@wildo-ai/saas-frontend-lib 1.1.5 → 1.1.7

package/dist/esm/components/auth/Auth_Register.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Register.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Register.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE,EAAE,GAAG,EAAE,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iDAAiD,EAAE;IACrH,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,gDAAgD,EAAE;IAC5H,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,yCAAyC,EAAE;IACnH,EAAE,GAAG,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE;IAC7G,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC3G;QACE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB;QACxC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EACL,wZAAwZ;KAC3Z;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACzG,EAAE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4CAA4C,EAAE;IACzH,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE;IACvI,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACxH,EAAE,GAAG,EAAE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAChI,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,6DAA6D,EAAE;IACvI,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE;IACxH,EAAE,GAAG,EAAE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,yEAAyE,EAAE;IACvJ,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qDAAqD,EAAE;IACzI,EAAE,GAAG,EAAE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE;IACxI,EAAE,GAAG,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,wEAAwE,EAAE;IACjJ,EAAE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE;IAC9I,EAAE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE;IACzI;QACE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB;QACxC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;KAClG;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB;QACxC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,qDAAqD;QAC9D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;KACjG;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACjJ,EAAE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACjJ,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACnI,EAAE,GAAG,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACrJ;QACE,GAAG,EAAE,iBAAiB,CAAC,kBAAkB;QACzC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EACL,0VAA0V;KAC7V;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB;QACvC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EACL,6YAA6Y;KAChZ;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,wBAAwB;QAC/C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,iWAAiW;KACpW;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,2PAA2P;KAC9P;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,kBAAkB;QACzC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,0RAA0R;KAC7R;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,4BAA4B;QACnD,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,mSAAmS;KACtS;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,mBAAmB;QAC1C,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EACL,qWAAqW;QACvW,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;KAC7G;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,mBAAmB;QAC1C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,6TAA6T;KAChU;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,kDAAkD,EAAE;IAC5H,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iEAAiE,EAAE;IAC9I;QACE,GAAG,EAAE,iBAAiB,CAAC,eAAe;QACtC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6DAA6D;KACvE;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,iDAAiD,EAAE;IAC1H,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qDAAqD,EAAE;IAClI;QACE,GAAG,EAAE,iBAAiB,CAAC,aAAa;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,yEAAyE;QAClF,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;KACnG;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAC3I;QACE,GAAG,EAAE,iBAAiB,CAAC,sBAAsB;QAC7C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6IAA6I;KACvJ;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,wBAAwB;QAC/C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,sOAAsO;KAChP;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,uBAAuB;QAC9C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,wKAAwK;KAClL;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,kBAAkB;QACzC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,2JAA2J;KACrK;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,oGAAoG,EAAE;IAC1L,EAAE,GAAG,EAAE,iBAAiB,CAAC,yBAAyB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAC/L,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,2GAA2G,EAAE;IAC9L,EAAE,GAAG,EAAE,iBAAiB,CAAC,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oIAAoI,EAAE;IAC1N,EAAE,GAAG,EAAE,iBAAiB,CAAC,kCAAkC,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,6GAA6G,EAAE;CAC/M,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels, UserRegisterLabel } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsUserRegisterLabels: LabellingUnitaryDef[] = [\n  { ref: UserRegisterLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Main heading of the account-registration screen' },\n  { ref: UserRegisterLabel.SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line under the registration heading' },\n  { ref: UserRegisterLabel.EMAIL_ADDRESS, kind: LabelKind.LABEL, purpose: 'Field label for the email-address input' },\n  { ref: UserRegisterLabel.FIRST_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the first-name input' },\n  { ref: UserRegisterLabel.LAST_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the last-name input' },\n  {\n    ref: UserRegisterLabel.ORGANIZATION_NAME,\n    kind: LabelKind.LABEL,\n    purpose:\n      'Field label for the organization-name input, which the form shows only when the registrant\\'s user type creates a tenant at sign-up AND that tenant type names itself by asking (`orgNameSource: ASK`). It is the name of the workspace, team or company the registrant is founding — not their own name, and not an existing organization they are joining, which is the invitation path and never reaches this form.',\n  },\n  { ref: UserRegisterLabel.PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the password input' },\n  { ref: UserRegisterLabel.CONFIRM_PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the confirm-password input' },\n  { ref: UserRegisterLabel.ALREADY_HAVE_ACCOUNT, kind: LabelKind.LABEL, purpose: 'Prompt preceding the sign-in link for existing users' },\n  { ref: UserRegisterLabel.SIGNIN_LINK, kind: LabelKind.LABEL, purpose: 'Link text that navigates to the sign-in screen' },\n  { ref: UserRegisterLabel.REGISTER_BUTTON, kind: LabelKind.BUTTON, purpose: 'Primary button that submits the registration form' },\n  { ref: UserRegisterLabel.REGISTERING, kind: LabelKind.MESSAGE, purpose: 'In-progress status shown while the account is being created' },\n  { ref: UserRegisterLabel.SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the account was created' },\n  { ref: UserRegisterLabel.SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body text instructing the user to verify their email after registration' },\n  { ref: UserRegisterLabel.REGISTRATION_DISABLED, kind: LabelKind.MESSAGE, purpose: 'Notice shown when public registration is turned off' },\n  { ref: UserRegisterLabel.INVITATION_ONLY, kind: LabelKind.MESSAGE, purpose: 'Notice shown when sign-up is restricted to invited users' },\n  { ref: UserRegisterLabel.ADMIN_ONLY, kind: LabelKind.MESSAGE, purpose: 'Notice shown when accounts can only be provisioned by an administrator' },\n  { ref: UserRegisterLabel.PASSWORD_MISMATCH, kind: LabelKind.MESSAGE, purpose: 'Validation error when password and confirmation do not match' },\n  { ref: UserRegisterLabel.UNEXPECTED_ERROR, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when registration fails unexpectedly' },\n  {\n    ref: UserRegisterLabel.POLICY_MIN_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the minimum required length',\n    params: [{ key: 'minLength', meaning: 'minimum number of characters the password must contain' }],\n  },\n  {\n    ref: UserRegisterLabel.POLICY_MAX_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the maximum allowed length',\n    params: [{ key: 'maxLength', meaning: 'maximum number of characters the password may contain' }],\n  },\n  { ref: UserRegisterLabel.POLICY_UPPERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one uppercase letter' },\n  { ref: UserRegisterLabel.POLICY_LOWERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one lowercase letter' },\n  { ref: UserRegisterLabel.POLICY_NUMBER, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one digit' },\n  { ref: UserRegisterLabel.POLICY_SPECIAL_CHAR, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one special character' },\n  {\n    ref: UserRegisterLabel.POLICY_BLOCKLISTED,\n    kind: LabelKind.DESCRIPTION,\n    purpose:\n      'Refusal shown when the chosen password is a known common guess, the application\\'s own name, or the local part of the user\\'s own email address. It reports a property of THIS password rather than an unmet rule, so it must not read like the other hints — there is no character the user can add to satisfy it, only a different password to choose.',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_ACCEPTANCE,\n    kind: LabelKind.LABEL,\n    purpose:\n      'Words beside the box a registrant ticks to accept the documents this application requires, e.g. \"I accept the documents listed below.\" It must NOT name specific documents: the control is total over whatever releases the application declares, which may be terms, a privacy notice, a data-processing agreement or something else entirely — the documents themselves are named by the links beside it.',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_ACCEPTANCE_IMPLIED,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      'Notice shown immediately above the submit button when the application accepts its documents by the act of registering rather than by a separate tick, e.g. \"By creating an account, you agree to our terms of service and privacy policy.\" It must state what submitting the form will MEAN, not invite an action, because there is no second action to invite.',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_READ_PROMPT,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      'Instruction above the document reading pane, shown when the application requires the registrant to scroll to the end of the documents before the acceptance box becomes available, e.g. \"Please read to the end of the documents below before accepting.\"',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_DRAFT_NOTICE,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      'Notice at the top of a document shown for acceptance that has never been released — the reader is looking at a draft which may change and has not taken effect. It must say so plainly: the person is being asked to accept this text, so an unmarked draft would read as settled terms.',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_CLAUSE_NOT_ESTABLISHED,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      \"Lead-in shown beneath a clause the document's own drafter marked as not yet established, followed by that clause's description of what is missing. Phrased so the two read as one sentence, e.g. \\\"Not yet settled:\\\". It must not soften the fact: the clause is being presented for acceptance.\",\n  },\n  {\n    ref: UserRegisterLabel.TERMS_OPEN_DOCUMENT,\n    kind: LabelKind.LABEL,\n    purpose:\n      'Link text opening one governed document\\'s own public page in a new tab, beside the acceptance control. It MUST include the document title, e.g. \"Read {documentTitle} in full\" — several documents can be listed together, and a link that omits the title reads identically for all of them, which leaves a screen-reader user a list of indistinguishable links.',\n    params: [{ key: 'documentTitle', meaning: \"the governed document's own title, in the document's language\" }],\n  },\n  {\n    ref: UserRegisterLabel.TERMS_READ_COMPLETE,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      'Announced to assistive technology the moment the reading gate opens — the reader has reached the end of every document and the acceptance box has become available. Short and factual, e.g. \"You have reached the end. You can now accept.\" It is never shown visually; the box becoming available is the visible feedback.',\n  },\n  { ref: UserRegisterLabel.RESEND_PROMPT, kind: LabelKind.LABEL, purpose: 'Prompt offering to resend the verification email' },\n  { ref: UserRegisterLabel.RESEND_SENDING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the verification email is being resent' },\n  {\n    ref: UserRegisterLabel.RESEND_COOLDOWN,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Cooldown notice telling the user when they can resend again',\n  },\n  { ref: UserRegisterLabel.RESEND_LINK, kind: LabelKind.BUTTON, purpose: 'Link/button that resends the verification email' },\n  { ref: UserRegisterLabel.RESEND_SUCCESS, kind: LabelKind.MESSAGE, purpose: 'Confirmation that the verification email was resent' },\n  {\n    ref: UserRegisterLabel.CONTINUE_WITH,\n    kind: LabelKind.BUTTON,\n    purpose: 'OAuth button label inviting the user to register with a social provider',\n    params: [{ key: 'provider', meaning: 'display name of the OAuth provider (e.g. Google, GitHub)' }],\n  },\n  { ref: UserRegisterLabel.DIVIDER_OR, kind: LabelKind.LABEL, purpose: 'Divider word separating OAuth providers from the registration form' },\n  {\n    ref: UserRegisterLabel.SSO_REGISTRATION_TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading shown when the email address belongs to a domain whose organization requires single sign-on, so no account was created by this form',\n  },\n  {\n    ref: UserRegisterLabel.SSO_REGISTRATION_MESSAGE,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Explains that the organization manages accounts for this email domain through single sign-on (whether sign-in creates the account or an administrator does), and that the person should sign in to continue (a sign-in link follows)',\n  },\n  {\n    ref: UserRegisterLabel.REGISTRATION_UNFINISHED,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Shown after registration when the account exists but signing up is not finished and needs a step this screen does not perform; tells the person to sign in to continue',\n  },\n  {\n    ref: UserRegisterLabel.METHOD_CHOICE_HINT,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Short line above the alternative sign-up methods, telling the person they can choose how they will sign in later (a password, an emailed link, a passkey)',\n  },\n  { ref: UserRegisterLabel.MAGIC_LINK_SIGNUP_BUTTON, kind: LabelKind.BUTTON, purpose: 'Submit button for a password-less sign-up that emails a sign-in link instead of setting a password' },\n  { ref: UserRegisterLabel.MAGIC_LINK_SIGNUP_SENDING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while a password-less sign-up is creating the account and sending its sign-in link' },\n  { ref: UserRegisterLabel.PASSKEY_SIGNUP_BUTTON, kind: LabelKind.BUTTON, purpose: 'Submit button for a passkey sign-up: a sign-in link is emailed and the passkey is set up after opening it' },\n  { ref: UserRegisterLabel.MAGIC_LINK_SENT_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body shown after a magic-link sign-up: a sign-in link was emailed, opening it finishes signing up (no separate verification email)' },\n  { ref: UserRegisterLabel.PASSKEY_ENROLLMENT_PENDING_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body shown after a passkey sign-up: a sign-in link was emailed, and the passkey is set up once it is opened' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, PublicLayoutsUserRegisterLabels);\n"]}
+{"version":3,"file":"Auth_Register.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_Register.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE,EAAE,GAAG,EAAE,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iDAAiD,EAAE;IACrH,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,gDAAgD,EAAE;IAC5H,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,yCAAyC,EAAE;IACnH,EAAE,GAAG,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE;IAC7G,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC3G;QACE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB;QACxC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EACL,wZAAwZ;KAC3Z;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACzG,EAAE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4CAA4C,EAAE;IACzH,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE;IACvI,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACxH,EAAE,GAAG,EAAE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAChI,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,6DAA6D,EAAE;IACvI,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE;IACxH,EAAE,GAAG,EAAE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,yEAAyE,EAAE;IACvJ,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qDAAqD,EAAE;IACzI,EAAE,GAAG,EAAE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE;IACxI,EAAE,GAAG,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,wEAAwE,EAAE;IACjJ,EAAE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE;IAC9I,EAAE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE;IACzI;QACE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB;QACxC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;KAClG;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB;QACxC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,qDAAqD;QAC9D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;KACjG;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACjJ,EAAE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACjJ,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACnI,EAAE,GAAG,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACrJ;QACE,GAAG,EAAE,iBAAiB,CAAC,kBAAkB;QACzC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EACL,0VAA0V;KAC7V;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,gBAAgB;QACvC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EACL,6YAA6Y;KAChZ;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,wBAAwB;QAC/C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,iWAAiW;KACpW;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,2PAA2P;KAC9P;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,kBAAkB;QACzC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,0RAA0R;KAC7R;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,4BAA4B;QACnD,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,mSAAmS;KACtS;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,mBAAmB;QAC1C,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EACL,qWAAqW;QACvW,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;KAC7G;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,mBAAmB;QAC1C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EACL,6TAA6T;KAChU;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,kDAAkD,EAAE;IAC5H,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iEAAiE,EAAE;IAC9I;QACE,GAAG,EAAE,iBAAiB,CAAC,eAAe;QACtC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6DAA6D;KACvE;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,iDAAiD,EAAE;IAC1H,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qDAAqD,EAAE;IAClI;QACE,GAAG,EAAE,iBAAiB,CAAC,aAAa;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,yEAAyE;QAClF,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;KACnG;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAC3I;QACE,GAAG,EAAE,iBAAiB,CAAC,sBAAsB;QAC7C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6IAA6I;KACvJ;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,wBAAwB;QAC/C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,sOAAsO;KAChP;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,uBAAuB;QAC9C,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,wKAAwK;KAClL;IACD;QACE,GAAG,EAAE,iBAAiB,CAAC,kBAAkB;QACzC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,2JAA2J;KACrK;IACD,EAAE,GAAG,EAAE,iBAAiB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,oGAAoG,EAAE;IAC1L,EAAE,GAAG,EAAE,iBAAiB,CAAC,yBAAyB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAC/L,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,2GAA2G,EAAE;IAC9L,EAAE,GAAG,EAAE,iBAAiB,CAAC,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oIAAoI,EAAE;IAC1N,EAAE,GAAG,EAAE,iBAAiB,CAAC,kCAAkC,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,6GAA6G,EAAE;CAC/M,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels, UserRegisterLabel } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsUserRegisterLabels: LabellingUnitaryDef[] = [\n  { ref: UserRegisterLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Main heading of the account-registration screen' },\n  { ref: UserRegisterLabel.SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line under the registration heading' },\n  { ref: UserRegisterLabel.EMAIL_ADDRESS, kind: LabelKind.LABEL, purpose: 'Field label for the email-address input' },\n  { ref: UserRegisterLabel.FIRST_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the first-name input' },\n  { ref: UserRegisterLabel.LAST_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the last-name input' },\n  {\n    ref: UserRegisterLabel.ORGANIZATION_NAME,\n    kind: LabelKind.LABEL,\n    purpose:\n      'Field label for the organization-name input, which the form shows only when the registrant\\'s user type creates a tenant at sign-up AND that tenant type names itself by asking (`orgNameSource: ASK`). It is the name of the workspace, team or company the registrant is founding — not their own name, and not an existing organization they are joining, which is the invitation path and never reaches this form.',\n  },\n  { ref: UserRegisterLabel.PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the password input' },\n  { ref: UserRegisterLabel.CONFIRM_PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the confirm-password input' },\n  { ref: UserRegisterLabel.ALREADY_HAVE_ACCOUNT, kind: LabelKind.LABEL, purpose: 'Prompt preceding the sign-in link for existing users' },\n  { ref: UserRegisterLabel.SIGNIN_LINK, kind: LabelKind.LABEL, purpose: 'Link text that navigates to the sign-in screen' },\n  { ref: UserRegisterLabel.REGISTER_BUTTON, kind: LabelKind.BUTTON, purpose: 'Primary button that submits the registration form' },\n  { ref: UserRegisterLabel.REGISTERING, kind: LabelKind.MESSAGE, purpose: 'In-progress status shown while the account is being created' },\n  { ref: UserRegisterLabel.SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the account was created' },\n  { ref: UserRegisterLabel.SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body text instructing the user to verify their email after registration' },\n  { ref: UserRegisterLabel.REGISTRATION_DISABLED, kind: LabelKind.MESSAGE, purpose: 'Notice shown when public registration is turned off' },\n  { ref: UserRegisterLabel.INVITATION_ONLY, kind: LabelKind.MESSAGE, purpose: 'Notice shown when sign-up is restricted to invited users' },\n  { ref: UserRegisterLabel.ADMIN_ONLY, kind: LabelKind.MESSAGE, purpose: 'Notice shown when accounts can only be provisioned by an administrator' },\n  { ref: UserRegisterLabel.PASSWORD_MISMATCH, kind: LabelKind.MESSAGE, purpose: 'Validation error when password and confirmation do not match' },\n  { ref: UserRegisterLabel.UNEXPECTED_ERROR, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when registration fails unexpectedly' },\n  {\n    ref: UserRegisterLabel.POLICY_MIN_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the minimum required length',\n    params: [{ key: 'minLength', meaning: 'minimum number of characters the password must contain' }],\n  },\n  {\n    ref: UserRegisterLabel.POLICY_MAX_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the maximum allowed length',\n    params: [{ key: 'maxLength', meaning: 'maximum number of characters the password may contain' }],\n  },\n  { ref: UserRegisterLabel.POLICY_UPPERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one uppercase letter' },\n  { ref: UserRegisterLabel.POLICY_LOWERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one lowercase letter' },\n  { ref: UserRegisterLabel.POLICY_NUMBER, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one digit' },\n  { ref: UserRegisterLabel.POLICY_SPECIAL_CHAR, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one special character' },\n  {\n    ref: UserRegisterLabel.POLICY_BLOCKLISTED,\n    kind: LabelKind.DESCRIPTION,\n    purpose:\n      'Refusal shown when the chosen password is a known common guess, the application\\'s own name, or the local part of the user\\'s own email address. It reports a property of THIS password rather than an unmet rule, so it must not read like the other hints — there is no character the user can add to satisfy it, only a different password to choose.',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_ACCEPTANCE,\n    kind: LabelKind.LABEL,\n    purpose:\n      'Words beside the box a registrant ticks to accept the documents this application requires, e.g. \"I accept the documents listed below.\" It must NOT name specific documents: the control is total over whatever releases the application declares, which may be terms, a privacy notice, a data-processing agreement or something else entirely — the documents themselves are named by the links beside it.',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_ACCEPTANCE_IMPLIED,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      'Notice shown immediately above the submit button when the application accepts its documents by the act of registering rather than by a separate tick, e.g. \"By creating an account, you agree to our terms of service and privacy policy.\" It must state what submitting the form will MEAN, not invite an action, because there is no second action to invite.',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_READ_PROMPT,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      'Instruction above the document reading pane, shown when the application requires the registrant to scroll to the end of the documents before the acceptance box becomes available, e.g. \"Please read to the end of the documents below before accepting.\"',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_DRAFT_NOTICE,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      'Notice at the top of a document shown for acceptance that has never been released — the reader is looking at a draft which may change and has not taken effect. It must say so plainly: the person is being asked to accept this text, so an unmarked draft would read as settled terms.',\n  },\n  {\n    ref: UserRegisterLabel.TERMS_CLAUSE_NOT_ESTABLISHED,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      \"Lead-in shown beneath a clause the document's own drafter marked as not yet established, followed by that clause's description of what is missing. Phrased so the two read as one sentence, e.g. \\\"Not yet settled:\\\". It must not soften the fact: the clause is being presented for acceptance.\",\n  },\n  {\n    ref: UserRegisterLabel.TERMS_OPEN_DOCUMENT,\n    kind: LabelKind.LABEL,\n    purpose:\n      'Link text opening one governed document\\'s own public page in a new tab, beside the acceptance control. It MUST include the document title, e.g. \"Read {documentTitle} in full\" — several documents can be listed together, and a link that omits the title reads identically for all of them, which leaves a screen-reader user a list of indistinguishable links.',\n    params: [{ key: 'documentTitle', meaning: \"the governed document's own title, in the document's language\" }],\n  },\n  {\n    ref: UserRegisterLabel.TERMS_READ_COMPLETE,\n    kind: LabelKind.MESSAGE,\n    purpose:\n      'Announced to assistive technology the moment the reading gate opens — the reader has reached the end of every document and the acceptance box has become available. Short and factual, e.g. \"You have reached the end. You can now accept.\" It is never shown visually; the box becoming available is the visible feedback.',\n  },\n  { ref: UserRegisterLabel.RESEND_PROMPT, kind: LabelKind.LABEL, purpose: 'Prompt offering to resend the verification email' },\n  { ref: UserRegisterLabel.RESEND_SENDING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the verification email is being resent' },\n  {\n    ref: UserRegisterLabel.RESEND_COOLDOWN,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Cooldown notice telling the user when they can resend again',\n  },\n  { ref: UserRegisterLabel.RESEND_LINK, kind: LabelKind.BUTTON, purpose: 'Link/button that resends the verification email' },\n  { ref: UserRegisterLabel.RESEND_SUCCESS, kind: LabelKind.MESSAGE, purpose: 'Confirmation that the verification email was resent' },\n  {\n    ref: UserRegisterLabel.CONTINUE_WITH,\n    kind: LabelKind.BUTTON,\n    purpose: 'OAuth button label inviting the user to register with a social provider',\n    params: [{ key: 'provider', meaning: 'display name of the OAuth provider (e.g. Google, GitHub)' }],\n  },\n  { ref: UserRegisterLabel.DIVIDER_OR, kind: LabelKind.LABEL, purpose: 'Divider word separating OAuth providers from the registration form' },\n  {\n    ref: UserRegisterLabel.SSO_REGISTRATION_TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading shown when the email address belongs to a domain whose organization requires single sign-on, so no account was created by this form',\n  },\n  {\n    ref: UserRegisterLabel.SSO_REGISTRATION_MESSAGE,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Explains that the organization manages accounts for this email domain through single sign-on (whether sign-in creates the account or an administrator does), and that the person should sign in to continue (a sign-in link follows)',\n  },\n  {\n    ref: UserRegisterLabel.REGISTRATION_UNFINISHED,\n    kind: LabelKind.MESSAGE,\n    purpose: 'Shown after registration when the account exists but signing up is not finished and needs a step this screen does not perform; tells the person to sign in to continue',\n  },\n  {\n    ref: UserRegisterLabel.METHOD_CHOICE_HINT,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Short line above the alternative sign-up methods, telling the person they can choose how they will sign in later (a password, an emailed link, a passkey)',\n  },\n  { ref: UserRegisterLabel.MAGIC_LINK_SIGNUP_BUTTON, kind: LabelKind.BUTTON, purpose: 'Submit button for a password-less sign-up that emails a sign-in link instead of setting a password' },\n  { ref: UserRegisterLabel.MAGIC_LINK_SIGNUP_SENDING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while a password-less sign-up is creating the account and sending its sign-in link' },\n  { ref: UserRegisterLabel.PASSKEY_SIGNUP_BUTTON, kind: LabelKind.BUTTON, purpose: 'Submit button for a passkey sign-up: a sign-in link is emailed and the passkey is set up after opening it' },\n  { ref: UserRegisterLabel.MAGIC_LINK_SENT_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body shown after a magic-link sign-up: a sign-in link was emailed, opening it finishes signing up (no separate verification email)' },\n  { ref: UserRegisterLabel.PASSKEY_ENROLLMENT_PENDING_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body shown after a passkey sign-up: a sign-in link was emailed, and the passkey is set up once it is opened' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, PublicLayoutsUserRegisterLabels);\n"]}

package/dist/esm/components/auth/StepUpAuthDialog.d.ts

@@ -1,5 +1,6 @@
 import React from 'react';
 import { AuthMethod, ReAuthenticationPurpose, type FederatedReAuthenticationMethod, type ReAuthenticationIdentityLink } from '@wildo-ai/saas-models';
+import { StepUpRefusalOrigin } from '../../core/requests/wildo-http-client.frontend.service';
 /**
  * The methods a step-up can be made with, strongest first — the order the dialog offers them in.
  *
@@ -61,6 +62,12 @@ interface StepUpAuthDialogProps {
     open: boolean;
     /** Which proof the refusal asked for; decides which methods are offered (#1417). */
     purpose: ReAuthenticationPurpose;
+    /**
+     * Who asked (#1633). When it is a CLIENT organization's policy, the proof must be a second factor, so the password
+     * and linked identities — which prove a first factor only — are not offered, and the description says whose policy
+     * asks. Absent means the account's own policy or the operation.
+     */
+    origin?: StepUpRefusalOrigin;
     onConfirm: (proof: StepUpProof) => void;
     onCancel: () => void;
     /**

package/dist/esm/components/auth/StepUpAuthDialog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StepUpAuthDialog.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/StepUpAuthDialog.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAmD,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,KAAK,+BAA+B,EAAE,KAAK,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAiBrJ;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAA+D,CAAC;AAEnH,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;AAEtF;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAA;CAAE,GAC9B;IAAE,MAAM,EAAE,+BAA+B,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAgB9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,aAAa,EAAE,4BAA4B,EAAE,CAAA;CAAE,CAAC,CAQrF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,GAAG,IAAI,CAW3H;AAED,UAAU,qBAAqB;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,oFAAoF;IACpF,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACxC,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAsM5D,CAAC"}
+{"version":3,"file":"StepUpAuthDialog.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/StepUpAuthDialog.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAmD,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,KAAK,+BAA+B,EAAE,KAAK,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAWrJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,sEAAsE,CAAC;AAO3G;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAA+D,CAAC;AAEnH,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;AAEtF;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAA;CAAE,GAC9B;IAAE,MAAM,EAAE,+BAA+B,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAgB9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,aAAa,EAAE,4BAA4B,EAAE,CAAA;CAAE,CAAC,CAQrF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,GAAG,IAAI,CAW3H;AAED,UAAU,qBAAqB;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,oFAAoF;IACpF,OAAO,EAAE,uBAAuB,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACxC,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CA4M5D,CAAC"}

package/dist/esm/components/auth/StepUpAuthDialog.js

@@ -11,6 +11,7 @@ import { Button, ButtonVariants_Variant } from '../../components/actions/button.
 import { useI18n } from '../../core/i18n/useI18n.js';
 import { useUserFacingErrorMessage } from '../../core/errors/useUserFacingErrorMessage.js';
 import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+import { StepUpRefusalOrigin } from '../../core/requests/wildo-http-client.frontend.service.js';
 import { FederatedReAuthenticationFailure, FederatedReAuthenticationFailureReason, openReAuthenticationWindow, } from '../../core/security/federated-reauthentication.frontend.js';
 /**
  * The methods a step-up can be made with, strongest first — the order the dialog offers them in.
@@ -72,7 +73,7 @@ export function buildStepUpProof(method, input) {
             return null;
     }
 }
-export const StepUpAuthDialog = ({ open, purpose, onConfirm, onCancel, failure, isLoading, }) => {
+export const StepUpAuthDialog = ({ open, purpose, origin = StepUpRefusalOrigin.ACCOUNT_OR_OPERATION, onConfirm, onCancel, failure, isLoading, }) => {
     const toUserFacingErrorMessage = useUserFacingErrorMessage();
     const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS });
     const t = useCallback((key) => tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key), [tComponent]);
@@ -105,14 +106,17 @@ export const StepUpAuthDialog = ({ open, purpose, onConfirm, onCancel, failure,
         void resolveStepUpOptions(purpose).then((options) => {
             if (cancelled)
                 return;
-            setAvailable(options.methods);
-            setIdentityLinks(options.identityLinks);
+            const secondFactorOnly = origin === StepUpRefusalOrigin.CLIENT_ORGANIZATION;
+            const methods = secondFactorOnly ? options.methods.filter((candidate) => candidate !== AuthMethod.PASSWORD) : options.methods;
+            const links = secondFactorOnly ? [] : options.identityLinks;
+            setAvailable(methods);
+            setIdentityLinks(links);
             // A local method first when there is one; otherwise the first provider.
-            setMethod(options.methods[0] ?? null);
-            setLink(options.methods.length === 0 ? options.identityLinks[0] ?? null : null);
+            setMethod(methods[0] ?? null);
+            setLink(methods.length === 0 ? links[0] ?? null : null);
         });
         return () => { cancelled = true; };
-    }, [open, purpose]);
+    }, [open, purpose, origin]);
     // Reset submitting guard when async operation finishes (success closes dialog; error stays open)
     useEffect(() => {
         if (!isLoading) {
@@ -162,7 +166,9 @@ export const StepUpAuthDialog = ({ open, purpose, onConfirm, onCancel, failure,
     };
     if (!isReady)
         return null;
-    return (_jsx(OperationsConfirmCritical, { open: open, onOpenChange: handleOpenChange, cancelCallback: handleCancel, validationCallback: handleValidation, label: t(SecuritySettingsLabel.REAUTH_TITLE), children: _jsxs("div", { className: "space-y-4 py-4", children: [_jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.REAUTH_DESCRIPTION) }), failure !== null && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: failure instanceof FederatedReAuthenticationFailure
+    return (_jsx(OperationsConfirmCritical, { open: open, onOpenChange: handleOpenChange, cancelCallback: handleCancel, validationCallback: handleValidation, label: t(SecuritySettingsLabel.REAUTH_TITLE), children: _jsxs("div", { className: "space-y-4 py-4", children: [_jsx(Text, { className: "text-sm", children: t(origin === StepUpRefusalOrigin.CLIENT_ORGANIZATION
+                        ? SecuritySettingsLabel.REAUTH_CLIENT_ORGANIZATION_DESCRIPTION
+                        : SecuritySettingsLabel.REAUTH_DESCRIPTION) }), failure !== null && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: failure instanceof FederatedReAuthenticationFailure
                             ? t(FEDERATED_FAILURE_LABEL[failure.reason])
                             : toUserFacingErrorMessage(failure, t(SecuritySettingsLabel.ERROR)) }) })), nothingOffered && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(SecuritySettingsLabel.REAUTH_NO_ACCEPTED_METHOD) }) })), available && available.length + identityLinks.length > 1 && (_jsxs("div", { className: "flex flex-wrap gap-2", role: "group", "aria-label": t(SecuritySettingsLabel.REAUTH_TITLE), children: [available.map((choice) => (_jsx(Button, { type: "button", size: ButtonSize.SM, variant: choice === method ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE, "aria-pressed": choice === method, disabled: isLoading, onClick: () => { setMethod(choice); setLink(null); }, children: t(METHOD_CHOICE_LABEL[choice]) }, choice))), identityLinks.map((choice) => (_jsx(Button, { type: "button", size: ButtonSize.SM, variant: choice.identityLinkId === link?.identityLinkId ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE, "aria-pressed": choice.identityLinkId === link?.identityLinkId, disabled: isLoading, onClick: () => { setLink(choice); setMethod(null); }, children: tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_WITH_PROVIDER, { provider: choice.displayName }) }, choice.identityLinkId)))] })), link && (_jsx(Text, { className: "text-sm", children: tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_PROVIDER_PROMPT, { provider: link.displayName }) })), method === AuthMethod.PASSWORD && (_jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.REAUTH_PASSWORD) }), _jsx(InputRoot, { type: "password", autoComplete: "current-password", value: password, onChange: (e) => setPassword(e.target.value), placeholder: t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER), disabled: isLoading, onKeyDown: submitOnEnter })] })), method === AuthMethod.TOTP && (_jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.REAUTH_TOTP_CODE) }), _jsx(InputRoot, { inputMode: "numeric", autoComplete: "one-time-code", maxLength: 8, value: code, onChange: (e) => setCode(e.target.value.replace(/\D/g, '')), placeholder: t(SecuritySettingsLabel.REAUTH_TOTP_CODE_PLACEHOLDER), disabled: isLoading, onKeyDown: submitOnEnter })] })), method === AuthMethod.PASSKEY && (_jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.REAUTH_PASSKEY_PROMPT) }))] }) }));
 };

package/dist/esm/components/auth/StepUpAuthDialog.js.map

@@ -1 +1 @@
-{"version":3,"file":"StepUpAuthDialog.js","sourceRoot":"","sources":["../../../../../src/components/auth/StepUpAuthDialog.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,UAAU,EAAoG,MAAM,uBAAuB,CAAC;AACrJ,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AAChH,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,sCAAsC,EACtC,0BAA0B,GAC3B,MAAM,uEAAuE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;AAmBnH,MAAM,uBAAuB,GAA0E;IACrG,CAAC,sCAAsC,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC,6BAA6B;IAC3G,oGAAoG;IACpG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;IAChG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,yBAAyB;IACnG,CAAC,sCAAsC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;CAC9F,CAAC;AAEF,MAAM,mBAAmB,GAAgD;IACvE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,mBAAmB;IAC/D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,gBAAgB;IACzD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC,oBAAoB;CAClE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAa,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA2B,EAAE,KAAyC;IACrG,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,KAAK,UAAU,CAAC,IAAI;YAClB,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,KAAK,UAAU,CAAC,OAAO;YACrB,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAiBD,MAAM,CAAC,MAAM,gBAAgB,GAAoC,CAAC,EAChE,IAAI,EACJ,OAAO,EACP,SAAS,EACT,QAAQ,EACR,OAAO,EACP,SAAS,GACV,EAAE,EAAE;IACH,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,CAAC,EACrF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,oGAAoG;IACpG,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAwB,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiC,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAChE,8FAA8F;IAC9F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,mGAAmG;IACnG,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,8FAA8F;IAC9F,iFAAiF;IACjF,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,oBAAoB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,SAAS;gBAAE,OAAO;YACtB,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACxC,wEAAwE;YACxE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACtC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpB,iGAAiG;IACjG,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;YAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7G,MAAM,cAAc,GAAG,SAAS,EAAE,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAE7E,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE;QACxC,sGAAsG;QACtG,gEAAgE;QAChE,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,eAAe,CAAC,OAAO;gBAAE,OAAO;YACpC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,qBAAqB,CAAC,OAAO,GAAG,IAAI,CAAC;YACrC,6EAA6E;YAC7E,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO;YAAE,OAAO;QAC9C,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO;YAAE,OAAO;QACtE,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE,CAAC;IACb,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,QAAiB,EAAE,EAAE;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC1C,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,MAAM,aAAa,GAAG,CAAC,CAAsB,EAAE,EAAE;QAC/C,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;YAAE,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,KAAC,yBAAyB,IACxB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,gBAAgB,EAC9B,cAAc,EAAE,YAAY,EAC5B,kBAAkB,EAAE,gBAAgB,EACpC,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,YAE5C,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,GAAQ,EAC7E,OAAO,KAAK,IAAI,IAAI,CACnB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cACd,OAAO,YAAY,gCAAgC;4BAClD,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;4BAC5C,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,GACpD,GACb,CACT,EACA,cAAc,IAAI,CACjB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,GAAoB,GACnF,CACT,EACA,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3D,eAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,OAAO,gBAAa,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,aACjG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACzB,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC9E,MAAM,KAAK,MAAM,EAC/B,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAR1B,MAAM,CASJ,CACV,CAAC,EACD,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC7B,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC3G,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,EAC5D,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,IARzI,MAAM,CAAC,cAAc,CASnB,CACV,CAAC,IACE,CACP,EACA,IAAI,IAAI,CACP,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YACtB,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,GACzI,CACR,EACA,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CACjC,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAc,EACnE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,EAC/B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,EACjE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAC7B,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,SAAS,EAAC,SAAS,EACnB,YAAY,EAAC,eAAe,EAC5B,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAC3D,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,4BAA4B,CAAC,EAClE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,CAChC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,CAClF,IACG,GACoB,CAC7B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import React, { useState, useCallback, useEffect, useRef } from 'react';\nimport { AuthMethod, ReAuthenticationPurpose, type FederatedReAuthenticationMethod, type ReAuthenticationIdentityLink } from '@wildo-ai/saas-models';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { OperationsConfirmCritical } from '~wildo-frontend-lib/components/feedback/operations-confirm-critical';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport {\n  FederatedReAuthenticationFailure,\n  FederatedReAuthenticationFailureReason,\n  openReAuthenticationWindow,\n} from '~wildo-frontend-lib/core/security/federated-reauthentication.frontend';\n\n/**\n * The methods a step-up can be made with, strongest first — the order the dialog offers them in.\n *\n * These are the three `POST /auth/reauth` accepts. A passkey leads because it is phishing-resistant;\n * a password comes last because it is the one a stolen session's owner is most likely to have reused.\n */\nexport const STEP_UP_METHODS: readonly StepUpMethod[] = [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.PASSWORD];\n\nexport type StepUpMethod = AuthMethod.PASSKEY | AuthMethod.TOTP | AuthMethod.PASSWORD;\n\n/**\n * What the person supplied to prove they are still the account holder. The dialog collects it; the\n * step-up context turns it into a single-use token. A passkey carries nothing here because its\n * ceremony runs after the dialog confirms — it needs a server challenge first.\n *\n * A federated proof (#1441) carries the linked identity and the window the provider will run in. The\n * window is opened BY THE DIALOG, in the Confirm click, because a browser allows a popup only there;\n * `null` means it refused.\n */\nexport type StepUpProof =\n  | { method: AuthMethod.PASSWORD; password: string }\n  | { method: AuthMethod.TOTP; code: string }\n  | { method: AuthMethod.PASSKEY }\n  | { method: FederatedReAuthenticationMethod; identityLinkId: string; popup: Window | null };\n\nconst FEDERATED_FAILURE_LABEL: Record<FederatedReAuthenticationFailureReason, SecuritySettingsLabel> = {\n  [FederatedReAuthenticationFailureReason.POPUP_BLOCKED]: SecuritySettingsLabel.REAUTH_PROVIDER_POPUP_BLOCKED,\n  // Never displayed (a cancelled dialog is closed); mapped so the table stays total over the reasons.\n  [FederatedReAuthenticationFailureReason.CANCELLED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n  [FederatedReAuthenticationFailureReason.TIMED_OUT]: SecuritySettingsLabel.REAUTH_PROVIDER_TIMED_OUT,\n  [FederatedReAuthenticationFailureReason.FAILED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n};\n\nconst METHOD_CHOICE_LABEL: Record<StepUpMethod, SecuritySettingsLabel> = {\n  [AuthMethod.PASSKEY]: SecuritySettingsLabel.REAUTH_WITH_PASSKEY,\n  [AuthMethod.TOTP]: SecuritySettingsLabel.REAUTH_WITH_TOTP,\n  [AuthMethod.PASSWORD]: SecuritySettingsLabel.REAUTH_WITH_PASSWORD,\n};\n\n/**\n * What this account can re-authenticate with for `purpose`: its local methods, in {@link STEP_UP_METHODS}\n * order, and the linked identities whose provider can re-authenticate it (#1441). One request answers both.\n *\n * Asked of the server each time the dialog opens (#1417): the answer changes as the person adds and\n * removes authenticators, and for a step-up it is narrowed by the account's step-up policy, which only\n * the server can resolve. Offering what the account merely HOLDS would show a password under a\n * passkey-only policy, accept it, and have the server refuse it.\n *\n * An EMPTY answer is kept empty: it means no factor the account holds can produce this proof, and the\n * dialog says so instead of offering one that would be refused. If the question itself fails, every\n * local method is offered: showing one the account lacks costs a refusal the person can read, while\n * offering nothing leaves them no way through at all. No linked identity is offered then: unlike a local\n * method, a provider cannot be offered blind, because starting one needs the link the answer would name.\n */\nexport async function resolveStepUpOptions(\n  purpose: ReAuthenticationPurpose,\n): Promise<{ methods: StepUpMethod[]; identityLinks: ReAuthenticationIdentityLink[] }> {\n  try {\n    const { methods, identityLinks } = await getManualCallsHttpClient().getReAuthenticationMethods(purpose);\n    const accepted = new Set<AuthMethod>(methods);\n    return { methods: STEP_UP_METHODS.filter((method) => accepted.has(method)), identityLinks: identityLinks ?? [] };\n  } catch {\n    return { methods: [...STEP_UP_METHODS], identityLinks: [] };\n  }\n}\n\n/**\n * The proof the dialog would submit for `method`, or `null` while the input cannot yet be one. A TOTP\n * code is 6 to 8 digits because the digit count is configurable (`totpOperational.digits`).\n */\nexport function buildStepUpProof(method: StepUpMethod | null, input: { password: string; code: string }): StepUpProof | null {\n  switch (method) {\n    case AuthMethod.PASSWORD:\n      return input.password.trim() ? { method, password: input.password } : null;\n    case AuthMethod.TOTP:\n      return /^\\d{6,8}$/.test(input.code.trim()) ? { method, code: input.code.trim() } : null;\n    case AuthMethod.PASSKEY:\n      return { method };\n    default:\n      return null;\n  }\n}\n\ninterface StepUpAuthDialogProps {\n  open: boolean;\n  /** Which proof the refusal asked for; decides which methods are offered (#1417). */\n  purpose: ReAuthenticationPurpose;\n  onConfirm: (proof: StepUpProof) => void;\n  onCancel: () => void;\n  /**\n   * The caught re-authentication failure, `null` when there is none. Passed as the error itself rather\n   * than as text so it is resolved HERE, through the i18n context: a wrong password used to reach the\n   * dialog as the backend's i18n reference (`authentication_user_credentials_invalid`).\n   */\n  failure: unknown;\n  isLoading: boolean;\n}\n\nexport const StepUpAuthDialog: React.FC<StepUpAuthDialogProps> = ({\n  open,\n  purpose,\n  onConfirm,\n  onCancel,\n  failure,\n  isLoading,\n}) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS });\n  const t = useCallback(\n    (key: string) => tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key),\n    [tComponent],\n  );\n\n  // `null` while the server is being asked, so the no-method message never flashes before the answer.\n  const [available, setAvailable] = useState<StepUpMethod[] | null>(null);\n  const [identityLinks, setIdentityLinks] = useState<ReAuthenticationIdentityLink[]>([]);\n  const [method, setMethod] = useState<StepUpMethod | null>(null);\n  // The chosen linked identity (#1441). Exclusive with `method`: choosing one clears the other.\n  const [link, setLink] = useState<ReAuthenticationIdentityLink | null>(null);\n  // Set while the provider's window is open. Cancel stays available then: the person may abandon the\n  // provider, and nothing else would ever end the wait early.\n  const isFederatedPendingRef = useRef(false);\n  const [password, setPassword] = useState('');\n  const [code, setCode] = useState('');\n  // OperationsConfirmCritical calls onOpenChange(false) synchronously after validationCallback.\n  // This ref prevents that premature close from cancelling the async re-auth flow.\n  const isSubmittingRef = useRef(false);\n\n  useEffect(() => {\n    if (!open) return;\n    setPassword('');\n    setCode('');\n    isSubmittingRef.current = false;\n    isFederatedPendingRef.current = false;\n    setAvailable(null);\n    setIdentityLinks([]);\n    setMethod(null);\n    setLink(null);\n    let cancelled = false;\n    void resolveStepUpOptions(purpose).then((options) => {\n      if (cancelled) return;\n      setAvailable(options.methods);\n      setIdentityLinks(options.identityLinks);\n      // A local method first when there is one; otherwise the first provider.\n      setMethod(options.methods[0] ?? null);\n      setLink(options.methods.length === 0 ? options.identityLinks[0] ?? null : null);\n    });\n    return () => { cancelled = true; };\n  }, [open, purpose]);\n\n  // Reset submitting guard when async operation finishes (success closes dialog; error stays open)\n  useEffect(() => {\n    if (!isLoading) {\n      isSubmittingRef.current = false;\n      isFederatedPendingRef.current = false;\n    }\n  }, [isLoading]);\n\n  const buildProof = useCallback(() => buildStepUpProof(method, { password, code }), [method, password, code]);\n\n  const nothingOffered = available?.length === 0 && identityLinks.length === 0;\n\n  const handleValidation = useCallback(() => {\n    // No method this account holds can produce the proof: the message already says what to do, so Confirm\n    // acknowledges it and closes rather than doing nothing (#1417).\n    if (nothingOffered) {\n      onCancel();\n      return;\n    }\n    if (link) {\n      if (isSubmittingRef.current) return;\n      isSubmittingRef.current = true;\n      isFederatedPendingRef.current = true;\n      // Opened HERE, synchronously in the click, or the browser blocks it (#1441).\n      onConfirm({ method: link.method, identityLinkId: link.identityLinkId, popup: openReAuthenticationWindow() });\n      return;\n    }\n    const proof = buildProof();\n    if (!proof || isSubmittingRef.current) return;\n    isSubmittingRef.current = true;\n    onConfirm(proof);\n  }, [nothingOffered, link, buildProof, onCancel, onConfirm]);\n\n  const handleCancel = useCallback(() => {\n    if (isSubmittingRef.current && !isFederatedPendingRef.current) return;\n    setPassword('');\n    setCode('');\n    onCancel();\n  }, [onCancel]);\n\n  const handleOpenChange = useCallback((nextOpen: boolean) => {\n    if (!nextOpen && !isSubmittingRef.current) {\n      handleCancel();\n    }\n  }, [handleCancel]);\n\n  const submitOnEnter = (e: React.KeyboardEvent) => {\n    if (e.key === 'Enter') handleValidation();\n  };\n\n  if (!isReady) return null;\n\n  return (\n    <OperationsConfirmCritical\n      open={open}\n      onOpenChange={handleOpenChange}\n      cancelCallback={handleCancel}\n      validationCallback={handleValidation}\n      label={t(SecuritySettingsLabel.REAUTH_TITLE)}\n    >\n      <div className=\"space-y-4 py-4\">\n        <Text className=\"text-sm\">{t(SecuritySettingsLabel.REAUTH_DESCRIPTION)}</Text>\n        {failure !== null && (\n          <Alert variant=\"destructive\">\n            <AlertDescription>\n              {failure instanceof FederatedReAuthenticationFailure\n                ? t(FEDERATED_FAILURE_LABEL[failure.reason])\n                : toUserFacingErrorMessage(failure, t(SecuritySettingsLabel.ERROR))}\n            </AlertDescription>\n          </Alert>\n        )}\n        {nothingOffered && (\n          <Alert>\n            <AlertDescription>{t(SecuritySettingsLabel.REAUTH_NO_ACCEPTED_METHOD)}</AlertDescription>\n          </Alert>\n        )}\n        {available && available.length + identityLinks.length > 1 && (\n          <div className=\"flex flex-wrap gap-2\" role=\"group\" aria-label={t(SecuritySettingsLabel.REAUTH_TITLE)}>\n            {available.map((choice) => (\n              <Button\n                key={choice}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice === method ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice === method}\n                disabled={isLoading}\n                onClick={() => { setMethod(choice); setLink(null); }}\n              >\n                {t(METHOD_CHOICE_LABEL[choice])}\n              </Button>\n            ))}\n            {identityLinks.map((choice) => (\n              <Button\n                key={choice.identityLinkId}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice.identityLinkId === link?.identityLinkId ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice.identityLinkId === link?.identityLinkId}\n                disabled={isLoading}\n                onClick={() => { setLink(choice); setMethod(null); }}\n              >\n                {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_WITH_PROVIDER, { provider: choice.displayName })}\n              </Button>\n            ))}\n          </div>\n        )}\n        {link && (\n          <Text className=\"text-sm\">\n            {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_PROVIDER_PROMPT, { provider: link.displayName })}\n          </Text>\n        )}\n        {method === AuthMethod.PASSWORD && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_PASSWORD)}</FieldLabel>\n            <InputRoot\n              type=\"password\"\n              autoComplete=\"current-password\"\n              value={password}\n              onChange={(e) => setPassword(e.target.value)}\n              placeholder={t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.TOTP && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_TOTP_CODE)}</FieldLabel>\n            <InputRoot\n              inputMode=\"numeric\"\n              autoComplete=\"one-time-code\"\n              maxLength={8}\n              value={code}\n              onChange={(e) => setCode(e.target.value.replace(/\\D/g, ''))}\n              placeholder={t(SecuritySettingsLabel.REAUTH_TOTP_CODE_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.PASSKEY && (\n          <Text className=\"text-sm\">{t(SecuritySettingsLabel.REAUTH_PASSKEY_PROMPT)}</Text>\n        )}\n      </div>\n    </OperationsConfirmCritical>\n  );\n};\n"]}
+{"version":3,"file":"StepUpAuthDialog.js","sourceRoot":"","sources":["../../../../src/components/auth/StepUpAuthDialog.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,UAAU,EAAoG,MAAM,uBAAuB,CAAC;AACrJ,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AAChH,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAAE,MAAM,sEAAsE,CAAC;AAC3G,OAAO,EACL,gCAAgC,EAChC,sCAAsC,EACtC,0BAA0B,GAC3B,MAAM,uEAAuE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;AAmBnH,MAAM,uBAAuB,GAA0E;IACrG,CAAC,sCAAsC,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC,6BAA6B;IAC3G,oGAAoG;IACpG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;IAChG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,yBAAyB;IACnG,CAAC,sCAAsC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;CAC9F,CAAC;AAEF,MAAM,mBAAmB,GAAgD;IACvE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,mBAAmB;IAC/D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,gBAAgB;IACzD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC,oBAAoB;CAClE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAa,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA2B,EAAE,KAAyC;IACrG,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,KAAK,UAAU,CAAC,IAAI;YAClB,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,KAAK,UAAU,CAAC,OAAO;YACrB,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,MAAM,gBAAgB,GAAoC,CAAC,EAChE,IAAI,EACJ,OAAO,EACP,MAAM,GAAG,mBAAmB,CAAC,oBAAoB,EACjD,SAAS,EACT,QAAQ,EACR,OAAO,EACP,SAAS,GACV,EAAE,EAAE;IACH,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,CAAC,EACrF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,oGAAoG;IACpG,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAwB,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiC,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAChE,8FAA8F;IAC9F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,mGAAmG;IACnG,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,8FAA8F;IAC9F,iFAAiF;IACjF,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,oBAAoB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,gBAAgB,GAAG,MAAM,KAAK,mBAAmB,CAAC,mBAAmB,CAAC;YAC5E,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC9H,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxB,wEAAwE;YACxE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAC9B,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5B,iGAAiG;IACjG,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;YAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7G,MAAM,cAAc,GAAG,SAAS,EAAE,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAE7E,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE;QACxC,sGAAsG;QACtG,gEAAgE;QAChE,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,eAAe,CAAC,OAAO;gBAAE,OAAO;YACpC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,qBAAqB,CAAC,OAAO,GAAG,IAAI,CAAC;YACrC,6EAA6E;YAC7E,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO;YAAE,OAAO;QAC9C,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO;YAAE,OAAO;QACtE,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE,CAAC;IACb,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,QAAiB,EAAE,EAAE;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC1C,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,MAAM,aAAa,GAAG,CAAC,CAAsB,EAAE,EAAE;QAC/C,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;YAAE,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,KAAC,yBAAyB,IACxB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,gBAAgB,EAC9B,cAAc,EAAE,YAAY,EAC5B,kBAAkB,EAAE,gBAAgB,EACpC,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,YAE5C,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,mBAAmB;wBAC7E,CAAC,CAAC,qBAAqB,CAAC,sCAAsC;wBAC9D,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,GAAQ,EACpD,OAAO,KAAK,IAAI,IAAI,CACnB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cACd,OAAO,YAAY,gCAAgC;4BAClD,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;4BAC5C,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,GACpD,GACb,CACT,EACA,cAAc,IAAI,CACjB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,GAAoB,GACnF,CACT,EACA,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3D,eAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,OAAO,gBAAa,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,aACjG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACzB,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC9E,MAAM,KAAK,MAAM,EAC/B,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAR1B,MAAM,CASJ,CACV,CAAC,EACD,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC7B,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC3G,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,EAC5D,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,IARzI,MAAM,CAAC,cAAc,CASnB,CACV,CAAC,IACE,CACP,EACA,IAAI,IAAI,CACP,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YACtB,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,GACzI,CACR,EACA,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CACjC,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAc,EACnE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,EAC/B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,EACjE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAC7B,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,SAAS,EAAC,SAAS,EACnB,YAAY,EAAC,eAAe,EAC5B,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAC3D,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,4BAA4B,CAAC,EAClE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,CAChC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,CAClF,IACG,GACoB,CAC7B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import React, { useState, useCallback, useEffect, useRef } from 'react';\nimport { AuthMethod, ReAuthenticationPurpose, type FederatedReAuthenticationMethod, type ReAuthenticationIdentityLink } from '@wildo-ai/saas-models';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { OperationsConfirmCritical } from '~wildo-frontend-lib/components/feedback/operations-confirm-critical';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { StepUpRefusalOrigin } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\nimport {\n  FederatedReAuthenticationFailure,\n  FederatedReAuthenticationFailureReason,\n  openReAuthenticationWindow,\n} from '~wildo-frontend-lib/core/security/federated-reauthentication.frontend';\n\n/**\n * The methods a step-up can be made with, strongest first — the order the dialog offers them in.\n *\n * These are the three `POST /auth/reauth` accepts. A passkey leads because it is phishing-resistant;\n * a password comes last because it is the one a stolen session's owner is most likely to have reused.\n */\nexport const STEP_UP_METHODS: readonly StepUpMethod[] = [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.PASSWORD];\n\nexport type StepUpMethod = AuthMethod.PASSKEY | AuthMethod.TOTP | AuthMethod.PASSWORD;\n\n/**\n * What the person supplied to prove they are still the account holder. The dialog collects it; the\n * step-up context turns it into a single-use token. A passkey carries nothing here because its\n * ceremony runs after the dialog confirms — it needs a server challenge first.\n *\n * A federated proof (#1441) carries the linked identity and the window the provider will run in. The\n * window is opened BY THE DIALOG, in the Confirm click, because a browser allows a popup only there;\n * `null` means it refused.\n */\nexport type StepUpProof =\n  | { method: AuthMethod.PASSWORD; password: string }\n  | { method: AuthMethod.TOTP; code: string }\n  | { method: AuthMethod.PASSKEY }\n  | { method: FederatedReAuthenticationMethod; identityLinkId: string; popup: Window | null };\n\nconst FEDERATED_FAILURE_LABEL: Record<FederatedReAuthenticationFailureReason, SecuritySettingsLabel> = {\n  [FederatedReAuthenticationFailureReason.POPUP_BLOCKED]: SecuritySettingsLabel.REAUTH_PROVIDER_POPUP_BLOCKED,\n  // Never displayed (a cancelled dialog is closed); mapped so the table stays total over the reasons.\n  [FederatedReAuthenticationFailureReason.CANCELLED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n  [FederatedReAuthenticationFailureReason.TIMED_OUT]: SecuritySettingsLabel.REAUTH_PROVIDER_TIMED_OUT,\n  [FederatedReAuthenticationFailureReason.FAILED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n};\n\nconst METHOD_CHOICE_LABEL: Record<StepUpMethod, SecuritySettingsLabel> = {\n  [AuthMethod.PASSKEY]: SecuritySettingsLabel.REAUTH_WITH_PASSKEY,\n  [AuthMethod.TOTP]: SecuritySettingsLabel.REAUTH_WITH_TOTP,\n  [AuthMethod.PASSWORD]: SecuritySettingsLabel.REAUTH_WITH_PASSWORD,\n};\n\n/**\n * What this account can re-authenticate with for `purpose`: its local methods, in {@link STEP_UP_METHODS}\n * order, and the linked identities whose provider can re-authenticate it (#1441). One request answers both.\n *\n * Asked of the server each time the dialog opens (#1417): the answer changes as the person adds and\n * removes authenticators, and for a step-up it is narrowed by the account's step-up policy, which only\n * the server can resolve. Offering what the account merely HOLDS would show a password under a\n * passkey-only policy, accept it, and have the server refuse it.\n *\n * An EMPTY answer is kept empty: it means no factor the account holds can produce this proof, and the\n * dialog says so instead of offering one that would be refused. If the question itself fails, every\n * local method is offered: showing one the account lacks costs a refusal the person can read, while\n * offering nothing leaves them no way through at all. No linked identity is offered then: unlike a local\n * method, a provider cannot be offered blind, because starting one needs the link the answer would name.\n */\nexport async function resolveStepUpOptions(\n  purpose: ReAuthenticationPurpose,\n): Promise<{ methods: StepUpMethod[]; identityLinks: ReAuthenticationIdentityLink[] }> {\n  try {\n    const { methods, identityLinks } = await getManualCallsHttpClient().getReAuthenticationMethods(purpose);\n    const accepted = new Set<AuthMethod>(methods);\n    return { methods: STEP_UP_METHODS.filter((method) => accepted.has(method)), identityLinks: identityLinks ?? [] };\n  } catch {\n    return { methods: [...STEP_UP_METHODS], identityLinks: [] };\n  }\n}\n\n/**\n * The proof the dialog would submit for `method`, or `null` while the input cannot yet be one. A TOTP\n * code is 6 to 8 digits because the digit count is configurable (`totpOperational.digits`).\n */\nexport function buildStepUpProof(method: StepUpMethod | null, input: { password: string; code: string }): StepUpProof | null {\n  switch (method) {\n    case AuthMethod.PASSWORD:\n      return input.password.trim() ? { method, password: input.password } : null;\n    case AuthMethod.TOTP:\n      return /^\\d{6,8}$/.test(input.code.trim()) ? { method, code: input.code.trim() } : null;\n    case AuthMethod.PASSKEY:\n      return { method };\n    default:\n      return null;\n  }\n}\n\ninterface StepUpAuthDialogProps {\n  open: boolean;\n  /** Which proof the refusal asked for; decides which methods are offered (#1417). */\n  purpose: ReAuthenticationPurpose;\n  /**\n   * Who asked (#1633). When it is a CLIENT organization's policy, the proof must be a second factor, so the password\n   * and linked identities — which prove a first factor only — are not offered, and the description says whose policy\n   * asks. Absent means the account's own policy or the operation.\n   */\n  origin?: StepUpRefusalOrigin;\n  onConfirm: (proof: StepUpProof) => void;\n  onCancel: () => void;\n  /**\n   * The caught re-authentication failure, `null` when there is none. Passed as the error itself rather\n   * than as text so it is resolved HERE, through the i18n context: a wrong password used to reach the\n   * dialog as the backend's i18n reference (`authentication_user_credentials_invalid`).\n   */\n  failure: unknown;\n  isLoading: boolean;\n}\n\nexport const StepUpAuthDialog: React.FC<StepUpAuthDialogProps> = ({\n  open,\n  purpose,\n  origin = StepUpRefusalOrigin.ACCOUNT_OR_OPERATION,\n  onConfirm,\n  onCancel,\n  failure,\n  isLoading,\n}) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS });\n  const t = useCallback(\n    (key: string) => tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key),\n    [tComponent],\n  );\n\n  // `null` while the server is being asked, so the no-method message never flashes before the answer.\n  const [available, setAvailable] = useState<StepUpMethod[] | null>(null);\n  const [identityLinks, setIdentityLinks] = useState<ReAuthenticationIdentityLink[]>([]);\n  const [method, setMethod] = useState<StepUpMethod | null>(null);\n  // The chosen linked identity (#1441). Exclusive with `method`: choosing one clears the other.\n  const [link, setLink] = useState<ReAuthenticationIdentityLink | null>(null);\n  // Set while the provider's window is open. Cancel stays available then: the person may abandon the\n  // provider, and nothing else would ever end the wait early.\n  const isFederatedPendingRef = useRef(false);\n  const [password, setPassword] = useState('');\n  const [code, setCode] = useState('');\n  // OperationsConfirmCritical calls onOpenChange(false) synchronously after validationCallback.\n  // This ref prevents that premature close from cancelling the async re-auth flow.\n  const isSubmittingRef = useRef(false);\n\n  useEffect(() => {\n    if (!open) return;\n    setPassword('');\n    setCode('');\n    isSubmittingRef.current = false;\n    isFederatedPendingRef.current = false;\n    setAvailable(null);\n    setIdentityLinks([]);\n    setMethod(null);\n    setLink(null);\n    let cancelled = false;\n    void resolveStepUpOptions(purpose).then((options) => {\n      if (cancelled) return;\n      const secondFactorOnly = origin === StepUpRefusalOrigin.CLIENT_ORGANIZATION;\n      const methods = secondFactorOnly ? options.methods.filter((candidate) => candidate !== AuthMethod.PASSWORD) : options.methods;\n      const links = secondFactorOnly ? [] : options.identityLinks;\n      setAvailable(methods);\n      setIdentityLinks(links);\n      // A local method first when there is one; otherwise the first provider.\n      setMethod(methods[0] ?? null);\n      setLink(methods.length === 0 ? links[0] ?? null : null);\n    });\n    return () => { cancelled = true; };\n  }, [open, purpose, origin]);\n\n  // Reset submitting guard when async operation finishes (success closes dialog; error stays open)\n  useEffect(() => {\n    if (!isLoading) {\n      isSubmittingRef.current = false;\n      isFederatedPendingRef.current = false;\n    }\n  }, [isLoading]);\n\n  const buildProof = useCallback(() => buildStepUpProof(method, { password, code }), [method, password, code]);\n\n  const nothingOffered = available?.length === 0 && identityLinks.length === 0;\n\n  const handleValidation = useCallback(() => {\n    // No method this account holds can produce the proof: the message already says what to do, so Confirm\n    // acknowledges it and closes rather than doing nothing (#1417).\n    if (nothingOffered) {\n      onCancel();\n      return;\n    }\n    if (link) {\n      if (isSubmittingRef.current) return;\n      isSubmittingRef.current = true;\n      isFederatedPendingRef.current = true;\n      // Opened HERE, synchronously in the click, or the browser blocks it (#1441).\n      onConfirm({ method: link.method, identityLinkId: link.identityLinkId, popup: openReAuthenticationWindow() });\n      return;\n    }\n    const proof = buildProof();\n    if (!proof || isSubmittingRef.current) return;\n    isSubmittingRef.current = true;\n    onConfirm(proof);\n  }, [nothingOffered, link, buildProof, onCancel, onConfirm]);\n\n  const handleCancel = useCallback(() => {\n    if (isSubmittingRef.current && !isFederatedPendingRef.current) return;\n    setPassword('');\n    setCode('');\n    onCancel();\n  }, [onCancel]);\n\n  const handleOpenChange = useCallback((nextOpen: boolean) => {\n    if (!nextOpen && !isSubmittingRef.current) {\n      handleCancel();\n    }\n  }, [handleCancel]);\n\n  const submitOnEnter = (e: React.KeyboardEvent) => {\n    if (e.key === 'Enter') handleValidation();\n  };\n\n  if (!isReady) return null;\n\n  return (\n    <OperationsConfirmCritical\n      open={open}\n      onOpenChange={handleOpenChange}\n      cancelCallback={handleCancel}\n      validationCallback={handleValidation}\n      label={t(SecuritySettingsLabel.REAUTH_TITLE)}\n    >\n      <div className=\"space-y-4 py-4\">\n        <Text className=\"text-sm\">{t(origin === StepUpRefusalOrigin.CLIENT_ORGANIZATION\n          ? SecuritySettingsLabel.REAUTH_CLIENT_ORGANIZATION_DESCRIPTION\n          : SecuritySettingsLabel.REAUTH_DESCRIPTION)}</Text>\n        {failure !== null && (\n          <Alert variant=\"destructive\">\n            <AlertDescription>\n              {failure instanceof FederatedReAuthenticationFailure\n                ? t(FEDERATED_FAILURE_LABEL[failure.reason])\n                : toUserFacingErrorMessage(failure, t(SecuritySettingsLabel.ERROR))}\n            </AlertDescription>\n          </Alert>\n        )}\n        {nothingOffered && (\n          <Alert>\n            <AlertDescription>{t(SecuritySettingsLabel.REAUTH_NO_ACCEPTED_METHOD)}</AlertDescription>\n          </Alert>\n        )}\n        {available && available.length + identityLinks.length > 1 && (\n          <div className=\"flex flex-wrap gap-2\" role=\"group\" aria-label={t(SecuritySettingsLabel.REAUTH_TITLE)}>\n            {available.map((choice) => (\n              <Button\n                key={choice}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice === method ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice === method}\n                disabled={isLoading}\n                onClick={() => { setMethod(choice); setLink(null); }}\n              >\n                {t(METHOD_CHOICE_LABEL[choice])}\n              </Button>\n            ))}\n            {identityLinks.map((choice) => (\n              <Button\n                key={choice.identityLinkId}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice.identityLinkId === link?.identityLinkId ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice.identityLinkId === link?.identityLinkId}\n                disabled={isLoading}\n                onClick={() => { setLink(choice); setMethod(null); }}\n              >\n                {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_WITH_PROVIDER, { provider: choice.displayName })}\n              </Button>\n            ))}\n          </div>\n        )}\n        {link && (\n          <Text className=\"text-sm\">\n            {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_PROVIDER_PROMPT, { provider: link.displayName })}\n          </Text>\n        )}\n        {method === AuthMethod.PASSWORD && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_PASSWORD)}</FieldLabel>\n            <InputRoot\n              type=\"password\"\n              autoComplete=\"current-password\"\n              value={password}\n              onChange={(e) => setPassword(e.target.value)}\n              placeholder={t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.TOTP && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_TOTP_CODE)}</FieldLabel>\n            <InputRoot\n              inputMode=\"numeric\"\n              autoComplete=\"one-time-code\"\n              maxLength={8}\n              value={code}\n              onChange={(e) => setCode(e.target.value.replace(/\\D/g, ''))}\n              placeholder={t(SecuritySettingsLabel.REAUTH_TOTP_CODE_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.PASSKEY && (\n          <Text className=\"text-sm\">{t(SecuritySettingsLabel.REAUTH_PASSKEY_PROMPT)}</Text>\n        )}\n      </div>\n    </OperationsConfirmCritical>\n  );\n};\n"]}

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_SecuritySettings.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAqKzE,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,EAwZ5C,CAAC"}
+{"version":3,"file":"AppPage_SecuritySettings.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAmLzE,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,EAkY5C,CAAC"}

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.js

@@ -27,6 +27,7 @@ import { CredentialUsernameAutofillField } from '../../../components/auth/utils/
 import { TotpEnrollmentMethod } from '../../../components/auth/enrollment/TotpEnrollmentMethod.js';
 import { PhoneEnrollmentMethod } from '../../../components/auth/enrollment/PhoneEnrollmentMethod.js';
 import { startRegistration } from '@simplewebauthn/browser';
+import { buildProviderDisplayNameLabelKey } from '@wildo-ai/saas-models/public-runtime';
 import { collectFrontendProviderDisplayLabelKeys, resolveFrontendProviderDisplayLabel, } from '../../../core/external-providers/frontend-provider-display-label.frontend.utils.js';
 /**
  * Presentational state of one authentication factor.
@@ -56,13 +57,17 @@ const FACTOR_STATE_BADGE_VARIANT = {
  * information pre-attentively; the description makes the choice informed. The
  * shape follows the account-security idiom used by mainstream providers.
  */
-const SecurityFactorCard = ({ icon, title, description, state, statusLabel, meta, action, children, }) => {
+const SecurityFactorRow = ({ icon, title, description, state, statusLabel, meta, action, children, }) => {
     const { renderIcon } = useIconRegistry();
     const isActive = state === SecurityFactorState.ACTIVE;
-    return (_jsx(Card, { children: _jsxs(CardContent, { className: "flex flex-col gap-item p-card", children: [_jsxs("div", { className: "flex flex-row items-start gap-item", children: [_jsx("div", { "aria-hidden": "true", className: cn('flex size-9 shrink-0 items-center justify-center rounded-md', isActive ? 'bg-success/10 text-success' : 'bg-muted text-muted-foreground'), children: renderIcon(icon, { size: IconSize.SM }) }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-element-xs", children: [_jsxs("div", { className: "flex flex-wrap items-center gap-element-xs", children: [_jsx(Text, { className: "font-medium leading-snug", children: title }), _jsx(Badge, { variant: FACTOR_STATE_BADGE_VARIANT[state], children: statusLabel })] }), _jsx(Text, { className: "text-sm text-muted-foreground", children: description }), meta] }), action && _jsx("div", { className: "flex shrink-0 items-center gap-element-xs", children: action })] }), children && (_jsx("div", { className: "flex flex-col gap-item ps-[calc(var(--spacing)*9+var(--sp-item))]", children: children }))] }) }));
+    return (
+    // One row of ONE card: the factors are a single list of alternatives, so they share a frame and
+    // are separated by hairlines (the settings-row idiom) rather than each carrying a card of its own —
+    // five stacked cards read as five pages.
+    _jsxs("div", { className: "flex flex-col gap-item py-group first:pt-0 last:pb-0", children: [_jsxs("div", { className: "flex flex-row items-start gap-item", children: [_jsx("div", { "aria-hidden": "true", className: cn('flex size-9 shrink-0 items-center justify-center rounded-md', isActive ? 'bg-success/10 text-success' : 'bg-muted text-muted-foreground'), children: renderIcon(icon, { size: IconSize.SM }) }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-element-xs", children: [_jsxs("div", { className: "flex flex-wrap items-center gap-element-xs", children: [_jsx(Text, { className: "font-medium leading-snug", children: title }), _jsx(Badge, { variant: FACTOR_STATE_BADGE_VARIANT[state], children: statusLabel })] }), !isActive && _jsx(Text, { className: "text-sm text-muted-foreground", children: description }), meta] }), action && _jsx("div", { className: "flex shrink-0 items-center gap-element-xs", children: action })] }), children && (_jsx("div", { className: "flex flex-col gap-item ps-[calc(var(--spacing)*9+var(--sp-item))]", children: children }))] }));
 };
 export const AppPage_SecuritySettings = () => {
-    const { auth, frontendProviderRegistry } = useApplication();
+    const { auth } = useApplication();
     const { auth: authState } = useAuthSession();
     const { user } = useUserOrgs();
     const resolvedAuth = useResolvedAuthConfig();
@@ -76,8 +81,10 @@ export const AppPage_SecuritySettings = () => {
     const [showTotpEnroll, setShowTotpEnroll] = useState(false);
     const [showPhoneEnroll, setShowPhoneEnroll] = useState(false);
     const [passkeyRegistering, setPasskeyRegistering] = useState(false);
-    const identityProviderLabelKeys = useMemo(() => collectFrontendProviderDisplayLabelKeys(identityLinks.map((link) => frontendProviderRegistry?.getProviderByRef(link.providerRef)?.metadata.displayNameLabelKey)), [frontendProviderRegistry, identityLinks]);
-    const { tComponent, t: translateProvider, isReady } = useI18n({
+    // The linked provider's name is `providers.<ref>.displayName`, derived from the ref the link holds
+    // (#1701) — never read off a frontend provider module, since sign-in runs no vendor code in the page.
+    const identityProviderLabelKeys = useMemo(() => collectFrontendProviderDisplayLabelKeys(identityLinks.map((link) => buildProviderDisplayNameLabelKey(link.providerRef))), [identityLinks]);
+    const { tComponent, t: translateProvider, isReady, formatDate } = useI18n({
         component: [
             FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS,
             FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER,
@@ -138,19 +145,14 @@ export const AppPage_SecuritySettings = () => {
     const smsMethod = methods.find((m) => m.method === AuthMethod.SMS_OTP);
     const phoneVerified = smsMethod?.enrolled ?? false;
     const phoneMasked = smsMethod?.details?.phoneNumber;
-    const resolvedIdentityLinks = useMemo(() => identityLinks.map((link) => {
-        const provider = frontendProviderRegistry?.getProviderByRef(link.providerRef);
-        return {
-            ...link,
-            providerLabel: resolveFrontendProviderDisplayLabel({
-                providerRef: link.providerRef,
-                displayName: auth?.socialOAuth2Providers?.[link.providerRef]?.displayName
-                    ?? provider?.metadata.displayName,
-                displayNameLabelKey: provider?.metadata.displayNameLabelKey,
-                translate: translateProvider,
-            }),
-        };
-    }), [auth?.socialOAuth2Providers, frontendProviderRegistry, identityLinks, translateProvider]);
+    const resolvedIdentityLinks = useMemo(() => identityLinks.map((link) => ({
+        ...link,
+        providerLabel: resolveFrontendProviderDisplayLabel({
+            providerRef: link.providerRef,
+            displayName: auth?.socialOAuth2Providers?.[link.providerRef]?.displayName,
+            translate: translateProvider,
+        }),
+    })), [auth?.socialOAuth2Providers, identityLinks, translateProvider]);
     const handlePasskeyAdd = useCallback(async () => {
         if (passkeys.length >= maxPasskeys)
             return;
@@ -239,11 +241,9 @@ export const AppPage_SecuritySettings = () => {
             case SecurityFactorState.INACTIVE: return t(SecuritySettingsLabel.STATUS_NOT_CONFIGURED);
         }
     };
-    const PasskeySection = (_jsxs(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY], title: t(SecuritySettingsLabel.SECTION_PASSKEYS), description: t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION), state: passkeyState, statusLabel: statusLabelFor(passkeyState), meta: passkeysSupported && passkeys.length > 0
-            ? _jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.PASSKEY_COUNT, { count: passkeys.length }) })
-            : undefined, action: passkeysSupported && passkeys.length < maxPasskeys ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handlePasskeyAdd, disabled: passkeyRegistering, children: passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD) })) : undefined, children: [!passkeysSupported && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED) }) })), passkeysSupported && (_jsxs(_Fragment, { children: [passkeys.length === 0 && (_jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.PASSKEY_EMPTY) })), passkeys.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element", children: passkeys.map((pk) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: pk.name }), pk.createdAt && (_jsx(Text, { className: "text-xs text-muted-foreground", children: t(SecuritySettingsLabel.PASSKEY_ADDED, { date: new Date(pk.createdAt).toLocaleDateString() }) }))] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => handlePasskeyRemove(pk.credentialId), children: t(SecuritySettingsLabel.PASSKEY_REMOVE) }))] }, pk.credentialId))) }))] }))] }));
+    const PasskeySection = (_jsxs(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY], title: t(SecuritySettingsLabel.SECTION_PASSKEYS), description: t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION), state: passkeyState, statusLabel: statusLabelFor(passkeyState), action: passkeysSupported && passkeys.length < maxPasskeys ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handlePasskeyAdd, disabled: passkeyRegistering, children: passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD) })) : undefined, children: [!passkeysSupported && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED) }) })), passkeysSupported && passkeys.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element", children: passkeys.map((pk) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: pk.name }), pk.createdAt && (_jsx(Text, { className: "text-xs text-muted-foreground", children: t(SecuritySettingsLabel.PASSKEY_ADDED, { date: formatDate(pk.createdAt) }) }))] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => handlePasskeyRemove(pk.credentialId), children: t(SecuritySettingsLabel.PASSKEY_REMOVE) }))] }, pk.credentialId))) }))] }));
     const totpState = hasTotp ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    const TotpSection = (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP], title: t(SecuritySettingsLabel.SECTION_TOTP), description: t(SecuritySettingsLabel.TOTP_DESCRIPTION), state: totpState, statusLabel: statusLabelFor(totpState), meta: _jsx(Text, { className: "text-sm", children: hasTotp ? t(SecuritySettingsLabel.TOTP_ENABLED) : t(SecuritySettingsLabel.TOTP_NOT_SETUP) }), action: hasTotp
+    const TotpSection = (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP], title: t(SecuritySettingsLabel.SECTION_TOTP), description: t(SecuritySettingsLabel.TOTP_DESCRIPTION), state: totpState, statusLabel: statusLabelFor(totpState), action: hasTotp
             ? (allowRemoval ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleTotpDisable, children: t(SecuritySettingsLabel.TOTP_DISABLE) })) : undefined)
             // While the enrolment flow is open its own controls own the row, so the
             // opener is withdrawn rather than left as a second way in.
@@ -252,9 +252,10 @@ export const AppPage_SecuritySettings = () => {
                 refresh();
             }, onError: (msg) => setError(msg), isLoading: false, t: (k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k) })) : null }));
     const phoneState = phoneVerified ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    const PhoneSection = (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP], title: t(SecuritySettingsLabel.SECTION_PHONE), description: t(SecuritySettingsLabel.PHONE_DESCRIPTION), state: phoneState, statusLabel: statusLabelFor(phoneState), meta: _jsx(Text, { className: "text-sm", children: phoneVerified
-                ? `${t(SecuritySettingsLabel.PHONE_VERIFIED)}: ${phoneMasked ?? '***'}`
-                : t(SecuritySettingsLabel.PHONE_NOT_VERIFIED) }), action: phoneVerified ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_CHANGE) })) : (showPhoneEnroll ? undefined : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_VERIFY) }))), children: phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (_jsx(PhoneEnrollmentMethod, { onComplete: () => {
+    const PhoneSection = (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP], title: t(SecuritySettingsLabel.SECTION_PHONE), description: t(SecuritySettingsLabel.PHONE_DESCRIPTION), state: phoneState, statusLabel: statusLabelFor(phoneState), 
+        // WHICH number is verified is the one thing the "Active" badge cannot say, so the masked number
+        // stands alone — no "Verified:" in front of it (the badge) and no sentence when there is none.
+        meta: phoneVerified && phoneMasked ? _jsx(Text, { className: "text-sm", children: phoneMasked }) : undefined, action: phoneVerified ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_CHANGE) })) : (showPhoneEnroll ? undefined : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_VERIFY) }))), children: phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (_jsx(PhoneEnrollmentMethod, { onComplete: () => {
                 setShowPhoneEnroll(false);
                 refresh();
             }, onError: (msg) => setError(msg), isLoading: false, t: (k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k) })) : null }));
@@ -272,10 +273,10 @@ export const AppPage_SecuritySettings = () => {
     // The rows below already carry the state (per-factor badge) and the meaning
     // (per-factor description). A summary that restates them as a number is
     // strictly less information, presented as if it were more.
-    return (_jsxs("div", { className: "flex flex-col gap-section", children: [_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx("h3", { className: "text-base font-semibold tracking-tight", children: t(SecuritySettingsLabel.PAGE_TITLE) }), _jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.PAGE_DESCRIPTION) })] }), error && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) })), successMsg && (_jsx(Alert, { children: _jsx(AlertDescription, { children: successMsg }) })), loading ? (_jsx(Text, { className: "text-muted-foreground", children: t(SecuritySettingsLabel.LOADING) })) : (_jsxs("div", { className: "flex flex-col gap-item", children: [PasskeySection, TotpSection, PhoneSection, _jsx(PasswordSection, { hasPassword: hasPassword, passwordPolicy: passwordPolicy, userEmail: user?.email, t: t, tPolicy: tPolicy, onSuccess: () => {
-                            setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));
-                            refresh();
-                        }, onError: (msg) => setError(msg) }), _jsx(IdentityLinksSection, { links: resolvedIdentityLinks, allowRemoval: allowRemoval, t: t, onUnlink: handleUnlinkIdentity })] }))] }));
+    return (_jsxs("div", { className: "flex flex-col gap-section", children: [_jsx("h3", { className: "text-base font-semibold tracking-tight", children: t(SecuritySettingsLabel.PAGE_TITLE) }), error && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) })), successMsg && (_jsx(Alert, { children: _jsx(AlertDescription, { children: successMsg }) })), loading ? (_jsx(Text, { className: "text-muted-foreground", children: t(SecuritySettingsLabel.LOADING) })) : (_jsx(Card, { children: _jsxs(CardContent, { className: "flex flex-col divide-y divide-border p-card", children: [PasskeySection, TotpSection, PhoneSection, _jsx(PasswordSection, { hasPassword: hasPassword, passwordPolicy: passwordPolicy, userEmail: user?.email, t: t, tPolicy: tPolicy, onSuccess: () => {
+                                setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));
+                                refresh();
+                            }, onError: (msg) => setError(msg) }), _jsx(IdentityLinksSection, { links: resolvedIdentityLinks, allowRemoval: allowRemoval, t: t, onUnlink: handleUnlinkIdentity })] }) }))] }));
 };
 const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, onSuccess, onError }) => {
     const toUserFacingErrorMessage = useUserFacingErrorMessage();
@@ -335,13 +336,11 @@ const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, o
         }
     }, [onError, onSuccess, setForm, t, toUserFacingErrorMessage]);
     const state = hasPassword ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    return (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD], title: t(SecuritySettingsLabel.SECTION_PASSWORD), description: t(SecuritySettingsLabel.PASSWORD_DESCRIPTION), state: state, statusLabel: t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), meta: _jsx(Text, { className: "text-sm", children: t(hasPassword ? SecuritySettingsLabel.PASSWORD_SET_STATUS : SecuritySettingsLabel.PASSWORD_NOT_SET_STATUS) }), action: editing ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => {
+    return (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD], title: t(SecuritySettingsLabel.SECTION_PASSWORD), description: t(SecuritySettingsLabel.PASSWORD_DESCRIPTION), state: state, statusLabel: t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), action: editing ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => {
                 setEditing(false);
                 changeForm.reset();
                 setForm.reset();
             }, children: t(SecuritySettingsLabel.CANCEL) })) : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setEditing(true), children: t(hasPassword ? SecuritySettingsLabel.PASSWORD_CHANGE : SecuritySettingsLabel.PASSWORD_SET) })), children: !editing ? null : hasPassword ? (_jsx(FormProvider, { ...changeForm, children: _jsxs("form", { onSubmit: changeForm.handleSubmit(handleChange), className: "space-y-4", children: [_jsx(CredentialUsernameAutofillField, { email: userEmail }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CURRENT) }), _jsx(InputRoot, { type: "password", autoComplete: "current-password", ...changeForm.register('currentPassword', { required: true }) })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_NEW) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...changeForm.register('newPassword', { required: true }) }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: tPolicy })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CONFIRM) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...changeForm.register('confirmPassword', { required: true }) })] }), _jsx(Button, { type: "submit", disabled: submitting, children: t(SecuritySettingsLabel.PASSWORD_CHANGE) })] }) })) : (_jsx(FormProvider, { ...setForm, children: _jsxs("form", { onSubmit: setForm.handleSubmit(handleSet), className: "space-y-4", children: [_jsx(CredentialUsernameAutofillField, { email: userEmail }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_NEW) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...setForm.register('newPassword', { required: true }) }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: tPolicy })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CONFIRM) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...setForm.register('confirmPassword', { required: true }) })] }), _jsx(Button, { type: "submit", disabled: submitting, children: t(SecuritySettingsLabel.PASSWORD_SET) })] }) })) }));
 };
-const IdentityLinksSection = ({ links, allowRemoval, t, onUnlink }) => (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2], title: t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS), description: t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION), state: links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE, statusLabel: t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), meta: links.length > 0
-        ? _jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.IDENTITY_LINKS_COUNT, { count: links.length }) })
-        : undefined, children: links.length === 0 ? (_jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.IDENTITY_LINKS_EMPTY) })) : (_jsx("ul", { className: "flex flex-col gap-element", children: links.map((link) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: link.providerLabel }), _jsx(Text, { className: "truncate text-xs text-muted-foreground", children: link.providerEmail })] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => onUnlink(link._id), children: t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK) }))] }, link._id))) })) }));
+const IdentityLinksSection = ({ links, allowRemoval, t, onUnlink }) => (_jsx(SecurityFactorRow, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2], title: t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS), description: t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION), state: links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE, statusLabel: t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), children: links.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element", children: links.map((link) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: link.providerLabel }), _jsx(Text, { className: "truncate text-xs text-muted-foreground", children: link.providerEmail })] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => onUnlink(link._id), children: t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK) }))] }, link._id))) })) }));
 //# sourceMappingURL=AppPage_SecuritySettings.js.map