@wildo-ai/saas-frontend-lib 1.0.1 → 1.1.0

package/dist/esm/components/auth/Auth_OAuthConsent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthConsent.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,+DAA+D,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EACL,wBAAwB,GAEzB,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AAEH,sGAAsG;AACtG,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG;IAC3B,eAAe;IACf,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,UAAU;IACV,OAAO;IACP,OAAO;CACC,CAAC;AAeX,oGAAoG;AACpG,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,MAAoD,EACjC,EAAE;IACrB,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,4BAA4B,EAAE,CAAC,CAAC;IAC3G,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,SAAS,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAClF,gGAAgG;IAChG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAA+B,IAAI,CAAC,CAAC;IACjF,oGAAoG;IACpG,oDAAoD;IACpD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAC;IAEtC,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,MAA+B,EAAU,EAAE,CACjE,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9E,kGAAkG;IAClG,4FAA4F;IAC5F,oGAAoG;IACpG,mGAAmG;IACnG,uFAAuF;IACvF,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,kGAAkG;IAClG,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,2DAA2D;IAC3D,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,yDAAyD;QACnF,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,wBAAwB,EAAE;aACvB,qBAAqB,CAAC,eAAe,CAAC;aACtC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjB,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,QAAQ,IAAI,kBAAkB,IAAI,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACtG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,QAAQ,IAAI,aAAa,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzE,6FAA6F;gBAC7F,gGAAgG;gBAChG,sFAAsF;gBACtF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnB,aAAa,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACrD,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,aAAa,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,QAA4B,EAAE,EAAE;QACrC,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC9C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAC3E,OAAO,CAAC,aAAa,EACrB,QAAQ;YACR,6EAA6E;YAC7E,QAAQ,KAAK,SAAS,IAAI,QAAQ,CACnC,CAAC;YACF,4FAA4F;YAC5F,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;YAC5F,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,aAAa,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,yFAAyF;IACzF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,QAAQ,EAAE,gBAAgB,CAAC,YAAY;YACvC,MAAM,EAAE,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,SAAG,CAAC;IAC5F,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,OAAO,CACL,cAAK,SAAS,EAAC,+BAA+B,YAC5C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CACL,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,UAAU,IAAI,qBAAqB,CAAC,aAAa,CAAC,GAAoB,GACrF,CACT,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAW,EACxF,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAQ,IAC1E,EAEL,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5B,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,IAAI,IAAC,SAAS,EAAC,aAAa,YAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAQ,EAC5E,aAAI,SAAS,EAAC,iBAAiB,YAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC7B,uBACE,KAAC,IAAI,cAAE,KAAK,GAAQ,IADb,KAAK,CAET,CACN,CAAC,GACC,IACD,CACP,EAEA,OAAO,CAAC,QAAQ,IAAI,CACnB,KAAC,IAAI,IAAC,SAAS,EAAC,mBAAmB,YAAE,CAAC,CAAC,qBAAqB,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAQ,CACrH,EAED,iBAAO,SAAS,EAAC,8CAA8C,aAC7D,KAAC,YAAY,IAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,CAAC,GAAI,EACpF,KAAC,IAAI,cAAE,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAQ,IAC1C,EAER,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAC,QAAQ,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAE5B,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,GACvB,EACT,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAC,QAAQ,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,YAE/B,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAC1B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EAC4D;IACpE,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,4BAA4B,EAClD,mBAAmB,CACpB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, UserOAuthConsentLabel } from '@wildo-ai/presets-components-models';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { CheckboxRoot } from '~wildo-frontend-lib/components/form/controls/boolean/checkbox';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport {\n  getManualCallsHttpClient,\n  type OAuthConsentRequiredResponse,\n} from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  buildAuthRedirectTarget,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\n\n/**\n * OIDC interactive-consent screen (S1) — the body rendered by {@link AuthPage_OAuthConsent}.\n *\n * FLOW (Bearer-authed SPA, NOT a server-rendered page — see the backend `handleConsentDecision`\n * JSDoc): a third-party client redirects the browser here with the OAuth authorize query. This\n * component forwards that query to `GET /oauth/authorize` (Bearer auto-attached) → the backend\n * returns `consent_required` + a single-use consent token + the requesting client / scopes / agent\n * resource. On Approve/Deny it POSTs `{consent_token, decision}` to `/oauth/authorize/decision`,\n * which returns `{ redirect_to }`; the app then `window.location.assign(redirect_to)` to complete the\n * OAuth redirect back to the client (carrying the `code` on approve, `error=access_denied` on deny).\n *\n * Copy is resolved through {@link UserOAuthConsentLabel} (component\n * `PUBLIC_LAYOUTS_OAUTH_CONSENT`) via {@link useI18n}; the label metadata lives in the\n * companion-scanned `Auth_OAuthConsent.labels.ts`.\n */\n\n// The authorize params this screen forwards verbatim to `GET /oauth/authorize`; the backend validates\n// them (client/redirect allowlist, PKCE). Anything else in the URL is ignored.\nconst AUTHORIZE_PARAM_KEYS = [\n  'response_type',\n  'client_id',\n  'redirect_uri',\n  'code_challenge',\n  'code_challenge_method',\n  'scope',\n  'resource',\n  'state',\n  'nonce',\n] as const;\n\ntype ConsentStatus = 'loading' | 'ready' | 'submitting' | 'error';\n\n/**\n * Props for the consent screen preset. The screen is self-driven from the authorize query\n * (`useSearchParams`) and the session (`useUserOrgs`), so it takes no external props — this interface\n * exists to satisfy the preset-wrapper contract (preset resolution + the frontend-component spec)\n * shared by every `PUBLIC_LAYOUTS` auth page.\n */\nexport interface PublicLayoutPreset_OAuthConsent_DefaultProps {\n  /** Reserved: the consent screen is URL/session-driven and currently accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/** Default preset implementation for {@link FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT}. */\nexport const PublicLayoutPreset_OAuthConsent_Default = (\n  _props: PublicLayoutPreset_OAuthConsent_DefaultProps,\n): React.JSX.Element => {\n  const { auth } = useUserOrgs();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConsentStatus>('loading');\n  const [consent, setConsent] = useState<OAuthConsentRequiredResponse | null>(null);\n  // The error is held as a label KEY (not resolved copy) so it stays i18n-clean and translatable.\n  const [errorLabel, setErrorLabel] = useState<UserOAuthConsentLabel | null>(null);\n  // Item 3 \"remember this app\" — opt-in (default off): on approve, stores a durable grant so a future\n  // authorize with covering scopes skips this screen.\n  const [remember, setRemember] = useState(false);\n\n  const accessToken = auth?.accessToken;\n\n  const t = (key: string, params?: Record<string, string>): string =>\n    tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT, key, params);\n\n  // Stale-closure-proof single-flight guard for the decision POST. The buttons already unmount when\n  // `status` flips to 'submitting' (see the render below) and the consent token is single-use\n  // server-side, but a synchronous double-dispatch could still fire two POSTs before React re-renders\n  // — a `status === 'submitting'` check would read the captured (stale) 'ready' in that window, so a\n  // ref (set synchronously at the top of `decide`) is the only reliable in-flight latch.\n  const submittingRef = useRef(false);\n\n  // The authorize query, filtered to the known OAuth params (verbatim pass-through to the backend).\n  const authorizeParams = useMemo(() => {\n    const params = new URLSearchParams();\n    for (const key of AUTHORIZE_PARAM_KEYS) {\n      const value = searchParams.get(key);\n      if (value) params.set(key, value);\n    }\n    return params;\n  }, [searchParams]);\n\n  // Load the consent request once the user is authenticated.\n  useEffect(() => {\n    if (!accessToken) return; // the Navigate guard below sends the user to login first\n    let cancelled = false;\n    setStatus('loading');\n    setErrorLabel(null);\n    getManualCallsHttpClient()\n      .oauthAuthorizeConsent(authorizeParams)\n      .then((response) => {\n        if (cancelled) return;\n        if (response && 'consent_required' in response && response.consent_required && response.consent_token) {\n          setConsent(response);\n          setStatus('ready');\n        } else if (response && 'redirect_to' in response && response.redirect_to) {\n          // Trusted (non-`requiresConsent`) client — the backend already minted the code; complete the\n          // OAuth redirect back to the client WITHOUT a consent screen. (`window.location.assign` because\n          // the redirect target is cross-origin; the XHR could not have followed a 302 itself.)\n          window.location.assign(response.redirect_to);\n        } else {\n          setStatus('error');\n          setErrorLabel(UserOAuthConsentLabel.ERROR_INVALID);\n        }\n      })\n      .catch(() => {\n        if (cancelled) return;\n        setStatus('error');\n        setErrorLabel(UserOAuthConsentLabel.ERROR_LOAD);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [accessToken, authorizeParams]);\n\n  const decide = useCallback(\n    async (decision: 'approve' | 'deny') => {\n      if (!consent || submittingRef.current) return;\n      submittingRef.current = true;\n      setStatus('submitting');\n      setErrorLabel(null);\n      try {\n        const { redirect_to } = await getManualCallsHttpClient().oauthConsentDecision(\n          consent.consent_token,\n          decision,\n          // Only an APPROVE meaningfully \"remembers\"; a deny sends `false` harmlessly.\n          decision === 'approve' && remember,\n        );\n        // Complete the OAuth redirect back to the third-party client (carries `code` or the error).\n        window.location.assign(redirect_to);\n      } catch {\n        // Release the latch so the user can retry (the token is unconsumed on a transport failure).\n        submittingRef.current = false;\n        setStatus('error');\n        setErrorLabel(UserOAuthConsentLabel.ERROR_DECISION);\n      }\n    },\n    [consent, remember],\n  );\n\n  // Not authenticated → send to login, returning to this exact consent request afterwards.\n  if (!accessToken) {\n    const target = buildAuthRedirectTarget({\n      pathname: CommonRoutePaths.oauthConsent,\n      search: `?${searchParams.toString()}`,\n    });\n    return <Navigate to={appendAuthRedirectToPath(CommonRoutePaths.login, target)} replace />;\n  }\n\n  if (status === 'loading' || status === 'submitting' || !isReady) {\n    return (\n      <div className=\"py-region flex justify-center\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  if (status === 'error' || !consent) {\n    return (\n      <Alert variant=\"destructive\">\n        <AlertDescription>{t(errorLabel ?? UserOAuthConsentLabel.ERROR_GENERIC)}</AlertDescription>\n      </Alert>\n    );\n  }\n\n  return (\n    <div className=\"space-y-group\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>{t(UserOAuthConsentLabel.TITLE, { clientName: consent.client.name })}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(UserOAuthConsentLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {consent.scopes.length > 0 && (\n        <div className=\"space-y-element\">\n          <Text className=\"font-medium\">{t(UserOAuthConsentLabel.SCOPES_INTRO)}</Text>\n          <ul className=\"space-y-item-xs\">\n            {consent.scopes.map((scope) => (\n              <li key={scope}>\n                <Text>{scope}</Text>\n              </li>\n            ))}\n          </ul>\n        </div>\n      )}\n\n      {consent.resource && (\n        <Text className=\"text-sm break-all\">{t(UserOAuthConsentLabel.AGENT_ENDPOINT, { resource: consent.resource })}</Text>\n      )}\n\n      <label className=\"flex items-center gap-item-xs cursor-pointer\">\n        <CheckboxRoot checked={remember} onCheckedChange={(c) => setRemember(c === true)} />\n        <Text>{t(UserOAuthConsentLabel.REMEMBER)}</Text>\n      </label>\n\n      <div className=\"flex gap-element\">\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          className=\"flex-1\"\n          onClick={() => decide('deny')}\n        >\n          {t(UserOAuthConsentLabel.DENY)}\n        </Button>\n        <Button\n          variant={ButtonVariants_Variant.DEFAULT}\n          className=\"flex-1\"\n          onClick={() => decide('approve')}\n        >\n          {t(UserOAuthConsentLabel.APPROVE)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\n/**\n * Preset-resolving wrapper for the OIDC consent screen (mirrors every other `PUBLIC_LAYOUTS` auth\n * page). Resolves `PUBLIC_LAYOUTS_OAUTH_CONSENT` to its registered preset (default =\n * {@link PublicLayoutPreset_OAuthConsent_Default}) so an application can swap in a branded consent UI\n * via the component registry. {@link AuthPage_OAuthConsent} renders this wrapper.\n */\nexport function Auth_OAuthConsent({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthConsent_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthConsent_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT,\n    'Auth_OAuthConsent',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthConsent.labels.d.ts

@@ -0,0 +1,3 @@
+import { type LabellingUnitaryDef } from '@wildo-ai/presets-components-models';
+export declare const PublicLayoutsOAuthConsentLabels: LabellingUnitaryDef[];
+//# sourceMappingURL=Auth_OAuthConsent.labels.d.ts.map

package/dist/esm/components/auth/Auth_OAuthConsent.labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthConsent.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAQ7C,eAAO,MAAM,+BAA+B,EAAE,mBAAmB,EA0DhE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthConsent.labels.js

@@ -0,0 +1,67 @@
+import { FrontendComponentType, LabelKind, registerComponentLabels, UserOAuthConsentLabel, } from '@wildo-ai/presets-components-models';
+// Companion-only label metadata for the OIDC interactive-consent screen: keys +
+// params + per-key purpose / kind. Statically scanned by the dev companion to
+// plan `components.PUBLIC_LAYOUTS_OAUTH_CONSENT.*` label generation; NOT imported
+// at runtime, so these description strings never ship in the browser bundle (see
+// `labels-bundle-isolation.test.ts`).
+export const PublicLayoutsOAuthConsentLabels = [
+    {
+        ref: UserOAuthConsentLabel.TITLE,
+        kind: LabelKind.HEADING,
+        params: [{ key: 'clientName', meaning: 'display name of the third-party application requesting access (e.g. "Acme Assistant")' }],
+        purpose: 'Heading telling the user that a named third-party application wants to act on their behalf',
+    },
+    {
+        ref: UserOAuthConsentLabel.SUB_TITLE,
+        kind: LabelKind.DESCRIPTION,
+        purpose: 'Supporting line explaining that approving delegates the user\'s own access to the application',
+    },
+    {
+        ref: UserOAuthConsentLabel.SCOPES_INTRO,
+        kind: LabelKind.LABEL,
+        purpose: 'Label introducing the list of scopes / permissions the application is requesting',
+    },
+    {
+        ref: UserOAuthConsentLabel.AGENT_ENDPOINT,
+        kind: LabelKind.LABEL,
+        params: [{ key: 'resource', meaning: 'the agent endpoint URL the delegated token will be bound to (RFC 8707 resource indicator)' }],
+        purpose: 'Shows the specific agent endpoint the delegated access is confined to',
+    },
+    {
+        ref: UserOAuthConsentLabel.APPROVE,
+        kind: LabelKind.BUTTON,
+        purpose: 'Button that grants the application delegated access on the user\'s behalf',
+    },
+    {
+        ref: UserOAuthConsentLabel.DENY,
+        kind: LabelKind.BUTTON,
+        purpose: 'Button that refuses the authorization request',
+    },
+    {
+        ref: UserOAuthConsentLabel.REMEMBER,
+        kind: LabelKind.LABEL,
+        purpose: 'Checkbox label letting the user remember this application for these scopes so they are not asked to approve it again on future sign-ins',
+    },
+    {
+        ref: UserOAuthConsentLabel.ERROR_INVALID,
+        kind: LabelKind.MESSAGE,
+        purpose: 'Error shown when the authorization request payload is present but could not be interpreted',
+    },
+    {
+        ref: UserOAuthConsentLabel.ERROR_LOAD,
+        kind: LabelKind.MESSAGE,
+        purpose: 'Error shown when the authorization request is invalid or expired and must be restarted from the application',
+    },
+    {
+        ref: UserOAuthConsentLabel.ERROR_DECISION,
+        kind: LabelKind.MESSAGE,
+        purpose: 'Error shown when the approve/deny decision could not be recorded and the user should retry from the application',
+    },
+    {
+        ref: UserOAuthConsentLabel.ERROR_GENERIC,
+        kind: LabelKind.MESSAGE,
+        purpose: 'Generic fallback error shown when the consent screen fails unexpectedly',
+    },
+];
+registerComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT, PublicLayoutsOAuthConsentLabels);
+//# sourceMappingURL=Auth_OAuthConsent.labels.js.map

package/dist/esm/components/auth/Auth_OAuthConsent.labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthConsent.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,qCAAqC,CAAC;AAE7C,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,sCAAsC;AAEtC,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE;QACE,GAAG,EAAE,qBAAqB,CAAC,KAAK;QAChC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC;QACjI,OAAO,EAAE,4FAA4F;KACtG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,SAAS;QACpC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,+FAA+F;KACzG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,YAAY;QACvC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,cAAc;QACzC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC;QACnI,OAAO,EAAE,uEAAuE;KACjF;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,OAAO;QAClC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,IAAI;QAC/B,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,+CAA+C;KACzD;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,QAAQ;QACnC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EAAE,yIAAyI;KACnJ;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,aAAa;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,4FAA4F;KACtG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,UAAU;QACrC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6GAA6G;KACvH;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,cAAc;QACzC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,iHAAiH;KAC3H;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,aAAa;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,yEAAyE;KACnF;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  registerComponentLabels,\n  UserOAuthConsentLabel,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC interactive-consent screen: keys +\n// params + per-key purpose / kind. Statically scanned by the dev companion to\n// plan `components.PUBLIC_LAYOUTS_OAUTH_CONSENT.*` label generation; NOT imported\n// at runtime, so these description strings never ship in the browser bundle (see\n// `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthConsentLabels: LabellingUnitaryDef[] = [\n  {\n    ref: UserOAuthConsentLabel.TITLE,\n    kind: LabelKind.HEADING,\n    params: [{ key: 'clientName', meaning: 'display name of the third-party application requesting access (e.g. \"Acme Assistant\")' }],\n    purpose: 'Heading telling the user that a named third-party application wants to act on their behalf',\n  },\n  {\n    ref: UserOAuthConsentLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that approving delegates the user\\'s own access to the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.SCOPES_INTRO,\n    kind: LabelKind.LABEL,\n    purpose: 'Label introducing the list of scopes / permissions the application is requesting',\n  },\n  {\n    ref: UserOAuthConsentLabel.AGENT_ENDPOINT,\n    kind: LabelKind.LABEL,\n    params: [{ key: 'resource', meaning: 'the agent endpoint URL the delegated token will be bound to (RFC 8707 resource indicator)' }],\n    purpose: 'Shows the specific agent endpoint the delegated access is confined to',\n  },\n  {\n    ref: UserOAuthConsentLabel.APPROVE,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that grants the application delegated access on the user\\'s behalf',\n  },\n  {\n    ref: UserOAuthConsentLabel.DENY,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that refuses the authorization request',\n  },\n  {\n    ref: UserOAuthConsentLabel.REMEMBER,\n    kind: LabelKind.LABEL,\n    purpose: 'Checkbox label letting the user remember this application for these scopes so they are not asked to approve it again on future sign-ins',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_INVALID,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the authorization request payload is present but could not be interpreted',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_LOAD,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the authorization request is invalid or expired and must be restarted from the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_DECISION,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the approve/deny decision could not be recorded and the user should retry from the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_GENERIC,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Generic fallback error shown when the consent screen fails unexpectedly',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT, PublicLayoutsOAuthConsentLabels);\n"]}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.d.ts

@@ -0,0 +1,20 @@
+import React from 'react';
+import { ComponentPresetProps } from '../../core/components-registry/component-registry.frontend.schemas';
+/**
+ * OIDC RP-Initiated Logout landing screen (§5) — the body rendered by {@link AuthPage_OAuthLoggedOut}.
+ *
+ * Shown after `GET /oauth/end-session` terminated the End-User's OP session when the request carried NO
+ * valid `post_logout_redirect_uri` (a request WITH a registered one is redirected straight back to the
+ * relying party instead — RP-Initiated Logout 1.0 §3). Purely informational: the session is already ended
+ * server-side (revocation-C per-session fence) by the time the browser lands here, so this page only
+ * confirms it and offers a route back to sign-in. No query params, no backend call, no state to drive.
+ *
+ * Copy is resolved through {@link OAuthLoggedOutLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT`) via
+ * {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLoggedOut.labels.ts`.
+ */
+export interface PublicLayoutPreset_OAuthLoggedOut_DefaultProps {
+    readonly _selfDriven?: never;
+}
+export declare const PublicLayoutPreset_OAuthLoggedOut_Default: (_props: PublicLayoutPreset_OAuthLoggedOut_DefaultProps) => React.JSX.Element;
+export declare function Auth_OAuthLoggedOut({ preset, ...props }: PublicLayoutPreset_OAuthLoggedOut_DefaultProps & ComponentPresetProps): React.JSX.Element;
+//# sourceMappingURL=Auth_OAuthLoggedOut.d.ts.map

package/dist/esm/components/auth/Auth_OAuthLoggedOut.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthLoggedOut.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAGxH;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,eAAO,MAAM,yCAAyC,GAAI,QAAQ,8CAA8C,KAAG,KAAK,CAAC,GAAG,CAAC,OAyB5H,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,8CAA8C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAM5K"}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.js

@@ -0,0 +1,25 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useNavigate } from 'react-router-dom';
+import { CorePresetNames, FrontendComponentType, OAuthLoggedOutLabel } from '@wildo-ai/presets-components-models';
+import { useI18n } from '../../core/i18n/useI18n.js';
+import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
+import { Button, ButtonVariants_Variant } from '../../components/actions/button.js';
+import { Heading } from '../../components/typography/heading.js';
+import { Text } from '../../components/typography/text.js';
+import { LoadingSpinner } from '../../components/feedback/loading-spinner.js';
+import { createComponentResolver } from '../../core/components-registry/component-resolver.frontend.helper.js';
+export const PublicLayoutPreset_OAuthLoggedOut_Default = (_props) => {
+    const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT });
+    const navigate = useNavigate();
+    const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, key);
+    // Component i18n sections load lazily; gate on `isReady` so the user never sees a flash of raw label keys.
+    if (!isReady) {
+        return (_jsx("div", { className: "flex justify-center py-section", children: _jsx(LoadingSpinner, {}) }));
+    }
+    return (_jsxs("div", { className: "text-center space-y-group py-section", children: [_jsxs("div", { className: "space-y-item-xs", children: [_jsx(Heading, { children: t(OAuthLoggedOutLabel.TITLE) }), _jsx(Text, { className: "text-muted-foreground max-w-sm mx-auto", children: t(OAuthLoggedOutLabel.SUB_TITLE) })] }), _jsx(Button, { variant: ButtonVariants_Variant.DEFAULT, className: "w-full", onClick: () => navigate(CommonRoutePaths.login), children: t(OAuthLoggedOutLabel.RETURN_TO_SIGN_IN) })] }));
+};
+export function Auth_OAuthLoggedOut({ preset = CorePresetNames.DEFAULT, ...props }) {
+    const Component = createComponentResolver(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, 'Auth_OAuthLoggedOut')(preset);
+    return _jsx(Component, { ...props });
+}
+//# sourceMappingURL=Auth_OAuthLoggedOut.js.map

package/dist/esm/components/auth/Auth_OAuthLoggedOut.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthLoggedOut.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAqB1H,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,MAAsD,EAAqB,EAAE;IACrI,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAE1G,2GAA2G;IAC3G,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAW,EACjD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAQ,IAC9F,EACN,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAChH,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,GAClC,IACL,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyE;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,+BAA+B,EACrD,qBAAqB,CACtB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React from 'react';\nimport { useNavigate } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLoggedOutLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout landing screen (§5) — the body rendered by {@link AuthPage_OAuthLoggedOut}.\n *\n * Shown after `GET /oauth/end-session` terminated the End-User's OP session when the request carried NO\n * valid `post_logout_redirect_uri` (a request WITH a registered one is redirected straight back to the\n * relying party instead — RP-Initiated Logout 1.0 §3). Purely informational: the session is already ended\n * server-side (revocation-C per-session fence) by the time the browser lands here, so this page only\n * confirms it and offers a route back to sign-in. No query params, no backend call, no state to drive.\n *\n * Copy is resolved through {@link OAuthLoggedOutLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT`) via\n * {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLoggedOut.labels.ts`.\n */\n\n// The screen is self-contained (no authorize query, no session), so it takes no external props; this\n// interface exists to satisfy the preset-wrapper contract shared by every `PUBLIC_LAYOUTS` auth page.\nexport interface PublicLayoutPreset_OAuthLoggedOut_DefaultProps {\n  readonly _selfDriven?: never;\n}\n\nexport const PublicLayoutPreset_OAuthLoggedOut_Default = (_props: PublicLayoutPreset_OAuthLoggedOut_DefaultProps): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT });\n  const navigate = useNavigate();\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, key);\n\n  // Component i18n sections load lazily; gate on `isReady` so the user never sees a flash of raw label keys.\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLoggedOutLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLoggedOutLabel.SUB_TITLE)}</Text>\n      </div>\n      <Button variant={ButtonVariants_Variant.DEFAULT} className=\"w-full\" onClick={() => navigate(CommonRoutePaths.login)}>\n        {t(OAuthLoggedOutLabel.RETURN_TO_SIGN_IN)}\n      </Button>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLoggedOut({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OAuthLoggedOut_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLoggedOut_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT,\n    'Auth_OAuthLoggedOut',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.labels.d.ts

@@ -0,0 +1,3 @@
+import { type LabellingUnitaryDef } from '@wildo-ai/presets-components-models';
+export declare const PublicLayoutsOAuthLoggedOutLabels: LabellingUnitaryDef[];
+//# sourceMappingURL=Auth_OAuthLoggedOut.labels.d.ts.map

package/dist/esm/components/auth/Auth_OAuthLoggedOut.labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthLoggedOut.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,iCAAiC,EAAE,mBAAmB,EAgBlE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.labels.js

@@ -0,0 +1,24 @@
+import { FrontendComponentType, LabelKind, OAuthLoggedOutLabel, registerComponentLabels, } from '@wildo-ai/presets-components-models';
+// Companion-only label metadata for the OIDC RP-Initiated Logout landing screen: keys +
+// per-key purpose / kind. Statically scanned by the dev companion to plan
+// `components.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT.*` label generation; NOT imported at runtime,
+// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).
+export const PublicLayoutsOAuthLoggedOutLabels = [
+    {
+        ref: OAuthLoggedOutLabel.TITLE,
+        kind: LabelKind.HEADING,
+        purpose: 'Heading confirming to the user that they have been signed out of the application',
+    },
+    {
+        ref: OAuthLoggedOutLabel.SUB_TITLE,
+        kind: LabelKind.DESCRIPTION,
+        purpose: 'Supporting line reassuring the user their session has ended and it is safe to close this tab, or that they can sign in again',
+    },
+    {
+        ref: OAuthLoggedOutLabel.RETURN_TO_SIGN_IN,
+        kind: LabelKind.BUTTON,
+        purpose: 'Button that takes the user back to the sign-in page to start a new session',
+    },
+];
+registerComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, PublicLayoutsOAuthLoggedOutLabels);
+//# sourceMappingURL=Auth_OAuthLoggedOut.labels.js.map

package/dist/esm/components/auth/Auth_OAuthLoggedOut.labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthLoggedOut.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,wFAAwF;AACxF,0EAA0E;AAC1E,4FAA4F;AAC5F,yGAAyG;AAEzG,MAAM,CAAC,MAAM,iCAAiC,GAA0B;IACtE;QACE,GAAG,EAAE,mBAAmB,CAAC,KAAK;QAC9B,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,SAAS;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,8HAA8H;KACxI;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,4EAA4E;KACtF;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLoggedOutLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout landing screen: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLoggedOutLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLoggedOutLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading confirming to the user that they have been signed out of the application',\n  },\n  {\n    ref: OAuthLoggedOutLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line reassuring the user their session has ended and it is safe to close this tab, or that they can sign in again',\n  },\n  {\n    ref: OAuthLoggedOutLabel.RETURN_TO_SIGN_IN,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that takes the user back to the sign-in page to start a new session',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, PublicLayoutsOAuthLoggedOutLabels);\n"]}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.d.ts

@@ -0,0 +1,27 @@
+import React from 'react';
+import { ComponentPresetProps } from '../../core/components-registry/component-registry.frontend.schemas';
+/**
+ * OIDC RP-Initiated Logout §6 confirmation prompt — the body rendered by {@link AuthPage_OAuthLogoutConfirm}.
+ *
+ * FLOW: `GET /oauth/end-session` redirects the browser here (with a single-use `token` query param) for a
+ * NON-trusted logout — everything EXCEPT a trusted RP presenting a valid `id_token_hint` AND an exact-match
+ * registered `post_logout_redirect_uri`, which is logged out directly without a prompt (the Keycloak-style
+ * posture). This page asks the End-User to confirm BEFORE the session is terminated, mitigating BROWSER-based
+ * logout CSRF (RP-Initiated Logout 1.0 §6; a cross-origin page cannot read the token to complete the confirm —
+ * see the backend `handleEndSessionConfirm` threat model). On CONFIRM it POSTs the token to `POST /oauth/end-session/confirm`,
+ * which terminates the session and returns `{ redirect_to }` (the signed-out page `/oauth/logged-out`); on
+ * CANCEL nothing is terminated and the user returns to the app.
+ *
+ * Token-driven, not session-driven: the End-User may be unauthenticated in this SPA (they arrived via an RP
+ * redirect), so this page never gates on a Bearer — the opaque `token` is the whole credential.
+ *
+ * Copy is resolved through {@link OAuthLogoutConfirmLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM`)
+ * via {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLogoutConfirm.labels.ts`.
+ */
+export interface PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps {
+    /** Reserved: the confirm screen is driven by the `token` query param and accepts no props. */
+    readonly _selfDriven?: never;
+}
+export declare const PublicLayoutPreset_OAuthLogoutConfirm_Default: (_props: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps) => React.JSX.Element;
+export declare function Auth_OAuthLogoutConfirm({ preset, ...props }: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps & ComponentPresetProps): React.JSX.Element;
+//# sourceMappingURL=Auth_OAuthLogoutConfirm.d.ts.map

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthLogoutConfirm.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAiD,MAAM,OAAO,CAAC;AAWtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAGxH;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,kDAAkD;IACjE,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAgBD,eAAO,MAAM,6CAA6C,GACxD,QAAQ,kDAAkD,KACzD,KAAK,CAAC,GAAG,CAAC,OAuEZ,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,EACtC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,kDAAkD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAM/F"}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.js

@@ -0,0 +1,73 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useMemo, useRef, useState } from 'react';
+import { Navigate, useSearchParams } from 'react-router-dom';
+import { CorePresetNames, FrontendComponentType, OAuthLogoutConfirmLabel } from '@wildo-ai/presets-components-models';
+import { useI18n } from '../../core/i18n/useI18n.js';
+import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
+import { Button, ButtonVariants_Variant } from '../../components/actions/button.js';
+import { Heading } from '../../components/typography/heading.js';
+import { Text } from '../../components/typography/text.js';
+import { Alert, AlertDescription } from '../../components/overlays/containers/alert.js';
+import { LoadingSpinner } from '../../components/feedback/loading-spinner.js';
+import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+import { createComponentResolver } from '../../core/components-registry/component-resolver.frontend.helper.js';
+/**
+ * The prompt's local interaction state. A named runtime source rather than a literal union so each
+ * member can carry WHY it exists — `ERROR` in particular is reached only by a stale/expired token,
+ * which is a normal outcome here (the token is single-use and short-TTL), not a fault.
+ */
+var ConfirmStatus;
+(function (ConfirmStatus) {
+    /** Waiting for the End-User to decide. */
+    ConfirmStatus["READY"] = "ready";
+    /** The confirm POST is in flight; both buttons are disabled to keep the single-use token single-use. */
+    ConfirmStatus["SUBMITTING"] = "submitting";
+    /** The confirmation token was stale, expired or already used — the user may start the logout again. */
+    ConfirmStatus["ERROR"] = "error";
+})(ConfirmStatus || (ConfirmStatus = {}));
+export const PublicLayoutPreset_OAuthLogoutConfirm_Default = (_props) => {
+    const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM });
+    const [searchParams] = useSearchParams();
+    const [status, setStatus] = useState(ConfirmStatus.READY);
+    const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, key);
+    const token = useMemo(() => searchParams.get('token') ?? '', [searchParams]);
+    // Stale-closure-proof single-flight latch for the confirm POST (mirrors the consent screen): a
+    // synchronous double-dispatch could fire two POSTs before React re-renders, and the token is single-use.
+    const submittingRef = useRef(false);
+    const confirm = useCallback(async () => {
+        if (!token || submittingRef.current)
+            return;
+        submittingRef.current = true;
+        setStatus(ConfirmStatus.SUBMITTING);
+        try {
+            const { redirect_to } = await getManualCallsHttpClient().oauthEndSessionConfirm(token);
+            // Full navigation to the signed-out page (`window.location.assign`, mirroring the consent screen):
+            // the session is ending, so re-booting the SPA there is desirable — it drops any stale client state.
+            window.location.assign(redirect_to);
+        }
+        catch {
+            // The token is single-use + short-TTL; a failure means it is stale/expired. Release the latch and
+            // surface a retry-able error rather than stranding the user.
+            submittingRef.current = false;
+            setStatus(ConfirmStatus.ERROR);
+        }
+    }, [token]);
+    const cancel = useCallback(() => {
+        // Cancel = do NOT sign out. Return to the app home (the user keeps their session). A full navigation
+        // avoids leaving the single-use `token` in the SPA's in-memory history entry.
+        window.location.assign(CommonRoutePaths.home);
+    }, []);
+    if (!isReady) {
+        return (_jsx("div", { className: "flex justify-center py-section", children: _jsx(LoadingSpinner, {}) }));
+    }
+    // Reached without a token (bad link / direct hit) — there is nothing to confirm; send to the signed-out page.
+    if (!token) {
+        return _jsx(Navigate, { to: CommonRoutePaths.oauthLoggedOut, replace: true });
+    }
+    return (_jsxs("div", { className: "text-center space-y-group py-section", children: [_jsxs("div", { className: "space-y-item-xs", children: [_jsx(Heading, { children: t(OAuthLogoutConfirmLabel.TITLE) }), _jsx(Text, { className: "text-muted-foreground max-w-sm mx-auto", children: t(OAuthLogoutConfirmLabel.SUB_TITLE) })] }), status === ConfirmStatus.ERROR && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: t(OAuthLogoutConfirmLabel.ERROR) }) })), _jsxs("div", { className: "flex gap-element", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, className: "flex-1", disabled: status === ConfirmStatus.SUBMITTING, onClick: cancel, children: t(OAuthLogoutConfirmLabel.CANCEL) }), _jsx(Button, { variant: ButtonVariants_Variant.DEFAULT, className: "flex-1", disabled: status === ConfirmStatus.SUBMITTING, onClick: confirm, children: t(OAuthLogoutConfirmLabel.CONFIRM) })] })] }));
+};
+export function Auth_OAuthLogoutConfirm({ preset = CorePresetNames.DEFAULT, ...props }) {
+    const Component = createComponentResolver(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, 'Auth_OAuthLogoutConfirm')(preset);
+    return _jsx(Component, { ...props });
+}
+//# sourceMappingURL=Auth_OAuthLogoutConfirm.js.map

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthLogoutConfirm.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AA0B1H;;;;GAIG;AACH,IAAK,aAOJ;AAPD,WAAK,aAAa;IAChB,0CAA0C;IAC1C,gCAAe,CAAA;IACf,wGAAwG;IACxG,0CAAyB,CAAA;IACzB,uGAAuG;IACvG,gCAAe,CAAA;AACjB,CAAC,EAPI,aAAa,KAAb,aAAa,QAOjB;AAED,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAC3D,MAA0D,EACvC,EAAE;IACrB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAE9G,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,+FAA+F;IAC/F,yGAAyG;IACzG,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC5C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvF,mGAAmG;YACnG,qGAAqG;YACrG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kGAAkG;YAClG,6DAA6D;YAC7D,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,qGAAqG;QACrG,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,8GAA8G;IAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,cAAc,EAAE,OAAO,SAAG,CAAC;IACnE,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAQ,IAClG,EAEL,MAAM,KAAK,aAAa,CAAC,KAAK,IAAI,CACjC,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAoB,GACjE,CACT,EAED,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,YAC/H,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAC3B,EACT,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,YAChI,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAC5B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EACtC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EACkE;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,mCAAmC,EACzD,yBAAyB,CAC1B,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLogoutConfirmLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout §6 confirmation prompt — the body rendered by {@link AuthPage_OAuthLogoutConfirm}.\n *\n * FLOW: `GET /oauth/end-session` redirects the browser here (with a single-use `token` query param) for a\n * NON-trusted logout — everything EXCEPT a trusted RP presenting a valid `id_token_hint` AND an exact-match\n * registered `post_logout_redirect_uri`, which is logged out directly without a prompt (the Keycloak-style\n * posture). This page asks the End-User to confirm BEFORE the session is terminated, mitigating BROWSER-based\n * logout CSRF (RP-Initiated Logout 1.0 §6; a cross-origin page cannot read the token to complete the confirm —\n * see the backend `handleEndSessionConfirm` threat model). On CONFIRM it POSTs the token to `POST /oauth/end-session/confirm`,\n * which terminates the session and returns `{ redirect_to }` (the signed-out page `/oauth/logged-out`); on\n * CANCEL nothing is terminated and the user returns to the app.\n *\n * Token-driven, not session-driven: the End-User may be unauthenticated in this SPA (they arrived via an RP\n * redirect), so this page never gates on a Bearer — the opaque `token` is the whole credential.\n *\n * Copy is resolved through {@link OAuthLogoutConfirmLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM`)\n * via {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLogoutConfirm.labels.ts`.\n */\n\nexport interface PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps {\n  /** Reserved: the confirm screen is driven by the `token` query param and accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/**\n * The prompt's local interaction state. A named runtime source rather than a literal union so each\n * member can carry WHY it exists — `ERROR` in particular is reached only by a stale/expired token,\n * which is a normal outcome here (the token is single-use and short-TTL), not a fault.\n */\nenum ConfirmStatus {\n  /** Waiting for the End-User to decide. */\n  READY = 'ready',\n  /** The confirm POST is in flight; both buttons are disabled to keep the single-use token single-use. */\n  SUBMITTING = 'submitting',\n  /** The confirmation token was stale, expired or already used — the user may start the logout again. */\n  ERROR = 'error',\n}\n\nexport const PublicLayoutPreset_OAuthLogoutConfirm_Default = (\n  _props: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps,\n): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConfirmStatus>(ConfirmStatus.READY);\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, key);\n\n  const token = useMemo(() => searchParams.get('token') ?? '', [searchParams]);\n\n  // Stale-closure-proof single-flight latch for the confirm POST (mirrors the consent screen): a\n  // synchronous double-dispatch could fire two POSTs before React re-renders, and the token is single-use.\n  const submittingRef = useRef(false);\n\n  const confirm = useCallback(async () => {\n    if (!token || submittingRef.current) return;\n    submittingRef.current = true;\n    setStatus(ConfirmStatus.SUBMITTING);\n    try {\n      const { redirect_to } = await getManualCallsHttpClient().oauthEndSessionConfirm(token);\n      // Full navigation to the signed-out page (`window.location.assign`, mirroring the consent screen):\n      // the session is ending, so re-booting the SPA there is desirable — it drops any stale client state.\n      window.location.assign(redirect_to);\n    } catch {\n      // The token is single-use + short-TTL; a failure means it is stale/expired. Release the latch and\n      // surface a retry-able error rather than stranding the user.\n      submittingRef.current = false;\n      setStatus(ConfirmStatus.ERROR);\n    }\n  }, [token]);\n\n  const cancel = useCallback(() => {\n    // Cancel = do NOT sign out. Return to the app home (the user keeps their session). A full navigation\n    // avoids leaving the single-use `token` in the SPA's in-memory history entry.\n    window.location.assign(CommonRoutePaths.home);\n  }, []);\n\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  // Reached without a token (bad link / direct hit) — there is nothing to confirm; send to the signed-out page.\n  if (!token) {\n    return <Navigate to={CommonRoutePaths.oauthLoggedOut} replace />;\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLogoutConfirmLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLogoutConfirmLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {status === ConfirmStatus.ERROR && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{t(OAuthLogoutConfirmLabel.ERROR)}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"flex gap-element\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={cancel}>\n          {t(OAuthLogoutConfirmLabel.CANCEL)}\n        </Button>\n        <Button variant={ButtonVariants_Variant.DEFAULT} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={confirm}>\n          {t(OAuthLogoutConfirmLabel.CONFIRM)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLogoutConfirm({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM,\n    'Auth_OAuthLogoutConfirm',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.d.ts

@@ -0,0 +1,3 @@
+import { type LabellingUnitaryDef } from '@wildo-ai/presets-components-models';
+export declare const PublicLayoutsOAuthLogoutConfirmLabels: LabellingUnitaryDef[];
+//# sourceMappingURL=Auth_OAuthLogoutConfirm.labels.d.ts.map

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,qCAAqC,EAAE,mBAAmB,EA0BtE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.js

@@ -0,0 +1,34 @@
+import { FrontendComponentType, LabelKind, OAuthLogoutConfirmLabel, registerComponentLabels, } from '@wildo-ai/presets-components-models';
+// Companion-only label metadata for the OIDC RP-Initiated Logout §6 confirmation prompt: keys +
+// per-key purpose / kind. Statically scanned by the dev companion to plan
+// `components.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM.*` label generation; NOT imported at runtime,
+// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).
+export const PublicLayoutsOAuthLogoutConfirmLabels = [
+    {
+        ref: OAuthLogoutConfirmLabel.TITLE,
+        kind: LabelKind.HEADING,
+        purpose: 'Heading asking the user to confirm they want to sign out of the application',
+    },
+    {
+        ref: OAuthLogoutConfirmLabel.SUB_TITLE,
+        kind: LabelKind.DESCRIPTION,
+        purpose: 'Supporting line explaining that confirming will end their session on this application',
+    },
+    {
+        ref: OAuthLogoutConfirmLabel.CONFIRM,
+        kind: LabelKind.BUTTON,
+        purpose: 'Primary button that confirms the sign-out and ends the session',
+    },
+    {
+        ref: OAuthLogoutConfirmLabel.CANCEL,
+        kind: LabelKind.BUTTON,
+        purpose: 'Secondary button that cancels the sign-out and returns the user to the application',
+    },
+    {
+        ref: OAuthLogoutConfirmLabel.ERROR,
+        kind: LabelKind.DESCRIPTION,
+        purpose: 'Message shown when the confirmation link has expired or could not be processed, inviting the user to try signing out again',
+    },
+];
+registerComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, PublicLayoutsOAuthLogoutConfirmLabels);
+//# sourceMappingURL=Auth_OAuthLogoutConfirm.labels.js.map

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,gGAAgG;AAChG,0EAA0E;AAC1E,gGAAgG;AAChG,yGAAyG;AAEzG,MAAM,CAAC,MAAM,qCAAqC,GAA0B;IAC1E;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,SAAS;QACtC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,uFAAuF;KACjG;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,OAAO;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,MAAM;QACnC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,4HAA4H;KACtI;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLogoutConfirmLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout §6 confirmation prompt: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLogoutConfirmLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLogoutConfirmLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading asking the user to confirm they want to sign out of the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that confirming will end their session on this application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CONFIRM,\n    kind: LabelKind.BUTTON,\n    purpose: 'Primary button that confirms the sign-out and ends the session',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CANCEL,\n    kind: LabelKind.BUTTON,\n    purpose: 'Secondary button that cancels the sign-out and returns the user to the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.ERROR,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Message shown when the confirmation link has expired or could not be processed, inviting the user to try signing out again',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, PublicLayoutsOAuthLogoutConfirmLabels);\n"]}

package/dist/esm/components/auth/Auth_OneOffSession.d.ts

@@ -1,19 +1,72 @@
 import React from 'react';
-import { ComponentPresetProps } from '../../core/components-registry/component-registry.frontend.schemas.js';
+import { ComponentPresetProps } from '../../core/components-registry/component-registry.frontend.schemas';
+/**
+ * Receiver mode for `Auth_OneOffSession` (cross-app-jwt-propagation.md Step 5).
+ *
+ * Two distinct issuance flows land on this same UI shell; the mode prop
+ * dispatches to the right exchange handler and the right post-exchange
+ * URL-resolution strategy:
+ *
+ * - `'one-off-session'` — W7.3b ephemeral one-off session. The token is
+ *   consumed via `handleOneOffTokenExchange` (`POST /auth/one-off-session/exchange`),
+ *   which returns a context populated with `tokenType`, `scopedInitiatorIds`,
+ *   and `applicationId`. Post-exchange URL resolves via the resource
+ *   registry (matches an operation whose `tokenAuthentication.types` accepts
+ *   the consumed `tokenType`). Enforces `EphemeralSessionTokenStorage` to
+ *   prevent stomping a parent tab's authenticated session.
+ *
+ * - `'cross-frontend-handoff'` — Cross-app JWT propagation handoff. The
+ *   token is an AUTH_CODE_EXCHANGE consumable issued by
+ *   `POST /auth/cross-frontend-handoff` and consumed via
+ *   `handleAuthCodeExchange` (`POST /auth/token/exchange`, the same exchange
+ *   endpoint OAuth2 callback uses — see Step 4 integration test). The
+ *   exchange response surfaces `returnPath` into
+ *   `auth.crossFrontendHandoffContext`; we navigate there post-exchange
+ *   (with URL-query fallback as defense-in-depth). The ephemeral-storage
+ *   guard is intentionally skipped — per K-7, the receiver's storage
+ *   adapter (NOT the protocol) determines lifetime, and the SaaS app's
+ *   regular persistent storage is the correct landing for a session
+ *   transfer.
+ */
+export type AuthOneOffSessionMode = 'one-off-session' | 'cross-frontend-handoff';
 export interface PublicLayoutPreset_OneOffSession_DefaultProps {
+    /**
+     * The one-time consumable token to exchange. For `mode='one-off-session'`
+     * it comes from the `:token` URL path param; for `mode='cross-frontend-handoff'`
+     * it comes from the `?code=` query param (extracted by `AuthPage_AuthExchange`).
+     */
     token?: string;
+    /**
+     * Defaults to `'one-off-session'` to preserve backward compatibility with
+     * the W7.3b page wrapper that does not pass this prop.
+     */
+    mode?: AuthOneOffSessionMode;
+    /**
+     * Cross-frontend-handoff receiver: the `?return=` URL query param value,
+     * extracted by `AuthPage_AuthExchange`. Defense-in-depth fallback used
+     * ONLY when `auth.crossFrontendHandoffContext.returnPath` is missing
+     * (e.g. backend metadata round-trip failed for some reason). Sanitized
+     * before use.
+     */
+    returnPathFromUrl?: string;
 }
 /**
- * W7.3b: One-off session exchange default preset.
+ * cross-app-jwt-propagation.md Step 5 dual-mode receiver.
+ *
+ * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it
+ * via `handleOneOffTokenExchange`, and redirects to the target page resolved
+ * from `tokenType` + targeting via the resource registry, falling back to
+ * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).
  *
- * Follows the same pattern as Auth_ConfirmEmail:
- * extracts the consumable token, exchanges it via handleOneOffTokenExchange,
- * and redirects to the target page on success (resolved from tokenType + targeting),
- * or home as fallback.
+ * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,
+ * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,
+ * the same endpoint OAuth2 callback uses), and navigates to
+ * `auth.crossFrontendHandoffContext.returnPath` (preferred) or
+ * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage
+ * guard — the SaaS app's persistent storage is the correct landing per K-7.
  *
- * Guards against same-tab SPA navigation (storage must be ephemeral).
- * All user-facing strings are i18n-driven via OneOffSessionLabel.
+ * All user-facing strings are i18n-driven via `OneOffSessionLabel`.
  */
-export declare const PublicLayoutPreset_OneOffSession_Default: ({ token }: PublicLayoutPreset_OneOffSession_DefaultProps) => React.JSX.Element;
+export declare const PublicLayoutPreset_OneOffSession_Default: ({ token, mode, returnPathFromUrl, }: PublicLayoutPreset_OneOffSession_DefaultProps) => React.JSX.Element;
 export declare function Auth_OneOffSession({ preset, ...props }: PublicLayoutPreset_OneOffSession_DefaultProps & ComponentPresetProps): React.JSX.Element;
 //# sourceMappingURL=Auth_OneOffSession.d.ts.map

package/dist/esm/components/auth/Auth_OneOffSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAcpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAMxH,MAAM,WAAW,6CAA6C;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0DD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wCAAwC,GAAI,WAAW,6CAA6C,KAAG,KAAK,CAAC,GAAG,CAAC,OAmF7H,CAAC;AAGF,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,6CAA6C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG1K"}
+{"version":3,"file":"Auth_OneOffSession.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAepE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAQxH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC;AAEjF,MAAM,WAAW,6CAA6C;IAC5D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAmGD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wCAAwC,GAAI,qCAItD,6CAA6C,KAAG,KAAK,CAAC,GAAG,CAAC,OAgO5D,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,6CAA6C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG1K"}