@wildo-ai/saas-frontend-lib 1.1.5 → 1.1.6

package/dist/esm/components/actions/action-bar.d.ts

@@ -5,6 +5,19 @@ import { type ButtonVariants_Variant } from './button';
 import { type ActionButtonSize } from './action-button';
 import type { ResourceOperationRiskLevel } from '@wildo-ai/saas-models';
 import type { DisplayDirection } from '@wildo-ai/zod-decorators';
+/**
+ * What an anchored panel's BODY is, which decides the panel's own chrome.
+ *
+ * A form wants the panel's padding around it; a list of options wants none — a menu runs its rows
+ * edge to edge, and padding around a command list draws a second frame inside the first. The body
+ * knows which it is, so it says so rather than each renderer guessing from the content.
+ */
+export declare enum ActionBarPopoverChrome {
+    /** A padded panel for a form or other free content. The default. */
+    PANEL = "panel",
+    /** An unpadded, menu-width panel for a list of options (a DROPDOWN action). */
+    LIST = "list"
+}
 /**
  * An anchored panel this action opens instead of firing `onClick`.
  *
@@ -24,6 +37,8 @@ export interface ActionBarButtonPopover {
     content: React.ReactNode;
     /** Accessible name for the panel. Falls back to the action's own label. */
     title?: string;
+    /** What the body is — see {@link ActionBarPopoverChrome}. Omitted means PANEL. */
+    chrome?: ActionBarPopoverChrome;
 }
 /**
  * Why an action cannot run right now, and — when there is one — the single step that makes it

package/dist/esm/components/actions/action-bar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-bar.d.ts","sourceRoot":"","sources":["../../../../../src/components/actions/action-bar.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAA0C,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAA;AACvH,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAIhE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,CAAA;IACb,YAAY,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAA;IACxB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,IAAI,EAAE,KAAK,CAAC,SAAS,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;IACpB,OAAO,CAAC,EAAE,sBAAsB,CAAA;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,uBAAuB,CAAA;IACxC,wFAAwF;IACxF,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C;uFACmF;IACnF,SAAS,CAAC,EAAE,0BAA0B,CAAA;IACtC;kFAC8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,KAAK,CAAC,SAAS,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,sBAAsB,CAAA;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,0BAA0B,CAAA;IACtC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;AAEpF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IACzC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAGD,wBAAgB,SAAS,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,cAAc,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGlI"}
+{"version":3,"file":"action-bar.d.ts","sourceRoot":"","sources":["../../../../../src/components/actions/action-bar.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAA0C,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAA;AACvH,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAIhE;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC,oEAAoE;IACpE,KAAK,UAAU;IACf,+EAA+E;IAC/E,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,CAAA;IACb,YAAY,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAA;IACxB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,kFAAkF;IAClF,MAAM,CAAC,EAAE,sBAAsB,CAAA;CAChC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,IAAI,EAAE,KAAK,CAAC,SAAS,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;IACpB,OAAO,CAAC,EAAE,sBAAsB,CAAA;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,uBAAuB,CAAA;IACxC,wFAAwF;IACxF,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C;uFACmF;IACnF,SAAS,CAAC,EAAE,0BAA0B,CAAA;IACtC;kFAC8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,KAAK,CAAC,SAAS,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,sBAAsB,CAAA;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,0BAA0B,CAAA;IACtC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;AAEpF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IACzC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAGD,wBAAgB,SAAS,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,cAAc,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGlI"}

package/dist/esm/components/actions/action-bar.js

@@ -1,6 +1,21 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createComponentResolver } from '../../core/components-registry/component-resolver.frontend.helper.js';
 import { FrontendComponentType, CorePresetNames } from '@wildo-ai/presets-components-models';
+// --- Contract ---
+/**
+ * What an anchored panel's BODY is, which decides the panel's own chrome.
+ *
+ * A form wants the panel's padding around it; a list of options wants none — a menu runs its rows
+ * edge to edge, and padding around a command list draws a second frame inside the first. The body
+ * knows which it is, so it says so rather than each renderer guessing from the content.
+ */
+export var ActionBarPopoverChrome;
+(function (ActionBarPopoverChrome) {
+    /** A padded panel for a form or other free content. The default. */
+    ActionBarPopoverChrome["PANEL"] = "panel";
+    /** An unpadded, menu-width panel for a list of options (a DROPDOWN action). */
+    ActionBarPopoverChrome["LIST"] = "list";
+})(ActionBarPopoverChrome || (ActionBarPopoverChrome = {}));
 // --- Wrapper ---
 export function ActionBar({ preset = CorePresetNames.DEFAULT, ...props }) {
     const Component = createComponentResolver(FrontendComponentType.LOW_LEVEL_ACTION_BAR, 'ActionBar')(preset);

package/dist/esm/components/actions/action-bar.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-bar.js","sourceRoot":"","sources":["../../../../../src/components/actions/action-bar.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAA;AACzH,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAA0B,MAAM,qCAAqC,CAAA;AA0HpH,kBAAkB;AAClB,MAAM,UAAU,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyC;IAC7G,MAAM,SAAS,GAAG,uBAAuB,CAAiB,qBAAqB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1H,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC","sourcesContent":["import React from 'react'\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper'\nimport { FrontendComponentType, CorePresetNames, ActionLabelDisplayMode } from '@wildo-ai/presets-components-models'\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas'\nimport { type ButtonVariants_Variant } from './button'\nimport { type ActionButtonSize } from './action-button'\nimport type { ResourceOperationRiskLevel } from '@wildo-ai/saas-models'\nimport type { DisplayDirection } from '@wildo-ai/zod-decorators'\n\n// --- Contract ---\n\n/**\n * An anchored panel this action opens instead of firing `onClick`.\n *\n * The bar owns the ANCHORING and nothing else: what goes in the panel is the caller's, which keeps\n * the bar free of any knowledge of resources, forms or operations.\n *\n * **A host that cannot anchor must fall back to `onClick`.** An item collapsed into the `…` overflow\n * menu or nested in a subgroup is already inside an open dropdown, and anchoring a second floating\n * layer to a row of the first is a nested-overlay problem with no good answer — the panel traps\n * focus the dropdown is still holding, and dismissing either one is ambiguous. Both are therefore\n * rendered as ordinary items, and `onClick` is expected to reach a host that CAN present the same\n * input (an overlay). An item carrying `popover` must always carry `onClick` too.\n */\nexport interface ActionBarButtonPopover {\n  open: boolean\n  onOpenChange: (open: boolean) => void\n  content: React.ReactNode\n  /** Accessible name for the panel. Falls back to the action's own label. */\n  title?: string\n}\n\n/**\n * Why an action cannot run right now, and — when there is one — the single step that makes it\n * runnable.\n *\n * An unavailable action stays FOCUSABLE (`aria-disabled`, not the native `disabled`, which removes it\n * from the tab order and swallows the click), and activating it opens a panel that says why. A greyed\n * button that explains nothing is the pattern this replaces: the person cannot tell \"not allowed\"\n * from \"not applicable to these rows\" from \"broken\", and a keyboard or screen-reader user cannot even\n * reach it to wonder.\n *\n * `resolve` exists for the case where the fix is one click away — a bulk action that 2 of 5 selected\n * rows do not qualify for offers \"Keep only the 3 eligible\". It never runs the action itself: the\n * person narrows, looks, and then acts.\n */\nexport interface ActionBarUnavailability {\n  /** Localized, specific reason — never a generic \"not available\". */\n  reason: string\n  resolve?: { label: string; onSelect: () => void }\n}\n\nexport interface ActionBarButton {\n  type?: \"button\"\n  icon: React.ReactNode\n  label: string\n  onClick?: () => void\n  variant?: ButtonVariants_Variant\n  disabled?: boolean\n  /**\n   * Set instead of `disabled` when the host can say WHY — see {@link ActionBarUnavailability}.\n   * `disabled` without a reason remains for states that genuinely have none to give (an action\n   * already running).\n   */\n  unavailability?: ActionBarUnavailability\n  /** This action is RUNNING — shown in progress and not pressable again until it ends. */\n  busy?: boolean\n  className?: string\n  featureLocked?: boolean\n  featureAvailability?: Record<string, unknown>\n  /** Backend risk classification of the operation; lets a host (e.g. the danger\n   *  zone) pick risk-specific copy. Carried through, never rendered by ActionBar. */\n  riskLevel?: ResourceOperationRiskLevel\n  /** Operation identifier — lets a host resolve per-operation i18n, e.g.\n   *  `tResourceOperation(resourceType, operationIdentifier, 'description')`. */\n  operationIdentifier?: string\n  /**\n   * Render this action as an anchored panel rather than a plain button — see\n   * {@link ActionBarButtonPopover}, including when a host must ignore it.\n   */\n  popover?: ActionBarButtonPopover\n}\n\nexport interface ActionBarSeparator {\n  type: \"separator\"\n}\n\nexport interface ActionBarSubGroup {\n  type: \"subgroup\"\n  icon: React.ReactNode\n  label: string\n  items: ActionBarItem[]\n  variant?: ButtonVariants_Variant\n  disabled?: boolean\n  className?: string\n  riskLevel?: ResourceOperationRiskLevel\n  operationIdentifier?: string\n}\n\nexport type ActionBarItem = ActionBarButton | ActionBarSeparator | ActionBarSubGroup\n\nexport interface ActionBarProps {\n  items: ActionBarItem[]\n  maxDisplayed?: number\n  size?: ActionButtonSize\n  /**\n   * How the bar's actions render their labels. When omitted, the bar falls\n   * back to the app-wide default (`ComponentStyleTheme.actionLabelDisplayMode`\n   * via `useUI()`). `INLINE` renders label text inside each button; `TOOLTIP`\n   * keeps buttons icon-only with tooltip labels; `DROPDOWN` collapses every\n   * action into the `…` overflow menu (icon + label per row).\n   */\n  labelDisplayMode?: ActionLabelDisplayMode\n  /**\n   * Lay the buttons out as a horizontal row (default) or a vertical stack.\n   * Drives the toolbar's flex direction, `aria-orientation`, the inter-item\n   * separator axis, and the arrow-key navigation axis. Used e.g. by a card whose\n   * `cardActionPlacement.orientation` is `VERTICAL`.\n   */\n  orientation?: DisplayDirection\n  'aria-label'?: string\n  className?: string\n}\n\n// --- Wrapper ---\nexport function ActionBar({ preset = CorePresetNames.DEFAULT, ...props }: ActionBarProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<ActionBarProps>(FrontendComponentType.LOW_LEVEL_ACTION_BAR, 'ActionBar')(preset)\n  return <Component {...props} />\n}\n"]}
+{"version":3,"file":"action-bar.js","sourceRoot":"","sources":["../../../../../src/components/actions/action-bar.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAA;AACzH,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAA0B,MAAM,qCAAqC,CAAA;AAOpH,mBAAmB;AAEnB;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,oEAAoE;IACpE,yCAAe,CAAA;IACf,+EAA+E;IAC/E,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC;AAqHD,kBAAkB;AAClB,MAAM,UAAU,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyC;IAC7G,MAAM,SAAS,GAAG,uBAAuB,CAAiB,qBAAqB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1H,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC","sourcesContent":["import React from 'react'\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper'\nimport { FrontendComponentType, CorePresetNames, ActionLabelDisplayMode } from '@wildo-ai/presets-components-models'\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas'\nimport { type ButtonVariants_Variant } from './button'\nimport { type ActionButtonSize } from './action-button'\nimport type { ResourceOperationRiskLevel } from '@wildo-ai/saas-models'\nimport type { DisplayDirection } from '@wildo-ai/zod-decorators'\n\n// --- Contract ---\n\n/**\n * What an anchored panel's BODY is, which decides the panel's own chrome.\n *\n * A form wants the panel's padding around it; a list of options wants none — a menu runs its rows\n * edge to edge, and padding around a command list draws a second frame inside the first. The body\n * knows which it is, so it says so rather than each renderer guessing from the content.\n */\nexport enum ActionBarPopoverChrome {\n  /** A padded panel for a form or other free content. The default. */\n  PANEL = 'panel',\n  /** An unpadded, menu-width panel for a list of options (a DROPDOWN action). */\n  LIST = 'list',\n}\n\n/**\n * An anchored panel this action opens instead of firing `onClick`.\n *\n * The bar owns the ANCHORING and nothing else: what goes in the panel is the caller's, which keeps\n * the bar free of any knowledge of resources, forms or operations.\n *\n * **A host that cannot anchor must fall back to `onClick`.** An item collapsed into the `…` overflow\n * menu or nested in a subgroup is already inside an open dropdown, and anchoring a second floating\n * layer to a row of the first is a nested-overlay problem with no good answer — the panel traps\n * focus the dropdown is still holding, and dismissing either one is ambiguous. Both are therefore\n * rendered as ordinary items, and `onClick` is expected to reach a host that CAN present the same\n * input (an overlay). An item carrying `popover` must always carry `onClick` too.\n */\nexport interface ActionBarButtonPopover {\n  open: boolean\n  onOpenChange: (open: boolean) => void\n  content: React.ReactNode\n  /** Accessible name for the panel. Falls back to the action's own label. */\n  title?: string\n  /** What the body is — see {@link ActionBarPopoverChrome}. Omitted means PANEL. */\n  chrome?: ActionBarPopoverChrome\n}\n\n/**\n * Why an action cannot run right now, and — when there is one — the single step that makes it\n * runnable.\n *\n * An unavailable action stays FOCUSABLE (`aria-disabled`, not the native `disabled`, which removes it\n * from the tab order and swallows the click), and activating it opens a panel that says why. A greyed\n * button that explains nothing is the pattern this replaces: the person cannot tell \"not allowed\"\n * from \"not applicable to these rows\" from \"broken\", and a keyboard or screen-reader user cannot even\n * reach it to wonder.\n *\n * `resolve` exists for the case where the fix is one click away — a bulk action that 2 of 5 selected\n * rows do not qualify for offers \"Keep only the 3 eligible\". It never runs the action itself: the\n * person narrows, looks, and then acts.\n */\nexport interface ActionBarUnavailability {\n  /** Localized, specific reason — never a generic \"not available\". */\n  reason: string\n  resolve?: { label: string; onSelect: () => void }\n}\n\nexport interface ActionBarButton {\n  type?: \"button\"\n  icon: React.ReactNode\n  label: string\n  onClick?: () => void\n  variant?: ButtonVariants_Variant\n  disabled?: boolean\n  /**\n   * Set instead of `disabled` when the host can say WHY — see {@link ActionBarUnavailability}.\n   * `disabled` without a reason remains for states that genuinely have none to give (an action\n   * already running).\n   */\n  unavailability?: ActionBarUnavailability\n  /** This action is RUNNING — shown in progress and not pressable again until it ends. */\n  busy?: boolean\n  className?: string\n  featureLocked?: boolean\n  featureAvailability?: Record<string, unknown>\n  /** Backend risk classification of the operation; lets a host (e.g. the danger\n   *  zone) pick risk-specific copy. Carried through, never rendered by ActionBar. */\n  riskLevel?: ResourceOperationRiskLevel\n  /** Operation identifier — lets a host resolve per-operation i18n, e.g.\n   *  `tResourceOperation(resourceType, operationIdentifier, 'description')`. */\n  operationIdentifier?: string\n  /**\n   * Render this action as an anchored panel rather than a plain button — see\n   * {@link ActionBarButtonPopover}, including when a host must ignore it.\n   */\n  popover?: ActionBarButtonPopover\n}\n\nexport interface ActionBarSeparator {\n  type: \"separator\"\n}\n\nexport interface ActionBarSubGroup {\n  type: \"subgroup\"\n  icon: React.ReactNode\n  label: string\n  items: ActionBarItem[]\n  variant?: ButtonVariants_Variant\n  disabled?: boolean\n  className?: string\n  riskLevel?: ResourceOperationRiskLevel\n  operationIdentifier?: string\n}\n\nexport type ActionBarItem = ActionBarButton | ActionBarSeparator | ActionBarSubGroup\n\nexport interface ActionBarProps {\n  items: ActionBarItem[]\n  maxDisplayed?: number\n  size?: ActionButtonSize\n  /**\n   * How the bar's actions render their labels. When omitted, the bar falls\n   * back to the app-wide default (`ComponentStyleTheme.actionLabelDisplayMode`\n   * via `useUI()`). `INLINE` renders label text inside each button; `TOOLTIP`\n   * keeps buttons icon-only with tooltip labels; `DROPDOWN` collapses every\n   * action into the `…` overflow menu (icon + label per row).\n   */\n  labelDisplayMode?: ActionLabelDisplayMode\n  /**\n   * Lay the buttons out as a horizontal row (default) or a vertical stack.\n   * Drives the toolbar's flex direction, `aria-orientation`, the inter-item\n   * separator axis, and the arrow-key navigation axis. Used e.g. by a card whose\n   * `cardActionPlacement.orientation` is `VERTICAL`.\n   */\n  orientation?: DisplayDirection\n  'aria-label'?: string\n  className?: string\n}\n\n// --- Wrapper ---\nexport function ActionBar({ preset = CorePresetNames.DEFAULT, ...props }: ActionBarProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<ActionBarProps>(FrontendComponentType.LOW_LEVEL_ACTION_BAR, 'ActionBar')(preset)\n  return <Component {...props} />\n}\n"]}

package/dist/esm/components/ai-elements/decision/approval.d.ts

@@ -2,7 +2,62 @@ import React from 'react';
 import type { SerializableZodSchema } from '@wildo-ai/zod-decorators';
 import { ComponentPresetProps } from '../../../core/components-registry/component-registry.frontend.schemas';
 import type { ComponentProps } from 'react';
-export type AI_ApprovalRequestProps = ComponentProps<"div"> & {
+/** One person a decision may be moved to, as the surface shows them. `value` is their id. */
+export type AI_ApprovalReassignCandidate = {
+    value: string;
+    label: string;
+};
+/** One reason a decision's clocks may be paused for (#1628). `value` is the gate's pause-state identifier. */
+export type AI_ApprovalPauseStateOption = {
+    value: string;
+    label: string;
+};
+/**
+ * One reason an approver may give for changing or rejecting an agent's proposal (#1921). `value` is a code of the
+ * application's declared vocabulary (`agentWorkReview.reasonCodes`); `label` is its word, as LOCALIZED text the
+ * surface's owner resolved from `system_enums.AgentWorkReasonCode.<code>` — the code itself when no word is authored.
+ */
+export type AI_ApprovalReasonCodeOption = {
+    value: string;
+    label: string;
+};
+/**
+ * What else a person may do with a decision besides answering it (#1594 D12). Each is offered only when its
+ * callback is supplied, so a surface shows exactly the acts its owner can carry out — never a button that
+ * submits into nothing. Declared here as well as on the preset: this module is the contract consumers import.
+ */
+export type AI_ApprovalRoutingProps = {
+    /** Take a decision routed to a role you hold for yourself. */
+    onClaim?: (approvalId: string) => void;
+    /** Give a decision you claimed back to its role. */
+    onUnclaim?: (approvalId: string) => void;
+    /** The reassign picker opened: load who it may go to, and pass them back as `reassignCandidates`. */
+    onReassignOpen?: (approvalId: string) => void;
+    /** Only people who could answer it. Absent while loading; empty when nobody else can. */
+    reassignCandidates?: readonly AI_ApprovalReassignCandidate[];
+    onReassign?: (approvalId: string, targetUserId: string, comment?: string) => void;
+    /** What the last act came to, as LOCALIZED text the surface's owner resolved. Absent when there is nothing to say. */
+    actionNotice?: string;
+    /**
+     * Stop the decision's CLAIM and DECISION deadlines, naming one of `pauseStateOptions` (#1628). Offered only
+     * with at least one option. Pausing never stops the decision from expiring.
+     */
+    onPauseClock?: (approvalId: string, pauseStateRef: string) => void;
+    /** Restart paused deadlines; the paused time is added to them. */
+    onResumeClock?: (approvalId: string) => void;
+    /** The reasons the gate allows its deadlines to be paused for. */
+    pauseStateOptions?: readonly AI_ApprovalPauseStateOption[];
+    /** The next deadline ahead of the decision, as LOCALIZED text the surface's owner resolved. */
+    deadlineNotice?: string;
+    /** Set while its deadlines are paused: why, as LOCALIZED text the surface's owner resolved. */
+    clockPausedNotice?: string;
+};
+export type AI_ApprovalRequestProps = ComponentProps<"div"> & AI_ApprovalRoutingProps & {
+    /**
+     * Whether THIS viewer may answer it (#1594). `false` renders the request with no actions and shows
+     * `actionNotice` instead — a question a reviewer answers. Default `true`.
+     */
+    answerable?: boolean;
     approvalId: string;
     actionDescription: string;
     /**
@@ -50,9 +105,19 @@ export type AI_ApprovalRequestProps = ComponentProps<"div"> & {
      * from their edit rather than from the model's proposal.
      */
     rejectedArguments?: Record<string, unknown>;
-    /** `modifiedToolArgs` is present only when the approver EDITED the arguments (#566). */
-    onApprove?: (approvalId: string, comment?: string, modifiedToolArgs?: Record<string, unknown>) => void;
-    onDeny?: (approvalId: string, comment?: string) => void;
+    /**
+     * The reasons an approver may give when they CHANGE or REJECT the proposal (#1921). Offered only then — approving
+     * the call as proposed is not a correction and needs no reason — and never required: a reason is optional evidence
+     * for the override rate's breakdown, not a gate on answering. Absent or empty: no picker.
+     */
+    reasonCodeOptions?: readonly AI_ApprovalReasonCodeOption[];
+    /**
+     * `modifiedToolArgs` is present only when the approver EDITED the arguments (#566); `reasonCode` only when they gave a
+     * reason for that edit (#1921).
+     */
+    onApprove?: (approvalId: string, comment?: string, modifiedToolArgs?: Record<string, unknown>, reasonCode?: string) => void;
+    /** `reasonCode` is present only when the approver gave a reason for the rejection (#1921). */
+    onDeny?: (approvalId: string, comment?: string, reasonCode?: string) => void;
     onEscalate?: (approvalId: string, comment?: string) => void;
     isProcessing?: boolean;
     createdAt?: Date;
@@ -68,11 +133,36 @@ export type AI_ApprovalQueueItem = {
     requiredRoles?: string[];
     executionContext?: Record<string, unknown>;
     createdAt?: Date;
+    /** The gated tool, rendered as authored (#455). */
+    toolName?: string;
+    /** Which routing acts THIS item offers (#1594). Unset means none. */
+    canEscalate?: boolean;
+    canClaim?: boolean;
+    canUnclaim?: boolean;
+    canReassign?: boolean;
+    reassignCandidates?: readonly AI_ApprovalReassignCandidate[];
+    actionNotice?: string;
+    /** #1628: whether this item offers Pause / Resume, the reasons it may be paused for, and its deadline lines. */
+    canPauseClock?: boolean;
+    canResumeClock?: boolean;
+    pauseStateOptions?: readonly AI_ApprovalPauseStateOption[];
+    deadlineNotice?: string;
+    clockPausedNotice?: string;
+    /** #1921: the reasons a reviewer may give when changing or rejecting this item's proposal. */
+    reasonCodeOptions?: readonly AI_ApprovalReasonCodeOption[];
+    /**
+     * #1921: offer the argument editor on this item — a reviewer may CHANGE the proposed call, not only approve or reject
+     * it. Only for an item whose answer door carries `modifiedToolArgs`; see `AI_ApprovalRequestProps`.
+     */
+    allowArgumentModification?: boolean;
+    /** The gated tool's input-schema descriptor, so the editor offers the tool's fields (#587). */
+    argumentsSchema?: SerializableZodSchema;
 };
-export type AI_ApprovalQueueProps = ComponentProps<"div"> & {
+export type AI_ApprovalQueueProps = ComponentProps<"div"> & Omit<AI_ApprovalRoutingProps, 'reassignCandidates' | 'actionNotice' | 'pauseStateOptions' | 'deadlineNotice' | 'clockPausedNotice'> & {
     items: AI_ApprovalQueueItem[];
-    onApprove?: (approvalId: string, comment?: string) => void;
-    onDeny?: (approvalId: string, comment?: string) => void;
+    /** `modifiedToolArgs` only when the reviewer edited the call; `reasonCode` only when they gave a reason (#1921). */
+    onApprove?: (approvalId: string, comment?: string, modifiedToolArgs?: Record<string, unknown>, reasonCode?: string) => void;
+    onDeny?: (approvalId: string, comment?: string, reasonCode?: string) => void;
     onEscalate?: (approvalId: string, comment?: string) => void;
     processingIds?: Set<string>;
     filter?: string;

package/dist/esm/components/ai-elements/decision/approval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../../../../../src/components/ai-elements/decision/approval.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAA;AACvH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAA;AAI3C,MAAM,MAAM,uBAAuB,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG;IAC5D,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;IAClD,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C;;;;;;;;;OASG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC;;;;OAIG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAA;IACvC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3C,wFAAwF;IACxF,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACtG,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IACvD,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3D,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,yFAAyF;IACzF,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;IAClD,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG;IAC1D,KAAK,EAAE,oBAAoB,EAAE,CAAA;IAC7B,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1D,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IACvD,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3D,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,SAAS,GAAG,aAAa,GAAG,SAAS,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG;IAC9E,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1D,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG;IAChF,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CACtD,CAAA;AAID,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGpJ;AAED,wBAAgB,gBAAgB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGhJ;AAED,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGpJ;AAED,wBAAgB,oBAAoB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,yBAAyB,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGxJ"}
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../../../../../src/components/ai-elements/decision/approval.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAA;AACvH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAA;AAI3C,6FAA6F;AAC7F,MAAM,MAAM,4BAA4B,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E,8GAA8G;AAC9G,MAAM,MAAM,2BAA2B,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1E;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1E;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;IACtC,oDAAoD;IACpD,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,qGAAqG;IACrG,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7C,yFAAyF;IACzF,kBAAkB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAA;IAC5D,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IACjF,sHAAsH;IACtH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAA;IAClE,kEAAkE;IAClE,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAA;IAC1D,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,uBAAuB,GAAG;IACtF;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;IAClD,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C;;;;;;;;;OASG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC;;;;OAIG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAA;IACvC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAA;IAC1D;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3H,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5E,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3D,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,yFAAyF;IACzF,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;IAClD,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qEAAqE;IACrE,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,kBAAkB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAA;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gHAAgH;IAChH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,iBAAiB,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAA;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAA;IAC1D;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,+FAA+F;IAC/F,eAAe,CAAC,EAAE,qBAAqB,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,uBAAuB,EAAE,oBAAoB,GAAG,cAAc,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,mBAAmB,CAAC,GAAG;IAChM,KAAK,EAAE,oBAAoB,EAAE,CAAA;IAC7B,oHAAoH;IACpH,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3H,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5E,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3D,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,SAAS,GAAG,aAAa,GAAG,SAAS,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG;IAC9E,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1D,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG;IAChF,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CACtD,CAAA;AAID,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGpJ;AAED,wBAAgB,gBAAgB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGhJ;AAED,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGpJ;AAED,wBAAgB,oBAAoB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,yBAAyB,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGxJ"}

package/dist/esm/components/ai-elements/decision/approval.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../../../../src/components/ai-elements/decision/approval.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAE5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAA;AAiHzH,mBAAmB;AAEnB,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAkD;IAC/H,MAAM,SAAS,GAAG,uBAAuB,CAA0B,qBAAqB,CAAC,6BAA6B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;IACrJ,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAgD;IAC3H,MAAM,SAAS,GAAG,uBAAuB,CAAwB,qBAAqB,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;IAC/I,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAkD;IAC/H,MAAM,SAAS,GAAG,uBAAuB,CAA0B,qBAAqB,CAAC,6BAA6B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;IACrJ,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAoD;IACnI,MAAM,SAAS,GAAG,uBAAuB,CAA4B,qBAAqB,CAAC,gCAAgC,EAAE,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAA;IAC5J,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC","sourcesContent":["import React from 'react'\nimport { FrontendComponentType, CorePresetNames } from '@wildo-ai/presets-components-models'\nimport type { SerializableZodSchema } from '@wildo-ai/zod-decorators'\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper'\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas'\nimport type { ComponentProps } from 'react'\n\n// --- Contracts ---\n\nexport type AI_ApprovalRequestProps = ComponentProps<\"div\"> & {\n  approvalId: string\n  actionDescription: string\n  /**\n   * OPTIONAL, because nothing populates it — see the preset implementation's note. Absent means no\n   * risk badge; a default would assert a severity nobody declared (#528).\n   */\n  riskLevel?: \"low\" | \"medium\" | \"high\" | \"critical\"\n  executionId: string\n  systemRef?: string\n  expiresAt?: Date\n  requiredRoles?: string[]\n  /**\n   * The gated tool call, and the arguments proposed for it.\n   *\n   * `toolName` is an IDENTIFIER, rendered as authored — it is the thing the agent asked to run,\n   * and humanizing it here would invent display text no i18n tree owns.\n   * `executionContext` carries the arguments (#455).\n   */\n  toolName?: string\n  executionContext?: Record<string, unknown>\n  /**\n   * Offer the approver an EDITOR over the proposed arguments (#566) — see the preset implementation\n   * for why this is opt-in per surface: turning it on changes what an approval MEANS, from assenting\n   * to the agent's call to authoring one.\n   *\n   * Declared HERE as well as on the preset because this module is the CONTRACT every consumer\n   * imports; the preset behind it is reached through the registry. A prop added only to the preset\n   * is invisible to callers and rejected by this type — which is exactly what happened while adding\n   * it, and is the resolver hop `positive-evidence-must-name-its-target.md` records.\n   */\n  allowArgumentModification?: boolean\n  /**\n   * The gated tool's input schema as a `SerializableZodSchema` descriptor (#587). When present and\n   * renderable, the argument editor offers the tool's fields instead of raw JSON; the raw editor stays\n   * reachable, and is the fallback for any shape the fields cannot express.\n   */\n  argumentsSchema?: SerializableZodSchema\n  /**\n   * The server's refusal of the last submitted edit (#587). The approval is still pending, so the\n   * editor stays open and shows why.\n   */\n  argumentModificationError?: string\n  /**\n   * The arguments the approver submitted when that edit was refused (#587), so the reopened editor starts\n   * from their edit rather than from the model's proposal.\n   */\n  rejectedArguments?: Record<string, unknown>\n  /** `modifiedToolArgs` is present only when the approver EDITED the arguments (#566). */\n  onApprove?: (approvalId: string, comment?: string, modifiedToolArgs?: Record<string, unknown>) => void\n  onDeny?: (approvalId: string, comment?: string) => void\n  onEscalate?: (approvalId: string, comment?: string) => void\n  isProcessing?: boolean\n  createdAt?: Date\n}\n\nexport type AI_ApprovalQueueItem = {\n  approvalId: string\n  executionId: string\n  systemRef: string\n  actionDescription: string\n  /** OPTIONAL for the same reason as on a single request — nothing populates it (#528). */\n  riskLevel?: \"low\" | \"medium\" | \"high\" | \"critical\"\n  expiresAt?: Date\n  requiredRoles?: string[]\n  executionContext?: Record<string, unknown>\n  createdAt?: Date\n}\n\nexport type AI_ApprovalQueueProps = ComponentProps<\"div\"> & {\n  items: AI_ApprovalQueueItem[]\n  onApprove?: (approvalId: string, comment?: string) => void\n  onDeny?: (approvalId: string, comment?: string) => void\n  onEscalate?: (approvalId: string, comment?: string) => void\n  processingIds?: Set<string>\n  filter?: string\n  onFilterChange?: (filter: string) => void\n}\n\nexport type AI_DecisionOption = {\n  id: string\n  label: string\n  description?: string\n  variant?: \"default\" | \"destructive\" | \"outline\"\n}\n\nexport type AI_DecisionRequestProps = Omit<ComponentProps<\"div\">, \"onSelect\"> & {\n  decisionId: string\n  title: string\n  description: string\n  options: AI_DecisionOption[]\n  riskLevel?: string\n  deadline?: string\n  undoGracePeriodMs?: number\n  onSelect?: (decisionId: string, optionId: string) => void\n}\n\nexport type AI_HumanInputRequestProps = Omit<ComponentProps<\"div\">, \"onSubmit\"> & {\n  requestId: string\n  prompt: string\n  inputType?: \"text\" | \"textarea\"\n  placeholder?: string\n  maxLength?: number\n  deadline?: string\n  onSubmit?: (requestId: string, value: string) => void\n}\n\n// --- Wrappers ---\n\nexport function AI_ApprovalRequest({ preset = CorePresetNames.DEFAULT, ...props }: AI_ApprovalRequestProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<AI_ApprovalRequestProps>(FrontendComponentType.LOW_LEVEL_AI_APPROVAL_REQUEST, 'AI_ApprovalRequest')(preset)\n  return <Component {...props} />\n}\n\nexport function AI_ApprovalQueue({ preset = CorePresetNames.DEFAULT, ...props }: AI_ApprovalQueueProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<AI_ApprovalQueueProps>(FrontendComponentType.LOW_LEVEL_AI_APPROVAL_QUEUE, 'AI_ApprovalQueue')(preset)\n  return <Component {...props} />\n}\n\nexport function AI_DecisionRequest({ preset = CorePresetNames.DEFAULT, ...props }: AI_DecisionRequestProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<AI_DecisionRequestProps>(FrontendComponentType.LOW_LEVEL_AI_DECISION_REQUEST, 'AI_DecisionRequest')(preset)\n  return <Component {...props} />\n}\n\nexport function AI_HumanInputRequest({ preset = CorePresetNames.DEFAULT, ...props }: AI_HumanInputRequestProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<AI_HumanInputRequestProps>(FrontendComponentType.LOW_LEVEL_AI_HUMAN_INPUT_REQUEST, 'AI_HumanInputRequest')(preset)\n  return <Component {...props} />\n}\n"]}
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../../../../src/components/ai-elements/decision/approval.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAE5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAA;AAsMzH,mBAAmB;AAEnB,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAkD;IAC/H,MAAM,SAAS,GAAG,uBAAuB,CAA0B,qBAAqB,CAAC,6BAA6B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;IACrJ,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAgD;IAC3H,MAAM,SAAS,GAAG,uBAAuB,CAAwB,qBAAqB,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;IAC/I,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAkD;IAC/H,MAAM,SAAS,GAAG,uBAAuB,CAA0B,qBAAqB,CAAC,6BAA6B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;IACrJ,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAoD;IACnI,MAAM,SAAS,GAAG,uBAAuB,CAA4B,qBAAqB,CAAC,gCAAgC,EAAE,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAA;IAC5J,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAA;AACjC,CAAC","sourcesContent":["import React from 'react'\nimport { FrontendComponentType, CorePresetNames } from '@wildo-ai/presets-components-models'\nimport type { SerializableZodSchema } from '@wildo-ai/zod-decorators'\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper'\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas'\nimport type { ComponentProps } from 'react'\n\n// --- Contracts ---\n\n/** One person a decision may be moved to, as the surface shows them. `value` is their id. */\nexport type AI_ApprovalReassignCandidate = { value: string; label: string }\n\n/** One reason a decision's clocks may be paused for (#1628). `value` is the gate's pause-state identifier. */\nexport type AI_ApprovalPauseStateOption = { value: string; label: string }\n\n/**\n * One reason an approver may give for changing or rejecting an agent's proposal (#1921). `value` is a code of the\n * application's declared vocabulary (`agentWorkReview.reasonCodes`); `label` is its word, as LOCALIZED text the\n * surface's owner resolved from `system_enums.AgentWorkReasonCode.<code>` — the code itself when no word is authored.\n */\nexport type AI_ApprovalReasonCodeOption = { value: string; label: string }\n\n/**\n * What else a person may do with a decision besides answering it (#1594 D12). Each is offered only when its\n * callback is supplied, so a surface shows exactly the acts its owner can carry out — never a button that\n * submits into nothing. Declared here as well as on the preset: this module is the contract consumers import.\n */\nexport type AI_ApprovalRoutingProps = {\n  /** Take a decision routed to a role you hold for yourself. */\n  onClaim?: (approvalId: string) => void\n  /** Give a decision you claimed back to its role. */\n  onUnclaim?: (approvalId: string) => void\n  /** The reassign picker opened: load who it may go to, and pass them back as `reassignCandidates`. */\n  onReassignOpen?: (approvalId: string) => void\n  /** Only people who could answer it. Absent while loading; empty when nobody else can. */\n  reassignCandidates?: readonly AI_ApprovalReassignCandidate[]\n  onReassign?: (approvalId: string, targetUserId: string, comment?: string) => void\n  /** What the last act came to, as LOCALIZED text the surface's owner resolved. Absent when there is nothing to say. */\n  actionNotice?: string\n  /**\n   * Stop the decision's CLAIM and DECISION deadlines, naming one of `pauseStateOptions` (#1628). Offered only\n   * with at least one option. Pausing never stops the decision from expiring.\n   */\n  onPauseClock?: (approvalId: string, pauseStateRef: string) => void\n  /** Restart paused deadlines; the paused time is added to them. */\n  onResumeClock?: (approvalId: string) => void\n  /** The reasons the gate allows its deadlines to be paused for. */\n  pauseStateOptions?: readonly AI_ApprovalPauseStateOption[]\n  /** The next deadline ahead of the decision, as LOCALIZED text the surface's owner resolved. */\n  deadlineNotice?: string\n  /** Set while its deadlines are paused: why, as LOCALIZED text the surface's owner resolved. */\n  clockPausedNotice?: string\n}\n\nexport type AI_ApprovalRequestProps = ComponentProps<\"div\"> & AI_ApprovalRoutingProps & {\n  /**\n   * Whether THIS viewer may answer it (#1594). `false` renders the request with no actions and shows\n   * `actionNotice` instead — a question a reviewer answers. Default `true`.\n   */\n  answerable?: boolean\n  approvalId: string\n  actionDescription: string\n  /**\n   * OPTIONAL, because nothing populates it — see the preset implementation's note. Absent means no\n   * risk badge; a default would assert a severity nobody declared (#528).\n   */\n  riskLevel?: \"low\" | \"medium\" | \"high\" | \"critical\"\n  executionId: string\n  systemRef?: string\n  expiresAt?: Date\n  requiredRoles?: string[]\n  /**\n   * The gated tool call, and the arguments proposed for it.\n   *\n   * `toolName` is an IDENTIFIER, rendered as authored — it is the thing the agent asked to run,\n   * and humanizing it here would invent display text no i18n tree owns.\n   * `executionContext` carries the arguments (#455).\n   */\n  toolName?: string\n  executionContext?: Record<string, unknown>\n  /**\n   * Offer the approver an EDITOR over the proposed arguments (#566) — see the preset implementation\n   * for why this is opt-in per surface: turning it on changes what an approval MEANS, from assenting\n   * to the agent's call to authoring one.\n   *\n   * Declared HERE as well as on the preset because this module is the CONTRACT every consumer\n   * imports; the preset behind it is reached through the registry. A prop added only to the preset\n   * is invisible to callers and rejected by this type — which is exactly what happened while adding\n   * it, and is the resolver hop `positive-evidence-must-name-its-target.md` records.\n   */\n  allowArgumentModification?: boolean\n  /**\n   * The gated tool's input schema as a `SerializableZodSchema` descriptor (#587). When present and\n   * renderable, the argument editor offers the tool's fields instead of raw JSON; the raw editor stays\n   * reachable, and is the fallback for any shape the fields cannot express.\n   */\n  argumentsSchema?: SerializableZodSchema\n  /**\n   * The server's refusal of the last submitted edit (#587). The approval is still pending, so the\n   * editor stays open and shows why.\n   */\n  argumentModificationError?: string\n  /**\n   * The arguments the approver submitted when that edit was refused (#587), so the reopened editor starts\n   * from their edit rather than from the model's proposal.\n   */\n  rejectedArguments?: Record<string, unknown>\n  /**\n   * The reasons an approver may give when they CHANGE or REJECT the proposal (#1921). Offered only then — approving\n   * the call as proposed is not a correction and needs no reason — and never required: a reason is optional evidence\n   * for the override rate's breakdown, not a gate on answering. Absent or empty: no picker.\n   */\n  reasonCodeOptions?: readonly AI_ApprovalReasonCodeOption[]\n  /**\n   * `modifiedToolArgs` is present only when the approver EDITED the arguments (#566); `reasonCode` only when they gave a\n   * reason for that edit (#1921).\n   */\n  onApprove?: (approvalId: string, comment?: string, modifiedToolArgs?: Record<string, unknown>, reasonCode?: string) => void\n  /** `reasonCode` is present only when the approver gave a reason for the rejection (#1921). */\n  onDeny?: (approvalId: string, comment?: string, reasonCode?: string) => void\n  onEscalate?: (approvalId: string, comment?: string) => void\n  isProcessing?: boolean\n  createdAt?: Date\n}\n\nexport type AI_ApprovalQueueItem = {\n  approvalId: string\n  executionId: string\n  systemRef: string\n  actionDescription: string\n  /** OPTIONAL for the same reason as on a single request — nothing populates it (#528). */\n  riskLevel?: \"low\" | \"medium\" | \"high\" | \"critical\"\n  expiresAt?: Date\n  requiredRoles?: string[]\n  executionContext?: Record<string, unknown>\n  createdAt?: Date\n  /** The gated tool, rendered as authored (#455). */\n  toolName?: string\n  /** Which routing acts THIS item offers (#1594). Unset means none. */\n  canEscalate?: boolean\n  canClaim?: boolean\n  canUnclaim?: boolean\n  canReassign?: boolean\n  reassignCandidates?: readonly AI_ApprovalReassignCandidate[]\n  actionNotice?: string\n  /** #1628: whether this item offers Pause / Resume, the reasons it may be paused for, and its deadline lines. */\n  canPauseClock?: boolean\n  canResumeClock?: boolean\n  pauseStateOptions?: readonly AI_ApprovalPauseStateOption[]\n  deadlineNotice?: string\n  clockPausedNotice?: string\n  /** #1921: the reasons a reviewer may give when changing or rejecting this item's proposal. */\n  reasonCodeOptions?: readonly AI_ApprovalReasonCodeOption[]\n  /**\n   * #1921: offer the argument editor on this item — a reviewer may CHANGE the proposed call, not only approve or reject\n   * it. Only for an item whose answer door carries `modifiedToolArgs`; see `AI_ApprovalRequestProps`.\n   */\n  allowArgumentModification?: boolean\n  /** The gated tool's input-schema descriptor, so the editor offers the tool's fields (#587). */\n  argumentsSchema?: SerializableZodSchema\n}\n\nexport type AI_ApprovalQueueProps = ComponentProps<\"div\"> & Omit<AI_ApprovalRoutingProps, 'reassignCandidates' | 'actionNotice' | 'pauseStateOptions' | 'deadlineNotice' | 'clockPausedNotice'> & {\n  items: AI_ApprovalQueueItem[]\n  /** `modifiedToolArgs` only when the reviewer edited the call; `reasonCode` only when they gave a reason (#1921). */\n  onApprove?: (approvalId: string, comment?: string, modifiedToolArgs?: Record<string, unknown>, reasonCode?: string) => void\n  onDeny?: (approvalId: string, comment?: string, reasonCode?: string) => void\n  onEscalate?: (approvalId: string, comment?: string) => void\n  processingIds?: Set<string>\n  filter?: string\n  onFilterChange?: (filter: string) => void\n}\n\nexport type AI_DecisionOption = {\n  id: string\n  label: string\n  description?: string\n  variant?: \"default\" | \"destructive\" | \"outline\"\n}\n\nexport type AI_DecisionRequestProps = Omit<ComponentProps<\"div\">, \"onSelect\"> & {\n  decisionId: string\n  title: string\n  description: string\n  options: AI_DecisionOption[]\n  riskLevel?: string\n  deadline?: string\n  undoGracePeriodMs?: number\n  onSelect?: (decisionId: string, optionId: string) => void\n}\n\nexport type AI_HumanInputRequestProps = Omit<ComponentProps<\"div\">, \"onSubmit\"> & {\n  requestId: string\n  prompt: string\n  inputType?: \"text\" | \"textarea\"\n  placeholder?: string\n  maxLength?: number\n  deadline?: string\n  onSubmit?: (requestId: string, value: string) => void\n}\n\n// --- Wrappers ---\n\nexport function AI_ApprovalRequest({ preset = CorePresetNames.DEFAULT, ...props }: AI_ApprovalRequestProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<AI_ApprovalRequestProps>(FrontendComponentType.LOW_LEVEL_AI_APPROVAL_REQUEST, 'AI_ApprovalRequest')(preset)\n  return <Component {...props} />\n}\n\nexport function AI_ApprovalQueue({ preset = CorePresetNames.DEFAULT, ...props }: AI_ApprovalQueueProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<AI_ApprovalQueueProps>(FrontendComponentType.LOW_LEVEL_AI_APPROVAL_QUEUE, 'AI_ApprovalQueue')(preset)\n  return <Component {...props} />\n}\n\nexport function AI_DecisionRequest({ preset = CorePresetNames.DEFAULT, ...props }: AI_DecisionRequestProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<AI_DecisionRequestProps>(FrontendComponentType.LOW_LEVEL_AI_DECISION_REQUEST, 'AI_DecisionRequest')(preset)\n  return <Component {...props} />\n}\n\nexport function AI_HumanInputRequest({ preset = CorePresetNames.DEFAULT, ...props }: AI_HumanInputRequestProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<AI_HumanInputRequestProps>(FrontendComponentType.LOW_LEVEL_AI_HUMAN_INPUT_REQUEST, 'AI_HumanInputRequest')(preset)\n  return <Component {...props} />\n}\n"]}

package/dist/esm/components/app/AppLayout_AuthenticatedRoute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppLayout_AuthenticatedRoute.d.ts","sourceRoot":"","sources":["../../../../../src/components/app/AppLayout_AuthenticatedRoute.tsx"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAA4B,MAAM,OAAO,CAAC;AAoBjD,UAAU,iCAAiC;IACzC,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA+CD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,4BAA4B,EAAE,KAAK,CAAC,EAAE,CAAC,iCAAiC,CA2DpF,CAAC"}
+{"version":3,"file":"AppLayout_AuthenticatedRoute.d.ts","sourceRoot":"","sources":["../../../../../src/components/app/AppLayout_AuthenticatedRoute.tsx"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAwC,MAAM,OAAO,CAAC;AAqB7D,UAAU,iCAAiC;IACzC,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA+CD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,4BAA4B,EAAE,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAgEpF,CAAC"}

package/dist/esm/components/app/AppLayout_AuthenticatedRoute.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 /**
  * AppLayout_AuthenticatedRoute
  *
@@ -8,7 +8,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
  * This ensures that ALL authenticated routes (resource pages, home, etc.)
  * are wrapped with the application shell (sidebar, menubar, etc.)
  */
-import { useEffect, useRef } from 'react';
+import { useContext, useEffect, useRef } from 'react';
 import { Outlet, Navigate, useLocation, useNavigate } from 'react-router-dom';
 import { ErrorCustomMessageReference, ErrorType } from '@wildo-ai/saas-models';
 import { useUserOrgs } from '../../core/security/useUserOrgs.js';
@@ -24,6 +24,7 @@ import { LoadingSpinner } from '../../components/feedback/loading-spinner.js';
 import { AppLayout_MainContainer } from './AppLayout_MainContainer.js';
 import { AppLayout_ConsentGate } from './AppLayout_ConsentGate.js';
 import { AppLayout_DocumentAcceptanceGate } from './AppLayout_DocumentAcceptanceGate.js';
+import { ApplicationContext } from '../../core/runtime/ApplicationContext.shared.js';
 /**
  * A spinner in place of page content.
  *
@@ -73,6 +74,7 @@ const AppLayout_OrganizationAccessRefused = () => {
  */
 export const AppLayout_AuthenticatedRoute = ({ redirectTo = CommonRoutePaths.login, }) => {
     const { auth } = useUserOrgs();
+    const shellCompanions = useContext(ApplicationContext)?.shellCompanions ?? [];
     const appScope = useAppScopeSafe();
     const location = useLocation();
     const routeOrganizationAccess = useRouteOrganizationAccess();
@@ -112,6 +114,9 @@ export const AppLayout_AuthenticatedRoute = ({ redirectTo = CommonRoutePaths.log
     // being asked about processing: while an acceptance is owed the consent gate is not rendered at all,
     // and its non-blocking prompt cannot float over the acceptance panel. Both wrap the whole shell, for the
     // reason above. See `AppLayout_DocumentAcceptanceGate`.
-    return (_jsx(AppLayout_DocumentAcceptanceGate, { children: _jsx(AppLayout_ConsentGate, { children: _jsx(AppLayout_MainContainer, { children: routeContent }) }) }));
+    // Shell companions (`ApplicationMainProviderOptions.shellCompanions`) sit beside the shell, inside both
+    // gates and only once the session is restored: they live exactly as long as the signed-in shell does,
+    // on every page, and never read before a person has agreed to what the application does.
+    return (_jsx(AppLayout_DocumentAcceptanceGate, { children: _jsxs(AppLayout_ConsentGate, { children: [shellCompanions.map((Companion, index) => _jsx(Companion, {}, index)), _jsx(AppLayout_MainContainer, { children: routeContent })] }) }));
 };
 //# sourceMappingURL=AppLayout_AuthenticatedRoute.js.map

package/dist/esm/components/app/AppLayout_AuthenticatedRoute.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppLayout_AuthenticatedRoute.js","sourceRoot":"","sources":["../../../../../src/components/app/AppLayout_AuthenticatedRoute.tsx"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;AAEH,OAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8DAA8D,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,4EAA4E,CAAC;AACrH,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0EAA0E,CAAC;AACzH,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAOtF;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAa,GAAG,EAAE,CAAC,CAC/C,cAAK,SAAS,EAAC,uDAAuD,YACpE,KAAC,cAAc,KAAG,GACd,CACP,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,mCAAmC,GAAa,GAAG,EAAE;IACzD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,aAAa,EAAE,GAAG,eAAe,EAAE,CAAC;IAC5C,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC1B,aAAa,CAAC,6BAA6B,CACzC,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC,EAAE,EAChI,EAAE,WAAW,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,CACnD,CAAC,CAAC;QACH,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IAE7D,OAAO,KAAC,wBAAwB,KAAG,CAAC;AACtC,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAgD,CAAC,EACxF,UAAU,GAAG,gBAAgB,CAAC,KAAK,GACpC,EAAE,EAAE;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,uBAAuB,GAAG,0BAA0B,EAAE,CAAC;IAC7D,MAAM,qBAAqB,GAAG,QAAQ,EAAE,qBAAqB,CAAC;IAC9D,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC3C,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE/E,wCAAwC;IACxC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,iBAAiB,EAAE,OAAO,SAAG,CAAC;IACrD,CAAC;IAED,qEAAqE;IACrE,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjF,OAAO,CACL,KAAC,uBAAuB,cACtB,KAAC,wBAAwB,KAAG,GACJ,CAC3B,CAAC;IACJ,CAAC;IAED,wGAAwG;IACxG,wGAAwG;IACxG,0GAA0G;IAC1G,kDAAkD;IAClD,IAAI,YAAY,GAAoB,KAAC,MAAM,KAAG,CAAC;IAC/C,IAAI,uBAAuB,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAClE,YAAY,GAAG,KAAC,wBAAwB,KAAG,CAAC;IAC9C,CAAC;SAAM,IAAI,uBAAuB,KAAK,uBAAuB,CAAC,OAAO,EAAE,CAAC;QACvE,YAAY,GAAG,KAAC,mCAAmC,KAAG,CAAC;IACzD,CAAC;IAED,kGAAkG;IAClG,0GAA0G;IAC1G,2GAA2G;IAC3G,4GAA4G;IAC5G,yGAAyG;IACzG,6FAA6F;IAC7F,2BAA2B;IAC3B,qGAAqG;IACrG,qGAAqG;IACrG,yGAAyG;IACzG,wDAAwD;IACxD,OAAO,CACL,KAAC,gCAAgC,cAC/B,KAAC,qBAAqB,cACpB,KAAC,uBAAuB,cACrB,YAAY,GACW,GACJ,GACS,CACpC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * AppLayout_AuthenticatedRoute\n *\n * Layout route component for authenticated pages.\n * Uses React Router's Outlet to render nested routes inside the MainContainer shell.\n *\n * This ensures that ALL authenticated routes (resource pages, home, etc.)\n * are wrapped with the application shell (sidebar, menubar, etc.)\n */\n\nimport React, { useEffect, useRef } from 'react';\nimport { Outlet, Navigate, useLocation, useNavigate } from 'react-router-dom';\nimport { ErrorCustomMessageReference, ErrorType } from '@wildo-ai/saas-models';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  buildAuthRedirectTarget,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { useRouteOrganizationAccess } from '~wildo-frontend-lib/core/security/useRouteOrganizationAccess';\nimport { RouteOrganizationAccess } from '~wildo-frontend-lib/core/security/route-organization-access.frontend.utils';\nimport { useNotification } from '~wildo-frontend-lib/core/events/useNotification';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { resolveUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/user-facing-error-message.frontend.utils';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { AppLayout_MainContainer } from './AppLayout_MainContainer';\nimport { AppLayout_ConsentGate } from './AppLayout_ConsentGate';\nimport { AppLayout_DocumentAcceptanceGate } from './AppLayout_DocumentAcceptanceGate';\n\ninterface AppLayout_AuthenticatedRouteProps {\n  /** Redirect path for unauthenticated users */\n  redirectTo?: string;\n}\n\n/**\n * A spinner in place of page content.\n *\n * I-5: the registry-resolved `LoadingSpinner` exposes `role=\"status\"` + `aria-live=\"polite\"` for screen\n * readers; no text is rendered here intentionally — i18n is not guaranteed to be ready during the early\n * auth-restore phase, and a localized aria-label would couple this layout to a component-scope translation\n * key it has no natural home for.\n */\nconst AppLayout_ContentLoading: React.FC = () => (\n  <div className=\"flex items-center justify-center w-full min-h-[200px]\">\n    <LoadingSpinner />\n  </div>\n);\n\n/**\n * Leaves a route whose organization the server refused to this account: sends it to the home page and says why.\n *\n * The words come from `errors_messages` / `errors_guidance` under\n * {@link ErrorCustomMessageReference.AUTHORIZATION_ORGANIZATION_NOT_ACCESSIBLE}, through the same resolver\n * the global error toast uses, so this notice is authored and translated like every other error.\n *\n * The ref guards a single notice per refusal: StrictMode runs the effect twice, and the translators change\n * identity on every i18n render.\n */\nconst AppLayout_OrganizationAccessRefused: React.FC = () => {\n  const navigate = useNavigate();\n  const { notifyWarning } = useNotification();\n  const { tErrorMessage, tErrorGuidance } = useI18n();\n  const handledRef = useRef(false);\n\n  useEffect(() => {\n    if (handledRef.current) {\n      return;\n    }\n    handledRef.current = true;\n    notifyWarning(resolveUserFacingErrorMessage(\n      { type: ErrorType.AUTHORIZATION, customMessageReference: ErrorCustomMessageReference.AUTHORIZATION_ORGANIZATION_NOT_ACCESSIBLE },\n      { translators: { tErrorMessage, tErrorGuidance } },\n    ));\n    navigate(CommonRoutePaths.home, { replace: true });\n  }, [navigate, notifyWarning, tErrorMessage, tErrorGuidance]);\n\n  return <AppLayout_ContentLoading />;\n};\n\n/**\n * Layout route that wraps authenticated content with MainContainer.\n * Redirects to login if user is not authenticated.\n * Waits while authenticated restore is still unresolved so the shell does not\n * render against prevalidated scope hints. After restore completes, a missing\n * AppScope organization remains a valid authenticated shell state.\n *\n * A route addressing an organization this account cannot open is left for the\n * home page with a notice, before any page content loads (see\n * {@link RouteOrganizationAccess}). This is the one layout every signed-in route\n * renders through, so resource, composite, chart, custom, flows and execution\n * routes are all covered, whatever path brought the person there.\n */\nexport const AppLayout_AuthenticatedRoute: React.FC<AppLayout_AuthenticatedRouteProps> = ({\n  redirectTo = CommonRoutePaths.login,\n}) => {\n  const { auth } = useUserOrgs();\n  const appScope = useAppScopeSafe();\n  const location = useLocation();\n  const routeOrganizationAccess = useRouteOrganizationAccess();\n  const currentOrganizationId = appScope?.currentOrganizationId;\n  const isAuthenticated = !!auth.accessToken;\n  const redirectTarget = buildAuthRedirectTarget(location);\n  const loginRedirectPath = appendAuthRedirectToPath(redirectTo, redirectTarget);\n\n  // Not authenticated - redirect to login\n  if (!isAuthenticated) {\n    return <Navigate to={loginRedirectPath} replace />;\n  }\n\n  // Wait while restore is unresolved so children do not render against\n  // prevalidated organization hints. Once restore is complete, missing org is\n  // still a valid authenticated shell state for org-optional flows.\n  if (auth.isRestoringSession || (!auth.sessionRestored && !currentOrganizationId)) {\n    return (\n      <AppLayout_MainContainer>\n        <AppLayout_ContentLoading />\n      </AppLayout_MainContainer>\n    );\n  }\n\n  // The page's own reads would carry the route's organization, so the route outlet (which syncs the route\n  // into the navigation zones and starts those reads) is withheld until the server has answered. Only the\n  // outlet is swapped: the shell below keeps the same element tree, so the sidebar, menubar and zone stacks\n  // stay mounted while an organization is verified.\n  let routeContent: React.ReactNode = <Outlet />;\n  if (routeOrganizationAccess === RouteOrganizationAccess.VERIFYING) {\n    routeContent = <AppLayout_ContentLoading />;\n  } else if (routeOrganizationAccess === RouteOrganizationAccess.REFUSED) {\n    routeContent = <AppLayout_OrganizationAccessRefused />;\n  }\n\n  // The consent gate wraps the SHELL, never the outlet. Signed-in page content is rendered from the\n  // navigation zone stacks, and this outlet is only the PRIMARY zone's fallback while that stack is empty —\n  // it is unmounted once the route has synced into the stack. A gate around it left the page after that sync\n  // (a live browser never showed the prompt, #977), and the shell could navigate past it. Around the shell it\n  // holds on every signed-in render: a missing REQUIRED purpose withholds the whole application (its panel\n  // carries sign-out), and an undecided optional purpose prompts in a fixed panel over it. See\n  // `AppLayout_ConsentGate`.\n  // The document acceptance gate sits OUTSIDE the consent gate, so a person agrees to the terms before\n  // being asked about processing: while an acceptance is owed the consent gate is not rendered at all,\n  // and its non-blocking prompt cannot float over the acceptance panel. Both wrap the whole shell, for the\n  // reason above. See `AppLayout_DocumentAcceptanceGate`.\n  return (\n    <AppLayout_DocumentAcceptanceGate>\n      <AppLayout_ConsentGate>\n        <AppLayout_MainContainer>\n          {routeContent}\n        </AppLayout_MainContainer>\n      </AppLayout_ConsentGate>\n    </AppLayout_DocumentAcceptanceGate>\n  );\n};\n\n\n"]}
+{"version":3,"file":"AppLayout_AuthenticatedRoute.js","sourceRoot":"","sources":["../../../../../src/components/app/AppLayout_AuthenticatedRoute.tsx"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;AAEH,OAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8DAA8D,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,4EAA4E,CAAC;AACrH,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0EAA0E,CAAC;AACzH,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAOhG;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAa,GAAG,EAAE,CAAC,CAC/C,cAAK,SAAS,EAAC,uDAAuD,YACpE,KAAC,cAAc,KAAG,GACd,CACP,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,mCAAmC,GAAa,GAAG,EAAE;IACzD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,aAAa,EAAE,GAAG,eAAe,EAAE,CAAC;IAC5C,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC1B,aAAa,CAAC,6BAA6B,CACzC,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC,EAAE,EAChI,EAAE,WAAW,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,CACnD,CAAC,CAAC;QACH,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IAE7D,OAAO,KAAC,wBAAwB,KAAG,CAAC;AACtC,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAgD,CAAC,EACxF,UAAU,GAAG,gBAAgB,CAAC,KAAK,GACpC,EAAE,EAAE;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,eAAe,GAAG,UAAU,CAAC,kBAAkB,CAAC,EAAE,eAAe,IAAI,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,uBAAuB,GAAG,0BAA0B,EAAE,CAAC;IAC7D,MAAM,qBAAqB,GAAG,QAAQ,EAAE,qBAAqB,CAAC;IAC9D,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC3C,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE/E,wCAAwC;IACxC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,iBAAiB,EAAE,OAAO,SAAG,CAAC;IACrD,CAAC;IAED,qEAAqE;IACrE,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjF,OAAO,CACL,KAAC,uBAAuB,cACtB,KAAC,wBAAwB,KAAG,GACJ,CAC3B,CAAC;IACJ,CAAC;IAED,wGAAwG;IACxG,wGAAwG;IACxG,0GAA0G;IAC1G,kDAAkD;IAClD,IAAI,YAAY,GAAoB,KAAC,MAAM,KAAG,CAAC;IAC/C,IAAI,uBAAuB,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAClE,YAAY,GAAG,KAAC,wBAAwB,KAAG,CAAC;IAC9C,CAAC;SAAM,IAAI,uBAAuB,KAAK,uBAAuB,CAAC,OAAO,EAAE,CAAC;QACvE,YAAY,GAAG,KAAC,mCAAmC,KAAG,CAAC;IACzD,CAAC;IAED,kGAAkG;IAClG,0GAA0G;IAC1G,2GAA2G;IAC3G,4GAA4G;IAC5G,yGAAyG;IACzG,6FAA6F;IAC7F,2BAA2B;IAC3B,qGAAqG;IACrG,qGAAqG;IACrG,yGAAyG;IACzG,wDAAwD;IACxD,wGAAwG;IACxG,sGAAsG;IACtG,yFAAyF;IACzF,OAAO,CACL,KAAC,gCAAgC,cAC/B,MAAC,qBAAqB,eACnB,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,KAAC,SAAS,MAAM,KAAK,CAAI,CAAC,EACrE,KAAC,uBAAuB,cACrB,YAAY,GACW,IACJ,GACS,CACpC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * AppLayout_AuthenticatedRoute\n *\n * Layout route component for authenticated pages.\n * Uses React Router's Outlet to render nested routes inside the MainContainer shell.\n *\n * This ensures that ALL authenticated routes (resource pages, home, etc.)\n * are wrapped with the application shell (sidebar, menubar, etc.)\n */\n\nimport React, { useContext, useEffect, useRef } from 'react';\nimport { Outlet, Navigate, useLocation, useNavigate } from 'react-router-dom';\nimport { ErrorCustomMessageReference, ErrorType } from '@wildo-ai/saas-models';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  buildAuthRedirectTarget,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { useRouteOrganizationAccess } from '~wildo-frontend-lib/core/security/useRouteOrganizationAccess';\nimport { RouteOrganizationAccess } from '~wildo-frontend-lib/core/security/route-organization-access.frontend.utils';\nimport { useNotification } from '~wildo-frontend-lib/core/events/useNotification';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { resolveUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/user-facing-error-message.frontend.utils';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { AppLayout_MainContainer } from './AppLayout_MainContainer';\nimport { AppLayout_ConsentGate } from './AppLayout_ConsentGate';\nimport { AppLayout_DocumentAcceptanceGate } from './AppLayout_DocumentAcceptanceGate';\nimport { ApplicationContext } from '~wildo-frontend-lib/core/runtime/ApplicationContext.shared';\n\ninterface AppLayout_AuthenticatedRouteProps {\n  /** Redirect path for unauthenticated users */\n  redirectTo?: string;\n}\n\n/**\n * A spinner in place of page content.\n *\n * I-5: the registry-resolved `LoadingSpinner` exposes `role=\"status\"` + `aria-live=\"polite\"` for screen\n * readers; no text is rendered here intentionally — i18n is not guaranteed to be ready during the early\n * auth-restore phase, and a localized aria-label would couple this layout to a component-scope translation\n * key it has no natural home for.\n */\nconst AppLayout_ContentLoading: React.FC = () => (\n  <div className=\"flex items-center justify-center w-full min-h-[200px]\">\n    <LoadingSpinner />\n  </div>\n);\n\n/**\n * Leaves a route whose organization the server refused to this account: sends it to the home page and says why.\n *\n * The words come from `errors_messages` / `errors_guidance` under\n * {@link ErrorCustomMessageReference.AUTHORIZATION_ORGANIZATION_NOT_ACCESSIBLE}, through the same resolver\n * the global error toast uses, so this notice is authored and translated like every other error.\n *\n * The ref guards a single notice per refusal: StrictMode runs the effect twice, and the translators change\n * identity on every i18n render.\n */\nconst AppLayout_OrganizationAccessRefused: React.FC = () => {\n  const navigate = useNavigate();\n  const { notifyWarning } = useNotification();\n  const { tErrorMessage, tErrorGuidance } = useI18n();\n  const handledRef = useRef(false);\n\n  useEffect(() => {\n    if (handledRef.current) {\n      return;\n    }\n    handledRef.current = true;\n    notifyWarning(resolveUserFacingErrorMessage(\n      { type: ErrorType.AUTHORIZATION, customMessageReference: ErrorCustomMessageReference.AUTHORIZATION_ORGANIZATION_NOT_ACCESSIBLE },\n      { translators: { tErrorMessage, tErrorGuidance } },\n    ));\n    navigate(CommonRoutePaths.home, { replace: true });\n  }, [navigate, notifyWarning, tErrorMessage, tErrorGuidance]);\n\n  return <AppLayout_ContentLoading />;\n};\n\n/**\n * Layout route that wraps authenticated content with MainContainer.\n * Redirects to login if user is not authenticated.\n * Waits while authenticated restore is still unresolved so the shell does not\n * render against prevalidated scope hints. After restore completes, a missing\n * AppScope organization remains a valid authenticated shell state.\n *\n * A route addressing an organization this account cannot open is left for the\n * home page with a notice, before any page content loads (see\n * {@link RouteOrganizationAccess}). This is the one layout every signed-in route\n * renders through, so resource, composite, chart, custom, flows and execution\n * routes are all covered, whatever path brought the person there.\n */\nexport const AppLayout_AuthenticatedRoute: React.FC<AppLayout_AuthenticatedRouteProps> = ({\n  redirectTo = CommonRoutePaths.login,\n}) => {\n  const { auth } = useUserOrgs();\n  const shellCompanions = useContext(ApplicationContext)?.shellCompanions ?? [];\n  const appScope = useAppScopeSafe();\n  const location = useLocation();\n  const routeOrganizationAccess = useRouteOrganizationAccess();\n  const currentOrganizationId = appScope?.currentOrganizationId;\n  const isAuthenticated = !!auth.accessToken;\n  const redirectTarget = buildAuthRedirectTarget(location);\n  const loginRedirectPath = appendAuthRedirectToPath(redirectTo, redirectTarget);\n\n  // Not authenticated - redirect to login\n  if (!isAuthenticated) {\n    return <Navigate to={loginRedirectPath} replace />;\n  }\n\n  // Wait while restore is unresolved so children do not render against\n  // prevalidated organization hints. Once restore is complete, missing org is\n  // still a valid authenticated shell state for org-optional flows.\n  if (auth.isRestoringSession || (!auth.sessionRestored && !currentOrganizationId)) {\n    return (\n      <AppLayout_MainContainer>\n        <AppLayout_ContentLoading />\n      </AppLayout_MainContainer>\n    );\n  }\n\n  // The page's own reads would carry the route's organization, so the route outlet (which syncs the route\n  // into the navigation zones and starts those reads) is withheld until the server has answered. Only the\n  // outlet is swapped: the shell below keeps the same element tree, so the sidebar, menubar and zone stacks\n  // stay mounted while an organization is verified.\n  let routeContent: React.ReactNode = <Outlet />;\n  if (routeOrganizationAccess === RouteOrganizationAccess.VERIFYING) {\n    routeContent = <AppLayout_ContentLoading />;\n  } else if (routeOrganizationAccess === RouteOrganizationAccess.REFUSED) {\n    routeContent = <AppLayout_OrganizationAccessRefused />;\n  }\n\n  // The consent gate wraps the SHELL, never the outlet. Signed-in page content is rendered from the\n  // navigation zone stacks, and this outlet is only the PRIMARY zone's fallback while that stack is empty —\n  // it is unmounted once the route has synced into the stack. A gate around it left the page after that sync\n  // (a live browser never showed the prompt, #977), and the shell could navigate past it. Around the shell it\n  // holds on every signed-in render: a missing REQUIRED purpose withholds the whole application (its panel\n  // carries sign-out), and an undecided optional purpose prompts in a fixed panel over it. See\n  // `AppLayout_ConsentGate`.\n  // The document acceptance gate sits OUTSIDE the consent gate, so a person agrees to the terms before\n  // being asked about processing: while an acceptance is owed the consent gate is not rendered at all,\n  // and its non-blocking prompt cannot float over the acceptance panel. Both wrap the whole shell, for the\n  // reason above. See `AppLayout_DocumentAcceptanceGate`.\n  // Shell companions (`ApplicationMainProviderOptions.shellCompanions`) sit beside the shell, inside both\n  // gates and only once the session is restored: they live exactly as long as the signed-in shell does,\n  // on every page, and never read before a person has agreed to what the application does.\n  return (\n    <AppLayout_DocumentAcceptanceGate>\n      <AppLayout_ConsentGate>\n        {shellCompanions.map((Companion, index) => <Companion key={index} />)}\n        <AppLayout_MainContainer>\n          {routeContent}\n        </AppLayout_MainContainer>\n      </AppLayout_ConsentGate>\n    </AppLayout_DocumentAcceptanceGate>\n  );\n};\n\n\n"]}

package/dist/esm/components/auth/Auth_EnrollmentRequired.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_EnrollmentRequired.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_EnrollmentRequired.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAsBjF,OAAO,qEAAqE,CAAC;AAC7E,OAAO,wEAAwE,CAAC;AAChF,OAAO,sEAAsE,CAAC;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAIxH,MAAM,WAAW,kDAAkD;CAAG;AAQtE;;;;;;;;GAQG;AACH,eAAO,MAAM,6CAA6C,GAAI,QAAQ,kDAAkD,KAAG,KAAK,CAAC,GAAG,CAAC,OAkQpI,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,kDAAkD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGpL"}
+{"version":3,"file":"Auth_EnrollmentRequired.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_EnrollmentRequired.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAuBjF,OAAO,qEAAqE,CAAC;AAC7E,OAAO,wEAAwE,CAAC;AAChF,OAAO,sEAAsE,CAAC;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAIxH,MAAM,WAAW,kDAAkD;CAAG;AAQtE;;;;;;;;GAQG;AACH,eAAO,MAAM,6CAA6C,GAAI,QAAQ,kDAAkD,KAAG,KAAK,CAAC,GAAG,CAAC,OAqQpI,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,kDAAkD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGpL"}

package/dist/esm/components/auth/Auth_EnrollmentRequired.js

@@ -4,6 +4,7 @@ import { Navigate, useLocation, useNavigate } from 'react-router-dom';
 import { ButtonSize, CorePresetNames, EnrollmentRequiredLabel, FrontendComponentType } from '@wildo-ai/presets-components-models';
 import { AuthMethod } from '@wildo-ai/saas-models';
 import { useAuthSession } from '../../core/security/useAuthSession.js';
+import { useUserOrgs } from '../../core/security/useUserOrgs.js';
 import { organizationOnboardingNavigationTarget } from '../../core/security/organization-onboarding.frontend.utils.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
 import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
@@ -34,7 +35,10 @@ const METHOD_DISPLAY_LABELS = {
  * All user-facing strings are i18n-driven via EnrollmentRequiredLabel.
  */
 export const PublicLayoutPreset_EnrollmentRequired_Default = (_props) => {
-    const { auth, logout, completeEnrollmentSession, getSessionState, adoptPendingMfaSession } = useAuthSession();
+    const { auth, completeEnrollmentSession, getSessionState, adoptPendingMfaSession } = useAuthSession();
+    // Signing out goes through `UserOrgsProvider`, which announces the person's departure before their consent is
+    // cleared (#1977). The auth session's own `logout` skips that announcement.
+    const { logout } = useUserOrgs();
     const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED });
     const navigate = useNavigate();
     const location = useLocation();

package/dist/esm/components/auth/Auth_EnrollmentRequired.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_EnrollmentRequired.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_EnrollmentRequired.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,sCAAsC,EAAE,MAAM,0EAA0E,CAAC;AAClI,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AAExE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6EAA6E,CAAC;AAC3H,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AAC9H,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,8EAA8E,CAAC;AAC9I,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAEnG,OAAO,qEAAqE,CAAC;AAC7E,OAAO,wEAAwE,CAAC;AAChF,OAAO,sEAAsE,CAAC;AAG9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAK1H,MAAM,qBAAqB,GAA4C;IACrE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,uBAAuB,CAAC,UAAU;IACrD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC,aAAa;IAC3D,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC,WAAW;CAC1D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,MAA0D,EAAqB,EAAE;IAC7I,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,eAAe,EAAE,sBAAsB,EAAE,GAAG,cAAc,EAAE,CAAC;IAC9G,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IACrG,MAAM,kBAAkB,GAAG,OAAO,CAChC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EACpD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClB,CAAC;IACF,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACxF,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,oBAAoB,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvE,MAAM,iBAAiB,GAAG,YAAY,IAAI,oBAAoB,EAAE,SAAS,IAAI,IAAI,CAAC;IAClF,MAAM,aAAa,GAAG,QAAQ,IAAI,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC;IACpE,MAAM,oBAAoB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,iBAAiB,CAAC;IAC3F,MAAM,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,yBAAyB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,oBAAoB,IAAI,CAAC,iBAAiB,IAAI,yBAAyB,CAAC,OAAO;YAAE,OAAO;QAC7F,yBAAyB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEzC,yGAAyG;QACzG,2BAA2B;QAC3B,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC9B,IAAI,oBAAoB,EAAE,SAAS,KAAK,iBAAiB;gBAAE,uBAAuB,EAAE,CAAC;QACvF,CAAC,CAAC;QAEF,eAAe,CAAC,iBAAiB,CAAC;aAC/B,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;YACrB,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC;gBAAE,kBAAkB,EAAE,CAAC;QACrF,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAyC,EAAE,EAAE;YACnD,qGAAqG;YACrG,mFAAmF;YACnF,MAAM,MAAM,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;YACvC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;gBAAE,kBAAkB,EAAE,CAAC;QAC7D,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,OAAO,CACvB,GAAG,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAC1E,CAAC,kBAAkB,CAAC,CACrB,CAAC;IACF,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC9C,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClB,CAAC;IAEF,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAC;IAC9E,MAAM,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAExD,MAAM,iBAAiB,GAAG,OAAO,CAC/B,GAAG,EAAE,CAAE,IAAI,CAAC,0BAA2C,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,EACpG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAClC,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC;QACpC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,wBAAwB,CAAC,gBAAgB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrF,CAAC;QAED,wGAAwG;QACxG,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,aAAa,CAAC;QAC1D,OAAO,wBAAwB,CAC7B,GAAG,gBAAgB,CAAC,YAAY,cAAc,SAAS,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAC5F,kBAAkB,CACnB,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAEvF;;;;;;;;;;;;;OAaG;IACH,MAAM,wBAAwB,GAAG,WAAW,CAAC,CAAC,UAAgD,EAAE,EAAE;QAChG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9B,UAAU,CAAC,GAAG,EAAE;YACd,QAAQ,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAE5D,MAAM,qBAAqB,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE;QACxD,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,qHAAqH;IACrH,MAAM,4BAA4B,GAAG,sCAAsC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtG,IAAI,4BAA4B,EAAE,CAAC;QACjC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,4BAA4B,EAAE,OAAO,SAAG,CAAC;IAChE,CAAC;IAED,mGAAmG;IACnG,qGAAqG;IACrG,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,gGAAgG;QAChG,yFAAyF;QACzF,IAAI,oBAAoB,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACpD,OAAO,mBAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,qBAAqB,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACjF,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,oGAAoG;IACpG,sDAAsD;IACtD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,CACL,eAAK,SAAS,EAAC,0BAA0B,aACvC,cAAK,SAAS,EAAC,6BAA6B,YAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,GACjD,EACN,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,GAAoB,GAChF,EACR,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,YACxF,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,GAClC,IACL,CACP,CAAC;IACJ,CAAC;IAED,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,GAAoB,GAC1E,EACR,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAQ,IACvF,CACP,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/F,OAAO,CACL,eAAK,SAAS,EAAC,0BAA0B,aACvC,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YACrD,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAClC,IACH,EAEL,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EAEA,CAAC,cAAc,IAAI,CAClB,eAAK,SAAS,EAAC,cAAc,aAC3B,KAAC,IAAI,IAAC,SAAS,EAAC,iCAAiC,YAC9C,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,GACpC,EACP,KAAC,oBAAoB,IACnB,MAAM,EAAE,sBAAsB,CAAC,IAAI,EACnC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,EAChE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GACpE,IACE,CACP,EAEA,cAAc,IAAI,iBAAiB,IAAI,CACtC,eAAK,SAAS,EAAC,cAAc,aAC3B,eAAK,SAAS,EAAC,yBAAyB,aACtC,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,KAAK,EACrC,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAGpD,EACT,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAClC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,GACtD,IACH,EACN,KAAC,iBAAiB,IAChB,SAAS,EAAE,IAAI,CAAC,YAAY,IAAI,SAAS,EACzC,UAAU,EAAE,wBAAwB,EACpC,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,GACJ,IACE,CACP,EAED,cAAK,SAAS,EAAC,MAAM,YACnB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,YACxF,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,GAClC,GACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAA6E;IAC/J,MAAM,SAAS,GAAG,uBAAuB,CAAqD,qBAAqB,CAAC,kCAAkC,EAAE,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3L,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate, useLocation, useNavigate } from 'react-router-dom';\nimport { ButtonSize, CorePresetNames, EnrollmentRequiredLabel, FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport { AuthMethod } from '@wildo-ai/saas-models';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { organizationOnboardingNavigationTarget } from '~wildo-frontend-lib/core/security/organization-onboarding.frontend.utils';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  extractAuthRedirectFromSearch,\n  resolvePostAuthRedirect,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport type { EnrollmentSessionSettlementResponse } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ENROLLMENT_METHOD_COMPONENTS } from '~wildo-frontend-lib/components/auth/enrollment/enrollment-method-components';\nimport { AuthMethodChoiceLayout, AuthMethodChoiceList } from '~wildo-frontend-lib/components/auth/utils/AuthMethodChoiceList';\nimport { forgetPendingMfaSession, readPendingMfaSession } from '~wildo-frontend-lib/core/security/pending-mfa-session-storage.frontend.utils';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport '~wildo-frontend-lib/components/auth/enrollment/TotpEnrollmentMethod';\nimport '~wildo-frontend-lib/components/auth/enrollment/PasskeyEnrollmentMethod';\nimport '~wildo-frontend-lib/components/auth/enrollment/PhoneEnrollmentMethod';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n// --- Contract ---\nexport interface PublicLayoutPreset_EnrollmentRequired_DefaultProps {}\n\nconst METHOD_DISPLAY_LABELS: Record<string, EnrollmentRequiredLabel> = {\n  [AuthMethod.TOTP]: EnrollmentRequiredLabel.TOTP_TITLE,\n  [AuthMethod.PASSKEY]: EnrollmentRequiredLabel.PASSKEY_TITLE,\n  [AuthMethod.SMS_OTP]: EnrollmentRequiredLabel.PHONE_TITLE,\n};\n\n/**\n * MFA enrollment required default preset.\n *\n * Displayed when the user's organization requires MFA but the user has\n * not enrolled any second-factor method yet. Offers enrollment options\n * and redirects to MFA challenge upon completion.\n *\n * All user-facing strings are i18n-driven via EnrollmentRequiredLabel.\n */\nexport const PublicLayoutPreset_EnrollmentRequired_Default = (_props: PublicLayoutPreset_EnrollmentRequired_DefaultProps): React.JSX.Element => {\n  const { auth, logout, completeEnrollmentSession, getSessionState, adoptPendingMfaSession } = useAuthSession();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED });\n  const navigate = useNavigate();\n  const location = useLocation();\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, key);\n  const authRedirectTarget = useMemo(\n    () => extractAuthRedirectFromSearch(location.search),\n    [location.search],\n  );\n  const { urlSessionId, urlEmail } = useMemo(() => {\n    const params = new URLSearchParams(location.search);\n    return { urlSessionId: params.get('sessionId'), urlEmail: params.get('email') || '' };\n  }, [location.search]);\n\n  /*\n   * Recover the session when this page was LOADED with an empty auth context rather than routed to.\n   *\n   * Every in-app arrival here finds the context already holding the session. A hard load does not, and this\n   * screen used to read ONLY the context, so it sent a valid session to sign-in. Two routes lead here, and\n   * each leaves the session somewhere a reload can find it:\n   * - the MFA CHALLENGE, itself loaded from a URL carrying `sessionId`, passes `sessionId`/`email` on in the\n   *   gate URL — ids its own URL already showed (#1033);\n   * - the in-app hand-off from sign-in, registration, email confirmation, invitation and magic link\n   *   (`useMfaContinuationNavigation`) carries NOTHING in the URL — a registration or invitation session\n   *   issues tokens and lives 24h — so a reload after it recovers from the tab-scoped copy the auth provider\n   *   keeps (`pending-mfa-session-storage.frontend.utils.ts`, #1068).\n   *\n   * The URL wins when both exist: it names the session this exact navigation was made for. Storage is read\n   * ONCE, in the first render — before any effect runs — so the provider's own bookkeeping cannot race it.\n   *\n   * A session in a state the server no longer admits second-factor work on, or one the server no longer\n   * knows, is not adopted, its stored copy is forgotten, and the sign-in bounce below proceeds as before.\n   */\n  const [storedPendingSession] = useState(() => readPendingMfaSession());\n  const recoverySessionId = urlSessionId ?? storedPendingSession?.sessionId ?? null;\n  const recoveryEmail = urlEmail || storedPendingSession?.email || '';\n  const needsSessionRecovery = !auth.accessToken && !auth.mfaRequired && !!recoverySessionId;\n  const [sessionRecoverySettled, setSessionRecoverySettled] = useState(false);\n  const sessionRecoveryStartedRef = useRef(false);\n\n  useEffect(() => {\n    if (!needsSessionRecovery || !recoverySessionId || sessionRecoveryStartedRef.current) return;\n    sessionRecoveryStartedRef.current = true;\n\n    // Only a copy of THIS session is dropped: a URL-named session failing says nothing about a different one\n    // the tab still remembers.\n    const forgetIfRemembered = () => {\n      if (storedPendingSession?.sessionId === recoverySessionId) forgetPendingMfaSession();\n    };\n\n    getSessionState(recoverySessionId)\n      .then((sessionState) => {\n        if (!adoptPendingMfaSession(recoverySessionId, sessionState)) forgetIfRemembered();\n      })\n      .catch((error: { response?: { status?: number } }) => {\n        // Forget only what the server says is GONE. A transient failure leaves the copy for the next reload,\n        // matching how the challenge screen tells an expired session from a generic error.\n        const status = error?.response?.status;\n        if (status === 404 || status === 410) forgetIfRemembered();\n      })\n      .finally(() => setSessionRecoverySettled(true));\n  }, [needsSessionRecovery, recoverySessionId, storedPendingSession, getSessionState, adoptPendingMfaSession]);\n  const loginPath = useMemo(\n    () => appendAuthRedirectToPath(CommonRoutePaths.login, authRedirectTarget),\n    [authRedirectTarget],\n  );\n  const postAuthRedirect = useMemo(\n    () => resolvePostAuthRedirect(location.search),\n    [location.search],\n  );\n\n  const [selectedMethod, setSelectedMethod] = useState<AuthMethod | null>(null);\n  const [enrolledSuccessfully, setEnrolledSuccessfully] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  const enrollableOptions = useMemo(\n    () => (auth.availableEnrollmentMethods as AuthMethod[]).filter(m => ENROLLMENT_METHOD_COMPONENTS[m]),\n    [auth.availableEnrollmentMethods],\n  );\n\n  const mfaChallengePath = useMemo(() => {\n    const sessionId = auth.mfaSessionId;\n    if (!sessionId) {\n      return appendAuthRedirectToPath(CommonRoutePaths.mfaChallenge, authRedirectTarget);\n    }\n\n    // A recovered session has no identification response behind it, so the recovered email is the fallback.\n    const email = auth.identification?.email || recoveryEmail;\n    return appendAuthRedirectToPath(\n      `${CommonRoutePaths.mfaChallenge}?sessionId=${sessionId}&email=${encodeURIComponent(email)}`,\n      authRedirectTarget,\n    );\n  }, [auth.mfaSessionId, auth.identification?.email, recoveryEmail, authRedirectTarget]);\n\n  /*\n   * Where enrollment leads depends on the session it was performed on, and the backend has already\n   * decided it (`enrollmentSession` on the ceremony response):\n   * - a REGISTRATION or INVITATION session is COMPLETED by the enrollment itself — the registrant has\n   *   just proven the factor, so there is nothing to challenge. The response carries the access\n   *   token; adopting it signs them in, and the `auth.accessToken` redirect below takes them into the\n   *   application. Sending them to the challenge instead is the dead end #603 records: the session is\n   *   consumed and no door would answer.\n   * - a LOGIN session was moved to `MFA_REQUIRED`, and the enrolled factor is now presented as the\n   *   challenge it still owes.\n   * - a registration settlement that stopped at `ONBOARDING_PENDING` (reachable since #1011) is adopted as a\n   *   parked onboarding session; the organization-onboarding guard below then takes the registrant to name\n   *   their organization, which signs them in (#1090).\n   */\n  const handleEnrollmentComplete = useCallback((settlement?: EnrollmentSessionSettlementResponse) => {\n    setError(null);\n    if (completeEnrollmentSession(settlement)) {\n      return;\n    }\n    setEnrolledSuccessfully(true);\n    setTimeout(() => {\n      navigate(mfaChallengePath, { replace: true });\n    }, 1200);\n  }, [navigate, mfaChallengePath, completeEnrollmentSession]);\n\n  const handleEnrollmentError = useCallback((msg: string) => {\n    setError(msg);\n  }, []);\n\n  // Parked at organization onboarding (#1090): the organization is the only step left, whatever this screen was doing.\n  const organizationOnboardingTarget = organizationOnboardingNavigationTarget(auth, authRedirectTarget);\n  if (organizationOnboardingTarget) {\n    return <Navigate to={organizationOnboardingTarget} replace />;\n  }\n\n  // Signed in — including by an enrollment that completed a registration session. Checked BEFORE the\n  // `mfaRequired` bounce, which that completion clears and would otherwise read as \"go back to login\".\n  if (auth.accessToken && !auth.isLoading) {\n    return <Navigate to={postAuthRedirect} replace />;\n  }\n\n  if (!auth.mfaRequired) {\n    // Not yet: the URL names a session and the recovery above has not answered. Bouncing now is the\n    // defect #1033 records — the session is valid, only this page's memory of it is missing.\n    if (needsSessionRecovery && !sessionRecoverySettled) {\n      return <></>;\n    }\n    return <Navigate to={loginPath} replace />;\n  }\n\n  /*\n   * Hand back to the challenge ONLY when a challenge can actually run.\n   *\n   * This bounce means \"you do not need to enroll anything, go and answer the challenge\" — a sentence\n   * that is only true when something is usable. It used to fire on `enrollableOptions.length === 0`\n   * alone, which made it the other half of a redirect loop: the challenge sends a user here when\n   * nothing is usable, and this sent them straight back when there was nothing to enroll. Both\n   * screens were individually reasonable and the PAIR never terminated.\n   *\n   * Requiring a usable factor breaks the cycle HERE, at the source, rather than relying on the two\n   * screens agreeing about `availableEnrollmentMethods` — which they read from different places (this\n   * one from the auth context, the challenge from its own session fetch), so any backend path that\n   * populates one and not the other would reopen it.\n   */\n  const hasUsableSecondFactor = auth.usableSecondFactorMethods.length > 0;\n  if (auth.mfaSessionId && enrollableOptions.length === 0 && hasUsableSecondFactor) {\n    return <Navigate to={mfaChallengePath} replace />;\n  }\n\n  if (!isReady) return null;\n\n  // Required, nothing usable, nothing enrollable: terminal, and it says so. Only an administrator can\n  // resolve it, so the sole action left is to sign out.\n  if (enrollableOptions.length === 0) {\n    return (\n      <div className=\"space-y-group py-section\">\n        <div className=\"text-center space-y-item-xs\">\n          <Heading>{t(EnrollmentRequiredLabel.TITLE)}</Heading>\n        </div>\n        <Alert>\n          <AlertDescription>{t(EnrollmentRequiredLabel.NO_METHODS_AVAILABLE)}</AlertDescription>\n        </Alert>\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"w-full\" onClick={() => logout()}>\n          {t(EnrollmentRequiredLabel.LOGOUT_BUTTON)}\n        </Button>\n      </div>\n    );\n  }\n\n  if (enrolledSuccessfully) {\n    return (\n      <div className=\"text-center space-y-group py-section\">\n        <Alert>\n          <AlertDescription>{t(EnrollmentRequiredLabel.ENROLL_SUCCESS)}</AlertDescription>\n        </Alert>\n        <Text className=\"text-sm text-muted-foreground\">{t(EnrollmentRequiredLabel.LOADING)}</Text>\n      </div>\n    );\n  }\n\n  const SelectedComponent = selectedMethod ? ENROLLMENT_METHOD_COMPONENTS[selectedMethod] : null;\n\n  return (\n    <div className=\"space-y-group py-section\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>{t(EnrollmentRequiredLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">\n          {t(EnrollmentRequiredLabel.DESCRIPTION)}\n        </Text>\n      </div>\n\n      {error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n      )}\n\n      {!selectedMethod && (\n        <div className=\"space-y-item\">\n          <Text className=\"text-sm font-medium text-center\">\n            {t(EnrollmentRequiredLabel.SELECT_METHOD)}\n          </Text>\n          <AuthMethodChoiceList\n            layout={AuthMethodChoiceLayout.LIST}\n            methods={enrollableOptions}\n            labelFor={(method) => t(METHOD_DISPLAY_LABELS[method] || method)}\n            onSelect={(method) => { setSelectedMethod(method); setError(null); }}\n          />\n        </div>\n      )}\n\n      {selectedMethod && SelectedComponent && (\n        <div className=\"space-y-item\">\n          <div className=\"flex items-center gap-2\">\n            <Button\n              variant={ButtonVariants_Variant.GHOST}\n              size={ButtonSize.SM}\n              onClick={() => { setSelectedMethod(null); setError(null); }}\n            >\n              ←\n            </Button>\n            <Text className=\"text-sm font-medium\">\n              {t(METHOD_DISPLAY_LABELS[selectedMethod] || selectedMethod)}\n            </Text>\n          </div>\n          <SelectedComponent\n            sessionId={auth.mfaSessionId || undefined}\n            onComplete={handleEnrollmentComplete}\n            onError={handleEnrollmentError}\n            isLoading={false}\n            t={t}\n          />\n        </div>\n      )}\n\n      <div className=\"pt-2\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"w-full\" onClick={() => logout()}>\n          {t(EnrollmentRequiredLabel.LOGOUT_BUTTON)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_EnrollmentRequired({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_EnrollmentRequired_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_EnrollmentRequired_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, 'Auth_EnrollmentRequired')(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_EnrollmentRequired.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_EnrollmentRequired.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,0EAA0E,CAAC;AAClI,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AAExE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6EAA6E,CAAC;AAC3H,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AAC9H,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,8EAA8E,CAAC;AAC9I,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAEnG,OAAO,qEAAqE,CAAC;AAC7E,OAAO,wEAAwE,CAAC;AAChF,OAAO,sEAAsE,CAAC;AAG9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAK1H,MAAM,qBAAqB,GAA4C;IACrE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,uBAAuB,CAAC,UAAU;IACrD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC,aAAa;IAC3D,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC,WAAW;CAC1D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,MAA0D,EAAqB,EAAE;IAC7I,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,eAAe,EAAE,sBAAsB,EAAE,GAAG,cAAc,EAAE,CAAC;IACtG,8GAA8G;IAC9G,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IACrG,MAAM,kBAAkB,GAAG,OAAO,CAChC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EACpD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClB,CAAC;IACF,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACxF,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,oBAAoB,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvE,MAAM,iBAAiB,GAAG,YAAY,IAAI,oBAAoB,EAAE,SAAS,IAAI,IAAI,CAAC;IAClF,MAAM,aAAa,GAAG,QAAQ,IAAI,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC;IACpE,MAAM,oBAAoB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,iBAAiB,CAAC;IAC3F,MAAM,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,yBAAyB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,oBAAoB,IAAI,CAAC,iBAAiB,IAAI,yBAAyB,CAAC,OAAO;YAAE,OAAO;QAC7F,yBAAyB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEzC,yGAAyG;QACzG,2BAA2B;QAC3B,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC9B,IAAI,oBAAoB,EAAE,SAAS,KAAK,iBAAiB;gBAAE,uBAAuB,EAAE,CAAC;QACvF,CAAC,CAAC;QAEF,eAAe,CAAC,iBAAiB,CAAC;aAC/B,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;YACrB,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC;gBAAE,kBAAkB,EAAE,CAAC;QACrF,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAyC,EAAE,EAAE;YACnD,qGAAqG;YACrG,mFAAmF;YACnF,MAAM,MAAM,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;YACvC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;gBAAE,kBAAkB,EAAE,CAAC;QAC7D,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,OAAO,CACvB,GAAG,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAC1E,CAAC,kBAAkB,CAAC,CACrB,CAAC;IACF,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC9C,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClB,CAAC;IAEF,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAC;IAC9E,MAAM,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAExD,MAAM,iBAAiB,GAAG,OAAO,CAC/B,GAAG,EAAE,CAAE,IAAI,CAAC,0BAA2C,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,EACpG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAClC,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC;QACpC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,wBAAwB,CAAC,gBAAgB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrF,CAAC;QAED,wGAAwG;QACxG,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,aAAa,CAAC;QAC1D,OAAO,wBAAwB,CAC7B,GAAG,gBAAgB,CAAC,YAAY,cAAc,SAAS,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAC5F,kBAAkB,CACnB,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAEvF;;;;;;;;;;;;;OAaG;IACH,MAAM,wBAAwB,GAAG,WAAW,CAAC,CAAC,UAAgD,EAAE,EAAE;QAChG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9B,UAAU,CAAC,GAAG,EAAE;YACd,QAAQ,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAE5D,MAAM,qBAAqB,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE;QACxD,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,qHAAqH;IACrH,MAAM,4BAA4B,GAAG,sCAAsC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtG,IAAI,4BAA4B,EAAE,CAAC;QACjC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,4BAA4B,EAAE,OAAO,SAAG,CAAC;IAChE,CAAC;IAED,mGAAmG;IACnG,qGAAqG;IACrG,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,gGAAgG;QAChG,yFAAyF;QACzF,IAAI,oBAAoB,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACpD,OAAO,mBAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,qBAAqB,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACjF,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,oGAAoG;IACpG,sDAAsD;IACtD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,CACL,eAAK,SAAS,EAAC,0BAA0B,aACvC,cAAK,SAAS,EAAC,6BAA6B,YAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,GACjD,EACN,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,GAAoB,GAChF,EACR,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,YACxF,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,GAClC,IACL,CACP,CAAC;IACJ,CAAC;IAED,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,GAAoB,GAC1E,EACR,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAQ,IACvF,CACP,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/F,OAAO,CACL,eAAK,SAAS,EAAC,0BAA0B,aACvC,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YACrD,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAClC,IACH,EAEL,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EAEA,CAAC,cAAc,IAAI,CAClB,eAAK,SAAS,EAAC,cAAc,aAC3B,KAAC,IAAI,IAAC,SAAS,EAAC,iCAAiC,YAC9C,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,GACpC,EACP,KAAC,oBAAoB,IACnB,MAAM,EAAE,sBAAsB,CAAC,IAAI,EACnC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,EAChE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GACpE,IACE,CACP,EAEA,cAAc,IAAI,iBAAiB,IAAI,CACtC,eAAK,SAAS,EAAC,cAAc,aAC3B,eAAK,SAAS,EAAC,yBAAyB,aACtC,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,KAAK,EACrC,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAGpD,EACT,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAClC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,GACtD,IACH,EACN,KAAC,iBAAiB,IAChB,SAAS,EAAE,IAAI,CAAC,YAAY,IAAI,SAAS,EACzC,UAAU,EAAE,wBAAwB,EACpC,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,GACJ,IACE,CACP,EAED,cAAK,SAAS,EAAC,MAAM,YACnB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,YACxF,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,GAClC,GACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAA6E;IAC/J,MAAM,SAAS,GAAG,uBAAuB,CAAqD,qBAAqB,CAAC,kCAAkC,EAAE,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3L,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate, useLocation, useNavigate } from 'react-router-dom';\nimport { ButtonSize, CorePresetNames, EnrollmentRequiredLabel, FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport { AuthMethod } from '@wildo-ai/saas-models';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { organizationOnboardingNavigationTarget } from '~wildo-frontend-lib/core/security/organization-onboarding.frontend.utils';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  extractAuthRedirectFromSearch,\n  resolvePostAuthRedirect,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport type { EnrollmentSessionSettlementResponse } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ENROLLMENT_METHOD_COMPONENTS } from '~wildo-frontend-lib/components/auth/enrollment/enrollment-method-components';\nimport { AuthMethodChoiceLayout, AuthMethodChoiceList } from '~wildo-frontend-lib/components/auth/utils/AuthMethodChoiceList';\nimport { forgetPendingMfaSession, readPendingMfaSession } from '~wildo-frontend-lib/core/security/pending-mfa-session-storage.frontend.utils';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport '~wildo-frontend-lib/components/auth/enrollment/TotpEnrollmentMethod';\nimport '~wildo-frontend-lib/components/auth/enrollment/PasskeyEnrollmentMethod';\nimport '~wildo-frontend-lib/components/auth/enrollment/PhoneEnrollmentMethod';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n// --- Contract ---\nexport interface PublicLayoutPreset_EnrollmentRequired_DefaultProps {}\n\nconst METHOD_DISPLAY_LABELS: Record<string, EnrollmentRequiredLabel> = {\n  [AuthMethod.TOTP]: EnrollmentRequiredLabel.TOTP_TITLE,\n  [AuthMethod.PASSKEY]: EnrollmentRequiredLabel.PASSKEY_TITLE,\n  [AuthMethod.SMS_OTP]: EnrollmentRequiredLabel.PHONE_TITLE,\n};\n\n/**\n * MFA enrollment required default preset.\n *\n * Displayed when the user's organization requires MFA but the user has\n * not enrolled any second-factor method yet. Offers enrollment options\n * and redirects to MFA challenge upon completion.\n *\n * All user-facing strings are i18n-driven via EnrollmentRequiredLabel.\n */\nexport const PublicLayoutPreset_EnrollmentRequired_Default = (_props: PublicLayoutPreset_EnrollmentRequired_DefaultProps): React.JSX.Element => {\n  const { auth, completeEnrollmentSession, getSessionState, adoptPendingMfaSession } = useAuthSession();\n  // Signing out goes through `UserOrgsProvider`, which announces the person's departure before their consent is\n  // cleared (#1977). The auth session's own `logout` skips that announcement.\n  const { logout } = useUserOrgs();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED });\n  const navigate = useNavigate();\n  const location = useLocation();\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, key);\n  const authRedirectTarget = useMemo(\n    () => extractAuthRedirectFromSearch(location.search),\n    [location.search],\n  );\n  const { urlSessionId, urlEmail } = useMemo(() => {\n    const params = new URLSearchParams(location.search);\n    return { urlSessionId: params.get('sessionId'), urlEmail: params.get('email') || '' };\n  }, [location.search]);\n\n  /*\n   * Recover the session when this page was LOADED with an empty auth context rather than routed to.\n   *\n   * Every in-app arrival here finds the context already holding the session. A hard load does not, and this\n   * screen used to read ONLY the context, so it sent a valid session to sign-in. Two routes lead here, and\n   * each leaves the session somewhere a reload can find it:\n   * - the MFA CHALLENGE, itself loaded from a URL carrying `sessionId`, passes `sessionId`/`email` on in the\n   *   gate URL — ids its own URL already showed (#1033);\n   * - the in-app hand-off from sign-in, registration, email confirmation, invitation and magic link\n   *   (`useMfaContinuationNavigation`) carries NOTHING in the URL — a registration or invitation session\n   *   issues tokens and lives 24h — so a reload after it recovers from the tab-scoped copy the auth provider\n   *   keeps (`pending-mfa-session-storage.frontend.utils.ts`, #1068).\n   *\n   * The URL wins when both exist: it names the session this exact navigation was made for. Storage is read\n   * ONCE, in the first render — before any effect runs — so the provider's own bookkeeping cannot race it.\n   *\n   * A session in a state the server no longer admits second-factor work on, or one the server no longer\n   * knows, is not adopted, its stored copy is forgotten, and the sign-in bounce below proceeds as before.\n   */\n  const [storedPendingSession] = useState(() => readPendingMfaSession());\n  const recoverySessionId = urlSessionId ?? storedPendingSession?.sessionId ?? null;\n  const recoveryEmail = urlEmail || storedPendingSession?.email || '';\n  const needsSessionRecovery = !auth.accessToken && !auth.mfaRequired && !!recoverySessionId;\n  const [sessionRecoverySettled, setSessionRecoverySettled] = useState(false);\n  const sessionRecoveryStartedRef = useRef(false);\n\n  useEffect(() => {\n    if (!needsSessionRecovery || !recoverySessionId || sessionRecoveryStartedRef.current) return;\n    sessionRecoveryStartedRef.current = true;\n\n    // Only a copy of THIS session is dropped: a URL-named session failing says nothing about a different one\n    // the tab still remembers.\n    const forgetIfRemembered = () => {\n      if (storedPendingSession?.sessionId === recoverySessionId) forgetPendingMfaSession();\n    };\n\n    getSessionState(recoverySessionId)\n      .then((sessionState) => {\n        if (!adoptPendingMfaSession(recoverySessionId, sessionState)) forgetIfRemembered();\n      })\n      .catch((error: { response?: { status?: number } }) => {\n        // Forget only what the server says is GONE. A transient failure leaves the copy for the next reload,\n        // matching how the challenge screen tells an expired session from a generic error.\n        const status = error?.response?.status;\n        if (status === 404 || status === 410) forgetIfRemembered();\n      })\n      .finally(() => setSessionRecoverySettled(true));\n  }, [needsSessionRecovery, recoverySessionId, storedPendingSession, getSessionState, adoptPendingMfaSession]);\n  const loginPath = useMemo(\n    () => appendAuthRedirectToPath(CommonRoutePaths.login, authRedirectTarget),\n    [authRedirectTarget],\n  );\n  const postAuthRedirect = useMemo(\n    () => resolvePostAuthRedirect(location.search),\n    [location.search],\n  );\n\n  const [selectedMethod, setSelectedMethod] = useState<AuthMethod | null>(null);\n  const [enrolledSuccessfully, setEnrolledSuccessfully] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  const enrollableOptions = useMemo(\n    () => (auth.availableEnrollmentMethods as AuthMethod[]).filter(m => ENROLLMENT_METHOD_COMPONENTS[m]),\n    [auth.availableEnrollmentMethods],\n  );\n\n  const mfaChallengePath = useMemo(() => {\n    const sessionId = auth.mfaSessionId;\n    if (!sessionId) {\n      return appendAuthRedirectToPath(CommonRoutePaths.mfaChallenge, authRedirectTarget);\n    }\n\n    // A recovered session has no identification response behind it, so the recovered email is the fallback.\n    const email = auth.identification?.email || recoveryEmail;\n    return appendAuthRedirectToPath(\n      `${CommonRoutePaths.mfaChallenge}?sessionId=${sessionId}&email=${encodeURIComponent(email)}`,\n      authRedirectTarget,\n    );\n  }, [auth.mfaSessionId, auth.identification?.email, recoveryEmail, authRedirectTarget]);\n\n  /*\n   * Where enrollment leads depends on the session it was performed on, and the backend has already\n   * decided it (`enrollmentSession` on the ceremony response):\n   * - a REGISTRATION or INVITATION session is COMPLETED by the enrollment itself — the registrant has\n   *   just proven the factor, so there is nothing to challenge. The response carries the access\n   *   token; adopting it signs them in, and the `auth.accessToken` redirect below takes them into the\n   *   application. Sending them to the challenge instead is the dead end #603 records: the session is\n   *   consumed and no door would answer.\n   * - a LOGIN session was moved to `MFA_REQUIRED`, and the enrolled factor is now presented as the\n   *   challenge it still owes.\n   * - a registration settlement that stopped at `ONBOARDING_PENDING` (reachable since #1011) is adopted as a\n   *   parked onboarding session; the organization-onboarding guard below then takes the registrant to name\n   *   their organization, which signs them in (#1090).\n   */\n  const handleEnrollmentComplete = useCallback((settlement?: EnrollmentSessionSettlementResponse) => {\n    setError(null);\n    if (completeEnrollmentSession(settlement)) {\n      return;\n    }\n    setEnrolledSuccessfully(true);\n    setTimeout(() => {\n      navigate(mfaChallengePath, { replace: true });\n    }, 1200);\n  }, [navigate, mfaChallengePath, completeEnrollmentSession]);\n\n  const handleEnrollmentError = useCallback((msg: string) => {\n    setError(msg);\n  }, []);\n\n  // Parked at organization onboarding (#1090): the organization is the only step left, whatever this screen was doing.\n  const organizationOnboardingTarget = organizationOnboardingNavigationTarget(auth, authRedirectTarget);\n  if (organizationOnboardingTarget) {\n    return <Navigate to={organizationOnboardingTarget} replace />;\n  }\n\n  // Signed in — including by an enrollment that completed a registration session. Checked BEFORE the\n  // `mfaRequired` bounce, which that completion clears and would otherwise read as \"go back to login\".\n  if (auth.accessToken && !auth.isLoading) {\n    return <Navigate to={postAuthRedirect} replace />;\n  }\n\n  if (!auth.mfaRequired) {\n    // Not yet: the URL names a session and the recovery above has not answered. Bouncing now is the\n    // defect #1033 records — the session is valid, only this page's memory of it is missing.\n    if (needsSessionRecovery && !sessionRecoverySettled) {\n      return <></>;\n    }\n    return <Navigate to={loginPath} replace />;\n  }\n\n  /*\n   * Hand back to the challenge ONLY when a challenge can actually run.\n   *\n   * This bounce means \"you do not need to enroll anything, go and answer the challenge\" — a sentence\n   * that is only true when something is usable. It used to fire on `enrollableOptions.length === 0`\n   * alone, which made it the other half of a redirect loop: the challenge sends a user here when\n   * nothing is usable, and this sent them straight back when there was nothing to enroll. Both\n   * screens were individually reasonable and the PAIR never terminated.\n   *\n   * Requiring a usable factor breaks the cycle HERE, at the source, rather than relying on the two\n   * screens agreeing about `availableEnrollmentMethods` — which they read from different places (this\n   * one from the auth context, the challenge from its own session fetch), so any backend path that\n   * populates one and not the other would reopen it.\n   */\n  const hasUsableSecondFactor = auth.usableSecondFactorMethods.length > 0;\n  if (auth.mfaSessionId && enrollableOptions.length === 0 && hasUsableSecondFactor) {\n    return <Navigate to={mfaChallengePath} replace />;\n  }\n\n  if (!isReady) return null;\n\n  // Required, nothing usable, nothing enrollable: terminal, and it says so. Only an administrator can\n  // resolve it, so the sole action left is to sign out.\n  if (enrollableOptions.length === 0) {\n    return (\n      <div className=\"space-y-group py-section\">\n        <div className=\"text-center space-y-item-xs\">\n          <Heading>{t(EnrollmentRequiredLabel.TITLE)}</Heading>\n        </div>\n        <Alert>\n          <AlertDescription>{t(EnrollmentRequiredLabel.NO_METHODS_AVAILABLE)}</AlertDescription>\n        </Alert>\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"w-full\" onClick={() => logout()}>\n          {t(EnrollmentRequiredLabel.LOGOUT_BUTTON)}\n        </Button>\n      </div>\n    );\n  }\n\n  if (enrolledSuccessfully) {\n    return (\n      <div className=\"text-center space-y-group py-section\">\n        <Alert>\n          <AlertDescription>{t(EnrollmentRequiredLabel.ENROLL_SUCCESS)}</AlertDescription>\n        </Alert>\n        <Text className=\"text-sm text-muted-foreground\">{t(EnrollmentRequiredLabel.LOADING)}</Text>\n      </div>\n    );\n  }\n\n  const SelectedComponent = selectedMethod ? ENROLLMENT_METHOD_COMPONENTS[selectedMethod] : null;\n\n  return (\n    <div className=\"space-y-group py-section\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>{t(EnrollmentRequiredLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">\n          {t(EnrollmentRequiredLabel.DESCRIPTION)}\n        </Text>\n      </div>\n\n      {error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n      )}\n\n      {!selectedMethod && (\n        <div className=\"space-y-item\">\n          <Text className=\"text-sm font-medium text-center\">\n            {t(EnrollmentRequiredLabel.SELECT_METHOD)}\n          </Text>\n          <AuthMethodChoiceList\n            layout={AuthMethodChoiceLayout.LIST}\n            methods={enrollableOptions}\n            labelFor={(method) => t(METHOD_DISPLAY_LABELS[method] || method)}\n            onSelect={(method) => { setSelectedMethod(method); setError(null); }}\n          />\n        </div>\n      )}\n\n      {selectedMethod && SelectedComponent && (\n        <div className=\"space-y-item\">\n          <div className=\"flex items-center gap-2\">\n            <Button\n              variant={ButtonVariants_Variant.GHOST}\n              size={ButtonSize.SM}\n              onClick={() => { setSelectedMethod(null); setError(null); }}\n            >\n              ←\n            </Button>\n            <Text className=\"text-sm font-medium\">\n              {t(METHOD_DISPLAY_LABELS[selectedMethod] || selectedMethod)}\n            </Text>\n          </div>\n          <SelectedComponent\n            sessionId={auth.mfaSessionId || undefined}\n            onComplete={handleEnrollmentComplete}\n            onError={handleEnrollmentError}\n            isLoading={false}\n            t={t}\n          />\n        </div>\n      )}\n\n      <div className=\"pt-2\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"w-full\" onClick={() => logout()}>\n          {t(EnrollmentRequiredLabel.LOGOUT_BUTTON)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_EnrollmentRequired({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_EnrollmentRequired_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_EnrollmentRequired_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, 'Auth_EnrollmentRequired')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_Main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Main.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.tsx"],"names":[],"mappings":"AACA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAiDjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAA;AAoEvH,MAAM,WAAW,wCAAwC;CACxD;AAED,eAAO,MAAM,mCAAmC,GAAI,IAAI,wCAAwC,KAAG,KAAK,CAAC,GAAG,CAAC,OAkc5G,CAAC;AAEF,wBAAgB,SAAS,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,wCAAwC,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAI5J"}
+{"version":3,"file":"Auth_Main.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.tsx"],"names":[],"mappings":"AACA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAgDjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAA;AAoEvH,MAAM,WAAW,wCAAwC;CACxD;AAED,eAAO,MAAM,mCAAmC,GAAI,IAAI,wCAAwC,KAAG,KAAK,CAAC,GAAG,CAAC,OAgc5G,CAAC;AAEF,wBAAgB,SAAS,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,wCAAwC,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAI5J"}

package/dist/esm/components/auth/Auth_Main.js

@@ -23,7 +23,6 @@ import { Alert, AlertDescription } from '../../components/overlays/containers/al
 import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
 import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
 import { appendAuthRedirectToPath, extractAuthRedirectFromSearch, resolvePostAuthRedirect, } from '../../core/security/auth-redirect.frontend.utils.js';
-import { useApplication } from '../../core/runtime/useApplication.js';
 import { collectFrontendProviderDisplayLabelKeys } from '../../core/external-providers/frontend-provider-display-label.frontend.utils.js';
 import { resolveOAuthProviderDisplayLabel, resolvePublicOAuthProviderEntries } from '../../components/auth/utils/oauth-provider-display-label.frontend.utils.js';
 import { OAuthProvidersSection, SSO_PROVIDER_BRAND_META } from '../../components/auth/utils/OAuthProvidersSection.js';
@@ -80,15 +79,13 @@ const PASSKEY_AUTOFILL_FIELD_WAIT_MS = 3000;
 export const PublicLayoutPreset_UserAuth_Default = ({}) => {
     const { auth, identifyByEmail, initiateOAuth2Login } = useUserOrgs();
     const { signInWithPasskey } = useAuthSession();
-    const { frontendProviderRegistry } = useApplication();
     const resolvedAuth = useResolvedAuthConfig();
     const location = useLocation();
     const enabledSocialOAuth2Providers = useMemo(() => {
         return resolvePublicOAuthProviderEntries({
             publicProviders: resolvedAuth.globalAuth?.socialOAuth2Providers,
-            frontendProviderRegistry,
         });
-    }, [frontendProviderRegistry, resolvedAuth.globalAuth?.socialOAuth2Providers]);
+    }, [resolvedAuth.globalAuth?.socialOAuth2Providers]);
     const socialOAuth2ProviderLabelKeys = useMemo(() => {
         return collectFrontendProviderDisplayLabelKeys(enabledSocialOAuth2Providers.map((provider) => provider.displayNameLabelKey));
     }, [enabledSocialOAuth2Providers]);