@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.5

package/dist/esm/components/auth/Auth_OAuthConsent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthConsent.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthConsent.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAoDxH;;;;;GAKG;AACH,MAAM,WAAW,4CAA4C;IAC3D,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,oGAAoG;AACpG,eAAO,MAAM,uCAAuC,GAClD,QAAQ,4CAA4C,KACnD,KAAK,CAAC,GAAG,CAAC,OAoKZ,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,4CAA4C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAMzF"}
+{"version":3,"file":"Auth_OAuthConsent.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAoDxH;;;;;GAKG;AACH,MAAM,WAAW,4CAA4C;IAC3D,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,oGAAoG;AACpG,eAAO,MAAM,uCAAuC,GAClD,QAAQ,4CAA4C,KACnD,KAAK,CAAC,GAAG,CAAC,OAqKZ,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,4CAA4C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAMzF"}

package/dist/esm/components/auth/Auth_OAuthConsent.js

@@ -123,7 +123,8 @@ export const PublicLayoutPreset_OAuthConsent_Default = (_props) => {
             window.location.assign(redirect_to);
         }
         catch {
-            // Release the latch so the user can retry (the token is unconsumed on a transport failure).
+            // Release the local latch. A lost response may follow server-side token consumption;
+            // the error view does not retry this request token. A fresh flow obtains fresh state.
             submittingRef.current = false;
             setStatus('error');
             setErrorLabel(UserOAuthConsentLabel.ERROR_DECISION);

package/dist/esm/components/auth/Auth_OAuthConsent.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthConsent.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthConsent.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,+DAA+D,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EACL,wBAAwB,GAEzB,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AAEH,sGAAsG;AACtG,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG;IAC3B,eAAe;IACf,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,UAAU;IACV,OAAO;IACP,OAAO;CACC,CAAC;AAeX,oGAAoG;AACpG,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,MAAoD,EACjC,EAAE;IACrB,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,4BAA4B,EAAE,CAAC,CAAC;IAC3G,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,SAAS,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAClF,gGAAgG;IAChG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAA+B,IAAI,CAAC,CAAC;IACjF,oGAAoG;IACpG,oDAAoD;IACpD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAC;IAEtC,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,MAA+B,EAAU,EAAE,CACjE,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9E,kGAAkG;IAClG,4FAA4F;IAC5F,oGAAoG;IACpG,mGAAmG;IACnG,uFAAuF;IACvF,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,kGAAkG;IAClG,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,2DAA2D;IAC3D,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,yDAAyD;QACnF,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,wBAAwB,EAAE;aACvB,qBAAqB,CAAC,eAAe,CAAC;aACtC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjB,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,QAAQ,IAAI,kBAAkB,IAAI,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACtG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,QAAQ,IAAI,aAAa,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzE,6FAA6F;gBAC7F,gGAAgG;gBAChG,sFAAsF;gBACtF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnB,aAAa,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACrD,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,aAAa,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,QAA4B,EAAE,EAAE;QACrC,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC9C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAC3E,OAAO,CAAC,aAAa,EACrB,QAAQ;YACR,6EAA6E;YAC7E,QAAQ,KAAK,SAAS,IAAI,QAAQ,CACnC,CAAC;YACF,4FAA4F;YAC5F,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;YAC5F,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,aAAa,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,yFAAyF;IACzF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,QAAQ,EAAE,gBAAgB,CAAC,YAAY;YACvC,MAAM,EAAE,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,SAAG,CAAC;IAC5F,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,OAAO,CACL,cAAK,SAAS,EAAC,+BAA+B,YAC5C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CACL,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,UAAU,IAAI,qBAAqB,CAAC,aAAa,CAAC,GAAoB,GACrF,CACT,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAW,EACxF,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAQ,IAC1E,EAEL,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5B,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,IAAI,IAAC,SAAS,EAAC,aAAa,YAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAQ,EAC5E,aAAI,SAAS,EAAC,iBAAiB,YAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC7B,uBACE,KAAC,IAAI,cAAE,KAAK,GAAQ,IADb,KAAK,CAET,CACN,CAAC,GACC,IACD,CACP,EAEA,OAAO,CAAC,QAAQ,IAAI,CACnB,KAAC,IAAI,IAAC,SAAS,EAAC,mBAAmB,YAAE,CAAC,CAAC,qBAAqB,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAQ,CACrH,EAED,iBAAO,SAAS,EAAC,8CAA8C,aAC7D,KAAC,YAAY,IAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,CAAC,GAAI,EACpF,KAAC,IAAI,cAAE,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAQ,IAC1C,EAER,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAC,QAAQ,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAE5B,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,GACvB,EACT,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAC,QAAQ,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,YAE/B,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAC1B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EAC4D;IACpE,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,4BAA4B,EAClD,mBAAmB,CACpB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, UserOAuthConsentLabel } from '@wildo-ai/presets-components-models';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { CheckboxRoot } from '~wildo-frontend-lib/components/form/controls/boolean/checkbox';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport {\n  getManualCallsHttpClient,\n  type OAuthConsentRequiredResponse,\n} from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  buildAuthRedirectTarget,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\n\n/**\n * OIDC interactive-consent screen (S1) — the body rendered by {@link AuthPage_OAuthConsent}.\n *\n * FLOW (Bearer-authed SPA, NOT a server-rendered page — see the backend `handleConsentDecision`\n * JSDoc): a third-party client redirects the browser here with the OAuth authorize query. This\n * component forwards that query to `GET /oauth/authorize` (Bearer auto-attached) → the backend\n * returns `consent_required` + a single-use consent token + the requesting client / scopes / agent\n * resource. On Approve/Deny it POSTs `{consent_token, decision}` to `/oauth/authorize/decision`,\n * which returns `{ redirect_to }`; the app then `window.location.assign(redirect_to)` to complete the\n * OAuth redirect back to the client (carrying the `code` on approve, `error=access_denied` on deny).\n *\n * Copy is resolved through {@link UserOAuthConsentLabel} (component\n * `PUBLIC_LAYOUTS_OAUTH_CONSENT`) via {@link useI18n}; the label metadata lives in the\n * companion-scanned `Auth_OAuthConsent.labels.ts`.\n */\n\n// The authorize params this screen forwards verbatim to `GET /oauth/authorize`; the backend validates\n// them (client/redirect allowlist, PKCE). Anything else in the URL is ignored.\nconst AUTHORIZE_PARAM_KEYS = [\n  'response_type',\n  'client_id',\n  'redirect_uri',\n  'code_challenge',\n  'code_challenge_method',\n  'scope',\n  'resource',\n  'state',\n  'nonce',\n] as const;\n\ntype ConsentStatus = 'loading' | 'ready' | 'submitting' | 'error';\n\n/**\n * Props for the consent screen preset. The screen is self-driven from the authorize query\n * (`useSearchParams`) and the session (`useUserOrgs`), so it takes no external props — this interface\n * exists to satisfy the preset-wrapper contract (preset resolution + the frontend-component spec)\n * shared by every `PUBLIC_LAYOUTS` auth page.\n */\nexport interface PublicLayoutPreset_OAuthConsent_DefaultProps {\n  /** Reserved: the consent screen is URL/session-driven and currently accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/** Default preset implementation for {@link FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT}. */\nexport const PublicLayoutPreset_OAuthConsent_Default = (\n  _props: PublicLayoutPreset_OAuthConsent_DefaultProps,\n): React.JSX.Element => {\n  const { auth } = useUserOrgs();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConsentStatus>('loading');\n  const [consent, setConsent] = useState<OAuthConsentRequiredResponse | null>(null);\n  // The error is held as a label KEY (not resolved copy) so it stays i18n-clean and translatable.\n  const [errorLabel, setErrorLabel] = useState<UserOAuthConsentLabel | null>(null);\n  // Item 3 \"remember this app\" — opt-in (default off): on approve, stores a durable grant so a future\n  // authorize with covering scopes skips this screen.\n  const [remember, setRemember] = useState(false);\n\n  const accessToken = auth?.accessToken;\n\n  const t = (key: string, params?: Record<string, string>): string =>\n    tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT, key, params);\n\n  // Stale-closure-proof single-flight guard for the decision POST. The buttons already unmount when\n  // `status` flips to 'submitting' (see the render below) and the consent token is single-use\n  // server-side, but a synchronous double-dispatch could still fire two POSTs before React re-renders\n  // — a `status === 'submitting'` check would read the captured (stale) 'ready' in that window, so a\n  // ref (set synchronously at the top of `decide`) is the only reliable in-flight latch.\n  const submittingRef = useRef(false);\n\n  // The authorize query, filtered to the known OAuth params (verbatim pass-through to the backend).\n  const authorizeParams = useMemo(() => {\n    const params = new URLSearchParams();\n    for (const key of AUTHORIZE_PARAM_KEYS) {\n      const value = searchParams.get(key);\n      if (value) params.set(key, value);\n    }\n    return params;\n  }, [searchParams]);\n\n  // Load the consent request once the user is authenticated.\n  useEffect(() => {\n    if (!accessToken) return; // the Navigate guard below sends the user to login first\n    let cancelled = false;\n    setStatus('loading');\n    setErrorLabel(null);\n    getManualCallsHttpClient()\n      .oauthAuthorizeConsent(authorizeParams)\n      .then((response) => {\n        if (cancelled) return;\n        if (response && 'consent_required' in response && response.consent_required && response.consent_token) {\n          setConsent(response);\n          setStatus('ready');\n        } else if (response && 'redirect_to' in response && response.redirect_to) {\n          // Trusted (non-`requiresConsent`) client — the backend already minted the code; complete the\n          // OAuth redirect back to the client WITHOUT a consent screen. (`window.location.assign` because\n          // the redirect target is cross-origin; the XHR could not have followed a 302 itself.)\n          window.location.assign(response.redirect_to);\n        } else {\n          setStatus('error');\n          setErrorLabel(UserOAuthConsentLabel.ERROR_INVALID);\n        }\n      })\n      .catch(() => {\n        if (cancelled) return;\n        setStatus('error');\n        setErrorLabel(UserOAuthConsentLabel.ERROR_LOAD);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [accessToken, authorizeParams]);\n\n  const decide = useCallback(\n    async (decision: 'approve' | 'deny') => {\n      if (!consent || submittingRef.current) return;\n      submittingRef.current = true;\n      setStatus('submitting');\n      setErrorLabel(null);\n      try {\n        const { redirect_to } = await getManualCallsHttpClient().oauthConsentDecision(\n          consent.consent_token,\n          decision,\n          // Only an APPROVE meaningfully \"remembers\"; a deny sends `false` harmlessly.\n          decision === 'approve' && remember,\n        );\n        // Complete the OAuth redirect back to the third-party client (carries `code` or the error).\n        window.location.assign(redirect_to);\n      } catch {\n        // Release the latch so the user can retry (the token is unconsumed on a transport failure).\n        submittingRef.current = false;\n        setStatus('error');\n        setErrorLabel(UserOAuthConsentLabel.ERROR_DECISION);\n      }\n    },\n    [consent, remember],\n  );\n\n  // Not authenticated → send to login, returning to this exact consent request afterwards.\n  if (!accessToken) {\n    const target = buildAuthRedirectTarget({\n      pathname: CommonRoutePaths.oauthConsent,\n      search: `?${searchParams.toString()}`,\n    });\n    return <Navigate to={appendAuthRedirectToPath(CommonRoutePaths.login, target)} replace />;\n  }\n\n  if (status === 'loading' || status === 'submitting' || !isReady) {\n    return (\n      <div className=\"py-region flex justify-center\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  if (status === 'error' || !consent) {\n    return (\n      <Alert variant=\"destructive\">\n        <AlertDescription>{t(errorLabel ?? UserOAuthConsentLabel.ERROR_GENERIC)}</AlertDescription>\n      </Alert>\n    );\n  }\n\n  return (\n    <div className=\"space-y-group\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>{t(UserOAuthConsentLabel.TITLE, { clientName: consent.client.name })}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(UserOAuthConsentLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {consent.scopes.length > 0 && (\n        <div className=\"space-y-element\">\n          <Text className=\"font-medium\">{t(UserOAuthConsentLabel.SCOPES_INTRO)}</Text>\n          <ul className=\"space-y-item-xs\">\n            {consent.scopes.map((scope) => (\n              <li key={scope}>\n                <Text>{scope}</Text>\n              </li>\n            ))}\n          </ul>\n        </div>\n      )}\n\n      {consent.resource && (\n        <Text className=\"text-sm break-all\">{t(UserOAuthConsentLabel.AGENT_ENDPOINT, { resource: consent.resource })}</Text>\n      )}\n\n      <label className=\"flex items-center gap-item-xs cursor-pointer\">\n        <CheckboxRoot checked={remember} onCheckedChange={(c) => setRemember(c === true)} />\n        <Text>{t(UserOAuthConsentLabel.REMEMBER)}</Text>\n      </label>\n\n      <div className=\"flex gap-element\">\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          className=\"flex-1\"\n          onClick={() => decide('deny')}\n        >\n          {t(UserOAuthConsentLabel.DENY)}\n        </Button>\n        <Button\n          variant={ButtonVariants_Variant.DEFAULT}\n          className=\"flex-1\"\n          onClick={() => decide('approve')}\n        >\n          {t(UserOAuthConsentLabel.APPROVE)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\n/**\n * Preset-resolving wrapper for the OIDC consent screen (mirrors every other `PUBLIC_LAYOUTS` auth\n * page). Resolves `PUBLIC_LAYOUTS_OAUTH_CONSENT` to its registered preset (default =\n * {@link PublicLayoutPreset_OAuthConsent_Default}) so an application can swap in a branded consent UI\n * via the component registry. {@link AuthPage_OAuthConsent} renders this wrapper.\n */\nexport function Auth_OAuthConsent({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthConsent_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthConsent_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT,\n    'Auth_OAuthConsent',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OAuthConsent.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,+DAA+D,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EACL,wBAAwB,GAEzB,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AAEH,sGAAsG;AACtG,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG;IAC3B,eAAe;IACf,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,UAAU;IACV,OAAO;IACP,OAAO;CACC,CAAC;AAeX,oGAAoG;AACpG,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,MAAoD,EACjC,EAAE;IACrB,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,4BAA4B,EAAE,CAAC,CAAC;IAC3G,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,SAAS,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAClF,gGAAgG;IAChG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAA+B,IAAI,CAAC,CAAC;IACjF,oGAAoG;IACpG,oDAAoD;IACpD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAC;IAEtC,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,MAA+B,EAAU,EAAE,CACjE,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9E,kGAAkG;IAClG,4FAA4F;IAC5F,oGAAoG;IACpG,mGAAmG;IACnG,uFAAuF;IACvF,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,kGAAkG;IAClG,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,2DAA2D;IAC3D,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,yDAAyD;QACnF,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,wBAAwB,EAAE;aACvB,qBAAqB,CAAC,eAAe,CAAC;aACtC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjB,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,QAAQ,IAAI,kBAAkB,IAAI,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACtG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,QAAQ,IAAI,aAAa,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzE,6FAA6F;gBAC7F,gGAAgG;gBAChG,sFAAsF;gBACtF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnB,aAAa,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACrD,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,aAAa,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,QAA4B,EAAE,EAAE;QACrC,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC9C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAC3E,OAAO,CAAC,aAAa,EACrB,QAAQ;YACR,6EAA6E;YAC7E,QAAQ,KAAK,SAAS,IAAI,QAAQ,CACnC,CAAC;YACF,4FAA4F;YAC5F,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;YACrF,sFAAsF;YACtF,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,aAAa,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,yFAAyF;IACzF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,QAAQ,EAAE,gBAAgB,CAAC,YAAY;YACvC,MAAM,EAAE,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,SAAG,CAAC;IAC5F,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,OAAO,CACL,cAAK,SAAS,EAAC,+BAA+B,YAC5C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CACL,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,UAAU,IAAI,qBAAqB,CAAC,aAAa,CAAC,GAAoB,GACrF,CACT,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAW,EACxF,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAQ,IAC1E,EAEL,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5B,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,IAAI,IAAC,SAAS,EAAC,aAAa,YAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAQ,EAC5E,aAAI,SAAS,EAAC,iBAAiB,YAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC7B,uBACE,KAAC,IAAI,cAAE,KAAK,GAAQ,IADb,KAAK,CAET,CACN,CAAC,GACC,IACD,CACP,EAEA,OAAO,CAAC,QAAQ,IAAI,CACnB,KAAC,IAAI,IAAC,SAAS,EAAC,mBAAmB,YAAE,CAAC,CAAC,qBAAqB,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAQ,CACrH,EAED,iBAAO,SAAS,EAAC,8CAA8C,aAC7D,KAAC,YAAY,IAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,CAAC,GAAI,EACpF,KAAC,IAAI,cAAE,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAQ,IAC1C,EAER,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAC,QAAQ,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAE5B,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,GACvB,EACT,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAC,QAAQ,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,YAE/B,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAC1B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EAC4D;IACpE,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,4BAA4B,EAClD,mBAAmB,CACpB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, UserOAuthConsentLabel } from '@wildo-ai/presets-components-models';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { CheckboxRoot } from '~wildo-frontend-lib/components/form/controls/boolean/checkbox';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport {\n  getManualCallsHttpClient,\n  type OAuthConsentRequiredResponse,\n} from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  buildAuthRedirectTarget,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\n\n/**\n * OIDC interactive-consent screen (S1) — the body rendered by {@link AuthPage_OAuthConsent}.\n *\n * FLOW (Bearer-authed SPA, NOT a server-rendered page — see the backend `handleConsentDecision`\n * JSDoc): a third-party client redirects the browser here with the OAuth authorize query. This\n * component forwards that query to `GET /oauth/authorize` (Bearer auto-attached) → the backend\n * returns `consent_required` + a single-use consent token + the requesting client / scopes / agent\n * resource. On Approve/Deny it POSTs `{consent_token, decision}` to `/oauth/authorize/decision`,\n * which returns `{ redirect_to }`; the app then `window.location.assign(redirect_to)` to complete the\n * OAuth redirect back to the client (carrying the `code` on approve, `error=access_denied` on deny).\n *\n * Copy is resolved through {@link UserOAuthConsentLabel} (component\n * `PUBLIC_LAYOUTS_OAUTH_CONSENT`) via {@link useI18n}; the label metadata lives in the\n * companion-scanned `Auth_OAuthConsent.labels.ts`.\n */\n\n// The authorize params this screen forwards verbatim to `GET /oauth/authorize`; the backend validates\n// them (client/redirect allowlist, PKCE). Anything else in the URL is ignored.\nconst AUTHORIZE_PARAM_KEYS = [\n  'response_type',\n  'client_id',\n  'redirect_uri',\n  'code_challenge',\n  'code_challenge_method',\n  'scope',\n  'resource',\n  'state',\n  'nonce',\n] as const;\n\ntype ConsentStatus = 'loading' | 'ready' | 'submitting' | 'error';\n\n/**\n * Props for the consent screen preset. The screen is self-driven from the authorize query\n * (`useSearchParams`) and the session (`useUserOrgs`), so it takes no external props — this interface\n * exists to satisfy the preset-wrapper contract (preset resolution + the frontend-component spec)\n * shared by every `PUBLIC_LAYOUTS` auth page.\n */\nexport interface PublicLayoutPreset_OAuthConsent_DefaultProps {\n  /** Reserved: the consent screen is URL/session-driven and currently accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/** Default preset implementation for {@link FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT}. */\nexport const PublicLayoutPreset_OAuthConsent_Default = (\n  _props: PublicLayoutPreset_OAuthConsent_DefaultProps,\n): React.JSX.Element => {\n  const { auth } = useUserOrgs();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConsentStatus>('loading');\n  const [consent, setConsent] = useState<OAuthConsentRequiredResponse | null>(null);\n  // The error is held as a label KEY (not resolved copy) so it stays i18n-clean and translatable.\n  const [errorLabel, setErrorLabel] = useState<UserOAuthConsentLabel | null>(null);\n  // Item 3 \"remember this app\" — opt-in (default off): on approve, stores a durable grant so a future\n  // authorize with covering scopes skips this screen.\n  const [remember, setRemember] = useState(false);\n\n  const accessToken = auth?.accessToken;\n\n  const t = (key: string, params?: Record<string, string>): string =>\n    tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT, key, params);\n\n  // Stale-closure-proof single-flight guard for the decision POST. The buttons already unmount when\n  // `status` flips to 'submitting' (see the render below) and the consent token is single-use\n  // server-side, but a synchronous double-dispatch could still fire two POSTs before React re-renders\n  // — a `status === 'submitting'` check would read the captured (stale) 'ready' in that window, so a\n  // ref (set synchronously at the top of `decide`) is the only reliable in-flight latch.\n  const submittingRef = useRef(false);\n\n  // The authorize query, filtered to the known OAuth params (verbatim pass-through to the backend).\n  const authorizeParams = useMemo(() => {\n    const params = new URLSearchParams();\n    for (const key of AUTHORIZE_PARAM_KEYS) {\n      const value = searchParams.get(key);\n      if (value) params.set(key, value);\n    }\n    return params;\n  }, [searchParams]);\n\n  // Load the consent request once the user is authenticated.\n  useEffect(() => {\n    if (!accessToken) return; // the Navigate guard below sends the user to login first\n    let cancelled = false;\n    setStatus('loading');\n    setErrorLabel(null);\n    getManualCallsHttpClient()\n      .oauthAuthorizeConsent(authorizeParams)\n      .then((response) => {\n        if (cancelled) return;\n        if (response && 'consent_required' in response && response.consent_required && response.consent_token) {\n          setConsent(response);\n          setStatus('ready');\n        } else if (response && 'redirect_to' in response && response.redirect_to) {\n          // Trusted (non-`requiresConsent`) client — the backend already minted the code; complete the\n          // OAuth redirect back to the client WITHOUT a consent screen. (`window.location.assign` because\n          // the redirect target is cross-origin; the XHR could not have followed a 302 itself.)\n          window.location.assign(response.redirect_to);\n        } else {\n          setStatus('error');\n          setErrorLabel(UserOAuthConsentLabel.ERROR_INVALID);\n        }\n      })\n      .catch(() => {\n        if (cancelled) return;\n        setStatus('error');\n        setErrorLabel(UserOAuthConsentLabel.ERROR_LOAD);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [accessToken, authorizeParams]);\n\n  const decide = useCallback(\n    async (decision: 'approve' | 'deny') => {\n      if (!consent || submittingRef.current) return;\n      submittingRef.current = true;\n      setStatus('submitting');\n      setErrorLabel(null);\n      try {\n        const { redirect_to } = await getManualCallsHttpClient().oauthConsentDecision(\n          consent.consent_token,\n          decision,\n          // Only an APPROVE meaningfully \"remembers\"; a deny sends `false` harmlessly.\n          decision === 'approve' && remember,\n        );\n        // Complete the OAuth redirect back to the third-party client (carries `code` or the error).\n        window.location.assign(redirect_to);\n      } catch {\n        // Release the local latch. A lost response may follow server-side token consumption;\n        // the error view does not retry this request token. A fresh flow obtains fresh state.\n        submittingRef.current = false;\n        setStatus('error');\n        setErrorLabel(UserOAuthConsentLabel.ERROR_DECISION);\n      }\n    },\n    [consent, remember],\n  );\n\n  // Not authenticated → send to login, returning to this exact consent request afterwards.\n  if (!accessToken) {\n    const target = buildAuthRedirectTarget({\n      pathname: CommonRoutePaths.oauthConsent,\n      search: `?${searchParams.toString()}`,\n    });\n    return <Navigate to={appendAuthRedirectToPath(CommonRoutePaths.login, target)} replace />;\n  }\n\n  if (status === 'loading' || status === 'submitting' || !isReady) {\n    return (\n      <div className=\"py-region flex justify-center\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  if (status === 'error' || !consent) {\n    return (\n      <Alert variant=\"destructive\">\n        <AlertDescription>{t(errorLabel ?? UserOAuthConsentLabel.ERROR_GENERIC)}</AlertDescription>\n      </Alert>\n    );\n  }\n\n  return (\n    <div className=\"space-y-group\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>{t(UserOAuthConsentLabel.TITLE, { clientName: consent.client.name })}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(UserOAuthConsentLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {consent.scopes.length > 0 && (\n        <div className=\"space-y-element\">\n          <Text className=\"font-medium\">{t(UserOAuthConsentLabel.SCOPES_INTRO)}</Text>\n          <ul className=\"space-y-item-xs\">\n            {consent.scopes.map((scope) => (\n              <li key={scope}>\n                <Text>{scope}</Text>\n              </li>\n            ))}\n          </ul>\n        </div>\n      )}\n\n      {consent.resource && (\n        <Text className=\"text-sm break-all\">{t(UserOAuthConsentLabel.AGENT_ENDPOINT, { resource: consent.resource })}</Text>\n      )}\n\n      <label className=\"flex items-center gap-item-xs cursor-pointer\">\n        <CheckboxRoot checked={remember} onCheckedChange={(c) => setRemember(c === true)} />\n        <Text>{t(UserOAuthConsentLabel.REMEMBER)}</Text>\n      </label>\n\n      <div className=\"flex gap-element\">\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          className=\"flex-1\"\n          onClick={() => decide('deny')}\n        >\n          {t(UserOAuthConsentLabel.DENY)}\n        </Button>\n        <Button\n          variant={ButtonVariants_Variant.DEFAULT}\n          className=\"flex-1\"\n          onClick={() => decide('approve')}\n        >\n          {t(UserOAuthConsentLabel.APPROVE)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\n/**\n * Preset-resolving wrapper for the OIDC consent screen (mirrors every other `PUBLIC_LAYOUTS` auth\n * page). Resolves `PUBLIC_LAYOUTS_OAUTH_CONSENT` to its registered preset (default =\n * {@link PublicLayoutPreset_OAuthConsent_Default}) so an application can swap in a branded consent UI\n * via the component registry. {@link AuthPage_OAuthConsent} renders this wrapper.\n */\nexport function Auth_OAuthConsent({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthConsent_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthConsent_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT,\n    'Auth_OAuthConsent',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthConsent.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthConsent.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthConsent.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAQ7C,eAAO,MAAM,+BAA+B,EAAE,mBAAmB,EA0DhE,CAAC"}
+{"version":3,"file":"Auth_OAuthConsent.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAQ7C,eAAO,MAAM,+BAA+B,EAAE,mBAAmB,EA0DhE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthConsent.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthConsent.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthConsent.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,qCAAqC,CAAC;AAE7C,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,sCAAsC;AAEtC,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE;QACE,GAAG,EAAE,qBAAqB,CAAC,KAAK;QAChC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC;QACjI,OAAO,EAAE,4FAA4F;KACtG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,SAAS;QACpC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,+FAA+F;KACzG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,YAAY;QACvC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,cAAc;QACzC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC;QACnI,OAAO,EAAE,uEAAuE;KACjF;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,OAAO;QAClC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,IAAI;QAC/B,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,+CAA+C;KACzD;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,QAAQ;QACnC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EAAE,yIAAyI;KACnJ;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,aAAa;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,4FAA4F;KACtG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,UAAU;QACrC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6GAA6G;KACvH;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,cAAc;QACzC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,iHAAiH;KAC3H;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,aAAa;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,yEAAyE;KACnF;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  registerComponentLabels,\n  UserOAuthConsentLabel,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC interactive-consent screen: keys +\n// params + per-key purpose / kind. Statically scanned by the dev companion to\n// plan `components.PUBLIC_LAYOUTS_OAUTH_CONSENT.*` label generation; NOT imported\n// at runtime, so these description strings never ship in the browser bundle (see\n// `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthConsentLabels: LabellingUnitaryDef[] = [\n  {\n    ref: UserOAuthConsentLabel.TITLE,\n    kind: LabelKind.HEADING,\n    params: [{ key: 'clientName', meaning: 'display name of the third-party application requesting access (e.g. \"Acme Assistant\")' }],\n    purpose: 'Heading telling the user that a named third-party application wants to act on their behalf',\n  },\n  {\n    ref: UserOAuthConsentLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that approving delegates the user\\'s own access to the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.SCOPES_INTRO,\n    kind: LabelKind.LABEL,\n    purpose: 'Label introducing the list of scopes / permissions the application is requesting',\n  },\n  {\n    ref: UserOAuthConsentLabel.AGENT_ENDPOINT,\n    kind: LabelKind.LABEL,\n    params: [{ key: 'resource', meaning: 'the agent endpoint URL the delegated token will be bound to (RFC 8707 resource indicator)' }],\n    purpose: 'Shows the specific agent endpoint the delegated access is confined to',\n  },\n  {\n    ref: UserOAuthConsentLabel.APPROVE,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that grants the application delegated access on the user\\'s behalf',\n  },\n  {\n    ref: UserOAuthConsentLabel.DENY,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that refuses the authorization request',\n  },\n  {\n    ref: UserOAuthConsentLabel.REMEMBER,\n    kind: LabelKind.LABEL,\n    purpose: 'Checkbox label letting the user remember this application for these scopes so they are not asked to approve it again on future sign-ins',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_INVALID,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the authorization request payload is present but could not be interpreted',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_LOAD,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the authorization request is invalid or expired and must be restarted from the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_DECISION,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the approve/deny decision could not be recorded and the user should retry from the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_GENERIC,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Generic fallback error shown when the consent screen fails unexpectedly',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT, PublicLayoutsOAuthConsentLabels);\n"]}
+{"version":3,"file":"Auth_OAuthConsent.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,qCAAqC,CAAC;AAE7C,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,sCAAsC;AAEtC,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE;QACE,GAAG,EAAE,qBAAqB,CAAC,KAAK;QAChC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC;QACjI,OAAO,EAAE,4FAA4F;KACtG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,SAAS;QACpC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,+FAA+F;KACzG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,YAAY;QACvC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,cAAc;QACzC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC;QACnI,OAAO,EAAE,uEAAuE;KACjF;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,OAAO;QAClC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,IAAI;QAC/B,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,+CAA+C;KACzD;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,QAAQ;QACnC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EAAE,yIAAyI;KACnJ;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,aAAa;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,4FAA4F;KACtG;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,UAAU;QACrC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6GAA6G;KACvH;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,cAAc;QACzC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,iHAAiH;KAC3H;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,aAAa;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,yEAAyE;KACnF;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  registerComponentLabels,\n  UserOAuthConsentLabel,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC interactive-consent screen: keys +\n// params + per-key purpose / kind. Statically scanned by the dev companion to\n// plan `components.PUBLIC_LAYOUTS_OAUTH_CONSENT.*` label generation; NOT imported\n// at runtime, so these description strings never ship in the browser bundle (see\n// `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthConsentLabels: LabellingUnitaryDef[] = [\n  {\n    ref: UserOAuthConsentLabel.TITLE,\n    kind: LabelKind.HEADING,\n    params: [{ key: 'clientName', meaning: 'display name of the third-party application requesting access (e.g. \"Acme Assistant\")' }],\n    purpose: 'Heading telling the user that a named third-party application wants to act on their behalf',\n  },\n  {\n    ref: UserOAuthConsentLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that approving delegates the user\\'s own access to the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.SCOPES_INTRO,\n    kind: LabelKind.LABEL,\n    purpose: 'Label introducing the list of scopes / permissions the application is requesting',\n  },\n  {\n    ref: UserOAuthConsentLabel.AGENT_ENDPOINT,\n    kind: LabelKind.LABEL,\n    params: [{ key: 'resource', meaning: 'the agent endpoint URL the delegated token will be bound to (RFC 8707 resource indicator)' }],\n    purpose: 'Shows the specific agent endpoint the delegated access is confined to',\n  },\n  {\n    ref: UserOAuthConsentLabel.APPROVE,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that grants the application delegated access on the user\\'s behalf',\n  },\n  {\n    ref: UserOAuthConsentLabel.DENY,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that refuses the authorization request',\n  },\n  {\n    ref: UserOAuthConsentLabel.REMEMBER,\n    kind: LabelKind.LABEL,\n    purpose: 'Checkbox label letting the user remember this application for these scopes so they are not asked to approve it again on future sign-ins',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_INVALID,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the authorization request payload is present but could not be interpreted',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_LOAD,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the authorization request is invalid or expired and must be restarted from the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_DECISION,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Error shown when the approve/deny decision could not be recorded and the user should retry from the application',\n  },\n  {\n    ref: UserOAuthConsentLabel.ERROR_GENERIC,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Generic fallback error shown when the consent screen fails unexpectedly',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_CONSENT, PublicLayoutsOAuthConsentLabels);\n"]}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLoggedOut.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLoggedOut.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAGxH;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,eAAO,MAAM,yCAAyC,GAAI,QAAQ,8CAA8C,KAAG,KAAK,CAAC,GAAG,CAAC,OAyB5H,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,8CAA8C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAM5K"}
+{"version":3,"file":"Auth_OAuthLoggedOut.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAGxH;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,eAAO,MAAM,yCAAyC,GAAI,QAAQ,8CAA8C,KAAG,KAAK,CAAC,GAAG,CAAC,OAyB5H,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,8CAA8C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAM5K"}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLoggedOut.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLoggedOut.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAqB1H,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,MAAsD,EAAqB,EAAE;IACrI,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAE1G,2GAA2G;IAC3G,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAW,EACjD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAQ,IAC9F,EACN,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAChH,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,GAClC,IACL,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyE;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,+BAA+B,EACrD,qBAAqB,CACtB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React from 'react';\nimport { useNavigate } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLoggedOutLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout landing screen (§5) — the body rendered by {@link AuthPage_OAuthLoggedOut}.\n *\n * Shown after `GET /oauth/end-session` terminated the End-User's OP session when the request carried NO\n * valid `post_logout_redirect_uri` (a request WITH a registered one is redirected straight back to the\n * relying party instead — RP-Initiated Logout 1.0 §3). Purely informational: the session is already ended\n * server-side (revocation-C per-session fence) by the time the browser lands here, so this page only\n * confirms it and offers a route back to sign-in. No query params, no backend call, no state to drive.\n *\n * Copy is resolved through {@link OAuthLoggedOutLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT`) via\n * {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLoggedOut.labels.ts`.\n */\n\n// The screen is self-contained (no authorize query, no session), so it takes no external props; this\n// interface exists to satisfy the preset-wrapper contract shared by every `PUBLIC_LAYOUTS` auth page.\nexport interface PublicLayoutPreset_OAuthLoggedOut_DefaultProps {\n  readonly _selfDriven?: never;\n}\n\nexport const PublicLayoutPreset_OAuthLoggedOut_Default = (_props: PublicLayoutPreset_OAuthLoggedOut_DefaultProps): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT });\n  const navigate = useNavigate();\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, key);\n\n  // Component i18n sections load lazily; gate on `isReady` so the user never sees a flash of raw label keys.\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLoggedOutLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLoggedOutLabel.SUB_TITLE)}</Text>\n      </div>\n      <Button variant={ButtonVariants_Variant.DEFAULT} className=\"w-full\" onClick={() => navigate(CommonRoutePaths.login)}>\n        {t(OAuthLoggedOutLabel.RETURN_TO_SIGN_IN)}\n      </Button>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLoggedOut({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OAuthLoggedOut_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLoggedOut_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT,\n    'Auth_OAuthLoggedOut',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OAuthLoggedOut.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAqB1H,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,MAAsD,EAAqB,EAAE;IACrI,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAE1G,2GAA2G;IAC3G,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAW,EACjD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAQ,IAC9F,EACN,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAChH,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,GAClC,IACL,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyE;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,+BAA+B,EACrD,qBAAqB,CACtB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React from 'react';\nimport { useNavigate } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLoggedOutLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout landing screen (§5) — the body rendered by {@link AuthPage_OAuthLoggedOut}.\n *\n * Shown after `GET /oauth/end-session` terminated the End-User's OP session when the request carried NO\n * valid `post_logout_redirect_uri` (a request WITH a registered one is redirected straight back to the\n * relying party instead — RP-Initiated Logout 1.0 §3). Purely informational: the session is already ended\n * server-side (revocation-C per-session fence) by the time the browser lands here, so this page only\n * confirms it and offers a route back to sign-in. No query params, no backend call, no state to drive.\n *\n * Copy is resolved through {@link OAuthLoggedOutLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT`) via\n * {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLoggedOut.labels.ts`.\n */\n\n// The screen is self-contained (no authorize query, no session), so it takes no external props; this\n// interface exists to satisfy the preset-wrapper contract shared by every `PUBLIC_LAYOUTS` auth page.\nexport interface PublicLayoutPreset_OAuthLoggedOut_DefaultProps {\n  readonly _selfDriven?: never;\n}\n\nexport const PublicLayoutPreset_OAuthLoggedOut_Default = (_props: PublicLayoutPreset_OAuthLoggedOut_DefaultProps): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT });\n  const navigate = useNavigate();\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, key);\n\n  // Component i18n sections load lazily; gate on `isReady` so the user never sees a flash of raw label keys.\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLoggedOutLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLoggedOutLabel.SUB_TITLE)}</Text>\n      </div>\n      <Button variant={ButtonVariants_Variant.DEFAULT} className=\"w-full\" onClick={() => navigate(CommonRoutePaths.login)}>\n        {t(OAuthLoggedOutLabel.RETURN_TO_SIGN_IN)}\n      </Button>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLoggedOut({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OAuthLoggedOut_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLoggedOut_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT,\n    'Auth_OAuthLoggedOut',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLoggedOut.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,iCAAiC,EAAE,mBAAmB,EAgBlE,CAAC"}
+{"version":3,"file":"Auth_OAuthLoggedOut.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,iCAAiC,EAAE,mBAAmB,EAgBlE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLoggedOut.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,wFAAwF;AACxF,0EAA0E;AAC1E,4FAA4F;AAC5F,yGAAyG;AAEzG,MAAM,CAAC,MAAM,iCAAiC,GAA0B;IACtE;QACE,GAAG,EAAE,mBAAmB,CAAC,KAAK;QAC9B,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,SAAS;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,8HAA8H;KACxI;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,4EAA4E;KACtF;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLoggedOutLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout landing screen: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLoggedOutLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLoggedOutLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading confirming to the user that they have been signed out of the application',\n  },\n  {\n    ref: OAuthLoggedOutLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line reassuring the user their session has ended and it is safe to close this tab, or that they can sign in again',\n  },\n  {\n    ref: OAuthLoggedOutLabel.RETURN_TO_SIGN_IN,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that takes the user back to the sign-in page to start a new session',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, PublicLayoutsOAuthLoggedOutLabels);\n"]}
+{"version":3,"file":"Auth_OAuthLoggedOut.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,wFAAwF;AACxF,0EAA0E;AAC1E,4FAA4F;AAC5F,yGAAyG;AAEzG,MAAM,CAAC,MAAM,iCAAiC,GAA0B;IACtE;QACE,GAAG,EAAE,mBAAmB,CAAC,KAAK;QAC9B,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,SAAS;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,8HAA8H;KACxI;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,4EAA4E;KACtF;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLoggedOutLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout landing screen: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLoggedOutLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLoggedOutLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading confirming to the user that they have been signed out of the application',\n  },\n  {\n    ref: OAuthLoggedOutLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line reassuring the user their session has ended and it is safe to close this tab, or that they can sign in again',\n  },\n  {\n    ref: OAuthLoggedOutLabel.RETURN_TO_SIGN_IN,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that takes the user back to the sign-in page to start a new session',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, PublicLayoutsOAuthLoggedOutLabels);\n"]}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAiD,MAAM,OAAO,CAAC;AAWtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAGxH;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,kDAAkD;IACjE,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAgBD,eAAO,MAAM,6CAA6C,GACxD,QAAQ,kDAAkD,KACzD,KAAK,CAAC,GAAG,CAAC,OAuEZ,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,EACtC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,kDAAkD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAM/F"}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAiD,MAAM,OAAO,CAAC;AAWtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAGxH;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,kDAAkD;IACjE,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAgBD,eAAO,MAAM,6CAA6C,GACxD,QAAQ,kDAAkD,KACzD,KAAK,CAAC,GAAG,CAAC,OAuEZ,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,EACtC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,kDAAkD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAM/F"}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AA0B1H;;;;GAIG;AACH,IAAK,aAOJ;AAPD,WAAK,aAAa;IAChB,0CAA0C;IAC1C,gCAAe,CAAA;IACf,wGAAwG;IACxG,0CAAyB,CAAA;IACzB,uGAAuG;IACvG,gCAAe,CAAA;AACjB,CAAC,EAPI,aAAa,KAAb,aAAa,QAOjB;AAED,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAC3D,MAA0D,EACvC,EAAE;IACrB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAE9G,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,+FAA+F;IAC/F,yGAAyG;IACzG,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC5C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvF,mGAAmG;YACnG,qGAAqG;YACrG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kGAAkG;YAClG,6DAA6D;YAC7D,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,qGAAqG;QACrG,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,8GAA8G;IAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,cAAc,EAAE,OAAO,SAAG,CAAC;IACnE,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAQ,IAClG,EAEL,MAAM,KAAK,aAAa,CAAC,KAAK,IAAI,CACjC,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAoB,GACjE,CACT,EAED,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,YAC/H,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAC3B,EACT,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,YAChI,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAC5B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EACtC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EACkE;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,mCAAmC,EACzD,yBAAyB,CAC1B,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLogoutConfirmLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout §6 confirmation prompt — the body rendered by {@link AuthPage_OAuthLogoutConfirm}.\n *\n * FLOW: `GET /oauth/end-session` redirects the browser here (with a single-use `token` query param) for a\n * NON-trusted logout — everything EXCEPT a trusted RP presenting a valid `id_token_hint` AND an exact-match\n * registered `post_logout_redirect_uri`, which is logged out directly without a prompt (the Keycloak-style\n * posture). This page asks the End-User to confirm BEFORE the session is terminated, mitigating BROWSER-based\n * logout CSRF (RP-Initiated Logout 1.0 §6; a cross-origin page cannot read the token to complete the confirm —\n * see the backend `handleEndSessionConfirm` threat model). On CONFIRM it POSTs the token to `POST /oauth/end-session/confirm`,\n * which terminates the session and returns `{ redirect_to }` (the signed-out page `/oauth/logged-out`); on\n * CANCEL nothing is terminated and the user returns to the app.\n *\n * Token-driven, not session-driven: the End-User may be unauthenticated in this SPA (they arrived via an RP\n * redirect), so this page never gates on a Bearer — the opaque `token` is the whole credential.\n *\n * Copy is resolved through {@link OAuthLogoutConfirmLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM`)\n * via {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLogoutConfirm.labels.ts`.\n */\n\nexport interface PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps {\n  /** Reserved: the confirm screen is driven by the `token` query param and accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/**\n * The prompt's local interaction state. A named runtime source rather than a literal union so each\n * member can carry WHY it exists — `ERROR` in particular is reached only by a stale/expired token,\n * which is a normal outcome here (the token is single-use and short-TTL), not a fault.\n */\nenum ConfirmStatus {\n  /** Waiting for the End-User to decide. */\n  READY = 'ready',\n  /** The confirm POST is in flight; both buttons are disabled to keep the single-use token single-use. */\n  SUBMITTING = 'submitting',\n  /** The confirmation token was stale, expired or already used — the user may start the logout again. */\n  ERROR = 'error',\n}\n\nexport const PublicLayoutPreset_OAuthLogoutConfirm_Default = (\n  _props: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps,\n): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConfirmStatus>(ConfirmStatus.READY);\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, key);\n\n  const token = useMemo(() => searchParams.get('token') ?? '', [searchParams]);\n\n  // Stale-closure-proof single-flight latch for the confirm POST (mirrors the consent screen): a\n  // synchronous double-dispatch could fire two POSTs before React re-renders, and the token is single-use.\n  const submittingRef = useRef(false);\n\n  const confirm = useCallback(async () => {\n    if (!token || submittingRef.current) return;\n    submittingRef.current = true;\n    setStatus(ConfirmStatus.SUBMITTING);\n    try {\n      const { redirect_to } = await getManualCallsHttpClient().oauthEndSessionConfirm(token);\n      // Full navigation to the signed-out page (`window.location.assign`, mirroring the consent screen):\n      // the session is ending, so re-booting the SPA there is desirable — it drops any stale client state.\n      window.location.assign(redirect_to);\n    } catch {\n      // The token is single-use + short-TTL; a failure means it is stale/expired. Release the latch and\n      // surface a retry-able error rather than stranding the user.\n      submittingRef.current = false;\n      setStatus(ConfirmStatus.ERROR);\n    }\n  }, [token]);\n\n  const cancel = useCallback(() => {\n    // Cancel = do NOT sign out. Return to the app home (the user keeps their session). A full navigation\n    // avoids leaving the single-use `token` in the SPA's in-memory history entry.\n    window.location.assign(CommonRoutePaths.home);\n  }, []);\n\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  // Reached without a token (bad link / direct hit) — there is nothing to confirm; send to the signed-out page.\n  if (!token) {\n    return <Navigate to={CommonRoutePaths.oauthLoggedOut} replace />;\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLogoutConfirmLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLogoutConfirmLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {status === ConfirmStatus.ERROR && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{t(OAuthLogoutConfirmLabel.ERROR)}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"flex gap-element\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={cancel}>\n          {t(OAuthLogoutConfirmLabel.CANCEL)}\n        </Button>\n        <Button variant={ButtonVariants_Variant.DEFAULT} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={confirm}>\n          {t(OAuthLogoutConfirmLabel.CONFIRM)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLogoutConfirm({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM,\n    'Auth_OAuthLogoutConfirm',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AA0B1H;;;;GAIG;AACH,IAAK,aAOJ;AAPD,WAAK,aAAa;IAChB,0CAA0C;IAC1C,gCAAe,CAAA;IACf,wGAAwG;IACxG,0CAAyB,CAAA;IACzB,uGAAuG;IACvG,gCAAe,CAAA;AACjB,CAAC,EAPI,aAAa,KAAb,aAAa,QAOjB;AAED,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAC3D,MAA0D,EACvC,EAAE;IACrB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAE9G,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,+FAA+F;IAC/F,yGAAyG;IACzG,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC5C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvF,mGAAmG;YACnG,qGAAqG;YACrG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kGAAkG;YAClG,6DAA6D;YAC7D,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,qGAAqG;QACrG,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,8GAA8G;IAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,cAAc,EAAE,OAAO,SAAG,CAAC;IACnE,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAQ,IAClG,EAEL,MAAM,KAAK,aAAa,CAAC,KAAK,IAAI,CACjC,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAoB,GACjE,CACT,EAED,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,YAC/H,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAC3B,EACT,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,YAChI,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAC5B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EACtC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EACkE;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,mCAAmC,EACzD,yBAAyB,CAC1B,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLogoutConfirmLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout §6 confirmation prompt — the body rendered by {@link AuthPage_OAuthLogoutConfirm}.\n *\n * FLOW: `GET /oauth/end-session` redirects the browser here (with a single-use `token` query param) for a\n * NON-trusted logout — everything EXCEPT a trusted RP presenting a valid `id_token_hint` AND an exact-match\n * registered `post_logout_redirect_uri`, which is logged out directly without a prompt (the Keycloak-style\n * posture). This page asks the End-User to confirm BEFORE the session is terminated, mitigating BROWSER-based\n * logout CSRF (RP-Initiated Logout 1.0 §6; a cross-origin page cannot read the token to complete the confirm —\n * see the backend `handleEndSessionConfirm` threat model). On CONFIRM it POSTs the token to `POST /oauth/end-session/confirm`,\n * which terminates the session and returns `{ redirect_to }` (the signed-out page `/oauth/logged-out`); on\n * CANCEL nothing is terminated and the user returns to the app.\n *\n * Token-driven, not session-driven: the End-User may be unauthenticated in this SPA (they arrived via an RP\n * redirect), so this page never gates on a Bearer — the opaque `token` is the whole credential.\n *\n * Copy is resolved through {@link OAuthLogoutConfirmLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM`)\n * via {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLogoutConfirm.labels.ts`.\n */\n\nexport interface PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps {\n  /** Reserved: the confirm screen is driven by the `token` query param and accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/**\n * The prompt's local interaction state. A named runtime source rather than a literal union so each\n * member can carry WHY it exists — `ERROR` in particular is reached only by a stale/expired token,\n * which is a normal outcome here (the token is single-use and short-TTL), not a fault.\n */\nenum ConfirmStatus {\n  /** Waiting for the End-User to decide. */\n  READY = 'ready',\n  /** The confirm POST is in flight; both buttons are disabled to keep the single-use token single-use. */\n  SUBMITTING = 'submitting',\n  /** The confirmation token was stale, expired or already used — the user may start the logout again. */\n  ERROR = 'error',\n}\n\nexport const PublicLayoutPreset_OAuthLogoutConfirm_Default = (\n  _props: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps,\n): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConfirmStatus>(ConfirmStatus.READY);\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, key);\n\n  const token = useMemo(() => searchParams.get('token') ?? '', [searchParams]);\n\n  // Stale-closure-proof single-flight latch for the confirm POST (mirrors the consent screen): a\n  // synchronous double-dispatch could fire two POSTs before React re-renders, and the token is single-use.\n  const submittingRef = useRef(false);\n\n  const confirm = useCallback(async () => {\n    if (!token || submittingRef.current) return;\n    submittingRef.current = true;\n    setStatus(ConfirmStatus.SUBMITTING);\n    try {\n      const { redirect_to } = await getManualCallsHttpClient().oauthEndSessionConfirm(token);\n      // Full navigation to the signed-out page (`window.location.assign`, mirroring the consent screen):\n      // the session is ending, so re-booting the SPA there is desirable — it drops any stale client state.\n      window.location.assign(redirect_to);\n    } catch {\n      // The token is single-use + short-TTL; a failure means it is stale/expired. Release the latch and\n      // surface a retry-able error rather than stranding the user.\n      submittingRef.current = false;\n      setStatus(ConfirmStatus.ERROR);\n    }\n  }, [token]);\n\n  const cancel = useCallback(() => {\n    // Cancel = do NOT sign out. Return to the app home (the user keeps their session). A full navigation\n    // avoids leaving the single-use `token` in the SPA's in-memory history entry.\n    window.location.assign(CommonRoutePaths.home);\n  }, []);\n\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  // Reached without a token (bad link / direct hit) — there is nothing to confirm; send to the signed-out page.\n  if (!token) {\n    return <Navigate to={CommonRoutePaths.oauthLoggedOut} replace />;\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLogoutConfirmLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLogoutConfirmLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {status === ConfirmStatus.ERROR && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{t(OAuthLogoutConfirmLabel.ERROR)}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"flex gap-element\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={cancel}>\n          {t(OAuthLogoutConfirmLabel.CANCEL)}\n        </Button>\n        <Button variant={ButtonVariants_Variant.DEFAULT} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={confirm}>\n          {t(OAuthLogoutConfirmLabel.CONFIRM)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLogoutConfirm({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM,\n    'Auth_OAuthLogoutConfirm',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,qCAAqC,EAAE,mBAAmB,EA0BtE,CAAC"}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,qCAAqC,EAAE,mBAAmB,EA0BtE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,gGAAgG;AAChG,0EAA0E;AAC1E,gGAAgG;AAChG,yGAAyG;AAEzG,MAAM,CAAC,MAAM,qCAAqC,GAA0B;IAC1E;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,SAAS;QACtC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,uFAAuF;KACjG;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,OAAO;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,MAAM;QACnC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,4HAA4H;KACtI;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLogoutConfirmLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout §6 confirmation prompt: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLogoutConfirmLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLogoutConfirmLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading asking the user to confirm they want to sign out of the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that confirming will end their session on this application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CONFIRM,\n    kind: LabelKind.BUTTON,\n    purpose: 'Primary button that confirms the sign-out and ends the session',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CANCEL,\n    kind: LabelKind.BUTTON,\n    purpose: 'Secondary button that cancels the sign-out and returns the user to the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.ERROR,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Message shown when the confirmation link has expired or could not be processed, inviting the user to try signing out again',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, PublicLayoutsOAuthLogoutConfirmLabels);\n"]}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,gGAAgG;AAChG,0EAA0E;AAC1E,gGAAgG;AAChG,yGAAyG;AAEzG,MAAM,CAAC,MAAM,qCAAqC,GAA0B;IAC1E;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,SAAS;QACtC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,uFAAuF;KACjG;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,OAAO;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,MAAM;QACnC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,4HAA4H;KACtI;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLogoutConfirmLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout §6 confirmation prompt: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLogoutConfirmLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLogoutConfirmLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading asking the user to confirm they want to sign out of the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that confirming will end their session on this application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CONFIRM,\n    kind: LabelKind.BUTTON,\n    purpose: 'Primary button that confirms the sign-out and ends the session',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CANCEL,\n    kind: LabelKind.BUTTON,\n    purpose: 'Secondary button that cancels the sign-out and returns the user to the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.ERROR,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Message shown when the confirmation link has expired or could not be processed, inviting the user to try signing out again',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, PublicLayoutsOAuthLogoutConfirmLabels);\n"]}

package/dist/esm/components/auth/Auth_OneOffSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAepE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAQxH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC;AAEjF,MAAM,WAAW,6CAA6C;IAC5D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAmGD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wCAAwC,GAAI,qCAItD,6CAA6C,KAAG,KAAK,CAAC,GAAG,CAAC,OAgO5D,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,6CAA6C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG1K"}
+{"version":3,"file":"Auth_OneOffSession.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAgBpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAQxH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC;AAEjF,MAAM,WAAW,6CAA6C;IAC5D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAmGD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wCAAwC,GAAI,qCAItD,6CAA6C,KAAG,KAAK,CAAC,GAAG,CAAC,OAiO5D,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,6CAA6C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG1K"}

package/dist/esm/components/auth/Auth_OneOffSession.js

@@ -4,13 +4,14 @@ import { Navigate } from 'react-router-dom';
 import { isOperationAddressable } from '../../core/resources/resources.frontend.schemas.js';
 import { useAuthSession } from '../../core/security/useAuthSession.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
+import { useUserFacingErrorMessage } from '../../core/errors/useUserFacingErrorMessage.js';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
 import { EphemeralSessionTokenStorage } from '../../core/security/session-token-storage.frontend.service.js';
 import { NavigationUtils } from '../../core/navigation/navigation.utils.js';
 import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
 import { Heading } from '../../components/typography/heading.js';
 import { Text } from '../../components/typography/text.js';
-import { Link } from '../../components/typography/link.js';
+import { AuthSecondaryLink } from '../../components/auth/utils/AuthSecondaryLink.js';
 import { Alert, AlertDescription } from '../../components/overlays/containers/alert.js';
 import { createComponentResolver } from '../../core/components-registry/component-resolver.frontend.helper.js';
 import { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';
@@ -127,6 +128,7 @@ export const PublicLayoutPreset_OneOffSession_Default = ({ token, mode = 'one-of
     const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();
     const { registry } = useResourceRegistry();
     const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
     const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);
     const loginPath = CommonRoutePaths.login;
     /**
@@ -256,7 +258,7 @@ export const PublicLayoutPreset_OneOffSession_Default = ({ token, mode = 'one-of
             : handleOneOffTokenExchange(token);
         exchange
             .catch((e) => {
-            setError(e?.message || t(OneOffSessionLabel.ERROR_GENERIC));
+            setError(toUserFacingErrorMessage(e, t(OneOffSessionLabel.ERROR_GENERIC)));
         })
             .finally(() => {
             setExchangePhaseResolved(true);
@@ -301,7 +303,7 @@ export const PublicLayoutPreset_OneOffSession_Default = ({ token, mode = 'one-of
     if (!isReady)
         return null;
     if (error) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx("div", { className: "mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element", children: _jsx("svg", { className: "h-6 w-6 text-destructive", fill: "none", viewBox: "0 0 24 24", stroke: "currentColor", strokeWidth: "2", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M6 18L18 6M6 6l12 12" }) }) }), _jsx(Heading, { children: t(OneOffSessionLabel.ERROR_TITLE) })] }), _jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) }), _jsx("div", { className: "text-center mt-group", children: _jsx(Link, { href: loginPath, children: t(OneOffSessionLabel.LOGIN_LINK) }) })] }));
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx("div", { className: "mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element", children: _jsx("svg", { className: "h-6 w-6 text-destructive", fill: "none", viewBox: "0 0 24 24", stroke: "currentColor", strokeWidth: "2", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M6 18L18 6M6 6l12 12" }) }) }), _jsx(Heading, { children: t(OneOffSessionLabel.ERROR_TITLE) })] }), _jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) }), _jsx("div", { className: "text-center mt-group", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(OneOffSessionLabel.LOGIN_LINK) }) })] }));
     }
     return (_jsxs("div", { role: "status", "aria-live": "polite", className: "text-center space-y-item-xs", children: [_jsx("div", { className: "mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element", "aria-hidden": "true", children: _jsx(LoadingSpinner, { size: 24, className: "text-primary" }) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(OneOffSessionLabel.VERIFYING) })] }));
 };

package/dist/esm/components/auth/Auth_OneOffSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAwDzF;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,YAAgD,EAChD,QAAkM;IAElM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,IAAI,aAA2D,CAAC;IAChE,IAAI,gBAAqE,CAAC;IAE1E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,SAAS,GAAI,EAAU,CAAC,mBAAmB,CAAC;YAClD,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAChG,aAAa,GAAG,EAAE,CAAC;gBACnB,gBAAgB,GAAG,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAE1D,0EAA0E;IAC1E,gFAAgF;IAChF,gCAAgC;IAChC,MAAM,2BAA2B,GAA2B,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAC/C,aAAa,EACb,gBAAgB,EAChB,2BAA2B,EAC3B,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IAEF,OAAO,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACvC,sFAAsF;IACtF,mFAAmF;IACnF,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,EACvD,KAAK,EACL,IAAI,GAAG,iBAAiB,EACxB,iBAAiB,GAC6B,EAAqB,EAAE;IACrE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,CAAC;IACrI,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAE7G,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAChE,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACxD,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAEpD,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC;YACjE,MAAM,SAAS,GAAG,WAAW,IAAI,iBAAiB,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,qEAAqE;QACrE,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,EAC5B,IAAI,CAAC,aAAa,CAAC,kBAAkB,EACrC,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAC3C,CAAC,EAAE;QACD,IAAI;QACJ,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,2BAA2B;QAChC,iBAAiB;QACjB,QAAQ;KACT,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,oBAAoB,CAAC,OAAO;YAAE,OAAO;QAEzC,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,YAAY,4BAA4B,CAAC,EAAE,CAAC;YAC1F,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;YAChD,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,sDAAsD;QACtD,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,6BAA6B;QAC7B,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACnD,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,KAAK,wBAAwB;YAChD,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAErC,QAAQ;aACL,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;YAChB,QAAQ,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAExJ,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,iEAAiE;IACjE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,qCAAqC;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACtC,gCAAgC,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAE7C,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,8FAA8F,YAC3G,cAAK,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YAC7G,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sBAAsB,GAAG,GAC1E,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAW,IAClD,EACN,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,EACR,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAQ,GAC5D,IACL,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,EAAC,SAAS,EAAC,6BAA6B,aAC3E,cAAK,SAAS,EAAC,0FAA0F,iBAAa,MAAM,YAC1H,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,GAAG,GACjD,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAQ,IACvE,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAwE;IACrJ,MAAM,SAAS,GAAG,uBAAuB,CAAgD,qBAAqB,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate } from 'react-router-dom';\nimport type { AnyFrontendResourceConfiguration, FrontendResourceConfiguration_Operation } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { isOperationAddressable } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { EphemeralSessionTokenStorage } from '~wildo-frontend-lib/core/security/session-token-storage.frontend.service';\nimport { NavigationUtils } from '~wildo-frontend-lib/core/navigation/navigation.utils';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\n\n// --- Contract ---\n\n/**\n * Receiver mode for `Auth_OneOffSession` (cross-app-jwt-propagation.md Step 5).\n *\n * Two distinct issuance flows land on this same UI shell; the mode prop\n * dispatches to the right exchange handler and the right post-exchange\n * URL-resolution strategy:\n *\n * - `'one-off-session'` — W7.3b ephemeral one-off session. The token is\n *   consumed via `handleOneOffTokenExchange` (`POST /auth/one-off-session/exchange`),\n *   which returns a context populated with `tokenType`, `scopedInitiatorIds`,\n *   and `applicationId`. Post-exchange URL resolves via the resource\n *   registry (matches an operation whose `tokenAuthentication.types` accepts\n *   the consumed `tokenType`). Enforces `EphemeralSessionTokenStorage` to\n *   prevent stomping a parent tab's authenticated session.\n *\n * - `'cross-frontend-handoff'` — Cross-app JWT propagation handoff. The\n *   token is an AUTH_CODE_EXCHANGE consumable issued by\n *   `POST /auth/cross-frontend-handoff` and consumed via\n *   `handleAuthCodeExchange` (`POST /auth/token/exchange`, the same exchange\n *   endpoint OAuth2 callback uses — see Step 4 integration test). The\n *   exchange response surfaces `returnPath` into\n *   `auth.crossFrontendHandoffContext`; we navigate there post-exchange\n *   (with URL-query fallback as defense-in-depth). The ephemeral-storage\n *   guard is intentionally skipped — per K-7, the receiver's storage\n *   adapter (NOT the protocol) determines lifetime, and the SaaS app's\n *   regular persistent storage is the correct landing for a session\n *   transfer.\n */\nexport type AuthOneOffSessionMode = 'one-off-session' | 'cross-frontend-handoff';\n\nexport interface PublicLayoutPreset_OneOffSession_DefaultProps {\n  /**\n   * The one-time consumable token to exchange. For `mode='one-off-session'`\n   * it comes from the `:token` URL path param; for `mode='cross-frontend-handoff'`\n   * it comes from the `?code=` query param (extracted by `AuthPage_AuthExchange`).\n   */\n  token?: string;\n  /**\n   * Defaults to `'one-off-session'` to preserve backward compatibility with\n   * the W7.3b page wrapper that does not pass this prop.\n   */\n  mode?: AuthOneOffSessionMode;\n  /**\n   * Cross-frontend-handoff receiver: the `?return=` URL query param value,\n   * extracted by `AuthPage_AuthExchange`. Defense-in-depth fallback used\n   * ONLY when `auth.crossFrontendHandoffContext.returnPath` is missing\n   * (e.g. backend metadata round-trip failed for some reason). Sanitized\n   * before use.\n   */\n  returnPathFromUrl?: string;\n}\n\n/**\n * Resolves the target frontend URL for a W7.3b one-off-session exchange.\n *\n * Searches the resource registry for an operation whose `tokenAuthentication.types`\n * includes the consumed `tokenType`, then builds a concrete URL using the\n * targeting `initiatorIds` as path parameters.\n *\n * Returns undefined if no matching operation is found or URL cannot be resolved\n * (caller falls back to home).\n *\n * NOT used for cross-frontend-handoff mode — that flow drives navigation off\n * `auth.crossFrontendHandoffContext.returnPath`, see\n * `resolveCrossFrontendHandoffUrl()` below.\n */\nfunction resolveTargetUrl(\n  tokenType: string,\n  initiatorIds: Record<string, string> | undefined,\n  registry: { resourceConfigurations: Record<string, AnyFrontendResourceConfiguration>; allResourceFieldIdentifiers: Record<string, string>; fieldIdentifierToResourceType: Record<string, string> },\n): string | undefined {\n  if (!initiatorIds || Object.keys(initiatorIds).length === 0) return undefined;\n\n  let matchedConfig: AnyFrontendResourceConfiguration | undefined;\n  let matchedOperation: FrontendResourceConfiguration_Operation | undefined;\n\n  for (const rc of Object.values(registry.resourceConfigurations)) {\n    const ops = Array.isArray(rc.operations) ? rc.operations : [];\n    for (const op of ops) {\n      const tokenAuth = (op as any).tokenAuthentication;\n      if (tokenAuth?.types?.includes(tokenType) && isOperationAddressable(op.operationFrontendConfig)) {\n        matchedConfig = rc;\n        matchedOperation = op;\n        break;\n      }\n    }\n    if (matchedOperation) break;\n  }\n\n  if (!matchedConfig || !matchedOperation) return undefined;\n\n  // initiatorIds uses fieldIdentifier keys (e.g., organizationId, tasksId).\n  // resolveResourceUrl expects candidateContextIdentifiers with resourceType keys\n  // (e.g., ORGANIZATIONS, TASKS).\n  const candidateContextIdentifiers: Record<string, string> = {};\n  for (const [fieldId, id] of Object.entries(initiatorIds)) {\n    const resourceType = registry.fieldIdentifierToResourceType[fieldId];\n    if (resourceType) {\n      candidateContextIdentifiers[resourceType] = id;\n    }\n  }\n\n  const result = NavigationUtils.resolveResourceUrl(\n    matchedConfig,\n    matchedOperation,\n    candidateContextIdentifiers,\n    registry.allResourceFieldIdentifiers,\n  );\n\n  return result?.resolvedUrl ?? undefined;\n}\n\n/**\n * Defense-in-depth sanitizer for `returnPath` values arriving at the receiver.\n *\n * The cross-frontend-handoff issuer schema (`CrossFrontendHandoff_ReturnPathSchema`\n * in `cross-frontend-handoff.shared.dto.schemas.ts`) already validates the\n * value at issuance time, AND the value flows through the consumable-token\n * metadata round-trip — but a malicious caller could hand-craft an exchange\n * URL bypassing the issuer entirely (`/auth/exchange?code=…&return=https://evil.com`).\n * Without this guard the eventual `<Navigate to={…}>` would happily honour\n * the open-redirect / XSS / path-traversal payload.\n *\n * The ORIGIN half of the question is answered by the shared\n * {@link isSameOriginRedirectPath} predicate rather than by the character\n * rules below, and that split is the fix for a real defect: this function,\n * the docs-site `AuthExchangePage.sanitizeReturnPath()` and the issuer\n * schema were three hand-written deny-lists that \"mirrored\" each other —\n * and all three admitted `/<TAB>/evil.com`, because the URL parser strips\n * ASCII tab / LF / CR before parsing, turning it into `//evil.com`. Every\n * copy banned `\\` and none banned the whitespace that becomes a `/`.\n *\n * The character rules are KEPT, as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n */\nfunction sanitizeReturnPath(raw: string | undefined): string {\n  if (!raw) return CommonRoutePaths.home;\n  // Authoritative: does this actually resolve onto our own origin? Covers `//evil.com`,\n  // `/\\evil.com` and the stripped-control-character family in one parse-based check.\n  if (!isSameOriginRedirectPath(raw)) return CommonRoutePaths.home;\n  if (raw.includes('..')) return CommonRoutePaths.home;\n  if (raw.includes('\\\\')) return CommonRoutePaths.home;\n  if (raw.includes('://')) return CommonRoutePaths.home;\n  if (/[<>\"]/.test(raw)) return CommonRoutePaths.home;\n  if (raw.length > 256) return CommonRoutePaths.home;\n  return raw;\n}\n\n/**\n * cross-app-jwt-propagation.md Step 5 dual-mode receiver.\n *\n * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it\n * via `handleOneOffTokenExchange`, and redirects to the target page resolved\n * from `tokenType` + targeting via the resource registry, falling back to\n * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).\n *\n * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,\n * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,\n * the same endpoint OAuth2 callback uses), and navigates to\n * `auth.crossFrontendHandoffContext.returnPath` (preferred) or\n * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage\n * guard — the SaaS app's persistent storage is the correct landing per K-7.\n *\n * All user-facing strings are i18n-driven via `OneOffSessionLabel`.\n */\nexport const PublicLayoutPreset_OneOffSession_Default = ({\n  token,\n  mode = 'one-off-session',\n  returnPathFromUrl,\n}: PublicLayoutPreset_OneOffSession_DefaultProps): React.JSX.Element => {\n  const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();\n  const { registry } = useResourceRegistry();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);\n  const loginPath = CommonRoutePaths.login;\n\n  /**\n   * Receiver-LOCAL error state for THIS exchange attempt.\n   *\n   * L-9 (third deep-review pass): this field deliberately duplicates\n   * `auth.error` (set by `AuthSessionContext.handleAuthCodeExchange`'s catch\n   * block) rather than reading the shared field directly. Reasoning:\n   *\n   * - `auth.error` is process-wide across all auth surfaces (logout,\n   *   refresh-token rotation, magic-link verify, MFA verify, passkey\n   *   auth, etc. all write to it). If a parallel\n   *   call sets `auth.error` while THIS receiver's exchange is succeeding,\n   *   reading `auth.error` from the H-4 navigation gate would falsely\n   *   block the receiver from rendering `<Navigate>` — even though the\n   *   receiver's own exchange completed cleanly.\n   *\n   * - Local `error` is scoped to THIS receiver's exchange attempt\n   *   (set ONLY by the `.catch()` on the in-mount exchange Promise).\n   *   The H-4 gate checks `!error` (local) so navigation is blocked iff\n   *   THIS receiver's exchange failed, regardless of what other auth\n   *   surfaces are doing concurrently.\n   *\n   * If the AuthSessionContext error surface is ever refactored into per-\n   * call scoped errors, this duplication can collapse — but until then\n   * the duplication is load-bearing.\n   */\n  const [error, setError] = useState<string | null>(null);\n  const exchangeAttemptedRef = useRef(false);\n  /**\n   * Gate `<Navigate>` until the exchange phase has resolved (success, failure,\n   * or intentionally skipped). Without this gate, a cross-frontend-handoff\n   * receiver mounted with a pre-existing `auth.accessToken` (cold-load from\n   * persistent storage) would render `<Navigate>` on the FIRST render —\n   * which commits and unmounts the component BEFORE this component's\n   * `useEffect` ever runs the AUTH_CODE_EXCHANGE consume call. The user\n   * would then land on the URL `?return=` value with their pre-existing\n   * session AND the consumable token would dangle in the store for 60s\n   * (auto-expiring without ever being consumed). See M-2 in the Step 5\n   * deep-review log on `cross-app-jwt-propagation.md`.\n   *\n   * Initial value is mode-dependent:\n   * - `one-off-session`: `true` IF accessToken is already set (preserve\n   *   the existing W7.3b \"render Navigate immediately\" semantics — the\n   *   ephemeral-storage guard fires for the in-tab case anyway).\n   * - `cross-frontend-handoff`: `false` always — we ALWAYS want the\n   *   exchange to run before navigating, even when `auth.accessToken` is\n   *   set, so the new tokens replace the existing session and the\n   *   `crossFrontendHandoffContext.returnPath` populates from the\n   *   exchange response (defense against silent auth-confusion when the\n   *   pre-existing session belongs to a different user than the handoff\n   *   was minted for).\n   */\n  const [exchangePhaseResolved, setExchangePhaseResolved] = useState<boolean>(\n    mode === 'one-off-session' && Boolean(auth.accessToken),\n  );\n\n  const targetUrl = useMemo(() => {\n    if (!auth.accessToken) return CommonRoutePaths.home;\n\n    // Cross-frontend-handoff: navigate to `returnPath` from the exchange\n    // response (which round-tripped via the consumable-token metadata),\n    // falling back to the URL-query value as defense-in-depth. Both inputs\n    // pass through `sanitizeReturnPath` to defeat any open-redirect /\n    // path-traversal / XSS payload that may have bypassed the issuer schema.\n    if (mode === 'cross-frontend-handoff') {\n      const fromContext = auth.crossFrontendHandoffContext?.returnPath;\n      const candidate = fromContext ?? returnPathFromUrl;\n      return sanitizeReturnPath(candidate);\n    }\n\n    // W7.3b one-off session: walk the resource registry for an operation\n    // matching the consumed tokenType.\n    if (!auth.oneOffContext) return CommonRoutePaths.home;\n    const resolved = resolveTargetUrl(\n      auth.oneOffContext.tokenType,\n      auth.oneOffContext.scopedInitiatorIds,\n      registry,\n    );\n    return resolved ?? CommonRoutePaths.home;\n  }, [\n    mode,\n    auth.oneOffContext,\n    auth.accessToken,\n    auth.crossFrontendHandoffContext,\n    returnPathFromUrl,\n    registry,\n  ]);\n\n  useEffect(() => {\n    if (exchangeAttemptedRef.current) return;\n\n    // Storage guard applies ONLY to W7.3b (one-off-session) mode. Cross-\n    // frontend-handoff intentionally lands in the receiver's regular tab\n    // with its regular (persistent or ephemeral, per receiver's adapter\n    // choice) storage — this is the protocol's whole point per K-7.\n    if (mode === 'one-off-session' && !(tokenStorage instanceof EphemeralSessionTokenStorage)) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_WRONG_TAB));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    if (!token) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_NO_TOKEN));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    // Already-authenticated short-circuit applies ONLY to W7.3b\n    // (one-off-session) mode — there an existing parent session in the\n    // tab is the trigger for the ERROR_WRONG_TAB guard above (the\n    // ephemeral-storage check should have already fired), and burning\n    // a one-off code on an authenticated tab is wasteful.\n    //\n    // Cross-frontend-handoff mode must NOT short-circuit: the user\n    // explicitly initiated a session transfer on the source frontend\n    // (clicked \"Open in docs\" / similar). Skipping the exchange would:\n    //   (a) leave a 60-second dangling AUTH_CODE_EXCHANGE token in the\n    //       store (auto-expires, but uses the consumable-token budget and\n    //       muddies audit logs);\n    //   (b) navigate the user using the URL `?return=` value but with\n    //       their PRE-EXISTING session — which may be a different user\n    //       than the handoff was minted for, leading to the user landing\n    //       on `/api/organization/foo` as the wrong identity (silent\n    //       auth-confusion). Always consume the code so the new tokens\n    //       replace the existing ones.\n    if (auth.accessToken && mode === 'one-off-session') {\n      exchangeAttemptedRef.current = true;\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    exchangeAttemptedRef.current = true;\n\n    const exchange = mode === 'cross-frontend-handoff'\n      ? handleAuthCodeExchange(token)\n      : handleOneOffTokenExchange(token);\n\n    exchange\n      .catch((e: any) => {\n        setError(e?.message || t(OneOffSessionLabel.ERROR_GENERIC));\n      })\n      .finally(() => {\n        setExchangePhaseResolved(true);\n      });\n  }, [token, mode, auth.accessToken, handleOneOffTokenExchange, handleAuthCodeExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  // Single-use cleanup of `auth.crossFrontendHandoffContext`. Runs on\n  // unmount, which happens AFTER `<Navigate to={targetUrl}>` resolves and\n  // React tears down the receiver. Earlier cleanup would race the\n  // `targetUrl` `useMemo` recomputation and could navigate to home instead\n  // of the intended `returnPath`. No-op for `one-off-session` mode (which\n  // never sets the field in the first place — `oneOffContext` is its\n  // sibling state and is preserved as part of the active session).\n  //\n  // Dependency note (L-6): `mode` is captured by closure, so listing it as\n  // a dep technically just re-creates the effect when `mode` changes mid-\n  // mount — which never happens in practice (the prop is fixed by the\n  // receiver page). It IS listed deliberately so React's exhaustive-deps\n  // lint stays clean AND so a future caller that toggles `mode` mid-mount\n  // gets the cleanup re-bound rather than the stale closure. Removing it\n  // would shift this from \"harmless dep\" to \"subtle stale-closure bug\n  // waiting for a future mode toggle\".\n  useEffect(() => {\n    return () => {\n      if (mode === 'cross-frontend-handoff') {\n        clearCrossFrontendHandoffContext();\n      }\n    };\n  }, [mode, clearCrossFrontendHandoffContext]);\n\n  // Navigation guard: render `<Navigate>` ONLY when the exchange phase\n  // resolved cleanly. Critical: `!error` is load-bearing here. Without it,\n  // a cross-frontend-handoff receiver mounted with a pre-existing\n  // `auth.accessToken` (cold-load from persistent storage) whose AUTH_CODE_\n  // EXCHANGE call fails would silently navigate the user to the URL\n  // `?return=` value WITH THE OLD SESSION — a session-confusion regression\n  // (the user lands on the deep link as the wrong identity, with no error\n  // surfaced). The error branch below shows a localized failure message\n  // and a login link instead. See H-4 in the Step 5 second deep-review log\n  // on `cross-app-jwt-propagation.md`.\n  if (auth.accessToken && !auth.isLoading && exchangePhaseResolved && !error) {\n    return <Navigate to={targetUrl} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (error) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element\">\n            <svg className=\"h-6 w-6 text-destructive\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\" />\n            </svg>\n          </div>\n          <Heading>{t(OneOffSessionLabel.ERROR_TITLE)}</Heading>\n        </div>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n        <div className=\"text-center mt-group\">\n          <Link href={loginPath}>{t(OneOffSessionLabel.LOGIN_LINK)}</Link>\n        </div>\n      </>\n    );\n  }\n\n  return (\n    <div role=\"status\" aria-live=\"polite\" className=\"text-center space-y-item-xs\">\n      <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\" aria-hidden=\"true\">\n        <LoadingSpinner size={24} className=\"text-primary\" />\n      </div>\n      <Text className=\"max-w-sm mx-auto\">{t(OneOffSessionLabel.VERIFYING)}</Text>\n    </div>\n  );\n};\n\nexport function Auth_OneOffSession({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OneOffSession_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OneOffSession_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, 'Auth_OneOffSession')(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OneOffSession.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAwDzF;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,YAAgD,EAChD,QAAkM;IAElM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,IAAI,aAA2D,CAAC;IAChE,IAAI,gBAAqE,CAAC;IAE1E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,SAAS,GAAI,EAAU,CAAC,mBAAmB,CAAC;YAClD,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAChG,aAAa,GAAG,EAAE,CAAC;gBACnB,gBAAgB,GAAG,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAE1D,0EAA0E;IAC1E,gFAAgF;IAChF,gCAAgC;IAChC,MAAM,2BAA2B,GAA2B,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAC/C,aAAa,EACb,gBAAgB,EAChB,2BAA2B,EAC3B,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IAEF,OAAO,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACvC,sFAAsF;IACtF,mFAAmF;IACnF,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,EACvD,KAAK,EACL,IAAI,GAAG,iBAAiB,EACxB,iBAAiB,GAC6B,EAAqB,EAAE;IACrE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,CAAC;IACrI,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAC7G,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAChE,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACxD,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAEpD,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC;YACjE,MAAM,SAAS,GAAG,WAAW,IAAI,iBAAiB,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,qEAAqE;QACrE,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,EAC5B,IAAI,CAAC,aAAa,CAAC,kBAAkB,EACrC,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAC3C,CAAC,EAAE;QACD,IAAI;QACJ,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,2BAA2B;QAChC,iBAAiB;QACjB,QAAQ;KACT,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,oBAAoB,CAAC,OAAO;YAAE,OAAO;QAEzC,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,YAAY,4BAA4B,CAAC,EAAE,CAAC;YAC1F,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;YAChD,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,sDAAsD;QACtD,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,6BAA6B;QAC7B,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACnD,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,KAAK,wBAAwB;YAChD,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAErC,QAAQ;aACL,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACpB,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAExJ,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,iEAAiE;IACjE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,qCAAqC;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACtC,gCAAgC,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAE7C,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,8FAA8F,YAC3G,cAAK,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YAC7G,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sBAAsB,GAAG,GAC1E,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAW,IAClD,EACN,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,EACR,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAqB,GACtF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,EAAC,SAAS,EAAC,6BAA6B,aAC3E,cAAK,SAAS,EAAC,0FAA0F,iBAAa,MAAM,YAC1H,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,GAAG,GACjD,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAQ,IACvE,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAwE;IACrJ,MAAM,SAAS,GAAG,uBAAuB,CAAgD,qBAAqB,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate } from 'react-router-dom';\nimport type { AnyFrontendResourceConfiguration, FrontendResourceConfiguration_Operation } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { isOperationAddressable } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { EphemeralSessionTokenStorage } from '~wildo-frontend-lib/core/security/session-token-storage.frontend.service';\nimport { NavigationUtils } from '~wildo-frontend-lib/core/navigation/navigation.utils';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { AuthSecondaryLink } from '~wildo-frontend-lib/components/auth/utils/AuthSecondaryLink';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\n\n// --- Contract ---\n\n/**\n * Receiver mode for `Auth_OneOffSession` (cross-app-jwt-propagation.md Step 5).\n *\n * Two distinct issuance flows land on this same UI shell; the mode prop\n * dispatches to the right exchange handler and the right post-exchange\n * URL-resolution strategy:\n *\n * - `'one-off-session'` — W7.3b ephemeral one-off session. The token is\n *   consumed via `handleOneOffTokenExchange` (`POST /auth/one-off-session/exchange`),\n *   which returns a context populated with `tokenType`, `scopedInitiatorIds`,\n *   and `applicationId`. Post-exchange URL resolves via the resource\n *   registry (matches an operation whose `tokenAuthentication.types` accepts\n *   the consumed `tokenType`). Enforces `EphemeralSessionTokenStorage` to\n *   prevent stomping a parent tab's authenticated session.\n *\n * - `'cross-frontend-handoff'` — Cross-app JWT propagation handoff. The\n *   token is an AUTH_CODE_EXCHANGE consumable issued by\n *   `POST /auth/cross-frontend-handoff` and consumed via\n *   `handleAuthCodeExchange` (`POST /auth/token/exchange`, the same exchange\n *   endpoint OAuth2 callback uses — see Step 4 integration test). The\n *   exchange response surfaces `returnPath` into\n *   `auth.crossFrontendHandoffContext`; we navigate there post-exchange\n *   (with URL-query fallback as defense-in-depth). The ephemeral-storage\n *   guard is intentionally skipped — per K-7, the receiver's storage\n *   adapter (NOT the protocol) determines lifetime, and the SaaS app's\n *   regular persistent storage is the correct landing for a session\n *   transfer.\n */\nexport type AuthOneOffSessionMode = 'one-off-session' | 'cross-frontend-handoff';\n\nexport interface PublicLayoutPreset_OneOffSession_DefaultProps {\n  /**\n   * The one-time consumable token to exchange. For `mode='one-off-session'`\n   * it comes from the `:token` URL path param; for `mode='cross-frontend-handoff'`\n   * it comes from the `?code=` query param (extracted by `AuthPage_AuthExchange`).\n   */\n  token?: string;\n  /**\n   * Defaults to `'one-off-session'` to preserve backward compatibility with\n   * the W7.3b page wrapper that does not pass this prop.\n   */\n  mode?: AuthOneOffSessionMode;\n  /**\n   * Cross-frontend-handoff receiver: the `?return=` URL query param value,\n   * extracted by `AuthPage_AuthExchange`. Defense-in-depth fallback used\n   * ONLY when `auth.crossFrontendHandoffContext.returnPath` is missing\n   * (e.g. backend metadata round-trip failed for some reason). Sanitized\n   * before use.\n   */\n  returnPathFromUrl?: string;\n}\n\n/**\n * Resolves the target frontend URL for a W7.3b one-off-session exchange.\n *\n * Searches the resource registry for an operation whose `tokenAuthentication.types`\n * includes the consumed `tokenType`, then builds a concrete URL using the\n * targeting `initiatorIds` as path parameters.\n *\n * Returns undefined if no matching operation is found or URL cannot be resolved\n * (caller falls back to home).\n *\n * NOT used for cross-frontend-handoff mode — that flow drives navigation off\n * `auth.crossFrontendHandoffContext.returnPath`, see\n * `resolveCrossFrontendHandoffUrl()` below.\n */\nfunction resolveTargetUrl(\n  tokenType: string,\n  initiatorIds: Record<string, string> | undefined,\n  registry: { resourceConfigurations: Record<string, AnyFrontendResourceConfiguration>; allResourceFieldIdentifiers: Record<string, string>; fieldIdentifierToResourceType: Record<string, string> },\n): string | undefined {\n  if (!initiatorIds || Object.keys(initiatorIds).length === 0) return undefined;\n\n  let matchedConfig: AnyFrontendResourceConfiguration | undefined;\n  let matchedOperation: FrontendResourceConfiguration_Operation | undefined;\n\n  for (const rc of Object.values(registry.resourceConfigurations)) {\n    const ops = Array.isArray(rc.operations) ? rc.operations : [];\n    for (const op of ops) {\n      const tokenAuth = (op as any).tokenAuthentication;\n      if (tokenAuth?.types?.includes(tokenType) && isOperationAddressable(op.operationFrontendConfig)) {\n        matchedConfig = rc;\n        matchedOperation = op;\n        break;\n      }\n    }\n    if (matchedOperation) break;\n  }\n\n  if (!matchedConfig || !matchedOperation) return undefined;\n\n  // initiatorIds uses fieldIdentifier keys (e.g., organizationId, tasksId).\n  // resolveResourceUrl expects candidateContextIdentifiers with resourceType keys\n  // (e.g., ORGANIZATIONS, TASKS).\n  const candidateContextIdentifiers: Record<string, string> = {};\n  for (const [fieldId, id] of Object.entries(initiatorIds)) {\n    const resourceType = registry.fieldIdentifierToResourceType[fieldId];\n    if (resourceType) {\n      candidateContextIdentifiers[resourceType] = id;\n    }\n  }\n\n  const result = NavigationUtils.resolveResourceUrl(\n    matchedConfig,\n    matchedOperation,\n    candidateContextIdentifiers,\n    registry.allResourceFieldIdentifiers,\n  );\n\n  return result?.resolvedUrl ?? undefined;\n}\n\n/**\n * Defense-in-depth sanitizer for `returnPath` values arriving at the receiver.\n *\n * The cross-frontend-handoff issuer schema (`CrossFrontendHandoff_ReturnPathSchema`\n * in `cross-frontend-handoff.shared.dto.schemas.ts`) already validates the\n * value at issuance time, AND the value flows through the consumable-token\n * metadata round-trip — but a malicious caller could hand-craft an exchange\n * URL bypassing the issuer entirely (`/auth/exchange?code=…&return=https://evil.com`).\n * Without this guard the eventual `<Navigate to={…}>` would happily honour\n * the open-redirect / XSS / path-traversal payload.\n *\n * The ORIGIN half of the question is answered by the shared\n * {@link isSameOriginRedirectPath} predicate rather than by the character\n * rules below, and that split is the fix for a real defect: this function,\n * the docs-site `AuthExchangePage.sanitizeReturnPath()` and the issuer\n * schema were three hand-written deny-lists that \"mirrored\" each other —\n * and all three admitted `/<TAB>/evil.com`, because the URL parser strips\n * ASCII tab / LF / CR before parsing, turning it into `//evil.com`. Every\n * copy banned `\\` and none banned the whitespace that becomes a `/`.\n *\n * The character rules are KEPT, as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n */\nfunction sanitizeReturnPath(raw: string | undefined): string {\n  if (!raw) return CommonRoutePaths.home;\n  // Authoritative: does this actually resolve onto our own origin? Covers `//evil.com`,\n  // `/\\evil.com` and the stripped-control-character family in one parse-based check.\n  if (!isSameOriginRedirectPath(raw)) return CommonRoutePaths.home;\n  if (raw.includes('..')) return CommonRoutePaths.home;\n  if (raw.includes('\\\\')) return CommonRoutePaths.home;\n  if (raw.includes('://')) return CommonRoutePaths.home;\n  if (/[<>\"]/.test(raw)) return CommonRoutePaths.home;\n  if (raw.length > 256) return CommonRoutePaths.home;\n  return raw;\n}\n\n/**\n * cross-app-jwt-propagation.md Step 5 dual-mode receiver.\n *\n * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it\n * via `handleOneOffTokenExchange`, and redirects to the target page resolved\n * from `tokenType` + targeting via the resource registry, falling back to\n * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).\n *\n * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,\n * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,\n * the same endpoint OAuth2 callback uses), and navigates to\n * `auth.crossFrontendHandoffContext.returnPath` (preferred) or\n * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage\n * guard — the SaaS app's persistent storage is the correct landing per K-7.\n *\n * All user-facing strings are i18n-driven via `OneOffSessionLabel`.\n */\nexport const PublicLayoutPreset_OneOffSession_Default = ({\n  token,\n  mode = 'one-off-session',\n  returnPathFromUrl,\n}: PublicLayoutPreset_OneOffSession_DefaultProps): React.JSX.Element => {\n  const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();\n  const { registry } = useResourceRegistry();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);\n  const loginPath = CommonRoutePaths.login;\n\n  /**\n   * Receiver-LOCAL error state for THIS exchange attempt.\n   *\n   * L-9 (third deep-review pass): this field deliberately duplicates\n   * `auth.error` (set by `AuthSessionContext.handleAuthCodeExchange`'s catch\n   * block) rather than reading the shared field directly. Reasoning:\n   *\n   * - `auth.error` is process-wide across all auth surfaces (logout,\n   *   refresh-token rotation, magic-link verify, MFA verify, passkey\n   *   auth, etc. all write to it). If a parallel\n   *   call sets `auth.error` while THIS receiver's exchange is succeeding,\n   *   reading `auth.error` from the H-4 navigation gate would falsely\n   *   block the receiver from rendering `<Navigate>` — even though the\n   *   receiver's own exchange completed cleanly.\n   *\n   * - Local `error` is scoped to THIS receiver's exchange attempt\n   *   (set ONLY by the `.catch()` on the in-mount exchange Promise).\n   *   The H-4 gate checks `!error` (local) so navigation is blocked iff\n   *   THIS receiver's exchange failed, regardless of what other auth\n   *   surfaces are doing concurrently.\n   *\n   * If the AuthSessionContext error surface is ever refactored into per-\n   * call scoped errors, this duplication can collapse — but until then\n   * the duplication is load-bearing.\n   */\n  const [error, setError] = useState<string | null>(null);\n  const exchangeAttemptedRef = useRef(false);\n  /**\n   * Gate `<Navigate>` until the exchange phase has resolved (success, failure,\n   * or intentionally skipped). Without this gate, a cross-frontend-handoff\n   * receiver mounted with a pre-existing `auth.accessToken` (cold-load from\n   * persistent storage) would render `<Navigate>` on the FIRST render —\n   * which commits and unmounts the component BEFORE this component's\n   * `useEffect` ever runs the AUTH_CODE_EXCHANGE consume call. The user\n   * would then land on the URL `?return=` value with their pre-existing\n   * session AND the consumable token would dangle in the store for 60s\n   * (auto-expiring without ever being consumed). See M-2 in the Step 5\n   * deep-review log on `cross-app-jwt-propagation.md`.\n   *\n   * Initial value is mode-dependent:\n   * - `one-off-session`: `true` IF accessToken is already set (preserve\n   *   the existing W7.3b \"render Navigate immediately\" semantics — the\n   *   ephemeral-storage guard fires for the in-tab case anyway).\n   * - `cross-frontend-handoff`: `false` always — we ALWAYS want the\n   *   exchange to run before navigating, even when `auth.accessToken` is\n   *   set, so the new tokens replace the existing session and the\n   *   `crossFrontendHandoffContext.returnPath` populates from the\n   *   exchange response (defense against silent auth-confusion when the\n   *   pre-existing session belongs to a different user than the handoff\n   *   was minted for).\n   */\n  const [exchangePhaseResolved, setExchangePhaseResolved] = useState<boolean>(\n    mode === 'one-off-session' && Boolean(auth.accessToken),\n  );\n\n  const targetUrl = useMemo(() => {\n    if (!auth.accessToken) return CommonRoutePaths.home;\n\n    // Cross-frontend-handoff: navigate to `returnPath` from the exchange\n    // response (which round-tripped via the consumable-token metadata),\n    // falling back to the URL-query value as defense-in-depth. Both inputs\n    // pass through `sanitizeReturnPath` to defeat any open-redirect /\n    // path-traversal / XSS payload that may have bypassed the issuer schema.\n    if (mode === 'cross-frontend-handoff') {\n      const fromContext = auth.crossFrontendHandoffContext?.returnPath;\n      const candidate = fromContext ?? returnPathFromUrl;\n      return sanitizeReturnPath(candidate);\n    }\n\n    // W7.3b one-off session: walk the resource registry for an operation\n    // matching the consumed tokenType.\n    if (!auth.oneOffContext) return CommonRoutePaths.home;\n    const resolved = resolveTargetUrl(\n      auth.oneOffContext.tokenType,\n      auth.oneOffContext.scopedInitiatorIds,\n      registry,\n    );\n    return resolved ?? CommonRoutePaths.home;\n  }, [\n    mode,\n    auth.oneOffContext,\n    auth.accessToken,\n    auth.crossFrontendHandoffContext,\n    returnPathFromUrl,\n    registry,\n  ]);\n\n  useEffect(() => {\n    if (exchangeAttemptedRef.current) return;\n\n    // Storage guard applies ONLY to W7.3b (one-off-session) mode. Cross-\n    // frontend-handoff intentionally lands in the receiver's regular tab\n    // with its regular (persistent or ephemeral, per receiver's adapter\n    // choice) storage — this is the protocol's whole point per K-7.\n    if (mode === 'one-off-session' && !(tokenStorage instanceof EphemeralSessionTokenStorage)) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_WRONG_TAB));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    if (!token) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_NO_TOKEN));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    // Already-authenticated short-circuit applies ONLY to W7.3b\n    // (one-off-session) mode — there an existing parent session in the\n    // tab is the trigger for the ERROR_WRONG_TAB guard above (the\n    // ephemeral-storage check should have already fired), and burning\n    // a one-off code on an authenticated tab is wasteful.\n    //\n    // Cross-frontend-handoff mode must NOT short-circuit: the user\n    // explicitly initiated a session transfer on the source frontend\n    // (clicked \"Open in docs\" / similar). Skipping the exchange would:\n    //   (a) leave a 60-second dangling AUTH_CODE_EXCHANGE token in the\n    //       store (auto-expires, but uses the consumable-token budget and\n    //       muddies audit logs);\n    //   (b) navigate the user using the URL `?return=` value but with\n    //       their PRE-EXISTING session — which may be a different user\n    //       than the handoff was minted for, leading to the user landing\n    //       on `/api/organization/foo` as the wrong identity (silent\n    //       auth-confusion). Always consume the code so the new tokens\n    //       replace the existing ones.\n    if (auth.accessToken && mode === 'one-off-session') {\n      exchangeAttemptedRef.current = true;\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    exchangeAttemptedRef.current = true;\n\n    const exchange = mode === 'cross-frontend-handoff'\n      ? handleAuthCodeExchange(token)\n      : handleOneOffTokenExchange(token);\n\n    exchange\n      .catch((e: unknown) => {\n        setError(toUserFacingErrorMessage(e, t(OneOffSessionLabel.ERROR_GENERIC)));\n      })\n      .finally(() => {\n        setExchangePhaseResolved(true);\n      });\n  }, [token, mode, auth.accessToken, handleOneOffTokenExchange, handleAuthCodeExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  // Single-use cleanup of `auth.crossFrontendHandoffContext`. Runs on\n  // unmount, which happens AFTER `<Navigate to={targetUrl}>` resolves and\n  // React tears down the receiver. Earlier cleanup would race the\n  // `targetUrl` `useMemo` recomputation and could navigate to home instead\n  // of the intended `returnPath`. No-op for `one-off-session` mode (which\n  // never sets the field in the first place — `oneOffContext` is its\n  // sibling state and is preserved as part of the active session).\n  //\n  // Dependency note (L-6): `mode` is captured by closure, so listing it as\n  // a dep technically just re-creates the effect when `mode` changes mid-\n  // mount — which never happens in practice (the prop is fixed by the\n  // receiver page). It IS listed deliberately so React's exhaustive-deps\n  // lint stays clean AND so a future caller that toggles `mode` mid-mount\n  // gets the cleanup re-bound rather than the stale closure. Removing it\n  // would shift this from \"harmless dep\" to \"subtle stale-closure bug\n  // waiting for a future mode toggle\".\n  useEffect(() => {\n    return () => {\n      if (mode === 'cross-frontend-handoff') {\n        clearCrossFrontendHandoffContext();\n      }\n    };\n  }, [mode, clearCrossFrontendHandoffContext]);\n\n  // Navigation guard: render `<Navigate>` ONLY when the exchange phase\n  // resolved cleanly. Critical: `!error` is load-bearing here. Without it,\n  // a cross-frontend-handoff receiver mounted with a pre-existing\n  // `auth.accessToken` (cold-load from persistent storage) whose AUTH_CODE_\n  // EXCHANGE call fails would silently navigate the user to the URL\n  // `?return=` value WITH THE OLD SESSION — a session-confusion regression\n  // (the user lands on the deep link as the wrong identity, with no error\n  // surfaced). The error branch below shows a localized failure message\n  // and a login link instead. See H-4 in the Step 5 second deep-review log\n  // on `cross-app-jwt-propagation.md`.\n  if (auth.accessToken && !auth.isLoading && exchangePhaseResolved && !error) {\n    return <Navigate to={targetUrl} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (error) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element\">\n            <svg className=\"h-6 w-6 text-destructive\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\" />\n            </svg>\n          </div>\n          <Heading>{t(OneOffSessionLabel.ERROR_TITLE)}</Heading>\n        </div>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n        <div className=\"text-center mt-group\">\n          <AuthSecondaryLink href={loginPath}>{t(OneOffSessionLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  return (\n    <div role=\"status\" aria-live=\"polite\" className=\"text-center space-y-item-xs\">\n      <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\" aria-hidden=\"true\">\n        <LoadingSpinner size={24} className=\"text-primary\" />\n      </div>\n      <Text className=\"max-w-sm mx-auto\">{t(OneOffSessionLabel.VERIFYING)}</Text>\n    </div>\n  );\n};\n\nexport function Auth_OneOffSession({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OneOffSession_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OneOffSession_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, 'Auth_OneOffSession')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OneOffSession.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA+C,MAAM,qCAAqC,CAAC;AAM9J,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAOjE,CAAC"}
+{"version":3,"file":"Auth_OneOffSession.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA+C,MAAM,qCAAqC,CAAC;AAM9J,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAOjE,CAAC"}

package/dist/esm/components/auth/Auth_OneOffSession.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,gCAAgC,GAA0B;IACrE,EAAE,GAAG,EAAE,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAChJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClI,EAAE,GAAG,EAAE,kBAAkB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE;IAC1I,EAAE,GAAG,EAAE,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+FAA+F,EAAE;IAC9K,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IACvJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;CAC1G,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OneOffSessionLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOneOffSessionLabels: LabellingUnitaryDef[] = [\n  { ref: OneOffSessionLabel.VERIFYING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the one-off session token is being exchanged' },\n  { ref: OneOffSessionLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the one-off session exchange fails' },\n  { ref: OneOffSessionLabel.ERROR_NO_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the one-off session link carries no token' },\n  { ref: OneOffSessionLabel.ERROR_WRONG_TAB, kind: LabelKind.MESSAGE, purpose: 'Error shown when a one-off session link is opened in a tab that already has a regular session' },\n  { ref: OneOffSessionLabel.ERROR_GENERIC, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the one-off session exchange fails unexpectedly' },\n  { ref: OneOffSessionLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, PublicLayoutsOneOffSessionLabels);\n"]}
+{"version":3,"file":"Auth_OneOffSession.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,gCAAgC,GAA0B;IACrE,EAAE,GAAG,EAAE,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAChJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClI,EAAE,GAAG,EAAE,kBAAkB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE;IAC1I,EAAE,GAAG,EAAE,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+FAA+F,EAAE;IAC9K,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IACvJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;CAC1G,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OneOffSessionLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOneOffSessionLabels: LabellingUnitaryDef[] = [\n  { ref: OneOffSessionLabel.VERIFYING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the one-off session token is being exchanged' },\n  { ref: OneOffSessionLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the one-off session exchange fails' },\n  { ref: OneOffSessionLabel.ERROR_NO_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the one-off session link carries no token' },\n  { ref: OneOffSessionLabel.ERROR_WRONG_TAB, kind: LabelKind.MESSAGE, purpose: 'Error shown when a one-off session link is opened in a tab that already has a regular session' },\n  { ref: OneOffSessionLabel.ERROR_GENERIC, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the one-off session exchange fails unexpectedly' },\n  { ref: OneOffSessionLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, PublicLayoutsOneOffSessionLabels);\n"]}

package/dist/esm/components/auth/Auth_OrganizationOnboarding.d.ts

@@ -0,0 +1,34 @@
+import React from 'react';
+import { OnboardingObligation } from '@wildo-ai/saas-models';
+import { ComponentPresetProps } from '../../core/components-registry/component-registry.frontend.schemas';
+export interface PublicLayoutPreset_OrganizationOnboarding_DefaultProps {
+}
+/**
+ * What a parked session owes, from the public session state (#1374). A server older than `pendingObligations`
+ * parked only on the organization, so that is what an absent field means.
+ */
+export declare function onboardingObligationsFromSessionState(sessionState: {
+    pendingObligations?: unknown;
+} | null | undefined): OnboardingObligation[];
+/**
+ * The onboarding screen (#1090, #1374) — named for its first obligation, and the host of every one.
+ *
+ * An account arrives here with its authentication session parked at `ONBOARDING_PENDING`
+ * (`auth.onboardingSessionId`) because its user type names its organization at onboarding and it has none yet.
+ * Four answers park it: a registration under deferred verification, an email verification, a second-factor
+ * enrollment that settles a registration session, and — since #1091 — any sign-in by an account that still owes
+ * its organization. Naming the organization creates it, makes the account its owner, and signs the account in.
+ *
+ * The session is the auth context's, never read from the URL: it mints, so it is kept out of history and request
+ * logs. Nothing is remembered across a reload either, and that loses nothing — the obligation is durable on the
+ * server, so a person whose tab lost the session signs in again and is brought straight back here. That is also
+ * the answer to a spent session (completed in another tab, expired): the auth context forgets it, and the step
+ * says so and offers sign-in.
+ *
+ * **The way out.** Every auth screen routes a parked context here, so the step offers "use a different account":
+ * it abandons the parked session and goes to sign-in. The account loses nothing — it is returned here the next
+ * time it signs in.
+ */
+export declare const PublicLayoutPreset_OrganizationOnboarding_Default: (_props: PublicLayoutPreset_OrganizationOnboarding_DefaultProps) => React.JSX.Element | null;
+export declare function Auth_OrganizationOnboarding({ preset, ...props }: PublicLayoutPreset_OrganizationOnboarding_DefaultProps & ComponentPresetProps): React.JSX.Element;
+//# sourceMappingURL=Auth_OrganizationOnboarding.d.ts.map

package/dist/esm/components/auth/Auth_OrganizationOnboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_OrganizationOnboarding.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OrganizationOnboarding.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAGzE,OAAO,EACL,oBAAoB,EAKrB,MAAM,uBAAuB,CAAC;AAoB/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAIxH,MAAM,WAAW,sDAAsD;CAAG;AAgE1E;;;GAGG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,EAAE,CAK/I;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iDAAiD,GAAI,QAAQ,sDAAsD,KAAG,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,IA4ItJ,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,sDAAsD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5L"}