@wildo-ai/saas-frontend-lib 1.1.5 → 1.1.6

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.js

@@ -27,6 +27,7 @@ import { CredentialUsernameAutofillField } from '../../../components/auth/utils/
 import { TotpEnrollmentMethod } from '../../../components/auth/enrollment/TotpEnrollmentMethod.js';
 import { PhoneEnrollmentMethod } from '../../../components/auth/enrollment/PhoneEnrollmentMethod.js';
 import { startRegistration } from '@simplewebauthn/browser';
+import { buildProviderDisplayNameLabelKey } from '@wildo-ai/saas-models/public-runtime';
 import { collectFrontendProviderDisplayLabelKeys, resolveFrontendProviderDisplayLabel, } from '../../../core/external-providers/frontend-provider-display-label.frontend.utils.js';
 /**
  * Presentational state of one authentication factor.
@@ -56,13 +57,17 @@ const FACTOR_STATE_BADGE_VARIANT = {
  * information pre-attentively; the description makes the choice informed. The
  * shape follows the account-security idiom used by mainstream providers.
  */
-const SecurityFactorCard = ({ icon, title, description, state, statusLabel, meta, action, children, }) => {
+const SecurityFactorRow = ({ icon, title, description, state, statusLabel, meta, action, children, }) => {
     const { renderIcon } = useIconRegistry();
     const isActive = state === SecurityFactorState.ACTIVE;
-    return (_jsx(Card, { children: _jsxs(CardContent, { className: "flex flex-col gap-item p-card", children: [_jsxs("div", { className: "flex flex-row items-start gap-item", children: [_jsx("div", { "aria-hidden": "true", className: cn('flex size-9 shrink-0 items-center justify-center rounded-md', isActive ? 'bg-success/10 text-success' : 'bg-muted text-muted-foreground'), children: renderIcon(icon, { size: IconSize.SM }) }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-element-xs", children: [_jsxs("div", { className: "flex flex-wrap items-center gap-element-xs", children: [_jsx(Text, { className: "font-medium leading-snug", children: title }), _jsx(Badge, { variant: FACTOR_STATE_BADGE_VARIANT[state], children: statusLabel })] }), _jsx(Text, { className: "text-sm text-muted-foreground", children: description }), meta] }), action && _jsx("div", { className: "flex shrink-0 items-center gap-element-xs", children: action })] }), children && (_jsx("div", { className: "flex flex-col gap-item ps-[calc(var(--spacing)*9+var(--sp-item))]", children: children }))] }) }));
+    return (
+    // One row of ONE card: the factors are a single list of alternatives, so they share a frame and
+    // are separated by hairlines (the settings-row idiom) rather than each carrying a card of its own —
+    // five stacked cards read as five pages.
+    _jsxs("div", { className: "flex flex-col gap-item py-group first:pt-0 last:pb-0", children: [_jsxs("div", { className: "flex flex-row items-start gap-item", children: [_jsx("div", { "aria-hidden": "true", className: cn('flex size-9 shrink-0 items-center justify-center rounded-md', isActive ? 'bg-success/10 text-success' : 'bg-muted text-muted-foreground'), children: renderIcon(icon, { size: IconSize.SM }) }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-element-xs", children: [_jsxs("div", { className: "flex flex-wrap items-center gap-element-xs", children: [_jsx(Text, { className: "font-medium leading-snug", children: title }), _jsx(Badge, { variant: FACTOR_STATE_BADGE_VARIANT[state], children: statusLabel })] }), !isActive && _jsx(Text, { className: "text-sm text-muted-foreground", children: description }), meta] }), action && _jsx("div", { className: "flex shrink-0 items-center gap-element-xs", children: action })] }), children && (_jsx("div", { className: "flex flex-col gap-item ps-[calc(var(--spacing)*9+var(--sp-item))]", children: children }))] }));
 };
 export const AppPage_SecuritySettings = () => {
-    const { auth, frontendProviderRegistry } = useApplication();
+    const { auth } = useApplication();
     const { auth: authState } = useAuthSession();
     const { user } = useUserOrgs();
     const resolvedAuth = useResolvedAuthConfig();
@@ -76,8 +81,10 @@ export const AppPage_SecuritySettings = () => {
     const [showTotpEnroll, setShowTotpEnroll] = useState(false);
     const [showPhoneEnroll, setShowPhoneEnroll] = useState(false);
     const [passkeyRegistering, setPasskeyRegistering] = useState(false);
-    const identityProviderLabelKeys = useMemo(() => collectFrontendProviderDisplayLabelKeys(identityLinks.map((link) => frontendProviderRegistry?.getProviderByRef(link.providerRef)?.metadata.displayNameLabelKey)), [frontendProviderRegistry, identityLinks]);
-    const { tComponent, t: translateProvider, isReady } = useI18n({
+    // The linked provider's name is `providers.<ref>.displayName`, derived from the ref the link holds
+    // (#1701) — never read off a frontend provider module, since sign-in runs no vendor code in the page.
+    const identityProviderLabelKeys = useMemo(() => collectFrontendProviderDisplayLabelKeys(identityLinks.map((link) => buildProviderDisplayNameLabelKey(link.providerRef))), [identityLinks]);
+    const { tComponent, t: translateProvider, isReady, formatDate } = useI18n({
         component: [
             FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS,
             FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER,
@@ -138,19 +145,14 @@ export const AppPage_SecuritySettings = () => {
     const smsMethod = methods.find((m) => m.method === AuthMethod.SMS_OTP);
     const phoneVerified = smsMethod?.enrolled ?? false;
     const phoneMasked = smsMethod?.details?.phoneNumber;
-    const resolvedIdentityLinks = useMemo(() => identityLinks.map((link) => {
-        const provider = frontendProviderRegistry?.getProviderByRef(link.providerRef);
-        return {
-            ...link,
-            providerLabel: resolveFrontendProviderDisplayLabel({
-                providerRef: link.providerRef,
-                displayName: auth?.socialOAuth2Providers?.[link.providerRef]?.displayName
-                    ?? provider?.metadata.displayName,
-                displayNameLabelKey: provider?.metadata.displayNameLabelKey,
-                translate: translateProvider,
-            }),
-        };
-    }), [auth?.socialOAuth2Providers, frontendProviderRegistry, identityLinks, translateProvider]);
+    const resolvedIdentityLinks = useMemo(() => identityLinks.map((link) => ({
+        ...link,
+        providerLabel: resolveFrontendProviderDisplayLabel({
+            providerRef: link.providerRef,
+            displayName: auth?.socialOAuth2Providers?.[link.providerRef]?.displayName,
+            translate: translateProvider,
+        }),
+    })), [auth?.socialOAuth2Providers, identityLinks, translateProvider]);
     const handlePasskeyAdd = useCallback(async () => {
         if (passkeys.length >= maxPasskeys)
             return;
@@ -239,11 +241,9 @@ export const AppPage_SecuritySettings = () => {
             case SecurityFactorState.INACTIVE: return t(SecuritySettingsLabel.STATUS_NOT_CONFIGURED);
         }
     };
-    const PasskeySection = (_jsxs(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY], title: t(SecuritySettingsLabel.SECTION_PASSKEYS), description: t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION), state: passkeyState, statusLabel: statusLabelFor(passkeyState), meta: passkeysSupported && passkeys.length > 0
-            ? _jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.PASSKEY_COUNT, { count: passkeys.length }) })
-            : undefined, action: passkeysSupported && passkeys.length < maxPasskeys ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handlePasskeyAdd, disabled: passkeyRegistering, children: passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD) })) : undefined, children: [!passkeysSupported && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED) }) })), passkeysSupported && (_jsxs(_Fragment, { children: [passkeys.length === 0 && (_jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.PASSKEY_EMPTY) })), passkeys.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element", children: passkeys.map((pk) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: pk.name }), pk.createdAt && (_jsx(Text, { className: "text-xs text-muted-foreground", children: t(SecuritySettingsLabel.PASSKEY_ADDED, { date: new Date(pk.createdAt).toLocaleDateString() }) }))] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => handlePasskeyRemove(pk.credentialId), children: t(SecuritySettingsLabel.PASSKEY_REMOVE) }))] }, pk.credentialId))) }))] }))] }));
+    const PasskeySection = (_jsxs(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY], title: t(SecuritySettingsLabel.SECTION_PASSKEYS), description: t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION), state: passkeyState, statusLabel: statusLabelFor(passkeyState), action: passkeysSupported && passkeys.length < maxPasskeys ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handlePasskeyAdd, disabled: passkeyRegistering, children: passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD) })) : undefined, children: [!passkeysSupported && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED) }) })), passkeysSupported && passkeys.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element", children: passkeys.map((pk) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: pk.name }), pk.createdAt && (_jsx(Text, { className: "text-xs text-muted-foreground", children: t(SecuritySettingsLabel.PASSKEY_ADDED, { date: formatDate(pk.createdAt) }) }))] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => handlePasskeyRemove(pk.credentialId), children: t(SecuritySettingsLabel.PASSKEY_REMOVE) }))] }, pk.credentialId))) }))] }));
     const totpState = hasTotp ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    const TotpSection = (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP], title: t(SecuritySettingsLabel.SECTION_TOTP), description: t(SecuritySettingsLabel.TOTP_DESCRIPTION), state: totpState, statusLabel: statusLabelFor(totpState), meta: _jsx(Text, { className: "text-sm", children: hasTotp ? t(SecuritySettingsLabel.TOTP_ENABLED) : t(SecuritySettingsLabel.TOTP_NOT_SETUP) }), action: hasTotp
+    const TotpSection = (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP], title: t(SecuritySettingsLabel.SECTION_TOTP), description: t(SecuritySettingsLabel.TOTP_DESCRIPTION), state: totpState, statusLabel: statusLabelFor(totpState), action: hasTotp
             ? (allowRemoval ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleTotpDisable, children: t(SecuritySettingsLabel.TOTP_DISABLE) })) : undefined)
             // While the enrolment flow is open its own controls own the row, so the
             // opener is withdrawn rather than left as a second way in.
@@ -252,9 +252,10 @@ export const AppPage_SecuritySettings = () => {
                 refresh();
             }, onError: (msg) => setError(msg), isLoading: false, t: (k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k) })) : null }));
     const phoneState = phoneVerified ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    const PhoneSection = (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP], title: t(SecuritySettingsLabel.SECTION_PHONE), description: t(SecuritySettingsLabel.PHONE_DESCRIPTION), state: phoneState, statusLabel: statusLabelFor(phoneState), meta: _jsx(Text, { className: "text-sm", children: phoneVerified
-                ? `${t(SecuritySettingsLabel.PHONE_VERIFIED)}: ${phoneMasked ?? '***'}`
-                : t(SecuritySettingsLabel.PHONE_NOT_VERIFIED) }), action: phoneVerified ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_CHANGE) })) : (showPhoneEnroll ? undefined : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_VERIFY) }))), children: phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (_jsx(PhoneEnrollmentMethod, { onComplete: () => {
+    const PhoneSection = (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP], title: t(SecuritySettingsLabel.SECTION_PHONE), description: t(SecuritySettingsLabel.PHONE_DESCRIPTION), state: phoneState, statusLabel: statusLabelFor(phoneState), 
+        // WHICH number is verified is the one thing the "Active" badge cannot say, so the masked number
+        // stands alone — no "Verified:" in front of it (the badge) and no sentence when there is none.
+        meta: phoneVerified && phoneMasked ? _jsx(Text, { className: "text-sm", children: phoneMasked }) : undefined, action: phoneVerified ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_CHANGE) })) : (showPhoneEnroll ? undefined : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_VERIFY) }))), children: phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (_jsx(PhoneEnrollmentMethod, { onComplete: () => {
                 setShowPhoneEnroll(false);
                 refresh();
             }, onError: (msg) => setError(msg), isLoading: false, t: (k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k) })) : null }));
@@ -272,10 +273,10 @@ export const AppPage_SecuritySettings = () => {
     // The rows below already carry the state (per-factor badge) and the meaning
     // (per-factor description). A summary that restates them as a number is
     // strictly less information, presented as if it were more.
-    return (_jsxs("div", { className: "flex flex-col gap-section", children: [_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx("h3", { className: "text-base font-semibold tracking-tight", children: t(SecuritySettingsLabel.PAGE_TITLE) }), _jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.PAGE_DESCRIPTION) })] }), error && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) })), successMsg && (_jsx(Alert, { children: _jsx(AlertDescription, { children: successMsg }) })), loading ? (_jsx(Text, { className: "text-muted-foreground", children: t(SecuritySettingsLabel.LOADING) })) : (_jsxs("div", { className: "flex flex-col gap-item", children: [PasskeySection, TotpSection, PhoneSection, _jsx(PasswordSection, { hasPassword: hasPassword, passwordPolicy: passwordPolicy, userEmail: user?.email, t: t, tPolicy: tPolicy, onSuccess: () => {
-                            setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));
-                            refresh();
-                        }, onError: (msg) => setError(msg) }), _jsx(IdentityLinksSection, { links: resolvedIdentityLinks, allowRemoval: allowRemoval, t: t, onUnlink: handleUnlinkIdentity })] }))] }));
+    return (_jsxs("div", { className: "flex flex-col gap-section", children: [_jsx("h3", { className: "text-base font-semibold tracking-tight", children: t(SecuritySettingsLabel.PAGE_TITLE) }), error && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) })), successMsg && (_jsx(Alert, { children: _jsx(AlertDescription, { children: successMsg }) })), loading ? (_jsx(Text, { className: "text-muted-foreground", children: t(SecuritySettingsLabel.LOADING) })) : (_jsx(Card, { children: _jsxs(CardContent, { className: "flex flex-col divide-y divide-border p-card", children: [PasskeySection, TotpSection, PhoneSection, _jsx(PasswordSection, { hasPassword: hasPassword, passwordPolicy: passwordPolicy, userEmail: user?.email, t: t, tPolicy: tPolicy, onSuccess: () => {
+                                setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));
+                                refresh();
+                            }, onError: (msg) => setError(msg) }), _jsx(IdentityLinksSection, { links: resolvedIdentityLinks, allowRemoval: allowRemoval, t: t, onUnlink: handleUnlinkIdentity })] }) }))] }));
 };
 const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, onSuccess, onError }) => {
     const toUserFacingErrorMessage = useUserFacingErrorMessage();
@@ -335,13 +336,11 @@ const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, o
         }
     }, [onError, onSuccess, setForm, t, toUserFacingErrorMessage]);
     const state = hasPassword ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    return (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD], title: t(SecuritySettingsLabel.SECTION_PASSWORD), description: t(SecuritySettingsLabel.PASSWORD_DESCRIPTION), state: state, statusLabel: t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), meta: _jsx(Text, { className: "text-sm", children: t(hasPassword ? SecuritySettingsLabel.PASSWORD_SET_STATUS : SecuritySettingsLabel.PASSWORD_NOT_SET_STATUS) }), action: editing ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => {
+    return (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD], title: t(SecuritySettingsLabel.SECTION_PASSWORD), description: t(SecuritySettingsLabel.PASSWORD_DESCRIPTION), state: state, statusLabel: t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), action: editing ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => {
                 setEditing(false);
                 changeForm.reset();
                 setForm.reset();
             }, children: t(SecuritySettingsLabel.CANCEL) })) : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setEditing(true), children: t(hasPassword ? SecuritySettingsLabel.PASSWORD_CHANGE : SecuritySettingsLabel.PASSWORD_SET) })), children: !editing ? null : hasPassword ? (_jsx(FormProvider, { ...changeForm, children: _jsxs("form", { onSubmit: changeForm.handleSubmit(handleChange), className: "space-y-4", children: [_jsx(CredentialUsernameAutofillField, { email: userEmail }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CURRENT) }), _jsx(InputRoot, { type: "password", autoComplete: "current-password", ...changeForm.register('currentPassword', { required: true }) })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_NEW) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...changeForm.register('newPassword', { required: true }) }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: tPolicy })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CONFIRM) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...changeForm.register('confirmPassword', { required: true }) })] }), _jsx(Button, { type: "submit", disabled: submitting, children: t(SecuritySettingsLabel.PASSWORD_CHANGE) })] }) })) : (_jsx(FormProvider, { ...setForm, children: _jsxs("form", { onSubmit: setForm.handleSubmit(handleSet), className: "space-y-4", children: [_jsx(CredentialUsernameAutofillField, { email: userEmail }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_NEW) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...setForm.register('newPassword', { required: true }) }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: tPolicy })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CONFIRM) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...setForm.register('confirmPassword', { required: true }) })] }), _jsx(Button, { type: "submit", disabled: submitting, children: t(SecuritySettingsLabel.PASSWORD_SET) })] }) })) }));
 };
-const IdentityLinksSection = ({ links, allowRemoval, t, onUnlink }) => (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2], title: t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS), description: t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION), state: links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE, statusLabel: t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), meta: links.length > 0
-        ? _jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.IDENTITY_LINKS_COUNT, { count: links.length }) })
-        : undefined, children: links.length === 0 ? (_jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.IDENTITY_LINKS_EMPTY) })) : (_jsx("ul", { className: "flex flex-col gap-element", children: links.map((link) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: link.providerLabel }), _jsx(Text, { className: "truncate text-xs text-muted-foreground", children: link.providerEmail })] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => onUnlink(link._id), children: t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK) }))] }, link._id))) })) }));
+const IdentityLinksSection = ({ links, allowRemoval, t, onUnlink }) => (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2], title: t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS), description: t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION), state: links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE, statusLabel: t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), children: links.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element", children: links.map((link) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: link.providerLabel }), _jsx(Text, { className: "truncate text-xs text-muted-foreground", children: link.providerEmail })] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => onUnlink(link._id), children: t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK) }))] }, link._id))) })) }));
 //# sourceMappingURL=AppPage_SecuritySettings.js.map

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_SecuritySettings.js","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,KAAK,EAA8B,MAAM,mDAAmD,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAyB,QAAQ,EAAE,MAAM,+DAA+D,CAAC;AAChH,OAAO,EAAE,2BAA2B,EAAE,MAAM,sEAAsE,CAAC;AACnH,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,GAIpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAA2B,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qEAAqE,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4FAA4F,CAAC;AAsBpG;;;;;;GAMG;AACH,IAAK,mBAIJ;AAJD,WAAK,mBAAmB;IACtB,wCAAiB,CAAA;IACjB,4CAAqB,CAAA;IACrB,kDAA2B,CAAA;AAC7B,CAAC,EAJI,mBAAmB,KAAnB,mBAAmB,QAIvB;AAED,MAAM,0BAA0B,GAAuD;IACrF,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,SAAS;IACvC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,SAAS;IACzC,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,WAAW;CAC/C,CAAC;AA+BF;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAsC,CAAC,EAC7D,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GACrE,EAAE,EAAE;IACH,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,KAAK,mBAAmB,CAAC,MAAM,CAAC;IAEtD,OAAO,CACL,KAAC,IAAI,cACH,MAAC,WAAW,IAAC,SAAS,EAAC,+BAA+B,aACpD,eAAK,SAAS,EAAC,oCAAoC,aAGjD,6BACc,MAAM,EAClB,SAAS,EAAE,EAAE,CACX,6DAA6D,EAC7D,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,gCAAgC,CAC3E,YAEA,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GACpC,EAEN,eAAK,SAAS,EAAC,6CAA6C,aAC1D,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,IAAI,IAAC,SAAS,EAAC,0BAA0B,YAAE,KAAK,GAAQ,EACzD,KAAC,KAAK,IAAC,OAAO,EAAE,0BAA0B,CAAC,KAAK,CAAC,YAAG,WAAW,GAAS,IACpE,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,WAAW,GAAQ,EACnE,IAAI,IACD,EAEL,MAAM,IAAI,cAAK,SAAS,EAAC,2CAA2C,YAAE,MAAM,GAAO,IAChF,EAKL,QAAQ,IAAI,CACX,cAAK,SAAS,EAAC,mEAAmE,YAAE,QAAQ,GAAO,CACpG,IACW,GACT,CACR,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAa,GAAG,EAAE;IACrD,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAmB,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,yBAAyB,GAAG,OAAO,CACvC,GAAG,EAAE,CAAC,uCAAuC,CAC3C,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACzB,wBAAwB,EAAE,gBAAgB,CACxC,IAAI,CAAC,WAAqC,CAC3C,EAAE,QAAQ,CAAC,mBAAmB,CAChC,CACF,EACD,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAC1C,CAAC;IACF,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5D,SAAS,EAAE;YACT,qBAAqB,CAAC,6BAA6B;YACnD,qBAAqB,CAAC,4BAA4B;YAClD,qBAAqB,CAAC,kCAAkC;SACzD;QACD,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,MAAwC,EAAE,EAAE,CACxD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,EAAE,MAAM,CAAC,EAC9E,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,CAAC,EACpF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;IAC1C,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACrE,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;IACnD,MAAM,WAAW,GAAG,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAC5D,MAAM,YAAY,GAAG,gBAAgB,EAAE,sBAAsB,IAAI,IAAI,CAAC;IAEtE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC5D,MAAM,CAAC,YAAY,EAAE;gBACrB,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,MAAM,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;aACvD,CAAC,CAAC;YACH,UAAU,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACrC,WAAW,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAC3C,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,EAAE,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAElC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,sFAAsF;IACtF,iGAAiG;IACjG,iGAAiG;IACjG,4CAA4C;IAC5C,MAAM,6BAA6B,GAAG,SAAS,CAAC,gCAAgC,EAAE,CAAC;IACnF,MAAM,oBAAoB,GAAG,OAAO;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC;SAC3F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC,2BAA2B,CAC/D,SAAS,CAAC,cAAc,EAAE,WAAW,IAAI,KAAK,EAC9C,SAAS,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EACzE,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAE,SAAS,CAAC,2BAA4C,EAChH,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,oBAAoB,IAAI,EAAE,CACjE,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,SAAS,EAAE,QAAQ,IAAI,KAAK,CAAC;IACnD,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,WAAiC,CAAC;IAC1E,MAAM,qBAAqB,GAAG,OAAO,CACnC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,wBAAwB,EAAE,gBAAgB,CACzD,IAAI,CAAC,WAAqC,CAC3C,CAAC;QAEF,OAAO;YACL,GAAG,IAAI;YACP,aAAa,EAAE,mCAAmC,CAAC;gBACjD,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW;uBACpE,QAAQ,EAAE,QAAQ,CAAC,WAAW;gBACnC,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,CAAC,mBAAmB;gBAC3D,SAAS,EAAE,iBAAiB;aAC7B,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,EACF,CAAC,IAAI,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAC1F,CAAC;IAEF,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC9C,IAAI,QAAQ,CAAC,MAAM,IAAI,WAAW;YAAE,OAAO;QAC3C,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO;QACzE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,sBAAsB,EAAE,CAAsD,CAAC;YAC7G,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;YACrJ,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEzE,MAAM,mBAAmB,GAAG,WAAW,CACrC,KAAK,EAAE,YAAoB,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC7D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EACD,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CACrD,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,cAAc,EAAE,CAAC;YAClD,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE3C,MAAM,oBAAoB,GAAG,WAAW,CACtC,KAAK,EAAE,MAAc,EAAE,EAAE;QACvB,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC5D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EACD,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CACrD,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACxF,MAAM,YAAY,GAAG,CAAC,iBAAiB;QACrC,CAAC,CAAC,mBAAmB,CAAC,WAAW;QACjC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAEpF,MAAM,cAAc,GAAG,CAAC,KAA0B,EAAU,EAAE;QAC5D,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YAC/E,KAAK,mBAAmB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;YACzF,KAAK,mBAAmB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CACrB,MAAC,kBAAkB,IACjB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,OAAO,CAAC,EACrD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAChD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,EACzC,IAAI,EAAE,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC5C,CAAC,CAAC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAQ;YACvG,CAAC,CAAC,SAAS,EACb,MAAM,EAAE,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAC3D,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB,YACrG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAC7F,CACV,CAAC,CAAC,CAAC,SAAS,aAEZ,CAAC,iBAAiB,IAAI,CACrB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAoB,GAC7E,CACT,EACA,iBAAiB,IAAI,CACpB,8BACG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CACxB,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,CAChG,EACA,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,aAAI,SAAS,EAAC,2BAA2B,YACtC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CACpB,cAA0B,SAAS,EAAC,wEAAwE,aAC1G,eAAK,SAAS,EAAC,uBAAuB,aACpC,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,EAAE,CAAC,IAAI,GAAQ,EACtD,EAAE,CAAC,SAAS,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAC5C,CAAC,CAAC,qBAAqB,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAAC,GACzF,CACR,IACG,EACL,YAAY,IAAI,CACf,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,YACtH,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,GACjC,CACV,KAbM,EAAE,CAAC,YAAY,CAcnB,CACN,CAAC,GACC,CACN,IACA,CACJ,IACkB,CACtB,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IACtF,MAAM,WAAW,GAAG,CAClB,KAAC,kBAAkB,IACjB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,IAAI,CAAC,EAClD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EACtD,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EACtC,IAAI,EAAE,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,GAAQ,EAClI,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAChB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,YACxE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,CAAC,CAAC,SAAS,CAAC;YACd,wEAAwE;YACxE,2DAA2D;YAC3D,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAC9B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,YACpF,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAC7B,CACV,CAAC,YAEH,OAAO,CAAC,CAAC,CAAC,CACT,4BACG,YAAY,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CACtG,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAoB,GAC/E,CACT,GACA,CACJ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CACnB,KAAC,oBAAoB,IACnB,UAAU,EAAE,GAAG,EAAE;gBACf,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,GACjF,CACH,CAAC,CAAC,CAAC,IAAI,GACW,CACtB,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAC7F,MAAM,YAAY,GAAG,CACnB,KAAC,kBAAkB,IACjB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,OAAO,CAAC,EACrD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAC7C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EACvD,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC,EACvC,IAAI,EACF,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YACtB,aAAa;gBACZ,CAAC,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,KAAK,WAAW,IAAI,KAAK,EAAE;gBACvE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,GAC1C,EAET,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CACtB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,YACrF,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CACjC,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,YACrF,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,YAED,aAAa,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAC5D,KAAC,qBAAqB,IACpB,UAAU,EAAE,GAAG,EAAE;gBACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,GACjF,CACH,CAAC,CAAC,CAAC,IAAI,GACW,CACtB,CAAC;IAEF,8EAA8E;IAC9E,8DAA8D;IAC9D,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,gEAAgE;IAChE,4EAA4E;IAC5E,wEAAwE;IACxE,2DAA2D;IAE3D,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aAGxC,eAAK,SAAS,EAAC,2BAA2B,aACxC,aAAI,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAAM,EACjG,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAQ,IAC9F,EAEL,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EACA,UAAU,IAAI,CACb,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,UAAU,GAAoB,GAC3C,CACT,EAEA,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,IAAI,IAAC,SAAS,EAAC,uBAAuB,YAAE,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAQ,CAClF,CAAC,CAAC,CAAC,CACF,eAAK,SAAS,EAAC,wBAAwB,aACpC,cAAc,EACd,WAAW,EACX,YAAY,EACb,KAAC,eAAe,IACd,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,IAAI,EAAE,KAAK,EACtB,CAAC,EAAE,CAAC,EACJ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,GAAG,EAAE;4BACd,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;4BAChD,OAAO,EAAE,CAAC;wBACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAC/B,EACF,KAAC,oBAAoB,IACnB,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,YAAY,EAC1B,CAAC,EAAE,CAAC,EACJ,QAAQ,EAAE,oBAAoB,GAC9B,IACE,CACP,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAkBF,MAAM,eAAe,GAAmC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACrI,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAA4E;QACpG,aAAa,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;KAC7E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAmD;QACxE,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,IAA+E,EAAE,EAAE;QACxF,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACxF,SAAS,EAAE,CAAC;YACZ,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAC9D,CAAC;IAEF,MAAM,SAAS,GAAG,WAAW,CAC3B,KAAK,EAAE,IAAsD,EAAE,EAAE;QAC/D,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/D,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAC3D,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAEtF,OAAO,CACL,KAAC,kBAAkB,IACjB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,QAAQ,CAAC,EACtD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAChD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,EAC/G,IAAI,EAAE,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,GAAQ,EACnJ,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAChB,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,OAAO,EAAE,GAAG,EAAE;gBACZ,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC,YAEA,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,GACzB,CACV,CAAC,CAAC,CAAC,CACF,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAC7E,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GACrF,CACV,YAEA,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAC7B,KAAC,YAAY,OAAK,UAAU,YAC1B,gBAAM,QAAQ,EAAE,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,SAAS,EAAC,WAAW,aAQ1E,KAAC,+BAA+B,IAAC,KAAK,EAAE,SAAS,GAAI,EACrD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,KAC3B,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC9D,IACI,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAc,EAChE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC1D,EACF,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,GAAI,IACnF,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC9D,IACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,YACvC,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAClC,IACJ,GACM,CAChB,CAAC,CAAC,CAAC,CACF,KAAC,YAAY,OAAK,OAAO,YACvB,gBAAM,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAC,WAAW,aAEpE,KAAC,+BAA+B,IAAC,KAAK,EAAE,SAAS,GAAI,EACrD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAc,EAChE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GACvD,EACF,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,GAAI,IACnF,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC3D,IACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,YACvC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,IACJ,GACM,CAChB,GACgB,CACtB,CAAC;AACJ,CAAC,CAAC;AASF,MAAM,oBAAoB,GAAwC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAC1G,KAAC,kBAAkB,IACjB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,eAAe,CAAC,EAC7D,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,EACtD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,EAChE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EACnF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,EACpH,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAQ;QAC3G,CAAC,CAAC,SAAS,YAEZ,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACpB,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,GAAQ,CACvG,CAAC,CAAC,CAAC,CACF,aAAI,SAAS,EAAC,2BAA2B,YACtC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,cAAmB,SAAS,EAAC,wEAAwE,aACnG,eAAK,SAAS,EAAC,uBAAuB,aACpC,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,IAAI,CAAC,aAAa,GAAQ,EAClE,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,IAAI,CAAC,aAAa,GAAQ,IAChF,EACL,YAAY,IAAI,CACf,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,YACpG,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GACxC,CACV,KATM,IAAI,CAAC,GAAG,CAUZ,CACN,CAAC,GACC,CACN,GACkB,CACtB,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useState } from 'react';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { Card, CardContent } from '~wildo-frontend-lib/components/sections/card';\nimport { Badge, type BadgeVariants_Variant } from '~wildo-frontend-lib/components/data-display/badge';\nimport { useIconRegistry } from '~wildo-frontend-lib/core/icons/useIconRegistry';\nimport { StandardIconReference, IconSize } from '~wildo-frontend-lib/core/icons/icon-registry.frontend.schemas';\nimport { AUTH_METHOD_ICON_REFERENCES } from '~wildo-frontend-lib/components/auth/methods/auth-method-presentation';\nimport { cn } from '~wildo-frontend-lib/core/ui/cn';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport {\n  AuthMethod,\n  AuthUtils,\n  isWildoBackendError,\n  type ExternalIdentitySource,\n  type PasswordPolicyRules,\n  type SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport { FormProvider, useForm } from 'react-hook-form';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { AuthSessionUtils } from '~wildo-frontend-lib/core/security/auth-session.utils';\nimport { PasswordStrengthIndicator, DEFAULT_PASSWORD_POLICY } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport { TotpEnrollmentMethod } from '~wildo-frontend-lib/components/auth/enrollment/TotpEnrollmentMethod';\nimport { PhoneEnrollmentMethod } from '~wildo-frontend-lib/components/auth/enrollment/PhoneEnrollmentMethod';\nimport { startRegistration } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/browser';\nimport type { FrontendAppProviderRef } from '@wildo-ai/external-connectors-public/app';\nimport {\n  collectFrontendProviderDisplayLabelKeys,\n  resolveFrontendProviderDisplayLabel,\n} from '~wildo-frontend-lib/core/external-providers/frontend-provider-display-label.frontend.utils';\n\n// A new `SecuritySettingsLabel` member (`@wildo-ai/presets-components-models`)\n// must ALSO be declared in `AppPage_SecuritySettings.labels.ts`, beside this\n// file: that list — key, kind, purpose — is what the dev companion scans\n// statically to plan and translate the words, and an enum member missing\n// from it never reaches the labelling pipeline. The shared step-up dialog\n// (`StepUpAuthDialog`) reads the same component's keys.\n\ntype EnrolledMethod = { method: string; enrolled: boolean; enrolledAt?: string; details?: Record<string, unknown> };\ntype PasskeyCred = { credentialId: string; name: string; createdAt: string };\ntype IdentityLink = {\n  _id: string;\n  connectionType: SsoConnectionType;\n  source: ExternalIdentitySource;\n  providerRef: string;\n  providerEmail: string;\n  linkedAt: string;\n  lastUsedAt: string;\n};\ntype ResolvedIdentityLink = IdentityLink & { providerLabel: string };\n\n/**\n * Presentational state of one authentication factor.\n *\n * `UNAVAILABLE` is NOT \"off\" — it means the current device/browser cannot offer\n * the factor at all (no WebAuthn support), which is a different instruction to\n * the user than \"you have not set this up yet\" and therefore a distinct badge.\n */\nenum SecurityFactorState {\n  ACTIVE = 'active',\n  INACTIVE = 'inactive',\n  UNAVAILABLE = 'unavailable',\n}\n\nconst FACTOR_STATE_BADGE_VARIANT: Record<SecurityFactorState, BadgeVariants_Variant> = {\n  [SecurityFactorState.ACTIVE]: 'success',\n  [SecurityFactorState.INACTIVE]: 'outline',\n  [SecurityFactorState.UNAVAILABLE]: 'secondary',\n};\n\ninterface SecurityFactorCardProps {\n  /** Glyph identifying the method — resolved through the icon registry so apps can re-skin it. */\n  icon: StandardIconReference;\n  title: string;\n  /** Plain-language \"what this is / why it matters\" line. Always rendered. */\n  description: string;\n  state: SecurityFactorState;\n  statusLabel: string;\n  /** Live detail under the description (count, masked number, enrolment date). */\n  meta?: React.ReactNode;\n  /**\n   * The factor's primary control, pinned to the inline-end of the header row.\n   * Every row's action lands on the same axis, so the column reads as a list of\n   * choices rather than as five stacked mini-pages — the account-security idiom\n   * used by mainstream providers. Anything that must expand (an enrolment flow,\n   * a credential list, a form) goes to `children` instead.\n   *\n   * Row actions are OUTLINE, without exception. They are peers: the panel offers\n   * five alternative ways to protect an account and recommends none of them, so\n   * filling any one of them would assert a priority the page does not hold —\n   * and five filled buttons stacked down a column assert five priorities, which\n   * is the same as none while costing all the emphasis. The filled variant is\n   * reserved for the commit action INSIDE an opened disclosure, where there\n   * genuinely is one thing to do next.\n   */\n  action?: React.ReactNode;\n  children?: React.ReactNode;\n}\n\n/**\n * One authentication factor, presented as a scannable row: glyph · name · what\n * it is · live status, with its primary control pinned to the row's end.\n *\n * This replaced a stack of visually identical title-only cards, which forced the\n * user to READ every card to learn which factors were active and offered no\n * explanation of what any factor was. The status badge and the icon carry that\n * information pre-attentively; the description makes the choice informed. The\n * shape follows the account-security idiom used by mainstream providers.\n */\nconst SecurityFactorCard: React.FC<SecurityFactorCardProps> = ({\n  icon, title, description, state, statusLabel, meta, action, children,\n}) => {\n  const { renderIcon } = useIconRegistry();\n  const isActive = state === SecurityFactorState.ACTIVE;\n\n  return (\n    <Card>\n      <CardContent className=\"flex flex-col gap-item p-card\">\n        <div className=\"flex flex-row items-start gap-item\">\n          {/* Tinted glyph tile — tinted only when the factor is live, so the eye\n              lands on what is protecting the account before any text is read. */}\n          <div\n            aria-hidden=\"true\"\n            className={cn(\n              'flex size-9 shrink-0 items-center justify-center rounded-md',\n              isActive ? 'bg-success/10 text-success' : 'bg-muted text-muted-foreground',\n            )}\n          >\n            {renderIcon(icon, { size: IconSize.SM })}\n          </div>\n\n          <div className=\"flex min-w-0 flex-1 flex-col gap-element-xs\">\n            <div className=\"flex flex-wrap items-center gap-element-xs\">\n              <Text className=\"font-medium leading-snug\">{title}</Text>\n              <Badge variant={FACTOR_STATE_BADGE_VARIANT[state]}>{statusLabel}</Badge>\n            </div>\n            <Text className=\"text-sm text-muted-foreground\">{description}</Text>\n            {meta}\n          </div>\n\n          {action && <div className=\"flex shrink-0 items-center gap-element-xs\">{action}</div>}\n        </div>\n\n        {/* Expanded content aligns with the TEXT column, not the glyph: the\n            indent is the glyph tile (`size-9`) plus the row gap, so a form or a\n            credential list continues the sentence it belongs to. */}\n        {children && (\n          <div className=\"flex flex-col gap-item ps-[calc(var(--spacing)*9+var(--sp-item))]\">{children}</div>\n        )}\n      </CardContent>\n    </Card>\n  );\n};\n\nexport const AppPage_SecuritySettings: React.FC = () => {\n  const { auth, frontendProviderRegistry } = useApplication();\n  const { auth: authState } = useAuthSession();\n  const { user } = useUserOrgs();\n  const resolvedAuth = useResolvedAuthConfig();\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  const [methods, setMethods] = useState<EnrolledMethod[]>([]);\n  const [passkeys, setPasskeys] = useState<PasskeyCred[]>([]);\n  const [identityLinks, setIdentityLinks] = useState<IdentityLink[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [successMsg, setSuccessMsg] = useState<string | null>(null);\n  const [showTotpEnroll, setShowTotpEnroll] = useState(false);\n  const [showPhoneEnroll, setShowPhoneEnroll] = useState(false);\n  const [passkeyRegistering, setPasskeyRegistering] = useState(false);\n  const identityProviderLabelKeys = useMemo(\n    () => collectFrontendProviderDisplayLabelKeys(\n      identityLinks.map((link) =>\n        frontendProviderRegistry?.getProviderByRef(\n          link.providerRef as FrontendAppProviderRef,\n        )?.metadata.displayNameLabelKey,\n      ),\n    ),\n    [frontendProviderRegistry, identityLinks],\n  );\n  const { tComponent, t: translateProvider, isReady } = useI18n({\n    component: [\n      FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS,\n      FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER,\n      FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED,\n    ],\n    keys: identityProviderLabelKeys,\n  });\n  const t = useCallback(\n    (key: string, params?: Record<string, string | number>) =>\n      tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key, params),\n    [tComponent],\n  );\n  const tPolicy = useCallback(\n    (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, key),\n    [tComponent],\n  );\n\n  const passkeyConfig = auth?.passkeyConfig;\n  const methodManagement = resolvedAuth.userTypeAuth?.methodManagement;\n  const passwordPolicy = resolvedAuth.passwordPolicy;\n  const maxPasskeys = passkeyConfig?.maxPasskeysPerUser ?? 10;\n  const allowRemoval = methodManagement?.allowUserMethodRemoval ?? true;\n\n  const refresh = useCallback(async () => {\n    setLoading(true);\n    setError(null);\n    try {\n      const client = getManualCallsHttpClient();\n      const [methodsRes, passkeysRes, linksRes] = await Promise.all([\n        client.getMyMethods(),\n        client.passkeyList().catch(() => ({ credentials: [] })),\n        client.getIdentityLinks().catch(() => ({ links: [] })),\n      ]);\n      setMethods(methodsRes.methods ?? []);\n      setPasskeys(passkeysRes.credentials ?? []);\n      setIdentityLinks(linksRes.links ?? []);\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n    } finally {\n      setLoading(false);\n    }\n  }, [t, toUserFacingErrorMessage]);\n\n  useEffect(() => {\n    refresh();\n  }, [refresh]);\n\n  useEffect(() => {\n    if (!successMsg) return;\n    const timer = setTimeout(() => setSuccessMsg(null), 5000);\n    return () => clearTimeout(timer);\n  }, [successMsg]);\n\n  // Derived, not listed. The literal `[TOTP, PASSKEY, SMS_OTP]` that stood here was the\n  // second-factor vocabulary minus the factors that need no enrollment — correct on the day it was\n  // written and silently short the day a fifth second factor is added, since a method missing from\n  // the list simply never counts as enrolled.\n  const enrollableSecondFactorMethods = AuthUtils.getEnrollableSecondFactorMethods();\n  const enrolledSecondFactor = methods\n    .filter((m) => m.enrolled && enrollableSecondFactorMethods.includes(m.method as AuthMethod))\n    .map((m) => m.method as AuthMethod);\n  const completeness = AuthSessionUtils.evaluateAccountCompleteness(\n    authState.identification?.requiresMFA ?? false,\n    authState.identification?.secondFactorMethods?.map((m) => m.method) ?? [],\n    enrolledSecondFactor.length > 0 ? enrolledSecondFactor : (authState.enrolledSecondFactorMethods as AuthMethod[]),\n    resolvedAuth.userTypeAuth?.mfaPolicy?.acceptableMFAMethods ?? [],\n  );\n\n  const hasPassword = methods.some((m) => m.method === AuthMethod.PASSWORD && m.enrolled);\n  const hasTotp = methods.some((m) => m.method === AuthMethod.TOTP && m.enrolled);\n  const smsMethod = methods.find((m) => m.method === AuthMethod.SMS_OTP);\n  const phoneVerified = smsMethod?.enrolled ?? false;\n  const phoneMasked = smsMethod?.details?.phoneNumber as string | undefined;\n  const resolvedIdentityLinks = useMemo(\n    () => identityLinks.map((link) => {\n      const provider = frontendProviderRegistry?.getProviderByRef(\n        link.providerRef as FrontendAppProviderRef,\n      );\n\n      return {\n        ...link,\n        providerLabel: resolveFrontendProviderDisplayLabel({\n          providerRef: link.providerRef,\n          displayName: auth?.socialOAuth2Providers?.[link.providerRef]?.displayName\n            ?? provider?.metadata.displayName,\n          displayNameLabelKey: provider?.metadata.displayNameLabelKey,\n          translate: translateProvider,\n        }),\n      };\n    }),\n    [auth?.socialOAuth2Providers, frontendProviderRegistry, identityLinks, translateProvider],\n  );\n\n  const handlePasskeyAdd = useCallback(async () => {\n    if (passkeys.length >= maxPasskeys) return;\n    if (typeof window === 'undefined' || !window.PublicKeyCredential) return;\n    setPasskeyRegistering(true);\n    setError(null);\n    try {\n      const client = getManualCallsHttpClient();\n      const options = (await client.passkeyRegisterOptions()) as unknown as PublicKeyCredentialCreationOptionsJSON;\n      const credential = await startRegistration({ optionsJSON: options });\n      await client.passkeyRegisterVerify({ response: credential });\n      setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n      refresh();\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      const msg = e?.name === 'NotAllowedError' ? t(SecuritySettingsLabel.PASSKEY_CANCELLED) : toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR));\n      setError(msg);\n    } finally {\n      setPasskeyRegistering(false);\n    }\n  }, [maxPasskeys, passkeys.length, refresh, t, toUserFacingErrorMessage]);\n\n  const handlePasskeyRemove = useCallback(\n    async (credentialId: string) => {\n      if (!allowRemoval) return;\n      try {\n        await getManualCallsHttpClient().passkeyRemove(credentialId);\n        setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n        refresh();\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      }\n    },\n    [allowRemoval, refresh, t, toUserFacingErrorMessage],\n  );\n\n  /*\n   * No re-authentication handling here, deliberately. Where the user type asks for it, the server\n   * answers `STEP_UP_REQUIRED` and the HTTP client answers that by itself — the shared step-up dialog\n   * (`StepUpAuthProvider`), then a replay carrying `X-Reauth-Token`. The same is true of adding a\n   * passkey, confirming TOTP and confirming a phone below. This page used to carry its own password-only\n   * copy of that dialog for this one action, and nothing for the binding actions at all.\n   */\n  const handleTotpDisable = useCallback(async () => {\n    try {\n      await getManualCallsHttpClient().mfaTOTPDisable();\n      setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n      setShowTotpEnroll(false);\n      refresh();\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n    }\n  }, [refresh, t, toUserFacingErrorMessage]);\n\n  const handleUnlinkIdentity = useCallback(\n    async (linkId: string) => {\n      if (!allowRemoval) return;\n      try {\n        await getManualCallsHttpClient().unlinkIdentityLink(linkId);\n        setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n        refresh();\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      }\n    },\n    [allowRemoval, refresh, t, toUserFacingErrorMessage],\n  );\n\n  if (!isReady) return null;\n\n  // Passkeys are only offerable where WebAuthn exists; an unsupported browser is\n  // a distinct state from \"not set up yet\" and gets its own badge + no CTA.\n  const passkeysSupported = typeof window !== 'undefined' && !!window.PublicKeyCredential;\n  const passkeyState = !passkeysSupported\n    ? SecurityFactorState.UNAVAILABLE\n    : passkeys.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n\n  const statusLabelFor = (state: SecurityFactorState): string => {\n    switch (state) {\n      case SecurityFactorState.ACTIVE: return t(SecuritySettingsLabel.STATUS_ACTIVE);\n      case SecurityFactorState.UNAVAILABLE: return t(SecuritySettingsLabel.STATUS_UNAVAILABLE);\n      case SecurityFactorState.INACTIVE: return t(SecuritySettingsLabel.STATUS_NOT_CONFIGURED);\n    }\n  };\n\n  const PasskeySection = (\n    <SecurityFactorCard\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY]}\n      title={t(SecuritySettingsLabel.SECTION_PASSKEYS)}\n      description={t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION)}\n      state={passkeyState}\n      statusLabel={statusLabelFor(passkeyState)}\n      meta={passkeysSupported && passkeys.length > 0\n        ? <Text className=\"text-sm\">{t(SecuritySettingsLabel.PASSKEY_COUNT, { count: passkeys.length })}</Text>\n        : undefined}\n      action={passkeysSupported && passkeys.length < maxPasskeys ? (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={handlePasskeyAdd} disabled={passkeyRegistering}>\n          {passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD)}\n        </Button>\n      ) : undefined}\n    >\n      {!passkeysSupported && (\n        <Alert>\n          <AlertDescription>{t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED)}</AlertDescription>\n        </Alert>\n      )}\n      {passkeysSupported && (\n        <>\n          {passkeys.length === 0 && (\n            <Text className=\"text-sm text-muted-foreground\">{t(SecuritySettingsLabel.PASSKEY_EMPTY)}</Text>\n          )}\n          {passkeys.length > 0 && (\n            <ul className=\"flex flex-col gap-element\">\n              {passkeys.map((pk) => (\n                <li key={pk.credentialId} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\">\n                  <div className=\"flex min-w-0 flex-col\">\n                    <Text className=\"truncate font-medium\">{pk.name}</Text>\n                    {pk.createdAt && (\n                      <Text className=\"text-xs text-muted-foreground\">\n                        {t(SecuritySettingsLabel.PASSKEY_ADDED, { date: new Date(pk.createdAt).toLocaleDateString() })}\n                      </Text>\n                    )}\n                  </div>\n                  {allowRemoval && (\n                    <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => handlePasskeyRemove(pk.credentialId)}>\n                      {t(SecuritySettingsLabel.PASSKEY_REMOVE)}\n                    </Button>\n                  )}\n                </li>\n              ))}\n            </ul>\n          )}\n        </>\n      )}\n    </SecurityFactorCard>\n  );\n\n  const totpState = hasTotp ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n  const TotpSection = (\n    <SecurityFactorCard\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP]}\n      title={t(SecuritySettingsLabel.SECTION_TOTP)}\n      description={t(SecuritySettingsLabel.TOTP_DESCRIPTION)}\n      state={totpState}\n      statusLabel={statusLabelFor(totpState)}\n      meta={<Text className=\"text-sm\">{hasTotp ? t(SecuritySettingsLabel.TOTP_ENABLED) : t(SecuritySettingsLabel.TOTP_NOT_SETUP)}</Text>}\n      action={hasTotp\n        ? (allowRemoval ? (\n          <Button variant={ButtonVariants_Variant.OUTLINE} onClick={handleTotpDisable}>\n            {t(SecuritySettingsLabel.TOTP_DISABLE)}\n          </Button>\n        ) : undefined)\n        // While the enrolment flow is open its own controls own the row, so the\n        // opener is withdrawn rather than left as a second way in.\n        : (showTotpEnroll ? undefined : (\n          <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowTotpEnroll(true)}>\n            {t(SecuritySettingsLabel.TOTP_SETUP)}\n          </Button>\n        ))}\n    >\n      {hasTotp ? (\n        <>\n          {completeness.enrolledMethods.length === 1 && completeness.enrolledMethods.includes(AuthMethod.TOTP) && (\n            <Alert>\n              <AlertDescription>{t(SecuritySettingsLabel.TOTP_ONLY_MFA_WARNING)}</AlertDescription>\n            </Alert>\n          )}\n        </>\n      ) : showTotpEnroll ? (\n        <TotpEnrollmentMethod\n          onComplete={() => {\n            setShowTotpEnroll(false);\n            refresh();\n          }}\n          onError={(msg) => setError(msg)}\n          isLoading={false}\n          t={(k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k)}\n        />\n      ) : null}\n    </SecurityFactorCard>\n  );\n\n  const phoneState = phoneVerified ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n  const PhoneSection = (\n    <SecurityFactorCard\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP]}\n      title={t(SecuritySettingsLabel.SECTION_PHONE)}\n      description={t(SecuritySettingsLabel.PHONE_DESCRIPTION)}\n      state={phoneState}\n      statusLabel={statusLabelFor(phoneState)}\n      meta={\n        <Text className=\"text-sm\">\n          {phoneVerified\n            ? `${t(SecuritySettingsLabel.PHONE_VERIFIED)}: ${phoneMasked ?? '***'}`\n            : t(SecuritySettingsLabel.PHONE_NOT_VERIFIED)}\n        </Text>\n      }\n      action={phoneVerified ? (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowPhoneEnroll(true)}>\n          {t(SecuritySettingsLabel.PHONE_CHANGE)}\n        </Button>\n      ) : (showPhoneEnroll ? undefined : (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowPhoneEnroll(true)}>\n          {t(SecuritySettingsLabel.PHONE_VERIFY)}\n        </Button>\n      ))}\n    >\n      {phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (\n        <PhoneEnrollmentMethod\n          onComplete={() => {\n            setShowPhoneEnroll(false);\n            refresh();\n          }}\n          onError={(msg) => setError(msg)}\n          isLoading={false}\n          t={(k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k)}\n        />\n      ) : null}\n    </SecurityFactorCard>\n  );\n\n  // ── No posture summary, deliberately ───────────────────────────────────────\n  // Two rejected designs, for whoever is tempted to re-add one:\n  //   1. \"Your account is fully secured\" keyed off `completeness.isComplete` —\n  //      that flag answers \"does this satisfy the app's auth POLICY?\", and it is\n  //      `true` whenever MFA is not required. It therefore claimed a fully\n  //      secured account for an account with zero second factors.\n  //   2. An \"n of 4 sign-in methods active\" ratio with a progress meter — a\n  //      score with no referent. The denominator is not a target: nobody needs\n  //      SMS *and* TOTP *and* a passkey, the factors are alternatives, and the\n  //      remedy differs per factor. A meter that fills toward a number the user\n  //      should not reach measures nothing and invites gaming it.\n  // The rows below already carry the state (per-factor badge) and the meaning\n  // (per-factor description). A summary that restates them as a number is\n  // strictly less information, presented as if it were more.\n\n  return (\n    <div className=\"flex flex-col gap-section\">\n      {/* `h3`, not `h2`: the Settings Hub header owns the `h2` for this dialog,\n          so a panel heading is one level below it. */}\n      <div className=\"flex flex-col gap-item-xs\">\n        <h3 className=\"text-base font-semibold tracking-tight\">{t(SecuritySettingsLabel.PAGE_TITLE)}</h3>\n        <Text className=\"text-sm text-muted-foreground\">{t(SecuritySettingsLabel.PAGE_DESCRIPTION)}</Text>\n      </div>\n\n      {error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n      )}\n      {successMsg && (\n        <Alert>\n          <AlertDescription>{successMsg}</AlertDescription>\n        </Alert>\n      )}\n\n      {loading ? (\n        <Text className=\"text-muted-foreground\">{t(SecuritySettingsLabel.LOADING)}</Text>\n      ) : (\n        <div className=\"flex flex-col gap-item\">\n          {PasskeySection}\n          {TotpSection}\n          {PhoneSection}\n          <PasswordSection\n            hasPassword={hasPassword}\n            passwordPolicy={passwordPolicy}\n            userEmail={user?.email}\n            t={t}\n            tPolicy={tPolicy}\n            onSuccess={() => {\n              setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n              refresh();\n            }}\n            onError={(msg) => setError(msg)}\n          />\n          <IdentityLinksSection\n            links={resolvedIdentityLinks}\n            allowRemoval={allowRemoval}\n            t={t}\n            onUnlink={handleUnlinkIdentity}\n          />\n        </div>\n      )}\n    </div>\n  );\n};\n\ninterface PasswordSectionProps {\n  hasPassword: boolean;\n  passwordPolicy: PasswordPolicyRules;\n  /**\n   * Signed-in user's email. Rendered as a visually-hidden\n   * `autocomplete=\"username\"` field inside each password form so password\n   * managers associate the saved/updated credential with the correct account\n   * (Chromium also warns when a password form has no username field).\n   */\n  userEmail?: string;\n  t: (k: string, params?: Record<string, string | number>) => string;\n  tPolicy: (k: string) => string;\n  onSuccess: () => void;\n  onError: (msg: string) => void;\n}\n\nconst PasswordSection: React.FC<PasswordSectionProps> = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, onSuccess, onError }) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const [submitting, setSubmitting] = useState(false);\n  // The credential form is a DISCLOSURE, not the row's resting state. Rendered\n  // eagerly it was four inputs plus a strength meter permanently open beneath a\n  // one-line row, which made this factor read as the page's subject and the\n  // other four as its footnotes. Every row now rests at the same height and\n  // opens on request.\n  const [editing, setEditing] = useState(false);\n  const changeForm = useForm<{ currentPassword: string; newPassword: string; confirmPassword: string }>({\n    defaultValues: { currentPassword: '', newPassword: '', confirmPassword: '' },\n  });\n  const setForm = useForm<{ newPassword: string; confirmPassword: string }>({\n    defaultValues: { newPassword: '', confirmPassword: '' },\n  });\n\n  const handleChange = useCallback(\n    async (data: { currentPassword: string; newPassword: string; confirmPassword: string }) => {\n      if (data.newPassword !== data.confirmPassword) {\n        onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));\n        return;\n      }\n      setSubmitting(true);\n      try {\n        await getManualCallsHttpClient().passwordChange(data.currentPassword, data.newPassword);\n        onSuccess();\n        changeForm.reset();\n        setEditing(false);\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      } finally {\n        setSubmitting(false);\n      }\n    },\n    [changeForm, onError, onSuccess, t, toUserFacingErrorMessage],\n  );\n\n  const handleSet = useCallback(\n    async (data: { newPassword: string; confirmPassword: string }) => {\n      if (data.newPassword !== data.confirmPassword) {\n        onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));\n        return;\n      }\n      setSubmitting(true);\n      try {\n        await getManualCallsHttpClient().passwordSet(data.newPassword);\n        onSuccess();\n        setForm.reset();\n        setEditing(false);\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      } finally {\n        setSubmitting(false);\n      }\n    },\n    [onError, onSuccess, setForm, t, toUserFacingErrorMessage],\n  );\n\n  const state = hasPassword ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n\n  return (\n    <SecurityFactorCard\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD]}\n      title={t(SecuritySettingsLabel.SECTION_PASSWORD)}\n      description={t(SecuritySettingsLabel.PASSWORD_DESCRIPTION)}\n      state={state}\n      statusLabel={t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED)}\n      meta={<Text className=\"text-sm\">{t(hasPassword ? SecuritySettingsLabel.PASSWORD_SET_STATUS : SecuritySettingsLabel.PASSWORD_NOT_SET_STATUS)}</Text>}\n      action={editing ? (\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          onClick={() => {\n            setEditing(false);\n            changeForm.reset();\n            setForm.reset();\n          }}\n        >\n          {t(SecuritySettingsLabel.CANCEL)}\n        </Button>\n      ) : (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setEditing(true)}>\n          {t(hasPassword ? SecuritySettingsLabel.PASSWORD_CHANGE : SecuritySettingsLabel.PASSWORD_SET)}\n        </Button>\n      )}\n    >\n      {!editing ? null : hasPassword ? (\n          <FormProvider {...changeForm}>\n            <form onSubmit={changeForm.handleSubmit(handleChange)} className=\"space-y-4\">\n              {/*\n                Hidden username field. Gives password managers the account\n                context they need to associate the updated credential, and\n                resolves Chromium's \"password forms should have an (optionally\n                hidden) username field\" warning. Must precede the password\n                inputs so managers pair the username with them.\n              */}\n              <CredentialUsernameAutofillField email={userEmail} />\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CURRENT)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"current-password\"\n                  {...changeForm.register('currentPassword', { required: true })}\n                />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_NEW)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...changeForm.register('newPassword', { required: true })}\n                />\n                <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={tPolicy} />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CONFIRM)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...changeForm.register('confirmPassword', { required: true })}\n                />\n              </Field>\n              <Button type=\"submit\" disabled={submitting}>\n                {t(SecuritySettingsLabel.PASSWORD_CHANGE)}\n              </Button>\n            </form>\n          </FormProvider>\n        ) : (\n          <FormProvider {...setForm}>\n            <form onSubmit={setForm.handleSubmit(handleSet)} className=\"space-y-4\">\n              {/* Hidden username field — see the note in the change-password form above. */}\n              <CredentialUsernameAutofillField email={userEmail} />\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_NEW)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...setForm.register('newPassword', { required: true })}\n                />\n                <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={tPolicy} />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CONFIRM)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...setForm.register('confirmPassword', { required: true })}\n                />\n              </Field>\n              <Button type=\"submit\" disabled={submitting}>\n                {t(SecuritySettingsLabel.PASSWORD_SET)}\n              </Button>\n            </form>\n          </FormProvider>\n        )}\n    </SecurityFactorCard>\n  );\n};\n\ninterface IdentityLinksSectionProps {\n  links: ResolvedIdentityLink[];\n  allowRemoval: boolean;\n  t: (k: string, params?: Record<string, string | number>) => string;\n  onUnlink: (linkId: string) => void;\n}\n\nconst IdentityLinksSection: React.FC<IdentityLinksSectionProps> = ({ links, allowRemoval, t, onUnlink }) => (\n  <SecurityFactorCard\n    icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2]}\n    title={t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS)}\n    description={t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION)}\n    state={links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE}\n    statusLabel={t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED)}\n    meta={links.length > 0\n      ? <Text className=\"text-sm\">{t(SecuritySettingsLabel.IDENTITY_LINKS_COUNT, { count: links.length })}</Text>\n      : undefined}\n  >\n    {links.length === 0 ? (\n      <Text className=\"text-sm text-muted-foreground\">{t(SecuritySettingsLabel.IDENTITY_LINKS_EMPTY)}</Text>\n    ) : (\n      <ul className=\"flex flex-col gap-element\">\n        {links.map((link) => (\n          <li key={link._id} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\">\n            <div className=\"flex min-w-0 flex-col\">\n              <Text className=\"truncate font-medium\">{link.providerLabel}</Text>\n              <Text className=\"truncate text-xs text-muted-foreground\">{link.providerEmail}</Text>\n            </div>\n            {allowRemoval && (\n              <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => onUnlink(link._id)}>\n                {t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK)}\n              </Button>\n            )}\n          </li>\n        ))}\n      </ul>\n    )}\n  </SecurityFactorCard>\n);\n"]}
+{"version":3,"file":"AppPage_SecuritySettings.js","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,KAAK,EAA8B,MAAM,mDAAmD,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAyB,QAAQ,EAAE,MAAM,+DAA+D,CAAC;AAChH,OAAO,EAAE,2BAA2B,EAAE,MAAM,sEAAsE,CAAC;AACnH,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,GAIpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAA2B,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qEAAqE,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4FAA4F,CAAC;AAsBpG;;;;;;GAMG;AACH,IAAK,mBAIJ;AAJD,WAAK,mBAAmB;IACtB,wCAAiB,CAAA;IACjB,4CAAqB,CAAA;IACrB,kDAA2B,CAAA;AAC7B,CAAC,EAJI,mBAAmB,KAAnB,mBAAmB,QAIvB;AAED,MAAM,0BAA0B,GAAuD;IACrF,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,SAAS;IACvC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,SAAS;IACzC,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,WAAW;CAC/C,CAAC;AA4CF;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAqC,CAAC,EAC3D,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GACrE,EAAE,EAAE;IACH,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,KAAK,mBAAmB,CAAC,MAAM,CAAC;IAEtD,OAAO;IACL,gGAAgG;IAChG,oGAAoG;IACpG,yCAAyC;IACzC,eAAK,SAAS,EAAC,sDAAsD,aACnE,eAAK,SAAS,EAAC,oCAAoC,aAGjD,6BACc,MAAM,EAClB,SAAS,EAAE,EAAE,CACX,6DAA6D,EAC7D,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,gCAAgC,CAC3E,YAEA,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GACpC,EAEN,eAAK,SAAS,EAAC,6CAA6C,aAC1D,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,IAAI,IAAC,SAAS,EAAC,0BAA0B,YAAE,KAAK,GAAQ,EACzD,KAAC,KAAK,IAAC,OAAO,EAAE,0BAA0B,CAAC,KAAK,CAAC,YAAG,WAAW,GAAS,IACpE,EACL,CAAC,QAAQ,IAAI,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,WAAW,GAAQ,EACjF,IAAI,IACD,EAEL,MAAM,IAAI,cAAK,SAAS,EAAC,2CAA2C,YAAE,MAAM,GAAO,IAChF,EAKL,QAAQ,IAAI,CACX,cAAK,SAAS,EAAC,mEAAmE,YAAE,QAAQ,GAAO,CACpG,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAa,GAAG,EAAE;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAmB,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,mGAAmG;IACnG,sGAAsG;IACtG,MAAM,yBAAyB,GAAG,OAAO,CACvC,GAAG,EAAE,CAAC,uCAAuC,CAC3C,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAChF,EACD,CAAC,aAAa,CAAC,CAChB,CAAC;IACF,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QACxE,SAAS,EAAE;YACT,qBAAqB,CAAC,6BAA6B;YACnD,qBAAqB,CAAC,4BAA4B;YAClD,qBAAqB,CAAC,kCAAkC;SACzD;QACD,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,MAAwC,EAAE,EAAE,CACxD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,EAAE,MAAM,CAAC,EAC9E,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,CAAC,EACpF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;IAC1C,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACrE,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;IACnD,MAAM,WAAW,GAAG,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAC5D,MAAM,YAAY,GAAG,gBAAgB,EAAE,sBAAsB,IAAI,IAAI,CAAC;IAEtE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC5D,MAAM,CAAC,YAAY,EAAE;gBACrB,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,MAAM,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;aACvD,CAAC,CAAC;YACH,UAAU,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACrC,WAAW,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAC3C,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,EAAE,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAElC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,sFAAsF;IACtF,iGAAiG;IACjG,iGAAiG;IACjG,4CAA4C;IAC5C,MAAM,6BAA6B,GAAG,SAAS,CAAC,gCAAgC,EAAE,CAAC;IACnF,MAAM,oBAAoB,GAAG,OAAO;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC;SAC3F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC,2BAA2B,CAC/D,SAAS,CAAC,cAAc,EAAE,WAAW,IAAI,KAAK,EAC9C,SAAS,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EACzE,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAE,SAAS,CAAC,2BAA4C,EAChH,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,oBAAoB,IAAI,EAAE,CACjE,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,SAAS,EAAE,QAAQ,IAAI,KAAK,CAAC;IACnD,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,WAAiC,CAAC;IAC1E,MAAM,qBAAqB,GAAG,OAAO,CACnC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,IAAI;QACP,aAAa,EAAE,mCAAmC,CAAC;YACjD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW;YACzE,SAAS,EAAE,iBAAiB;SAC7B,CAAC;KACH,CAAC,CAAC,EACH,CAAC,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAChE,CAAC;IAEF,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC9C,IAAI,QAAQ,CAAC,MAAM,IAAI,WAAW;YAAE,OAAO;QAC3C,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO;QACzE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,sBAAsB,EAAE,CAAsD,CAAC;YAC7G,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;YACrJ,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEzE,MAAM,mBAAmB,GAAG,WAAW,CACrC,KAAK,EAAE,YAAoB,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC7D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EACD,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CACrD,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,cAAc,EAAE,CAAC;YAClD,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE3C,MAAM,oBAAoB,GAAG,WAAW,CACtC,KAAK,EAAE,MAAc,EAAE,EAAE;QACvB,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC5D,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,EACD,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CACrD,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACxF,MAAM,YAAY,GAAG,CAAC,iBAAiB;QACrC,CAAC,CAAC,mBAAmB,CAAC,WAAW;QACjC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAEpF,MAAM,cAAc,GAAG,CAAC,KAA0B,EAAU,EAAE;QAC5D,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YAC/E,KAAK,mBAAmB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;YACzF,KAAK,mBAAmB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CACrB,MAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,OAAO,CAAC,EACrD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAChD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,EACzC,MAAM,EAAE,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAC3D,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB,YACrG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAC7F,CACV,CAAC,CAAC,CAAC,SAAS,aAEZ,CAAC,iBAAiB,IAAI,CACrB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAoB,GAC7E,CACT,EAGA,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3C,aAAI,SAAS,EAAC,2BAA2B,YACtC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CACpB,cAA0B,SAAS,EAAC,wEAAwE,aAC1G,eAAK,SAAS,EAAC,uBAAuB,aACpC,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,EAAE,CAAC,IAAI,GAAQ,EACtD,EAAE,CAAC,SAAS,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAC5C,CAAC,CAAC,qBAAqB,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,GACtE,CACR,IACG,EACL,YAAY,IAAI,CACf,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,YACtH,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,GACjC,CACV,KAbM,EAAE,CAAC,YAAY,CAcnB,CACN,CAAC,GACC,CACN,IACiB,CACrB,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IACtF,MAAM,WAAW,GAAG,CAClB,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,IAAI,CAAC,EAClD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EACtD,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EACtC,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAChB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,YACxE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,CAAC,CAAC,SAAS,CAAC;YACd,wEAAwE;YACxE,2DAA2D;YAC3D,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAC9B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,YACpF,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAC7B,CACV,CAAC,YAEH,OAAO,CAAC,CAAC,CAAC,CACT,4BACG,YAAY,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CACtG,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAoB,GAC/E,CACT,GACA,CACJ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CACnB,KAAC,oBAAoB,IACnB,UAAU,EAAE,GAAG,EAAE;gBACf,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,GACjF,CACH,CAAC,CAAC,CAAC,IAAI,GACU,CACrB,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAC7F,MAAM,YAAY,GAAG,CACnB,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,OAAO,CAAC,EACrD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAC7C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EACvD,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC;QACvC,gGAAgG;QAChG,+FAA+F;QAC/F,IAAI,EAAE,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,WAAW,GAAQ,CAAC,CAAC,CAAC,SAAS,EAC/F,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CACtB,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,YACrF,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CACjC,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,YACrF,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,CACV,CAAC,YAED,aAAa,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAC5D,KAAC,qBAAqB,IACpB,UAAU,EAAE,GAAG,EAAE;gBACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,SAAS,EAAE,KAAK,EAChB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,GACjF,CACH,CAAC,CAAC,CAAC,IAAI,GACU,CACrB,CAAC;IAEF,8EAA8E;IAC9E,8DAA8D;IAC9D,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,gEAAgE;IAChE,4EAA4E;IAC5E,wEAAwE;IACxE,2DAA2D;IAE3D,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aAKxC,aAAI,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,GAAM,EAEhG,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EACA,UAAU,IAAI,CACb,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,UAAU,GAAoB,GAC3C,CACT,EAEA,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,IAAI,IAAC,SAAS,EAAC,uBAAuB,YAAE,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAQ,CAClF,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cACH,MAAC,WAAW,IAAC,SAAS,EAAC,6CAA6C,aACjE,cAAc,EACd,WAAW,EACX,YAAY,EACb,KAAC,eAAe,IACd,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,IAAI,EAAE,KAAK,EACtB,CAAC,EAAE,CAAC,EACJ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,GAAG,EAAE;gCACd,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;gCAChD,OAAO,EAAE,CAAC;4BACZ,CAAC,EACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAC/B,EACF,KAAC,oBAAoB,IACnB,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,YAAY,EAC1B,CAAC,EAAE,CAAC,EACJ,QAAQ,EAAE,oBAAoB,GAC9B,IACU,GACT,CACR,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAkBF,MAAM,eAAe,GAAmC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACrI,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAA4E;QACpG,aAAa,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;KAC7E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAmD;QACxE,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,IAA+E,EAAE,EAAE;QACxF,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACxF,SAAS,EAAE,CAAC;YACZ,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAC9D,CAAC;IAEF,MAAM,SAAS,GAAG,WAAW,CAC3B,KAAK,EAAE,IAAsD,EAAE,EAAE;QAC/D,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/D,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAC3D,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;IAEtF,OAAO,CACL,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,QAAQ,CAAC,EACtD,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAChD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,EAC/G,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAChB,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,OAAO,EAAE,GAAG,EAAE;gBACZ,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC,YAEA,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,GACzB,CACV,CAAC,CAAC,CAAC,CACF,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAC7E,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GACrF,CACV,YAEA,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAC7B,KAAC,YAAY,OAAK,UAAU,YAC1B,gBAAM,QAAQ,EAAE,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,SAAS,EAAC,WAAW,aAQ1E,KAAC,+BAA+B,IAAC,KAAK,EAAE,SAAS,GAAI,EACrD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,KAC3B,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC9D,IACI,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAc,EAChE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC1D,EACF,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,GAAI,IACnF,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC9D,IACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,YACvC,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAClC,IACJ,GACM,CAChB,CAAC,CAAC,CAAC,CACF,KAAC,YAAY,OAAK,OAAO,YACvB,gBAAM,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAC,WAAW,aAEpE,KAAC,+BAA+B,IAAC,KAAK,EAAE,SAAS,GAAI,EACrD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAc,EAChE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GACvD,EACF,KAAC,yBAAyB,IAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,GAAI,IACnF,EACR,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,KACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAC3D,IACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,YACvC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAC/B,IACJ,GACM,CAChB,GACe,CACrB,CAAC;AACJ,CAAC,CAAC;AASF,MAAM,oBAAoB,GAAwC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAC1G,KAAC,iBAAiB,IAChB,IAAI,EAAE,2BAA2B,CAAC,UAAU,CAAC,eAAe,CAAC,EAC7D,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,EACtD,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,EAChE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EACnF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,YAInH,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CACnB,aAAI,SAAS,EAAC,2BAA2B,YACtC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,cAAmB,SAAS,EAAC,wEAAwE,aACnG,eAAK,SAAS,EAAC,uBAAuB,aACpC,KAAC,IAAI,IAAC,SAAS,EAAC,sBAAsB,YAAE,IAAI,CAAC,aAAa,GAAQ,EAClE,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,IAAI,CAAC,aAAa,GAAQ,IAChF,EACL,YAAY,IAAI,CACf,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,YACpG,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GACxC,CACV,KATM,IAAI,CAAC,GAAG,CAUZ,CACN,CAAC,GACC,CACN,GACiB,CACrB,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useState } from 'react';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { Card, CardContent } from '~wildo-frontend-lib/components/sections/card';\nimport { Badge, type BadgeVariants_Variant } from '~wildo-frontend-lib/components/data-display/badge';\nimport { useIconRegistry } from '~wildo-frontend-lib/core/icons/useIconRegistry';\nimport { StandardIconReference, IconSize } from '~wildo-frontend-lib/core/icons/icon-registry.frontend.schemas';\nimport { AUTH_METHOD_ICON_REFERENCES } from '~wildo-frontend-lib/components/auth/methods/auth-method-presentation';\nimport { cn } from '~wildo-frontend-lib/core/ui/cn';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport {\n  AuthMethod,\n  AuthUtils,\n  isWildoBackendError,\n  type ExternalIdentitySource,\n  type PasswordPolicyRules,\n  type SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport { FormProvider, useForm } from 'react-hook-form';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { AuthSessionUtils } from '~wildo-frontend-lib/core/security/auth-session.utils';\nimport { PasswordStrengthIndicator, DEFAULT_PASSWORD_POLICY } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport { TotpEnrollmentMethod } from '~wildo-frontend-lib/components/auth/enrollment/TotpEnrollmentMethod';\nimport { PhoneEnrollmentMethod } from '~wildo-frontend-lib/components/auth/enrollment/PhoneEnrollmentMethod';\nimport { startRegistration } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/browser';\nimport { buildProviderDisplayNameLabelKey } from '@wildo-ai/saas-models/public-runtime';\nimport {\n  collectFrontendProviderDisplayLabelKeys,\n  resolveFrontendProviderDisplayLabel,\n} from '~wildo-frontend-lib/core/external-providers/frontend-provider-display-label.frontend.utils';\n\n// A new `SecuritySettingsLabel` member (`@wildo-ai/presets-components-models`)\n// must ALSO be declared in `AppPage_SecuritySettings.labels.ts`, beside this\n// file: that list — key, kind, purpose — is what the dev companion scans\n// statically to plan and translate the words, and an enum member missing\n// from it never reaches the labelling pipeline. The shared step-up dialog\n// (`StepUpAuthDialog`) reads the same component's keys.\n\ntype EnrolledMethod = { method: string; enrolled: boolean; enrolledAt?: string; details?: Record<string, unknown> };\ntype PasskeyCred = { credentialId: string; name: string; createdAt: string };\ntype IdentityLink = {\n  _id: string;\n  connectionType: SsoConnectionType;\n  source: ExternalIdentitySource;\n  providerRef: string;\n  providerEmail: string;\n  linkedAt: string;\n  lastUsedAt: string;\n};\ntype ResolvedIdentityLink = IdentityLink & { providerLabel: string };\n\n/**\n * Presentational state of one authentication factor.\n *\n * `UNAVAILABLE` is NOT \"off\" — it means the current device/browser cannot offer\n * the factor at all (no WebAuthn support), which is a different instruction to\n * the user than \"you have not set this up yet\" and therefore a distinct badge.\n */\nenum SecurityFactorState {\n  ACTIVE = 'active',\n  INACTIVE = 'inactive',\n  UNAVAILABLE = 'unavailable',\n}\n\nconst FACTOR_STATE_BADGE_VARIANT: Record<SecurityFactorState, BadgeVariants_Variant> = {\n  [SecurityFactorState.ACTIVE]: 'success',\n  [SecurityFactorState.INACTIVE]: 'outline',\n  [SecurityFactorState.UNAVAILABLE]: 'secondary',\n};\n\ninterface SecurityFactorRowProps {\n  /** Glyph identifying the method — resolved through the icon registry so apps can re-skin it. */\n  icon: StandardIconReference;\n  title: string;\n  /**\n   * Plain-language \"what this is / why it matters\" line — shown only while the factor is NOT active.\n   *\n   * It is a prompt for a decision the person has not taken yet (\"Authenticator apps provide one-time\n   * codes as a second sign-in step\" beside \"Set up authenticator app\"). Once the factor protects the\n   * account the decision is made, the badge says so, and the sentence is read on every visit for\n   * nothing — the same reason a read view carries no section descriptions.\n   */\n  description: string;\n  state: SecurityFactorState;\n  statusLabel: string;\n  /**\n   * A live detail the badge cannot carry — today only the masked verified phone number.\n   *\n   * Nothing that RESTATES the badge belongs here. \"Password is set.\" under \"Password · Active\",\n   * \"No authenticator app is set up.\" under \"Not configured\", and \"1 linked accounts\" above the list\n   * of that one account were each the same fact twice; they were removed with their labels.\n   */\n  meta?: React.ReactNode;\n  /**\n   * The factor's primary control, pinned to the inline-end of the header row.\n   * Every row's action lands on the same axis, so the column reads as a list of\n   * choices rather than as five stacked mini-pages — the account-security idiom\n   * used by mainstream providers. Anything that must expand (an enrolment flow,\n   * a credential list, a form) goes to `children` instead.\n   *\n   * Row actions are OUTLINE, without exception. They are peers: the panel offers\n   * five alternative ways to protect an account and recommends none of them, so\n   * filling any one of them would assert a priority the page does not hold —\n   * and five filled buttons stacked down a column assert five priorities, which\n   * is the same as none while costing all the emphasis. The filled variant is\n   * reserved for the commit action INSIDE an opened disclosure, where there\n   * genuinely is one thing to do next.\n   */\n  action?: React.ReactNode;\n  children?: React.ReactNode;\n}\n\n/**\n * One authentication factor, presented as a scannable row: glyph · name · what\n * it is · live status, with its primary control pinned to the row's end.\n *\n * This replaced a stack of visually identical title-only cards, which forced the\n * user to READ every card to learn which factors were active and offered no\n * explanation of what any factor was. The status badge and the icon carry that\n * information pre-attentively; the description makes the choice informed. The\n * shape follows the account-security idiom used by mainstream providers.\n */\nconst SecurityFactorRow: React.FC<SecurityFactorRowProps> = ({\n  icon, title, description, state, statusLabel, meta, action, children,\n}) => {\n  const { renderIcon } = useIconRegistry();\n  const isActive = state === SecurityFactorState.ACTIVE;\n\n  return (\n    // One row of ONE card: the factors are a single list of alternatives, so they share a frame and\n    // are separated by hairlines (the settings-row idiom) rather than each carrying a card of its own —\n    // five stacked cards read as five pages.\n    <div className=\"flex flex-col gap-item py-group first:pt-0 last:pb-0\">\n      <div className=\"flex flex-row items-start gap-item\">\n        {/* Tinted glyph tile — tinted only when the factor is live, so the eye\n            lands on what is protecting the account before any text is read. */}\n        <div\n          aria-hidden=\"true\"\n          className={cn(\n            'flex size-9 shrink-0 items-center justify-center rounded-md',\n            isActive ? 'bg-success/10 text-success' : 'bg-muted text-muted-foreground',\n          )}\n        >\n          {renderIcon(icon, { size: IconSize.SM })}\n        </div>\n\n        <div className=\"flex min-w-0 flex-1 flex-col gap-element-xs\">\n          <div className=\"flex flex-wrap items-center gap-element-xs\">\n            <Text className=\"font-medium leading-snug\">{title}</Text>\n            <Badge variant={FACTOR_STATE_BADGE_VARIANT[state]}>{statusLabel}</Badge>\n          </div>\n          {!isActive && <Text className=\"text-sm text-muted-foreground\">{description}</Text>}\n          {meta}\n        </div>\n\n        {action && <div className=\"flex shrink-0 items-center gap-element-xs\">{action}</div>}\n      </div>\n\n      {/* Expanded content aligns with the TEXT column, not the glyph: the\n          indent is the glyph tile (`size-9`) plus the row gap, so a form or a\n          credential list continues the sentence it belongs to. */}\n      {children && (\n        <div className=\"flex flex-col gap-item ps-[calc(var(--spacing)*9+var(--sp-item))]\">{children}</div>\n      )}\n    </div>\n  );\n};\n\nexport const AppPage_SecuritySettings: React.FC = () => {\n  const { auth } = useApplication();\n  const { auth: authState } = useAuthSession();\n  const { user } = useUserOrgs();\n  const resolvedAuth = useResolvedAuthConfig();\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  const [methods, setMethods] = useState<EnrolledMethod[]>([]);\n  const [passkeys, setPasskeys] = useState<PasskeyCred[]>([]);\n  const [identityLinks, setIdentityLinks] = useState<IdentityLink[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [successMsg, setSuccessMsg] = useState<string | null>(null);\n  const [showTotpEnroll, setShowTotpEnroll] = useState(false);\n  const [showPhoneEnroll, setShowPhoneEnroll] = useState(false);\n  const [passkeyRegistering, setPasskeyRegistering] = useState(false);\n  // The linked provider's name is `providers.<ref>.displayName`, derived from the ref the link holds\n  // (#1701) — never read off a frontend provider module, since sign-in runs no vendor code in the page.\n  const identityProviderLabelKeys = useMemo(\n    () => collectFrontendProviderDisplayLabelKeys(\n      identityLinks.map((link) => buildProviderDisplayNameLabelKey(link.providerRef)),\n    ),\n    [identityLinks],\n  );\n  const { tComponent, t: translateProvider, isReady, formatDate } = useI18n({\n    component: [\n      FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS,\n      FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER,\n      FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED,\n    ],\n    keys: identityProviderLabelKeys,\n  });\n  const t = useCallback(\n    (key: string, params?: Record<string, string | number>) =>\n      tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key, params),\n    [tComponent],\n  );\n  const tPolicy = useCallback(\n    (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, key),\n    [tComponent],\n  );\n\n  const passkeyConfig = auth?.passkeyConfig;\n  const methodManagement = resolvedAuth.userTypeAuth?.methodManagement;\n  const passwordPolicy = resolvedAuth.passwordPolicy;\n  const maxPasskeys = passkeyConfig?.maxPasskeysPerUser ?? 10;\n  const allowRemoval = methodManagement?.allowUserMethodRemoval ?? true;\n\n  const refresh = useCallback(async () => {\n    setLoading(true);\n    setError(null);\n    try {\n      const client = getManualCallsHttpClient();\n      const [methodsRes, passkeysRes, linksRes] = await Promise.all([\n        client.getMyMethods(),\n        client.passkeyList().catch(() => ({ credentials: [] })),\n        client.getIdentityLinks().catch(() => ({ links: [] })),\n      ]);\n      setMethods(methodsRes.methods ?? []);\n      setPasskeys(passkeysRes.credentials ?? []);\n      setIdentityLinks(linksRes.links ?? []);\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n    } finally {\n      setLoading(false);\n    }\n  }, [t, toUserFacingErrorMessage]);\n\n  useEffect(() => {\n    refresh();\n  }, [refresh]);\n\n  useEffect(() => {\n    if (!successMsg) return;\n    const timer = setTimeout(() => setSuccessMsg(null), 5000);\n    return () => clearTimeout(timer);\n  }, [successMsg]);\n\n  // Derived, not listed. The literal `[TOTP, PASSKEY, SMS_OTP]` that stood here was the\n  // second-factor vocabulary minus the factors that need no enrollment — correct on the day it was\n  // written and silently short the day a fifth second factor is added, since a method missing from\n  // the list simply never counts as enrolled.\n  const enrollableSecondFactorMethods = AuthUtils.getEnrollableSecondFactorMethods();\n  const enrolledSecondFactor = methods\n    .filter((m) => m.enrolled && enrollableSecondFactorMethods.includes(m.method as AuthMethod))\n    .map((m) => m.method as AuthMethod);\n  const completeness = AuthSessionUtils.evaluateAccountCompleteness(\n    authState.identification?.requiresMFA ?? false,\n    authState.identification?.secondFactorMethods?.map((m) => m.method) ?? [],\n    enrolledSecondFactor.length > 0 ? enrolledSecondFactor : (authState.enrolledSecondFactorMethods as AuthMethod[]),\n    resolvedAuth.userTypeAuth?.mfaPolicy?.acceptableMFAMethods ?? [],\n  );\n\n  const hasPassword = methods.some((m) => m.method === AuthMethod.PASSWORD && m.enrolled);\n  const hasTotp = methods.some((m) => m.method === AuthMethod.TOTP && m.enrolled);\n  const smsMethod = methods.find((m) => m.method === AuthMethod.SMS_OTP);\n  const phoneVerified = smsMethod?.enrolled ?? false;\n  const phoneMasked = smsMethod?.details?.phoneNumber as string | undefined;\n  const resolvedIdentityLinks = useMemo(\n    () => identityLinks.map((link) => ({\n      ...link,\n      providerLabel: resolveFrontendProviderDisplayLabel({\n        providerRef: link.providerRef,\n        displayName: auth?.socialOAuth2Providers?.[link.providerRef]?.displayName,\n        translate: translateProvider,\n      }),\n    })),\n    [auth?.socialOAuth2Providers, identityLinks, translateProvider],\n  );\n\n  const handlePasskeyAdd = useCallback(async () => {\n    if (passkeys.length >= maxPasskeys) return;\n    if (typeof window === 'undefined' || !window.PublicKeyCredential) return;\n    setPasskeyRegistering(true);\n    setError(null);\n    try {\n      const client = getManualCallsHttpClient();\n      const options = (await client.passkeyRegisterOptions()) as unknown as PublicKeyCredentialCreationOptionsJSON;\n      const credential = await startRegistration({ optionsJSON: options });\n      await client.passkeyRegisterVerify({ response: credential });\n      setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n      refresh();\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      const msg = e?.name === 'NotAllowedError' ? t(SecuritySettingsLabel.PASSKEY_CANCELLED) : toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR));\n      setError(msg);\n    } finally {\n      setPasskeyRegistering(false);\n    }\n  }, [maxPasskeys, passkeys.length, refresh, t, toUserFacingErrorMessage]);\n\n  const handlePasskeyRemove = useCallback(\n    async (credentialId: string) => {\n      if (!allowRemoval) return;\n      try {\n        await getManualCallsHttpClient().passkeyRemove(credentialId);\n        setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n        refresh();\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      }\n    },\n    [allowRemoval, refresh, t, toUserFacingErrorMessage],\n  );\n\n  /*\n   * No re-authentication handling here, deliberately. Where the user type asks for it, the server\n   * answers `STEP_UP_REQUIRED` and the HTTP client answers that by itself — the shared step-up dialog\n   * (`StepUpAuthProvider`), then a replay carrying `X-Reauth-Token`. The same is true of adding a\n   * passkey, confirming TOTP and confirming a phone below. This page used to carry its own password-only\n   * copy of that dialog for this one action, and nothing for the binding actions at all.\n   */\n  const handleTotpDisable = useCallback(async () => {\n    try {\n      await getManualCallsHttpClient().mfaTOTPDisable();\n      setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n      setShowTotpEnroll(false);\n      refresh();\n    } catch (e: any) {\n      if (isWildoBackendError(e)) throw e;\n      setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n    }\n  }, [refresh, t, toUserFacingErrorMessage]);\n\n  const handleUnlinkIdentity = useCallback(\n    async (linkId: string) => {\n      if (!allowRemoval) return;\n      try {\n        await getManualCallsHttpClient().unlinkIdentityLink(linkId);\n        setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n        refresh();\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      }\n    },\n    [allowRemoval, refresh, t, toUserFacingErrorMessage],\n  );\n\n  if (!isReady) return null;\n\n  // Passkeys are only offerable where WebAuthn exists; an unsupported browser is\n  // a distinct state from \"not set up yet\" and gets its own badge + no CTA.\n  const passkeysSupported = typeof window !== 'undefined' && !!window.PublicKeyCredential;\n  const passkeyState = !passkeysSupported\n    ? SecurityFactorState.UNAVAILABLE\n    : passkeys.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n\n  const statusLabelFor = (state: SecurityFactorState): string => {\n    switch (state) {\n      case SecurityFactorState.ACTIVE: return t(SecuritySettingsLabel.STATUS_ACTIVE);\n      case SecurityFactorState.UNAVAILABLE: return t(SecuritySettingsLabel.STATUS_UNAVAILABLE);\n      case SecurityFactorState.INACTIVE: return t(SecuritySettingsLabel.STATUS_NOT_CONFIGURED);\n    }\n  };\n\n  const PasskeySection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY]}\n      title={t(SecuritySettingsLabel.SECTION_PASSKEYS)}\n      description={t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION)}\n      state={passkeyState}\n      statusLabel={statusLabelFor(passkeyState)}\n      action={passkeysSupported && passkeys.length < maxPasskeys ? (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={handlePasskeyAdd} disabled={passkeyRegistering}>\n          {passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD)}\n        </Button>\n      ) : undefined}\n    >\n      {!passkeysSupported && (\n        <Alert>\n          <AlertDescription>{t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED)}</AlertDescription>\n        </Alert>\n      )}\n      {/* The registered passkeys ARE the detail: no count above them, and no \"No passkeys added\n          yet.\" when there are none — the \"Not configured\" badge already says it. */}\n      {passkeysSupported && passkeys.length > 0 && (\n        <ul className=\"flex flex-col gap-element\">\n          {passkeys.map((pk) => (\n            <li key={pk.credentialId} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\">\n              <div className=\"flex min-w-0 flex-col\">\n                <Text className=\"truncate font-medium\">{pk.name}</Text>\n                {pk.createdAt && (\n                  <Text className=\"text-xs text-muted-foreground\">\n                    {t(SecuritySettingsLabel.PASSKEY_ADDED, { date: formatDate(pk.createdAt) })}\n                  </Text>\n                )}\n              </div>\n              {allowRemoval && (\n                <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => handlePasskeyRemove(pk.credentialId)}>\n                  {t(SecuritySettingsLabel.PASSKEY_REMOVE)}\n                </Button>\n              )}\n            </li>\n          ))}\n        </ul>\n      )}\n    </SecurityFactorRow>\n  );\n\n  const totpState = hasTotp ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n  const TotpSection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP]}\n      title={t(SecuritySettingsLabel.SECTION_TOTP)}\n      description={t(SecuritySettingsLabel.TOTP_DESCRIPTION)}\n      state={totpState}\n      statusLabel={statusLabelFor(totpState)}\n      action={hasTotp\n        ? (allowRemoval ? (\n          <Button variant={ButtonVariants_Variant.OUTLINE} onClick={handleTotpDisable}>\n            {t(SecuritySettingsLabel.TOTP_DISABLE)}\n          </Button>\n        ) : undefined)\n        // While the enrolment flow is open its own controls own the row, so the\n        // opener is withdrawn rather than left as a second way in.\n        : (showTotpEnroll ? undefined : (\n          <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowTotpEnroll(true)}>\n            {t(SecuritySettingsLabel.TOTP_SETUP)}\n          </Button>\n        ))}\n    >\n      {hasTotp ? (\n        <>\n          {completeness.enrolledMethods.length === 1 && completeness.enrolledMethods.includes(AuthMethod.TOTP) && (\n            <Alert>\n              <AlertDescription>{t(SecuritySettingsLabel.TOTP_ONLY_MFA_WARNING)}</AlertDescription>\n            </Alert>\n          )}\n        </>\n      ) : showTotpEnroll ? (\n        <TotpEnrollmentMethod\n          onComplete={() => {\n            setShowTotpEnroll(false);\n            refresh();\n          }}\n          onError={(msg) => setError(msg)}\n          isLoading={false}\n          t={(k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k)}\n        />\n      ) : null}\n    </SecurityFactorRow>\n  );\n\n  const phoneState = phoneVerified ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n  const PhoneSection = (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP]}\n      title={t(SecuritySettingsLabel.SECTION_PHONE)}\n      description={t(SecuritySettingsLabel.PHONE_DESCRIPTION)}\n      state={phoneState}\n      statusLabel={statusLabelFor(phoneState)}\n      // WHICH number is verified is the one thing the \"Active\" badge cannot say, so the masked number\n      // stands alone — no \"Verified:\" in front of it (the badge) and no sentence when there is none.\n      meta={phoneVerified && phoneMasked ? <Text className=\"text-sm\">{phoneMasked}</Text> : undefined}\n      action={phoneVerified ? (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowPhoneEnroll(true)}>\n          {t(SecuritySettingsLabel.PHONE_CHANGE)}\n        </Button>\n      ) : (showPhoneEnroll ? undefined : (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setShowPhoneEnroll(true)}>\n          {t(SecuritySettingsLabel.PHONE_VERIFY)}\n        </Button>\n      ))}\n    >\n      {phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (\n        <PhoneEnrollmentMethod\n          onComplete={() => {\n            setShowPhoneEnroll(false);\n            refresh();\n          }}\n          onError={(msg) => setError(msg)}\n          isLoading={false}\n          t={(k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k)}\n        />\n      ) : null}\n    </SecurityFactorRow>\n  );\n\n  // ── No posture summary, deliberately ───────────────────────────────────────\n  // Two rejected designs, for whoever is tempted to re-add one:\n  //   1. \"Your account is fully secured\" keyed off `completeness.isComplete` —\n  //      that flag answers \"does this satisfy the app's auth POLICY?\", and it is\n  //      `true` whenever MFA is not required. It therefore claimed a fully\n  //      secured account for an account with zero second factors.\n  //   2. An \"n of 4 sign-in methods active\" ratio with a progress meter — a\n  //      score with no referent. The denominator is not a target: nobody needs\n  //      SMS *and* TOTP *and* a passkey, the factors are alternatives, and the\n  //      remedy differs per factor. A meter that fills toward a number the user\n  //      should not reach measures nothing and invites gaming it.\n  // The rows below already carry the state (per-factor badge) and the meaning\n  // (per-factor description). A summary that restates them as a number is\n  // strictly less information, presented as if it were more.\n\n  return (\n    <div className=\"flex flex-col gap-section\">\n      {/* `h3`, not `h2`: the Settings Hub header owns the `h2` for this dialog,\n          so a panel heading is one level below it. */}\n      {/* No sub-heading: \"Manage how you sign in and protect your account\" restated the heading and the\n          five factor names beneath it. */}\n      <h3 className=\"text-base font-semibold tracking-tight\">{t(SecuritySettingsLabel.PAGE_TITLE)}</h3>\n\n      {error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n      )}\n      {successMsg && (\n        <Alert>\n          <AlertDescription>{successMsg}</AlertDescription>\n        </Alert>\n      )}\n\n      {loading ? (\n        <Text className=\"text-muted-foreground\">{t(SecuritySettingsLabel.LOADING)}</Text>\n      ) : (\n        <Card>\n          <CardContent className=\"flex flex-col divide-y divide-border p-card\">\n            {PasskeySection}\n            {TotpSection}\n            {PhoneSection}\n            <PasswordSection\n              hasPassword={hasPassword}\n              passwordPolicy={passwordPolicy}\n              userEmail={user?.email}\n              t={t}\n              tPolicy={tPolicy}\n              onSuccess={() => {\n                setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));\n                refresh();\n              }}\n              onError={(msg) => setError(msg)}\n            />\n            <IdentityLinksSection\n              links={resolvedIdentityLinks}\n              allowRemoval={allowRemoval}\n              t={t}\n              onUnlink={handleUnlinkIdentity}\n            />\n          </CardContent>\n        </Card>\n      )}\n    </div>\n  );\n};\n\ninterface PasswordSectionProps {\n  hasPassword: boolean;\n  passwordPolicy: PasswordPolicyRules;\n  /**\n   * Signed-in user's email. Rendered as a visually-hidden\n   * `autocomplete=\"username\"` field inside each password form so password\n   * managers associate the saved/updated credential with the correct account\n   * (Chromium also warns when a password form has no username field).\n   */\n  userEmail?: string;\n  t: (k: string, params?: Record<string, string | number>) => string;\n  tPolicy: (k: string) => string;\n  onSuccess: () => void;\n  onError: (msg: string) => void;\n}\n\nconst PasswordSection: React.FC<PasswordSectionProps> = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, onSuccess, onError }) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const [submitting, setSubmitting] = useState(false);\n  // The credential form is a DISCLOSURE, not the row's resting state. Rendered\n  // eagerly it was four inputs plus a strength meter permanently open beneath a\n  // one-line row, which made this factor read as the page's subject and the\n  // other four as its footnotes. Every row now rests at the same height and\n  // opens on request.\n  const [editing, setEditing] = useState(false);\n  const changeForm = useForm<{ currentPassword: string; newPassword: string; confirmPassword: string }>({\n    defaultValues: { currentPassword: '', newPassword: '', confirmPassword: '' },\n  });\n  const setForm = useForm<{ newPassword: string; confirmPassword: string }>({\n    defaultValues: { newPassword: '', confirmPassword: '' },\n  });\n\n  const handleChange = useCallback(\n    async (data: { currentPassword: string; newPassword: string; confirmPassword: string }) => {\n      if (data.newPassword !== data.confirmPassword) {\n        onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));\n        return;\n      }\n      setSubmitting(true);\n      try {\n        await getManualCallsHttpClient().passwordChange(data.currentPassword, data.newPassword);\n        onSuccess();\n        changeForm.reset();\n        setEditing(false);\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      } finally {\n        setSubmitting(false);\n      }\n    },\n    [changeForm, onError, onSuccess, t, toUserFacingErrorMessage],\n  );\n\n  const handleSet = useCallback(\n    async (data: { newPassword: string; confirmPassword: string }) => {\n      if (data.newPassword !== data.confirmPassword) {\n        onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));\n        return;\n      }\n      setSubmitting(true);\n      try {\n        await getManualCallsHttpClient().passwordSet(data.newPassword);\n        onSuccess();\n        setForm.reset();\n        setEditing(false);\n      } catch (e: any) {\n        if (isWildoBackendError(e)) throw e;\n        onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));\n      } finally {\n        setSubmitting(false);\n      }\n    },\n    [onError, onSuccess, setForm, t, toUserFacingErrorMessage],\n  );\n\n  const state = hasPassword ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;\n\n  return (\n    <SecurityFactorRow\n      icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD]}\n      title={t(SecuritySettingsLabel.SECTION_PASSWORD)}\n      description={t(SecuritySettingsLabel.PASSWORD_DESCRIPTION)}\n      state={state}\n      statusLabel={t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED)}\n      action={editing ? (\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          onClick={() => {\n            setEditing(false);\n            changeForm.reset();\n            setForm.reset();\n          }}\n        >\n          {t(SecuritySettingsLabel.CANCEL)}\n        </Button>\n      ) : (\n        <Button variant={ButtonVariants_Variant.OUTLINE} onClick={() => setEditing(true)}>\n          {t(hasPassword ? SecuritySettingsLabel.PASSWORD_CHANGE : SecuritySettingsLabel.PASSWORD_SET)}\n        </Button>\n      )}\n    >\n      {!editing ? null : hasPassword ? (\n          <FormProvider {...changeForm}>\n            <form onSubmit={changeForm.handleSubmit(handleChange)} className=\"space-y-4\">\n              {/*\n                Hidden username field. Gives password managers the account\n                context they need to associate the updated credential, and\n                resolves Chromium's \"password forms should have an (optionally\n                hidden) username field\" warning. Must precede the password\n                inputs so managers pair the username with them.\n              */}\n              <CredentialUsernameAutofillField email={userEmail} />\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CURRENT)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"current-password\"\n                  {...changeForm.register('currentPassword', { required: true })}\n                />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_NEW)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...changeForm.register('newPassword', { required: true })}\n                />\n                <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={tPolicy} />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CONFIRM)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...changeForm.register('confirmPassword', { required: true })}\n                />\n              </Field>\n              <Button type=\"submit\" disabled={submitting}>\n                {t(SecuritySettingsLabel.PASSWORD_CHANGE)}\n              </Button>\n            </form>\n          </FormProvider>\n        ) : (\n          <FormProvider {...setForm}>\n            <form onSubmit={setForm.handleSubmit(handleSet)} className=\"space-y-4\">\n              {/* Hidden username field — see the note in the change-password form above. */}\n              <CredentialUsernameAutofillField email={userEmail} />\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_NEW)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...setForm.register('newPassword', { required: true })}\n                />\n                <PasswordStrengthIndicator fieldName=\"newPassword\" policy={passwordPolicy} t={tPolicy} />\n              </Field>\n              <Field>\n                <FieldLabel>{t(SecuritySettingsLabel.PASSWORD_CONFIRM)}</FieldLabel>\n                <InputRoot\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  {...setForm.register('confirmPassword', { required: true })}\n                />\n              </Field>\n              <Button type=\"submit\" disabled={submitting}>\n                {t(SecuritySettingsLabel.PASSWORD_SET)}\n              </Button>\n            </form>\n          </FormProvider>\n        )}\n    </SecurityFactorRow>\n  );\n};\n\ninterface IdentityLinksSectionProps {\n  links: ResolvedIdentityLink[];\n  allowRemoval: boolean;\n  t: (k: string, params?: Record<string, string | number>) => string;\n  onUnlink: (linkId: string) => void;\n}\n\nconst IdentityLinksSection: React.FC<IdentityLinksSectionProps> = ({ links, allowRemoval, t, onUnlink }) => (\n  <SecurityFactorRow\n    icon={AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2]}\n    title={t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS)}\n    description={t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION)}\n    state={links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE}\n    statusLabel={t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED)}\n  >\n    {/* The linked accounts ARE the detail: no count above the list, no empty sentence under a\n        \"Not configured\" badge. */}\n    {links.length > 0 && (\n      <ul className=\"flex flex-col gap-element\">\n        {links.map((link) => (\n          <li key={link._id} className=\"flex items-center justify-between gap-item rounded-md border p-card-sm\">\n            <div className=\"flex min-w-0 flex-col\">\n              <Text className=\"truncate font-medium\">{link.providerLabel}</Text>\n              <Text className=\"truncate text-xs text-muted-foreground\">{link.providerEmail}</Text>\n            </div>\n            {allowRemoval && (\n              <Button variant={ButtonVariants_Variant.OUTLINE} size={ButtonSize.SM} onClick={() => onUnlink(link._id)}>\n                {t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK)}\n              </Button>\n            )}\n          </li>\n        ))}\n      </ul>\n    )}\n  </SecurityFactorRow>\n);\n"]}

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_SecuritySettings.labels.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA2B,MAAM,qCAAqC,CAAC;AAM1I,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAmFjE,CAAC"}
+{"version":3,"file":"AppPage_SecuritySettings.labels.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA2B,MAAM,qCAAqC,CAAC;AAM1I,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAiFjE,CAAC"}

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.labels.js

@@ -4,38 +4,28 @@ import { FrontendComponentType, LabelKind, registerComponentLabels } from '@wild
 // NOT imported at runtime, so it never ships in the bundle.
 export const AppLayoutsSecuritySettingsLabels = [
     { ref: 'pageTitle', kind: LabelKind.HEADING, purpose: 'Page heading for the account security-settings screen' },
-    { ref: 'accountComplete', kind: LabelKind.MESSAGE, purpose: 'Status line shown when the account meets all required security factors' },
-    { ref: 'accountIncomplete', kind: LabelKind.MESSAGE, purpose: 'Status line shown when the account is missing a required security factor' },
     { ref: 'sectionPasskeys', kind: LabelKind.HEADING, purpose: 'Section title for the passkeys management card' },
     { ref: 'sectionTotp', kind: LabelKind.HEADING, purpose: 'Section title for the authenticator-app (TOTP) management card' },
     { ref: 'sectionPhone', kind: LabelKind.HEADING, purpose: 'Section title for the phone / SMS management card' },
     { ref: 'sectionPassword', kind: LabelKind.HEADING, purpose: 'Section title for the password management card' },
     { ref: 'sectionIdentityLinks', kind: LabelKind.HEADING, purpose: 'Section title for the linked social-identity providers card' },
     { ref: 'passkeyAdd', kind: LabelKind.BUTTON, purpose: 'Button that registers a new passkey' },
-    { ref: 'passkeyEmpty', kind: LabelKind.EMPTY_STATE, purpose: 'Empty state shown when the user has no passkeys registered' },
     { ref: 'passkeyUnsupported', kind: LabelKind.MESSAGE, purpose: 'Notice shown when the device or browser does not support passkeys' },
     { ref: 'passkeyRemove', kind: LabelKind.BUTTON, purpose: 'Button that removes an individual passkey' },
-    { ref: 'passkeyRename', kind: LabelKind.BUTTON, purpose: 'Button that renames an individual passkey' },
-    { ref: 'totpEnabled', kind: LabelKind.MESSAGE, purpose: 'Status line shown when an authenticator app is already set up' },
-    { ref: 'totpNotSetup', kind: LabelKind.MESSAGE, purpose: 'Status line shown when no authenticator app is configured' },
     { ref: 'totpSetup', kind: LabelKind.BUTTON, purpose: 'Button that starts authenticator-app setup' },
     { ref: 'totpDisable', kind: LabelKind.BUTTON, purpose: 'Button that disables the authenticator app' },
     { ref: 'totpOnlyMfaWarning', kind: LabelKind.MESSAGE, purpose: 'Warning that the authenticator app is the only enrolled second factor' },
-    { ref: 'phoneVerified', kind: LabelKind.MESSAGE, purpose: 'Status line shown when a phone number is verified (masked number appended)' },
-    { ref: 'phoneNotVerified', kind: LabelKind.MESSAGE, purpose: 'Status line shown when no phone number is verified' },
     { ref: 'phoneChange', kind: LabelKind.BUTTON, purpose: 'Button that changes the verified phone number' },
     { ref: 'passwordChange', kind: LabelKind.BUTTON, purpose: 'Submit button that changes the existing password' },
     { ref: 'passwordSet', kind: LabelKind.BUTTON, purpose: 'Submit button that sets a password for an account that has none' },
     { ref: 'passwordCurrent', kind: LabelKind.LABEL, purpose: 'Field label for the current-password input' },
     { ref: 'passwordNew', kind: LabelKind.LABEL, purpose: 'Field label for the new-password input' },
     { ref: 'passwordConfirm', kind: LabelKind.LABEL, purpose: 'Field label for the confirm-new-password input' },
-    { ref: 'identityLinksEmpty', kind: LabelKind.EMPTY_STATE, purpose: 'Empty state shown when no social identities are linked' },
     { ref: 'identityLinksUnlink', kind: LabelKind.BUTTON, purpose: 'Button that unlinks a connected social identity' },
     { ref: 'reauthTitle', kind: LabelKind.HEADING, purpose: 'Title of the re-authentication confirmation dialog' },
     { ref: 'reauthDescription', kind: LabelKind.DESCRIPTION, purpose: 'Explains that the person must confirm it is really them before this sensitive change goes through. Must not name a method: they may confirm with a password, a passkey or an authenticator code' },
     { ref: 'reauthPassword', kind: LabelKind.LABEL, purpose: 'Field label for the re-authentication password input' },
-    { ref: 'confirm', kind: LabelKind.BUTTON, purpose: 'Confirm button for the re-authentication dialog' },
-    { ref: 'cancel', kind: LabelKind.BUTTON, purpose: 'Cancel button for the re-authentication dialog' },
+    { ref: 'cancel', kind: LabelKind.BUTTON, purpose: 'Button that closes the password change or set-password form without saving' },
     { ref: 'success', kind: LabelKind.MESSAGE, purpose: 'Generic confirmation shown after a successful security change' },
     { ref: 'error', kind: LabelKind.MESSAGE, purpose: 'Generic error shown when a security operation fails' },
     { ref: 'passkeyCancelled', kind: LabelKind.MESSAGE, purpose: 'Notice shown when the user cancels passkey registration' },
@@ -50,6 +40,7 @@ export const AppLayoutsSecuritySettingsLabels = [
     { ref: 'reauthTotpCode', kind: LabelKind.LABEL, purpose: 'Field label for the authenticator-app code input in the re-authentication dialog' },
     { ref: 'reauthTotpCodePlaceholder', kind: LabelKind.PLACEHOLDER, purpose: 'Placeholder inside the authenticator-app code input, which takes the current one-time code' },
     { ref: 'reauthNoAcceptedMethod', kind: LabelKind.MESSAGE, purpose: 'Shown in the re-authentication dialog when none of the account\'s sign-in methods is accepted for this confirmation, because the account\'s security policy requires a method it has not added yet. Tells the person to add that method (for example a passkey) in their security settings first' },
+    { ref: 'reauthClientOrganizationDescription', kind: LabelKind.DESCRIPTION, purpose: 'Shown in the re-authentication dialog to an expert from a service firm who has just opened a client organization\'s workspace: that organization asks people working in it on behalf of a service firm to confirm with a second factor (an authenticator code or a passkey) before continuing, and this confirmation counts for that organization only. Must not name a specific organization' },
     {
         ref: 'reauthWithProvider',
         kind: LabelKind.BUTTON,
@@ -66,11 +57,22 @@ export const AppLayoutsSecuritySettingsLabels = [
     { ref: 'reauthProviderTimedOut', kind: LabelKind.MESSAGE, purpose: 'Error in the re-authentication dialog when signing in again at the identity provider was not finished in time (the sign-in window was left open or closed without finishing); they can try again or choose another method' },
     { ref: 'reauthProviderFailed', kind: LabelKind.MESSAGE, purpose: 'Error in the re-authentication dialog when signing in again at the identity provider did not confirm the person; they can try again or choose another method' },
     { ref: 'phoneVerify', kind: LabelKind.BUTTON, purpose: 'Button that starts phone-number verification' },
-    // Posture summary + per-factor descriptive copy. The panel presents each
-    // authentication factor as a scannable row (icon · name · what it is · live
-    // status), so every factor owns a short plain-language description and every
-    // state owns an explicit status word.
-    { ref: 'pageDescription', kind: LabelKind.DESCRIPTION, purpose: 'Sub-heading explaining that this screen manages how the user signs in and protects their account' },
+    // Per-factor descriptive copy. The panel presents each authentication factor
+    // as a scannable row (icon · name · status badge), so every state owns an
+    // explicit status word, and every factor owns a short plain-language
+    // description that is shown only while the factor is NOT active — it is the
+    // prompt for a decision not yet taken.
+    //
+    // Removed with the text they rendered, because each restated something else on
+    // the same row: the panel sub-heading (`pageDescription`), the status lines
+    // under a badge saying the same (`totpEnabled`, `totpNotSetup`,
+    // `phoneNotVerified`, `passwordSetStatus`, `passwordNotSetStatus`), the empty
+    // sentences under a "Not configured" badge (`passkeyEmpty`,
+    // `identityLinksEmpty`), the counts above the lists they count (`passkeyCount`,
+    // `identityLinksCount`) and the "Verified:" in front of the masked phone number
+    // (`phoneVerified`). Their `SecuritySettingsLabel` members went with them, as did
+    // `accountComplete` / `accountIncomplete`, `passkeyRename` and a `confirm` the
+    // re-authentication dialog never read (its confirm button is the critical-confirm's own).
     { ref: 'statusActive', kind: LabelKind.MESSAGE, purpose: 'Short status word on a factor the user has configured' },
     { ref: 'statusNotConfigured', kind: LabelKind.MESSAGE, purpose: 'Short status word on a factor the user has not configured yet' },
     { ref: 'statusUnavailable', kind: LabelKind.MESSAGE, purpose: 'Short status word on a factor unavailable on the current device or browser' },
@@ -79,11 +81,7 @@ export const AppLayoutsSecuritySettingsLabels = [
     { ref: 'phoneDescription', kind: LabelKind.DESCRIPTION, purpose: 'Plain-language explanation of SMS one-time codes to a verified phone number' },
     { ref: 'passwordDescription', kind: LabelKind.DESCRIPTION, purpose: 'Plain-language explanation of the account password as a sign-in credential' },
     { ref: 'identityLinksDescription', kind: LabelKind.DESCRIPTION, purpose: 'Plain-language explanation of external identity accounts linked for sign-in' },
-    { ref: 'passkeyCount', kind: LabelKind.MESSAGE, purpose: 'Number of passkeys currently registered on the account', params: ['count'] },
     { ref: 'passkeyAdded', kind: LabelKind.MESSAGE, purpose: 'Registration date shown under an individual passkey entry', params: ['date'] },
-    { ref: 'passwordSetStatus', kind: LabelKind.MESSAGE, purpose: 'Status line shown when the account has a password set' },
-    { ref: 'passwordNotSetStatus', kind: LabelKind.MESSAGE, purpose: 'Status line shown when the account has no password set' },
-    { ref: 'identityLinksCount', kind: LabelKind.MESSAGE, purpose: 'Number of external identities currently linked to the account', params: ['count'] },
 ];
 registerComponentLabels(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, AppLayoutsSecuritySettingsLabels);
 //# sourceMappingURL=AppPage_SecuritySettings.labels.js.map