@wildo-ai/saas-frontend-lib 1.1.2 → 1.1.3

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AA0B1H;;;;GAIG;AACH,IAAK,aAOJ;AAPD,WAAK,aAAa;IAChB,0CAA0C;IAC1C,gCAAe,CAAA;IACf,wGAAwG;IACxG,0CAAyB,CAAA;IACzB,uGAAuG;IACvG,gCAAe,CAAA;AACjB,CAAC,EAPI,aAAa,KAAb,aAAa,QAOjB;AAED,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAC3D,MAA0D,EACvC,EAAE;IACrB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAE9G,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,+FAA+F;IAC/F,yGAAyG;IACzG,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC5C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvF,mGAAmG;YACnG,qGAAqG;YACrG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kGAAkG;YAClG,6DAA6D;YAC7D,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,qGAAqG;QACrG,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,8GAA8G;IAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,cAAc,EAAE,OAAO,SAAG,CAAC;IACnE,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAQ,IAClG,EAEL,MAAM,KAAK,aAAa,CAAC,KAAK,IAAI,CACjC,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAoB,GACjE,CACT,EAED,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,YAC/H,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAC3B,EACT,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,YAChI,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAC5B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EACtC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EACkE;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,mCAAmC,EACzD,yBAAyB,CAC1B,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLogoutConfirmLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout §6 confirmation prompt — the body rendered by {@link AuthPage_OAuthLogoutConfirm}.\n *\n * FLOW: `GET /oauth/end-session` redirects the browser here (with a single-use `token` query param) for a\n * NON-trusted logout — everything EXCEPT a trusted RP presenting a valid `id_token_hint` AND an exact-match\n * registered `post_logout_redirect_uri`, which is logged out directly without a prompt (the Keycloak-style\n * posture). This page asks the End-User to confirm BEFORE the session is terminated, mitigating BROWSER-based\n * logout CSRF (RP-Initiated Logout 1.0 §6; a cross-origin page cannot read the token to complete the confirm —\n * see the backend `handleEndSessionConfirm` threat model). On CONFIRM it POSTs the token to `POST /oauth/end-session/confirm`,\n * which terminates the session and returns `{ redirect_to }` (the signed-out page `/oauth/logged-out`); on\n * CANCEL nothing is terminated and the user returns to the app.\n *\n * Token-driven, not session-driven: the End-User may be unauthenticated in this SPA (they arrived via an RP\n * redirect), so this page never gates on a Bearer — the opaque `token` is the whole credential.\n *\n * Copy is resolved through {@link OAuthLogoutConfirmLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM`)\n * via {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLogoutConfirm.labels.ts`.\n */\n\nexport interface PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps {\n  /** Reserved: the confirm screen is driven by the `token` query param and accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/**\n * The prompt's local interaction state. A named runtime source rather than a literal union so each\n * member can carry WHY it exists — `ERROR` in particular is reached only by a stale/expired token,\n * which is a normal outcome here (the token is single-use and short-TTL), not a fault.\n */\nenum ConfirmStatus {\n  /** Waiting for the End-User to decide. */\n  READY = 'ready',\n  /** The confirm POST is in flight; both buttons are disabled to keep the single-use token single-use. */\n  SUBMITTING = 'submitting',\n  /** The confirmation token was stale, expired or already used — the user may start the logout again. */\n  ERROR = 'error',\n}\n\nexport const PublicLayoutPreset_OAuthLogoutConfirm_Default = (\n  _props: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps,\n): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConfirmStatus>(ConfirmStatus.READY);\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, key);\n\n  const token = useMemo(() => searchParams.get('token') ?? '', [searchParams]);\n\n  // Stale-closure-proof single-flight latch for the confirm POST (mirrors the consent screen): a\n  // synchronous double-dispatch could fire two POSTs before React re-renders, and the token is single-use.\n  const submittingRef = useRef(false);\n\n  const confirm = useCallback(async () => {\n    if (!token || submittingRef.current) return;\n    submittingRef.current = true;\n    setStatus(ConfirmStatus.SUBMITTING);\n    try {\n      const { redirect_to } = await getManualCallsHttpClient().oauthEndSessionConfirm(token);\n      // Full navigation to the signed-out page (`window.location.assign`, mirroring the consent screen):\n      // the session is ending, so re-booting the SPA there is desirable — it drops any stale client state.\n      window.location.assign(redirect_to);\n    } catch {\n      // The token is single-use + short-TTL; a failure means it is stale/expired. Release the latch and\n      // surface a retry-able error rather than stranding the user.\n      submittingRef.current = false;\n      setStatus(ConfirmStatus.ERROR);\n    }\n  }, [token]);\n\n  const cancel = useCallback(() => {\n    // Cancel = do NOT sign out. Return to the app home (the user keeps their session). A full navigation\n    // avoids leaving the single-use `token` in the SPA's in-memory history entry.\n    window.location.assign(CommonRoutePaths.home);\n  }, []);\n\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  // Reached without a token (bad link / direct hit) — there is nothing to confirm; send to the signed-out page.\n  if (!token) {\n    return <Navigate to={CommonRoutePaths.oauthLoggedOut} replace />;\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLogoutConfirmLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLogoutConfirmLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {status === ConfirmStatus.ERROR && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{t(OAuthLogoutConfirmLabel.ERROR)}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"flex gap-element\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={cancel}>\n          {t(OAuthLogoutConfirmLabel.CANCEL)}\n        </Button>\n        <Button variant={ButtonVariants_Variant.DEFAULT} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={confirm}>\n          {t(OAuthLogoutConfirmLabel.CONFIRM)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLogoutConfirm({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM,\n    'Auth_OAuthLogoutConfirm',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AA0B1H;;;;GAIG;AACH,IAAK,aAOJ;AAPD,WAAK,aAAa;IAChB,0CAA0C;IAC1C,gCAAe,CAAA;IACf,wGAAwG;IACxG,0CAAyB,CAAA;IACzB,uGAAuG;IACvG,gCAAe,CAAA;AACjB,CAAC,EAPI,aAAa,KAAb,aAAa,QAOjB;AAED,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAC3D,MAA0D,EACvC,EAAE;IACrB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAE9G,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,+FAA+F;IAC/F,yGAAyG;IACzG,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC5C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvF,mGAAmG;YACnG,qGAAqG;YACrG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kGAAkG;YAClG,6DAA6D;YAC7D,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,qGAAqG;QACrG,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,8GAA8G;IAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,cAAc,EAAE,OAAO,SAAG,CAAC;IACnE,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAQ,IAClG,EAEL,MAAM,KAAK,aAAa,CAAC,KAAK,IAAI,CACjC,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAoB,GACjE,CACT,EAED,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,YAC/H,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAC3B,EACT,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,YAChI,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAC5B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EACtC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EACkE;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,mCAAmC,EACzD,yBAAyB,CAC1B,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLogoutConfirmLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout §6 confirmation prompt — the body rendered by {@link AuthPage_OAuthLogoutConfirm}.\n *\n * FLOW: `GET /oauth/end-session` redirects the browser here (with a single-use `token` query param) for a\n * NON-trusted logout — everything EXCEPT a trusted RP presenting a valid `id_token_hint` AND an exact-match\n * registered `post_logout_redirect_uri`, which is logged out directly without a prompt (the Keycloak-style\n * posture). This page asks the End-User to confirm BEFORE the session is terminated, mitigating BROWSER-based\n * logout CSRF (RP-Initiated Logout 1.0 §6; a cross-origin page cannot read the token to complete the confirm —\n * see the backend `handleEndSessionConfirm` threat model). On CONFIRM it POSTs the token to `POST /oauth/end-session/confirm`,\n * which terminates the session and returns `{ redirect_to }` (the signed-out page `/oauth/logged-out`); on\n * CANCEL nothing is terminated and the user returns to the app.\n *\n * Token-driven, not session-driven: the End-User may be unauthenticated in this SPA (they arrived via an RP\n * redirect), so this page never gates on a Bearer — the opaque `token` is the whole credential.\n *\n * Copy is resolved through {@link OAuthLogoutConfirmLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM`)\n * via {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLogoutConfirm.labels.ts`.\n */\n\nexport interface PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps {\n  /** Reserved: the confirm screen is driven by the `token` query param and accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/**\n * The prompt's local interaction state. A named runtime source rather than a literal union so each\n * member can carry WHY it exists — `ERROR` in particular is reached only by a stale/expired token,\n * which is a normal outcome here (the token is single-use and short-TTL), not a fault.\n */\nenum ConfirmStatus {\n  /** Waiting for the End-User to decide. */\n  READY = 'ready',\n  /** The confirm POST is in flight; both buttons are disabled to keep the single-use token single-use. */\n  SUBMITTING = 'submitting',\n  /** The confirmation token was stale, expired or already used — the user may start the logout again. */\n  ERROR = 'error',\n}\n\nexport const PublicLayoutPreset_OAuthLogoutConfirm_Default = (\n  _props: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps,\n): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConfirmStatus>(ConfirmStatus.READY);\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, key);\n\n  const token = useMemo(() => searchParams.get('token') ?? '', [searchParams]);\n\n  // Stale-closure-proof single-flight latch for the confirm POST (mirrors the consent screen): a\n  // synchronous double-dispatch could fire two POSTs before React re-renders, and the token is single-use.\n  const submittingRef = useRef(false);\n\n  const confirm = useCallback(async () => {\n    if (!token || submittingRef.current) return;\n    submittingRef.current = true;\n    setStatus(ConfirmStatus.SUBMITTING);\n    try {\n      const { redirect_to } = await getManualCallsHttpClient().oauthEndSessionConfirm(token);\n      // Full navigation to the signed-out page (`window.location.assign`, mirroring the consent screen):\n      // the session is ending, so re-booting the SPA there is desirable — it drops any stale client state.\n      window.location.assign(redirect_to);\n    } catch {\n      // The token is single-use + short-TTL; a failure means it is stale/expired. Release the latch and\n      // surface a retry-able error rather than stranding the user.\n      submittingRef.current = false;\n      setStatus(ConfirmStatus.ERROR);\n    }\n  }, [token]);\n\n  const cancel = useCallback(() => {\n    // Cancel = do NOT sign out. Return to the app home (the user keeps their session). A full navigation\n    // avoids leaving the single-use `token` in the SPA's in-memory history entry.\n    window.location.assign(CommonRoutePaths.home);\n  }, []);\n\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  // Reached without a token (bad link / direct hit) — there is nothing to confirm; send to the signed-out page.\n  if (!token) {\n    return <Navigate to={CommonRoutePaths.oauthLoggedOut} replace />;\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLogoutConfirmLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLogoutConfirmLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {status === ConfirmStatus.ERROR && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{t(OAuthLogoutConfirmLabel.ERROR)}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"flex gap-element\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={cancel}>\n          {t(OAuthLogoutConfirmLabel.CANCEL)}\n        </Button>\n        <Button variant={ButtonVariants_Variant.DEFAULT} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={confirm}>\n          {t(OAuthLogoutConfirmLabel.CONFIRM)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLogoutConfirm({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM,\n    'Auth_OAuthLogoutConfirm',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,qCAAqC,EAAE,mBAAmB,EA0BtE,CAAC"}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,qCAAqC,EAAE,mBAAmB,EA0BtE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,gGAAgG;AAChG,0EAA0E;AAC1E,gGAAgG;AAChG,yGAAyG;AAEzG,MAAM,CAAC,MAAM,qCAAqC,GAA0B;IAC1E;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,SAAS;QACtC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,uFAAuF;KACjG;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,OAAO;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,MAAM;QACnC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,4HAA4H;KACtI;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLogoutConfirmLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout §6 confirmation prompt: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLogoutConfirmLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLogoutConfirmLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading asking the user to confirm they want to sign out of the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that confirming will end their session on this application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CONFIRM,\n    kind: LabelKind.BUTTON,\n    purpose: 'Primary button that confirms the sign-out and ends the session',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CANCEL,\n    kind: LabelKind.BUTTON,\n    purpose: 'Secondary button that cancels the sign-out and returns the user to the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.ERROR,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Message shown when the confirmation link has expired or could not be processed, inviting the user to try signing out again',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, PublicLayoutsOAuthLogoutConfirmLabels);\n"]}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,gGAAgG;AAChG,0EAA0E;AAC1E,gGAAgG;AAChG,yGAAyG;AAEzG,MAAM,CAAC,MAAM,qCAAqC,GAA0B;IAC1E;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,SAAS;QACtC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,uFAAuF;KACjG;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,OAAO;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,MAAM;QACnC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,4HAA4H;KACtI;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLogoutConfirmLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout §6 confirmation prompt: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLogoutConfirmLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLogoutConfirmLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading asking the user to confirm they want to sign out of the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that confirming will end their session on this application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CONFIRM,\n    kind: LabelKind.BUTTON,\n    purpose: 'Primary button that confirms the sign-out and ends the session',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CANCEL,\n    kind: LabelKind.BUTTON,\n    purpose: 'Secondary button that cancels the sign-out and returns the user to the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.ERROR,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Message shown when the confirmation link has expired or could not be processed, inviting the user to try signing out again',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, PublicLayoutsOAuthLogoutConfirmLabels);\n"]}

package/dist/esm/components/auth/Auth_OneOffSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAepE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAQxH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC;AAEjF,MAAM,WAAW,6CAA6C;IAC5D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAmGD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wCAAwC,GAAI,qCAItD,6CAA6C,KAAG,KAAK,CAAC,GAAG,CAAC,OAgO5D,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,6CAA6C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG1K"}
+{"version":3,"file":"Auth_OneOffSession.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAepE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAQxH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC;AAEjF,MAAM,WAAW,6CAA6C;IAC5D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAmGD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wCAAwC,GAAI,qCAItD,6CAA6C,KAAG,KAAK,CAAC,GAAG,CAAC,OAgO5D,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,6CAA6C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG1K"}

package/dist/esm/components/auth/Auth_OneOffSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAwDzF;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,YAAgD,EAChD,QAAkM;IAElM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,IAAI,aAA2D,CAAC;IAChE,IAAI,gBAAqE,CAAC;IAE1E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,SAAS,GAAI,EAAU,CAAC,mBAAmB,CAAC;YAClD,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAChG,aAAa,GAAG,EAAE,CAAC;gBACnB,gBAAgB,GAAG,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAE1D,0EAA0E;IAC1E,gFAAgF;IAChF,gCAAgC;IAChC,MAAM,2BAA2B,GAA2B,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAC/C,aAAa,EACb,gBAAgB,EAChB,2BAA2B,EAC3B,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IAEF,OAAO,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACvC,sFAAsF;IACtF,mFAAmF;IACnF,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,EACvD,KAAK,EACL,IAAI,GAAG,iBAAiB,EACxB,iBAAiB,GAC6B,EAAqB,EAAE;IACrE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,CAAC;IACrI,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAE7G,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAChE,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACxD,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAEpD,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC;YACjE,MAAM,SAAS,GAAG,WAAW,IAAI,iBAAiB,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,qEAAqE;QACrE,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,EAC5B,IAAI,CAAC,aAAa,CAAC,kBAAkB,EACrC,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAC3C,CAAC,EAAE;QACD,IAAI;QACJ,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,2BAA2B;QAChC,iBAAiB;QACjB,QAAQ;KACT,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,oBAAoB,CAAC,OAAO;YAAE,OAAO;QAEzC,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,YAAY,4BAA4B,CAAC,EAAE,CAAC;YAC1F,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;YAChD,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,sDAAsD;QACtD,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,6BAA6B;QAC7B,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACnD,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,KAAK,wBAAwB;YAChD,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAErC,QAAQ;aACL,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;YAChB,QAAQ,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAExJ,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,iEAAiE;IACjE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,qCAAqC;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACtC,gCAAgC,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAE7C,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,8FAA8F,YAC3G,cAAK,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YAC7G,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sBAAsB,GAAG,GAC1E,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAW,IAClD,EACN,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,EACR,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAQ,GAC5D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,EAAC,SAAS,EAAC,6BAA6B,aAC3E,cAAK,SAAS,EAAC,0FAA0F,iBAAa,MAAM,YAC1H,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,GAAG,GACjD,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAQ,IACvE,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAwE;IACrJ,MAAM,SAAS,GAAG,uBAAuB,CAAgD,qBAAqB,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate } from 'react-router-dom';\nimport type { AnyFrontendResourceConfiguration, FrontendResourceConfiguration_Operation } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { isOperationAddressable } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { EphemeralSessionTokenStorage } from '~wildo-frontend-lib/core/security/session-token-storage.frontend.service';\nimport { NavigationUtils } from '~wildo-frontend-lib/core/navigation/navigation.utils';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\n\n// --- Contract ---\n\n/**\n * Receiver mode for `Auth_OneOffSession` (cross-app-jwt-propagation.md Step 5).\n *\n * Two distinct issuance flows land on this same UI shell; the mode prop\n * dispatches to the right exchange handler and the right post-exchange\n * URL-resolution strategy:\n *\n * - `'one-off-session'` — W7.3b ephemeral one-off session. The token is\n *   consumed via `handleOneOffTokenExchange` (`POST /auth/one-off-session/exchange`),\n *   which returns a context populated with `tokenType`, `scopedInitiatorIds`,\n *   and `applicationId`. Post-exchange URL resolves via the resource\n *   registry (matches an operation whose `tokenAuthentication.types` accepts\n *   the consumed `tokenType`). Enforces `EphemeralSessionTokenStorage` to\n *   prevent stomping a parent tab's authenticated session.\n *\n * - `'cross-frontend-handoff'` — Cross-app JWT propagation handoff. The\n *   token is an AUTH_CODE_EXCHANGE consumable issued by\n *   `POST /auth/cross-frontend-handoff` and consumed via\n *   `handleAuthCodeExchange` (`POST /auth/token/exchange`, the same exchange\n *   endpoint OAuth2 callback uses — see Step 4 integration test). The\n *   exchange response surfaces `returnPath` into\n *   `auth.crossFrontendHandoffContext`; we navigate there post-exchange\n *   (with URL-query fallback as defense-in-depth). The ephemeral-storage\n *   guard is intentionally skipped — per K-7, the receiver's storage\n *   adapter (NOT the protocol) determines lifetime, and the SaaS app's\n *   regular persistent storage is the correct landing for a session\n *   transfer.\n */\nexport type AuthOneOffSessionMode = 'one-off-session' | 'cross-frontend-handoff';\n\nexport interface PublicLayoutPreset_OneOffSession_DefaultProps {\n  /**\n   * The one-time consumable token to exchange. For `mode='one-off-session'`\n   * it comes from the `:token` URL path param; for `mode='cross-frontend-handoff'`\n   * it comes from the `?code=` query param (extracted by `AuthPage_AuthExchange`).\n   */\n  token?: string;\n  /**\n   * Defaults to `'one-off-session'` to preserve backward compatibility with\n   * the W7.3b page wrapper that does not pass this prop.\n   */\n  mode?: AuthOneOffSessionMode;\n  /**\n   * Cross-frontend-handoff receiver: the `?return=` URL query param value,\n   * extracted by `AuthPage_AuthExchange`. Defense-in-depth fallback used\n   * ONLY when `auth.crossFrontendHandoffContext.returnPath` is missing\n   * (e.g. backend metadata round-trip failed for some reason). Sanitized\n   * before use.\n   */\n  returnPathFromUrl?: string;\n}\n\n/**\n * Resolves the target frontend URL for a W7.3b one-off-session exchange.\n *\n * Searches the resource registry for an operation whose `tokenAuthentication.types`\n * includes the consumed `tokenType`, then builds a concrete URL using the\n * targeting `initiatorIds` as path parameters.\n *\n * Returns undefined if no matching operation is found or URL cannot be resolved\n * (caller falls back to home).\n *\n * NOT used for cross-frontend-handoff mode — that flow drives navigation off\n * `auth.crossFrontendHandoffContext.returnPath`, see\n * `resolveCrossFrontendHandoffUrl()` below.\n */\nfunction resolveTargetUrl(\n  tokenType: string,\n  initiatorIds: Record<string, string> | undefined,\n  registry: { resourceConfigurations: Record<string, AnyFrontendResourceConfiguration>; allResourceFieldIdentifiers: Record<string, string>; fieldIdentifierToResourceType: Record<string, string> },\n): string | undefined {\n  if (!initiatorIds || Object.keys(initiatorIds).length === 0) return undefined;\n\n  let matchedConfig: AnyFrontendResourceConfiguration | undefined;\n  let matchedOperation: FrontendResourceConfiguration_Operation | undefined;\n\n  for (const rc of Object.values(registry.resourceConfigurations)) {\n    const ops = Array.isArray(rc.operations) ? rc.operations : [];\n    for (const op of ops) {\n      const tokenAuth = (op as any).tokenAuthentication;\n      if (tokenAuth?.types?.includes(tokenType) && isOperationAddressable(op.operationFrontendConfig)) {\n        matchedConfig = rc;\n        matchedOperation = op;\n        break;\n      }\n    }\n    if (matchedOperation) break;\n  }\n\n  if (!matchedConfig || !matchedOperation) return undefined;\n\n  // initiatorIds uses fieldIdentifier keys (e.g., organizationId, tasksId).\n  // resolveResourceUrl expects candidateContextIdentifiers with resourceType keys\n  // (e.g., ORGANIZATIONS, TASKS).\n  const candidateContextIdentifiers: Record<string, string> = {};\n  for (const [fieldId, id] of Object.entries(initiatorIds)) {\n    const resourceType = registry.fieldIdentifierToResourceType[fieldId];\n    if (resourceType) {\n      candidateContextIdentifiers[resourceType] = id;\n    }\n  }\n\n  const result = NavigationUtils.resolveResourceUrl(\n    matchedConfig,\n    matchedOperation,\n    candidateContextIdentifiers,\n    registry.allResourceFieldIdentifiers,\n  );\n\n  return result?.resolvedUrl ?? undefined;\n}\n\n/**\n * Defense-in-depth sanitizer for `returnPath` values arriving at the receiver.\n *\n * The cross-frontend-handoff issuer schema (`CrossFrontendHandoff_ReturnPathSchema`\n * in `cross-frontend-handoff.shared.dto.schemas.ts`) already validates the\n * value at issuance time, AND the value flows through the consumable-token\n * metadata round-trip — but a malicious caller could hand-craft an exchange\n * URL bypassing the issuer entirely (`/auth/exchange?code=…&return=https://evil.com`).\n * Without this guard the eventual `<Navigate to={…}>` would happily honour\n * the open-redirect / XSS / path-traversal payload.\n *\n * The ORIGIN half of the question is answered by the shared\n * {@link isSameOriginRedirectPath} predicate rather than by the character\n * rules below, and that split is the fix for a real defect: this function,\n * the docs-site `AuthExchangePage.sanitizeReturnPath()` and the issuer\n * schema were three hand-written deny-lists that \"mirrored\" each other —\n * and all three admitted `/<TAB>/evil.com`, because the URL parser strips\n * ASCII tab / LF / CR before parsing, turning it into `//evil.com`. Every\n * copy banned `\\` and none banned the whitespace that becomes a `/`.\n *\n * The character rules are KEPT, as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n */\nfunction sanitizeReturnPath(raw: string | undefined): string {\n  if (!raw) return CommonRoutePaths.home;\n  // Authoritative: does this actually resolve onto our own origin? Covers `//evil.com`,\n  // `/\\evil.com` and the stripped-control-character family in one parse-based check.\n  if (!isSameOriginRedirectPath(raw)) return CommonRoutePaths.home;\n  if (raw.includes('..')) return CommonRoutePaths.home;\n  if (raw.includes('\\\\')) return CommonRoutePaths.home;\n  if (raw.includes('://')) return CommonRoutePaths.home;\n  if (/[<>\"]/.test(raw)) return CommonRoutePaths.home;\n  if (raw.length > 256) return CommonRoutePaths.home;\n  return raw;\n}\n\n/**\n * cross-app-jwt-propagation.md Step 5 dual-mode receiver.\n *\n * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it\n * via `handleOneOffTokenExchange`, and redirects to the target page resolved\n * from `tokenType` + targeting via the resource registry, falling back to\n * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).\n *\n * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,\n * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,\n * the same endpoint OAuth2 callback uses), and navigates to\n * `auth.crossFrontendHandoffContext.returnPath` (preferred) or\n * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage\n * guard — the SaaS app's persistent storage is the correct landing per K-7.\n *\n * All user-facing strings are i18n-driven via `OneOffSessionLabel`.\n */\nexport const PublicLayoutPreset_OneOffSession_Default = ({\n  token,\n  mode = 'one-off-session',\n  returnPathFromUrl,\n}: PublicLayoutPreset_OneOffSession_DefaultProps): React.JSX.Element => {\n  const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();\n  const { registry } = useResourceRegistry();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);\n  const loginPath = CommonRoutePaths.login;\n\n  /**\n   * Receiver-LOCAL error state for THIS exchange attempt.\n   *\n   * L-9 (third deep-review pass): this field deliberately duplicates\n   * `auth.error` (set by `AuthSessionContext.handleAuthCodeExchange`'s catch\n   * block) rather than reading the shared field directly. Reasoning:\n   *\n   * - `auth.error` is process-wide across all auth surfaces (logout,\n   *   refresh-token rotation, magic-link verify, MFA verify, passkey\n   *   auth, etc. all write to it). If a parallel\n   *   call sets `auth.error` while THIS receiver's exchange is succeeding,\n   *   reading `auth.error` from the H-4 navigation gate would falsely\n   *   block the receiver from rendering `<Navigate>` — even though the\n   *   receiver's own exchange completed cleanly.\n   *\n   * - Local `error` is scoped to THIS receiver's exchange attempt\n   *   (set ONLY by the `.catch()` on the in-mount exchange Promise).\n   *   The H-4 gate checks `!error` (local) so navigation is blocked iff\n   *   THIS receiver's exchange failed, regardless of what other auth\n   *   surfaces are doing concurrently.\n   *\n   * If the AuthSessionContext error surface is ever refactored into per-\n   * call scoped errors, this duplication can collapse — but until then\n   * the duplication is load-bearing.\n   */\n  const [error, setError] = useState<string | null>(null);\n  const exchangeAttemptedRef = useRef(false);\n  /**\n   * Gate `<Navigate>` until the exchange phase has resolved (success, failure,\n   * or intentionally skipped). Without this gate, a cross-frontend-handoff\n   * receiver mounted with a pre-existing `auth.accessToken` (cold-load from\n   * persistent storage) would render `<Navigate>` on the FIRST render —\n   * which commits and unmounts the component BEFORE this component's\n   * `useEffect` ever runs the AUTH_CODE_EXCHANGE consume call. The user\n   * would then land on the URL `?return=` value with their pre-existing\n   * session AND the consumable token would dangle in the store for 60s\n   * (auto-expiring without ever being consumed). See M-2 in the Step 5\n   * deep-review log on `cross-app-jwt-propagation.md`.\n   *\n   * Initial value is mode-dependent:\n   * - `one-off-session`: `true` IF accessToken is already set (preserve\n   *   the existing W7.3b \"render Navigate immediately\" semantics — the\n   *   ephemeral-storage guard fires for the in-tab case anyway).\n   * - `cross-frontend-handoff`: `false` always — we ALWAYS want the\n   *   exchange to run before navigating, even when `auth.accessToken` is\n   *   set, so the new tokens replace the existing session and the\n   *   `crossFrontendHandoffContext.returnPath` populates from the\n   *   exchange response (defense against silent auth-confusion when the\n   *   pre-existing session belongs to a different user than the handoff\n   *   was minted for).\n   */\n  const [exchangePhaseResolved, setExchangePhaseResolved] = useState<boolean>(\n    mode === 'one-off-session' && Boolean(auth.accessToken),\n  );\n\n  const targetUrl = useMemo(() => {\n    if (!auth.accessToken) return CommonRoutePaths.home;\n\n    // Cross-frontend-handoff: navigate to `returnPath` from the exchange\n    // response (which round-tripped via the consumable-token metadata),\n    // falling back to the URL-query value as defense-in-depth. Both inputs\n    // pass through `sanitizeReturnPath` to defeat any open-redirect /\n    // path-traversal / XSS payload that may have bypassed the issuer schema.\n    if (mode === 'cross-frontend-handoff') {\n      const fromContext = auth.crossFrontendHandoffContext?.returnPath;\n      const candidate = fromContext ?? returnPathFromUrl;\n      return sanitizeReturnPath(candidate);\n    }\n\n    // W7.3b one-off session: walk the resource registry for an operation\n    // matching the consumed tokenType.\n    if (!auth.oneOffContext) return CommonRoutePaths.home;\n    const resolved = resolveTargetUrl(\n      auth.oneOffContext.tokenType,\n      auth.oneOffContext.scopedInitiatorIds,\n      registry,\n    );\n    return resolved ?? CommonRoutePaths.home;\n  }, [\n    mode,\n    auth.oneOffContext,\n    auth.accessToken,\n    auth.crossFrontendHandoffContext,\n    returnPathFromUrl,\n    registry,\n  ]);\n\n  useEffect(() => {\n    if (exchangeAttemptedRef.current) return;\n\n    // Storage guard applies ONLY to W7.3b (one-off-session) mode. Cross-\n    // frontend-handoff intentionally lands in the receiver's regular tab\n    // with its regular (persistent or ephemeral, per receiver's adapter\n    // choice) storage — this is the protocol's whole point per K-7.\n    if (mode === 'one-off-session' && !(tokenStorage instanceof EphemeralSessionTokenStorage)) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_WRONG_TAB));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    if (!token) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_NO_TOKEN));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    // Already-authenticated short-circuit applies ONLY to W7.3b\n    // (one-off-session) mode — there an existing parent session in the\n    // tab is the trigger for the ERROR_WRONG_TAB guard above (the\n    // ephemeral-storage check should have already fired), and burning\n    // a one-off code on an authenticated tab is wasteful.\n    //\n    // Cross-frontend-handoff mode must NOT short-circuit: the user\n    // explicitly initiated a session transfer on the source frontend\n    // (clicked \"Open in docs\" / similar). Skipping the exchange would:\n    //   (a) leave a 60-second dangling AUTH_CODE_EXCHANGE token in the\n    //       store (auto-expires, but uses the consumable-token budget and\n    //       muddies audit logs);\n    //   (b) navigate the user using the URL `?return=` value but with\n    //       their PRE-EXISTING session — which may be a different user\n    //       than the handoff was minted for, leading to the user landing\n    //       on `/api/organization/foo` as the wrong identity (silent\n    //       auth-confusion). Always consume the code so the new tokens\n    //       replace the existing ones.\n    if (auth.accessToken && mode === 'one-off-session') {\n      exchangeAttemptedRef.current = true;\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    exchangeAttemptedRef.current = true;\n\n    const exchange = mode === 'cross-frontend-handoff'\n      ? handleAuthCodeExchange(token)\n      : handleOneOffTokenExchange(token);\n\n    exchange\n      .catch((e: any) => {\n        setError(e?.message || t(OneOffSessionLabel.ERROR_GENERIC));\n      })\n      .finally(() => {\n        setExchangePhaseResolved(true);\n      });\n  }, [token, mode, auth.accessToken, handleOneOffTokenExchange, handleAuthCodeExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  // Single-use cleanup of `auth.crossFrontendHandoffContext`. Runs on\n  // unmount, which happens AFTER `<Navigate to={targetUrl}>` resolves and\n  // React tears down the receiver. Earlier cleanup would race the\n  // `targetUrl` `useMemo` recomputation and could navigate to home instead\n  // of the intended `returnPath`. No-op for `one-off-session` mode (which\n  // never sets the field in the first place — `oneOffContext` is its\n  // sibling state and is preserved as part of the active session).\n  //\n  // Dependency note (L-6): `mode` is captured by closure, so listing it as\n  // a dep technically just re-creates the effect when `mode` changes mid-\n  // mount — which never happens in practice (the prop is fixed by the\n  // receiver page). It IS listed deliberately so React's exhaustive-deps\n  // lint stays clean AND so a future caller that toggles `mode` mid-mount\n  // gets the cleanup re-bound rather than the stale closure. Removing it\n  // would shift this from \"harmless dep\" to \"subtle stale-closure bug\n  // waiting for a future mode toggle\".\n  useEffect(() => {\n    return () => {\n      if (mode === 'cross-frontend-handoff') {\n        clearCrossFrontendHandoffContext();\n      }\n    };\n  }, [mode, clearCrossFrontendHandoffContext]);\n\n  // Navigation guard: render `<Navigate>` ONLY when the exchange phase\n  // resolved cleanly. Critical: `!error` is load-bearing here. Without it,\n  // a cross-frontend-handoff receiver mounted with a pre-existing\n  // `auth.accessToken` (cold-load from persistent storage) whose AUTH_CODE_\n  // EXCHANGE call fails would silently navigate the user to the URL\n  // `?return=` value WITH THE OLD SESSION — a session-confusion regression\n  // (the user lands on the deep link as the wrong identity, with no error\n  // surfaced). The error branch below shows a localized failure message\n  // and a login link instead. See H-4 in the Step 5 second deep-review log\n  // on `cross-app-jwt-propagation.md`.\n  if (auth.accessToken && !auth.isLoading && exchangePhaseResolved && !error) {\n    return <Navigate to={targetUrl} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (error) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element\">\n            <svg className=\"h-6 w-6 text-destructive\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\" />\n            </svg>\n          </div>\n          <Heading>{t(OneOffSessionLabel.ERROR_TITLE)}</Heading>\n        </div>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n        <div className=\"text-center mt-group\">\n          <Link href={loginPath}>{t(OneOffSessionLabel.LOGIN_LINK)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  return (\n    <div role=\"status\" aria-live=\"polite\" className=\"text-center space-y-item-xs\">\n      <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\" aria-hidden=\"true\">\n        <LoadingSpinner size={24} className=\"text-primary\" />\n      </div>\n      <Text className=\"max-w-sm mx-auto\">{t(OneOffSessionLabel.VERIFYING)}</Text>\n    </div>\n  );\n};\n\nexport function Auth_OneOffSession({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OneOffSession_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OneOffSession_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, 'Auth_OneOffSession')(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OneOffSession.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAwDzF;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,YAAgD,EAChD,QAAkM;IAElM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,IAAI,aAA2D,CAAC;IAChE,IAAI,gBAAqE,CAAC;IAE1E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,SAAS,GAAI,EAAU,CAAC,mBAAmB,CAAC;YAClD,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAChG,aAAa,GAAG,EAAE,CAAC;gBACnB,gBAAgB,GAAG,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAE1D,0EAA0E;IAC1E,gFAAgF;IAChF,gCAAgC;IAChC,MAAM,2BAA2B,GAA2B,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAC/C,aAAa,EACb,gBAAgB,EAChB,2BAA2B,EAC3B,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IAEF,OAAO,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACvC,sFAAsF;IACtF,mFAAmF;IACnF,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,EACvD,KAAK,EACL,IAAI,GAAG,iBAAiB,EACxB,iBAAiB,GAC6B,EAAqB,EAAE;IACrE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,CAAC;IACrI,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAE7G,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAChE,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACxD,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAEpD,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC;YACjE,MAAM,SAAS,GAAG,WAAW,IAAI,iBAAiB,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,qEAAqE;QACrE,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,EAC5B,IAAI,CAAC,aAAa,CAAC,kBAAkB,EACrC,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAC3C,CAAC,EAAE;QACD,IAAI;QACJ,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,2BAA2B;QAChC,iBAAiB;QACjB,QAAQ;KACT,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,oBAAoB,CAAC,OAAO;YAAE,OAAO;QAEzC,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,YAAY,4BAA4B,CAAC,EAAE,CAAC;YAC1F,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;YAChD,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,sDAAsD;QACtD,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,6BAA6B;QAC7B,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACnD,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,KAAK,wBAAwB;YAChD,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAErC,QAAQ;aACL,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;YAChB,QAAQ,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAExJ,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,iEAAiE;IACjE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,qCAAqC;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACtC,gCAAgC,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAE7C,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,8FAA8F,YAC3G,cAAK,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YAC7G,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sBAAsB,GAAG,GAC1E,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAW,IAClD,EACN,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,EACR,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAQ,GAC5D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,EAAC,SAAS,EAAC,6BAA6B,aAC3E,cAAK,SAAS,EAAC,0FAA0F,iBAAa,MAAM,YAC1H,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,GAAG,GACjD,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAQ,IACvE,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAwE;IACrJ,MAAM,SAAS,GAAG,uBAAuB,CAAgD,qBAAqB,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate } from 'react-router-dom';\nimport type { AnyFrontendResourceConfiguration, FrontendResourceConfiguration_Operation } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { isOperationAddressable } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { EphemeralSessionTokenStorage } from '~wildo-frontend-lib/core/security/session-token-storage.frontend.service';\nimport { NavigationUtils } from '~wildo-frontend-lib/core/navigation/navigation.utils';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\n\n// --- Contract ---\n\n/**\n * Receiver mode for `Auth_OneOffSession` (cross-app-jwt-propagation.md Step 5).\n *\n * Two distinct issuance flows land on this same UI shell; the mode prop\n * dispatches to the right exchange handler and the right post-exchange\n * URL-resolution strategy:\n *\n * - `'one-off-session'` — W7.3b ephemeral one-off session. The token is\n *   consumed via `handleOneOffTokenExchange` (`POST /auth/one-off-session/exchange`),\n *   which returns a context populated with `tokenType`, `scopedInitiatorIds`,\n *   and `applicationId`. Post-exchange URL resolves via the resource\n *   registry (matches an operation whose `tokenAuthentication.types` accepts\n *   the consumed `tokenType`). Enforces `EphemeralSessionTokenStorage` to\n *   prevent stomping a parent tab's authenticated session.\n *\n * - `'cross-frontend-handoff'` — Cross-app JWT propagation handoff. The\n *   token is an AUTH_CODE_EXCHANGE consumable issued by\n *   `POST /auth/cross-frontend-handoff` and consumed via\n *   `handleAuthCodeExchange` (`POST /auth/token/exchange`, the same exchange\n *   endpoint OAuth2 callback uses — see Step 4 integration test). The\n *   exchange response surfaces `returnPath` into\n *   `auth.crossFrontendHandoffContext`; we navigate there post-exchange\n *   (with URL-query fallback as defense-in-depth). The ephemeral-storage\n *   guard is intentionally skipped — per K-7, the receiver's storage\n *   adapter (NOT the protocol) determines lifetime, and the SaaS app's\n *   regular persistent storage is the correct landing for a session\n *   transfer.\n */\nexport type AuthOneOffSessionMode = 'one-off-session' | 'cross-frontend-handoff';\n\nexport interface PublicLayoutPreset_OneOffSession_DefaultProps {\n  /**\n   * The one-time consumable token to exchange. For `mode='one-off-session'`\n   * it comes from the `:token` URL path param; for `mode='cross-frontend-handoff'`\n   * it comes from the `?code=` query param (extracted by `AuthPage_AuthExchange`).\n   */\n  token?: string;\n  /**\n   * Defaults to `'one-off-session'` to preserve backward compatibility with\n   * the W7.3b page wrapper that does not pass this prop.\n   */\n  mode?: AuthOneOffSessionMode;\n  /**\n   * Cross-frontend-handoff receiver: the `?return=` URL query param value,\n   * extracted by `AuthPage_AuthExchange`. Defense-in-depth fallback used\n   * ONLY when `auth.crossFrontendHandoffContext.returnPath` is missing\n   * (e.g. backend metadata round-trip failed for some reason). Sanitized\n   * before use.\n   */\n  returnPathFromUrl?: string;\n}\n\n/**\n * Resolves the target frontend URL for a W7.3b one-off-session exchange.\n *\n * Searches the resource registry for an operation whose `tokenAuthentication.types`\n * includes the consumed `tokenType`, then builds a concrete URL using the\n * targeting `initiatorIds` as path parameters.\n *\n * Returns undefined if no matching operation is found or URL cannot be resolved\n * (caller falls back to home).\n *\n * NOT used for cross-frontend-handoff mode — that flow drives navigation off\n * `auth.crossFrontendHandoffContext.returnPath`, see\n * `resolveCrossFrontendHandoffUrl()` below.\n */\nfunction resolveTargetUrl(\n  tokenType: string,\n  initiatorIds: Record<string, string> | undefined,\n  registry: { resourceConfigurations: Record<string, AnyFrontendResourceConfiguration>; allResourceFieldIdentifiers: Record<string, string>; fieldIdentifierToResourceType: Record<string, string> },\n): string | undefined {\n  if (!initiatorIds || Object.keys(initiatorIds).length === 0) return undefined;\n\n  let matchedConfig: AnyFrontendResourceConfiguration | undefined;\n  let matchedOperation: FrontendResourceConfiguration_Operation | undefined;\n\n  for (const rc of Object.values(registry.resourceConfigurations)) {\n    const ops = Array.isArray(rc.operations) ? rc.operations : [];\n    for (const op of ops) {\n      const tokenAuth = (op as any).tokenAuthentication;\n      if (tokenAuth?.types?.includes(tokenType) && isOperationAddressable(op.operationFrontendConfig)) {\n        matchedConfig = rc;\n        matchedOperation = op;\n        break;\n      }\n    }\n    if (matchedOperation) break;\n  }\n\n  if (!matchedConfig || !matchedOperation) return undefined;\n\n  // initiatorIds uses fieldIdentifier keys (e.g., organizationId, tasksId).\n  // resolveResourceUrl expects candidateContextIdentifiers with resourceType keys\n  // (e.g., ORGANIZATIONS, TASKS).\n  const candidateContextIdentifiers: Record<string, string> = {};\n  for (const [fieldId, id] of Object.entries(initiatorIds)) {\n    const resourceType = registry.fieldIdentifierToResourceType[fieldId];\n    if (resourceType) {\n      candidateContextIdentifiers[resourceType] = id;\n    }\n  }\n\n  const result = NavigationUtils.resolveResourceUrl(\n    matchedConfig,\n    matchedOperation,\n    candidateContextIdentifiers,\n    registry.allResourceFieldIdentifiers,\n  );\n\n  return result?.resolvedUrl ?? undefined;\n}\n\n/**\n * Defense-in-depth sanitizer for `returnPath` values arriving at the receiver.\n *\n * The cross-frontend-handoff issuer schema (`CrossFrontendHandoff_ReturnPathSchema`\n * in `cross-frontend-handoff.shared.dto.schemas.ts`) already validates the\n * value at issuance time, AND the value flows through the consumable-token\n * metadata round-trip — but a malicious caller could hand-craft an exchange\n * URL bypassing the issuer entirely (`/auth/exchange?code=…&return=https://evil.com`).\n * Without this guard the eventual `<Navigate to={…}>` would happily honour\n * the open-redirect / XSS / path-traversal payload.\n *\n * The ORIGIN half of the question is answered by the shared\n * {@link isSameOriginRedirectPath} predicate rather than by the character\n * rules below, and that split is the fix for a real defect: this function,\n * the docs-site `AuthExchangePage.sanitizeReturnPath()` and the issuer\n * schema were three hand-written deny-lists that \"mirrored\" each other —\n * and all three admitted `/<TAB>/evil.com`, because the URL parser strips\n * ASCII tab / LF / CR before parsing, turning it into `//evil.com`. Every\n * copy banned `\\` and none banned the whitespace that becomes a `/`.\n *\n * The character rules are KEPT, as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n */\nfunction sanitizeReturnPath(raw: string | undefined): string {\n  if (!raw) return CommonRoutePaths.home;\n  // Authoritative: does this actually resolve onto our own origin? Covers `//evil.com`,\n  // `/\\evil.com` and the stripped-control-character family in one parse-based check.\n  if (!isSameOriginRedirectPath(raw)) return CommonRoutePaths.home;\n  if (raw.includes('..')) return CommonRoutePaths.home;\n  if (raw.includes('\\\\')) return CommonRoutePaths.home;\n  if (raw.includes('://')) return CommonRoutePaths.home;\n  if (/[<>\"]/.test(raw)) return CommonRoutePaths.home;\n  if (raw.length > 256) return CommonRoutePaths.home;\n  return raw;\n}\n\n/**\n * cross-app-jwt-propagation.md Step 5 dual-mode receiver.\n *\n * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it\n * via `handleOneOffTokenExchange`, and redirects to the target page resolved\n * from `tokenType` + targeting via the resource registry, falling back to\n * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).\n *\n * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,\n * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,\n * the same endpoint OAuth2 callback uses), and navigates to\n * `auth.crossFrontendHandoffContext.returnPath` (preferred) or\n * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage\n * guard — the SaaS app's persistent storage is the correct landing per K-7.\n *\n * All user-facing strings are i18n-driven via `OneOffSessionLabel`.\n */\nexport const PublicLayoutPreset_OneOffSession_Default = ({\n  token,\n  mode = 'one-off-session',\n  returnPathFromUrl,\n}: PublicLayoutPreset_OneOffSession_DefaultProps): React.JSX.Element => {\n  const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();\n  const { registry } = useResourceRegistry();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);\n  const loginPath = CommonRoutePaths.login;\n\n  /**\n   * Receiver-LOCAL error state for THIS exchange attempt.\n   *\n   * L-9 (third deep-review pass): this field deliberately duplicates\n   * `auth.error` (set by `AuthSessionContext.handleAuthCodeExchange`'s catch\n   * block) rather than reading the shared field directly. Reasoning:\n   *\n   * - `auth.error` is process-wide across all auth surfaces (logout,\n   *   refresh-token rotation, magic-link verify, MFA verify, passkey\n   *   auth, etc. all write to it). If a parallel\n   *   call sets `auth.error` while THIS receiver's exchange is succeeding,\n   *   reading `auth.error` from the H-4 navigation gate would falsely\n   *   block the receiver from rendering `<Navigate>` — even though the\n   *   receiver's own exchange completed cleanly.\n   *\n   * - Local `error` is scoped to THIS receiver's exchange attempt\n   *   (set ONLY by the `.catch()` on the in-mount exchange Promise).\n   *   The H-4 gate checks `!error` (local) so navigation is blocked iff\n   *   THIS receiver's exchange failed, regardless of what other auth\n   *   surfaces are doing concurrently.\n   *\n   * If the AuthSessionContext error surface is ever refactored into per-\n   * call scoped errors, this duplication can collapse — but until then\n   * the duplication is load-bearing.\n   */\n  const [error, setError] = useState<string | null>(null);\n  const exchangeAttemptedRef = useRef(false);\n  /**\n   * Gate `<Navigate>` until the exchange phase has resolved (success, failure,\n   * or intentionally skipped). Without this gate, a cross-frontend-handoff\n   * receiver mounted with a pre-existing `auth.accessToken` (cold-load from\n   * persistent storage) would render `<Navigate>` on the FIRST render —\n   * which commits and unmounts the component BEFORE this component's\n   * `useEffect` ever runs the AUTH_CODE_EXCHANGE consume call. The user\n   * would then land on the URL `?return=` value with their pre-existing\n   * session AND the consumable token would dangle in the store for 60s\n   * (auto-expiring without ever being consumed). See M-2 in the Step 5\n   * deep-review log on `cross-app-jwt-propagation.md`.\n   *\n   * Initial value is mode-dependent:\n   * - `one-off-session`: `true` IF accessToken is already set (preserve\n   *   the existing W7.3b \"render Navigate immediately\" semantics — the\n   *   ephemeral-storage guard fires for the in-tab case anyway).\n   * - `cross-frontend-handoff`: `false` always — we ALWAYS want the\n   *   exchange to run before navigating, even when `auth.accessToken` is\n   *   set, so the new tokens replace the existing session and the\n   *   `crossFrontendHandoffContext.returnPath` populates from the\n   *   exchange response (defense against silent auth-confusion when the\n   *   pre-existing session belongs to a different user than the handoff\n   *   was minted for).\n   */\n  const [exchangePhaseResolved, setExchangePhaseResolved] = useState<boolean>(\n    mode === 'one-off-session' && Boolean(auth.accessToken),\n  );\n\n  const targetUrl = useMemo(() => {\n    if (!auth.accessToken) return CommonRoutePaths.home;\n\n    // Cross-frontend-handoff: navigate to `returnPath` from the exchange\n    // response (which round-tripped via the consumable-token metadata),\n    // falling back to the URL-query value as defense-in-depth. Both inputs\n    // pass through `sanitizeReturnPath` to defeat any open-redirect /\n    // path-traversal / XSS payload that may have bypassed the issuer schema.\n    if (mode === 'cross-frontend-handoff') {\n      const fromContext = auth.crossFrontendHandoffContext?.returnPath;\n      const candidate = fromContext ?? returnPathFromUrl;\n      return sanitizeReturnPath(candidate);\n    }\n\n    // W7.3b one-off session: walk the resource registry for an operation\n    // matching the consumed tokenType.\n    if (!auth.oneOffContext) return CommonRoutePaths.home;\n    const resolved = resolveTargetUrl(\n      auth.oneOffContext.tokenType,\n      auth.oneOffContext.scopedInitiatorIds,\n      registry,\n    );\n    return resolved ?? CommonRoutePaths.home;\n  }, [\n    mode,\n    auth.oneOffContext,\n    auth.accessToken,\n    auth.crossFrontendHandoffContext,\n    returnPathFromUrl,\n    registry,\n  ]);\n\n  useEffect(() => {\n    if (exchangeAttemptedRef.current) return;\n\n    // Storage guard applies ONLY to W7.3b (one-off-session) mode. Cross-\n    // frontend-handoff intentionally lands in the receiver's regular tab\n    // with its regular (persistent or ephemeral, per receiver's adapter\n    // choice) storage — this is the protocol's whole point per K-7.\n    if (mode === 'one-off-session' && !(tokenStorage instanceof EphemeralSessionTokenStorage)) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_WRONG_TAB));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    if (!token) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_NO_TOKEN));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    // Already-authenticated short-circuit applies ONLY to W7.3b\n    // (one-off-session) mode — there an existing parent session in the\n    // tab is the trigger for the ERROR_WRONG_TAB guard above (the\n    // ephemeral-storage check should have already fired), and burning\n    // a one-off code on an authenticated tab is wasteful.\n    //\n    // Cross-frontend-handoff mode must NOT short-circuit: the user\n    // explicitly initiated a session transfer on the source frontend\n    // (clicked \"Open in docs\" / similar). Skipping the exchange would:\n    //   (a) leave a 60-second dangling AUTH_CODE_EXCHANGE token in the\n    //       store (auto-expires, but uses the consumable-token budget and\n    //       muddies audit logs);\n    //   (b) navigate the user using the URL `?return=` value but with\n    //       their PRE-EXISTING session — which may be a different user\n    //       than the handoff was minted for, leading to the user landing\n    //       on `/api/organization/foo` as the wrong identity (silent\n    //       auth-confusion). Always consume the code so the new tokens\n    //       replace the existing ones.\n    if (auth.accessToken && mode === 'one-off-session') {\n      exchangeAttemptedRef.current = true;\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    exchangeAttemptedRef.current = true;\n\n    const exchange = mode === 'cross-frontend-handoff'\n      ? handleAuthCodeExchange(token)\n      : handleOneOffTokenExchange(token);\n\n    exchange\n      .catch((e: any) => {\n        setError(e?.message || t(OneOffSessionLabel.ERROR_GENERIC));\n      })\n      .finally(() => {\n        setExchangePhaseResolved(true);\n      });\n  }, [token, mode, auth.accessToken, handleOneOffTokenExchange, handleAuthCodeExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  // Single-use cleanup of `auth.crossFrontendHandoffContext`. Runs on\n  // unmount, which happens AFTER `<Navigate to={targetUrl}>` resolves and\n  // React tears down the receiver. Earlier cleanup would race the\n  // `targetUrl` `useMemo` recomputation and could navigate to home instead\n  // of the intended `returnPath`. No-op for `one-off-session` mode (which\n  // never sets the field in the first place — `oneOffContext` is its\n  // sibling state and is preserved as part of the active session).\n  //\n  // Dependency note (L-6): `mode` is captured by closure, so listing it as\n  // a dep technically just re-creates the effect when `mode` changes mid-\n  // mount — which never happens in practice (the prop is fixed by the\n  // receiver page). It IS listed deliberately so React's exhaustive-deps\n  // lint stays clean AND so a future caller that toggles `mode` mid-mount\n  // gets the cleanup re-bound rather than the stale closure. Removing it\n  // would shift this from \"harmless dep\" to \"subtle stale-closure bug\n  // waiting for a future mode toggle\".\n  useEffect(() => {\n    return () => {\n      if (mode === 'cross-frontend-handoff') {\n        clearCrossFrontendHandoffContext();\n      }\n    };\n  }, [mode, clearCrossFrontendHandoffContext]);\n\n  // Navigation guard: render `<Navigate>` ONLY when the exchange phase\n  // resolved cleanly. Critical: `!error` is load-bearing here. Without it,\n  // a cross-frontend-handoff receiver mounted with a pre-existing\n  // `auth.accessToken` (cold-load from persistent storage) whose AUTH_CODE_\n  // EXCHANGE call fails would silently navigate the user to the URL\n  // `?return=` value WITH THE OLD SESSION — a session-confusion regression\n  // (the user lands on the deep link as the wrong identity, with no error\n  // surfaced). The error branch below shows a localized failure message\n  // and a login link instead. See H-4 in the Step 5 second deep-review log\n  // on `cross-app-jwt-propagation.md`.\n  if (auth.accessToken && !auth.isLoading && exchangePhaseResolved && !error) {\n    return <Navigate to={targetUrl} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (error) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element\">\n            <svg className=\"h-6 w-6 text-destructive\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\" />\n            </svg>\n          </div>\n          <Heading>{t(OneOffSessionLabel.ERROR_TITLE)}</Heading>\n        </div>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n        <div className=\"text-center mt-group\">\n          <Link href={loginPath}>{t(OneOffSessionLabel.LOGIN_LINK)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  return (\n    <div role=\"status\" aria-live=\"polite\" className=\"text-center space-y-item-xs\">\n      <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\" aria-hidden=\"true\">\n        <LoadingSpinner size={24} className=\"text-primary\" />\n      </div>\n      <Text className=\"max-w-sm mx-auto\">{t(OneOffSessionLabel.VERIFYING)}</Text>\n    </div>\n  );\n};\n\nexport function Auth_OneOffSession({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OneOffSession_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OneOffSession_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, 'Auth_OneOffSession')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OneOffSession.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA+C,MAAM,qCAAqC,CAAC;AAM9J,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAOjE,CAAC"}
+{"version":3,"file":"Auth_OneOffSession.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA+C,MAAM,qCAAqC,CAAC;AAM9J,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAOjE,CAAC"}

package/dist/esm/components/auth/Auth_OneOffSession.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,gCAAgC,GAA0B;IACrE,EAAE,GAAG,EAAE,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAChJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClI,EAAE,GAAG,EAAE,kBAAkB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE;IAC1I,EAAE,GAAG,EAAE,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+FAA+F,EAAE;IAC9K,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IACvJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;CAC1G,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OneOffSessionLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOneOffSessionLabels: LabellingUnitaryDef[] = [\n  { ref: OneOffSessionLabel.VERIFYING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the one-off session token is being exchanged' },\n  { ref: OneOffSessionLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the one-off session exchange fails' },\n  { ref: OneOffSessionLabel.ERROR_NO_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the one-off session link carries no token' },\n  { ref: OneOffSessionLabel.ERROR_WRONG_TAB, kind: LabelKind.MESSAGE, purpose: 'Error shown when a one-off session link is opened in a tab that already has a regular session' },\n  { ref: OneOffSessionLabel.ERROR_GENERIC, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the one-off session exchange fails unexpectedly' },\n  { ref: OneOffSessionLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, PublicLayoutsOneOffSessionLabels);\n"]}
+{"version":3,"file":"Auth_OneOffSession.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,gCAAgC,GAA0B;IACrE,EAAE,GAAG,EAAE,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAChJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClI,EAAE,GAAG,EAAE,kBAAkB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE;IAC1I,EAAE,GAAG,EAAE,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+FAA+F,EAAE;IAC9K,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IACvJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;CAC1G,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OneOffSessionLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOneOffSessionLabels: LabellingUnitaryDef[] = [\n  { ref: OneOffSessionLabel.VERIFYING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the one-off session token is being exchanged' },\n  { ref: OneOffSessionLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the one-off session exchange fails' },\n  { ref: OneOffSessionLabel.ERROR_NO_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the one-off session link carries no token' },\n  { ref: OneOffSessionLabel.ERROR_WRONG_TAB, kind: LabelKind.MESSAGE, purpose: 'Error shown when a one-off session link is opened in a tab that already has a regular session' },\n  { ref: OneOffSessionLabel.ERROR_GENERIC, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the one-off session exchange fails unexpectedly' },\n  { ref: OneOffSessionLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, PublicLayoutsOneOffSessionLabels);\n"]}

package/dist/esm/components/auth/Auth_PasswordLost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_PasswordLost.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAiD,MAAM,OAAO,CAAC;AA4BtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAqFxH,MAAM,WAAW,gDAAgD;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,2CAA2C,GAAI,wBAGzD,gDAAgD,KAAG,KAAK,CAAC,GAAG,CAAC,OA+M/D,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,gDAAgD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5K"}
+{"version":3,"file":"Auth_PasswordLost.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAiD,MAAM,OAAO,CAAC;AA4BtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAqFxH,MAAM,WAAW,gDAAgD;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,2CAA2C,GAAI,wBAGzD,gDAAgD,KAAG,KAAK,CAAC,GAAG,CAAC,OA+M/D,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,gDAAgD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5K"}

package/dist/esm/components/auth/Auth_PasswordLost.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_PasswordLost.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACnG,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,SAAS,GAIV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAE9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mFAAmF,CAAC;AAClI,OAAO,EAAE,uBAAuB,EAAE,MAAM,+EAA+E,CAAC;AACxH,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,6EAA6E,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAEhG,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAE1H,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,4BAA4B,GAAa,GAAG,EAAE;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAEpG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,OAAO,GAAG,EAEzB,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,EACxD,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EACjD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAWF,MAAM,6BAA6B,GAAiD,CAAC,EACnF,UAAU,GACX,EAAE,EAAE;IACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,cAAc,GAAwB,YAAY,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAEnG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,+BAA+B,IAAC,KAAK,EAAE,UAAU,GAAI,EACtD,KAAC,SAAS,IAAC,IAAI,EAAC,aAAa,GAAG,EAChC,KAAC,SAAS,IAAC,IAAI,EAAC,iBAAiB,GAAG,EAEpC,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,GAAI,EAElF,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAC5C,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,EACnD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,EAC1D,UAAU,EACV,KAAK,GAC4C,EAAqB,EAAE;IACxE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC,sDAAsD;IACtD,MAAM,cAAc,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC5G,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,WAAwB,EAAE,EAAE;QAC/D,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;QACrC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEvB,gBAAgB;IAChB,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,cAAc,GAAwB,OAAO,CAAC,GAAG,EAAE;QACvD,OAAO,YAAY,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAChE,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;IAElC,uEAAuE;IACvE,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9C,OAAO,kCAAkC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE;YACpG,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;YACnD,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAER,4CAA4C;IAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,SAAG,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,kEAAkE;IAClE,qDAAqD;IACrD,kEAAkE;IAClE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,0FAA0F,YACvG,cAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YACzG,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,gBAAgB,GAAG,GACpE,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAW,EACjE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,IACtF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAAQ,GAC/D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,8CAA8C;IAC9C,kEAAkE;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAAkC,EAAE,EAAE;YACrE,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5C,iBAAiB,EAAE,CAAC;YAEpB,MAAM,YAAY,GAAG,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,iCAAiC,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClG,CAAC,CAAC;gBACH,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,wBAAwB,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrF,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,YAAY,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,YAAY,EAAE,CAAC;oBACjB,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,iBAAiB,GAAG,iCAAiC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;oBAClF,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;wBACvC,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,iBAAiB,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;qBACnF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAAW,EACzD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,IAChF,EAEN,KAAC,aAAa,IACZ,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,EACvD,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE;wBACN,MAAM,EAAE;4BACN,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC;4BAClD,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;yBAC3D;qBACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,KAAC,6BAA6B,IAAC,UAAU,EAAE,KAAK,GAAI,GAC1E,EAEF,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,mCAAmC;IACnC,kEAAkE;IAClE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,0FAA0F,YACvG,cAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YACzG,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sGAAsG,GAAG,GAC1J,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAW,EAC3D,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,IAChF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uCAAuC;IACvC,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAA6B,EAAE,EAAE;QAChE,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5C,iBAAiB,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClE,YAAY,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,YAAY,EAAE,CAAC;gBACjB,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAW,EACnD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAQ,IAC1E,EAEN,KAAC,aAAa,IACZ,MAAM,EAAE,6BAA6B,EACrC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAC5B,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;qBAC9C;iBACF,EACD,cAAc,EAAE,4BAA4B,GAC5C,EAEF,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAA2E;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CAAmD,qBAAqB,CAAC,iCAAiC,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IAClL,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import { FrontendComponentType, UserPasswordLostLabel } from '@wildo-ai/presets-components-models';\nimport {\n  PasswordResetCompleteFormDtoSchema,\n  PasswordResetRequestDtoSchema,\n  AuthUtils,\n  type PasswordPolicyRules,\n  type PasswordResetCompleteFormDto,\n  type PasswordResetRequestDto,\n} from '@wildo-ai/saas-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { useFormContext } from 'react-hook-form';\nimport { Navigate } from 'react-router-dom';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { type FormMethods } from '~wildo-frontend-lib/components/form/Form';\nimport { extractServerValidationErrors } from '~wildo-frontend-lib/components/form/validation-errors/form-error-extraction.utils';\nimport { useServerErrorInjection } from '~wildo-frontend-lib/components/form/validation-errors/useServerErrorInjection';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { DEFAULT_PASSWORD_POLICY, PasswordStrengthIndicator } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport {\n  extractPasswordPolicyErrorMessage,\n  resolvePasswordViolationsToLabels,\n} from '~wildo-frontend-lib/components/auth/utils/resolvePasswordViolationsToLabels';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\n\nimport { CorePresetNames } from '@wildo-ai/presets-components-models';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n// =============================================================================\n// SELF-SUFFICIENT FORM TEMPLATES\n// =============================================================================\n\n/**\n * Template for the email request form (Step 1a).\n * Reads root errors from `useFormContext()`, labels from `useI18n()`.\n */\nconst PasswordResetRequestTemplate: React.FC = () => {\n  const { formState } = useFormContext();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"email\" />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserPasswordLostLabel.SEND_RESET_PASSWORD_LINK)}\n        submittingLabel={t(UserPasswordLostLabel.SENDING)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Template for the password reset form (Step 2a).\n * Reads password policy from `useResolvedAuthConfig()`, root errors from RHF,\n * labels from `useI18n()`.\n */\ninterface PasswordResetCompleteTemplateProps {\n  resetEmail?: string;\n}\n\nconst PasswordResetCompleteTemplate: React.FC<PasswordResetCompleteTemplateProps> = ({\n  resetEmail,\n}) => {\n  const resolvedAuth = useResolvedAuthConfig();\n  const { formState } = useFormContext();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n  const passwordPolicy: PasswordPolicyRules = resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <CredentialUsernameAutofillField email={resetEmail} />\n      <FormField name=\"newPassword\" />\n      <FormField name=\"confirmPassword\" />\n\n      <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={t} />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserPasswordLostLabel.RESET_BUTTON)}\n        submittingLabel={t(UserPasswordLostLabel.RESETTING)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n// --- Contract ---\nexport interface PublicLayoutPreset_UserPasswordLost_DefaultProps {\n  resetToken?: string;\n  email?: string;\n}\n\nexport const PublicLayoutPreset_UserPasswordLost_Default = ({\n  resetToken,\n  email,\n}: PublicLayoutPreset_UserPasswordLost_DefaultProps): React.JSX.Element => {\n  const { auth } = useUserOrgs();\n  const resolvedAuth = useResolvedAuthConfig();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n  const loginPath = CommonRoutePaths.login;\n\n  // ─── Form methods ref for server error injection ───\n  const formMethodsRef = useRef<FormMethods | null>(null);\n  const { initAutoClearing, injectServerErrors, clearServerErrors } = useServerErrorInjection(formMethodsRef);\n  const handleFormReady = useCallback((formMethods: FormMethods) => {\n    formMethodsRef.current = formMethods;\n    initAutoClearing(formMethods);\n  }, [initAutoClearing]);\n\n  // ─── State ───\n  const [isLoading, setIsLoading] = useState(false);\n  const [emailSent, setEmailSent] = useState(false);\n  const [resetComplete, setResetComplete] = useState(false);\n\n  const passwordPolicy: PasswordPolicyRules = useMemo(() => {\n    return resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n  }, [resolvedAuth.passwordPolicy]);\n\n  // ─── Refined schema with i18n error message for password mismatch ───\n  const refinedResetPasswordSchema = useMemo(() => {\n    return PasswordResetCompleteFormDtoSchema.refine((data) => data.newPassword === data.confirmPassword, {\n      message: t(UserPasswordLostLabel.PASSWORD_MISMATCH),\n      path: ['confirmPassword'],\n    });\n  }, [t]);\n\n  // Redirect to home if already authenticated\n  if (auth.accessToken) {\n    return <Navigate to={CommonRoutePaths.home} replace />;\n  }\n\n  if (!isReady) return null;\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 2b: Reset Success — password has been updated\n  // ═══════════════════════════════════════════════════════════════\n  if (resetComplete) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-success/10 mb-element\">\n            <svg className=\"h-6 w-6 text-success\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M5 13l4 4L19 7\" />\n            </svg>\n          </div>\n          <Heading>{t(UserPasswordLostLabel.RESET_SUCCESS_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.RESET_SUCCESS_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.LOGIN_LINK)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 2a: Password Reset Form (token in URL)\n  // ═══════════════════════════════════════════════════════════════\n  if (resetToken) {\n    const handleResetSubmit = async (data: PasswordResetCompleteFormDto) => {\n      setIsLoading(true);\n      formMethodsRef.current?.clearErrors('root');\n      clearServerErrors();\n\n      const policyResult = AuthUtils.validatePasswordAgainstPolicy(data.newPassword, passwordPolicy);\n      if (!policyResult.valid) {\n        formMethodsRef.current?.setError('root', {\n          type: 'policy',\n          message: resolvePasswordViolationsToLabels(policyResult.violations, t, passwordPolicy).join('. '),\n        });\n        setIsLoading(false);\n        return;\n      }\n\n      try {\n        await getManualCallsHttpClient().completePasswordReset(resetToken, data.newPassword);\n        setResetComplete(true);\n      } catch (e: any) {\n        const serverErrors = extractServerValidationErrors(e);\n        if (serverErrors) {\n          injectServerErrors(serverErrors.validationErrors);\n        } else {\n          const passwordPolicyMsg = extractPasswordPolicyErrorMessage(e, t, passwordPolicy);\n          formMethodsRef.current?.setError('root', {\n            type: 'server',\n            message: passwordPolicyMsg ?? e?.message ?? t(UserPasswordLostLabel.INVALID_TOKEN),\n          });\n        }\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserPasswordLostLabel.RESET_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.RESET_SUB_TITLE)}</Text>\n        </div>\n\n        <AutomatedForm\n          schema={refinedResetPasswordSchema}\n          defaultValues={{ newPassword: '', confirmPassword: '' }}\n          onSubmit={handleResetSubmit}\n          onFormReady={handleFormReady}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={isLoading}\n          labels={{\n            fields: {\n              newPassword: t(UserPasswordLostLabel.NEW_PASSWORD),\n              confirmPassword: t(UserPasswordLostLabel.CONFIRM_PASSWORD),\n            },\n          }}\n          layoutTemplate={() => <PasswordResetCompleteTemplate resetEmail={email} />}\n        />\n\n        <div className=\"text-center mt-group\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 1b: Email Sent Confirmation\n  // ═══════════════════════════════════════════════════════════════\n  if (emailSent) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\">\n            <svg className=\"h-6 w-6 text-primary\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\" />\n            </svg>\n          </div>\n          <Heading>{t(UserPasswordLostLabel.SUCCESS_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.SUCCESS_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 1a: Request Reset — Email Input\n  // ═══════════════════════════════════════════════════════════════\n  const handleEmailSubmit = async (data: PasswordResetRequestDto) => {\n    setIsLoading(true);\n    formMethodsRef.current?.clearErrors('root');\n    clearServerErrors();\n\n    try {\n      await getManualCallsHttpClient().requestPasswordReset(data.email);\n      setEmailSent(true);\n    } catch (e: any) {\n      const serverErrors = extractServerValidationErrors(e);\n      if (serverErrors) {\n        injectServerErrors(serverErrors.validationErrors);\n      } else {\n        formMethodsRef.current?.setError('root', {\n          type: 'server',\n          message: e?.message || t(UserPasswordLostLabel.UNEXPECTED_ERROR),\n        });\n      }\n    } finally {\n      setIsLoading(false);\n    }\n  };\n\n  return (\n    <>\n      <div className=\"text-center space-y-item-xs mb-group\">\n        <Heading>{t(UserPasswordLostLabel.TITLE)}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.SUB_TITLE)}</Text>\n      </div>\n\n      <AutomatedForm\n        schema={PasswordResetRequestDtoSchema}\n        defaultValues={{ email: '' }}\n        onSubmit={handleEmailSubmit}\n        onFormReady={handleFormReady}\n        validationMode={ValidationMode.ON_BLUR}\n        disabled={isLoading}\n        labels={{\n          fields: {\n            email: t(UserPasswordLostLabel.EMAIL_ADDRESS),\n          },\n        }}\n        layoutTemplate={PasswordResetRequestTemplate}\n      />\n\n      <div className=\"text-center mt-group\">\n        <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n      </div>\n    </>\n  );\n};\n\nexport function Auth_PasswordLost({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_UserPasswordLost_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_UserPasswordLost_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, 'Auth_PasswordLost')(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_PasswordLost.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACnG,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,SAAS,GAIV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAE9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mFAAmF,CAAC;AAClI,OAAO,EAAE,uBAAuB,EAAE,MAAM,+EAA+E,CAAC;AACxH,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,6EAA6E,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAEhG,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAE1H,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,4BAA4B,GAAa,GAAG,EAAE;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAEpG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,OAAO,GAAG,EAEzB,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,EACxD,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EACjD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAWF,MAAM,6BAA6B,GAAiD,CAAC,EACnF,UAAU,GACX,EAAE,EAAE;IACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,cAAc,GAAwB,YAAY,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAEnG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,+BAA+B,IAAC,KAAK,EAAE,UAAU,GAAI,EACtD,KAAC,SAAS,IAAC,IAAI,EAAC,aAAa,GAAG,EAChC,KAAC,SAAS,IAAC,IAAI,EAAC,iBAAiB,GAAG,EAEpC,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,GAAI,EAElF,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAC5C,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,EACnD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,EAC1D,UAAU,EACV,KAAK,GAC4C,EAAqB,EAAE;IACxE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,iCAAiC;KACnE,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC,sDAAsD;IACtD,MAAM,cAAc,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC5G,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,WAAwB,EAAE,EAAE;QAC/D,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;QACrC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEvB,gBAAgB;IAChB,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,cAAc,GAAwB,OAAO,CAAC,GAAG,EAAE;QACvD,OAAO,YAAY,CAAC,cAAc,IAAI,uBAAuB,CAAC;IAChE,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;IAElC,uEAAuE;IACvE,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9C,OAAO,kCAAkC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE;YACpG,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;YACnD,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAER,4CAA4C;IAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,SAAG,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,kEAAkE;IAClE,qDAAqD;IACrD,kEAAkE;IAClE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,0FAA0F,YACvG,cAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YACzG,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,gBAAgB,GAAG,GACpE,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAW,EACjE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,IACtF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAAQ,GAC/D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,8CAA8C;IAC9C,kEAAkE;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAAkC,EAAE,EAAE;YACrE,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5C,iBAAiB,EAAE,CAAC;YAEpB,MAAM,YAAY,GAAG,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,iCAAiC,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClG,CAAC,CAAC;gBACH,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,wBAAwB,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrF,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,YAAY,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,YAAY,EAAE,CAAC;oBACjB,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,iBAAiB,GAAG,iCAAiC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;oBAClF,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;wBACvC,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,iBAAiB,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;qBACnF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAAW,EACzD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,IAChF,EAEN,KAAC,aAAa,IACZ,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,EACvD,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE;wBACN,MAAM,EAAE;4BACN,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC;4BAClD,eAAe,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;yBAC3D;qBACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,KAAC,6BAA6B,IAAC,UAAU,EAAE,KAAK,GAAI,GAC1E,EAEF,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,mCAAmC;IACnC,kEAAkE;IAClE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,0FAA0F,YACvG,cAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YACzG,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sGAAsG,GAAG,GAC1J,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAW,EAC3D,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,IAChF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uCAAuC;IACvC,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAA6B,EAAE,EAAE;QAChE,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5C,iBAAiB,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClE,YAAY,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,YAAY,EAAE,CAAC;gBACjB,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAW,EACnD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAQ,IAC1E,EAEN,KAAC,aAAa,IACZ,MAAM,EAAE,6BAA6B,EACrC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAC5B,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;qBAC9C;iBACF,EACD,cAAc,EAAE,4BAA4B,GAC5C,EAEF,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAClE,IACL,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAA2E;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CAAmD,qBAAqB,CAAC,iCAAiC,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IAClL,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import { FrontendComponentType, UserPasswordLostLabel } from '@wildo-ai/presets-components-models';\nimport {\n  PasswordResetCompleteFormDtoSchema,\n  PasswordResetRequestDtoSchema,\n  AuthUtils,\n  type PasswordPolicyRules,\n  type PasswordResetCompleteFormDto,\n  type PasswordResetRequestDto,\n} from '@wildo-ai/saas-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { useFormContext } from 'react-hook-form';\nimport { Navigate } from 'react-router-dom';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { type FormMethods } from '~wildo-frontend-lib/components/form/Form';\nimport { extractServerValidationErrors } from '~wildo-frontend-lib/components/form/validation-errors/form-error-extraction.utils';\nimport { useServerErrorInjection } from '~wildo-frontend-lib/components/form/validation-errors/useServerErrorInjection';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { DEFAULT_PASSWORD_POLICY, PasswordStrengthIndicator } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport {\n  extractPasswordPolicyErrorMessage,\n  resolvePasswordViolationsToLabels,\n} from '~wildo-frontend-lib/components/auth/utils/resolvePasswordViolationsToLabels';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\n\nimport { CorePresetNames } from '@wildo-ai/presets-components-models';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n// =============================================================================\n// SELF-SUFFICIENT FORM TEMPLATES\n// =============================================================================\n\n/**\n * Template for the email request form (Step 1a).\n * Reads root errors from `useFormContext()`, labels from `useI18n()`.\n */\nconst PasswordResetRequestTemplate: React.FC = () => {\n  const { formState } = useFormContext();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"email\" />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserPasswordLostLabel.SEND_RESET_PASSWORD_LINK)}\n        submittingLabel={t(UserPasswordLostLabel.SENDING)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Template for the password reset form (Step 2a).\n * Reads password policy from `useResolvedAuthConfig()`, root errors from RHF,\n * labels from `useI18n()`.\n */\ninterface PasswordResetCompleteTemplateProps {\n  resetEmail?: string;\n}\n\nconst PasswordResetCompleteTemplate: React.FC<PasswordResetCompleteTemplateProps> = ({\n  resetEmail,\n}) => {\n  const resolvedAuth = useResolvedAuthConfig();\n  const { formState } = useFormContext();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n  const passwordPolicy: PasswordPolicyRules = resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <CredentialUsernameAutofillField email={resetEmail} />\n      <FormField name=\"newPassword\" />\n      <FormField name=\"confirmPassword\" />\n\n      <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={t} />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserPasswordLostLabel.RESET_BUTTON)}\n        submittingLabel={t(UserPasswordLostLabel.RESETTING)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n// --- Contract ---\nexport interface PublicLayoutPreset_UserPasswordLost_DefaultProps {\n  resetToken?: string;\n  email?: string;\n}\n\nexport const PublicLayoutPreset_UserPasswordLost_Default = ({\n  resetToken,\n  email,\n}: PublicLayoutPreset_UserPasswordLost_DefaultProps): React.JSX.Element => {\n  const { auth } = useUserOrgs();\n  const resolvedAuth = useResolvedAuthConfig();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST,\n  });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, key);\n  const loginPath = CommonRoutePaths.login;\n\n  // ─── Form methods ref for server error injection ───\n  const formMethodsRef = useRef<FormMethods | null>(null);\n  const { initAutoClearing, injectServerErrors, clearServerErrors } = useServerErrorInjection(formMethodsRef);\n  const handleFormReady = useCallback((formMethods: FormMethods) => {\n    formMethodsRef.current = formMethods;\n    initAutoClearing(formMethods);\n  }, [initAutoClearing]);\n\n  // ─── State ───\n  const [isLoading, setIsLoading] = useState(false);\n  const [emailSent, setEmailSent] = useState(false);\n  const [resetComplete, setResetComplete] = useState(false);\n\n  const passwordPolicy: PasswordPolicyRules = useMemo(() => {\n    return resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n  }, [resolvedAuth.passwordPolicy]);\n\n  // ─── Refined schema with i18n error message for password mismatch ───\n  const refinedResetPasswordSchema = useMemo(() => {\n    return PasswordResetCompleteFormDtoSchema.refine((data) => data.newPassword === data.confirmPassword, {\n      message: t(UserPasswordLostLabel.PASSWORD_MISMATCH),\n      path: ['confirmPassword'],\n    });\n  }, [t]);\n\n  // Redirect to home if already authenticated\n  if (auth.accessToken) {\n    return <Navigate to={CommonRoutePaths.home} replace />;\n  }\n\n  if (!isReady) return null;\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 2b: Reset Success — password has been updated\n  // ═══════════════════════════════════════════════════════════════\n  if (resetComplete) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-success/10 mb-element\">\n            <svg className=\"h-6 w-6 text-success\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M5 13l4 4L19 7\" />\n            </svg>\n          </div>\n          <Heading>{t(UserPasswordLostLabel.RESET_SUCCESS_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.RESET_SUCCESS_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.LOGIN_LINK)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 2a: Password Reset Form (token in URL)\n  // ═══════════════════════════════════════════════════════════════\n  if (resetToken) {\n    const handleResetSubmit = async (data: PasswordResetCompleteFormDto) => {\n      setIsLoading(true);\n      formMethodsRef.current?.clearErrors('root');\n      clearServerErrors();\n\n      const policyResult = AuthUtils.validatePasswordAgainstPolicy(data.newPassword, passwordPolicy);\n      if (!policyResult.valid) {\n        formMethodsRef.current?.setError('root', {\n          type: 'policy',\n          message: resolvePasswordViolationsToLabels(policyResult.violations, t, passwordPolicy).join('. '),\n        });\n        setIsLoading(false);\n        return;\n      }\n\n      try {\n        await getManualCallsHttpClient().completePasswordReset(resetToken, data.newPassword);\n        setResetComplete(true);\n      } catch (e: any) {\n        const serverErrors = extractServerValidationErrors(e);\n        if (serverErrors) {\n          injectServerErrors(serverErrors.validationErrors);\n        } else {\n          const passwordPolicyMsg = extractPasswordPolicyErrorMessage(e, t, passwordPolicy);\n          formMethodsRef.current?.setError('root', {\n            type: 'server',\n            message: passwordPolicyMsg ?? e?.message ?? t(UserPasswordLostLabel.INVALID_TOKEN),\n          });\n        }\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserPasswordLostLabel.RESET_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.RESET_SUB_TITLE)}</Text>\n        </div>\n\n        <AutomatedForm\n          schema={refinedResetPasswordSchema}\n          defaultValues={{ newPassword: '', confirmPassword: '' }}\n          onSubmit={handleResetSubmit}\n          onFormReady={handleFormReady}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={isLoading}\n          labels={{\n            fields: {\n              newPassword: t(UserPasswordLostLabel.NEW_PASSWORD),\n              confirmPassword: t(UserPasswordLostLabel.CONFIRM_PASSWORD),\n            },\n          }}\n          layoutTemplate={() => <PasswordResetCompleteTemplate resetEmail={email} />}\n        />\n\n        <div className=\"text-center mt-group\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 1b: Email Sent Confirmation\n  // ═══════════════════════════════════════════════════════════════\n  if (emailSent) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\">\n            <svg className=\"h-6 w-6 text-primary\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\" />\n            </svg>\n          </div>\n          <Heading>{t(UserPasswordLostLabel.SUCCESS_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.SUCCESS_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Step 1a: Request Reset — Email Input\n  // ═══════════════════════════════════════════════════════════════\n  const handleEmailSubmit = async (data: PasswordResetRequestDto) => {\n    setIsLoading(true);\n    formMethodsRef.current?.clearErrors('root');\n    clearServerErrors();\n\n    try {\n      await getManualCallsHttpClient().requestPasswordReset(data.email);\n      setEmailSent(true);\n    } catch (e: any) {\n      const serverErrors = extractServerValidationErrors(e);\n      if (serverErrors) {\n        injectServerErrors(serverErrors.validationErrors);\n      } else {\n        formMethodsRef.current?.setError('root', {\n          type: 'server',\n          message: e?.message || t(UserPasswordLostLabel.UNEXPECTED_ERROR),\n        });\n      }\n    } finally {\n      setIsLoading(false);\n    }\n  };\n\n  return (\n    <>\n      <div className=\"text-center space-y-item-xs mb-group\">\n        <Heading>{t(UserPasswordLostLabel.TITLE)}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(UserPasswordLostLabel.SUB_TITLE)}</Text>\n      </div>\n\n      <AutomatedForm\n        schema={PasswordResetRequestDtoSchema}\n        defaultValues={{ email: '' }}\n        onSubmit={handleEmailSubmit}\n        onFormReady={handleFormReady}\n        validationMode={ValidationMode.ON_BLUR}\n        disabled={isLoading}\n        labels={{\n          fields: {\n            email: t(UserPasswordLostLabel.EMAIL_ADDRESS),\n          },\n        }}\n        layoutTemplate={PasswordResetRequestTemplate}\n      />\n\n      <div className=\"text-center mt-group\">\n        <Link href={loginPath}>{t(UserPasswordLostLabel.BACK_TO_LOGIN)}</Link>\n      </div>\n    </>\n  );\n};\n\nexport function Auth_PasswordLost({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_UserPasswordLost_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_UserPasswordLost_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, 'Auth_PasswordLost')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_PasswordLost.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_PasswordLost.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_PasswordLost.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAAkD,MAAM,qCAAqC,CAAC;AAMjK,eAAO,MAAM,mCAAmC,EAAE,mBAAmB,EAqCpE,CAAC"}
+{"version":3,"file":"Auth_PasswordLost.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_PasswordLost.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAAkD,MAAM,qCAAqC,CAAC;AAMjK,eAAO,MAAM,mCAAmC,EAAE,mBAAmB,EAqCpE,CAAC"}

package/dist/esm/components/auth/Auth_PasswordLost.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_PasswordLost.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_PasswordLost.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEjK,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,mCAAmC,GAA0B;IACxE,EAAE,GAAG,EAAE,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACtH,EAAE,GAAG,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACnI,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,8DAA8D,EAAE;IAC5I,EAAE,GAAG,EAAE,qBAAqB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,4CAA4C,EAAE;IACtI,EAAE,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACjI,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC5H,EAAE,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE;IACtJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,6DAA6D,EAAE;IAC3I,EAAE,GAAG,EAAE,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,mEAAmE,EAAE;IACjJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,iDAAiD,EAAE;IACvI,EAAE,GAAG,EAAE,qBAAqB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE;IACrH,EAAE,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACjI,EAAE,GAAG,EAAE,qBAAqB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,sCAAsC,EAAE;IACpH,EAAE,GAAG,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE;IACtI,EAAE,GAAG,EAAE,qBAAqB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACjI,EAAE,GAAG,EAAE,qBAAqB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAC5J,EAAE,GAAG,EAAE,qBAAqB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE;IAChI,EAAE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IAC1J,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kEAAkE,EAAE;IAClJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+DAA+D,EAAE;IAClJ;QACE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB;QAC5C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;KAClG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB;QAC5C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,qDAAqD;QAC9D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;KACjG;IACD,EAAE,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACrJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACrJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACvI,EAAE,GAAG,EAAE,qBAAqB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,+DAA+D,EAAE;CAC1J,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,mCAAmC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels, UserPasswordLostLabel } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsUserPasswordLostLabels: LabellingUnitaryDef[] = [\n  { ref: UserPasswordLostLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the request-password-reset screen' },\n  { ref: UserPasswordLostLabel.SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line explaining the reset-link request' },\n  { ref: UserPasswordLostLabel.EMAIL_ADDRESS, kind: LabelKind.LABEL, purpose: 'Field label for the email input that receives the reset link' },\n  { ref: UserPasswordLostLabel.SEND_RESET_PASSWORD_LINK, kind: LabelKind.BUTTON, purpose: 'Button that emails the password-reset link' },\n  { ref: UserPasswordLostLabel.SENDING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the reset link is being sent' },\n  { ref: UserPasswordLostLabel.SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the reset link was sent' },\n  { ref: UserPasswordLostLabel.SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body text telling the user to check their inbox for the reset link' },\n  { ref: UserPasswordLostLabel.BACK_TO_LOGIN, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen from the request-reset view' },\n  { ref: UserPasswordLostLabel.RESET_TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the set-new-password screen reached via the reset link' },\n  { ref: UserPasswordLostLabel.RESET_SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line for the set-new-password screen' },\n  { ref: UserPasswordLostLabel.NEW_PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the new-password input' },\n  { ref: UserPasswordLostLabel.CONFIRM_PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the confirm-new-password input' },\n  { ref: UserPasswordLostLabel.RESET_BUTTON, kind: LabelKind.BUTTON, purpose: 'Button that submits the new password' },\n  { ref: UserPasswordLostLabel.RESETTING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the new password is being saved' },\n  { ref: UserPasswordLostLabel.RESET_SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the password was reset' },\n  { ref: UserPasswordLostLabel.RESET_SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body text confirming the password was changed and inviting sign-in' },\n  { ref: UserPasswordLostLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link to the sign-in screen after a successful reset' },\n  { ref: UserPasswordLostLabel.PASSWORD_MISMATCH, kind: LabelKind.MESSAGE, purpose: 'Validation error when the new password and confirmation do not match' },\n  { ref: UserPasswordLostLabel.INVALID_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the reset token is missing, invalid, or expired' },\n  { ref: UserPasswordLostLabel.UNEXPECTED_ERROR, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the reset request fails unexpectedly' },\n  {\n    ref: UserPasswordLostLabel.POLICY_MIN_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the minimum required length',\n    params: [{ key: 'minLength', meaning: 'minimum number of characters the password must contain' }],\n  },\n  {\n    ref: UserPasswordLostLabel.POLICY_MAX_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the maximum allowed length',\n    params: [{ key: 'maxLength', meaning: 'maximum number of characters the password may contain' }],\n  },\n  { ref: UserPasswordLostLabel.POLICY_UPPERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one uppercase letter' },\n  { ref: UserPasswordLostLabel.POLICY_LOWERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one lowercase letter' },\n  { ref: UserPasswordLostLabel.POLICY_NUMBER, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one digit' },\n  { ref: UserPasswordLostLabel.POLICY_SPECIAL_CHAR, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one special character' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, PublicLayoutsUserPasswordLostLabels);\n"]}
+{"version":3,"file":"Auth_PasswordLost.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_PasswordLost.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEjK,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,mCAAmC,GAA0B;IACxE,EAAE,GAAG,EAAE,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACtH,EAAE,GAAG,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACnI,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,8DAA8D,EAAE;IAC5I,EAAE,GAAG,EAAE,qBAAqB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,4CAA4C,EAAE;IACtI,EAAE,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACjI,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC5H,EAAE,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE;IACtJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,6DAA6D,EAAE;IAC3I,EAAE,GAAG,EAAE,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,mEAAmE,EAAE;IACjJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,iDAAiD,EAAE;IACvI,EAAE,GAAG,EAAE,qBAAqB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE;IACrH,EAAE,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACjI,EAAE,GAAG,EAAE,qBAAqB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,sCAAsC,EAAE;IACpH,EAAE,GAAG,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE;IACtI,EAAE,GAAG,EAAE,qBAAqB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACjI,EAAE,GAAG,EAAE,qBAAqB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAC5J,EAAE,GAAG,EAAE,qBAAqB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE;IAChI,EAAE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IAC1J,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kEAAkE,EAAE;IAClJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+DAA+D,EAAE;IAClJ;QACE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB;QAC5C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;KAClG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB;QAC5C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,qDAAqD;QAC9D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;KACjG;IACD,EAAE,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACrJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACrJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACvI,EAAE,GAAG,EAAE,qBAAqB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,+DAA+D,EAAE;CAC1J,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,mCAAmC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels, UserPasswordLostLabel } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsUserPasswordLostLabels: LabellingUnitaryDef[] = [\n  { ref: UserPasswordLostLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the request-password-reset screen' },\n  { ref: UserPasswordLostLabel.SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line explaining the reset-link request' },\n  { ref: UserPasswordLostLabel.EMAIL_ADDRESS, kind: LabelKind.LABEL, purpose: 'Field label for the email input that receives the reset link' },\n  { ref: UserPasswordLostLabel.SEND_RESET_PASSWORD_LINK, kind: LabelKind.BUTTON, purpose: 'Button that emails the password-reset link' },\n  { ref: UserPasswordLostLabel.SENDING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the reset link is being sent' },\n  { ref: UserPasswordLostLabel.SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the reset link was sent' },\n  { ref: UserPasswordLostLabel.SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body text telling the user to check their inbox for the reset link' },\n  { ref: UserPasswordLostLabel.BACK_TO_LOGIN, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen from the request-reset view' },\n  { ref: UserPasswordLostLabel.RESET_TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the set-new-password screen reached via the reset link' },\n  { ref: UserPasswordLostLabel.RESET_SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line for the set-new-password screen' },\n  { ref: UserPasswordLostLabel.NEW_PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the new-password input' },\n  { ref: UserPasswordLostLabel.CONFIRM_PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the confirm-new-password input' },\n  { ref: UserPasswordLostLabel.RESET_BUTTON, kind: LabelKind.BUTTON, purpose: 'Button that submits the new password' },\n  { ref: UserPasswordLostLabel.RESETTING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the new password is being saved' },\n  { ref: UserPasswordLostLabel.RESET_SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the password was reset' },\n  { ref: UserPasswordLostLabel.RESET_SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body text confirming the password was changed and inviting sign-in' },\n  { ref: UserPasswordLostLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link to the sign-in screen after a successful reset' },\n  { ref: UserPasswordLostLabel.PASSWORD_MISMATCH, kind: LabelKind.MESSAGE, purpose: 'Validation error when the new password and confirmation do not match' },\n  { ref: UserPasswordLostLabel.INVALID_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the reset token is missing, invalid, or expired' },\n  { ref: UserPasswordLostLabel.UNEXPECTED_ERROR, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the reset request fails unexpectedly' },\n  {\n    ref: UserPasswordLostLabel.POLICY_MIN_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the minimum required length',\n    params: [{ key: 'minLength', meaning: 'minimum number of characters the password must contain' }],\n  },\n  {\n    ref: UserPasswordLostLabel.POLICY_MAX_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the maximum allowed length',\n    params: [{ key: 'maxLength', meaning: 'maximum number of characters the password may contain' }],\n  },\n  { ref: UserPasswordLostLabel.POLICY_UPPERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one uppercase letter' },\n  { ref: UserPasswordLostLabel.POLICY_LOWERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one lowercase letter' },\n  { ref: UserPasswordLostLabel.POLICY_NUMBER, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one digit' },\n  { ref: UserPasswordLostLabel.POLICY_SPECIAL_CHAR, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one special character' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_PASSWORD_LOST, PublicLayoutsUserPasswordLostLabels);\n"]}

package/dist/esm/components/auth/Auth_Register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Register.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Register.tsx"],"names":[],"mappings":"AAYA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAqCjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AA0DxH,MAAM,WAAW,4CAA4C;CAC5D;AAED,eAAO,MAAM,uCAAuC,GAAI,IAAI,4CAA4C,KAAG,KAAK,CAAC,GAAG,CAAC,OA2SpH,CAAC;AAyCF,wBAAgB,aAAa,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,4CAA4C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAoBpK"}
+{"version":3,"file":"Auth_Register.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_Register.tsx"],"names":[],"mappings":"AAYA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAqCjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AA0DxH,MAAM,WAAW,4CAA4C;CAC5D;AAED,eAAO,MAAM,uCAAuC,GAAI,IAAI,4CAA4C,KAAG,KAAK,CAAC,GAAG,CAAC,OA2SpH,CAAC;AAyCF,wBAAgB,aAAa,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,4CAA4C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAoBpK"}