@wildo-ai/saas-frontend-lib 1.0.1 → 1.1.0

package/dist/esm/components/auth/Auth_OneOffSession.js

@@ -1,6 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useMemo, useRef, useState } from 'react';
 import { Navigate } from 'react-router-dom';
+import { isOperationAddressable } from '../../core/resources/resources.frontend.schemas.js';
 import { useAuthSession } from '../../core/security/useAuthSession.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
@@ -12,17 +13,22 @@ import { Text } from '../../components/typography/text.js';
 import { Link } from '../../components/typography/link.js';
 import { Alert, AlertDescription } from '../../components/overlays/containers/alert.js';
 import { createComponentResolver } from '../../core/components-registry/component-resolver.frontend.helper.js';
-import { FrontendComponentType, CorePresetNames, OneOffSessionLabel } from '@wildo-ai/presets-components-models';
+import { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';
+import { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';
 import { LoadingSpinner } from '../../components/feedback/loading-spinner.js';
 /**
- * Resolves the target frontend URL from the token exchange context.
+ * Resolves the target frontend URL for a W7.3b one-off-session exchange.
  *
- * Searches the resource registry for an operation whose tokenAuthentication.types
- * includes the given tokenType, then builds a concrete URL using the targeting
- * initiatorIds as path parameters.
+ * Searches the resource registry for an operation whose `tokenAuthentication.types`
+ * includes the consumed `tokenType`, then builds a concrete URL using the
+ * targeting `initiatorIds` as path parameters.
  *
  * Returns undefined if no matching operation is found or URL cannot be resolved
- * (fallback to home).
+ * (caller falls back to home).
+ *
+ * NOT used for cross-frontend-handoff mode — that flow drives navigation off
+ * `auth.crossFrontendHandoffContext.returnPath`, see
+ * `resolveCrossFrontendHandoffUrl()` below.
  */
 function resolveTargetUrl(tokenType, initiatorIds, registry) {
     if (!initiatorIds || Object.keys(initiatorIds).length === 0)
@@ -33,7 +39,7 @@ function resolveTargetUrl(tokenType, initiatorIds, registry) {
         const ops = Array.isArray(rc.operations) ? rc.operations : [];
         for (const op of ops) {
             const tokenAuth = op.tokenAuthentication;
-            if (tokenAuth?.types?.includes(tokenType) && op.operationFrontendConfig?.isAddressable) {
+            if (tokenAuth?.types?.includes(tokenType) && isOperationAddressable(op.operationFrontendConfig)) {
                 matchedConfig = rc;
                 matchedOperation = op;
                 break;
@@ -58,53 +64,238 @@ function resolveTargetUrl(tokenType, initiatorIds, registry) {
     return result?.resolvedUrl ?? undefined;
 }
 /**
- * W7.3b: One-off session exchange default preset.
+ * Defense-in-depth sanitizer for `returnPath` values arriving at the receiver.
+ *
+ * The cross-frontend-handoff issuer schema (`CrossFrontendHandoff_ReturnPathSchema`
+ * in `cross-frontend-handoff.shared.dto.schemas.ts`) already validates the
+ * value at issuance time, AND the value flows through the consumable-token
+ * metadata round-trip — but a malicious caller could hand-craft an exchange
+ * URL bypassing the issuer entirely (`/auth/exchange?code=…&return=https://evil.com`).
+ * Without this guard the eventual `<Navigate to={…}>` would happily honour
+ * the open-redirect / XSS / path-traversal payload.
+ *
+ * The ORIGIN half of the question is answered by the shared
+ * {@link isSameOriginRedirectPath} predicate rather than by the character
+ * rules below, and that split is the fix for a real defect: this function,
+ * the docs-site `AuthExchangePage.sanitizeReturnPath()` and the issuer
+ * schema were three hand-written deny-lists that "mirrored" each other —
+ * and all three admitted `/<TAB>/evil.com`, because the URL parser strips
+ * ASCII tab / LF / CR before parsing, turning it into `//evil.com`. Every
+ * copy banned `\` and none banned the whitespace that becomes a `/`.
+ *
+ * The character rules are KEPT, as defence-in-depth for the concerns the
+ * origin predicate deliberately does not own: path traversal (`..`), markup
+ * injection (`<>"`) and the length ceiling.
+ */
+function sanitizeReturnPath(raw) {
+    if (!raw)
+        return CommonRoutePaths.home;
+    // Authoritative: does this actually resolve onto our own origin? Covers `//evil.com`,
+    // `/\evil.com` and the stripped-control-character family in one parse-based check.
+    if (!isSameOriginRedirectPath(raw))
+        return CommonRoutePaths.home;
+    if (raw.includes('..'))
+        return CommonRoutePaths.home;
+    if (raw.includes('\\'))
+        return CommonRoutePaths.home;
+    if (raw.includes('://'))
+        return CommonRoutePaths.home;
+    if (/[<>"]/.test(raw))
+        return CommonRoutePaths.home;
+    if (raw.length > 256)
+        return CommonRoutePaths.home;
+    return raw;
+}
+/**
+ * cross-app-jwt-propagation.md Step 5 dual-mode receiver.
+ *
+ * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it
+ * via `handleOneOffTokenExchange`, and redirects to the target page resolved
+ * from `tokenType` + targeting via the resource registry, falling back to
+ * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).
  *
- * Follows the same pattern as Auth_ConfirmEmail:
- * extracts the consumable token, exchanges it via handleOneOffTokenExchange,
- * and redirects to the target page on success (resolved from tokenType + targeting),
- * or home as fallback.
+ * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,
+ * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,
+ * the same endpoint OAuth2 callback uses), and navigates to
+ * `auth.crossFrontendHandoffContext.returnPath` (preferred) or
+ * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage
+ * guard — the SaaS app's persistent storage is the correct landing per K-7.
  *
- * Guards against same-tab SPA navigation (storage must be ephemeral).
- * All user-facing strings are i18n-driven via OneOffSessionLabel.
+ * All user-facing strings are i18n-driven via `OneOffSessionLabel`.
  */
-export const PublicLayoutPreset_OneOffSession_Default = ({ token }) => {
-    const { handleOneOffTokenExchange, auth, tokenStorage } = useAuthSession();
+export const PublicLayoutPreset_OneOffSession_Default = ({ token, mode = 'one-off-session', returnPathFromUrl, }) => {
+    const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();
     const { registry } = useResourceRegistry();
     const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });
     const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);
     const loginPath = CommonRoutePaths.login;
+    /**
+     * Receiver-LOCAL error state for THIS exchange attempt.
+     *
+     * L-9 (third deep-review pass): this field deliberately duplicates
+     * `auth.error` (set by `AuthSessionContext.handleAuthCodeExchange`'s catch
+     * block) rather than reading the shared field directly. Reasoning:
+     *
+     * - `auth.error` is process-wide across all auth surfaces (logout,
+     *   refresh-token rotation, magic-link verify, MFA verify, passkey
+     *   auth, etc. all write to it). If a parallel
+     *   call sets `auth.error` while THIS receiver's exchange is succeeding,
+     *   reading `auth.error` from the H-4 navigation gate would falsely
+     *   block the receiver from rendering `<Navigate>` — even though the
+     *   receiver's own exchange completed cleanly.
+     *
+     * - Local `error` is scoped to THIS receiver's exchange attempt
+     *   (set ONLY by the `.catch()` on the in-mount exchange Promise).
+     *   The H-4 gate checks `!error` (local) so navigation is blocked iff
+     *   THIS receiver's exchange failed, regardless of what other auth
+     *   surfaces are doing concurrently.
+     *
+     * If the AuthSessionContext error surface is ever refactored into per-
+     * call scoped errors, this duplication can collapse — but until then
+     * the duplication is load-bearing.
+     */
     const [error, setError] = useState(null);
     const exchangeAttemptedRef = useRef(false);
+    /**
+     * Gate `<Navigate>` until the exchange phase has resolved (success, failure,
+     * or intentionally skipped). Without this gate, a cross-frontend-handoff
+     * receiver mounted with a pre-existing `auth.accessToken` (cold-load from
+     * persistent storage) would render `<Navigate>` on the FIRST render —
+     * which commits and unmounts the component BEFORE this component's
+     * `useEffect` ever runs the AUTH_CODE_EXCHANGE consume call. The user
+     * would then land on the URL `?return=` value with their pre-existing
+     * session AND the consumable token would dangle in the store for 60s
+     * (auto-expiring without ever being consumed). See M-2 in the Step 5
+     * deep-review log on `cross-app-jwt-propagation.md`.
+     *
+     * Initial value is mode-dependent:
+     * - `one-off-session`: `true` IF accessToken is already set (preserve
+     *   the existing W7.3b "render Navigate immediately" semantics — the
+     *   ephemeral-storage guard fires for the in-tab case anyway).
+     * - `cross-frontend-handoff`: `false` always — we ALWAYS want the
+     *   exchange to run before navigating, even when `auth.accessToken` is
+     *   set, so the new tokens replace the existing session and the
+     *   `crossFrontendHandoffContext.returnPath` populates from the
+     *   exchange response (defense against silent auth-confusion when the
+     *   pre-existing session belongs to a different user than the handoff
+     *   was minted for).
+     */
+    const [exchangePhaseResolved, setExchangePhaseResolved] = useState(mode === 'one-off-session' && Boolean(auth.accessToken));
     const targetUrl = useMemo(() => {
-        if (!auth.oneOffContext || !auth.accessToken)
+        if (!auth.accessToken)
+            return CommonRoutePaths.home;
+        // Cross-frontend-handoff: navigate to `returnPath` from the exchange
+        // response (which round-tripped via the consumable-token metadata),
+        // falling back to the URL-query value as defense-in-depth. Both inputs
+        // pass through `sanitizeReturnPath` to defeat any open-redirect /
+        // path-traversal / XSS payload that may have bypassed the issuer schema.
+        if (mode === 'cross-frontend-handoff') {
+            const fromContext = auth.crossFrontendHandoffContext?.returnPath;
+            const candidate = fromContext ?? returnPathFromUrl;
+            return sanitizeReturnPath(candidate);
+        }
+        // W7.3b one-off session: walk the resource registry for an operation
+        // matching the consumed tokenType.
+        if (!auth.oneOffContext)
             return CommonRoutePaths.home;
         const resolved = resolveTargetUrl(auth.oneOffContext.tokenType, auth.oneOffContext.scopedInitiatorIds, registry);
         return resolved ?? CommonRoutePaths.home;
-    }, [auth.oneOffContext, auth.accessToken, registry]);
+    }, [
+        mode,
+        auth.oneOffContext,
+        auth.accessToken,
+        auth.crossFrontendHandoffContext,
+        returnPathFromUrl,
+        registry,
+    ]);
     useEffect(() => {
         if (exchangeAttemptedRef.current)
             return;
-        if (!(tokenStorage instanceof EphemeralSessionTokenStorage)) {
+        // Storage guard applies ONLY to W7.3b (one-off-session) mode. Cross-
+        // frontend-handoff intentionally lands in the receiver's regular tab
+        // with its regular (persistent or ephemeral, per receiver's adapter
+        // choice) storage — this is the protocol's whole point per K-7.
+        if (mode === 'one-off-session' && !(tokenStorage instanceof EphemeralSessionTokenStorage)) {
             exchangeAttemptedRef.current = true;
             setError(t(OneOffSessionLabel.ERROR_WRONG_TAB));
+            setExchangePhaseResolved(true);
             return;
         }
         if (!token) {
             exchangeAttemptedRef.current = true;
             setError(t(OneOffSessionLabel.ERROR_NO_TOKEN));
+            setExchangePhaseResolved(true);
             return;
         }
-        if (auth.accessToken) {
+        // Already-authenticated short-circuit applies ONLY to W7.3b
+        // (one-off-session) mode — there an existing parent session in the
+        // tab is the trigger for the ERROR_WRONG_TAB guard above (the
+        // ephemeral-storage check should have already fired), and burning
+        // a one-off code on an authenticated tab is wasteful.
+        //
+        // Cross-frontend-handoff mode must NOT short-circuit: the user
+        // explicitly initiated a session transfer on the source frontend
+        // (clicked "Open in docs" / similar). Skipping the exchange would:
+        //   (a) leave a 60-second dangling AUTH_CODE_EXCHANGE token in the
+        //       store (auto-expires, but uses the consumable-token budget and
+        //       muddies audit logs);
+        //   (b) navigate the user using the URL `?return=` value but with
+        //       their PRE-EXISTING session — which may be a different user
+        //       than the handoff was minted for, leading to the user landing
+        //       on `/api/organization/foo` as the wrong identity (silent
+        //       auth-confusion). Always consume the code so the new tokens
+        //       replace the existing ones.
+        if (auth.accessToken && mode === 'one-off-session') {
             exchangeAttemptedRef.current = true;
+            setExchangePhaseResolved(true);
             return;
         }
         exchangeAttemptedRef.current = true;
-        handleOneOffTokenExchange(token).catch((e) => {
+        const exchange = mode === 'cross-frontend-handoff'
+            ? handleAuthCodeExchange(token)
+            : handleOneOffTokenExchange(token);
+        exchange
+            .catch((e) => {
             setError(e?.message || t(OneOffSessionLabel.ERROR_GENERIC));
+        })
+            .finally(() => {
+            setExchangePhaseResolved(true);
         });
-    }, [token, auth.accessToken, handleOneOffTokenExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps
-    if (auth.accessToken && !auth.isLoading) {
+    }, [token, mode, auth.accessToken, handleOneOffTokenExchange, handleAuthCodeExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps
+    // Single-use cleanup of `auth.crossFrontendHandoffContext`. Runs on
+    // unmount, which happens AFTER `<Navigate to={targetUrl}>` resolves and
+    // React tears down the receiver. Earlier cleanup would race the
+    // `targetUrl` `useMemo` recomputation and could navigate to home instead
+    // of the intended `returnPath`. No-op for `one-off-session` mode (which
+    // never sets the field in the first place — `oneOffContext` is its
+    // sibling state and is preserved as part of the active session).
+    //
+    // Dependency note (L-6): `mode` is captured by closure, so listing it as
+    // a dep technically just re-creates the effect when `mode` changes mid-
+    // mount — which never happens in practice (the prop is fixed by the
+    // receiver page). It IS listed deliberately so React's exhaustive-deps
+    // lint stays clean AND so a future caller that toggles `mode` mid-mount
+    // gets the cleanup re-bound rather than the stale closure. Removing it
+    // would shift this from "harmless dep" to "subtle stale-closure bug
+    // waiting for a future mode toggle".
+    useEffect(() => {
+        return () => {
+            if (mode === 'cross-frontend-handoff') {
+                clearCrossFrontendHandoffContext();
+            }
+        };
+    }, [mode, clearCrossFrontendHandoffContext]);
+    // Navigation guard: render `<Navigate>` ONLY when the exchange phase
+    // resolved cleanly. Critical: `!error` is load-bearing here. Without it,
+    // a cross-frontend-handoff receiver mounted with a pre-existing
+    // `auth.accessToken` (cold-load from persistent storage) whose AUTH_CODE_
+    // EXCHANGE call fails would silently navigate the user to the URL
+    // `?return=` value WITH THE OLD SESSION — a session-confusion regression
+    // (the user lands on the deep link as the wrong identity, with no error
+    // surfaced). The error branch below shows a localized failure message
+    // and a login link instead. See H-4 in the Step 5 second deep-review log
+    // on `cross-app-jwt-propagation.md`.
+    if (auth.accessToken && !auth.isLoading && exchangePhaseResolved && !error) {
         return _jsx(Navigate, { to: targetUrl, replace: true });
     }
     if (!isReady)
@@ -118,4 +309,4 @@ export function Auth_OneOffSession({ preset = CorePresetNames.DEFAULT, ...props
     const Component = createComponentResolver(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, 'Auth_OneOffSession')(preset);
     return _jsx(Component, { ...props });
 }
-//# sourceMappingURL=Auth_OneOffSession.js.map
+//# sourceMappingURL=Auth_OneOffSession.js.map

package/dist/esm/components/auth/Auth_OneOffSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAOzF;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,YAAgD,EAChD,QAAkM;IAElM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,IAAI,aAA2D,CAAC;IAChE,IAAI,gBAAqE,CAAC;IAE1E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,SAAS,GAAI,EAAU,CAAC,mBAAmB,CAAC;YAClD,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,uBAAuB,EAAE,aAAa,EAAE,CAAC;gBACvF,aAAa,GAAG,EAAE,CAAC;gBACnB,gBAAgB,GAAG,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAE1D,0EAA0E;IAC1E,gFAAgF;IAChF,gCAAgC;IAChC,MAAM,2BAA2B,GAA2B,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAC/C,aAAa,EACb,gBAAgB,EAChB,2BAA2B,EAC3B,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IAEF,OAAO,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,EAAE,KAAK,EAAiD,EAAqB,EAAE;IACtI,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,CAAC;IAC3E,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAE7G,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAC3E,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,EAC5B,IAAI,CAAC,aAAa,CAAC,kBAAkB,EACrC,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAC3C,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAErD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,oBAAoB,CAAC,OAAO;YAAE,OAAO;QAEzC,IAAI,CAAC,CAAC,YAAY,YAAY,4BAA4B,CAAC,EAAE,CAAC;YAC5D,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,OAAO;QACT,CAAC;QAED,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpC,yBAAyB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;YAChD,QAAQ,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAE1H,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,8FAA8F,YAC3G,cAAK,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YAC7G,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sBAAsB,GAAG,GAC1E,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAW,IAClD,EACN,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,EACR,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAQ,GAC5D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,EAAC,SAAS,EAAC,6BAA6B,aAC3E,cAAK,SAAS,EAAC,0FAA0F,iBAAa,MAAM,YAC1H,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,GAAG,GACjD,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAQ,IACvE,CACP,CAAC;AACJ,CAAC,CAAC;AAGF,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAwE;IACrJ,MAAM,SAAS,GAAG,uBAAuB,CAAgD,qBAAqB,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC"}
+{"version":3,"file":"Auth_OneOffSession.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAwDzF;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,YAAgD,EAChD,QAAkM;IAElM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,IAAI,aAA2D,CAAC;IAChE,IAAI,gBAAqE,CAAC;IAE1E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,SAAS,GAAI,EAAU,CAAC,mBAAmB,CAAC;YAClD,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAChG,aAAa,GAAG,EAAE,CAAC;gBACnB,gBAAgB,GAAG,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAE1D,0EAA0E;IAC1E,gFAAgF;IAChF,gCAAgC;IAChC,MAAM,2BAA2B,GAA2B,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAC/C,aAAa,EACb,gBAAgB,EAChB,2BAA2B,EAC3B,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IAEF,OAAO,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACvC,sFAAsF;IACtF,mFAAmF;IACnF,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,EACvD,KAAK,EACL,IAAI,GAAG,iBAAiB,EACxB,iBAAiB,GAC6B,EAAqB,EAAE;IACrE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,CAAC;IACrI,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAE7G,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAChE,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACxD,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAEpD,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC;YACjE,MAAM,SAAS,GAAG,WAAW,IAAI,iBAAiB,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,qEAAqE;QACrE,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,EAC5B,IAAI,CAAC,aAAa,CAAC,kBAAkB,EACrC,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAC3C,CAAC,EAAE;QACD,IAAI;QACJ,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,2BAA2B;QAChC,iBAAiB;QACjB,QAAQ;KACT,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,oBAAoB,CAAC,OAAO;YAAE,OAAO;QAEzC,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,YAAY,4BAA4B,CAAC,EAAE,CAAC;YAC1F,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;YAChD,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,sDAAsD;QACtD,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,6BAA6B;QAC7B,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACnD,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,KAAK,wBAAwB;YAChD,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAErC,QAAQ;aACL,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;YAChB,QAAQ,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAExJ,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,iEAAiE;IACjE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,qCAAqC;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACtC,gCAAgC,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAE7C,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,8FAA8F,YAC3G,cAAK,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YAC7G,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sBAAsB,GAAG,GAC1E,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAW,IAClD,EACN,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,EACR,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAQ,GAC5D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,EAAC,SAAS,EAAC,6BAA6B,aAC3E,cAAK,SAAS,EAAC,0FAA0F,iBAAa,MAAM,YAC1H,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,GAAG,GACjD,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAQ,IACvE,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAwE;IACrJ,MAAM,SAAS,GAAG,uBAAuB,CAAgD,qBAAqB,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate } from 'react-router-dom';\nimport type { AnyFrontendResourceConfiguration, FrontendResourceConfiguration_Operation } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { isOperationAddressable } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { EphemeralSessionTokenStorage } from '~wildo-frontend-lib/core/security/session-token-storage.frontend.service';\nimport { NavigationUtils } from '~wildo-frontend-lib/core/navigation/navigation.utils';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\n\n// --- Contract ---\n\n/**\n * Receiver mode for `Auth_OneOffSession` (cross-app-jwt-propagation.md Step 5).\n *\n * Two distinct issuance flows land on this same UI shell; the mode prop\n * dispatches to the right exchange handler and the right post-exchange\n * URL-resolution strategy:\n *\n * - `'one-off-session'` — W7.3b ephemeral one-off session. The token is\n *   consumed via `handleOneOffTokenExchange` (`POST /auth/one-off-session/exchange`),\n *   which returns a context populated with `tokenType`, `scopedInitiatorIds`,\n *   and `applicationId`. Post-exchange URL resolves via the resource\n *   registry (matches an operation whose `tokenAuthentication.types` accepts\n *   the consumed `tokenType`). Enforces `EphemeralSessionTokenStorage` to\n *   prevent stomping a parent tab's authenticated session.\n *\n * - `'cross-frontend-handoff'` — Cross-app JWT propagation handoff. The\n *   token is an AUTH_CODE_EXCHANGE consumable issued by\n *   `POST /auth/cross-frontend-handoff` and consumed via\n *   `handleAuthCodeExchange` (`POST /auth/token/exchange`, the same exchange\n *   endpoint OAuth2 callback uses — see Step 4 integration test). The\n *   exchange response surfaces `returnPath` into\n *   `auth.crossFrontendHandoffContext`; we navigate there post-exchange\n *   (with URL-query fallback as defense-in-depth). The ephemeral-storage\n *   guard is intentionally skipped — per K-7, the receiver's storage\n *   adapter (NOT the protocol) determines lifetime, and the SaaS app's\n *   regular persistent storage is the correct landing for a session\n *   transfer.\n */\nexport type AuthOneOffSessionMode = 'one-off-session' | 'cross-frontend-handoff';\n\nexport interface PublicLayoutPreset_OneOffSession_DefaultProps {\n  /**\n   * The one-time consumable token to exchange. For `mode='one-off-session'`\n   * it comes from the `:token` URL path param; for `mode='cross-frontend-handoff'`\n   * it comes from the `?code=` query param (extracted by `AuthPage_AuthExchange`).\n   */\n  token?: string;\n  /**\n   * Defaults to `'one-off-session'` to preserve backward compatibility with\n   * the W7.3b page wrapper that does not pass this prop.\n   */\n  mode?: AuthOneOffSessionMode;\n  /**\n   * Cross-frontend-handoff receiver: the `?return=` URL query param value,\n   * extracted by `AuthPage_AuthExchange`. Defense-in-depth fallback used\n   * ONLY when `auth.crossFrontendHandoffContext.returnPath` is missing\n   * (e.g. backend metadata round-trip failed for some reason). Sanitized\n   * before use.\n   */\n  returnPathFromUrl?: string;\n}\n\n/**\n * Resolves the target frontend URL for a W7.3b one-off-session exchange.\n *\n * Searches the resource registry for an operation whose `tokenAuthentication.types`\n * includes the consumed `tokenType`, then builds a concrete URL using the\n * targeting `initiatorIds` as path parameters.\n *\n * Returns undefined if no matching operation is found or URL cannot be resolved\n * (caller falls back to home).\n *\n * NOT used for cross-frontend-handoff mode — that flow drives navigation off\n * `auth.crossFrontendHandoffContext.returnPath`, see\n * `resolveCrossFrontendHandoffUrl()` below.\n */\nfunction resolveTargetUrl(\n  tokenType: string,\n  initiatorIds: Record<string, string> | undefined,\n  registry: { resourceConfigurations: Record<string, AnyFrontendResourceConfiguration>; allResourceFieldIdentifiers: Record<string, string>; fieldIdentifierToResourceType: Record<string, string> },\n): string | undefined {\n  if (!initiatorIds || Object.keys(initiatorIds).length === 0) return undefined;\n\n  let matchedConfig: AnyFrontendResourceConfiguration | undefined;\n  let matchedOperation: FrontendResourceConfiguration_Operation | undefined;\n\n  for (const rc of Object.values(registry.resourceConfigurations)) {\n    const ops = Array.isArray(rc.operations) ? rc.operations : [];\n    for (const op of ops) {\n      const tokenAuth = (op as any).tokenAuthentication;\n      if (tokenAuth?.types?.includes(tokenType) && isOperationAddressable(op.operationFrontendConfig)) {\n        matchedConfig = rc;\n        matchedOperation = op;\n        break;\n      }\n    }\n    if (matchedOperation) break;\n  }\n\n  if (!matchedConfig || !matchedOperation) return undefined;\n\n  // initiatorIds uses fieldIdentifier keys (e.g., organizationId, tasksId).\n  // resolveResourceUrl expects candidateContextIdentifiers with resourceType keys\n  // (e.g., ORGANIZATIONS, TASKS).\n  const candidateContextIdentifiers: Record<string, string> = {};\n  for (const [fieldId, id] of Object.entries(initiatorIds)) {\n    const resourceType = registry.fieldIdentifierToResourceType[fieldId];\n    if (resourceType) {\n      candidateContextIdentifiers[resourceType] = id;\n    }\n  }\n\n  const result = NavigationUtils.resolveResourceUrl(\n    matchedConfig,\n    matchedOperation,\n    candidateContextIdentifiers,\n    registry.allResourceFieldIdentifiers,\n  );\n\n  return result?.resolvedUrl ?? undefined;\n}\n\n/**\n * Defense-in-depth sanitizer for `returnPath` values arriving at the receiver.\n *\n * The cross-frontend-handoff issuer schema (`CrossFrontendHandoff_ReturnPathSchema`\n * in `cross-frontend-handoff.shared.dto.schemas.ts`) already validates the\n * value at issuance time, AND the value flows through the consumable-token\n * metadata round-trip — but a malicious caller could hand-craft an exchange\n * URL bypassing the issuer entirely (`/auth/exchange?code=…&return=https://evil.com`).\n * Without this guard the eventual `<Navigate to={…}>` would happily honour\n * the open-redirect / XSS / path-traversal payload.\n *\n * The ORIGIN half of the question is answered by the shared\n * {@link isSameOriginRedirectPath} predicate rather than by the character\n * rules below, and that split is the fix for a real defect: this function,\n * the docs-site `AuthExchangePage.sanitizeReturnPath()` and the issuer\n * schema were three hand-written deny-lists that \"mirrored\" each other —\n * and all three admitted `/<TAB>/evil.com`, because the URL parser strips\n * ASCII tab / LF / CR before parsing, turning it into `//evil.com`. Every\n * copy banned `\\` and none banned the whitespace that becomes a `/`.\n *\n * The character rules are KEPT, as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n */\nfunction sanitizeReturnPath(raw: string | undefined): string {\n  if (!raw) return CommonRoutePaths.home;\n  // Authoritative: does this actually resolve onto our own origin? Covers `//evil.com`,\n  // `/\\evil.com` and the stripped-control-character family in one parse-based check.\n  if (!isSameOriginRedirectPath(raw)) return CommonRoutePaths.home;\n  if (raw.includes('..')) return CommonRoutePaths.home;\n  if (raw.includes('\\\\')) return CommonRoutePaths.home;\n  if (raw.includes('://')) return CommonRoutePaths.home;\n  if (/[<>\"]/.test(raw)) return CommonRoutePaths.home;\n  if (raw.length > 256) return CommonRoutePaths.home;\n  return raw;\n}\n\n/**\n * cross-app-jwt-propagation.md Step 5 dual-mode receiver.\n *\n * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it\n * via `handleOneOffTokenExchange`, and redirects to the target page resolved\n * from `tokenType` + targeting via the resource registry, falling back to\n * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).\n *\n * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,\n * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,\n * the same endpoint OAuth2 callback uses), and navigates to\n * `auth.crossFrontendHandoffContext.returnPath` (preferred) or\n * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage\n * guard — the SaaS app's persistent storage is the correct landing per K-7.\n *\n * All user-facing strings are i18n-driven via `OneOffSessionLabel`.\n */\nexport const PublicLayoutPreset_OneOffSession_Default = ({\n  token,\n  mode = 'one-off-session',\n  returnPathFromUrl,\n}: PublicLayoutPreset_OneOffSession_DefaultProps): React.JSX.Element => {\n  const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();\n  const { registry } = useResourceRegistry();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);\n  const loginPath = CommonRoutePaths.login;\n\n  /**\n   * Receiver-LOCAL error state for THIS exchange attempt.\n   *\n   * L-9 (third deep-review pass): this field deliberately duplicates\n   * `auth.error` (set by `AuthSessionContext.handleAuthCodeExchange`'s catch\n   * block) rather than reading the shared field directly. Reasoning:\n   *\n   * - `auth.error` is process-wide across all auth surfaces (logout,\n   *   refresh-token rotation, magic-link verify, MFA verify, passkey\n   *   auth, etc. all write to it). If a parallel\n   *   call sets `auth.error` while THIS receiver's exchange is succeeding,\n   *   reading `auth.error` from the H-4 navigation gate would falsely\n   *   block the receiver from rendering `<Navigate>` — even though the\n   *   receiver's own exchange completed cleanly.\n   *\n   * - Local `error` is scoped to THIS receiver's exchange attempt\n   *   (set ONLY by the `.catch()` on the in-mount exchange Promise).\n   *   The H-4 gate checks `!error` (local) so navigation is blocked iff\n   *   THIS receiver's exchange failed, regardless of what other auth\n   *   surfaces are doing concurrently.\n   *\n   * If the AuthSessionContext error surface is ever refactored into per-\n   * call scoped errors, this duplication can collapse — but until then\n   * the duplication is load-bearing.\n   */\n  const [error, setError] = useState<string | null>(null);\n  const exchangeAttemptedRef = useRef(false);\n  /**\n   * Gate `<Navigate>` until the exchange phase has resolved (success, failure,\n   * or intentionally skipped). Without this gate, a cross-frontend-handoff\n   * receiver mounted with a pre-existing `auth.accessToken` (cold-load from\n   * persistent storage) would render `<Navigate>` on the FIRST render —\n   * which commits and unmounts the component BEFORE this component's\n   * `useEffect` ever runs the AUTH_CODE_EXCHANGE consume call. The user\n   * would then land on the URL `?return=` value with their pre-existing\n   * session AND the consumable token would dangle in the store for 60s\n   * (auto-expiring without ever being consumed). See M-2 in the Step 5\n   * deep-review log on `cross-app-jwt-propagation.md`.\n   *\n   * Initial value is mode-dependent:\n   * - `one-off-session`: `true` IF accessToken is already set (preserve\n   *   the existing W7.3b \"render Navigate immediately\" semantics — the\n   *   ephemeral-storage guard fires for the in-tab case anyway).\n   * - `cross-frontend-handoff`: `false` always — we ALWAYS want the\n   *   exchange to run before navigating, even when `auth.accessToken` is\n   *   set, so the new tokens replace the existing session and the\n   *   `crossFrontendHandoffContext.returnPath` populates from the\n   *   exchange response (defense against silent auth-confusion when the\n   *   pre-existing session belongs to a different user than the handoff\n   *   was minted for).\n   */\n  const [exchangePhaseResolved, setExchangePhaseResolved] = useState<boolean>(\n    mode === 'one-off-session' && Boolean(auth.accessToken),\n  );\n\n  const targetUrl = useMemo(() => {\n    if (!auth.accessToken) return CommonRoutePaths.home;\n\n    // Cross-frontend-handoff: navigate to `returnPath` from the exchange\n    // response (which round-tripped via the consumable-token metadata),\n    // falling back to the URL-query value as defense-in-depth. Both inputs\n    // pass through `sanitizeReturnPath` to defeat any open-redirect /\n    // path-traversal / XSS payload that may have bypassed the issuer schema.\n    if (mode === 'cross-frontend-handoff') {\n      const fromContext = auth.crossFrontendHandoffContext?.returnPath;\n      const candidate = fromContext ?? returnPathFromUrl;\n      return sanitizeReturnPath(candidate);\n    }\n\n    // W7.3b one-off session: walk the resource registry for an operation\n    // matching the consumed tokenType.\n    if (!auth.oneOffContext) return CommonRoutePaths.home;\n    const resolved = resolveTargetUrl(\n      auth.oneOffContext.tokenType,\n      auth.oneOffContext.scopedInitiatorIds,\n      registry,\n    );\n    return resolved ?? CommonRoutePaths.home;\n  }, [\n    mode,\n    auth.oneOffContext,\n    auth.accessToken,\n    auth.crossFrontendHandoffContext,\n    returnPathFromUrl,\n    registry,\n  ]);\n\n  useEffect(() => {\n    if (exchangeAttemptedRef.current) return;\n\n    // Storage guard applies ONLY to W7.3b (one-off-session) mode. Cross-\n    // frontend-handoff intentionally lands in the receiver's regular tab\n    // with its regular (persistent or ephemeral, per receiver's adapter\n    // choice) storage — this is the protocol's whole point per K-7.\n    if (mode === 'one-off-session' && !(tokenStorage instanceof EphemeralSessionTokenStorage)) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_WRONG_TAB));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    if (!token) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_NO_TOKEN));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    // Already-authenticated short-circuit applies ONLY to W7.3b\n    // (one-off-session) mode — there an existing parent session in the\n    // tab is the trigger for the ERROR_WRONG_TAB guard above (the\n    // ephemeral-storage check should have already fired), and burning\n    // a one-off code on an authenticated tab is wasteful.\n    //\n    // Cross-frontend-handoff mode must NOT short-circuit: the user\n    // explicitly initiated a session transfer on the source frontend\n    // (clicked \"Open in docs\" / similar). Skipping the exchange would:\n    //   (a) leave a 60-second dangling AUTH_CODE_EXCHANGE token in the\n    //       store (auto-expires, but uses the consumable-token budget and\n    //       muddies audit logs);\n    //   (b) navigate the user using the URL `?return=` value but with\n    //       their PRE-EXISTING session — which may be a different user\n    //       than the handoff was minted for, leading to the user landing\n    //       on `/api/organization/foo` as the wrong identity (silent\n    //       auth-confusion). Always consume the code so the new tokens\n    //       replace the existing ones.\n    if (auth.accessToken && mode === 'one-off-session') {\n      exchangeAttemptedRef.current = true;\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    exchangeAttemptedRef.current = true;\n\n    const exchange = mode === 'cross-frontend-handoff'\n      ? handleAuthCodeExchange(token)\n      : handleOneOffTokenExchange(token);\n\n    exchange\n      .catch((e: any) => {\n        setError(e?.message || t(OneOffSessionLabel.ERROR_GENERIC));\n      })\n      .finally(() => {\n        setExchangePhaseResolved(true);\n      });\n  }, [token, mode, auth.accessToken, handleOneOffTokenExchange, handleAuthCodeExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  // Single-use cleanup of `auth.crossFrontendHandoffContext`. Runs on\n  // unmount, which happens AFTER `<Navigate to={targetUrl}>` resolves and\n  // React tears down the receiver. Earlier cleanup would race the\n  // `targetUrl` `useMemo` recomputation and could navigate to home instead\n  // of the intended `returnPath`. No-op for `one-off-session` mode (which\n  // never sets the field in the first place — `oneOffContext` is its\n  // sibling state and is preserved as part of the active session).\n  //\n  // Dependency note (L-6): `mode` is captured by closure, so listing it as\n  // a dep technically just re-creates the effect when `mode` changes mid-\n  // mount — which never happens in practice (the prop is fixed by the\n  // receiver page). It IS listed deliberately so React's exhaustive-deps\n  // lint stays clean AND so a future caller that toggles `mode` mid-mount\n  // gets the cleanup re-bound rather than the stale closure. Removing it\n  // would shift this from \"harmless dep\" to \"subtle stale-closure bug\n  // waiting for a future mode toggle\".\n  useEffect(() => {\n    return () => {\n      if (mode === 'cross-frontend-handoff') {\n        clearCrossFrontendHandoffContext();\n      }\n    };\n  }, [mode, clearCrossFrontendHandoffContext]);\n\n  // Navigation guard: render `<Navigate>` ONLY when the exchange phase\n  // resolved cleanly. Critical: `!error` is load-bearing here. Without it,\n  // a cross-frontend-handoff receiver mounted with a pre-existing\n  // `auth.accessToken` (cold-load from persistent storage) whose AUTH_CODE_\n  // EXCHANGE call fails would silently navigate the user to the URL\n  // `?return=` value WITH THE OLD SESSION — a session-confusion regression\n  // (the user lands on the deep link as the wrong identity, with no error\n  // surfaced). The error branch below shows a localized failure message\n  // and a login link instead. See H-4 in the Step 5 second deep-review log\n  // on `cross-app-jwt-propagation.md`.\n  if (auth.accessToken && !auth.isLoading && exchangePhaseResolved && !error) {\n    return <Navigate to={targetUrl} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (error) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element\">\n            <svg className=\"h-6 w-6 text-destructive\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\" />\n            </svg>\n          </div>\n          <Heading>{t(OneOffSessionLabel.ERROR_TITLE)}</Heading>\n        </div>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n        <div className=\"text-center mt-group\">\n          <Link href={loginPath}>{t(OneOffSessionLabel.LOGIN_LINK)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  return (\n    <div role=\"status\" aria-live=\"polite\" className=\"text-center space-y-item-xs\">\n      <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\" aria-hidden=\"true\">\n        <LoadingSpinner size={24} className=\"text-primary\" />\n      </div>\n      <Text className=\"max-w-sm mx-auto\">{t(OneOffSessionLabel.VERIFYING)}</Text>\n    </div>\n  );\n};\n\nexport function Auth_OneOffSession({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OneOffSession_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OneOffSession_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, 'Auth_OneOffSession')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OneOffSession.labels.d.ts

@@ -0,0 +1,3 @@
+import { type LabellingUnitaryDef } from '@wildo-ai/presets-components-models';
+export declare const PublicLayoutsOneOffSessionLabels: LabellingUnitaryDef[];
+//# sourceMappingURL=Auth_OneOffSession.labels.d.ts.map

package/dist/esm/components/auth/Auth_OneOffSession.labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OneOffSession.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA+C,MAAM,qCAAqC,CAAC;AAM9J,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAOjE,CAAC"}

package/dist/esm/components/auth/Auth_OneOffSession.labels.js

@@ -0,0 +1,14 @@
+import { FrontendComponentType, LabelKind, OneOffSessionLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';
+// Companion-only label metadata for this component: keys + params + per-key
+// purpose / kind / variable meaning. Statically scanned by the dev companion;
+// NOT imported at runtime, so it never ships in the bundle.
+export const PublicLayoutsOneOffSessionLabels = [
+    { ref: OneOffSessionLabel.VERIFYING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the one-off session token is being exchanged' },
+    { ref: OneOffSessionLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the one-off session exchange fails' },
+    { ref: OneOffSessionLabel.ERROR_NO_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the one-off session link carries no token' },
+    { ref: OneOffSessionLabel.ERROR_WRONG_TAB, kind: LabelKind.MESSAGE, purpose: 'Error shown when a one-off session link is opened in a tab that already has a regular session' },
+    { ref: OneOffSessionLabel.ERROR_GENERIC, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the one-off session exchange fails unexpectedly' },
+    { ref: OneOffSessionLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen' },
+];
+registerComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, PublicLayoutsOneOffSessionLabels);
+//# sourceMappingURL=Auth_OneOffSession.labels.js.map

package/dist/esm/components/auth/Auth_OneOffSession.labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OneOffSession.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,gCAAgC,GAA0B;IACrE,EAAE,GAAG,EAAE,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAChJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClI,EAAE,GAAG,EAAE,kBAAkB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE;IAC1I,EAAE,GAAG,EAAE,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+FAA+F,EAAE;IAC9K,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IACvJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;CAC1G,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OneOffSessionLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOneOffSessionLabels: LabellingUnitaryDef[] = [\n  { ref: OneOffSessionLabel.VERIFYING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the one-off session token is being exchanged' },\n  { ref: OneOffSessionLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the one-off session exchange fails' },\n  { ref: OneOffSessionLabel.ERROR_NO_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the one-off session link carries no token' },\n  { ref: OneOffSessionLabel.ERROR_WRONG_TAB, kind: LabelKind.MESSAGE, purpose: 'Error shown when a one-off session link is opened in a tab that already has a regular session' },\n  { ref: OneOffSessionLabel.ERROR_GENERIC, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the one-off session exchange fails unexpectedly' },\n  { ref: OneOffSessionLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, PublicLayoutsOneOffSessionLabels);\n"]}

package/dist/esm/components/auth/Auth_PasswordLost.d.ts

@@ -1,8 +1,9 @@
 import React from 'react';
-import { ComponentPresetProps } from '../../core/components-registry/component-registry.frontend.schemas.js';
+import { ComponentPresetProps } from '../../core/components-registry/component-registry.frontend.schemas';
 export interface PublicLayoutPreset_UserPasswordLost_DefaultProps {
     resetToken?: string;
+    email?: string;
 }
-export declare const PublicLayoutPreset_UserPasswordLost_Default: ({ resetToken }: PublicLayoutPreset_UserPasswordLost_DefaultProps) => React.JSX.Element;
+export declare const PublicLayoutPreset_UserPasswordLost_Default: ({ resetToken, email, }: PublicLayoutPreset_UserPasswordLost_DefaultProps) => React.JSX.Element;
 export declare function Auth_PasswordLost({ preset, ...props }: PublicLayoutPreset_UserPasswordLost_DefaultProps & ComponentPresetProps): React.JSX.Element;
 //# sourceMappingURL=Auth_PasswordLost.d.ts.map

package/dist/esm/components/auth/Auth_PasswordLost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_PasswordLost.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAiD,MAAM,OAAO,CAAC;AA2BtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AA2ExH,MAAM,WAAW,gDAAgD;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,eAAO,MAAM,2CAA2C,GAAI,gBAAgB,gDAAgD,KAAG,KAAK,CAAC,GAAG,CAAC,OA+MxI,CAAC;AAGF,wBAAgB,iBAAiB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,gDAAgD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5K"}
+{"version":3,"file":"Auth_PasswordLost.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAiD,MAAM,OAAO,CAAC;AA4BtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAqFxH,MAAM,WAAW,gDAAgD;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,2CAA2C,GAAI,wBAGzD,gDAAgD,KAAG,KAAK,CAAC,GAAG,CAAC,OA+M/D,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,gDAAgD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5K"}

package/dist/esm/components/auth/Auth_PasswordLost.js

@@ -13,6 +13,7 @@ import { extractServerValidationErrors } from '../../components/form/validation-
 import { useServerErrorInjection } from '../../components/form/validation-errors/useServerErrorInjection.js';
 import { Alert, AlertDescription } from '../../components/overlays/containers/alert.js';
 import { DEFAULT_PASSWORD_POLICY, PasswordStrengthIndicator } from '../../components/auth/utils/PasswordStrengthIndicator.js';
+import { CredentialUsernameAutofillField } from '../../components/auth/utils/CredentialUsernameAutofillField.js';
 import { extractPasswordPolicyErrorMessage, resolvePasswordViolationsToLabels, } from '../../components/auth/utils/resolvePasswordViolationsToLabels.js';
 import { Heading } from '../../components/typography/heading.js';
 import { Link } from '../../components/typography/link.js';
@@ -33,28 +34,27 @@ import { createComponentResolver } from '../../core/components-registry/componen
  */
 const PasswordResetRequestTemplate = () => {
     const { formState } = useFormContext();
-    const { tComponent } = useI18n({
+    const { tComponent, isReady } = useI18n({
         component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,
     });
     const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);
+    if (!isReady)
+        return null;
     return (_jsxs(FormLayout, { children: [_jsx(FormField, { name: "email" }), formState.errors.root && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: formState.errors.root.message }) })), _jsx(SubmitButton, { label: t(UserPasswordLostLabel.SEND_RESET_PASSWORD_LINK), submittingLabel: t(UserPasswordLostLabel.SENDING), fullWidth: true })] }));
 };
-/**
- * Template for the password reset form (Step 2a).
- * Reads password policy from `useResolvedAuthConfig()`, root errors from RHF,
- * labels from `useI18n()`.
- */
-const PasswordResetCompleteTemplate = () => {
+const PasswordResetCompleteTemplate = ({ resetEmail, }) => {
     const resolvedAuth = useResolvedAuthConfig();
     const { formState } = useFormContext();
-    const { tComponent } = useI18n({
+    const { tComponent, isReady } = useI18n({
         component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,
     });
     const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);
     const passwordPolicy = resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;
-    return (_jsxs(FormLayout, { children: [_jsx(FormField, { name: "newPassword" }), _jsx(FormField, { name: "confirmPassword" }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: t }), formState.errors.root && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: formState.errors.root.message }) })), _jsx(SubmitButton, { label: t(UserPasswordLostLabel.RESET_BUTTON), submittingLabel: t(UserPasswordLostLabel.RESETTING), fullWidth: true })] }));
+    if (!isReady)
+        return null;
+    return (_jsxs(FormLayout, { children: [_jsx(CredentialUsernameAutofillField, { email: resetEmail }), _jsx(FormField, { name: "newPassword" }), _jsx(FormField, { name: "confirmPassword" }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: t }), formState.errors.root && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: formState.errors.root.message }) })), _jsx(SubmitButton, { label: t(UserPasswordLostLabel.RESET_BUTTON), submittingLabel: t(UserPasswordLostLabel.RESETTING), fullWidth: true })] }));
 };
-export const PublicLayoutPreset_UserPasswordLost_Default = ({ resetToken }) => {
+export const PublicLayoutPreset_UserPasswordLost_Default = ({ resetToken, email, }) => {
     const { auth } = useUserOrgs();
     const resolvedAuth = useResolvedAuthConfig();
     const { tComponent, isReady } = useI18n({
@@ -93,7 +93,7 @@ export const PublicLayoutPreset_UserPasswordLost_Default = ({ resetToken }) => {
     // Step 2b: Reset Success — password has been updated
     // ═══════════════════════════════════════════════════════════════
     if (resetComplete) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx("div", { className: "mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-success/10 mb-element", children: _jsx("svg", { className: "h-6 w-6 text-success-foreground", fill: "none", viewBox: "0 0 24 24", stroke: "currentColor", strokeWidth: "2", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M5 13l4 4L19 7" }) }) }), _jsx(Heading, { children: t(UserPasswordLostLabel.RESET_SUCCESS_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserPasswordLostLabel.RESET_SUCCESS_MESSAGE) })] }), _jsx("div", { className: "text-center", children: _jsx(Link, { href: loginPath, children: t(UserPasswordLostLabel.LOGIN_LINK) }) })] }));
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx("div", { className: "mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-success/10 mb-element", children: _jsx("svg", { className: "h-6 w-6 text-success", fill: "none", viewBox: "0 0 24 24", stroke: "currentColor", strokeWidth: "2", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M5 13l4 4L19 7" }) }) }), _jsx(Heading, { children: t(UserPasswordLostLabel.RESET_SUCCESS_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserPasswordLostLabel.RESET_SUCCESS_MESSAGE) })] }), _jsx("div", { className: "text-center", children: _jsx(Link, { href: loginPath, children: t(UserPasswordLostLabel.LOGIN_LINK) }) })] }));
     }
     // ═══════════════════════════════════════════════════════════════
     // Step 2a: Password Reset Form (token in URL)
@@ -138,7 +138,7 @@ export const PublicLayoutPreset_UserPasswordLost_Default = ({ resetToken }) => {
                             newPassword: t(UserPasswordLostLabel.NEW_PASSWORD),
                             confirmPassword: t(UserPasswordLostLabel.CONFIRM_PASSWORD),
                         },
-                    }, layoutTemplate: PasswordResetCompleteTemplate }), _jsx("div", { className: "text-center mt-group", children: _jsx(Link, { href: loginPath, children: t(UserPasswordLostLabel.BACK_TO_LOGIN) }) })] }));
+                    }, layoutTemplate: () => _jsx(PasswordResetCompleteTemplate, { resetEmail: email }) }), _jsx("div", { className: "text-center mt-group", children: _jsx(Link, { href: loginPath, children: t(UserPasswordLostLabel.BACK_TO_LOGIN) }) })] }));
     }
     // ═══════════════════════════════════════════════════════════════
     // Step 1b: Email Sent Confirmation
@@ -183,4 +183,4 @@ export function Auth_PasswordLost({ preset = CorePresetNames.DEFAULT, ...props }
     const Component = createComponentResolver(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, 'Auth_PasswordLost')(preset);
     return _jsx(Component, { ...props });
 }
-//# sourceMappingURL=Auth_PasswordLost.js.map
+//# sourceMappingURL=Auth_PasswordLost.js.map

package/dist/esm/components/auth/Auth_PasswordLost.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_PasswordLost.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACnG,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,SAAS,GAIV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAE9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mFAAmF,CAAC;AAClI,OAAO,EAAE,uBAAuB,EAAE,MAAM,+EAA+E,CAAC;AACxH,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AACzI,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,6EAA6E,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAEhG,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAG1H,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,4BAA4B,GAAa,GAAG,EAAE;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7B,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAEpG,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,OAAO,GAAG,EAEzB,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,EACxD,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EACjD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,6BAA6B,GAAa,GAAG,EAAE;IACnD,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7B,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,cAAc,GAAwB,YAAY,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAEnG,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,aAAa,GAAG,EAChC,KAAC,SAAS,IAAC,IAAI,EAAC,iBAAiB,GAAG,EAEpC,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,GAAI,EAElF,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAC5C,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,EACnD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,EAAE,UAAU,EAAoD,EAAqB,EAAE;IACjJ,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC,sDAAsD;IACtD,MAAM,cAAc,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC5G,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,WAAwB,EAAE,EAAE;QAC/D,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;QACrC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEvB,gBAAgB;IAChB,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,cAAc,GAAwB,OAAO,CAAC,GAAG,EAAE;QACvD,OAAO,YAAY,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAChE,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;IAElC,uEAAuE;IACvE,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9C,OAAO,kCAAkC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE;YACpG,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;YACnD,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAER,4CAA4C;IAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,SAAG,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,kEAAkE;IAClE,qDAAqD;IACrD,kEAAkE;IAClE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,0FAA0F,YACvG,cAAK,SAAS,EAAC,iCAAiC,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YACpH,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,gBAAgB,GAAG,GACpE,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAW,EACjE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,IACtF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAAQ,GAC/D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,8CAA8C;IAC9C,kEAAkE;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAAkC,EAAE,EAAE;YACrE,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5C,iBAAiB,EAAE,CAAC;YAEpB,MAAM,YAAY,GAAG,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,iCAAiC,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClG,CAAC,CAAC;gBACH,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,wBAAwB,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrF,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,YAAY,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,YAAY,EAAE,CAAC;oBACjB,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,iBAAiB,GAAG,iCAAiC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;oBAClF,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;wBACvC,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,iBAAiB,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;qBACnF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAAW,EACzD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,IAChF,EAEN,KAAC,aAAa,IACZ,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,EACvD,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE;wBACN,MAAM,EAAE;4BACN,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC;4BAClD,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;yBAC3D;qBACF,EACD,cAAc,EAAE,6BAA6B,GAC7C,EAEF,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,mCAAmC;IACnC,kEAAkE;IAClE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,0FAA0F,YACvG,cAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YACzG,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sGAAsG,GAAG,GAC1J,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAW,EAC3D,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,IAChF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uCAAuC;IACvC,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAA6B,EAAE,EAAE;QAChE,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5C,iBAAiB,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClE,YAAY,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,YAAY,EAAE,CAAC;gBACjB,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAW,EACnD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAQ,IAC1E,EAEN,KAAC,aAAa,IACZ,MAAM,EAAE,6BAA6B,EACrC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAC5B,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;qBAC9C;iBACF,EACD,cAAc,EAAE,4BAA4B,GAC5C,EAEF,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;AACJ,CAAC,CAAC;AAGF,MAAM,UAAU,iBAAiB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAA2E;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CAAmD,qBAAqB,CAAC,iCAAiC,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IAClL,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC"}
+{"version":3,"file":"Auth_PasswordLost.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACnG,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,SAAS,GAIV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAE9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mFAAmF,CAAC;AAClI,OAAO,EAAE,uBAAuB,EAAE,MAAM,+EAA+E,CAAC;AACxH,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,6EAA6E,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAEhG,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAE1H,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,4BAA4B,GAAa,GAAG,EAAE;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAEpG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,OAAO,GAAG,EAEzB,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,EACxD,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EACjD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAWF,MAAM,6BAA6B,GAAiD,CAAC,EACnF,UAAU,GACX,EAAE,EAAE;IACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,cAAc,GAAwB,YAAY,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAEnG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,+BAA+B,IAAC,KAAK,EAAE,UAAU,GAAI,EACtD,KAAC,SAAS,IAAC,IAAI,EAAC,aAAa,GAAG,EAChC,KAAC,SAAS,IAAC,IAAI,EAAC,iBAAiB,GAAG,EAEpC,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,GAAI,EAElF,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAC5C,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,EACnD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,EAC1D,UAAU,EACV,KAAK,GAC4C,EAAqB,EAAE;IACxE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC,sDAAsD;IACtD,MAAM,cAAc,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC5G,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,WAAwB,EAAE,EAAE;QAC/D,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;QACrC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEvB,gBAAgB;IAChB,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,cAAc,GAAwB,OAAO,CAAC,GAAG,EAAE;QACvD,OAAO,YAAY,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAChE,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;IAElC,uEAAuE;IACvE,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9C,OAAO,kCAAkC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE;YACpG,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;YACnD,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAER,4CAA4C;IAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,SAAG,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,kEAAkE;IAClE,qDAAqD;IACrD,kEAAkE;IAClE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,0FAA0F,YACvG,cAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YACzG,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,gBAAgB,GAAG,GACpE,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAW,EACjE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,IACtF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAAQ,GAC/D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,8CAA8C;IAC9C,kEAAkE;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAAkC,EAAE,EAAE;YACrE,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5C,iBAAiB,EAAE,CAAC;YAEpB,MAAM,YAAY,GAAG,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,iCAAiC,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClG,CAAC,CAAC;gBACH,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,wBAAwB,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrF,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,YAAY,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,YAAY,EAAE,CAAC;oBACjB,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,iBAAiB,GAAG,iCAAiC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;oBAClF,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;wBACvC,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,iBAAiB,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;qBACnF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAAW,EACzD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,IAChF,EAEN,KAAC,aAAa,IACZ,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,EACvD,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE;wBACN,MAAM,EAAE;4BACN,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC;4BAClD,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;yBAC3D;qBACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,KAAC,6BAA6B,IAAC,UAAU,EAAE,KAAK,GAAI,GAC1E,EAEF,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,mCAAmC;IACnC,kEAAkE;IAClE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,0FAA0F,YACvG,cAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YACzG,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sGAAsG,GAAG,GAC1J,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAW,EAC3D,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,IAChF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uCAAuC;IACvC,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAA6B,EAAE,EAAE;QAChE,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5C,iBAAiB,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClE,YAAY,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,YAAY,EAAE,CAAC;gBACjB,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAW,EACnD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAQ,IAC1E,EAEN,KAAC,aAAa,IACZ,MAAM,EAAE,6BAA6B,EACrC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAC5B,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;qBAC9C;iBACF,EACD,cAAc,EAAE,4BAA4B,GAC5C,EAEF,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAA2E;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CAAmD,qBAAqB,CAAC,iCAAiC,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IAClL,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import { FrontendComponentType, UserPasswordLostLabel } from '@wildo-ai/presets-components-models';\nimport {\n  PasswordResetCompleteFormDtoSchema,\n  PasswordResetRequestDtoSchema,\n  AuthUtils,\n  type PasswordPolicyRules,\n  type PasswordResetCompleteFormDto,\n  type PasswordResetRequestDto,\n} from '@wildo-ai/saas-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { useFormContext } from 'react-hook-form';\nimport { Navigate } from 'react-router-dom';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { type FormMethods } from '~wildo-frontend-lib/components/form/Form';\nimport { extractServerValidationErrors } from '~wildo-frontend-lib/components/form/validation-errors/form-error-extraction.utils';\nimport { useServerErrorInjection } from '~wildo-frontend-lib/components/form/validation-errors/useServerErrorInjection';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { DEFAULT_PASSWORD_POLICY, PasswordStrengthIndicator } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport {\n  extractPasswordPolicyErrorMessage,\n  resolvePasswordViolationsToLabels,\n} from '~wildo-frontend-lib/components/auth/utils/resolvePasswordViolationsToLabels';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\n\nimport { CorePresetNames } from '@wildo-ai/presets-components-models';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n// =============================================================================\n// SELF-SUFFICIENT FORM TEMPLATES\n// =============================================================================\n\n/**\n * Template for the email request form (Step 1a).\n * Reads root errors from `useFormContext()`, labels from `useI18n()`.\n */\nconst PasswordResetRequestTemplate: React.FC = () => {\n  const { formState } = useFormContext();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"email\" />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserPasswordLostLabel.SEND_RESET_PASSWORD_LINK)}\n        submittingLabel={t(UserPasswordLostLabel.SENDING)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Template for the password reset form (Step 2a).\n * Reads password policy from `useResolvedAuthConfig()`, root errors from RHF,\n * labels from `useI18n()`.\n */\ninterface PasswordResetCompleteTemplateProps {\n  resetEmail?: string;\n}\n\nconst PasswordResetCompleteTemplate: React.FC<PasswordResetCompleteTemplateProps> = ({\n  resetEmail,\n}) => {\n  const resolvedAuth = useResolvedAuthConfig();\n  const { formState } = useFormContext();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n  const passwordPolicy: PasswordPolicyRules = resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <CredentialUsernameAutofillField email={resetEmail} />\n      <FormField name=\"newPassword\" />\n      <FormField name=\"confirmPassword\" />\n\n      <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={t} />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserPasswordLostLabel.RESET_BUTTON)}\n        submittingLabel={t(UserPasswordLostLabel.RESETTING)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n// --- Contract ---\nexport interface PublicLayoutPreset_UserPasswordLost_DefaultProps {\n  resetToken?: string;\n  email?: string;\n}\n\nexport const PublicLayoutPreset_UserPasswordLost_Default = ({\n  resetToken,\n  email,\n}: PublicLayoutPreset_UserPasswordLost_DefaultProps): React.JSX.Element => {\n  const { auth } = useUserOrgs();\n  const resolvedAuth = useResolvedAuthConfig();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n  const loginPath = CommonRoutePaths.login;\n\n  // ─── Form methods ref for server error injection ───\n  const formMethodsRef = useRef<FormMethods | null>(null);\n  const { initAutoClearing, injectServerErrors, clearServerErrors } = useServerErrorInjection(formMethodsRef);\n  const handleFormReady = useCallback((formMethods: FormMethods) => {\n    formMethodsRef.current = formMethods;\n    initAutoClearing(formMethods);\n  }, [initAutoClearing]);\n\n  // ─── State ───\n  const [isLoading, setIsLoading] = useState(false);\n  const [emailSent, setEmailSent] = useState(false);\n  const [resetComplete, setResetComplete] = useState(false);\n\n  const passwordPolicy: PasswordPolicyRules = useMemo(() => {\n    return resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n  }, [resolvedAuth.passwordPolicy]);\n\n  // ─── Refined schema with i18n error message for password mismatch ───\n  const refinedResetPasswordSchema = useMemo(() => {\n    return PasswordResetCompleteFormDtoSchema.refine((data) => data.newPassword === data.confirmPassword, {\n      message: t(UserPasswordLostLabel.PASSWORD_MISMATCH),\n      path: ['confirmPassword'],\n    });\n  }, [t]);\n\n  // Redirect to home if already authenticated\n  if (auth.accessToken) {\n    return <Navigate to={CommonRoutePaths.home} replace />;\n  }\n\n  if (!isReady) return null;\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 2b: Reset Success — password has been updated\n  // ═══════════════════════════════════════════════════════════════\n  if (resetComplete) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-success/10 mb-element\">\n            <svg className=\"h-6 w-6 text-success\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M5 13l4 4L19 7\" />\n            </svg>\n          </div>\n          <Heading>{t(UserPasswordLostLabel.RESET_SUCCESS_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.RESET_SUCCESS_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.LOGIN_LINK)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 2a: Password Reset Form (token in URL)\n  // ═══════════════════════════════════════════════════════════════\n  if (resetToken) {\n    const handleResetSubmit = async (data: PasswordResetCompleteFormDto) => {\n      setIsLoading(true);\n      formMethodsRef.current?.clearErrors('root');\n      clearServerErrors();\n\n      const policyResult = AuthUtils.validatePasswordAgainstPolicy(data.newPassword, passwordPolicy);\n      if (!policyResult.valid) {\n        formMethodsRef.current?.setError('root', {\n          type: 'policy',\n          message: resolvePasswordViolationsToLabels(policyResult.violations, t, passwordPolicy).join('. '),\n        });\n        setIsLoading(false);\n        return;\n      }\n\n      try {\n        await getManualCallsHttpClient().completePasswordReset(resetToken, data.newPassword);\n        setResetComplete(true);\n      } catch (e: any) {\n        const serverErrors = extractServerValidationErrors(e);\n        if (serverErrors) {\n          injectServerErrors(serverErrors.validationErrors);\n        } else {\n          const passwordPolicyMsg = extractPasswordPolicyErrorMessage(e, t, passwordPolicy);\n          formMethodsRef.current?.setError('root', {\n            type: 'server',\n            message: passwordPolicyMsg ?? e?.message ?? t(UserPasswordLostLabel.INVALID_TOKEN),\n          });\n        }\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserPasswordLostLabel.RESET_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.RESET_SUB_TITLE)}</Text>\n        </div>\n\n        <AutomatedForm\n          schema={refinedResetPasswordSchema}\n          defaultValues={{ newPassword: '', confirmPassword: '' }}\n          onSubmit={handleResetSubmit}\n          onFormReady={handleFormReady}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={isLoading}\n          labels={{\n            fields: {\n              newPassword: t(UserPasswordLostLabel.NEW_PASSWORD),\n              confirmPassword: t(UserPasswordLostLabel.CONFIRM_PASSWORD),\n            },\n          }}\n          layoutTemplate={() => <PasswordResetCompleteTemplate resetEmail={email} />}\n        />\n\n        <div className=\"text-center mt-group\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 1b: Email Sent Confirmation\n  // ═══════════════════════════════════════════════════════════════\n  if (emailSent) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\">\n            <svg className=\"h-6 w-6 text-primary\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\" />\n            </svg>\n          </div>\n          <Heading>{t(UserPasswordLostLabel.SUCCESS_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.SUCCESS_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 1a: Request Reset — Email Input\n  // ═══════════════════════════════════════════════════════════════\n  const handleEmailSubmit = async (data: PasswordResetRequestDto) => {\n    setIsLoading(true);\n    formMethodsRef.current?.clearErrors('root');\n    clearServerErrors();\n\n    try {\n      await getManualCallsHttpClient().requestPasswordReset(data.email);\n      setEmailSent(true);\n    } catch (e: any) {\n      const serverErrors = extractServerValidationErrors(e);\n      if (serverErrors) {\n        injectServerErrors(serverErrors.validationErrors);\n      } else {\n        formMethodsRef.current?.setError('root', {\n          type: 'server',\n          message: e?.message || t(UserPasswordLostLabel.UNEXPECTED_ERROR),\n        });\n      }\n    } finally {\n      setIsLoading(false);\n    }\n  };\n\n  return (\n    <>\n      <div className=\"text-center space-y-item-xs mb-group\">\n        <Heading>{t(UserPasswordLostLabel.TITLE)}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.SUB_TITLE)}</Text>\n      </div>\n\n      <AutomatedForm\n        schema={PasswordResetRequestDtoSchema}\n        defaultValues={{ email: '' }}\n        onSubmit={handleEmailSubmit}\n        onFormReady={handleFormReady}\n        validationMode={ValidationMode.ON_BLUR}\n        disabled={isLoading}\n        labels={{\n          fields: {\n            email: t(UserPasswordLostLabel.EMAIL_ADDRESS),\n          },\n        }}\n        layoutTemplate={PasswordResetRequestTemplate}\n      />\n\n      <div className=\"text-center mt-group\">\n        <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n      </div>\n    </>\n  );\n};\n\nexport function Auth_PasswordLost({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_UserPasswordLost_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_UserPasswordLost_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, 'Auth_PasswordLost')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_PasswordLost.labels.d.ts

@@ -0,0 +1,3 @@
+import { type LabellingUnitaryDef } from '@wildo-ai/presets-components-models';
+export declare const PublicLayoutsUserPasswordLostLabels: LabellingUnitaryDef[];
+//# sourceMappingURL=Auth_PasswordLost.labels.d.ts.map

package/dist/esm/components/auth/Auth_PasswordLost.labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_PasswordLost.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_PasswordLost.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAAkD,MAAM,qCAAqC,CAAC;AAMjK,eAAO,MAAM,mCAAmC,EAAE,mBAAmB,EAqCpE,CAAC"}