@wildo-ai/saas-frontend-lib 1.1.10 → 1.1.11

package/dist/esm/components/auth/StepUpAuthDialog.js.map

@@ -1 +1 @@
-{"version":3,"file":"StepUpAuthDialog.js","sourceRoot":"","sources":["../../../../../src/components/auth/StepUpAuthDialog.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,UAAU,EAAoG,MAAM,uBAAuB,CAAC;AACrJ,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AAChH,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAAE,MAAM,sEAAsE,CAAC;AAC3G,OAAO,EACL,gCAAgC,EAChC,sCAAsC,EACtC,0BAA0B,GAC3B,MAAM,uEAAuE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;AAmBnH,MAAM,uBAAuB,GAA0E;IACrG,CAAC,sCAAsC,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC,6BAA6B;IAC3G,oGAAoG;IACpG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;IAChG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,yBAAyB;IACnG,CAAC,sCAAsC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;CAC9F,CAAC;AAEF,MAAM,mBAAmB,GAAgD;IACvE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,mBAAmB;IAC/D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,gBAAgB;IACzD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC,oBAAoB;CAClE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAa,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA2B,EAAE,KAAyC;IACrG,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,KAAK,UAAU,CAAC,IAAI;YAClB,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,KAAK,UAAU,CAAC,OAAO;YACrB,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,MAAM,gBAAgB,GAAoC,CAAC,EAChE,IAAI,EACJ,OAAO,EACP,MAAM,GAAG,mBAAmB,CAAC,oBAAoB,EACjD,SAAS,EACT,QAAQ,EACR,OAAO,EACP,SAAS,GACV,EAAE,EAAE;IACH,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,CAAC,EACrF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,oGAAoG;IACpG,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAwB,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiC,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAChE,8FAA8F;IAC9F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,mGAAmG;IACnG,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,8FAA8F;IAC9F,iFAAiF;IACjF,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,oBAAoB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,gBAAgB,GAAG,MAAM,KAAK,mBAAmB,CAAC,mBAAmB,CAAC;YAC5E,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC9H,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxB,wEAAwE;YACxE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAC9B,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5B,iGAAiG;IACjG,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;YAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7G,MAAM,cAAc,GAAG,SAAS,EAAE,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAE7E,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE;QACxC,sGAAsG;QACtG,gEAAgE;QAChE,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,eAAe,CAAC,OAAO;gBAAE,OAAO;YACpC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,qBAAqB,CAAC,OAAO,GAAG,IAAI,CAAC;YACrC,6EAA6E;YAC7E,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO;YAAE,OAAO;QAC9C,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO;YAAE,OAAO;QACtE,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE,CAAC;IACb,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,QAAiB,EAAE,EAAE;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC1C,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,MAAM,aAAa,GAAG,CAAC,CAAsB,EAAE,EAAE;QAC/C,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;YAAE,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,KAAC,yBAAyB,IACxB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,gBAAgB,EAC9B,cAAc,EAAE,YAAY,EAC5B,kBAAkB,EAAE,gBAAgB,EACpC,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,YAE5C,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,mBAAmB;wBAC7E,CAAC,CAAC,qBAAqB,CAAC,sCAAsC;wBAC9D,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,GAAQ,EACpD,OAAO,KAAK,IAAI,IAAI,CACnB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cACd,OAAO,YAAY,gCAAgC;4BAClD,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;4BAC5C,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,GACpD,GACb,CACT,EACA,cAAc,IAAI,CACjB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,GAAoB,GACnF,CACT,EACA,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3D,eAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,OAAO,gBAAa,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,aACjG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACzB,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC9E,MAAM,KAAK,MAAM,EAC/B,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAR1B,MAAM,CASJ,CACV,CAAC,EACD,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC7B,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC3G,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,EAC5D,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,IARzI,MAAM,CAAC,cAAc,CASnB,CACV,CAAC,IACE,CACP,EACA,IAAI,IAAI,CACP,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YACtB,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,GACzI,CACR,EACA,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CACjC,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAc,EACnE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,EAC/B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,EACjE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAC7B,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,SAAS,EAAC,SAAS,EACnB,YAAY,EAAC,eAAe,EAC5B,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAC3D,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,4BAA4B,CAAC,EAClE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,CAChC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,CAClF,IACG,GACoB,CAC7B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import React, { useState, useCallback, useEffect, useRef } from 'react';\nimport { AuthMethod, ReAuthenticationPurpose, type FederatedReAuthenticationMethod, type ReAuthenticationIdentityLink } from '@wildo-ai/saas-models';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { OperationsConfirmCritical } from '~wildo-frontend-lib/components/feedback/operations-confirm-critical';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { StepUpRefusalOrigin } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\nimport {\n  FederatedReAuthenticationFailure,\n  FederatedReAuthenticationFailureReason,\n  openReAuthenticationWindow,\n} from '~wildo-frontend-lib/core/security/federated-reauthentication.frontend';\n\n/**\n * The methods a step-up can be made with, strongest first — the order the dialog offers them in.\n *\n * These are the three `POST /auth/reauth` accepts. A passkey leads because it is phishing-resistant;\n * a password comes last because it is the one a stolen session's owner is most likely to have reused.\n */\nexport const STEP_UP_METHODS: readonly StepUpMethod[] = [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.PASSWORD];\n\nexport type StepUpMethod = AuthMethod.PASSKEY | AuthMethod.TOTP | AuthMethod.PASSWORD;\n\n/**\n * What the person supplied to prove they are still the account holder. The dialog collects it; the\n * step-up context turns it into a single-use token. A passkey carries nothing here because its\n * ceremony runs after the dialog confirms — it needs a server challenge first.\n *\n * A federated proof (#1441) carries the linked identity and the window the provider will run in. The\n * window is opened BY THE DIALOG, in the Confirm click, because a browser allows a popup only there;\n * `null` means it refused.\n */\nexport type StepUpProof =\n  | { method: AuthMethod.PASSWORD; password: string }\n  | { method: AuthMethod.TOTP; code: string }\n  | { method: AuthMethod.PASSKEY }\n  | { method: FederatedReAuthenticationMethod; identityLinkId: string; popup: Window | null };\n\nconst FEDERATED_FAILURE_LABEL: Record<FederatedReAuthenticationFailureReason, SecuritySettingsLabel> = {\n  [FederatedReAuthenticationFailureReason.POPUP_BLOCKED]: SecuritySettingsLabel.REAUTH_PROVIDER_POPUP_BLOCKED,\n  // Never displayed (a cancelled dialog is closed); mapped so the table stays total over the reasons.\n  [FederatedReAuthenticationFailureReason.CANCELLED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n  [FederatedReAuthenticationFailureReason.TIMED_OUT]: SecuritySettingsLabel.REAUTH_PROVIDER_TIMED_OUT,\n  [FederatedReAuthenticationFailureReason.FAILED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n};\n\nconst METHOD_CHOICE_LABEL: Record<StepUpMethod, SecuritySettingsLabel> = {\n  [AuthMethod.PASSKEY]: SecuritySettingsLabel.REAUTH_WITH_PASSKEY,\n  [AuthMethod.TOTP]: SecuritySettingsLabel.REAUTH_WITH_TOTP,\n  [AuthMethod.PASSWORD]: SecuritySettingsLabel.REAUTH_WITH_PASSWORD,\n};\n\n/**\n * What this account can re-authenticate with for `purpose`: its local methods, in {@link STEP_UP_METHODS}\n * order, and the linked identities whose provider can re-authenticate it (#1441). One request answers both.\n *\n * Asked of the server each time the dialog opens (#1417): the answer changes as the person adds and\n * removes authenticators, and for a step-up it is narrowed by the account's step-up policy, which only\n * the server can resolve. Offering what the account merely HOLDS would show a password under a\n * passkey-only policy, accept it, and have the server refuse it.\n *\n * An EMPTY answer is kept empty: it means no factor the account holds can produce this proof, and the\n * dialog says so instead of offering one that would be refused. If the question itself fails, every\n * local method is offered: showing one the account lacks costs a refusal the person can read, while\n * offering nothing leaves them no way through at all. No linked identity is offered then: unlike a local\n * method, a provider cannot be offered blind, because starting one needs the link the answer would name.\n */\nexport async function resolveStepUpOptions(\n  purpose: ReAuthenticationPurpose,\n): Promise<{ methods: StepUpMethod[]; identityLinks: ReAuthenticationIdentityLink[] }> {\n  try {\n    const { methods, identityLinks } = await getManualCallsHttpClient().getReAuthenticationMethods(purpose);\n    const accepted = new Set<AuthMethod>(methods);\n    return { methods: STEP_UP_METHODS.filter((method) => accepted.has(method)), identityLinks: identityLinks ?? [] };\n  } catch {\n    return { methods: [...STEP_UP_METHODS], identityLinks: [] };\n  }\n}\n\n/**\n * The proof the dialog would submit for `method`, or `null` while the input cannot yet be one. A TOTP\n * code is 6 to 8 digits because the digit count is configurable (`totpOperational.digits`).\n */\nexport function buildStepUpProof(method: StepUpMethod | null, input: { password: string; code: string }): StepUpProof | null {\n  switch (method) {\n    case AuthMethod.PASSWORD:\n      return input.password.trim() ? { method, password: input.password } : null;\n    case AuthMethod.TOTP:\n      return /^\\d{6,8}$/.test(input.code.trim()) ? { method, code: input.code.trim() } : null;\n    case AuthMethod.PASSKEY:\n      return { method };\n    default:\n      return null;\n  }\n}\n\ninterface StepUpAuthDialogProps {\n  open: boolean;\n  /** Which proof the refusal asked for; decides which methods are offered (#1417). */\n  purpose: ReAuthenticationPurpose;\n  /**\n   * Who asked (#1633). When it is a CLIENT organization's policy, the proof must be a second factor, so the password\n   * and linked identities — which prove a first factor only — are not offered, and the description says whose policy\n   * asks. Absent means the account's own policy or the operation.\n   */\n  origin?: StepUpRefusalOrigin;\n  onConfirm: (proof: StepUpProof) => void;\n  onCancel: () => void;\n  /**\n   * The caught re-authentication failure, `null` when there is none. Passed as the error itself rather\n   * than as text so it is resolved HERE, through the i18n context: a wrong password used to reach the\n   * dialog as the backend's i18n reference (`authentication_user_credentials_invalid`).\n   */\n  failure: unknown;\n  isLoading: boolean;\n}\n\nexport const StepUpAuthDialog: React.FC<StepUpAuthDialogProps> = ({\n  open,\n  purpose,\n  origin = StepUpRefusalOrigin.ACCOUNT_OR_OPERATION,\n  onConfirm,\n  onCancel,\n  failure,\n  isLoading,\n}) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS });\n  const t = useCallback(\n    (key: string) => tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key),\n    [tComponent],\n  );\n\n  // `null` while the server is being asked, so the no-method message never flashes before the answer.\n  const [available, setAvailable] = useState<StepUpMethod[] | null>(null);\n  const [identityLinks, setIdentityLinks] = useState<ReAuthenticationIdentityLink[]>([]);\n  const [method, setMethod] = useState<StepUpMethod | null>(null);\n  // The chosen linked identity (#1441). Exclusive with `method`: choosing one clears the other.\n  const [link, setLink] = useState<ReAuthenticationIdentityLink | null>(null);\n  // Set while the provider's window is open. Cancel stays available then: the person may abandon the\n  // provider, and nothing else would ever end the wait early.\n  const isFederatedPendingRef = useRef(false);\n  const [password, setPassword] = useState('');\n  const [code, setCode] = useState('');\n  // OperationsConfirmCritical calls onOpenChange(false) synchronously after validationCallback.\n  // This ref prevents that premature close from cancelling the async re-auth flow.\n  const isSubmittingRef = useRef(false);\n\n  useEffect(() => {\n    if (!open) return;\n    setPassword('');\n    setCode('');\n    isSubmittingRef.current = false;\n    isFederatedPendingRef.current = false;\n    setAvailable(null);\n    setIdentityLinks([]);\n    setMethod(null);\n    setLink(null);\n    let cancelled = false;\n    void resolveStepUpOptions(purpose).then((options) => {\n      if (cancelled) return;\n      const secondFactorOnly = origin === StepUpRefusalOrigin.CLIENT_ORGANIZATION;\n      const methods = secondFactorOnly ? options.methods.filter((candidate) => candidate !== AuthMethod.PASSWORD) : options.methods;\n      const links = secondFactorOnly ? [] : options.identityLinks;\n      setAvailable(methods);\n      setIdentityLinks(links);\n      // A local method first when there is one; otherwise the first provider.\n      setMethod(methods[0] ?? null);\n      setLink(methods.length === 0 ? links[0] ?? null : null);\n    });\n    return () => { cancelled = true; };\n  }, [open, purpose, origin]);\n\n  // Reset submitting guard when async operation finishes (success closes dialog; error stays open)\n  useEffect(() => {\n    if (!isLoading) {\n      isSubmittingRef.current = false;\n      isFederatedPendingRef.current = false;\n    }\n  }, [isLoading]);\n\n  const buildProof = useCallback(() => buildStepUpProof(method, { password, code }), [method, password, code]);\n\n  const nothingOffered = available?.length === 0 && identityLinks.length === 0;\n\n  const handleValidation = useCallback(() => {\n    // No method this account holds can produce the proof: the message already says what to do, so Confirm\n    // acknowledges it and closes rather than doing nothing (#1417).\n    if (nothingOffered) {\n      onCancel();\n      return;\n    }\n    if (link) {\n      if (isSubmittingRef.current) return;\n      isSubmittingRef.current = true;\n      isFederatedPendingRef.current = true;\n      // Opened HERE, synchronously in the click, or the browser blocks it (#1441).\n      onConfirm({ method: link.method, identityLinkId: link.identityLinkId, popup: openReAuthenticationWindow() });\n      return;\n    }\n    const proof = buildProof();\n    if (!proof || isSubmittingRef.current) return;\n    isSubmittingRef.current = true;\n    onConfirm(proof);\n  }, [nothingOffered, link, buildProof, onCancel, onConfirm]);\n\n  const handleCancel = useCallback(() => {\n    if (isSubmittingRef.current && !isFederatedPendingRef.current) return;\n    setPassword('');\n    setCode('');\n    onCancel();\n  }, [onCancel]);\n\n  const handleOpenChange = useCallback((nextOpen: boolean) => {\n    if (!nextOpen && !isSubmittingRef.current) {\n      handleCancel();\n    }\n  }, [handleCancel]);\n\n  const submitOnEnter = (e: React.KeyboardEvent) => {\n    if (e.key === 'Enter') handleValidation();\n  };\n\n  if (!isReady) return null;\n\n  return (\n    <OperationsConfirmCritical\n      open={open}\n      onOpenChange={handleOpenChange}\n      cancelCallback={handleCancel}\n      validationCallback={handleValidation}\n      label={t(SecuritySettingsLabel.REAUTH_TITLE)}\n    >\n      <div className=\"space-y-4 py-4\">\n        <Text className=\"text-sm\">{t(origin === StepUpRefusalOrigin.CLIENT_ORGANIZATION\n          ? SecuritySettingsLabel.REAUTH_CLIENT_ORGANIZATION_DESCRIPTION\n          : SecuritySettingsLabel.REAUTH_DESCRIPTION)}</Text>\n        {failure !== null && (\n          <Alert variant=\"destructive\">\n            <AlertDescription>\n              {failure instanceof FederatedReAuthenticationFailure\n                ? t(FEDERATED_FAILURE_LABEL[failure.reason])\n                : toUserFacingErrorMessage(failure, t(SecuritySettingsLabel.ERROR))}\n            </AlertDescription>\n          </Alert>\n        )}\n        {nothingOffered && (\n          <Alert>\n            <AlertDescription>{t(SecuritySettingsLabel.REAUTH_NO_ACCEPTED_METHOD)}</AlertDescription>\n          </Alert>\n        )}\n        {available && available.length + identityLinks.length > 1 && (\n          <div className=\"flex flex-wrap gap-2\" role=\"group\" aria-label={t(SecuritySettingsLabel.REAUTH_TITLE)}>\n            {available.map((choice) => (\n              <Button\n                key={choice}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice === method ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice === method}\n                disabled={isLoading}\n                onClick={() => { setMethod(choice); setLink(null); }}\n              >\n                {t(METHOD_CHOICE_LABEL[choice])}\n              </Button>\n            ))}\n            {identityLinks.map((choice) => (\n              <Button\n                key={choice.identityLinkId}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice.identityLinkId === link?.identityLinkId ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice.identityLinkId === link?.identityLinkId}\n                disabled={isLoading}\n                onClick={() => { setLink(choice); setMethod(null); }}\n              >\n                {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_WITH_PROVIDER, { provider: choice.displayName })}\n              </Button>\n            ))}\n          </div>\n        )}\n        {link && (\n          <Text className=\"text-sm\">\n            {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_PROVIDER_PROMPT, { provider: link.displayName })}\n          </Text>\n        )}\n        {method === AuthMethod.PASSWORD && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_PASSWORD)}</FieldLabel>\n            <InputRoot\n              type=\"password\"\n              autoComplete=\"current-password\"\n              value={password}\n              onChange={(e) => setPassword(e.target.value)}\n              placeholder={t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.TOTP && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_TOTP_CODE)}</FieldLabel>\n            <InputRoot\n              inputMode=\"numeric\"\n              autoComplete=\"one-time-code\"\n              maxLength={8}\n              value={code}\n              onChange={(e) => setCode(e.target.value.replace(/\\D/g, ''))}\n              placeholder={t(SecuritySettingsLabel.REAUTH_TOTP_CODE_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.PASSKEY && (\n          <Text className=\"text-sm\">{t(SecuritySettingsLabel.REAUTH_PASSKEY_PROMPT)}</Text>\n        )}\n      </div>\n    </OperationsConfirmCritical>\n  );\n};\n"]}
+{"version":3,"file":"StepUpAuthDialog.js","sourceRoot":"","sources":["../../../../../src/components/auth/StepUpAuthDialog.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,UAAU,EAAoG,MAAM,uBAAuB,CAAC;AACrJ,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AAChH,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAAE,MAAM,sEAAsE,CAAC;AAC3G,OAAO,EACL,gCAAgC,EAChC,sCAAsC,EACtC,0BAA0B,GAC3B,MAAM,uEAAuE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;AAmBnH,MAAM,uBAAuB,GAA0E;IACrG,CAAC,sCAAsC,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC,6BAA6B;IAC3G,oGAAoG;IACpG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;IAChG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,yBAAyB;IACnG,CAAC,sCAAsC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;CAC9F,CAAC;AAEF,MAAM,mBAAmB,GAAgD;IACvE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,mBAAmB;IAC/D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,gBAAgB;IACzD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC,oBAAoB;CAClE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAa,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA2B,EAAE,KAAyC;IACrG,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,KAAK,UAAU,CAAC,IAAI;YAClB,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,KAAK,UAAU,CAAC,OAAO;YACrB,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,MAAM,gBAAgB,GAAoC,CAAC,EAChE,IAAI,EACJ,OAAO,EACP,MAAM,GAAG,mBAAmB,CAAC,oBAAoB,EACjD,SAAS,EACT,QAAQ,EACR,OAAO,EACP,SAAS,GACV,EAAE,EAAE;IACH,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,CAAC,EACrF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,oGAAoG;IACpG,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAwB,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiC,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAChE,8FAA8F;IAC9F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,mGAAmG;IACnG,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,8FAA8F;IAC9F,iFAAiF;IACjF,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,oBAAoB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,gBAAgB,GAAG,MAAM,KAAK,mBAAmB,CAAC,qBAAqB,CAAC;YAC9E,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC9H,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxB,wEAAwE;YACxE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAC9B,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5B,iGAAiG;IACjG,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;YAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7G,MAAM,cAAc,GAAG,SAAS,EAAE,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAE7E,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE;QACxC,sGAAsG;QACtG,gEAAgE;QAChE,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,eAAe,CAAC,OAAO;gBAAE,OAAO;YACpC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,qBAAqB,CAAC,OAAO,GAAG,IAAI,CAAC;YACrC,6EAA6E;YAC7E,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO;YAAE,OAAO;QAC9C,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO;YAAE,OAAO;QACtE,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE,CAAC;IACb,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,QAAiB,EAAE,EAAE;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC1C,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,MAAM,aAAa,GAAG,CAAC,CAAsB,EAAE,EAAE;QAC/C,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;YAAE,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,KAAC,yBAAyB,IACxB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,gBAAgB,EAC9B,cAAc,EAAE,YAAY,EAC5B,kBAAkB,EAAE,gBAAgB,EACpC,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,YAE5C,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,qBAAqB;wBAC/E,CAAC,CAAC,qBAAqB,CAAC,wCAAwC;wBAChE,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,GAAQ,EACpD,OAAO,KAAK,IAAI,IAAI,CACnB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cACd,OAAO,YAAY,gCAAgC;4BAClD,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;4BAC5C,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,GACpD,GACb,CACT,EACA,cAAc,IAAI,CACjB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,GAAoB,GACnF,CACT,EACA,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3D,eAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,OAAO,gBAAa,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,aACjG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACzB,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC9E,MAAM,KAAK,MAAM,EAC/B,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAR1B,MAAM,CASJ,CACV,CAAC,EACD,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC7B,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC3G,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,EAC5D,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,IARzI,MAAM,CAAC,cAAc,CASnB,CACV,CAAC,IACE,CACP,EACA,IAAI,IAAI,CACP,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YACtB,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,GACzI,CACR,EACA,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CACjC,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAc,EACnE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,EAC/B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,EACjE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAC7B,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,SAAS,EAAC,SAAS,EACnB,YAAY,EAAC,eAAe,EAC5B,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAC3D,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,4BAA4B,CAAC,EAClE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,CAChC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,CAClF,IACG,GACoB,CAC7B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import React, { useState, useCallback, useEffect, useRef } from 'react';\nimport { AuthMethod, ReAuthenticationPurpose, type FederatedReAuthenticationMethod, type ReAuthenticationIdentityLink } from '@wildo-ai/saas-models';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { OperationsConfirmCritical } from '~wildo-frontend-lib/components/feedback/operations-confirm-critical';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { StepUpRefusalOrigin } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\nimport {\n  FederatedReAuthenticationFailure,\n  FederatedReAuthenticationFailureReason,\n  openReAuthenticationWindow,\n} from '~wildo-frontend-lib/core/security/federated-reauthentication.frontend';\n\n/**\n * The methods a step-up can be made with, strongest first — the order the dialog offers them in.\n *\n * These are the three `POST /auth/reauth` accepts. A passkey leads because it is phishing-resistant;\n * a password comes last because it is the one a stolen session's owner is most likely to have reused.\n */\nexport const STEP_UP_METHODS: readonly StepUpMethod[] = [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.PASSWORD];\n\nexport type StepUpMethod = AuthMethod.PASSKEY | AuthMethod.TOTP | AuthMethod.PASSWORD;\n\n/**\n * What the person supplied to prove they are still the account holder. The dialog collects it; the\n * step-up context turns it into a single-use token. A passkey carries nothing here because its\n * ceremony runs after the dialog confirms — it needs a server challenge first.\n *\n * A federated proof (#1441) carries the linked identity and the window the provider will run in. The\n * window is opened BY THE DIALOG, in the Confirm click, because a browser allows a popup only there;\n * `null` means it refused.\n */\nexport type StepUpProof =\n  | { method: AuthMethod.PASSWORD; password: string }\n  | { method: AuthMethod.TOTP; code: string }\n  | { method: AuthMethod.PASSKEY }\n  | { method: FederatedReAuthenticationMethod; identityLinkId: string; popup: Window | null };\n\nconst FEDERATED_FAILURE_LABEL: Record<FederatedReAuthenticationFailureReason, SecuritySettingsLabel> = {\n  [FederatedReAuthenticationFailureReason.POPUP_BLOCKED]: SecuritySettingsLabel.REAUTH_PROVIDER_POPUP_BLOCKED,\n  // Never displayed (a cancelled dialog is closed); mapped so the table stays total over the reasons.\n  [FederatedReAuthenticationFailureReason.CANCELLED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n  [FederatedReAuthenticationFailureReason.TIMED_OUT]: SecuritySettingsLabel.REAUTH_PROVIDER_TIMED_OUT,\n  [FederatedReAuthenticationFailureReason.FAILED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n};\n\nconst METHOD_CHOICE_LABEL: Record<StepUpMethod, SecuritySettingsLabel> = {\n  [AuthMethod.PASSKEY]: SecuritySettingsLabel.REAUTH_WITH_PASSKEY,\n  [AuthMethod.TOTP]: SecuritySettingsLabel.REAUTH_WITH_TOTP,\n  [AuthMethod.PASSWORD]: SecuritySettingsLabel.REAUTH_WITH_PASSWORD,\n};\n\n/**\n * What this account can re-authenticate with for `purpose`: its local methods, in {@link STEP_UP_METHODS}\n * order, and the linked identities whose provider can re-authenticate it (#1441). One request answers both.\n *\n * Asked of the server each time the dialog opens (#1417): the answer changes as the person adds and\n * removes authenticators, and for a step-up it is narrowed by the account's step-up policy, which only\n * the server can resolve. Offering what the account merely HOLDS would show a password under a\n * passkey-only policy, accept it, and have the server refuse it.\n *\n * An EMPTY answer is kept empty: it means no factor the account holds can produce this proof, and the\n * dialog says so instead of offering one that would be refused. If the question itself fails, every\n * local method is offered: showing one the account lacks costs a refusal the person can read, while\n * offering nothing leaves them no way through at all. No linked identity is offered then: unlike a local\n * method, a provider cannot be offered blind, because starting one needs the link the answer would name.\n */\nexport async function resolveStepUpOptions(\n  purpose: ReAuthenticationPurpose,\n): Promise<{ methods: StepUpMethod[]; identityLinks: ReAuthenticationIdentityLink[] }> {\n  try {\n    const { methods, identityLinks } = await getManualCallsHttpClient().getReAuthenticationMethods(purpose);\n    const accepted = new Set<AuthMethod>(methods);\n    return { methods: STEP_UP_METHODS.filter((method) => accepted.has(method)), identityLinks: identityLinks ?? [] };\n  } catch {\n    return { methods: [...STEP_UP_METHODS], identityLinks: [] };\n  }\n}\n\n/**\n * The proof the dialog would submit for `method`, or `null` while the input cannot yet be one. A TOTP\n * code is 6 to 8 digits because the digit count is configurable (`totpOperational.digits`).\n */\nexport function buildStepUpProof(method: StepUpMethod | null, input: { password: string; code: string }): StepUpProof | null {\n  switch (method) {\n    case AuthMethod.PASSWORD:\n      return input.password.trim() ? { method, password: input.password } : null;\n    case AuthMethod.TOTP:\n      return /^\\d{6,8}$/.test(input.code.trim()) ? { method, code: input.code.trim() } : null;\n    case AuthMethod.PASSKEY:\n      return { method };\n    default:\n      return null;\n  }\n}\n\ninterface StepUpAuthDialogProps {\n  open: boolean;\n  /** Which proof the refusal asked for; decides which methods are offered (#1417). */\n  purpose: ReAuthenticationPurpose;\n  /**\n   * Who asked (#1633). When it is a GRANTING organization's policy, the proof must be a second factor, so the password\n   * and linked identities — which prove a first factor only — are not offered, and the description says whose policy\n   * asks. Absent means the account's own policy or the operation.\n   */\n  origin?: StepUpRefusalOrigin;\n  onConfirm: (proof: StepUpProof) => void;\n  onCancel: () => void;\n  /**\n   * The caught re-authentication failure, `null` when there is none. Passed as the error itself rather\n   * than as text so it is resolved HERE, through the i18n context: a wrong password used to reach the\n   * dialog as the backend's i18n reference (`authentication_user_credentials_invalid`).\n   */\n  failure: unknown;\n  isLoading: boolean;\n}\n\nexport const StepUpAuthDialog: React.FC<StepUpAuthDialogProps> = ({\n  open,\n  purpose,\n  origin = StepUpRefusalOrigin.ACCOUNT_OR_OPERATION,\n  onConfirm,\n  onCancel,\n  failure,\n  isLoading,\n}) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS });\n  const t = useCallback(\n    (key: string) => tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key),\n    [tComponent],\n  );\n\n  // `null` while the server is being asked, so the no-method message never flashes before the answer.\n  const [available, setAvailable] = useState<StepUpMethod[] | null>(null);\n  const [identityLinks, setIdentityLinks] = useState<ReAuthenticationIdentityLink[]>([]);\n  const [method, setMethod] = useState<StepUpMethod | null>(null);\n  // The chosen linked identity (#1441). Exclusive with `method`: choosing one clears the other.\n  const [link, setLink] = useState<ReAuthenticationIdentityLink | null>(null);\n  // Set while the provider's window is open. Cancel stays available then: the person may abandon the\n  // provider, and nothing else would ever end the wait early.\n  const isFederatedPendingRef = useRef(false);\n  const [password, setPassword] = useState('');\n  const [code, setCode] = useState('');\n  // OperationsConfirmCritical calls onOpenChange(false) synchronously after validationCallback.\n  // This ref prevents that premature close from cancelling the async re-auth flow.\n  const isSubmittingRef = useRef(false);\n\n  useEffect(() => {\n    if (!open) return;\n    setPassword('');\n    setCode('');\n    isSubmittingRef.current = false;\n    isFederatedPendingRef.current = false;\n    setAvailable(null);\n    setIdentityLinks([]);\n    setMethod(null);\n    setLink(null);\n    let cancelled = false;\n    void resolveStepUpOptions(purpose).then((options) => {\n      if (cancelled) return;\n      const secondFactorOnly = origin === StepUpRefusalOrigin.GRANTING_ORGANIZATION;\n      const methods = secondFactorOnly ? options.methods.filter((candidate) => candidate !== AuthMethod.PASSWORD) : options.methods;\n      const links = secondFactorOnly ? [] : options.identityLinks;\n      setAvailable(methods);\n      setIdentityLinks(links);\n      // A local method first when there is one; otherwise the first provider.\n      setMethod(methods[0] ?? null);\n      setLink(methods.length === 0 ? links[0] ?? null : null);\n    });\n    return () => { cancelled = true; };\n  }, [open, purpose, origin]);\n\n  // Reset submitting guard when async operation finishes (success closes dialog; error stays open)\n  useEffect(() => {\n    if (!isLoading) {\n      isSubmittingRef.current = false;\n      isFederatedPendingRef.current = false;\n    }\n  }, [isLoading]);\n\n  const buildProof = useCallback(() => buildStepUpProof(method, { password, code }), [method, password, code]);\n\n  const nothingOffered = available?.length === 0 && identityLinks.length === 0;\n\n  const handleValidation = useCallback(() => {\n    // No method this account holds can produce the proof: the message already says what to do, so Confirm\n    // acknowledges it and closes rather than doing nothing (#1417).\n    if (nothingOffered) {\n      onCancel();\n      return;\n    }\n    if (link) {\n      if (isSubmittingRef.current) return;\n      isSubmittingRef.current = true;\n      isFederatedPendingRef.current = true;\n      // Opened HERE, synchronously in the click, or the browser blocks it (#1441).\n      onConfirm({ method: link.method, identityLinkId: link.identityLinkId, popup: openReAuthenticationWindow() });\n      return;\n    }\n    const proof = buildProof();\n    if (!proof || isSubmittingRef.current) return;\n    isSubmittingRef.current = true;\n    onConfirm(proof);\n  }, [nothingOffered, link, buildProof, onCancel, onConfirm]);\n\n  const handleCancel = useCallback(() => {\n    if (isSubmittingRef.current && !isFederatedPendingRef.current) return;\n    setPassword('');\n    setCode('');\n    onCancel();\n  }, [onCancel]);\n\n  const handleOpenChange = useCallback((nextOpen: boolean) => {\n    if (!nextOpen && !isSubmittingRef.current) {\n      handleCancel();\n    }\n  }, [handleCancel]);\n\n  const submitOnEnter = (e: React.KeyboardEvent) => {\n    if (e.key === 'Enter') handleValidation();\n  };\n\n  if (!isReady) return null;\n\n  return (\n    <OperationsConfirmCritical\n      open={open}\n      onOpenChange={handleOpenChange}\n      cancelCallback={handleCancel}\n      validationCallback={handleValidation}\n      label={t(SecuritySettingsLabel.REAUTH_TITLE)}\n    >\n      <div className=\"space-y-4 py-4\">\n        <Text className=\"text-sm\">{t(origin === StepUpRefusalOrigin.GRANTING_ORGANIZATION\n          ? SecuritySettingsLabel.REAUTH_GRANTING_ORGANIZATION_DESCRIPTION\n          : SecuritySettingsLabel.REAUTH_DESCRIPTION)}</Text>\n        {failure !== null && (\n          <Alert variant=\"destructive\">\n            <AlertDescription>\n              {failure instanceof FederatedReAuthenticationFailure\n                ? t(FEDERATED_FAILURE_LABEL[failure.reason])\n                : toUserFacingErrorMessage(failure, t(SecuritySettingsLabel.ERROR))}\n            </AlertDescription>\n          </Alert>\n        )}\n        {nothingOffered && (\n          <Alert>\n            <AlertDescription>{t(SecuritySettingsLabel.REAUTH_NO_ACCEPTED_METHOD)}</AlertDescription>\n          </Alert>\n        )}\n        {available && available.length + identityLinks.length > 1 && (\n          <div className=\"flex flex-wrap gap-2\" role=\"group\" aria-label={t(SecuritySettingsLabel.REAUTH_TITLE)}>\n            {available.map((choice) => (\n              <Button\n                key={choice}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice === method ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice === method}\n                disabled={isLoading}\n                onClick={() => { setMethod(choice); setLink(null); }}\n              >\n                {t(METHOD_CHOICE_LABEL[choice])}\n              </Button>\n            ))}\n            {identityLinks.map((choice) => (\n              <Button\n                key={choice.identityLinkId}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice.identityLinkId === link?.identityLinkId ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice.identityLinkId === link?.identityLinkId}\n                disabled={isLoading}\n                onClick={() => { setLink(choice); setMethod(null); }}\n              >\n                {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_WITH_PROVIDER, { provider: choice.displayName })}\n              </Button>\n            ))}\n          </div>\n        )}\n        {link && (\n          <Text className=\"text-sm\">\n            {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_PROVIDER_PROMPT, { provider: link.displayName })}\n          </Text>\n        )}\n        {method === AuthMethod.PASSWORD && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_PASSWORD)}</FieldLabel>\n            <InputRoot\n              type=\"password\"\n              autoComplete=\"current-password\"\n              value={password}\n              onChange={(e) => setPassword(e.target.value)}\n              placeholder={t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.TOTP && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_TOTP_CODE)}</FieldLabel>\n            <InputRoot\n              inputMode=\"numeric\"\n              autoComplete=\"one-time-code\"\n              maxLength={8}\n              value={code}\n              onChange={(e) => setCode(e.target.value.replace(/\\D/g, ''))}\n              placeholder={t(SecuritySettingsLabel.REAUTH_TOTP_CODE_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.PASSKEY && (\n          <Text className=\"text-sm\">{t(SecuritySettingsLabel.REAUTH_PASSKEY_PROMPT)}</Text>\n        )}\n      </div>\n    </OperationsConfirmCritical>\n  );\n};\n"]}

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_SecuritySettings.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAmLzE,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,EAkY5C,CAAC"}
+{"version":3,"file":"AppPage_SecuritySettings.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAkMjF,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,EAgZ5C,CAAC"}

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.js

@@ -1,20 +1,22 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { useCallback, useEffect, useMemo, useState } from 'react';
-import { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { ButtonSize, FrontendComponentType, SecuritySettingsLabel, resolveVocabularyWordKey } from '@wildo-ai/presets-components-models';
 import { Card, CardContent } from '../../../components/sections/card.js';
 import { Badge } from '../../../components/data-display/badge.js';
 import { useIconRegistry } from '../../../core/icons/useIconRegistry.js';
-import { IconSize } from '../../../core/icons/icon-registry.frontend.schemas.js';
+import { StandardIconReference, IconSize } from '../../../core/icons/icon-registry.frontend.schemas.js';
 import { AUTH_METHOD_ICON_REFERENCES } from '../../../components/auth/methods/auth-method-presentation.js';
 import { cn } from '../../../core/ui/cn.js';
 import { Button, ButtonVariants_Variant } from '../../../components/actions/button.js';
 import { Text } from '../../../components/typography/text.js';
 import { Alert, AlertDescription } from '../../../components/overlays/containers/alert.js';
+import { AlertDialog, AlertDialogAction, AlertDialogCancel, AlertDialogContent, AlertDialogDescription, AlertDialogFooter, AlertDialogHeader, AlertDialogTitle, } from '../../../components/overlays/containers/alert-dialog.js';
 import { InputRoot } from '../../../components/form/controls/input.js';
 import { Field, FieldLabel } from '../../../components/form/chromes/field.js';
-import { AuthMethod, AuthUtils, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { AuthMethod, AuthUtils, isWildoBackendError, SessionClientBrowser, SessionClientOperatingSystem, SessionClientVocabulary, } from '@wildo-ai/saas-models';
 import { FormProvider, useForm } from 'react-hook-form';
 import { useI18n } from '../../../core/i18n/useI18n.js';
+import { unresolvedLabel } from '../../../core/i18n/I18nContext.js';
 import { useUserFacingErrorMessage } from '../../../core/errors/useUserFacingErrorMessage.js';
 import { useApplication } from '../../../core/runtime/useApplication.js';
 import { useAuthSession } from '../../../core/security/useAuthSession.js';
@@ -68,7 +70,7 @@ const SecurityFactorRow = ({ icon, title, description, state, statusLabel, meta,
 };
 export const AppPage_SecuritySettings = () => {
     const { auth } = useApplication();
-    const { auth: authState } = useAuthSession();
+    const { auth: authState, signOutEverywhere } = useAuthSession();
     const { user } = useUserOrgs();
     const resolvedAuth = useResolvedAuthConfig();
     const toUserFacingErrorMessage = useUserFacingErrorMessage();
@@ -276,7 +278,7 @@ export const AppPage_SecuritySettings = () => {
     return (_jsxs("div", { className: "flex flex-col gap-section", children: [_jsx("h3", { className: "text-base font-semibold tracking-tight", children: t(SecuritySettingsLabel.PAGE_TITLE) }), error && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) })), successMsg && (_jsx(Alert, { children: _jsx(AlertDescription, { children: successMsg }) })), loading ? (_jsx(Text, { className: "text-muted-foreground", children: t(SecuritySettingsLabel.LOADING) })) : (_jsx(Card, { children: _jsxs(CardContent, { className: "flex flex-col divide-y divide-border p-card", children: [PasskeySection, TotpSection, PhoneSection, _jsx(PasswordSection, { hasPassword: hasPassword, passwordPolicy: passwordPolicy, userEmail: user?.email, t: t, tPolicy: tPolicy, onSuccess: () => {
                                 setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));
                                 refresh();
-                            }, onError: (msg) => setError(msg) }), _jsx(IdentityLinksSection, { links: resolvedIdentityLinks, allowRemoval: allowRemoval, t: t, onUnlink: handleUnlinkIdentity })] }) }))] }));
+                            }, onError: (msg) => setError(msg) }), _jsx(IdentityLinksSection, { links: resolvedIdentityLinks, allowRemoval: allowRemoval, t: t, onUnlink: handleUnlinkIdentity })] }) })), !loading && (_jsx(Card, { children: _jsx(CardContent, { className: "flex flex-col divide-y divide-border p-card", children: _jsx(SessionsSection, { t: t, formatDate: formatDate, onSignOutEverywhere: signOutEverywhere, onError: (caught) => setError(toUserFacingErrorMessage(caught)) }) }) }))] }));
 };
 const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, onSuccess, onError }) => {
     const toUserFacingErrorMessage = useUserFacingErrorMessage();
@@ -342,5 +344,91 @@ const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, o
                 setForm.reset();
             }, children: t(SecuritySettingsLabel.CANCEL) })) : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setEditing(true), children: t(hasPassword ? SecuritySettingsLabel.PASSWORD_CHANGE : SecuritySettingsLabel.PASSWORD_SET) })), children: !editing ? null : hasPassword ? (_jsx(FormProvider, { ...changeForm, children: _jsxs("form", { onSubmit: changeForm.handleSubmit(handleChange), className: "space-y-4", children: [_jsx(CredentialUsernameAutofillField, { email: userEmail }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CURRENT) }), _jsx(InputRoot, { type: "password", autoComplete: "current-password", ...changeForm.register('currentPassword', { required: true }) })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_NEW) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...changeForm.register('newPassword', { required: true }) }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: tPolicy })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CONFIRM) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...changeForm.register('confirmPassword', { required: true }) })] }), _jsx(Button, { type: "submit", disabled: submitting, children: t(SecuritySettingsLabel.PASSWORD_CHANGE) })] }) })) : (_jsx(FormProvider, { ...setForm, children: _jsxs("form", { onSubmit: setForm.handleSubmit(handleSet), className: "space-y-4", children: [_jsx(CredentialUsernameAutofillField, { email: userEmail }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_NEW) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...setForm.register('newPassword', { required: true }) }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: tPolicy })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CONFIRM) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...setForm.register('confirmPassword', { required: true }) })] }), _jsx(Button, { type: "submit", disabled: submitting, children: t(SecuritySettingsLabel.PASSWORD_SET) })] }) })) }));
 };
+/**
+ * Where the account is signed in (#2317): every live session, with the one in use marked, a way to sign any
+ * other one out, and a way to sign out of all of them.
+ *
+ * Signing out everywhere is confirmed first, because it also ends the session the person is using; on success the
+ * tab is signed out, so nothing renders a success message, and on failure the person stays signed in and is told,
+ * since the other devices still are. Signing out ONE other session is not confirmed: it only takes access away from
+ * a device, the person usually reaches for it because they no longer trust that device, and the device can sign in
+ * again. The session in use has no such control here; signing out of it is the ordinary sign-out.
+ */
+const SessionsSection = ({ t, formatDate, onSignOutEverywhere, onError }) => {
+    const { renderIcon } = useIconRegistry();
+    const { t: tGlobal } = useI18n();
+    const [confirming, setConfirming] = useState(false);
+    const [signingOut, setSigningOut] = useState(false);
+    const [sessions, setSessions] = useState(null);
+    const [revoking, setRevoking] = useState(null);
+    // The parent passes `onError` inline, so it is a new function on every render; held in a ref, it neither refetches
+    // the list nor rebuilds the handlers each time the panel re-renders.
+    const onErrorRef = useRef(onError);
+    onErrorRef.current = onError;
+    useEffect(() => {
+        let cancelled = false;
+        getManualCallsHttpClient().listMySessions()
+            .then((response) => { if (!cancelled)
+            setSessions(response.sessions); })
+            .catch((caught) => { if (!cancelled) {
+            setSessions([]);
+            onErrorRef.current(caught);
+        } });
+        return () => { cancelled = true; };
+    }, []);
+    const handleRevoke = useCallback(async (sessionId) => {
+        setRevoking(sessionId);
+        const removeRow = () => setSessions((current) => current?.filter((session) => session.sessionId !== sessionId) ?? null);
+        try {
+            await getManualCallsHttpClient().revokeMySession(sessionId);
+            removeRow();
+        }
+        catch (caught) {
+            // 404: the session ended on its own since the list was read (signed out, expired, retired by the session limit).
+            // What the person asked for is already true, so the row goes and nothing is reported.
+            if (caught?.httpStatus === 404)
+                removeRow();
+            else
+                onErrorRef.current(caught);
+        }
+        finally {
+            setRevoking(null);
+        }
+    }, []);
+    /*
+     * A browser's and a system's words are their vocabularies' (`system_enums.SessionClientBrowser.chrome`), the same words
+     * the new-sign-in-client email shows for them (#2929): one source, so the email and the page it links to agree. A
+     * value with no word shows as itself, a missing label that looks missing.
+     */
+    const clientWord = (vocabulary, value) => {
+        const key = resolveVocabularyWordKey(vocabulary, value);
+        const word = tGlobal(key);
+        return word === key ? unresolvedLabel(value) : word;
+    };
+    const describeDevice = (session) => t(SecuritySettingsLabel.SESSION_DEVICE, {
+        browser: clientWord(SessionClientVocabulary.BROWSER, session.browser ?? SessionClientBrowser.OTHER),
+        operatingSystem: clientWord(SessionClientVocabulary.OPERATING_SYSTEM, session.operatingSystem ?? SessionClientOperatingSystem.OTHER),
+    });
+    const describeDetails = (session) => session.ipAddress
+        ? t(SecuritySettingsLabel.SESSION_DETAILS, { address: session.ipAddress, lastActive: formatDate(session.lastActiveAt) })
+        : t(SecuritySettingsLabel.SESSION_LAST_ACTIVE, { lastActive: formatDate(session.lastActiveAt) });
+    const handleConfirm = useCallback(async () => {
+        setSigningOut(true);
+        try {
+            await onSignOutEverywhere();
+        }
+        catch (caught) {
+            setSigningOut(false);
+            setConfirming(false);
+            onError(caught);
+        }
+    }, [onSignOutEverywhere, onError]);
+    return (_jsxs("div", { className: "flex flex-col gap-item", children: [_jsxs("div", { className: "flex flex-row items-start gap-item", children: [_jsx("div", { "aria-hidden": "true", className: "flex size-9 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground", children: renderIcon(StandardIconReference.LOGOUT, { size: IconSize.SM }) }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-element-xs", children: [_jsx(Text, { className: "font-medium leading-snug", children: t(SecuritySettingsLabel.SECTION_SESSIONS) }), _jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE_DESCRIPTION) })] }), _jsx("div", { className: "flex shrink-0 items-center gap-element-xs", children: _jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => setConfirming(true), disabled: signingOut, children: t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE) }) }), _jsx(AlertDialog, { open: confirming, onOpenChange: (open) => { if (!open && !signingOut)
+                            setConfirming(false); }, children: _jsxs(AlertDialogContent, { children: [_jsxs(AlertDialogHeader, { children: [_jsx(AlertDialogTitle, { children: t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE_CONFIRM_TITLE) }), _jsx(AlertDialogDescription, { children: t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE_CONFIRM_DESCRIPTION) })] }), _jsxs(AlertDialogFooter, { children: [_jsx(AlertDialogCancel, { disabled: signingOut, children: t(SecuritySettingsLabel.CANCEL) }), _jsx(AlertDialogAction, { disabled: signingOut, onClick: (event) => {
+                                                // Held open until the backend answers: closing first would hide a failure.
+                                                event.preventDefault();
+                                                void handleConfirm();
+                                            }, children: t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE) })] })] }) })] }), sessions && sessions.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element ps-[calc(var(--spacing)*9+var(--sp-item))]", "aria-label": t(SecuritySettingsLabel.SECTION_SESSIONS), children: sessions.map((session) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", "data-session-id": session.sessionId, children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsxs("div", { className: "flex flex-wrap items-center gap-element-xs", children: [_jsx(Text, { className: "truncate font-medium", children: describeDevice(session) }), session.isCurrent && _jsx(Badge, { variant: "secondary", children: t(SecuritySettingsLabel.SESSION_THIS_DEVICE) })] }), _jsx(Text, { className: "truncate text-xs text-muted-foreground", children: describeDetails(session) })] }), !session.isCurrent && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, disabled: revoking === session.sessionId, onClick: () => { void handleRevoke(session.sessionId); }, children: t(SecuritySettingsLabel.SESSION_SIGN_OUT) }))] }, session.sessionId))) }))] }));
+};
 const IdentityLinksSection = ({ links, allowRemoval, t, onUnlink }) => (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2], title: t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS), description: t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION), state: links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE, statusLabel: t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), children: links.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element", children: links.map((link) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: link.providerLabel }), _jsx(Text, { className: "truncate text-xs text-muted-foreground", children: link.providerEmail })] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => onUnlink(link._id), children: t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK) }))] }, link._id))) })) }));
 //# sourceMappingURL=AppPage_SecuritySettings.js.map

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_SecuritySettings.js","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,KAAK,EAA8B,MAAM,mDAAmD,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAyB,QAAQ,EAAE,MAAM,+DAA+D,CAAC;AAChH,OAAO,EAAE,2BAA2B,EAAE,MAAM,sEAAsE,CAAC;AACnH,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,GAIpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAA2B,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qEAAqE,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4FAA4F,CAAC;AAsBpG;;;;;;GAMG;AACH,IAAK,mBAIJ;AAJD,WAAK,mBAAmB;IACtB,wCAAiB,CAAA;IACjB,4CAAqB,CAAA;IACrB,kDAA2B,CAAA;AAC7B,CAAC,EAJI,mBAAmB,KAAnB,mBAAmB,QAIvB;AAED,MAAM,0BAA0B,GAAuD;IACrF,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,SAAS;IACvC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,SAAS;IACzC,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,WAAW;CAC/C,CAAC;AA4CF;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAqC,CAAC,EAC3D,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GACrE,EAAE,EAAE;IACH,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,KAAK,mBAAmB,CAAC,MAAM,CAAC;IAEtD,OAAO;IACL,gGAAgG;IAChG,oGAAoG;IACpG,yCAAyC;IACzC,eAAK,SAAS,EAAC,sDAAsD,aACnE,eAAK,SAAS,EAAC,oCAAoC,aAGjD,6BACc,MAAM,EAClB,SAAS,EAAE,EAAE,CACX,6DAA6D,EAC7D,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,gCAAgC,CAC3E,YAEA,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GACpC,EAEN,eAAK,SAAS,EAAC,6CAA6C,aAC1D,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,IAAI,IAAC,SAAS,EAAC,0BAA0B,YAAE,KAAK,GAAQ,EACzD,KAAC,KAAK,IAAC,OAAO,EAAE,0BAA0B,CAAC,KAAK,CAAC,YAAG,WAAW,GAAS,IACpE,EACL,CAAC,QAAQ,IAAI,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,WAAW,GAAQ,EACjF,IAAI,IACD,EAEL,MAAM,IAAI,cAAK,SAAS,EAAC,2CAA2C,YAAE,MAAM,GAAO,IAChF,EAKL,QAAQ,IAAI,CACX,cAAK,SAAS,EAAC,mEAAmE,YAAE,QAAQ,GAAO,CACpG,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAa,GAAG,EAAE;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAmB,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,mGAAmG;IACnG,sGAAsG;IACtG,MAAM,yBAAyB,GAAG,OAAO,CACvC,GAAG,EAAE,CAAC,uCAAuC,CAC3C,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAChF,EACD,CAAC,aAAa,CAAC,CAChB,CAAC;IACF,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QACxE,SAAS,EAAE;YACT,qBAAqB,CAAC,6BAA6B;YACnD,qBAAqB,CAAC,4BAA4B;YAClD,qBAAqB,CAAC,kCAAkC;SACzD;QACD,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,MAAwC,EAAE,EAAE,CACxD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,EAAE,MAAM,CAAC,EAC9E,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,CAAC,EACpF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;IAC1C,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACrE,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;IACnD,MAAM,WAAW,GAAG,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAC5D,MAAM,YAAY,GAAG,gBAAgB,EAAE,sBAAsB,IAAI,IAAI,CAAC;IAEtE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC5D,MAAM,CAAC,YAAY,EAAE;gBACrB,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,MAAM,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;aACvD,CAAC,CAAC;YACH,UAAU,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACrC,WAAW,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAC3C,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,EAAE,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAElC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,sFAAsF;IACtF,iGAAiG;IACjG,iGAAiG;IACjG,4CAA4C;IAC5C,MAAM,6BAA6B,GAAG,SAAS,CAAC,gCAAgC,EAAE,CAAC;IACnF,MAAM,oBAAoB,GAAG,OAAO;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC;SAC3F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC,2BAA2B,CAC/D,SAAS,CAAC,cAAc,EAAE,WAAW,IAAI,KAAK,EAC9C,SAAS,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EACzE,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAE,SAAS,CAAC,2BAA4C,EAChH,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,oBAAoB,IAAI,EAAE,CACjE,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,SAAS,EAAE,QAAQ,IAAI,KAAK,CAAC;IACnD,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,WAAiC,CAAC;IAC1E,MAAM,qBAAqB,GAAG,OAAO,CACnC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,IAAI;QACP,aAAa,EAAE,mCAAmC,CAAC;YACjD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW;YACzE,SAAS,EAAE,iBAAiB;SAC7B,CAAC;KACH,CAAC,CAAC,EACH,CAAC,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAChE,CAAC;IAEF,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC9C,IAAI,QAAQ,CAAC,MAAM,IAAI,WAAW;YAAE,OAAO;QAC3C,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO;QACzE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,sBAAsB,EAAE,CAAsD,CAAC;YAC7G,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;YACrJ,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEzE,MAAM,mBAAmB,GAAG,WAAW,CACrC,KAAK,EAAE,YAAoB,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC7D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EACD,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CACrD,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,cAAc,EAAE,CAAC;YAClD,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE3C,MAAM,oBAAoB,GAAG,WAAW,CACtC,KAAK,EAAE,MAAc,EAAE,EAAE;QACvB,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC5D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EACD,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CACrD,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACxF,MAAM,YAAY,GAAG,CAAC,iBAAiB;QACrC,CAAC,CAAC,mBAAmB,CAAC,WAAW;QACjC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAEpF,MAAM,cAAc,GAAG,CAAC,KAA0B,EAAU,EAAE;QAC5D,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YAC/E,KAAK,mBAAmB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;YACzF,KAAK,mBAAmB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CACrB,MAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,OAAO,CAAC,EACrD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAChD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,EACzC,MAAM,EAAE,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAC3D,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB,YACrG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAC7F,CACV,CAAC,CAAC,CAAC,SAAS,aAEZ,CAAC,iBAAiB,IAAI,CACrB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAoB,GAC7E,CACT,EAGA,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3C,aAAI,SAAS,EAAC,2BAA2B,YACtC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CACpB,cAA0B,SAAS,EAAC,wEAAwE,aAC1G,eAAK,SAAS,EAAC,uBAAuB,aACpC,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,EAAE,CAAC,IAAI,GAAQ,EACtD,EAAE,CAAC,SAAS,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAC5C,CAAC,CAAC,qBAAqB,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,GACtE,CACR,IACG,EACL,YAAY,IAAI,CACf,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,YACtH,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,GACjC,CACV,KAbM,EAAE,CAAC,YAAY,CAcnB,CACN,CAAC,GACC,CACN,IACiB,CACrB,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IACtF,MAAM,WAAW,GAAG,CAClB,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,IAAI,CAAC,EAClD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EACtD,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EACtC,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAChB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,YACxE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,CAAC,CAAC,SAAS,CAAC;YACd,wEAAwE;YACxE,2DAA2D;YAC3D,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAC9B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,YACpF,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAC7B,CACV,CAAC,YAEH,OAAO,CAAC,CAAC,CAAC,CACT,4BACG,YAAY,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CACtG,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAoB,GAC/E,CACT,GACA,CACJ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CACnB,KAAC,oBAAoB,IACnB,UAAU,EAAE,GAAG,EAAE;gBACf,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,GACjF,CACH,CAAC,CAAC,CAAC,IAAI,GACU,CACrB,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAC7F,MAAM,YAAY,GAAG,CACnB,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,OAAO,CAAC,EACrD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAC7C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EACvD,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC;QACvC,gGAAgG;QAChG,+FAA+F;QAC/F,IAAI,EAAE,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,WAAW,GAAQ,CAAC,CAAC,CAAC,SAAS,EAC/F,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CACtB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,YACrF,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CACjC,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,YACrF,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,YAED,aAAa,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAC5D,KAAC,qBAAqB,IACpB,UAAU,EAAE,GAAG,EAAE;gBACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,GACjF,CACH,CAAC,CAAC,CAAC,IAAI,GACU,CACrB,CAAC;IAEF,8EAA8E;IAC9E,8DAA8D;IAC9D,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,gEAAgE;IAChE,4EAA4E;IAC5E,wEAAwE;IACxE,2DAA2D;IAE3D,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aAKxC,aAAI,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAAM,EAEhG,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EACA,UAAU,IAAI,CACb,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,UAAU,GAAoB,GAC3C,CACT,EAEA,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,IAAI,IAAC,SAAS,EAAC,uBAAuB,YAAE,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAQ,CAClF,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cACH,MAAC,WAAW,IAAC,SAAS,EAAC,6CAA6C,aACjE,cAAc,EACd,WAAW,EACX,YAAY,EACb,KAAC,eAAe,IACd,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,IAAI,EAAE,KAAK,EACtB,CAAC,EAAE,CAAC,EACJ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,GAAG,EAAE;gCACd,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;gCAChD,OAAO,EAAE,CAAC;4BACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAC/B,EACF,KAAC,oBAAoB,IACnB,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,YAAY,EAC1B,CAAC,EAAE,CAAC,EACJ,QAAQ,EAAE,oBAAoB,GAC9B,IACU,GACT,CACR,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAkBF,MAAM,eAAe,GAAmC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACrI,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAA4E;QACpG,aAAa,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;KAC7E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAmD;QACxE,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,IAA+E,EAAE,EAAE;QACxF,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACxF,SAAS,EAAE,CAAC;YACZ,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAC9D,CAAC;IAEF,MAAM,SAAS,GAAG,WAAW,CAC3B,KAAK,EAAE,IAAsD,EAAE,EAAE;QAC/D,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/D,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAC3D,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAEtF,OAAO,CACL,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,QAAQ,CAAC,EACtD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAChD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,EAC/G,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAChB,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,OAAO,EAAE,GAAG,EAAE;gBACZ,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC,YAEA,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,GACzB,CACV,CAAC,CAAC,CAAC,CACF,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAC7E,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GACrF,CACV,YAEA,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAC7B,KAAC,YAAY,OAAK,UAAU,YAC1B,gBAAM,QAAQ,EAAE,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,SAAS,EAAC,WAAW,aAQ1E,KAAC,+BAA+B,IAAC,KAAK,EAAE,SAAS,GAAI,EACrD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,KAC3B,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC9D,IACI,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAc,EAChE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC1D,EACF,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,GAAI,IACnF,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC9D,IACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,YACvC,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAClC,IACJ,GACM,CAChB,CAAC,CAAC,CAAC,CACF,KAAC,YAAY,OAAK,OAAO,YACvB,gBAAM,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAC,WAAW,aAEpE,KAAC,+BAA+B,IAAC,KAAK,EAAE,SAAS,GAAI,EACrD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAc,EAChE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GACvD,EACF,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,GAAI,IACnF,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC3D,IACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,YACvC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,IACJ,GACM,CAChB,GACe,CACrB,CAAC;AACJ,CAAC,CAAC;AASF,MAAM,oBAAoB,GAAwC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAC1G,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,eAAe,CAAC,EAC7D,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,EACtD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,EAChE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EACnF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,YAInH,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CACnB,aAAI,SAAS,EAAC,2BAA2B,YACtC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,cAAmB,SAAS,EAAC,wEAAwE,aACnG,eAAK,SAAS,EAAC,uBAAuB,aACpC,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,IAAI,CAAC,aAAa,GAAQ,EAClE,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,IAAI,CAAC,aAAa,GAAQ,IAChF,EACL,YAAY,IAAI,CACf,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,YACpG,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GACxC,CACV,KATM,IAAI,CAAC,GAAG,CAUZ,CACN,CAAC,GACC,CACN,GACiB,CACrB,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useState } from 'react';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { Card, CardContent } from '~wildo-frontend-lib/components/sections/card';\nimport { Badge, type BadgeVariants_Variant } from '~wildo-frontend-lib/components/data-display/badge';\nimport { useIconRegistry } from '~wildo-frontend-lib/core/icons/useIconRegistry';\nimport { StandardIconReference, IconSize } from '~wildo-frontend-lib/core/icons/icon-registry.frontend.schemas';\nimport { AUTH_METHOD_ICON_REFERENCES } from '~wildo-frontend-lib/components/auth/methods/auth-method-presentation';\nimport { cn } from '~wildo-frontend-lib/core/ui/cn';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport {\n  AuthMethod,\n  AuthUtils,\n  isWildoBackendError,\n  type ExternalIdentitySource,\n  type PasswordPolicyRules,\n  type SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport { FormProvider, useForm } from 'react-hook-form';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { AuthSessionUtils } from '~wildo-frontend-lib/core/security/auth-session.utils';\nimport { PasswordStrengthIndicator, DEFAULT_PASSWORD_POLICY } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport { TotpEnrollmentMethod } from '~wildo-frontend-lib/components/auth/enrollment/TotpEnrollmentMethod';\nimport { PhoneEnrollmentMethod } from '~wildo-frontend-lib/components/auth/enrollment/PhoneEnrollmentMethod';\nimport { startRegistration } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/browser';\nimport { buildProviderDisplayNameLabelKey } from '@wildo-ai/saas-models/public-runtime';\nimport {\n  collectFrontendProviderDisplayLabelKeys,\n  resolveFrontendProviderDisplayLabel,\n} from '~wildo-frontend-lib/core/external-providers/frontend-provider-display-label.frontend.utils';\n\n// A new `SecuritySettingsLabel` member (`@wildo-ai/presets-components-models`)\n// must ALSO be declared in `AppPage_SecuritySettings.labels.ts`, beside this\n// file: that list — key, kind, purpose — is what the dev companion scans\n// statically to plan and translate the words, and an enum member missing\n// from it never reaches the labelling pipeline. The shared step-up dialog\n// (`StepUpAuthDialog`) reads the same component's keys.\n\ntype EnrolledMethod = { method: string; enrolled: boolean; enrolledAt?: string; details?: Record<string, unknown> };\ntype PasskeyCred = { credentialId: string; name: string; createdAt: string };\ntype IdentityLink = {\n  _id: string;\n  connectionType: SsoConnectionType;\n  source: ExternalIdentitySource;\n  providerRef: string;\n  providerEmail: string;\n  linkedAt: string;\n  lastUsedAt: string;\n};\ntype ResolvedIdentityLink = IdentityLink & { providerLabel: string };\n\n/**\n * Presentational state of one authentication factor.\n *\n * `UNAVAILABLE` is NOT \"off\" — it means the current device/browser cannot offer\n * the factor at all (no WebAuthn support), which is a different instruction to\n * the user than \"you have not set this up yet\" and therefore a distinct badge.\n */\nenum SecurityFactorState {\n  ACTIVE = 'active',\n  INACTIVE = 'inactive',\n  UNAVAILABLE = 'unavailable',\n}\n\nconst FACTOR_STATE_BADGE_VARIANT: Record<SecurityFactorState, BadgeVariants_Variant> = {\n  [SecurityFactorState.ACTIVE]: 'success',\n  [SecurityFactorState.INACTIVE]: 'outline',\n  [SecurityFactorState.UNAVAILABLE]: 'secondary',\n};\n\ninterface SecurityFactorRowProps {\n  /** Glyph identifying the method — resolved through the icon registry so apps can re-skin it. */\n  icon: StandardIconReference;\n  title: string;\n  /**\n   * Plain-language \"what this is / why it matters\" line — shown only while the factor is NOT active.\n   *\n   * It is a prompt for a decision the person has not taken yet (\"Authenticator apps provide one-time\n   * codes as a second sign-in step\" beside \"Set up authenticator app\"). Once the factor protects the\n   * account the decision is made, the badge says so, and the sentence is read on every visit for\n   * nothing — the same reason a read view carries no section descriptions.\n   */\n  description: string;\n  state: SecurityFactorState;\n  statusLabel: string;\n  /**\n   * A live detail the badge cannot carry — today only the masked verified phone number.\n   *\n   * Nothing that RESTATES the badge belongs here. \"Password is set.\" under \"Password · Active\",\n   * \"No authenticator app is set up.\" under \"Not configured\", and \"1 linked accounts\" above the list\n   * of that one account were each the same fact twice; they were removed with their labels.\n   */\n  meta?: React.ReactNode;\n  /**\n   * The factor's primary control, pinned to the inline-end of the header row.\n   * Every row's action lands on the same axis, so the column reads as a list of\n   * choices rather than as five stacked mini-pages — the account-security idiom\n   * used by mainstream providers. Anything that must expand (an enrolment flow,\n   * a credential list, a form) goes to `children` instead.\n   *\n   * Row actions are OUTLINE, without exception. They are peers: the panel offers\n   * five alternative ways to protect an account and recommends none of them, so\n   * filling any one of them would assert a priority the page does not hold —\n   * and five filled buttons stacked down a column assert five priorities, which\n   * is the same as none while costing all the emphasis. The filled variant is\n   * reserved for the commit action INSIDE an opened disclosure, where there\n   * genuinely is one thing to do next.\n   */\n  action?: React.ReactNode;\n  children?: React.ReactNode;\n}\n\n/**\n * One authentication factor, presented as a scannable row: glyph · name · what\n * it is · live status, with its primary control pinned to the row's end.\n *\n * This replaced a stack of visually identical title-only cards, which forced the\n * user to READ every card to learn which factors were active and offered no\n * explanation of what any factor was. The status badge and the icon carry that\n * information pre-attentively; the description makes the choice informed. The\n * shape follows the account-security idiom used by mainstream providers.\n */\nconst SecurityFactorRow: React.FC<SecurityFactorRowProps> = ({\n  icon, title, description, state, statusLabel, meta, action, children,\n}) => {\n  const { renderIcon } = useIconRegistry();\n  const isActive = state === SecurityFactorState.ACTIVE;\n\n  return (\n    // One row of ONE card: the factors are a single list of alternatives, so they share a frame and\n    // are separated by hairlines (the settings-row idiom) rather than each carrying a card of its own —\n    // five stacked cards read as five pages.\n    <div className=\"flex flex-col gap-item py-group first:pt-0 last:pb-0\">\n      <div className=\"flex flex-row items-start gap-item\">\n        {/* Tinted glyph tile — tinted only when the factor is live, so the eye\n            lands on what is protecting the account before any text is read. */}\n        <div\n          aria-hidden=\"true\"\n          className={cn(\n            'flex size-9 shrink-0 items-center justify-center rounded-md',\n            isActive ? 'bg-success/10 text-success' : 'bg-muted text-muted-foreground',\n          )}\n        >\n          {renderIcon(icon, { size: IconSize.SM })}\n        </div>\n\n        <div className=\"flex min-w-0 flex-1 flex-col gap-element-xs\">\n          <div className=\"flex flex-wrap items-center gap-element-xs\">\n            <Text className=\"font-medium leading-snug\">{title}</Text>\n            <Badge variant={FACTOR_STATE_BADGE_VARIANT[state]}>{statusLabel}</Badge>\n          </div>\n          {!isActive && <Text className=\"text-sm text-muted-foreground\">{description}</Text>}\n          {meta}\n        </div>\n\n        {action && <div className=\"flex shrink-0 items-center gap-element-xs\">{action}</div>}\n      </div>\n\n      {/* Expanded content aligns with the TEXT column, not the glyph: the\n          indent is the glyph tile (`size-9`) plus the row gap, so a form or a\n          credential list continues the sentence it belongs to. */}\n      {children && (\n        <div className=\"flex flex-col gap-item ps-[calc(var(--spacing)*9+var(--sp-item))]\">{children}</div>\n      )}\n    </div>\n  );\n};\n\nexport const AppPage_SecuritySettings: React.FC = () => {\n  const { auth } = useApplication();\n  const { auth: authState } = useAuthSession();\n  const { user } = useUserOrgs();\n  const resolvedAuth = useResolvedAuthConfig();\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  const [methods, setMethods] = useState<EnrolledMethod[]>([]);\n  const [passkeys, setPasskeys] = useState<PasskeyCred[]>([]);\n  const [identityLinks, setIdentityLinks] = useState<IdentityLink[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [successMsg, setSuccessMsg] = useState<string | null>(null);\n  const [showTotpEnroll, setShowTotpEnroll] = useState(false);\n  const [showPhoneEnroll, setShowPhoneEnroll] = useState(false);\n  const [passkeyRegistering, setPasskeyRegistering] = useState(false);\n  // The linked provider's name is `providers.<ref>.displayName`, derived from the ref the link holds\n  // (#1701) — never read off a frontend provider module, since sign-in runs no vendor code in the page.\n  const identityProviderLabelKeys = useMemo(\n    () => collectFrontendProviderDisplayLabelKeys(\n      identityLinks.map((link) => buildProviderDisplayNameLabelKey(link.providerRef)),\n    ),\n    [identityLinks],\n  );\n  const { tComponent, t: translateProvider, isReady, formatDate } = useI18n({\n    component: [\n      FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS,\n      FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER,\n      FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED,\n    ],\n    keys: identityProviderLabelKeys,\n  });\n  const t = useCallback(\n    (key: string, params?: Record<string, string | number>) =>\n      tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key, params),\n    [tComponent],\n  );\n  const tPolicy = useCallback(\n    (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, key),\n    [tComponent],\n  );\n\n  const passkeyConfig = auth?.passkeyConfig;\n  const methodManagement = resolvedAuth.userTypeAuth?.methodManagement;\n  const passwordPolicy = resolvedAuth.passwordPolicy;\n  const maxPasskeys = passkeyConfig?.maxPasskeysPerUser ?? 10;\n  const allowRemoval = methodManagement?.allowUserMethodRemoval ?? true;\n\n  const refresh = useCallback(async () => {\n    setLoading(true);\n    setError(null);\n    try {\n      const client = getManualCallsHttpClient();\n      const [methodsRes, passkeysRes, linksRes] = await Promise.all([\n        client.getMyMethods(),\n        client.passkeyList().catch(() => ({ credentials: [] })),\n        client.getIdentityLinks().catch(() => ({ links: [] })),\n      ]);\n      setMethods(methodsRes.methods ?? []);\n      setPasskeys(passkeysRes.credentials ?? []);\n      setIdentityLinks(linksRes.links ?? []);\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n    } finally {\n      setLoading(false);\n    }\n  }, [t, toUserFacingErrorMessage]);\n\n  useEffect(() => {\n    refresh();\n  }, [refresh]);\n\n  useEffect(() => {\n    if (!successMsg) return;\n    const timer = setTimeout(() => setSuccessMsg(null), 5000);\n    return () => clearTimeout(timer);\n  }, [successMsg]);\n\n  // Derived, not listed. The literal `[TOTP, PASSKEY, SMS_OTP]` that stood here was the\n  // second-factor vocabulary minus the factors that need no enrollment — correct on the day it was\n  // written and silently short the day a fifth second factor is added, since a method missing from\n  // the list simply never counts as enrolled.\n  const enrollableSecondFactorMethods = AuthUtils.getEnrollableSecondFactorMethods();\n  const enrolledSecondFactor = methods\n    .filter((m) => m.enrolled && enrollableSecondFactorMethods.includes(m.method as AuthMethod))\n    .map((m) => m.method as AuthMethod);\n  const completeness = AuthSessionUtils.evaluateAccountCompleteness(\n    authState.identification?.requiresMFA ?? false,\n    authState.identification?.secondFactorMethods?.map((m) => m.method) ?? [],\n    enrolledSecondFactor.length > 0 ? enrolledSecondFactor : (authState.enrolledSecondFactorMethods as AuthMethod[]),\n    resolvedAuth.userTypeAuth?.mfaPolicy?.acceptableMFAMethods ?? [],\n  );\n\n  const hasPassword = methods.some((m) => m.method === AuthMethod.PASSWORD && m.enrolled);\n  const hasTotp = methods.some((m) => m.method === AuthMethod.TOTP && m.enrolled);\n  const smsMethod = methods.find((m) => m.method === AuthMethod.SMS_OTP);\n  const phoneVerified = smsMethod?.enrolled ?? false;\n  const phoneMasked = smsMethod?.details?.phoneNumber as string | undefined;\n  const resolvedIdentityLinks = useMemo(\n    () => identityLinks.map((link) => ({\n      ...link,\n      providerLabel: resolveFrontendProviderDisplayLabel({\n        providerRef: link.providerRef,\n        displayName: auth?.socialOAuth2Providers?.[link.providerRef]?.displayName,\n        translate: translateProvider,\n      }),\n    })),\n    [auth?.socialOAuth2Providers, identityLinks, translateProvider],\n  );\n\n  const handlePasskeyAdd = useCallback(async () => {\n    if (passkeys.length >= maxPasskeys) return;\n    if (typeof window === 'undefined' || !window.PublicKeyCredential) return;\n    setPasskeyRegistering(true);\n    setError(null);\n    try {\n      const client = getManualCallsHttpClient();\n      const options = (await client.passkeyRegisterOptions()) as unknown as PublicKeyCredentialCreationOptionsJSON;\n      const credential = await startRegistration({ optionsJSON: options });\n      await client.passkeyRegisterVerify({ response: credential });\n      setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n      refresh();\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      const msg = e?.name === 'NotAllowedError' ? t(SecuritySettingsLabel.PASSKEY_CANCELLED) : toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR));\n      setError(msg);\n    } finally {\n      setPasskeyRegistering(false);\n    }\n  }, [maxPasskeys, passkeys.length, refresh, t, toUserFacingErrorMessage]);\n\n  const handlePasskeyRemove = useCallback(\n    async (credentialId: string) => {\n      if (!allowRemoval) return;\n      try {\n        await getManualCallsHttpClient().passkeyRemove(credentialId);\n        setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n        refresh();\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      }\n    },\n    [allowRemoval, refresh, t, toUserFacingErrorMessage],\n  );\n\n  /*\n   * No re-authentication handling here, deliberately. Where the user type asks for it, the server\n   * answers `STEP_UP_REQUIRED` and the HTTP client answers that by itself — the shared step-up dialog\n   * (`StepUpAuthProvider`), then a replay carrying `X-Reauth-Token`. The same is true of adding a\n   * passkey, confirming TOTP and confirming a phone below. This page used to carry its own password-only\n   * copy of that dialog for this one action, and nothing for the binding actions at all.\n   */\n  const handleTotpDisable = useCallback(async () => {\n    try {\n      await getManualCallsHttpClient().mfaTOTPDisable();\n      setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n      setShowTotpEnroll(false);\n      refresh();\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n    }\n  }, [refresh, t, toUserFacingErrorMessage]);\n\n  const handleUnlinkIdentity = useCallback(\n    async (linkId: string) => {\n      if (!allowRemoval) return;\n      try {\n        await getManualCallsHttpClient().unlinkIdentityLink(linkId);\n        setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n        refresh();\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      }\n    },\n    [allowRemoval, refresh, t, toUserFacingErrorMessage],\n  );\n\n  if (!isReady) return null;\n\n  // Passkeys are only offerable where WebAuthn exists; an unsupported browser is\n  // a distinct state from \"not set up yet\" and gets its own badge + no CTA.\n  const passkeysSupported = typeof window !== 'undefined' && !!window.PublicKeyCredential;\n  const passkeyState = !passkeysSupported\n    ? SecurityFactorState.UNAVAILABLE\n    : passkeys.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n\n  const statusLabelFor = (state: SecurityFactorState): string => {\n    switch (state) {\n      case SecurityFactorState.ACTIVE: return t(SecuritySettingsLabel.STATUS_ACTIVE);\n      case SecurityFactorState.UNAVAILABLE: return t(SecuritySettingsLabel.STATUS_UNAVAILABLE);\n      case SecurityFactorState.INACTIVE: return t(SecuritySettingsLabel.STATUS_NOT_CONFIGURED);\n    }\n  };\n\n  const PasskeySection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY]}\n      title={t(SecuritySettingsLabel.SECTION_PASSKEYS)}\n      description={t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION)}\n      state={passkeyState}\n      statusLabel={statusLabelFor(passkeyState)}\n      action={passkeysSupported && passkeys.length < maxPasskeys ? (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={handlePasskeyAdd} disabled={passkeyRegistering}>\n          {passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD)}\n        </Button>\n      ) : undefined}\n    >\n      {!passkeysSupported && (\n        <Alert>\n          <AlertDescription>{t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED)}</AlertDescription>\n        </Alert>\n      )}\n      {/* The registered passkeys ARE the detail: no count above them, and no \"No passkeys added\n          yet.\" when there are none — the \"Not configured\" badge already says it. */}\n      {passkeysSupported && passkeys.length > 0 && (\n        <ul className=\"flex flex-col gap-element\">\n          {passkeys.map((pk) => (\n            <li key={pk.credentialId} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\">\n              <div className=\"flex min-w-0 flex-col\">\n                <Text className=\"truncate font-medium\">{pk.name}</Text>\n                {pk.createdAt && (\n                  <Text className=\"text-xs text-muted-foreground\">\n                    {t(SecuritySettingsLabel.PASSKEY_ADDED, { date: formatDate(pk.createdAt) })}\n                  </Text>\n                )}\n              </div>\n              {allowRemoval && (\n                <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => handlePasskeyRemove(pk.credentialId)}>\n                  {t(SecuritySettingsLabel.PASSKEY_REMOVE)}\n                </Button>\n              )}\n            </li>\n          ))}\n        </ul>\n      )}\n    </SecurityFactorRow>\n  );\n\n  const totpState = hasTotp ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n  const TotpSection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP]}\n      title={t(SecuritySettingsLabel.SECTION_TOTP)}\n      description={t(SecuritySettingsLabel.TOTP_DESCRIPTION)}\n      state={totpState}\n      statusLabel={statusLabelFor(totpState)}\n      action={hasTotp\n        ? (allowRemoval ? (\n          <Button variant={ButtonVariants_Variant.OUTLINE} onClick={handleTotpDisable}>\n            {t(SecuritySettingsLabel.TOTP_DISABLE)}\n          </Button>\n        ) : undefined)\n        // While the enrolment flow is open its own controls own the row, so the\n        // opener is withdrawn rather than left as a second way in.\n        : (showTotpEnroll ? undefined : (\n          <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowTotpEnroll(true)}>\n            {t(SecuritySettingsLabel.TOTP_SETUP)}\n          </Button>\n        ))}\n    >\n      {hasTotp ? (\n        <>\n          {completeness.enrolledMethods.length === 1 && completeness.enrolledMethods.includes(AuthMethod.TOTP) && (\n            <Alert>\n              <AlertDescription>{t(SecuritySettingsLabel.TOTP_ONLY_MFA_WARNING)}</AlertDescription>\n            </Alert>\n          )}\n        </>\n      ) : showTotpEnroll ? (\n        <TotpEnrollmentMethod\n          onComplete={() => {\n            setShowTotpEnroll(false);\n            refresh();\n          }}\n          onError={(msg) => setError(msg)}\n          isLoading={false}\n          t={(k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k)}\n        />\n      ) : null}\n    </SecurityFactorRow>\n  );\n\n  const phoneState = phoneVerified ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n  const PhoneSection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP]}\n      title={t(SecuritySettingsLabel.SECTION_PHONE)}\n      description={t(SecuritySettingsLabel.PHONE_DESCRIPTION)}\n      state={phoneState}\n      statusLabel={statusLabelFor(phoneState)}\n      // WHICH number is verified is the one thing the \"Active\" badge cannot say, so the masked number\n      // stands alone — no \"Verified:\" in front of it (the badge) and no sentence when there is none.\n      meta={phoneVerified && phoneMasked ? <Text className=\"text-sm\">{phoneMasked}</Text> : undefined}\n      action={phoneVerified ? (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowPhoneEnroll(true)}>\n          {t(SecuritySettingsLabel.PHONE_CHANGE)}\n        </Button>\n      ) : (showPhoneEnroll ? undefined : (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowPhoneEnroll(true)}>\n          {t(SecuritySettingsLabel.PHONE_VERIFY)}\n        </Button>\n      ))}\n    >\n      {phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (\n        <PhoneEnrollmentMethod\n          onComplete={() => {\n            setShowPhoneEnroll(false);\n            refresh();\n          }}\n          onError={(msg) => setError(msg)}\n          isLoading={false}\n          t={(k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k)}\n        />\n      ) : null}\n    </SecurityFactorRow>\n  );\n\n  // ── No posture summary, deliberately ───────────────────────────────────────\n  // Two rejected designs, for whoever is tempted to re-add one:\n  //   1. \"Your account is fully secured\" keyed off `completeness.isComplete` —\n  //      that flag answers \"does this satisfy the app's auth POLICY?\", and it is\n  //      `true` whenever MFA is not required. It therefore claimed a fully\n  //      secured account for an account with zero second factors.\n  //   2. An \"n of 4 sign-in methods active\" ratio with a progress meter — a\n  //      score with no referent. The denominator is not a target: nobody needs\n  //      SMS *and* TOTP *and* a passkey, the factors are alternatives, and the\n  //      remedy differs per factor. A meter that fills toward a number the user\n  //      should not reach measures nothing and invites gaming it.\n  // The rows below already carry the state (per-factor badge) and the meaning\n  // (per-factor description). A summary that restates them as a number is\n  // strictly less information, presented as if it were more.\n\n  return (\n    <div className=\"flex flex-col gap-section\">\n      {/* `h3`, not `h2`: the Settings Hub header owns the `h2` for this dialog,\n          so a panel heading is one level below it. */}\n      {/* No sub-heading: \"Manage how you sign in and protect your account\" restated the heading and the\n          five factor names beneath it. */}\n      <h3 className=\"text-base font-semibold tracking-tight\">{t(SecuritySettingsLabel.PAGE_TITLE)}</h3>\n\n      {error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n      )}\n      {successMsg && (\n        <Alert>\n          <AlertDescription>{successMsg}</AlertDescription>\n        </Alert>\n      )}\n\n      {loading ? (\n        <Text className=\"text-muted-foreground\">{t(SecuritySettingsLabel.LOADING)}</Text>\n      ) : (\n        <Card>\n          <CardContent className=\"flex flex-col divide-y divide-border p-card\">\n            {PasskeySection}\n            {TotpSection}\n            {PhoneSection}\n            <PasswordSection\n              hasPassword={hasPassword}\n              passwordPolicy={passwordPolicy}\n              userEmail={user?.email}\n              t={t}\n              tPolicy={tPolicy}\n              onSuccess={() => {\n                setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n                refresh();\n              }}\n              onError={(msg) => setError(msg)}\n            />\n            <IdentityLinksSection\n              links={resolvedIdentityLinks}\n              allowRemoval={allowRemoval}\n              t={t}\n              onUnlink={handleUnlinkIdentity}\n            />\n          </CardContent>\n        </Card>\n      )}\n    </div>\n  );\n};\n\ninterface PasswordSectionProps {\n  hasPassword: boolean;\n  passwordPolicy: PasswordPolicyRules;\n  /**\n   * Signed-in user's email. Rendered as a visually-hidden\n   * `autocomplete=\"username\"` field inside each password form so password\n   * managers associate the saved/updated credential with the correct account\n   * (Chromium also warns when a password form has no username field).\n   */\n  userEmail?: string;\n  t: (k: string, params?: Record<string, string | number>) => string;\n  tPolicy: (k: string) => string;\n  onSuccess: () => void;\n  onError: (msg: string) => void;\n}\n\nconst PasswordSection: React.FC<PasswordSectionProps> = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, onSuccess, onError }) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const [submitting, setSubmitting] = useState(false);\n  // The credential form is a DISCLOSURE, not the row's resting state. Rendered\n  // eagerly it was four inputs plus a strength meter permanently open beneath a\n  // one-line row, which made this factor read as the page's subject and the\n  // other four as its footnotes. Every row now rests at the same height and\n  // opens on request.\n  const [editing, setEditing] = useState(false);\n  const changeForm = useForm<{ currentPassword: string; newPassword: string; confirmPassword: string }>({\n    defaultValues: { currentPassword: '', newPassword: '', confirmPassword: '' },\n  });\n  const setForm = useForm<{ newPassword: string; confirmPassword: string }>({\n    defaultValues: { newPassword: '', confirmPassword: '' },\n  });\n\n  const handleChange = useCallback(\n    async (data: { currentPassword: string; newPassword: string; confirmPassword: string }) => {\n      if (data.newPassword !== data.confirmPassword) {\n        onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));\n        return;\n      }\n      setSubmitting(true);\n      try {\n        await getManualCallsHttpClient().passwordChange(data.currentPassword, data.newPassword);\n        onSuccess();\n        changeForm.reset();\n        setEditing(false);\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      } finally {\n        setSubmitting(false);\n      }\n    },\n    [changeForm, onError, onSuccess, t, toUserFacingErrorMessage],\n  );\n\n  const handleSet = useCallback(\n    async (data: { newPassword: string; confirmPassword: string }) => {\n      if (data.newPassword !== data.confirmPassword) {\n        onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));\n        return;\n      }\n      setSubmitting(true);\n      try {\n        await getManualCallsHttpClient().passwordSet(data.newPassword);\n        onSuccess();\n        setForm.reset();\n        setEditing(false);\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      } finally {\n        setSubmitting(false);\n      }\n    },\n    [onError, onSuccess, setForm, t, toUserFacingErrorMessage],\n  );\n\n  const state = hasPassword ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n\n  return (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD]}\n      title={t(SecuritySettingsLabel.SECTION_PASSWORD)}\n      description={t(SecuritySettingsLabel.PASSWORD_DESCRIPTION)}\n      state={state}\n      statusLabel={t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED)}\n      action={editing ? (\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          onClick={() => {\n            setEditing(false);\n            changeForm.reset();\n            setForm.reset();\n          }}\n        >\n          {t(SecuritySettingsLabel.CANCEL)}\n        </Button>\n      ) : (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setEditing(true)}>\n          {t(hasPassword ? SecuritySettingsLabel.PASSWORD_CHANGE : SecuritySettingsLabel.PASSWORD_SET)}\n        </Button>\n      )}\n    >\n      {!editing ? null : hasPassword ? (\n          <FormProvider {...changeForm}>\n            <form onSubmit={changeForm.handleSubmit(handleChange)} className=\"space-y-4\">\n              {/*\n                Hidden username field. Gives password managers the account\n                context they need to associate the updated credential, and\n                resolves Chromium's \"password forms should have an (optionally\n                hidden) username field\" warning. Must precede the password\n                inputs so managers pair the username with them.\n              */}\n              <CredentialUsernameAutofillField email={userEmail} />\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CURRENT)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"current-password\"\n                  {...changeForm.register('currentPassword', { required: true })}\n                />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_NEW)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...changeForm.register('newPassword', { required: true })}\n                />\n                <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={tPolicy} />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CONFIRM)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...changeForm.register('confirmPassword', { required: true })}\n                />\n              </Field>\n              <Button type=\"submit\" disabled={submitting}>\n                {t(SecuritySettingsLabel.PASSWORD_CHANGE)}\n              </Button>\n            </form>\n          </FormProvider>\n        ) : (\n          <FormProvider {...setForm}>\n            <form onSubmit={setForm.handleSubmit(handleSet)} className=\"space-y-4\">\n              {/* Hidden username field — see the note in the change-password form above. */}\n              <CredentialUsernameAutofillField email={userEmail} />\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_NEW)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...setForm.register('newPassword', { required: true })}\n                />\n                <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={tPolicy} />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CONFIRM)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...setForm.register('confirmPassword', { required: true })}\n                />\n              </Field>\n              <Button type=\"submit\" disabled={submitting}>\n                {t(SecuritySettingsLabel.PASSWORD_SET)}\n              </Button>\n            </form>\n          </FormProvider>\n        )}\n    </SecurityFactorRow>\n  );\n};\n\ninterface IdentityLinksSectionProps {\n  links: ResolvedIdentityLink[];\n  allowRemoval: boolean;\n  t: (k: string, params?: Record<string, string | number>) => string;\n  onUnlink: (linkId: string) => void;\n}\n\nconst IdentityLinksSection: React.FC<IdentityLinksSectionProps> = ({ links, allowRemoval, t, onUnlink }) => (\n  <SecurityFactorRow\n    icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2]}\n    title={t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS)}\n    description={t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION)}\n    state={links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE}\n    statusLabel={t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED)}\n  >\n    {/* The linked accounts ARE the detail: no count above the list, no empty sentence under a\n        \"Not configured\" badge. */}\n    {links.length > 0 && (\n      <ul className=\"flex flex-col gap-element\">\n        {links.map((link) => (\n          <li key={link._id} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\">\n            <div className=\"flex min-w-0 flex-col\">\n              <Text className=\"truncate font-medium\">{link.providerLabel}</Text>\n              <Text className=\"truncate text-xs text-muted-foreground\">{link.providerEmail}</Text>\n            </div>\n            {allowRemoval && (\n              <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => onUnlink(link._id)}>\n                {t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK)}\n              </Button>\n            )}\n          </li>\n        ))}\n      </ul>\n    )}\n  </SecurityFactorRow>\n);\n"]}
+{"version":3,"file":"AppPage_SecuritySettings.js","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACzI,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,KAAK,EAA8B,MAAM,mDAAmD,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,+DAA+D,CAAC;AAChH,OAAO,EAAE,2BAA2B,EAAE,MAAM,sEAAsE,CAAC;AACnH,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iEAAiE,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,EAInB,oBAAoB,EACpB,4BAA4B,EAC5B,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAA2B,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qEAAqE,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4FAA4F,CAAC;AAsBpG;;;;;;GAMG;AACH,IAAK,mBAIJ;AAJD,WAAK,mBAAmB;IACtB,wCAAiB,CAAA;IACjB,4CAAqB,CAAA;IACrB,kDAA2B,CAAA;AAC7B,CAAC,EAJI,mBAAmB,KAAnB,mBAAmB,QAIvB;AAED,MAAM,0BAA0B,GAAuD;IACrF,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,SAAS;IACvC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,SAAS;IACzC,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,WAAW;CAC/C,CAAC;AA4CF;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAqC,CAAC,EAC3D,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GACrE,EAAE,EAAE;IACH,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,KAAK,mBAAmB,CAAC,MAAM,CAAC;IAEtD,OAAO;IACL,gGAAgG;IAChG,oGAAoG;IACpG,yCAAyC;IACzC,eAAK,SAAS,EAAC,sDAAsD,aACnE,eAAK,SAAS,EAAC,oCAAoC,aAGjD,6BACc,MAAM,EAClB,SAAS,EAAE,EAAE,CACX,6DAA6D,EAC7D,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,gCAAgC,CAC3E,YAEA,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GACpC,EAEN,eAAK,SAAS,EAAC,6CAA6C,aAC1D,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,IAAI,IAAC,SAAS,EAAC,0BAA0B,YAAE,KAAK,GAAQ,EACzD,KAAC,KAAK,IAAC,OAAO,EAAE,0BAA0B,CAAC,KAAK,CAAC,YAAG,WAAW,GAAS,IACpE,EACL,CAAC,QAAQ,IAAI,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,WAAW,GAAQ,EACjF,IAAI,IACD,EAEL,MAAM,IAAI,cAAK,SAAS,EAAC,2CAA2C,YAAE,MAAM,GAAO,IAChF,EAKL,QAAQ,IAAI,CACX,cAAK,SAAS,EAAC,mEAAmE,YAAE,QAAQ,GAAO,CACpG,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAa,GAAG,EAAE;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,cAAc,EAAE,CAAC;IAChE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAmB,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,mGAAmG;IACnG,sGAAsG;IACtG,MAAM,yBAAyB,GAAG,OAAO,CACvC,GAAG,EAAE,CAAC,uCAAuC,CAC3C,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAChF,EACD,CAAC,aAAa,CAAC,CAChB,CAAC;IACF,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QACxE,SAAS,EAAE;YACT,qBAAqB,CAAC,6BAA6B;YACnD,qBAAqB,CAAC,4BAA4B;YAClD,qBAAqB,CAAC,kCAAkC;SACzD;QACD,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,MAAwC,EAAE,EAAE,CACxD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,EAAE,MAAM,CAAC,EAC9E,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,CAAC,EACpF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;IAC1C,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACrE,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;IACnD,MAAM,WAAW,GAAG,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAC5D,MAAM,YAAY,GAAG,gBAAgB,EAAE,sBAAsB,IAAI,IAAI,CAAC;IAEtE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC5D,MAAM,CAAC,YAAY,EAAE;gBACrB,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,MAAM,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;aACvD,CAAC,CAAC;YACH,UAAU,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACrC,WAAW,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAC3C,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,EAAE,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAElC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,sFAAsF;IACtF,iGAAiG;IACjG,iGAAiG;IACjG,4CAA4C;IAC5C,MAAM,6BAA6B,GAAG,SAAS,CAAC,gCAAgC,EAAE,CAAC;IACnF,MAAM,oBAAoB,GAAG,OAAO;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC;SAC3F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC,2BAA2B,CAC/D,SAAS,CAAC,cAAc,EAAE,WAAW,IAAI,KAAK,EAC9C,SAAS,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EACzE,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAE,SAAS,CAAC,2BAA4C,EAChH,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,oBAAoB,IAAI,EAAE,CACjE,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,SAAS,EAAE,QAAQ,IAAI,KAAK,CAAC;IACnD,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,WAAiC,CAAC;IAC1E,MAAM,qBAAqB,GAAG,OAAO,CACnC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,IAAI;QACP,aAAa,EAAE,mCAAmC,CAAC;YACjD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW;YACzE,SAAS,EAAE,iBAAiB;SAC7B,CAAC;KACH,CAAC,CAAC,EACH,CAAC,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAChE,CAAC;IAEF,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC9C,IAAI,QAAQ,CAAC,MAAM,IAAI,WAAW;YAAE,OAAO;QAC3C,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO;QACzE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,sBAAsB,EAAE,CAAsD,CAAC;YAC7G,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;YACrJ,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEzE,MAAM,mBAAmB,GAAG,WAAW,CACrC,KAAK,EAAE,YAAoB,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC7D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EACD,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CACrD,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,cAAc,EAAE,CAAC;YAClD,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE3C,MAAM,oBAAoB,GAAG,WAAW,CACtC,KAAK,EAAE,MAAc,EAAE,EAAE;QACvB,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC5D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EACD,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CACrD,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACxF,MAAM,YAAY,GAAG,CAAC,iBAAiB;QACrC,CAAC,CAAC,mBAAmB,CAAC,WAAW;QACjC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAEpF,MAAM,cAAc,GAAG,CAAC,KAA0B,EAAU,EAAE;QAC5D,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YAC/E,KAAK,mBAAmB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;YACzF,KAAK,mBAAmB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CACrB,MAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,OAAO,CAAC,EACrD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAChD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,EACzC,MAAM,EAAE,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAC3D,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB,YACrG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAC7F,CACV,CAAC,CAAC,CAAC,SAAS,aAEZ,CAAC,iBAAiB,IAAI,CACrB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAoB,GAC7E,CACT,EAGA,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3C,aAAI,SAAS,EAAC,2BAA2B,YACtC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CACpB,cAA0B,SAAS,EAAC,wEAAwE,aAC1G,eAAK,SAAS,EAAC,uBAAuB,aACpC,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,EAAE,CAAC,IAAI,GAAQ,EACtD,EAAE,CAAC,SAAS,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAC5C,CAAC,CAAC,qBAAqB,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,GACtE,CACR,IACG,EACL,YAAY,IAAI,CACf,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,YACtH,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,GACjC,CACV,KAbM,EAAE,CAAC,YAAY,CAcnB,CACN,CAAC,GACC,CACN,IACiB,CACrB,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IACtF,MAAM,WAAW,GAAG,CAClB,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,IAAI,CAAC,EAClD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EACtD,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EACtC,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAChB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,YACxE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,CAAC,CAAC,SAAS,CAAC;YACd,wEAAwE;YACxE,2DAA2D;YAC3D,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAC9B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,YACpF,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAC7B,CACV,CAAC,YAEH,OAAO,CAAC,CAAC,CAAC,CACT,4BACG,YAAY,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CACtG,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAoB,GAC/E,CACT,GACA,CACJ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CACnB,KAAC,oBAAoB,IACnB,UAAU,EAAE,GAAG,EAAE;gBACf,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,GACjF,CACH,CAAC,CAAC,CAAC,IAAI,GACU,CACrB,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAC7F,MAAM,YAAY,GAAG,CACnB,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,OAAO,CAAC,EACrD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAC7C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EACvD,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC;QACvC,gGAAgG;QAChG,+FAA+F;QAC/F,IAAI,EAAE,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,WAAW,GAAQ,CAAC,CAAC,CAAC,SAAS,EAC/F,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CACtB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,YACrF,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CACjC,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,YACrF,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,YAED,aAAa,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAC5D,KAAC,qBAAqB,IACpB,UAAU,EAAE,GAAG,EAAE;gBACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,GACjF,CACH,CAAC,CAAC,CAAC,IAAI,GACU,CACrB,CAAC;IAEF,8EAA8E;IAC9E,8DAA8D;IAC9D,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,gEAAgE;IAChE,4EAA4E;IAC5E,wEAAwE;IACxE,2DAA2D;IAE3D,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aAKxC,aAAI,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAAM,EAEhG,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EACA,UAAU,IAAI,CACb,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,UAAU,GAAoB,GAC3C,CACT,EAEA,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,IAAI,IAAC,SAAS,EAAC,uBAAuB,YAAE,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAQ,CAClF,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cACH,MAAC,WAAW,IAAC,SAAS,EAAC,6CAA6C,aACjE,cAAc,EACd,WAAW,EACX,YAAY,EACb,KAAC,eAAe,IACd,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,IAAI,EAAE,KAAK,EACtB,CAAC,EAAE,CAAC,EACJ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,GAAG,EAAE;gCACd,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;gCAChD,OAAO,EAAE,CAAC;4BACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAC/B,EACF,KAAC,oBAAoB,IACnB,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,YAAY,EAC1B,CAAC,EAAE,CAAC,EACJ,QAAQ,EAAE,oBAAoB,GAC9B,IACU,GACT,CACR,EAGA,CAAC,OAAO,IAAI,CACX,KAAC,IAAI,cACH,KAAC,WAAW,IAAC,SAAS,EAAC,6CAA6C,YAClE,KAAC,eAAe,IACd,CAAC,EAAE,CAAC,EACJ,UAAU,EAAE,UAAU,EACtB,mBAAmB,EAAE,iBAAiB,EACtC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,GAC/D,GACU,GACT,CACR,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAkBF,MAAM,eAAe,GAAmC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACrI,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAA4E;QACpG,aAAa,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;KAC7E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAmD;QACxE,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,IAA+E,EAAE,EAAE;QACxF,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACxF,SAAS,EAAE,CAAC;YACZ,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAC9D,CAAC;IAEF,MAAM,SAAS,GAAG,WAAW,CAC3B,KAAK,EAAE,IAAsD,EAAE,EAAE;QAC/D,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/D,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAC3D,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAEtF,OAAO,CACL,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,QAAQ,CAAC,EACtD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAChD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,EAC/G,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAChB,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,OAAO,EAAE,GAAG,EAAE;gBACZ,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC,YAEA,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,GACzB,CACV,CAAC,CAAC,CAAC,CACF,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAC7E,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GACrF,CACV,YAEA,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAC7B,KAAC,YAAY,OAAK,UAAU,YAC1B,gBAAM,QAAQ,EAAE,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,SAAS,EAAC,WAAW,aAQ1E,KAAC,+BAA+B,IAAC,KAAK,EAAE,SAAS,GAAI,EACrD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,KAC3B,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC9D,IACI,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAc,EAChE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC1D,EACF,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,GAAI,IACnF,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC9D,IACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,YACvC,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAClC,IACJ,GACM,CAChB,CAAC,CAAC,CAAC,CACF,KAAC,YAAY,OAAK,OAAO,YACvB,gBAAM,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAC,WAAW,aAEpE,KAAC,+BAA+B,IAAC,KAAK,EAAE,SAAS,GAAI,EACrD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAc,EAChE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GACvD,EACF,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,GAAI,IACnF,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC3D,IACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,YACvC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,IACJ,GACM,CAChB,GACe,CACrB,CAAC;AACJ,CAAC,CAAC;AAgBF;;;;;;;;;GASG;AACH,MAAM,eAAe,GAAmC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE;IAC1G,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACjC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAA8B,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC9D,mHAAmH;IACnH,qEAAqE;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC;IAE7B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,wBAAwB,EAAE,CAAC,cAAc,EAAE;aACxC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;aACvE,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;QAC3D,WAAW,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;QACxH,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC5D,SAAS,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,iHAAiH;YACjH,sFAAsF;YACtF,IAAK,MAA0C,EAAE,UAAU,KAAK,GAAG;gBAAE,SAAS,EAAE,CAAC;;gBAC5E,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;OAIG;IACH,MAAM,UAAU,GAAG,CAAC,UAAmC,EAAE,KAAa,EAAU,EAAE;QAChF,MAAM,GAAG,GAAG,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,OAA2B,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,EAAE;QAC9F,OAAO,EAAE,UAAU,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC;QACnG,eAAe,EAAE,UAAU,CAAC,uBAAuB,CAAC,gBAAgB,EAAE,OAAO,CAAC,eAAe,IAAI,4BAA4B,CAAC,KAAK,CAAC;KACrI,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,CAAC,OAA2B,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS;QACxE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACxH,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAEnG,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,mBAAmB,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,EAAE,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnC,OAAO,CACL,eAAK,SAAS,EAAC,wBAAwB,aACvC,eAAK,SAAS,EAAC,oCAAoC,aACjD,6BAAiB,MAAM,EAAC,SAAS,EAAC,4FAA4F,YAC3H,UAAU,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GAC5D,EACN,eAAK,SAAS,EAAC,6CAA6C,aAC1D,KAAC,IAAI,IAAC,SAAS,EAAC,0BAA0B,YAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAQ,EAC7F,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,qBAAqB,CAAC,+BAA+B,CAAC,GAAQ,IAC7G,EACN,cAAK,SAAS,EAAC,2CAA2C,YACxD,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,YAC3H,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GACtC,GACL,EACN,KAAC,WAAW,IAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU;4BAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YACxG,MAAC,kBAAkB,eACjB,MAAC,iBAAiB,eAChB,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,iCAAiC,CAAC,GAAoB,EACjG,KAAC,sBAAsB,cAAE,CAAC,CAAC,qBAAqB,CAAC,uCAAuC,CAAC,GAA0B,IACjG,EACpB,MAAC,iBAAiB,eAChB,KAAC,iBAAiB,IAAC,QAAQ,EAAE,UAAU,YAAG,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAqB,EAC9F,KAAC,iBAAiB,IAChB,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gDACjB,2EAA2E;gDAC3E,KAAK,CAAC,cAAc,EAAE,CAAC;gDACvB,KAAK,aAAa,EAAE,CAAC;4CACvB,CAAC,YAEA,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAC3B,IACF,IACD,GACT,IACV,EAEH,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAClC,aAAI,SAAS,EAAC,sEAAsE,gBAAa,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,YACvI,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,cAA4B,SAAS,EAAC,wEAAwE,qBAAkB,OAAO,CAAC,SAAS,aAC/I,eAAK,SAAS,EAAC,uBAAuB,aACpC,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,cAAc,CAAC,OAAO,CAAC,GAAQ,EACtE,OAAO,CAAC,SAAS,IAAI,KAAC,KAAK,IAAC,OAAO,EAAC,WAAW,YAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAS,IACnG,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,eAAe,CAAC,OAAO,CAAC,GAAQ,IACtF,EACL,CAAC,OAAO,CAAC,SAAS,IAAI,CACrB,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,SAAS,EACxC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAEvD,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GACnC,CACV,KAjBM,OAAO,CAAC,SAAS,CAkBrB,CACN,CAAC,GACC,CACN,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAwC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAC1G,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,eAAe,CAAC,EAC7D,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,EACtD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,EAChE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EACnF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,YAInH,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CACnB,aAAI,SAAS,EAAC,2BAA2B,YACtC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,cAAmB,SAAS,EAAC,wEAAwE,aACnG,eAAK,SAAS,EAAC,uBAAuB,aACpC,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,IAAI,CAAC,aAAa,GAAQ,EAClE,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,IAAI,CAAC,aAAa,GAAQ,IAChF,EACL,YAAY,IAAI,CACf,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,YACpG,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GACxC,CACV,KATM,IAAI,CAAC,GAAG,CAUZ,CACN,CAAC,GACC,CACN,GACiB,CACrB,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel, resolveVocabularyWordKey } from '@wildo-ai/presets-components-models';\nimport { Card, CardContent } from '~wildo-frontend-lib/components/sections/card';\nimport { Badge, type BadgeVariants_Variant } from '~wildo-frontend-lib/components/data-display/badge';\nimport { useIconRegistry } from '~wildo-frontend-lib/core/icons/useIconRegistry';\nimport { StandardIconReference, IconSize } from '~wildo-frontend-lib/core/icons/icon-registry.frontend.schemas';\nimport { AUTH_METHOD_ICON_REFERENCES } from '~wildo-frontend-lib/components/auth/methods/auth-method-presentation';\nimport { cn } from '~wildo-frontend-lib/core/ui/cn';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport {\n  AlertDialog,\n  AlertDialogAction,\n  AlertDialogCancel,\n  AlertDialogContent,\n  AlertDialogDescription,\n  AlertDialogFooter,\n  AlertDialogHeader,\n  AlertDialogTitle,\n} from '~wildo-frontend-lib/components/overlays/containers/alert-dialog';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport {\n  AuthMethod,\n  AuthUtils,\n  isWildoBackendError,\n  type ExternalIdentitySource,\n  type PasswordPolicyRules,\n  type SsoConnectionType,\n  SessionClientBrowser,\n  SessionClientOperatingSystem,\n  SessionClientVocabulary,\n  type UserSessionSummary,\n} from '@wildo-ai/saas-models';\nimport { FormProvider, useForm } from 'react-hook-form';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { unresolvedLabel } from '~wildo-frontend-lib/core/i18n/I18nContext';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { AuthSessionUtils } from '~wildo-frontend-lib/core/security/auth-session.utils';\nimport { PasswordStrengthIndicator, DEFAULT_PASSWORD_POLICY } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport { TotpEnrollmentMethod } from '~wildo-frontend-lib/components/auth/enrollment/TotpEnrollmentMethod';\nimport { PhoneEnrollmentMethod } from '~wildo-frontend-lib/components/auth/enrollment/PhoneEnrollmentMethod';\nimport { startRegistration } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/browser';\nimport { buildProviderDisplayNameLabelKey } from '@wildo-ai/saas-models/public-runtime';\nimport {\n  collectFrontendProviderDisplayLabelKeys,\n  resolveFrontendProviderDisplayLabel,\n} from '~wildo-frontend-lib/core/external-providers/frontend-provider-display-label.frontend.utils';\n\n// A new `SecuritySettingsLabel` member (`@wildo-ai/presets-components-models`)\n// must ALSO be declared in `AppPage_SecuritySettings.labels.ts`, beside this\n// file: that list — key, kind, purpose — is what the dev companion scans\n// statically to plan and translate the words, and an enum member missing\n// from it never reaches the labelling pipeline. The shared step-up dialog\n// (`StepUpAuthDialog`) reads the same component's keys.\n\ntype EnrolledMethod = { method: string; enrolled: boolean; enrolledAt?: string; details?: Record<string, unknown> };\ntype PasskeyCred = { credentialId: string; name: string; createdAt: string };\ntype IdentityLink = {\n  _id: string;\n  connectionType: SsoConnectionType;\n  source: ExternalIdentitySource;\n  providerRef: string;\n  providerEmail: string;\n  linkedAt: string;\n  lastUsedAt: string;\n};\ntype ResolvedIdentityLink = IdentityLink & { providerLabel: string };\n\n/**\n * Presentational state of one authentication factor.\n *\n * `UNAVAILABLE` is NOT \"off\" — it means the current device/browser cannot offer\n * the factor at all (no WebAuthn support), which is a different instruction to\n * the user than \"you have not set this up yet\" and therefore a distinct badge.\n */\nenum SecurityFactorState {\n  ACTIVE = 'active',\n  INACTIVE = 'inactive',\n  UNAVAILABLE = 'unavailable',\n}\n\nconst FACTOR_STATE_BADGE_VARIANT: Record<SecurityFactorState, BadgeVariants_Variant> = {\n  [SecurityFactorState.ACTIVE]: 'success',\n  [SecurityFactorState.INACTIVE]: 'outline',\n  [SecurityFactorState.UNAVAILABLE]: 'secondary',\n};\n\ninterface SecurityFactorRowProps {\n  /** Glyph identifying the method — resolved through the icon registry so apps can re-skin it. */\n  icon: StandardIconReference;\n  title: string;\n  /**\n   * Plain-language \"what this is / why it matters\" line — shown only while the factor is NOT active.\n   *\n   * It is a prompt for a decision the person has not taken yet (\"Authenticator apps provide one-time\n   * codes as a second sign-in step\" beside \"Set up authenticator app\"). Once the factor protects the\n   * account the decision is made, the badge says so, and the sentence is read on every visit for\n   * nothing — the same reason a read view carries no section descriptions.\n   */\n  description: string;\n  state: SecurityFactorState;\n  statusLabel: string;\n  /**\n   * A live detail the badge cannot carry — today only the masked verified phone number.\n   *\n   * Nothing that RESTATES the badge belongs here. \"Password is set.\" under \"Password · Active\",\n   * \"No authenticator app is set up.\" under \"Not configured\", and \"1 linked accounts\" above the list\n   * of that one account were each the same fact twice; they were removed with their labels.\n   */\n  meta?: React.ReactNode;\n  /**\n   * The factor's primary control, pinned to the inline-end of the header row.\n   * Every row's action lands on the same axis, so the column reads as a list of\n   * choices rather than as five stacked mini-pages — the account-security idiom\n   * used by mainstream providers. Anything that must expand (an enrolment flow,\n   * a credential list, a form) goes to `children` instead.\n   *\n   * Row actions are OUTLINE, without exception. They are peers: the panel offers\n   * five alternative ways to protect an account and recommends none of them, so\n   * filling any one of them would assert a priority the page does not hold —\n   * and five filled buttons stacked down a column assert five priorities, which\n   * is the same as none while costing all the emphasis. The filled variant is\n   * reserved for the commit action INSIDE an opened disclosure, where there\n   * genuinely is one thing to do next.\n   */\n  action?: React.ReactNode;\n  children?: React.ReactNode;\n}\n\n/**\n * One authentication factor, presented as a scannable row: glyph · name · what\n * it is · live status, with its primary control pinned to the row's end.\n *\n * This replaced a stack of visually identical title-only cards, which forced the\n * user to READ every card to learn which factors were active and offered no\n * explanation of what any factor was. The status badge and the icon carry that\n * information pre-attentively; the description makes the choice informed. The\n * shape follows the account-security idiom used by mainstream providers.\n */\nconst SecurityFactorRow: React.FC<SecurityFactorRowProps> = ({\n  icon, title, description, state, statusLabel, meta, action, children,\n}) => {\n  const { renderIcon } = useIconRegistry();\n  const isActive = state === SecurityFactorState.ACTIVE;\n\n  return (\n    // One row of ONE card: the factors are a single list of alternatives, so they share a frame and\n    // are separated by hairlines (the settings-row idiom) rather than each carrying a card of its own —\n    // five stacked cards read as five pages.\n    <div className=\"flex flex-col gap-item py-group first:pt-0 last:pb-0\">\n      <div className=\"flex flex-row items-start gap-item\">\n        {/* Tinted glyph tile — tinted only when the factor is live, so the eye\n            lands on what is protecting the account before any text is read. */}\n        <div\n          aria-hidden=\"true\"\n          className={cn(\n            'flex size-9 shrink-0 items-center justify-center rounded-md',\n            isActive ? 'bg-success/10 text-success' : 'bg-muted text-muted-foreground',\n          )}\n        >\n          {renderIcon(icon, { size: IconSize.SM })}\n        </div>\n\n        <div className=\"flex min-w-0 flex-1 flex-col gap-element-xs\">\n          <div className=\"flex flex-wrap items-center gap-element-xs\">\n            <Text className=\"font-medium leading-snug\">{title}</Text>\n            <Badge variant={FACTOR_STATE_BADGE_VARIANT[state]}>{statusLabel}</Badge>\n          </div>\n          {!isActive && <Text className=\"text-sm text-muted-foreground\">{description}</Text>}\n          {meta}\n        </div>\n\n        {action && <div className=\"flex shrink-0 items-center gap-element-xs\">{action}</div>}\n      </div>\n\n      {/* Expanded content aligns with the TEXT column, not the glyph: the\n          indent is the glyph tile (`size-9`) plus the row gap, so a form or a\n          credential list continues the sentence it belongs to. */}\n      {children && (\n        <div className=\"flex flex-col gap-item ps-[calc(var(--spacing)*9+var(--sp-item))]\">{children}</div>\n      )}\n    </div>\n  );\n};\n\nexport const AppPage_SecuritySettings: React.FC = () => {\n  const { auth } = useApplication();\n  const { auth: authState, signOutEverywhere } = useAuthSession();\n  const { user } = useUserOrgs();\n  const resolvedAuth = useResolvedAuthConfig();\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  const [methods, setMethods] = useState<EnrolledMethod[]>([]);\n  const [passkeys, setPasskeys] = useState<PasskeyCred[]>([]);\n  const [identityLinks, setIdentityLinks] = useState<IdentityLink[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [successMsg, setSuccessMsg] = useState<string | null>(null);\n  const [showTotpEnroll, setShowTotpEnroll] = useState(false);\n  const [showPhoneEnroll, setShowPhoneEnroll] = useState(false);\n  const [passkeyRegistering, setPasskeyRegistering] = useState(false);\n  // The linked provider's name is `providers.<ref>.displayName`, derived from the ref the link holds\n  // (#1701) — never read off a frontend provider module, since sign-in runs no vendor code in the page.\n  const identityProviderLabelKeys = useMemo(\n    () => collectFrontendProviderDisplayLabelKeys(\n      identityLinks.map((link) => buildProviderDisplayNameLabelKey(link.providerRef)),\n    ),\n    [identityLinks],\n  );\n  const { tComponent, t: translateProvider, isReady, formatDate } = useI18n({\n    component: [\n      FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS,\n      FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER,\n      FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED,\n    ],\n    keys: identityProviderLabelKeys,\n  });\n  const t = useCallback(\n    (key: string, params?: Record<string, string | number>) =>\n      tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key, params),\n    [tComponent],\n  );\n  const tPolicy = useCallback(\n    (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, key),\n    [tComponent],\n  );\n\n  const passkeyConfig = auth?.passkeyConfig;\n  const methodManagement = resolvedAuth.userTypeAuth?.methodManagement;\n  const passwordPolicy = resolvedAuth.passwordPolicy;\n  const maxPasskeys = passkeyConfig?.maxPasskeysPerUser ?? 10;\n  const allowRemoval = methodManagement?.allowUserMethodRemoval ?? true;\n\n  const refresh = useCallback(async () => {\n    setLoading(true);\n    setError(null);\n    try {\n      const client = getManualCallsHttpClient();\n      const [methodsRes, passkeysRes, linksRes] = await Promise.all([\n        client.getMyMethods(),\n        client.passkeyList().catch(() => ({ credentials: [] })),\n        client.getIdentityLinks().catch(() => ({ links: [] })),\n      ]);\n      setMethods(methodsRes.methods ?? []);\n      setPasskeys(passkeysRes.credentials ?? []);\n      setIdentityLinks(linksRes.links ?? []);\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n    } finally {\n      setLoading(false);\n    }\n  }, [t, toUserFacingErrorMessage]);\n\n  useEffect(() => {\n    refresh();\n  }, [refresh]);\n\n  useEffect(() => {\n    if (!successMsg) return;\n    const timer = setTimeout(() => setSuccessMsg(null), 5000);\n    return () => clearTimeout(timer);\n  }, [successMsg]);\n\n  // Derived, not listed. The literal `[TOTP, PASSKEY, SMS_OTP]` that stood here was the\n  // second-factor vocabulary minus the factors that need no enrollment — correct on the day it was\n  // written and silently short the day a fifth second factor is added, since a method missing from\n  // the list simply never counts as enrolled.\n  const enrollableSecondFactorMethods = AuthUtils.getEnrollableSecondFactorMethods();\n  const enrolledSecondFactor = methods\n    .filter((m) => m.enrolled && enrollableSecondFactorMethods.includes(m.method as AuthMethod))\n    .map((m) => m.method as AuthMethod);\n  const completeness = AuthSessionUtils.evaluateAccountCompleteness(\n    authState.identification?.requiresMFA ?? false,\n    authState.identification?.secondFactorMethods?.map((m) => m.method) ?? [],\n    enrolledSecondFactor.length > 0 ? enrolledSecondFactor : (authState.enrolledSecondFactorMethods as AuthMethod[]),\n    resolvedAuth.userTypeAuth?.mfaPolicy?.acceptableMFAMethods ?? [],\n  );\n\n  const hasPassword = methods.some((m) => m.method === AuthMethod.PASSWORD && m.enrolled);\n  const hasTotp = methods.some((m) => m.method === AuthMethod.TOTP && m.enrolled);\n  const smsMethod = methods.find((m) => m.method === AuthMethod.SMS_OTP);\n  const phoneVerified = smsMethod?.enrolled ?? false;\n  const phoneMasked = smsMethod?.details?.phoneNumber as string | undefined;\n  const resolvedIdentityLinks = useMemo(\n    () => identityLinks.map((link) => ({\n      ...link,\n      providerLabel: resolveFrontendProviderDisplayLabel({\n        providerRef: link.providerRef,\n        displayName: auth?.socialOAuth2Providers?.[link.providerRef]?.displayName,\n        translate: translateProvider,\n      }),\n    })),\n    [auth?.socialOAuth2Providers, identityLinks, translateProvider],\n  );\n\n  const handlePasskeyAdd = useCallback(async () => {\n    if (passkeys.length >= maxPasskeys) return;\n    if (typeof window === 'undefined' || !window.PublicKeyCredential) return;\n    setPasskeyRegistering(true);\n    setError(null);\n    try {\n      const client = getManualCallsHttpClient();\n      const options = (await client.passkeyRegisterOptions()) as unknown as PublicKeyCredentialCreationOptionsJSON;\n      const credential = await startRegistration({ optionsJSON: options });\n      await client.passkeyRegisterVerify({ response: credential });\n      setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n      refresh();\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      const msg = e?.name === 'NotAllowedError' ? t(SecuritySettingsLabel.PASSKEY_CANCELLED) : toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR));\n      setError(msg);\n    } finally {\n      setPasskeyRegistering(false);\n    }\n  }, [maxPasskeys, passkeys.length, refresh, t, toUserFacingErrorMessage]);\n\n  const handlePasskeyRemove = useCallback(\n    async (credentialId: string) => {\n      if (!allowRemoval) return;\n      try {\n        await getManualCallsHttpClient().passkeyRemove(credentialId);\n        setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n        refresh();\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      }\n    },\n    [allowRemoval, refresh, t, toUserFacingErrorMessage],\n  );\n\n  /*\n   * No re-authentication handling here, deliberately. Where the user type asks for it, the server\n   * answers `STEP_UP_REQUIRED` and the HTTP client answers that by itself — the shared step-up dialog\n   * (`StepUpAuthProvider`), then a replay carrying `X-Reauth-Token`. The same is true of adding a\n   * passkey, confirming TOTP and confirming a phone below. This page used to carry its own password-only\n   * copy of that dialog for this one action, and nothing for the binding actions at all.\n   */\n  const handleTotpDisable = useCallback(async () => {\n    try {\n      await getManualCallsHttpClient().mfaTOTPDisable();\n      setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n      setShowTotpEnroll(false);\n      refresh();\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n    }\n  }, [refresh, t, toUserFacingErrorMessage]);\n\n  const handleUnlinkIdentity = useCallback(\n    async (linkId: string) => {\n      if (!allowRemoval) return;\n      try {\n        await getManualCallsHttpClient().unlinkIdentityLink(linkId);\n        setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n        refresh();\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      }\n    },\n    [allowRemoval, refresh, t, toUserFacingErrorMessage],\n  );\n\n  if (!isReady) return null;\n\n  // Passkeys are only offerable where WebAuthn exists; an unsupported browser is\n  // a distinct state from \"not set up yet\" and gets its own badge + no CTA.\n  const passkeysSupported = typeof window !== 'undefined' && !!window.PublicKeyCredential;\n  const passkeyState = !passkeysSupported\n    ? SecurityFactorState.UNAVAILABLE\n    : passkeys.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n\n  const statusLabelFor = (state: SecurityFactorState): string => {\n    switch (state) {\n      case SecurityFactorState.ACTIVE: return t(SecuritySettingsLabel.STATUS_ACTIVE);\n      case SecurityFactorState.UNAVAILABLE: return t(SecuritySettingsLabel.STATUS_UNAVAILABLE);\n      case SecurityFactorState.INACTIVE: return t(SecuritySettingsLabel.STATUS_NOT_CONFIGURED);\n    }\n  };\n\n  const PasskeySection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY]}\n      title={t(SecuritySettingsLabel.SECTION_PASSKEYS)}\n      description={t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION)}\n      state={passkeyState}\n      statusLabel={statusLabelFor(passkeyState)}\n      action={passkeysSupported && passkeys.length < maxPasskeys ? (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={handlePasskeyAdd} disabled={passkeyRegistering}>\n          {passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD)}\n        </Button>\n      ) : undefined}\n    >\n      {!passkeysSupported && (\n        <Alert>\n          <AlertDescription>{t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED)}</AlertDescription>\n        </Alert>\n      )}\n      {/* The registered passkeys ARE the detail: no count above them, and no \"No passkeys added\n          yet.\" when there are none — the \"Not configured\" badge already says it. */}\n      {passkeysSupported && passkeys.length > 0 && (\n        <ul className=\"flex flex-col gap-element\">\n          {passkeys.map((pk) => (\n            <li key={pk.credentialId} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\">\n              <div className=\"flex min-w-0 flex-col\">\n                <Text className=\"truncate font-medium\">{pk.name}</Text>\n                {pk.createdAt && (\n                  <Text className=\"text-xs text-muted-foreground\">\n                    {t(SecuritySettingsLabel.PASSKEY_ADDED, { date: formatDate(pk.createdAt) })}\n                  </Text>\n                )}\n              </div>\n              {allowRemoval && (\n                <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => handlePasskeyRemove(pk.credentialId)}>\n                  {t(SecuritySettingsLabel.PASSKEY_REMOVE)}\n                </Button>\n              )}\n            </li>\n          ))}\n        </ul>\n      )}\n    </SecurityFactorRow>\n  );\n\n  const totpState = hasTotp ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n  const TotpSection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP]}\n      title={t(SecuritySettingsLabel.SECTION_TOTP)}\n      description={t(SecuritySettingsLabel.TOTP_DESCRIPTION)}\n      state={totpState}\n      statusLabel={statusLabelFor(totpState)}\n      action={hasTotp\n        ? (allowRemoval ? (\n          <Button variant={ButtonVariants_Variant.OUTLINE} onClick={handleTotpDisable}>\n            {t(SecuritySettingsLabel.TOTP_DISABLE)}\n          </Button>\n        ) : undefined)\n        // While the enrolment flow is open its own controls own the row, so the\n        // opener is withdrawn rather than left as a second way in.\n        : (showTotpEnroll ? undefined : (\n          <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowTotpEnroll(true)}>\n            {t(SecuritySettingsLabel.TOTP_SETUP)}\n          </Button>\n        ))}\n    >\n      {hasTotp ? (\n        <>\n          {completeness.enrolledMethods.length === 1 && completeness.enrolledMethods.includes(AuthMethod.TOTP) && (\n            <Alert>\n              <AlertDescription>{t(SecuritySettingsLabel.TOTP_ONLY_MFA_WARNING)}</AlertDescription>\n            </Alert>\n          )}\n        </>\n      ) : showTotpEnroll ? (\n        <TotpEnrollmentMethod\n          onComplete={() => {\n            setShowTotpEnroll(false);\n            refresh();\n          }}\n          onError={(msg) => setError(msg)}\n          isLoading={false}\n          t={(k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k)}\n        />\n      ) : null}\n    </SecurityFactorRow>\n  );\n\n  const phoneState = phoneVerified ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n  const PhoneSection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP]}\n      title={t(SecuritySettingsLabel.SECTION_PHONE)}\n      description={t(SecuritySettingsLabel.PHONE_DESCRIPTION)}\n      state={phoneState}\n      statusLabel={statusLabelFor(phoneState)}\n      // WHICH number is verified is the one thing the \"Active\" badge cannot say, so the masked number\n      // stands alone — no \"Verified:\" in front of it (the badge) and no sentence when there is none.\n      meta={phoneVerified && phoneMasked ? <Text className=\"text-sm\">{phoneMasked}</Text> : undefined}\n      action={phoneVerified ? (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowPhoneEnroll(true)}>\n          {t(SecuritySettingsLabel.PHONE_CHANGE)}\n        </Button>\n      ) : (showPhoneEnroll ? undefined : (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowPhoneEnroll(true)}>\n          {t(SecuritySettingsLabel.PHONE_VERIFY)}\n        </Button>\n      ))}\n    >\n      {phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (\n        <PhoneEnrollmentMethod\n          onComplete={() => {\n            setShowPhoneEnroll(false);\n            refresh();\n          }}\n          onError={(msg) => setError(msg)}\n          isLoading={false}\n          t={(k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k)}\n        />\n      ) : null}\n    </SecurityFactorRow>\n  );\n\n  // ── No posture summary, deliberately ───────────────────────────────────────\n  // Two rejected designs, for whoever is tempted to re-add one:\n  //   1. \"Your account is fully secured\" keyed off `completeness.isComplete` —\n  //      that flag answers \"does this satisfy the app's auth POLICY?\", and it is\n  //      `true` whenever MFA is not required. It therefore claimed a fully\n  //      secured account for an account with zero second factors.\n  //   2. An \"n of 4 sign-in methods active\" ratio with a progress meter — a\n  //      score with no referent. The denominator is not a target: nobody needs\n  //      SMS *and* TOTP *and* a passkey, the factors are alternatives, and the\n  //      remedy differs per factor. A meter that fills toward a number the user\n  //      should not reach measures nothing and invites gaming it.\n  // The rows below already carry the state (per-factor badge) and the meaning\n  // (per-factor description). A summary that restates them as a number is\n  // strictly less information, presented as if it were more.\n\n  return (\n    <div className=\"flex flex-col gap-section\">\n      {/* `h3`, not `h2`: the Settings Hub header owns the `h2` for this dialog,\n          so a panel heading is one level below it. */}\n      {/* No sub-heading: \"Manage how you sign in and protect your account\" restated the heading and the\n          five factor names beneath it. */}\n      <h3 className=\"text-base font-semibold tracking-tight\">{t(SecuritySettingsLabel.PAGE_TITLE)}</h3>\n\n      {error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n      )}\n      {successMsg && (\n        <Alert>\n          <AlertDescription>{successMsg}</AlertDescription>\n        </Alert>\n      )}\n\n      {loading ? (\n        <Text className=\"text-muted-foreground\">{t(SecuritySettingsLabel.LOADING)}</Text>\n      ) : (\n        <Card>\n          <CardContent className=\"flex flex-col divide-y divide-border p-card\">\n            {PasskeySection}\n            {TotpSection}\n            {PhoneSection}\n            <PasswordSection\n              hasPassword={hasPassword}\n              passwordPolicy={passwordPolicy}\n              userEmail={user?.email}\n              t={t}\n              tPolicy={tPolicy}\n              onSuccess={() => {\n                setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n                refresh();\n              }}\n              onError={(msg) => setError(msg)}\n            />\n            <IdentityLinksSection\n              links={resolvedIdentityLinks}\n              allowRemoval={allowRemoval}\n              t={t}\n              onUnlink={handleUnlinkIdentity}\n            />\n          </CardContent>\n        </Card>\n      )}\n\n      {/* Sessions are not a way to sign in, so they are not a row of the factors card. */}\n      {!loading && (\n        <Card>\n          <CardContent className=\"flex flex-col divide-y divide-border p-card\">\n            <SessionsSection\n              t={t}\n              formatDate={formatDate}\n              onSignOutEverywhere={signOutEverywhere}\n              onError={(caught) => setError(toUserFacingErrorMessage(caught))}\n            />\n          </CardContent>\n        </Card>\n      )}\n    </div>\n  );\n};\n\ninterface PasswordSectionProps {\n  hasPassword: boolean;\n  passwordPolicy: PasswordPolicyRules;\n  /**\n   * Signed-in user's email. Rendered as a visually-hidden\n   * `autocomplete=\"username\"` field inside each password form so password\n   * managers associate the saved/updated credential with the correct account\n   * (Chromium also warns when a password form has no username field).\n   */\n  userEmail?: string;\n  t: (k: string, params?: Record<string, string | number>) => string;\n  tPolicy: (k: string) => string;\n  onSuccess: () => void;\n  onError: (msg: string) => void;\n}\n\nconst PasswordSection: React.FC<PasswordSectionProps> = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, onSuccess, onError }) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const [submitting, setSubmitting] = useState(false);\n  // The credential form is a DISCLOSURE, not the row's resting state. Rendered\n  // eagerly it was four inputs plus a strength meter permanently open beneath a\n  // one-line row, which made this factor read as the page's subject and the\n  // other four as its footnotes. Every row now rests at the same height and\n  // opens on request.\n  const [editing, setEditing] = useState(false);\n  const changeForm = useForm<{ currentPassword: string; newPassword: string; confirmPassword: string }>({\n    defaultValues: { currentPassword: '', newPassword: '', confirmPassword: '' },\n  });\n  const setForm = useForm<{ newPassword: string; confirmPassword: string }>({\n    defaultValues: { newPassword: '', confirmPassword: '' },\n  });\n\n  const handleChange = useCallback(\n    async (data: { currentPassword: string; newPassword: string; confirmPassword: string }) => {\n      if (data.newPassword !== data.confirmPassword) {\n        onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));\n        return;\n      }\n      setSubmitting(true);\n      try {\n        await getManualCallsHttpClient().passwordChange(data.currentPassword, data.newPassword);\n        onSuccess();\n        changeForm.reset();\n        setEditing(false);\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      } finally {\n        setSubmitting(false);\n      }\n    },\n    [changeForm, onError, onSuccess, t, toUserFacingErrorMessage],\n  );\n\n  const handleSet = useCallback(\n    async (data: { newPassword: string; confirmPassword: string }) => {\n      if (data.newPassword !== data.confirmPassword) {\n        onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));\n        return;\n      }\n      setSubmitting(true);\n      try {\n        await getManualCallsHttpClient().passwordSet(data.newPassword);\n        onSuccess();\n        setForm.reset();\n        setEditing(false);\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      } finally {\n        setSubmitting(false);\n      }\n    },\n    [onError, onSuccess, setForm, t, toUserFacingErrorMessage],\n  );\n\n  const state = hasPassword ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n\n  return (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD]}\n      title={t(SecuritySettingsLabel.SECTION_PASSWORD)}\n      description={t(SecuritySettingsLabel.PASSWORD_DESCRIPTION)}\n      state={state}\n      statusLabel={t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED)}\n      action={editing ? (\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          onClick={() => {\n            setEditing(false);\n            changeForm.reset();\n            setForm.reset();\n          }}\n        >\n          {t(SecuritySettingsLabel.CANCEL)}\n        </Button>\n      ) : (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setEditing(true)}>\n          {t(hasPassword ? SecuritySettingsLabel.PASSWORD_CHANGE : SecuritySettingsLabel.PASSWORD_SET)}\n        </Button>\n      )}\n    >\n      {!editing ? null : hasPassword ? (\n          <FormProvider {...changeForm}>\n            <form onSubmit={changeForm.handleSubmit(handleChange)} className=\"space-y-4\">\n              {/*\n                Hidden username field. Gives password managers the account\n                context they need to associate the updated credential, and\n                resolves Chromium's \"password forms should have an (optionally\n                hidden) username field\" warning. Must precede the password\n                inputs so managers pair the username with them.\n              */}\n              <CredentialUsernameAutofillField email={userEmail} />\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CURRENT)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"current-password\"\n                  {...changeForm.register('currentPassword', { required: true })}\n                />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_NEW)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...changeForm.register('newPassword', { required: true })}\n                />\n                <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={tPolicy} />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CONFIRM)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...changeForm.register('confirmPassword', { required: true })}\n                />\n              </Field>\n              <Button type=\"submit\" disabled={submitting}>\n                {t(SecuritySettingsLabel.PASSWORD_CHANGE)}\n              </Button>\n            </form>\n          </FormProvider>\n        ) : (\n          <FormProvider {...setForm}>\n            <form onSubmit={setForm.handleSubmit(handleSet)} className=\"space-y-4\">\n              {/* Hidden username field — see the note in the change-password form above. */}\n              <CredentialUsernameAutofillField email={userEmail} />\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_NEW)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...setForm.register('newPassword', { required: true })}\n                />\n                <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={tPolicy} />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CONFIRM)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...setForm.register('confirmPassword', { required: true })}\n                />\n              </Field>\n              <Button type=\"submit\" disabled={submitting}>\n                {t(SecuritySettingsLabel.PASSWORD_SET)}\n              </Button>\n            </form>\n          </FormProvider>\n        )}\n    </SecurityFactorRow>\n  );\n};\n\ninterface IdentityLinksSectionProps {\n  links: ResolvedIdentityLink[];\n  allowRemoval: boolean;\n  t: (k: string, params?: Record<string, string | number>) => string;\n  onUnlink: (linkId: string) => void;\n}\n\ninterface SessionsSectionProps {\n  t: (k: string, params?: Record<string, string | number>) => string;\n  formatDate: (value: Date | string) => string;\n  onSignOutEverywhere: () => Promise<void>;\n  onError: (caught: unknown) => void;\n}\n\n/**\n * Where the account is signed in (#2317): every live session, with the one in use marked, a way to sign any\n * other one out, and a way to sign out of all of them.\n *\n * Signing out everywhere is confirmed first, because it also ends the session the person is using; on success the\n * tab is signed out, so nothing renders a success message, and on failure the person stays signed in and is told,\n * since the other devices still are. Signing out ONE other session is not confirmed: it only takes access away from\n * a device, the person usually reaches for it because they no longer trust that device, and the device can sign in\n * again. The session in use has no such control here; signing out of it is the ordinary sign-out.\n */\nconst SessionsSection: React.FC<SessionsSectionProps> = ({ t, formatDate, onSignOutEverywhere, onError }) => {\n  const { renderIcon } = useIconRegistry();\n  const { t: tGlobal } = useI18n();\n  const [confirming, setConfirming] = useState(false);\n  const [signingOut, setSigningOut] = useState(false);\n  const [sessions, setSessions] = useState<UserSessionSummary[] | null>(null);\n  const [revoking, setRevoking] = useState<string | null>(null);\n  // The parent passes `onError` inline, so it is a new function on every render; held in a ref, it neither refetches\n  // the list nor rebuilds the handlers each time the panel re-renders.\n  const onErrorRef = useRef(onError);\n  onErrorRef.current = onError;\n\n  useEffect(() => {\n    let cancelled = false;\n    getManualCallsHttpClient().listMySessions()\n      .then((response) => { if (!cancelled) setSessions(response.sessions); })\n      .catch((caught) => { if (!cancelled) { setSessions([]); onErrorRef.current(caught); } });\n    return () => { cancelled = true; };\n  }, []);\n\n  const handleRevoke = useCallback(async (sessionId: string) => {\n    setRevoking(sessionId);\n    const removeRow = () => setSessions((current) => current?.filter((session) => session.sessionId !== sessionId) ?? null);\n    try {\n      await getManualCallsHttpClient().revokeMySession(sessionId);\n      removeRow();\n    } catch (caught) {\n      // 404: the session ended on its own since the list was read (signed out, expired, retired by the session limit).\n      // What the person asked for is already true, so the row goes and nothing is reported.\n      if ((caught as { httpStatus?: unknown } | null)?.httpStatus === 404) removeRow();\n      else onErrorRef.current(caught);\n    } finally {\n      setRevoking(null);\n    }\n  }, []);\n\n  /*\n   * A browser's and a system's words are their vocabularies' (`system_enums.SessionClientBrowser.chrome`), the same words\n   * the new-sign-in-client email shows for them (#2929): one source, so the email and the page it links to agree. A\n   * value with no word shows as itself, a missing label that looks missing.\n   */\n  const clientWord = (vocabulary: SessionClientVocabulary, value: string): string => {\n    const key = resolveVocabularyWordKey(vocabulary, value);\n    const word = tGlobal(key);\n    return word === key ? unresolvedLabel(value) : word;\n  };\n  const describeDevice = (session: UserSessionSummary) => t(SecuritySettingsLabel.SESSION_DEVICE, {\n    browser: clientWord(SessionClientVocabulary.BROWSER, session.browser ?? SessionClientBrowser.OTHER),\n    operatingSystem: clientWord(SessionClientVocabulary.OPERATING_SYSTEM, session.operatingSystem ?? SessionClientOperatingSystem.OTHER),\n  });\n  const describeDetails = (session: UserSessionSummary) => session.ipAddress\n    ? t(SecuritySettingsLabel.SESSION_DETAILS, { address: session.ipAddress, lastActive: formatDate(session.lastActiveAt) })\n    : t(SecuritySettingsLabel.SESSION_LAST_ACTIVE, { lastActive: formatDate(session.lastActiveAt) });\n\n  const handleConfirm = useCallback(async () => {\n    setSigningOut(true);\n    try {\n      await onSignOutEverywhere();\n    } catch (caught) {\n      setSigningOut(false);\n      setConfirming(false);\n      onError(caught);\n    }\n  }, [onSignOutEverywhere, onError]);\n\n  return (\n    <div className=\"flex flex-col gap-item\">\n    <div className=\"flex flex-row items-start gap-item\">\n      <div aria-hidden=\"true\" className=\"flex size-9 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground\">\n        {renderIcon(StandardIconReference.LOGOUT, { size: IconSize.SM })}\n      </div>\n      <div className=\"flex min-w-0 flex-1 flex-col gap-element-xs\">\n        <Text className=\"font-medium leading-snug\">{t(SecuritySettingsLabel.SECTION_SESSIONS)}</Text>\n        <Text className=\"text-sm text-muted-foreground\">{t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE_DESCRIPTION)}</Text>\n      </div>\n      <div className=\"flex shrink-0 items-center gap-element-xs\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => setConfirming(true)} disabled={signingOut}>\n          {t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE)}\n        </Button>\n      </div>\n      <AlertDialog open={confirming} onOpenChange={(open) => { if (!open && !signingOut) setConfirming(false); }}>\n        <AlertDialogContent>\n          <AlertDialogHeader>\n            <AlertDialogTitle>{t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE_CONFIRM_TITLE)}</AlertDialogTitle>\n            <AlertDialogDescription>{t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE_CONFIRM_DESCRIPTION)}</AlertDialogDescription>\n          </AlertDialogHeader>\n          <AlertDialogFooter>\n            <AlertDialogCancel disabled={signingOut}>{t(SecuritySettingsLabel.CANCEL)}</AlertDialogCancel>\n            <AlertDialogAction\n              disabled={signingOut}\n              onClick={(event) => {\n                // Held open until the backend answers: closing first would hide a failure.\n                event.preventDefault();\n                void handleConfirm();\n              }}\n            >\n              {t(SecuritySettingsLabel.SIGN_OUT_EVERYWHERE)}\n            </AlertDialogAction>\n          </AlertDialogFooter>\n        </AlertDialogContent>\n      </AlertDialog>\n    </div>\n      {/* Aligned with the text column, like a factor row's expanded content. */}\n      {sessions && sessions.length > 0 && (\n        <ul className=\"flex flex-col gap-element ps-[calc(var(--spacing)*9+var(--sp-item))]\" aria-label={t(SecuritySettingsLabel.SECTION_SESSIONS)}>\n          {sessions.map((session) => (\n            <li key={session.sessionId} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\" data-session-id={session.sessionId}>\n              <div className=\"flex min-w-0 flex-col\">\n                <div className=\"flex flex-wrap items-center gap-element-xs\">\n                  <Text className=\"truncate font-medium\">{describeDevice(session)}</Text>\n                  {session.isCurrent && <Badge variant=\"secondary\">{t(SecuritySettingsLabel.SESSION_THIS_DEVICE)}</Badge>}\n                </div>\n                <Text className=\"truncate text-xs text-muted-foreground\">{describeDetails(session)}</Text>\n              </div>\n              {!session.isCurrent && (\n                <Button\n                  variant={ButtonVariants_Variant.OUTLINE}\n                  size={ButtonSize.SM}\n                  disabled={revoking === session.sessionId}\n                  onClick={() => { void handleRevoke(session.sessionId); }}\n                >\n                  {t(SecuritySettingsLabel.SESSION_SIGN_OUT)}\n                </Button>\n              )}\n            </li>\n          ))}\n        </ul>\n      )}\n    </div>\n  );\n};\n\nconst IdentityLinksSection: React.FC<IdentityLinksSectionProps> = ({ links, allowRemoval, t, onUnlink }) => (\n  <SecurityFactorRow\n    icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2]}\n    title={t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS)}\n    description={t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION)}\n    state={links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE}\n    statusLabel={t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED)}\n  >\n    {/* The linked accounts ARE the detail: no count above the list, no empty sentence under a\n        \"Not configured\" badge. */}\n    {links.length > 0 && (\n      <ul className=\"flex flex-col gap-element\">\n        {links.map((link) => (\n          <li key={link._id} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\">\n            <div className=\"flex min-w-0 flex-col\">\n              <Text className=\"truncate font-medium\">{link.providerLabel}</Text>\n              <Text className=\"truncate text-xs text-muted-foreground\">{link.providerEmail}</Text>\n            </div>\n            {allowRemoval && (\n              <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => onUnlink(link._id)}>\n                {t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK)}\n              </Button>\n            )}\n          </li>\n        ))}\n      </ul>\n    )}\n  </SecurityFactorRow>\n);\n"]}