@wildo-ai/saas-frontend-lib 1.1.5 → 1.1.7

package/dist/esm/components/auth/Auth_OAuthLoggedOut.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLoggedOut.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAqB1H,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,MAAsD,EAAqB,EAAE;IACrI,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAE1G,2GAA2G;IAC3G,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAW,EACjD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAQ,IAC9F,EACN,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAChH,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,GAClC,IACL,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyE;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,+BAA+B,EACrD,qBAAqB,CACtB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React from 'react';\nimport { useNavigate } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLoggedOutLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout landing screen (§5) — the body rendered by {@link AuthPage_OAuthLoggedOut}.\n *\n * Shown after `GET /oauth/end-session` terminated the End-User's OP session when the request carried NO\n * valid `post_logout_redirect_uri` (a request WITH a registered one is redirected straight back to the\n * relying party instead — RP-Initiated Logout 1.0 §3). Purely informational: the session is already ended\n * server-side (revocation-C per-session fence) by the time the browser lands here, so this page only\n * confirms it and offers a route back to sign-in. No query params, no backend call, no state to drive.\n *\n * Copy is resolved through {@link OAuthLoggedOutLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT`) via\n * {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLoggedOut.labels.ts`.\n */\n\n// The screen is self-contained (no authorize query, no session), so it takes no external props; this\n// interface exists to satisfy the preset-wrapper contract shared by every `PUBLIC_LAYOUTS` auth page.\nexport interface PublicLayoutPreset_OAuthLoggedOut_DefaultProps {\n  readonly _selfDriven?: never;\n}\n\nexport const PublicLayoutPreset_OAuthLoggedOut_Default = (_props: PublicLayoutPreset_OAuthLoggedOut_DefaultProps): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT });\n  const navigate = useNavigate();\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, key);\n\n  // Component i18n sections load lazily; gate on `isReady` so the user never sees a flash of raw label keys.\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLoggedOutLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLoggedOutLabel.SUB_TITLE)}</Text>\n      </div>\n      <Button variant={ButtonVariants_Variant.DEFAULT} className=\"w-full\" onClick={() => navigate(CommonRoutePaths.login)}>\n        {t(OAuthLoggedOutLabel.RETURN_TO_SIGN_IN)}\n      </Button>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLoggedOut({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OAuthLoggedOut_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLoggedOut_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT,\n    'Auth_OAuthLoggedOut',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OAuthLoggedOut.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLoggedOut.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAqB1H,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,MAAsD,EAAqB,EAAE;IACrI,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAE1G,2GAA2G;IAC3G,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAW,EACjD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAQ,IAC9F,EACN,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAChH,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,GAClC,IACL,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyE;IACvJ,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,+BAA+B,EACrD,qBAAqB,CACtB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React from 'react';\nimport { useNavigate } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLoggedOutLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout landing screen (§5) — the body rendered by {@link AuthPage_OAuthLoggedOut}.\n *\n * Shown after `GET /oauth/end-session` terminated the End-User's OP session when the request carried NO\n * valid `post_logout_redirect_uri` (a request WITH a registered one is redirected straight back to the\n * relying party instead — RP-Initiated Logout 1.0 §3). Purely informational: the session is already ended\n * server-side (revocation-C per-session fence) by the time the browser lands here, so this page only\n * confirms it and offers a route back to sign-in. No query params, no backend call, no state to drive.\n *\n * Copy is resolved through {@link OAuthLoggedOutLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT`) via\n * {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLoggedOut.labels.ts`.\n */\n\n// The screen is self-contained (no authorize query, no session), so it takes no external props; this\n// interface exists to satisfy the preset-wrapper contract shared by every `PUBLIC_LAYOUTS` auth page.\nexport interface PublicLayoutPreset_OAuthLoggedOut_DefaultProps {\n  readonly _selfDriven?: never;\n}\n\nexport const PublicLayoutPreset_OAuthLoggedOut_Default = (_props: PublicLayoutPreset_OAuthLoggedOut_DefaultProps): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT });\n  const navigate = useNavigate();\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, key);\n\n  // Component i18n sections load lazily; gate on `isReady` so the user never sees a flash of raw label keys.\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLoggedOutLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLoggedOutLabel.SUB_TITLE)}</Text>\n      </div>\n      <Button variant={ButtonVariants_Variant.DEFAULT} className=\"w-full\" onClick={() => navigate(CommonRoutePaths.login)}>\n        {t(OAuthLoggedOutLabel.RETURN_TO_SIGN_IN)}\n      </Button>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLoggedOut({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OAuthLoggedOut_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLoggedOut_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT,\n    'Auth_OAuthLoggedOut',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLoggedOut.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,iCAAiC,EAAE,mBAAmB,EAgBlE,CAAC"}
+{"version":3,"file":"Auth_OAuthLoggedOut.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,iCAAiC,EAAE,mBAAmB,EAgBlE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthLoggedOut.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLoggedOut.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,wFAAwF;AACxF,0EAA0E;AAC1E,4FAA4F;AAC5F,yGAAyG;AAEzG,MAAM,CAAC,MAAM,iCAAiC,GAA0B;IACtE;QACE,GAAG,EAAE,mBAAmB,CAAC,KAAK;QAC9B,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,SAAS;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,8HAA8H;KACxI;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,4EAA4E;KACtF;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLoggedOutLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout landing screen: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLoggedOutLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLoggedOutLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading confirming to the user that they have been signed out of the application',\n  },\n  {\n    ref: OAuthLoggedOutLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line reassuring the user their session has ended and it is safe to close this tab, or that they can sign in again',\n  },\n  {\n    ref: OAuthLoggedOutLabel.RETURN_TO_SIGN_IN,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that takes the user back to the sign-in page to start a new session',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, PublicLayoutsOAuthLoggedOutLabels);\n"]}
+{"version":3,"file":"Auth_OAuthLoggedOut.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLoggedOut.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,wFAAwF;AACxF,0EAA0E;AAC1E,4FAA4F;AAC5F,yGAAyG;AAEzG,MAAM,CAAC,MAAM,iCAAiC,GAA0B;IACtE;QACE,GAAG,EAAE,mBAAmB,CAAC,KAAK;QAC9B,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,SAAS;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,8HAA8H;KACxI;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,4EAA4E;KACtF;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLoggedOutLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout landing screen: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLoggedOutLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLoggedOutLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading confirming to the user that they have been signed out of the application',\n  },\n  {\n    ref: OAuthLoggedOutLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line reassuring the user their session has ended and it is safe to close this tab, or that they can sign in again',\n  },\n  {\n    ref: OAuthLoggedOutLabel.RETURN_TO_SIGN_IN,\n    kind: LabelKind.BUTTON,\n    purpose: 'Button that takes the user back to the sign-in page to start a new session',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT, PublicLayoutsOAuthLoggedOutLabels);\n"]}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAiD,MAAM,OAAO,CAAC;AAWtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAGxH;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,kDAAkD;IACjE,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAgBD,eAAO,MAAM,6CAA6C,GACxD,QAAQ,kDAAkD,KACzD,KAAK,CAAC,GAAG,CAAC,OAuEZ,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,EACtC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,kDAAkD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAM/F"}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAiD,MAAM,OAAO,CAAC;AAWtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAGxH;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,kDAAkD;IACjE,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAgBD,eAAO,MAAM,6CAA6C,GACxD,QAAQ,kDAAkD,KACzD,KAAK,CAAC,GAAG,CAAC,OAuEZ,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,EACtC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,kDAAkD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAM/F"}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AA0B1H;;;;GAIG;AACH,IAAK,aAOJ;AAPD,WAAK,aAAa;IAChB,0CAA0C;IAC1C,gCAAe,CAAA;IACf,wGAAwG;IACxG,0CAAyB,CAAA;IACzB,uGAAuG;IACvG,gCAAe,CAAA;AACjB,CAAC,EAPI,aAAa,KAAb,aAAa,QAOjB;AAED,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAC3D,MAA0D,EACvC,EAAE;IACrB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAE9G,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,+FAA+F;IAC/F,yGAAyG;IACzG,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC5C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvF,mGAAmG;YACnG,qGAAqG;YACrG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kGAAkG;YAClG,6DAA6D;YAC7D,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,qGAAqG;QACrG,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,8GAA8G;IAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,cAAc,EAAE,OAAO,SAAG,CAAC;IACnE,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAQ,IAClG,EAEL,MAAM,KAAK,aAAa,CAAC,KAAK,IAAI,CACjC,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAoB,GACjE,CACT,EAED,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,YAC/H,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAC3B,EACT,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,YAChI,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAC5B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EACtC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EACkE;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,mCAAmC,EACzD,yBAAyB,CAC1B,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLogoutConfirmLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout §6 confirmation prompt — the body rendered by {@link AuthPage_OAuthLogoutConfirm}.\n *\n * FLOW: `GET /oauth/end-session` redirects the browser here (with a single-use `token` query param) for a\n * NON-trusted logout — everything EXCEPT a trusted RP presenting a valid `id_token_hint` AND an exact-match\n * registered `post_logout_redirect_uri`, which is logged out directly without a prompt (the Keycloak-style\n * posture). This page asks the End-User to confirm BEFORE the session is terminated, mitigating BROWSER-based\n * logout CSRF (RP-Initiated Logout 1.0 §6; a cross-origin page cannot read the token to complete the confirm —\n * see the backend `handleEndSessionConfirm` threat model). On CONFIRM it POSTs the token to `POST /oauth/end-session/confirm`,\n * which terminates the session and returns `{ redirect_to }` (the signed-out page `/oauth/logged-out`); on\n * CANCEL nothing is terminated and the user returns to the app.\n *\n * Token-driven, not session-driven: the End-User may be unauthenticated in this SPA (they arrived via an RP\n * redirect), so this page never gates on a Bearer — the opaque `token` is the whole credential.\n *\n * Copy is resolved through {@link OAuthLogoutConfirmLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM`)\n * via {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLogoutConfirm.labels.ts`.\n */\n\nexport interface PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps {\n  /** Reserved: the confirm screen is driven by the `token` query param and accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/**\n * The prompt's local interaction state. A named runtime source rather than a literal union so each\n * member can carry WHY it exists — `ERROR` in particular is reached only by a stale/expired token,\n * which is a normal outcome here (the token is single-use and short-TTL), not a fault.\n */\nenum ConfirmStatus {\n  /** Waiting for the End-User to decide. */\n  READY = 'ready',\n  /** The confirm POST is in flight; both buttons are disabled to keep the single-use token single-use. */\n  SUBMITTING = 'submitting',\n  /** The confirmation token was stale, expired or already used — the user may start the logout again. */\n  ERROR = 'error',\n}\n\nexport const PublicLayoutPreset_OAuthLogoutConfirm_Default = (\n  _props: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps,\n): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConfirmStatus>(ConfirmStatus.READY);\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, key);\n\n  const token = useMemo(() => searchParams.get('token') ?? '', [searchParams]);\n\n  // Stale-closure-proof single-flight latch for the confirm POST (mirrors the consent screen): a\n  // synchronous double-dispatch could fire two POSTs before React re-renders, and the token is single-use.\n  const submittingRef = useRef(false);\n\n  const confirm = useCallback(async () => {\n    if (!token || submittingRef.current) return;\n    submittingRef.current = true;\n    setStatus(ConfirmStatus.SUBMITTING);\n    try {\n      const { redirect_to } = await getManualCallsHttpClient().oauthEndSessionConfirm(token);\n      // Full navigation to the signed-out page (`window.location.assign`, mirroring the consent screen):\n      // the session is ending, so re-booting the SPA there is desirable — it drops any stale client state.\n      window.location.assign(redirect_to);\n    } catch {\n      // The token is single-use + short-TTL; a failure means it is stale/expired. Release the latch and\n      // surface a retry-able error rather than stranding the user.\n      submittingRef.current = false;\n      setStatus(ConfirmStatus.ERROR);\n    }\n  }, [token]);\n\n  const cancel = useCallback(() => {\n    // Cancel = do NOT sign out. Return to the app home (the user keeps their session). A full navigation\n    // avoids leaving the single-use `token` in the SPA's in-memory history entry.\n    window.location.assign(CommonRoutePaths.home);\n  }, []);\n\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  // Reached without a token (bad link / direct hit) — there is nothing to confirm; send to the signed-out page.\n  if (!token) {\n    return <Navigate to={CommonRoutePaths.oauthLoggedOut} replace />;\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLogoutConfirmLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLogoutConfirmLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {status === ConfirmStatus.ERROR && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{t(OAuthLogoutConfirmLabel.ERROR)}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"flex gap-element\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={cancel}>\n          {t(OAuthLogoutConfirmLabel.CANCEL)}\n        </Button>\n        <Button variant={ButtonVariants_Variant.DEFAULT} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={confirm}>\n          {t(OAuthLogoutConfirmLabel.CONFIRM)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLogoutConfirm({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM,\n    'Auth_OAuthLogoutConfirm',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AA0B1H;;;;GAIG;AACH,IAAK,aAOJ;AAPD,WAAK,aAAa;IAChB,0CAA0C;IAC1C,gCAAe,CAAA;IACf,wGAAwG;IACxG,0CAAyB,CAAA;IACzB,uGAAuG;IACvG,gCAAe,CAAA;AACjB,CAAC,EAPI,aAAa,KAAb,aAAa,QAOjB;AAED,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAC3D,MAA0D,EACvC,EAAE;IACrB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAE9G,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,+FAA+F;IAC/F,yGAAyG;IACzG,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAC5C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvF,mGAAmG;YACnG,qGAAqG;YACrG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kGAAkG;YAClG,6DAA6D;YAC7D,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC;YAC9B,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,qGAAqG;QACrG,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,cAAK,SAAS,EAAC,gCAAgC,YAC7C,KAAC,cAAc,KAAG,GACd,CACP,CAAC;IACJ,CAAC;IAED,8GAA8G;IAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,cAAc,EAAE,OAAO,SAAG,CAAC;IACnE,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAW,EACrD,KAAC,IAAI,IAAC,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAQ,IAClG,EAEL,MAAM,KAAK,aAAa,CAAC,KAAK,IAAI,CACjC,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAoB,GACjE,CACT,EAED,eAAK,SAAS,EAAC,kBAAkB,aAC/B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,YAC/H,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAC3B,EACT,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,YAChI,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAC5B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,EACtC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EACkE;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CACvC,qBAAqB,CAAC,mCAAmC,EACzD,yBAAyB,CAC1B,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useMemo, useRef, useState } from 'react';\nimport { Navigate, useSearchParams } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OAuthLogoutConfirmLabel } from '@wildo-ai/presets-components-models';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * OIDC RP-Initiated Logout §6 confirmation prompt — the body rendered by {@link AuthPage_OAuthLogoutConfirm}.\n *\n * FLOW: `GET /oauth/end-session` redirects the browser here (with a single-use `token` query param) for a\n * NON-trusted logout — everything EXCEPT a trusted RP presenting a valid `id_token_hint` AND an exact-match\n * registered `post_logout_redirect_uri`, which is logged out directly without a prompt (the Keycloak-style\n * posture). This page asks the End-User to confirm BEFORE the session is terminated, mitigating BROWSER-based\n * logout CSRF (RP-Initiated Logout 1.0 §6; a cross-origin page cannot read the token to complete the confirm —\n * see the backend `handleEndSessionConfirm` threat model). On CONFIRM it POSTs the token to `POST /oauth/end-session/confirm`,\n * which terminates the session and returns `{ redirect_to }` (the signed-out page `/oauth/logged-out`); on\n * CANCEL nothing is terminated and the user returns to the app.\n *\n * Token-driven, not session-driven: the End-User may be unauthenticated in this SPA (they arrived via an RP\n * redirect), so this page never gates on a Bearer — the opaque `token` is the whole credential.\n *\n * Copy is resolved through {@link OAuthLogoutConfirmLabel} (component `PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM`)\n * via {@link useI18n}; the label metadata lives in the companion-scanned `Auth_OAuthLogoutConfirm.labels.ts`.\n */\n\nexport interface PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps {\n  /** Reserved: the confirm screen is driven by the `token` query param and accepts no props. */\n  readonly _selfDriven?: never;\n}\n\n/**\n * The prompt's local interaction state. A named runtime source rather than a literal union so each\n * member can carry WHY it exists — `ERROR` in particular is reached only by a stale/expired token,\n * which is a normal outcome here (the token is single-use and short-TTL), not a fault.\n */\nenum ConfirmStatus {\n  /** Waiting for the End-User to decide. */\n  READY = 'ready',\n  /** The confirm POST is in flight; both buttons are disabled to keep the single-use token single-use. */\n  SUBMITTING = 'submitting',\n  /** The confirmation token was stale, expired or already used — the user may start the logout again. */\n  ERROR = 'error',\n}\n\nexport const PublicLayoutPreset_OAuthLogoutConfirm_Default = (\n  _props: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps,\n): React.JSX.Element => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM });\n  const [searchParams] = useSearchParams();\n  const [status, setStatus] = useState<ConfirmStatus>(ConfirmStatus.READY);\n  const t = (key: string): string => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, key);\n\n  const token = useMemo(() => searchParams.get('token') ?? '', [searchParams]);\n\n  // Stale-closure-proof single-flight latch for the confirm POST (mirrors the consent screen): a\n  // synchronous double-dispatch could fire two POSTs before React re-renders, and the token is single-use.\n  const submittingRef = useRef(false);\n\n  const confirm = useCallback(async () => {\n    if (!token || submittingRef.current) return;\n    submittingRef.current = true;\n    setStatus(ConfirmStatus.SUBMITTING);\n    try {\n      const { redirect_to } = await getManualCallsHttpClient().oauthEndSessionConfirm(token);\n      // Full navigation to the signed-out page (`window.location.assign`, mirroring the consent screen):\n      // the session is ending, so re-booting the SPA there is desirable — it drops any stale client state.\n      window.location.assign(redirect_to);\n    } catch {\n      // The token is single-use + short-TTL; a failure means it is stale/expired. Release the latch and\n      // surface a retry-able error rather than stranding the user.\n      submittingRef.current = false;\n      setStatus(ConfirmStatus.ERROR);\n    }\n  }, [token]);\n\n  const cancel = useCallback(() => {\n    // Cancel = do NOT sign out. Return to the app home (the user keeps their session). A full navigation\n    // avoids leaving the single-use `token` in the SPA's in-memory history entry.\n    window.location.assign(CommonRoutePaths.home);\n  }, []);\n\n  if (!isReady) {\n    return (\n      <div className=\"flex justify-center py-section\">\n        <LoadingSpinner />\n      </div>\n    );\n  }\n\n  // Reached without a token (bad link / direct hit) — there is nothing to confirm; send to the signed-out page.\n  if (!token) {\n    return <Navigate to={CommonRoutePaths.oauthLoggedOut} replace />;\n  }\n\n  return (\n    <div className=\"text-center space-y-group py-section\">\n      <div className=\"space-y-item-xs\">\n        <Heading>{t(OAuthLogoutConfirmLabel.TITLE)}</Heading>\n        <Text className=\"text-muted-foreground max-w-sm mx-auto\">{t(OAuthLogoutConfirmLabel.SUB_TITLE)}</Text>\n      </div>\n\n      {status === ConfirmStatus.ERROR && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{t(OAuthLogoutConfirmLabel.ERROR)}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"flex gap-element\">\n        <Button variant={ButtonVariants_Variant.OUTLINE} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={cancel}>\n          {t(OAuthLogoutConfirmLabel.CANCEL)}\n        </Button>\n        <Button variant={ButtonVariants_Variant.DEFAULT} className=\"flex-1\" disabled={status === ConfirmStatus.SUBMITTING} onClick={confirm}>\n          {t(OAuthLogoutConfirmLabel.CONFIRM)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_OAuthLogoutConfirm({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OAuthLogoutConfirm_DefaultProps>(\n    FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM,\n    'Auth_OAuthLogoutConfirm',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,qCAAqC,EAAE,mBAAmB,EA0BtE,CAAC"}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,qCAAqC,CAAC;AAO7C,eAAO,MAAM,qCAAqC,EAAE,mBAAmB,EA0BtE,CAAC"}

package/dist/esm/components/auth/Auth_OAuthLogoutConfirm.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,gGAAgG;AAChG,0EAA0E;AAC1E,gGAAgG;AAChG,yGAAyG;AAEzG,MAAM,CAAC,MAAM,qCAAqC,GAA0B;IAC1E;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,SAAS;QACtC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,uFAAuF;KACjG;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,OAAO;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,MAAM;QACnC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,4HAA4H;KACtI;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLogoutConfirmLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout §6 confirmation prompt: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLogoutConfirmLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLogoutConfirmLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading asking the user to confirm they want to sign out of the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that confirming will end their session on this application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CONFIRM,\n    kind: LabelKind.BUTTON,\n    purpose: 'Primary button that confirms the sign-out and ends the session',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CANCEL,\n    kind: LabelKind.BUTTON,\n    purpose: 'Secondary button that cancels the sign-out and returns the user to the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.ERROR,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Message shown when the confirmation link has expired or could not be processed, inviting the user to try signing out again',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, PublicLayoutsOAuthLogoutConfirmLabels);\n"]}
+{"version":3,"file":"Auth_OAuthLogoutConfirm.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OAuthLogoutConfirm.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,gGAAgG;AAChG,0EAA0E;AAC1E,gGAAgG;AAChG,yGAAyG;AAEzG,MAAM,CAAC,MAAM,qCAAqC,GAA0B;IAC1E;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,SAAS;QACtC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,uFAAuF;KACjG;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,OAAO;QACpC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,MAAM;QACnC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,GAAG,EAAE,uBAAuB,CAAC,KAAK;QAClC,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,4HAA4H;KACtI;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  OAuthLogoutConfirmLabel,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the OIDC RP-Initiated Logout §6 confirmation prompt: keys +\n// per-key purpose / kind. Statically scanned by the dev companion to plan\n// `components.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM.*` label generation; NOT imported at runtime,\n// so these description strings never ship in the browser bundle (see `labels-bundle-isolation.test.ts`).\n\nexport const PublicLayoutsOAuthLogoutConfirmLabels: LabellingUnitaryDef[] = [\n  {\n    ref: OAuthLogoutConfirmLabel.TITLE,\n    kind: LabelKind.HEADING,\n    purpose: 'Heading asking the user to confirm they want to sign out of the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.SUB_TITLE,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Supporting line explaining that confirming will end their session on this application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CONFIRM,\n    kind: LabelKind.BUTTON,\n    purpose: 'Primary button that confirms the sign-out and ends the session',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.CANCEL,\n    kind: LabelKind.BUTTON,\n    purpose: 'Secondary button that cancels the sign-out and returns the user to the application',\n  },\n  {\n    ref: OAuthLogoutConfirmLabel.ERROR,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Message shown when the confirmation link has expired or could not be processed, inviting the user to try signing out again',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_OAUTH_LOGOUT_CONFIRM, PublicLayoutsOAuthLogoutConfirmLabels);\n"]}

package/dist/esm/components/auth/Auth_OneOffSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAgBpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAQxH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC;AAEjF,MAAM,WAAW,6CAA6C;IAC5D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAmGD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wCAAwC,GAAI,qCAItD,6CAA6C,KAAG,KAAK,CAAC,GAAG,CAAC,OAiO5D,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,6CAA6C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG1K"}
+{"version":3,"file":"Auth_OneOffSession.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAgBpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAQxH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC;AAEjF,MAAM,WAAW,6CAA6C;IAC5D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAmGD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wCAAwC,GAAI,qCAItD,6CAA6C,KAAG,KAAK,CAAC,GAAG,CAAC,OAiO5D,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,6CAA6C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG1K"}

package/dist/esm/components/auth/Auth_OneOffSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAwDzF;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,YAAgD,EAChD,QAAkM;IAElM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,IAAI,aAA2D,CAAC;IAChE,IAAI,gBAAqE,CAAC;IAE1E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,SAAS,GAAI,EAAU,CAAC,mBAAmB,CAAC;YAClD,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAChG,aAAa,GAAG,EAAE,CAAC;gBACnB,gBAAgB,GAAG,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAE1D,0EAA0E;IAC1E,gFAAgF;IAChF,gCAAgC;IAChC,MAAM,2BAA2B,GAA2B,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAC/C,aAAa,EACb,gBAAgB,EAChB,2BAA2B,EAC3B,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IAEF,OAAO,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACvC,sFAAsF;IACtF,mFAAmF;IACnF,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,EACvD,KAAK,EACL,IAAI,GAAG,iBAAiB,EACxB,iBAAiB,GAC6B,EAAqB,EAAE;IACrE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,CAAC;IACrI,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAC7G,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAChE,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACxD,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAEpD,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC;YACjE,MAAM,SAAS,GAAG,WAAW,IAAI,iBAAiB,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,qEAAqE;QACrE,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,EAC5B,IAAI,CAAC,aAAa,CAAC,kBAAkB,EACrC,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAC3C,CAAC,EAAE;QACD,IAAI;QACJ,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,2BAA2B;QAChC,iBAAiB;QACjB,QAAQ;KACT,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,oBAAoB,CAAC,OAAO;YAAE,OAAO;QAEzC,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,YAAY,4BAA4B,CAAC,EAAE,CAAC;YAC1F,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;YAChD,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,sDAAsD;QACtD,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,6BAA6B;QAC7B,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACnD,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,KAAK,wBAAwB;YAChD,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAErC,QAAQ;aACL,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACpB,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAExJ,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,iEAAiE;IACjE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,qCAAqC;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACtC,gCAAgC,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAE7C,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,8FAA8F,YAC3G,cAAK,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YAC7G,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sBAAsB,GAAG,GAC1E,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAW,IAClD,EACN,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,EACR,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAqB,GACtF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,EAAC,SAAS,EAAC,6BAA6B,aAC3E,cAAK,SAAS,EAAC,0FAA0F,iBAAa,MAAM,YAC1H,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,GAAG,GACjD,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAQ,IACvE,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAwE;IACrJ,MAAM,SAAS,GAAG,uBAAuB,CAAgD,qBAAqB,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate } from 'react-router-dom';\nimport type { AnyFrontendResourceConfiguration, FrontendResourceConfiguration_Operation } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { isOperationAddressable } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { EphemeralSessionTokenStorage } from '~wildo-frontend-lib/core/security/session-token-storage.frontend.service';\nimport { NavigationUtils } from '~wildo-frontend-lib/core/navigation/navigation.utils';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { AuthSecondaryLink } from '~wildo-frontend-lib/components/auth/utils/AuthSecondaryLink';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\n\n// --- Contract ---\n\n/**\n * Receiver mode for `Auth_OneOffSession` (cross-app-jwt-propagation.md Step 5).\n *\n * Two distinct issuance flows land on this same UI shell; the mode prop\n * dispatches to the right exchange handler and the right post-exchange\n * URL-resolution strategy:\n *\n * - `'one-off-session'` — W7.3b ephemeral one-off session. The token is\n *   consumed via `handleOneOffTokenExchange` (`POST /auth/one-off-session/exchange`),\n *   which returns a context populated with `tokenType`, `scopedInitiatorIds`,\n *   and `applicationId`. Post-exchange URL resolves via the resource\n *   registry (matches an operation whose `tokenAuthentication.types` accepts\n *   the consumed `tokenType`). Enforces `EphemeralSessionTokenStorage` to\n *   prevent stomping a parent tab's authenticated session.\n *\n * - `'cross-frontend-handoff'` — Cross-app JWT propagation handoff. The\n *   token is an AUTH_CODE_EXCHANGE consumable issued by\n *   `POST /auth/cross-frontend-handoff` and consumed via\n *   `handleAuthCodeExchange` (`POST /auth/token/exchange`, the same exchange\n *   endpoint OAuth2 callback uses — see Step 4 integration test). The\n *   exchange response surfaces `returnPath` into\n *   `auth.crossFrontendHandoffContext`; we navigate there post-exchange\n *   (with URL-query fallback as defense-in-depth). The ephemeral-storage\n *   guard is intentionally skipped — per K-7, the receiver's storage\n *   adapter (NOT the protocol) determines lifetime, and the SaaS app's\n *   regular persistent storage is the correct landing for a session\n *   transfer.\n */\nexport type AuthOneOffSessionMode = 'one-off-session' | 'cross-frontend-handoff';\n\nexport interface PublicLayoutPreset_OneOffSession_DefaultProps {\n  /**\n   * The one-time consumable token to exchange. For `mode='one-off-session'`\n   * it comes from the `:token` URL path param; for `mode='cross-frontend-handoff'`\n   * it comes from the `?code=` query param (extracted by `AuthPage_AuthExchange`).\n   */\n  token?: string;\n  /**\n   * Defaults to `'one-off-session'` to preserve backward compatibility with\n   * the W7.3b page wrapper that does not pass this prop.\n   */\n  mode?: AuthOneOffSessionMode;\n  /**\n   * Cross-frontend-handoff receiver: the `?return=` URL query param value,\n   * extracted by `AuthPage_AuthExchange`. Defense-in-depth fallback used\n   * ONLY when `auth.crossFrontendHandoffContext.returnPath` is missing\n   * (e.g. backend metadata round-trip failed for some reason). Sanitized\n   * before use.\n   */\n  returnPathFromUrl?: string;\n}\n\n/**\n * Resolves the target frontend URL for a W7.3b one-off-session exchange.\n *\n * Searches the resource registry for an operation whose `tokenAuthentication.types`\n * includes the consumed `tokenType`, then builds a concrete URL using the\n * targeting `initiatorIds` as path parameters.\n *\n * Returns undefined if no matching operation is found or URL cannot be resolved\n * (caller falls back to home).\n *\n * NOT used for cross-frontend-handoff mode — that flow drives navigation off\n * `auth.crossFrontendHandoffContext.returnPath`, see\n * `resolveCrossFrontendHandoffUrl()` below.\n */\nfunction resolveTargetUrl(\n  tokenType: string,\n  initiatorIds: Record<string, string> | undefined,\n  registry: { resourceConfigurations: Record<string, AnyFrontendResourceConfiguration>; allResourceFieldIdentifiers: Record<string, string>; fieldIdentifierToResourceType: Record<string, string> },\n): string | undefined {\n  if (!initiatorIds || Object.keys(initiatorIds).length === 0) return undefined;\n\n  let matchedConfig: AnyFrontendResourceConfiguration | undefined;\n  let matchedOperation: FrontendResourceConfiguration_Operation | undefined;\n\n  for (const rc of Object.values(registry.resourceConfigurations)) {\n    const ops = Array.isArray(rc.operations) ? rc.operations : [];\n    for (const op of ops) {\n      const tokenAuth = (op as any).tokenAuthentication;\n      if (tokenAuth?.types?.includes(tokenType) && isOperationAddressable(op.operationFrontendConfig)) {\n        matchedConfig = rc;\n        matchedOperation = op;\n        break;\n      }\n    }\n    if (matchedOperation) break;\n  }\n\n  if (!matchedConfig || !matchedOperation) return undefined;\n\n  // initiatorIds uses fieldIdentifier keys (e.g., organizationId, tasksId).\n  // resolveResourceUrl expects candidateContextIdentifiers with resourceType keys\n  // (e.g., ORGANIZATIONS, TASKS).\n  const candidateContextIdentifiers: Record<string, string> = {};\n  for (const [fieldId, id] of Object.entries(initiatorIds)) {\n    const resourceType = registry.fieldIdentifierToResourceType[fieldId];\n    if (resourceType) {\n      candidateContextIdentifiers[resourceType] = id;\n    }\n  }\n\n  const result = NavigationUtils.resolveResourceUrl(\n    matchedConfig,\n    matchedOperation,\n    candidateContextIdentifiers,\n    registry.allResourceFieldIdentifiers,\n  );\n\n  return result?.resolvedUrl ?? undefined;\n}\n\n/**\n * Defense-in-depth sanitizer for `returnPath` values arriving at the receiver.\n *\n * The cross-frontend-handoff issuer schema (`CrossFrontendHandoff_ReturnPathSchema`\n * in `cross-frontend-handoff.shared.dto.schemas.ts`) already validates the\n * value at issuance time, AND the value flows through the consumable-token\n * metadata round-trip — but a malicious caller could hand-craft an exchange\n * URL bypassing the issuer entirely (`/auth/exchange?code=…&return=https://evil.com`).\n * Without this guard the eventual `<Navigate to={…}>` would happily honour\n * the open-redirect / XSS / path-traversal payload.\n *\n * The ORIGIN half of the question is answered by the shared\n * {@link isSameOriginRedirectPath} predicate rather than by the character\n * rules below, and that split is the fix for a real defect: this function,\n * the docs-site `AuthExchangePage.sanitizeReturnPath()` and the issuer\n * schema were three hand-written deny-lists that \"mirrored\" each other —\n * and all three admitted `/<TAB>/evil.com`, because the URL parser strips\n * ASCII tab / LF / CR before parsing, turning it into `//evil.com`. Every\n * copy banned `\\` and none banned the whitespace that becomes a `/`.\n *\n * The character rules are KEPT, as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n */\nfunction sanitizeReturnPath(raw: string | undefined): string {\n  if (!raw) return CommonRoutePaths.home;\n  // Authoritative: does this actually resolve onto our own origin? Covers `//evil.com`,\n  // `/\\evil.com` and the stripped-control-character family in one parse-based check.\n  if (!isSameOriginRedirectPath(raw)) return CommonRoutePaths.home;\n  if (raw.includes('..')) return CommonRoutePaths.home;\n  if (raw.includes('\\\\')) return CommonRoutePaths.home;\n  if (raw.includes('://')) return CommonRoutePaths.home;\n  if (/[<>\"]/.test(raw)) return CommonRoutePaths.home;\n  if (raw.length > 256) return CommonRoutePaths.home;\n  return raw;\n}\n\n/**\n * cross-app-jwt-propagation.md Step 5 dual-mode receiver.\n *\n * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it\n * via `handleOneOffTokenExchange`, and redirects to the target page resolved\n * from `tokenType` + targeting via the resource registry, falling back to\n * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).\n *\n * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,\n * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,\n * the same endpoint OAuth2 callback uses), and navigates to\n * `auth.crossFrontendHandoffContext.returnPath` (preferred) or\n * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage\n * guard — the SaaS app's persistent storage is the correct landing per K-7.\n *\n * All user-facing strings are i18n-driven via `OneOffSessionLabel`.\n */\nexport const PublicLayoutPreset_OneOffSession_Default = ({\n  token,\n  mode = 'one-off-session',\n  returnPathFromUrl,\n}: PublicLayoutPreset_OneOffSession_DefaultProps): React.JSX.Element => {\n  const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();\n  const { registry } = useResourceRegistry();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);\n  const loginPath = CommonRoutePaths.login;\n\n  /**\n   * Receiver-LOCAL error state for THIS exchange attempt.\n   *\n   * L-9 (third deep-review pass): this field deliberately duplicates\n   * `auth.error` (set by `AuthSessionContext.handleAuthCodeExchange`'s catch\n   * block) rather than reading the shared field directly. Reasoning:\n   *\n   * - `auth.error` is process-wide across all auth surfaces (logout,\n   *   refresh-token rotation, magic-link verify, MFA verify, passkey\n   *   auth, etc. all write to it). If a parallel\n   *   call sets `auth.error` while THIS receiver's exchange is succeeding,\n   *   reading `auth.error` from the H-4 navigation gate would falsely\n   *   block the receiver from rendering `<Navigate>` — even though the\n   *   receiver's own exchange completed cleanly.\n   *\n   * - Local `error` is scoped to THIS receiver's exchange attempt\n   *   (set ONLY by the `.catch()` on the in-mount exchange Promise).\n   *   The H-4 gate checks `!error` (local) so navigation is blocked iff\n   *   THIS receiver's exchange failed, regardless of what other auth\n   *   surfaces are doing concurrently.\n   *\n   * If the AuthSessionContext error surface is ever refactored into per-\n   * call scoped errors, this duplication can collapse — but until then\n   * the duplication is load-bearing.\n   */\n  const [error, setError] = useState<string | null>(null);\n  const exchangeAttemptedRef = useRef(false);\n  /**\n   * Gate `<Navigate>` until the exchange phase has resolved (success, failure,\n   * or intentionally skipped). Without this gate, a cross-frontend-handoff\n   * receiver mounted with a pre-existing `auth.accessToken` (cold-load from\n   * persistent storage) would render `<Navigate>` on the FIRST render —\n   * which commits and unmounts the component BEFORE this component's\n   * `useEffect` ever runs the AUTH_CODE_EXCHANGE consume call. The user\n   * would then land on the URL `?return=` value with their pre-existing\n   * session AND the consumable token would dangle in the store for 60s\n   * (auto-expiring without ever being consumed). See M-2 in the Step 5\n   * deep-review log on `cross-app-jwt-propagation.md`.\n   *\n   * Initial value is mode-dependent:\n   * - `one-off-session`: `true` IF accessToken is already set (preserve\n   *   the existing W7.3b \"render Navigate immediately\" semantics — the\n   *   ephemeral-storage guard fires for the in-tab case anyway).\n   * - `cross-frontend-handoff`: `false` always — we ALWAYS want the\n   *   exchange to run before navigating, even when `auth.accessToken` is\n   *   set, so the new tokens replace the existing session and the\n   *   `crossFrontendHandoffContext.returnPath` populates from the\n   *   exchange response (defense against silent auth-confusion when the\n   *   pre-existing session belongs to a different user than the handoff\n   *   was minted for).\n   */\n  const [exchangePhaseResolved, setExchangePhaseResolved] = useState<boolean>(\n    mode === 'one-off-session' && Boolean(auth.accessToken),\n  );\n\n  const targetUrl = useMemo(() => {\n    if (!auth.accessToken) return CommonRoutePaths.home;\n\n    // Cross-frontend-handoff: navigate to `returnPath` from the exchange\n    // response (which round-tripped via the consumable-token metadata),\n    // falling back to the URL-query value as defense-in-depth. Both inputs\n    // pass through `sanitizeReturnPath` to defeat any open-redirect /\n    // path-traversal / XSS payload that may have bypassed the issuer schema.\n    if (mode === 'cross-frontend-handoff') {\n      const fromContext = auth.crossFrontendHandoffContext?.returnPath;\n      const candidate = fromContext ?? returnPathFromUrl;\n      return sanitizeReturnPath(candidate);\n    }\n\n    // W7.3b one-off session: walk the resource registry for an operation\n    // matching the consumed tokenType.\n    if (!auth.oneOffContext) return CommonRoutePaths.home;\n    const resolved = resolveTargetUrl(\n      auth.oneOffContext.tokenType,\n      auth.oneOffContext.scopedInitiatorIds,\n      registry,\n    );\n    return resolved ?? CommonRoutePaths.home;\n  }, [\n    mode,\n    auth.oneOffContext,\n    auth.accessToken,\n    auth.crossFrontendHandoffContext,\n    returnPathFromUrl,\n    registry,\n  ]);\n\n  useEffect(() => {\n    if (exchangeAttemptedRef.current) return;\n\n    // Storage guard applies ONLY to W7.3b (one-off-session) mode. Cross-\n    // frontend-handoff intentionally lands in the receiver's regular tab\n    // with its regular (persistent or ephemeral, per receiver's adapter\n    // choice) storage — this is the protocol's whole point per K-7.\n    if (mode === 'one-off-session' && !(tokenStorage instanceof EphemeralSessionTokenStorage)) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_WRONG_TAB));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    if (!token) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_NO_TOKEN));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    // Already-authenticated short-circuit applies ONLY to W7.3b\n    // (one-off-session) mode — there an existing parent session in the\n    // tab is the trigger for the ERROR_WRONG_TAB guard above (the\n    // ephemeral-storage check should have already fired), and burning\n    // a one-off code on an authenticated tab is wasteful.\n    //\n    // Cross-frontend-handoff mode must NOT short-circuit: the user\n    // explicitly initiated a session transfer on the source frontend\n    // (clicked \"Open in docs\" / similar). Skipping the exchange would:\n    //   (a) leave a 60-second dangling AUTH_CODE_EXCHANGE token in the\n    //       store (auto-expires, but uses the consumable-token budget and\n    //       muddies audit logs);\n    //   (b) navigate the user using the URL `?return=` value but with\n    //       their PRE-EXISTING session — which may be a different user\n    //       than the handoff was minted for, leading to the user landing\n    //       on `/api/organization/foo` as the wrong identity (silent\n    //       auth-confusion). Always consume the code so the new tokens\n    //       replace the existing ones.\n    if (auth.accessToken && mode === 'one-off-session') {\n      exchangeAttemptedRef.current = true;\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    exchangeAttemptedRef.current = true;\n\n    const exchange = mode === 'cross-frontend-handoff'\n      ? handleAuthCodeExchange(token)\n      : handleOneOffTokenExchange(token);\n\n    exchange\n      .catch((e: unknown) => {\n        setError(toUserFacingErrorMessage(e, t(OneOffSessionLabel.ERROR_GENERIC)));\n      })\n      .finally(() => {\n        setExchangePhaseResolved(true);\n      });\n  }, [token, mode, auth.accessToken, handleOneOffTokenExchange, handleAuthCodeExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  // Single-use cleanup of `auth.crossFrontendHandoffContext`. Runs on\n  // unmount, which happens AFTER `<Navigate to={targetUrl}>` resolves and\n  // React tears down the receiver. Earlier cleanup would race the\n  // `targetUrl` `useMemo` recomputation and could navigate to home instead\n  // of the intended `returnPath`. No-op for `one-off-session` mode (which\n  // never sets the field in the first place — `oneOffContext` is its\n  // sibling state and is preserved as part of the active session).\n  //\n  // Dependency note (L-6): `mode` is captured by closure, so listing it as\n  // a dep technically just re-creates the effect when `mode` changes mid-\n  // mount — which never happens in practice (the prop is fixed by the\n  // receiver page). It IS listed deliberately so React's exhaustive-deps\n  // lint stays clean AND so a future caller that toggles `mode` mid-mount\n  // gets the cleanup re-bound rather than the stale closure. Removing it\n  // would shift this from \"harmless dep\" to \"subtle stale-closure bug\n  // waiting for a future mode toggle\".\n  useEffect(() => {\n    return () => {\n      if (mode === 'cross-frontend-handoff') {\n        clearCrossFrontendHandoffContext();\n      }\n    };\n  }, [mode, clearCrossFrontendHandoffContext]);\n\n  // Navigation guard: render `<Navigate>` ONLY when the exchange phase\n  // resolved cleanly. Critical: `!error` is load-bearing here. Without it,\n  // a cross-frontend-handoff receiver mounted with a pre-existing\n  // `auth.accessToken` (cold-load from persistent storage) whose AUTH_CODE_\n  // EXCHANGE call fails would silently navigate the user to the URL\n  // `?return=` value WITH THE OLD SESSION — a session-confusion regression\n  // (the user lands on the deep link as the wrong identity, with no error\n  // surfaced). The error branch below shows a localized failure message\n  // and a login link instead. See H-4 in the Step 5 second deep-review log\n  // on `cross-app-jwt-propagation.md`.\n  if (auth.accessToken && !auth.isLoading && exchangePhaseResolved && !error) {\n    return <Navigate to={targetUrl} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (error) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element\">\n            <svg className=\"h-6 w-6 text-destructive\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\" />\n            </svg>\n          </div>\n          <Heading>{t(OneOffSessionLabel.ERROR_TITLE)}</Heading>\n        </div>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n        <div className=\"text-center mt-group\">\n          <AuthSecondaryLink href={loginPath}>{t(OneOffSessionLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  return (\n    <div role=\"status\" aria-live=\"polite\" className=\"text-center space-y-item-xs\">\n      <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\" aria-hidden=\"true\">\n        <LoadingSpinner size={24} className=\"text-primary\" />\n      </div>\n      <Text className=\"max-w-sm mx-auto\">{t(OneOffSessionLabel.VERIFYING)}</Text>\n    </div>\n  );\n};\n\nexport function Auth_OneOffSession({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OneOffSession_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OneOffSession_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, 'Auth_OneOffSession')(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OneOffSession.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAwDzF;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,YAAgD,EAChD,QAAkM;IAElM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,IAAI,aAA2D,CAAC;IAChE,IAAI,gBAAqE,CAAC;IAE1E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,SAAS,GAAI,EAAU,CAAC,mBAAmB,CAAC;YAClD,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAChG,aAAa,GAAG,EAAE,CAAC;gBACnB,gBAAgB,GAAG,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAE1D,0EAA0E;IAC1E,gFAAgF;IAChF,gCAAgC;IAChC,MAAM,2BAA2B,GAA2B,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAC/C,aAAa,EACb,gBAAgB,EAChB,2BAA2B,EAC3B,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IAEF,OAAO,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACvC,sFAAsF;IACtF,mFAAmF;IACnF,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,EACvD,KAAK,EACL,IAAI,GAAG,iBAAiB,EACxB,iBAAiB,GAC6B,EAAqB,EAAE;IACrE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,CAAC;IACrI,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAC7G,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAChE,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACxD,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAEpD,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC;YACjE,MAAM,SAAS,GAAG,WAAW,IAAI,iBAAiB,CAAC;YACnD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,qEAAqE;QACrE,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,EAC5B,IAAI,CAAC,aAAa,CAAC,kBAAkB,EACrC,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAC3C,CAAC,EAAE;QACD,IAAI;QACJ,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,2BAA2B;QAChC,iBAAiB;QACjB,QAAQ;KACT,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,oBAAoB,CAAC,OAAO;YAAE,OAAO;QAEzC,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,YAAY,4BAA4B,CAAC,EAAE,CAAC;YAC1F,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;YAChD,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,sDAAsD;QACtD,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,6BAA6B;QAC7B,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACnD,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACpC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,KAAK,wBAAwB;YAChD,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAErC,QAAQ;aACL,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACpB,QAAQ,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAExJ,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,iEAAiE;IACjE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,qCAAqC;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACtC,gCAAgC,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAE7C,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAG,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,cAAK,SAAS,EAAC,8FAA8F,YAC3G,cAAK,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,YAC7G,eAAM,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,CAAC,EAAC,sBAAsB,GAAG,GAC1E,GACF,EACN,KAAC,OAAO,cAAE,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAW,IAClD,EACN,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,EACR,cAAK,SAAS,EAAC,sBAAsB,YACnC,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAqB,GACtF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,EAAC,SAAS,EAAC,6BAA6B,aAC3E,cAAK,SAAS,EAAC,0FAA0F,iBAAa,MAAM,YAC1H,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,GAAG,GACjD,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAQ,IACvE,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAwE;IACrJ,MAAM,SAAS,GAAG,uBAAuB,CAAgD,qBAAqB,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate } from 'react-router-dom';\nimport type { AnyFrontendResourceConfiguration, FrontendResourceConfiguration_Operation } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { isOperationAddressable } from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { EphemeralSessionTokenStorage } from '~wildo-frontend-lib/core/security/session-token-storage.frontend.service';\nimport { NavigationUtils } from '~wildo-frontend-lib/core/navigation/navigation.utils';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { AuthSecondaryLink } from '~wildo-frontend-lib/components/auth/utils/AuthSecondaryLink';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { CorePresetNames, FrontendComponentType, OneOffSessionLabel } from '@wildo-ai/presets-components-models';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\n\n// --- Contract ---\n\n/**\n * Receiver mode for `Auth_OneOffSession` (cross-app-jwt-propagation.md Step 5).\n *\n * Two distinct issuance flows land on this same UI shell; the mode prop\n * dispatches to the right exchange handler and the right post-exchange\n * URL-resolution strategy:\n *\n * - `'one-off-session'` — W7.3b ephemeral one-off session. The token is\n *   consumed via `handleOneOffTokenExchange` (`POST /auth/one-off-session/exchange`),\n *   which returns a context populated with `tokenType`, `scopedInitiatorIds`,\n *   and `applicationId`. Post-exchange URL resolves via the resource\n *   registry (matches an operation whose `tokenAuthentication.types` accepts\n *   the consumed `tokenType`). Enforces `EphemeralSessionTokenStorage` to\n *   prevent stomping a parent tab's authenticated session.\n *\n * - `'cross-frontend-handoff'` — Cross-app JWT propagation handoff. The\n *   token is an AUTH_CODE_EXCHANGE consumable issued by\n *   `POST /auth/cross-frontend-handoff` and consumed via\n *   `handleAuthCodeExchange` (`POST /auth/token/exchange`, the same exchange\n *   endpoint OAuth2 callback uses — see Step 4 integration test). The\n *   exchange response surfaces `returnPath` into\n *   `auth.crossFrontendHandoffContext`; we navigate there post-exchange\n *   (with URL-query fallback as defense-in-depth). The ephemeral-storage\n *   guard is intentionally skipped — per K-7, the receiver's storage\n *   adapter (NOT the protocol) determines lifetime, and the SaaS app's\n *   regular persistent storage is the correct landing for a session\n *   transfer.\n */\nexport type AuthOneOffSessionMode = 'one-off-session' | 'cross-frontend-handoff';\n\nexport interface PublicLayoutPreset_OneOffSession_DefaultProps {\n  /**\n   * The one-time consumable token to exchange. For `mode='one-off-session'`\n   * it comes from the `:token` URL path param; for `mode='cross-frontend-handoff'`\n   * it comes from the `?code=` query param (extracted by `AuthPage_AuthExchange`).\n   */\n  token?: string;\n  /**\n   * Defaults to `'one-off-session'` to preserve backward compatibility with\n   * the W7.3b page wrapper that does not pass this prop.\n   */\n  mode?: AuthOneOffSessionMode;\n  /**\n   * Cross-frontend-handoff receiver: the `?return=` URL query param value,\n   * extracted by `AuthPage_AuthExchange`. Defense-in-depth fallback used\n   * ONLY when `auth.crossFrontendHandoffContext.returnPath` is missing\n   * (e.g. backend metadata round-trip failed for some reason). Sanitized\n   * before use.\n   */\n  returnPathFromUrl?: string;\n}\n\n/**\n * Resolves the target frontend URL for a W7.3b one-off-session exchange.\n *\n * Searches the resource registry for an operation whose `tokenAuthentication.types`\n * includes the consumed `tokenType`, then builds a concrete URL using the\n * targeting `initiatorIds` as path parameters.\n *\n * Returns undefined if no matching operation is found or URL cannot be resolved\n * (caller falls back to home).\n *\n * NOT used for cross-frontend-handoff mode — that flow drives navigation off\n * `auth.crossFrontendHandoffContext.returnPath`, see\n * `resolveCrossFrontendHandoffUrl()` below.\n */\nfunction resolveTargetUrl(\n  tokenType: string,\n  initiatorIds: Record<string, string> | undefined,\n  registry: { resourceConfigurations: Record<string, AnyFrontendResourceConfiguration>; allResourceFieldIdentifiers: Record<string, string>; fieldIdentifierToResourceType: Record<string, string> },\n): string | undefined {\n  if (!initiatorIds || Object.keys(initiatorIds).length === 0) return undefined;\n\n  let matchedConfig: AnyFrontendResourceConfiguration | undefined;\n  let matchedOperation: FrontendResourceConfiguration_Operation | undefined;\n\n  for (const rc of Object.values(registry.resourceConfigurations)) {\n    const ops = Array.isArray(rc.operations) ? rc.operations : [];\n    for (const op of ops) {\n      const tokenAuth = (op as any).tokenAuthentication;\n      if (tokenAuth?.types?.includes(tokenType) && isOperationAddressable(op.operationFrontendConfig)) {\n        matchedConfig = rc;\n        matchedOperation = op;\n        break;\n      }\n    }\n    if (matchedOperation) break;\n  }\n\n  if (!matchedConfig || !matchedOperation) return undefined;\n\n  // initiatorIds uses fieldIdentifier keys (e.g., organizationId, tasksId).\n  // resolveResourceUrl expects candidateContextIdentifiers with resourceType keys\n  // (e.g., ORGANIZATIONS, TASKS).\n  const candidateContextIdentifiers: Record<string, string> = {};\n  for (const [fieldId, id] of Object.entries(initiatorIds)) {\n    const resourceType = registry.fieldIdentifierToResourceType[fieldId];\n    if (resourceType) {\n      candidateContextIdentifiers[resourceType] = id;\n    }\n  }\n\n  const result = NavigationUtils.resolveResourceUrl(\n    matchedConfig,\n    matchedOperation,\n    candidateContextIdentifiers,\n    registry.allResourceFieldIdentifiers,\n  );\n\n  return result?.resolvedUrl ?? undefined;\n}\n\n/**\n * Defense-in-depth sanitizer for `returnPath` values arriving at the receiver.\n *\n * The cross-frontend-handoff issuer schema (`CrossFrontendHandoff_ReturnPathSchema`\n * in `cross-frontend-handoff.shared.dto.schemas.ts`) already validates the\n * value at issuance time, AND the value flows through the consumable-token\n * metadata round-trip — but a malicious caller could hand-craft an exchange\n * URL bypassing the issuer entirely (`/auth/exchange?code=…&return=https://evil.com`).\n * Without this guard the eventual `<Navigate to={…}>` would happily honour\n * the open-redirect / XSS / path-traversal payload.\n *\n * The ORIGIN half of the question is answered by the shared\n * {@link isSameOriginRedirectPath} predicate rather than by the character\n * rules below, and that split is the fix for a real defect: this function,\n * the docs-site `AuthExchangePage.sanitizeReturnPath()` and the issuer\n * schema were three hand-written deny-lists that \"mirrored\" each other —\n * and all three admitted `/<TAB>/evil.com`, because the URL parser strips\n * ASCII tab / LF / CR before parsing, turning it into `//evil.com`. Every\n * copy banned `\\` and none banned the whitespace that becomes a `/`.\n *\n * The character rules are KEPT, as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n */\nfunction sanitizeReturnPath(raw: string | undefined): string {\n  if (!raw) return CommonRoutePaths.home;\n  // Authoritative: does this actually resolve onto our own origin? Covers `//evil.com`,\n  // `/\\evil.com` and the stripped-control-character family in one parse-based check.\n  if (!isSameOriginRedirectPath(raw)) return CommonRoutePaths.home;\n  if (raw.includes('..')) return CommonRoutePaths.home;\n  if (raw.includes('\\\\')) return CommonRoutePaths.home;\n  if (raw.includes('://')) return CommonRoutePaths.home;\n  if (/[<>\"]/.test(raw)) return CommonRoutePaths.home;\n  if (raw.length > 256) return CommonRoutePaths.home;\n  return raw;\n}\n\n/**\n * cross-app-jwt-propagation.md Step 5 dual-mode receiver.\n *\n * W7.3b mode (`one-off-session`): extracts the consumable token, exchanges it\n * via `handleOneOffTokenExchange`, and redirects to the target page resolved\n * from `tokenType` + targeting via the resource registry, falling back to\n * home. Guards against same-tab SPA navigation (storage MUST be ephemeral).\n *\n * Cross-frontend-handoff mode: extracts the AUTH_CODE_EXCHANGE token,\n * exchanges it via `handleAuthCodeExchange` (which hits `/auth/token/exchange`,\n * the same endpoint OAuth2 callback uses), and navigates to\n * `auth.crossFrontendHandoffContext.returnPath` (preferred) or\n * `returnPathFromUrl` (defense-in-depth fallback). Skips the ephemeral-storage\n * guard — the SaaS app's persistent storage is the correct landing per K-7.\n *\n * All user-facing strings are i18n-driven via `OneOffSessionLabel`.\n */\nexport const PublicLayoutPreset_OneOffSession_Default = ({\n  token,\n  mode = 'one-off-session',\n  returnPathFromUrl,\n}: PublicLayoutPreset_OneOffSession_DefaultProps): React.JSX.Element => {\n  const { handleOneOffTokenExchange, handleAuthCodeExchange, clearCrossFrontendHandoffContext, auth, tokenStorage } = useAuthSession();\n  const { registry } = useResourceRegistry();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION });\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, key);\n  const loginPath = CommonRoutePaths.login;\n\n  /**\n   * Receiver-LOCAL error state for THIS exchange attempt.\n   *\n   * L-9 (third deep-review pass): this field deliberately duplicates\n   * `auth.error` (set by `AuthSessionContext.handleAuthCodeExchange`'s catch\n   * block) rather than reading the shared field directly. Reasoning:\n   *\n   * - `auth.error` is process-wide across all auth surfaces (logout,\n   *   refresh-token rotation, magic-link verify, MFA verify, passkey\n   *   auth, etc. all write to it). If a parallel\n   *   call sets `auth.error` while THIS receiver's exchange is succeeding,\n   *   reading `auth.error` from the H-4 navigation gate would falsely\n   *   block the receiver from rendering `<Navigate>` — even though the\n   *   receiver's own exchange completed cleanly.\n   *\n   * - Local `error` is scoped to THIS receiver's exchange attempt\n   *   (set ONLY by the `.catch()` on the in-mount exchange Promise).\n   *   The H-4 gate checks `!error` (local) so navigation is blocked iff\n   *   THIS receiver's exchange failed, regardless of what other auth\n   *   surfaces are doing concurrently.\n   *\n   * If the AuthSessionContext error surface is ever refactored into per-\n   * call scoped errors, this duplication can collapse — but until then\n   * the duplication is load-bearing.\n   */\n  const [error, setError] = useState<string | null>(null);\n  const exchangeAttemptedRef = useRef(false);\n  /**\n   * Gate `<Navigate>` until the exchange phase has resolved (success, failure,\n   * or intentionally skipped). Without this gate, a cross-frontend-handoff\n   * receiver mounted with a pre-existing `auth.accessToken` (cold-load from\n   * persistent storage) would render `<Navigate>` on the FIRST render —\n   * which commits and unmounts the component BEFORE this component's\n   * `useEffect` ever runs the AUTH_CODE_EXCHANGE consume call. The user\n   * would then land on the URL `?return=` value with their pre-existing\n   * session AND the consumable token would dangle in the store for 60s\n   * (auto-expiring without ever being consumed). See M-2 in the Step 5\n   * deep-review log on `cross-app-jwt-propagation.md`.\n   *\n   * Initial value is mode-dependent:\n   * - `one-off-session`: `true` IF accessToken is already set (preserve\n   *   the existing W7.3b \"render Navigate immediately\" semantics — the\n   *   ephemeral-storage guard fires for the in-tab case anyway).\n   * - `cross-frontend-handoff`: `false` always — we ALWAYS want the\n   *   exchange to run before navigating, even when `auth.accessToken` is\n   *   set, so the new tokens replace the existing session and the\n   *   `crossFrontendHandoffContext.returnPath` populates from the\n   *   exchange response (defense against silent auth-confusion when the\n   *   pre-existing session belongs to a different user than the handoff\n   *   was minted for).\n   */\n  const [exchangePhaseResolved, setExchangePhaseResolved] = useState<boolean>(\n    mode === 'one-off-session' && Boolean(auth.accessToken),\n  );\n\n  const targetUrl = useMemo(() => {\n    if (!auth.accessToken) return CommonRoutePaths.home;\n\n    // Cross-frontend-handoff: navigate to `returnPath` from the exchange\n    // response (which round-tripped via the consumable-token metadata),\n    // falling back to the URL-query value as defense-in-depth. Both inputs\n    // pass through `sanitizeReturnPath` to defeat any open-redirect /\n    // path-traversal / XSS payload that may have bypassed the issuer schema.\n    if (mode === 'cross-frontend-handoff') {\n      const fromContext = auth.crossFrontendHandoffContext?.returnPath;\n      const candidate = fromContext ?? returnPathFromUrl;\n      return sanitizeReturnPath(candidate);\n    }\n\n    // W7.3b one-off session: walk the resource registry for an operation\n    // matching the consumed tokenType.\n    if (!auth.oneOffContext) return CommonRoutePaths.home;\n    const resolved = resolveTargetUrl(\n      auth.oneOffContext.tokenType,\n      auth.oneOffContext.scopedInitiatorIds,\n      registry,\n    );\n    return resolved ?? CommonRoutePaths.home;\n  }, [\n    mode,\n    auth.oneOffContext,\n    auth.accessToken,\n    auth.crossFrontendHandoffContext,\n    returnPathFromUrl,\n    registry,\n  ]);\n\n  useEffect(() => {\n    if (exchangeAttemptedRef.current) return;\n\n    // Storage guard applies ONLY to W7.3b (one-off-session) mode. Cross-\n    // frontend-handoff intentionally lands in the receiver's regular tab\n    // with its regular (persistent or ephemeral, per receiver's adapter\n    // choice) storage — this is the protocol's whole point per K-7.\n    if (mode === 'one-off-session' && !(tokenStorage instanceof EphemeralSessionTokenStorage)) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_WRONG_TAB));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    if (!token) {\n      exchangeAttemptedRef.current = true;\n      setError(t(OneOffSessionLabel.ERROR_NO_TOKEN));\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    // Already-authenticated short-circuit applies ONLY to W7.3b\n    // (one-off-session) mode — there an existing parent session in the\n    // tab is the trigger for the ERROR_WRONG_TAB guard above (the\n    // ephemeral-storage check should have already fired), and burning\n    // a one-off code on an authenticated tab is wasteful.\n    //\n    // Cross-frontend-handoff mode must NOT short-circuit: the user\n    // explicitly initiated a session transfer on the source frontend\n    // (clicked \"Open in docs\" / similar). Skipping the exchange would:\n    //   (a) leave a 60-second dangling AUTH_CODE_EXCHANGE token in the\n    //       store (auto-expires, but uses the consumable-token budget and\n    //       muddies audit logs);\n    //   (b) navigate the user using the URL `?return=` value but with\n    //       their PRE-EXISTING session — which may be a different user\n    //       than the handoff was minted for, leading to the user landing\n    //       on `/api/organization/foo` as the wrong identity (silent\n    //       auth-confusion). Always consume the code so the new tokens\n    //       replace the existing ones.\n    if (auth.accessToken && mode === 'one-off-session') {\n      exchangeAttemptedRef.current = true;\n      setExchangePhaseResolved(true);\n      return;\n    }\n\n    exchangeAttemptedRef.current = true;\n\n    const exchange = mode === 'cross-frontend-handoff'\n      ? handleAuthCodeExchange(token)\n      : handleOneOffTokenExchange(token);\n\n    exchange\n      .catch((e: unknown) => {\n        setError(toUserFacingErrorMessage(e, t(OneOffSessionLabel.ERROR_GENERIC)));\n      })\n      .finally(() => {\n        setExchangePhaseResolved(true);\n      });\n  }, [token, mode, auth.accessToken, handleOneOffTokenExchange, handleAuthCodeExchange, tokenStorage]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  // Single-use cleanup of `auth.crossFrontendHandoffContext`. Runs on\n  // unmount, which happens AFTER `<Navigate to={targetUrl}>` resolves and\n  // React tears down the receiver. Earlier cleanup would race the\n  // `targetUrl` `useMemo` recomputation and could navigate to home instead\n  // of the intended `returnPath`. No-op for `one-off-session` mode (which\n  // never sets the field in the first place — `oneOffContext` is its\n  // sibling state and is preserved as part of the active session).\n  //\n  // Dependency note (L-6): `mode` is captured by closure, so listing it as\n  // a dep technically just re-creates the effect when `mode` changes mid-\n  // mount — which never happens in practice (the prop is fixed by the\n  // receiver page). It IS listed deliberately so React's exhaustive-deps\n  // lint stays clean AND so a future caller that toggles `mode` mid-mount\n  // gets the cleanup re-bound rather than the stale closure. Removing it\n  // would shift this from \"harmless dep\" to \"subtle stale-closure bug\n  // waiting for a future mode toggle\".\n  useEffect(() => {\n    return () => {\n      if (mode === 'cross-frontend-handoff') {\n        clearCrossFrontendHandoffContext();\n      }\n    };\n  }, [mode, clearCrossFrontendHandoffContext]);\n\n  // Navigation guard: render `<Navigate>` ONLY when the exchange phase\n  // resolved cleanly. Critical: `!error` is load-bearing here. Without it,\n  // a cross-frontend-handoff receiver mounted with a pre-existing\n  // `auth.accessToken` (cold-load from persistent storage) whose AUTH_CODE_\n  // EXCHANGE call fails would silently navigate the user to the URL\n  // `?return=` value WITH THE OLD SESSION — a session-confusion regression\n  // (the user lands on the deep link as the wrong identity, with no error\n  // surfaced). The error branch below shows a localized failure message\n  // and a login link instead. See H-4 in the Step 5 second deep-review log\n  // on `cross-app-jwt-propagation.md`.\n  if (auth.accessToken && !auth.isLoading && exchangePhaseResolved && !error) {\n    return <Navigate to={targetUrl} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (error) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-destructive/10 mb-element\">\n            <svg className=\"h-6 w-6 text-destructive\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" strokeWidth=\"2\">\n              <path strokeLinecap=\"round\" strokeLinejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\" />\n            </svg>\n          </div>\n          <Heading>{t(OneOffSessionLabel.ERROR_TITLE)}</Heading>\n        </div>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{error}</AlertDescription>\n        </Alert>\n        <div className=\"text-center mt-group\">\n          <AuthSecondaryLink href={loginPath}>{t(OneOffSessionLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  return (\n    <div role=\"status\" aria-live=\"polite\" className=\"text-center space-y-item-xs\">\n      <div className=\"mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element\" aria-hidden=\"true\">\n        <LoadingSpinner size={24} className=\"text-primary\" />\n      </div>\n      <Text className=\"max-w-sm mx-auto\">{t(OneOffSessionLabel.VERIFYING)}</Text>\n    </div>\n  );\n};\n\nexport function Auth_OneOffSession({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OneOffSession_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OneOffSession_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, 'Auth_OneOffSession')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OneOffSession.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA+C,MAAM,qCAAqC,CAAC;AAM9J,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAOjE,CAAC"}
+{"version":3,"file":"Auth_OneOffSession.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA+C,MAAM,qCAAqC,CAAC;AAM9J,eAAO,MAAM,gCAAgC,EAAE,mBAAmB,EAOjE,CAAC"}

package/dist/esm/components/auth/Auth_OneOffSession.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OneOffSession.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,gCAAgC,GAA0B;IACrE,EAAE,GAAG,EAAE,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAChJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClI,EAAE,GAAG,EAAE,kBAAkB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE;IAC1I,EAAE,GAAG,EAAE,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+FAA+F,EAAE;IAC9K,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IACvJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;CAC1G,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OneOffSessionLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOneOffSessionLabels: LabellingUnitaryDef[] = [\n  { ref: OneOffSessionLabel.VERIFYING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the one-off session token is being exchanged' },\n  { ref: OneOffSessionLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the one-off session exchange fails' },\n  { ref: OneOffSessionLabel.ERROR_NO_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the one-off session link carries no token' },\n  { ref: OneOffSessionLabel.ERROR_WRONG_TAB, kind: LabelKind.MESSAGE, purpose: 'Error shown when a one-off session link is opened in a tab that already has a regular session' },\n  { ref: OneOffSessionLabel.ERROR_GENERIC, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the one-off session exchange fails unexpectedly' },\n  { ref: OneOffSessionLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, PublicLayoutsOneOffSessionLabels);\n"]}
+{"version":3,"file":"Auth_OneOffSession.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OneOffSession.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,gCAAgC,GAA0B;IACrE,EAAE,GAAG,EAAE,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAChJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClI,EAAE,GAAG,EAAE,kBAAkB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE;IAC1I,EAAE,GAAG,EAAE,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+FAA+F,EAAE;IAC9K,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IACvJ,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;CAC1G,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OneOffSessionLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOneOffSessionLabels: LabellingUnitaryDef[] = [\n  { ref: OneOffSessionLabel.VERIFYING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the one-off session token is being exchanged' },\n  { ref: OneOffSessionLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the one-off session exchange fails' },\n  { ref: OneOffSessionLabel.ERROR_NO_TOKEN, kind: LabelKind.MESSAGE, purpose: 'Error shown when the one-off session link carries no token' },\n  { ref: OneOffSessionLabel.ERROR_WRONG_TAB, kind: LabelKind.MESSAGE, purpose: 'Error shown when a one-off session link is opened in a tab that already has a regular session' },\n  { ref: OneOffSessionLabel.ERROR_GENERIC, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when the one-off session exchange fails unexpectedly' },\n  { ref: OneOffSessionLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link back to the sign-in screen' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ONE_OFF_SESSION, PublicLayoutsOneOffSessionLabels);\n"]}

package/dist/esm/components/auth/Auth_OrganizationOnboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OrganizationOnboarding.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OrganizationOnboarding.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAGzE,OAAO,EACL,oBAAoB,EAKrB,MAAM,uBAAuB,CAAC;AAoB/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAIxH,MAAM,WAAW,sDAAsD;CAAG;AAgE1E;;;GAGG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,EAAE,CAK/I;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iDAAiD,GAAI,QAAQ,sDAAsD,KAAG,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,IA4ItJ,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,sDAAsD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5L"}
+{"version":3,"file":"Auth_OrganizationOnboarding.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OrganizationOnboarding.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAGzE,OAAO,EACL,oBAAoB,EAKrB,MAAM,uBAAuB,CAAC;AAoB/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAIxH,MAAM,WAAW,sDAAsD;CAAG;AAgE1E;;;GAGG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,EAAE,CAK/I;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iDAAiD,GAAI,QAAQ,sDAAsD,KAAG,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,IA4ItJ,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,sDAAsD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5L"}

package/dist/esm/components/auth/Auth_OrganizationOnboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OrganizationOnboarding.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OrganizationOnboarding.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAC1H,OAAO,EACL,oBAAoB,EACpB,mCAAmC,EACnC,8BAA8B,GAG/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAC9F,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAElF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAK1H,MAAM,cAAc,GAAG,qBAAqB,CAAC,sCAAsC,CAAC;AAEpF,mFAAmF;AACnF,MAAM,4CAA4C,GAAG,KAAK,CAAC,aAAa,CAAgB,IAAI,CAAC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,kCAAkC,GAAa,GAAG,EAAE;IACxD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAC;IAEvF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,kBAAkB,GAAG,EAEpC,eAAe,IAAI,CAClB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,eAAe,GAAoB,GAChD,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,2BAA2B,CAAC,aAAa,CAAC,EAC5E,eAAe,EAAC,QAAG,EACnB,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF,+GAA+G;AAC/G,MAAM,6BAA6B,GAAa,GAAG,EAAE;IACnD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAC;IAEvF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,WAAW,GAAG,EAC9B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAE5B,eAAe,IAAI,CAClB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,eAAe,GAAoB,GAChD,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,2BAA2B,CAAC,qBAAqB,CAAC,EACpF,eAAe,EAAC,QAAG,EACnB,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAiE;IACrH,MAAM,QAAQ,GAAG,YAAY,EAAE,kBAAkB,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACnE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAgC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,MAA8D,EAA4B,EAAE;IAC5J,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7I,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5G,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE5H,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAE5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgC,IAAI,CAAC,CAAC;IACpF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACjD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,eAAe,CAAC,SAAS,CAAC;aACvB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,cAAc,CAAC,qCAAqC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,gHAAgH;aAC/G,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,cAAc,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAClF,MAAM,cAAc,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,EAAE,IAA8B,EAAE,EAAE;QAC/E,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAEtF,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,IAAmC,EAAE,EAAE;QAC7E,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,uGAAuG;YACvG,mDAAmD;YACnD,qGAAqG;YACrG,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC,EAAE,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAE3F,MAAM,yBAAyB,GAAG,WAAW,CAAC,GAAG,EAAE;QACjD,6BAA6B,EAAE,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,EAAE,CAAC,6BAA6B,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAEzD,0DAA0D;IAC1D,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9B,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,GAAW,EACzD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,2BAA2B,CAAC,eAAe,CAAC,GAAQ,IACtF,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YACvB,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,GAAQ,GAC5E,IACH,CACP,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,mBAAmB,GAAG,CAC1B,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,YAC9E,CAAC,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,GAC9C,GACL,CACP,CAAC;IAEF,IAAI,cAAc,KAAK,oBAAoB,CAAC,aAAa,EAAE,CAAC;QAC1D,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,2BAA2B,CAAC,aAAa,CAAC,GAAW,EACjE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,GAAQ,IAC1F,EAEN,KAAC,4CAA4C,CAAC,QAAQ,IAAC,KAAK,EAAE,eAAe,YAC3E,KAAC,aAAa,IAEZ,MAAM,EAAE,8BAA8B,EACtC,aAAa,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC9C,QAAQ,EAAE,mBAAmB,EAC7B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,IAAI,CAAC,SAAS,EACxB,cAAc,EAAE,6BAA6B,EAC7C,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,EAAE,IAP3H,oBAAoB,CAAC,aAAa,CAQvC,GACoD,EAEvD,mBAAmB,IAChB,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,GAAW,EACzD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,2BAA2B,CAAC,WAAW,CAAC,GAAQ,IAClF,EAEN,KAAC,4CAA4C,CAAC,QAAQ,IAAC,KAAK,EAAE,eAAe,YAC3E,KAAC,aAAa,IAEZ,MAAM,EAAE,mCAAmC,EAC3C,aAAa,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,EACvC,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,IAAI,CAAC,SAAS,EACxB,cAAc,EAAE,kCAAkC,EAClD,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAPrF,oBAAoB,CAAC,YAAY,CAQtC,GACoD,EAEvD,mBAAmB,IAChB,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAiF;IACvK,MAAM,SAAS,GAAG,uBAAuB,CAAyD,cAAc,EAAE,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;IACzJ,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useState } from 'react';\nimport { Navigate, useLocation, useNavigate } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OrganizationOnboardingLabel } from '@wildo-ai/presets-components-models';\nimport {\n  OnboardingObligation,\n  OrganizationOnboardingFormDtoSchema,\n  ProfileOnboardingFormDtoSchema,\n  type OrganizationOnboardingFormDto,\n  type ProfileOnboardingFormDto,\n} from '@wildo-ai/saas-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  extractAuthRedirectFromSearch,\n  resolvePostAuthRedirect,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n// --- Contract ---\nexport interface PublicLayoutPreset_OrganizationOnboarding_DefaultProps {}\n\nconst COMPONENT_TYPE = FrontendComponentType.PUBLIC_LAYOUTS_ORGANIZATION_ONBOARDING;\n\n/** What went wrong with the last submission, rendered inside the form template. */\nconst OrganizationOnboardingSubmissionErrorContext = React.createContext<string | null>(null);\n\n/**\n * Module-scope form template: the organization name, the submission error, and the submit button. Labels come\n * from this component's own namespace; the error is handed in through context because the template is\n * module-scope and the submission lives in the preset.\n */\nconst OrganizationOnboardingFormTemplate: React.FC = () => {\n  const { tComponent, isReady } = useI18n({ component: COMPONENT_TYPE });\n  const submissionError = React.useContext(OrganizationOnboardingSubmissionErrorContext);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"organizationName\" />\n\n      {submissionError && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{submissionError}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={tComponent(COMPONENT_TYPE, OrganizationOnboardingLabel.SUBMIT_BUTTON)}\n        submittingLabel=\"…\"\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/** The names step's form template (#1374): the two name fields, the submission error and the submit button. */\nconst ProfileOnboardingFormTemplate: React.FC = () => {\n  const { tComponent, isReady } = useI18n({ component: COMPONENT_TYPE });\n  const submissionError = React.useContext(OrganizationOnboardingSubmissionErrorContext);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"firstName\" />\n      <FormField name=\"lastName\" />\n\n      {submissionError && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{submissionError}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={tComponent(COMPONENT_TYPE, OrganizationOnboardingLabel.PROFILE_SUBMIT_BUTTON)}\n        submittingLabel=\"…\"\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * What a parked session owes, from the public session state (#1374). A server older than `pendingObligations`\n * parked only on the organization, so that is what an absent field means.\n */\nexport function onboardingObligationsFromSessionState(sessionState: { pendingObligations?: unknown } | null | undefined): OnboardingObligation[] {\n  const reported = sessionState?.pendingObligations;\n  if (!Array.isArray(reported)) return [OnboardingObligation.ORGANIZATION];\n  const known = new Set<string>(Object.values(OnboardingObligation));\n  return reported.filter((item): item is OnboardingObligation => typeof item === 'string' && known.has(item));\n}\n\n/**\n * The onboarding screen (#1090, #1374) — named for its first obligation, and the host of every one.\n *\n * An account arrives here with its authentication session parked at `ONBOARDING_PENDING`\n * (`auth.onboardingSessionId`) because its user type names its organization at onboarding and it has none yet.\n * Four answers park it: a registration under deferred verification, an email verification, a second-factor\n * enrollment that settles a registration session, and — since #1091 — any sign-in by an account that still owes\n * its organization. Naming the organization creates it, makes the account its owner, and signs the account in.\n *\n * The session is the auth context's, never read from the URL: it mints, so it is kept out of history and request\n * logs. Nothing is remembered across a reload either, and that loses nothing — the obligation is durable on the\n * server, so a person whose tab lost the session signs in again and is brought straight back here. That is also\n * the answer to a spent session (completed in another tab, expired): the auth context forgets it, and the step\n * says so and offers sign-in.\n *\n * **The way out.** Every auth screen routes a parked context here, so the step offers \"use a different account\":\n * it abandons the parked session and goes to sign-in. The account loses nothing — it is returned here the next\n * time it signs in.\n */\nexport const PublicLayoutPreset_OrganizationOnboarding_Default = (_props: PublicLayoutPreset_OrganizationOnboarding_DefaultProps): React.JSX.Element | null => {\n  const { auth, completeOrganizationOnboarding, completeProfileOnboarding, abandonOrganizationOnboarding, getSessionState } = useAuthSession();\n  const { tComponent, isReady } = useI18n({ component: COMPONENT_TYPE });\n  const t = (key: string) => tComponent(COMPONENT_TYPE, key);\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const location = useLocation();\n  const navigate = useNavigate();\n\n  const authRedirectTarget = useMemo(() => extractAuthRedirectFromSearch(location.search), [location.search]);\n  const postAuthRedirect = useMemo(() => resolvePostAuthRedirect(location.search), [location.search]);\n  const loginPath = useMemo(() => appendAuthRedirectToPath(CommonRoutePaths.login, authRedirectTarget), [authRedirectTarget]);\n\n  const [submissionError, setSubmissionError] = useState<string | null>(null);\n\n  /*\n   * What the parked session still owes, in the order it is asked (#1374). Read from the session the context holds\n   * when the screen opens, then advanced by each completion's answer — so a session parked on the names AND the\n   * organization shows the names step, then the organization step, then signs in. `null` while unknown.\n   */\n  const [obligations, setObligations] = useState<OnboardingObligation[] | null>(null);\n  useEffect(() => {\n    const sessionId = auth.onboardingSessionId;\n    if (!sessionId) { setObligations(null); return; }\n    let cancelled = false;\n    getSessionState(sessionId)\n      .then((state) => { if (!cancelled) setObligations(onboardingObligationsFromSessionState(state)); })\n      // Unreadable ⇒ the organization, the one obligation every server knows; its completion refuses a spent session.\n      .catch(() => { if (!cancelled) setObligations([OnboardingObligation.ORGANIZATION]); });\n    return () => { cancelled = true; };\n  }, [auth.onboardingSessionId]); // eslint-disable-line react-hooks/exhaustive-deps\n  const nextObligation = obligations?.[0];\n\n  const handleProfileSubmit = useCallback(async (data: ProfileOnboardingFormDto) => {\n    setSubmissionError(null);\n    try {\n      const outcome = await completeProfileOnboarding(data.firstName.trim(), data.lastName.trim());\n      if (!outcome.signedIn) setObligations(outcome.pendingObligations);\n    } catch (e: unknown) {\n      setSubmissionError(toUserFacingErrorMessage(e, t(OrganizationOnboardingLabel.COMPLETION_ERROR)));\n    }\n  }, [completeProfileOnboarding, t]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  const handleSubmit = useCallback(async (data: OrganizationOnboardingFormDto) => {\n    setSubmissionError(null);\n    try {\n      const outcome = await completeOrganizationOnboarding(data.organizationName.trim());\n      if (!outcome.signedIn) setObligations(outcome.pendingObligations);\n    } catch (e: unknown) {\n      // A SPENT session needs no branch here: the context forgets it, and this step then renders as expired,\n      // which replaces the form and any error set below.\n      // Guidance (localized first), then the refusal's own label, then this step's words — never raw text.\n      setSubmissionError(toUserFacingErrorMessage(e, t(OrganizationOnboardingLabel.COMPLETION_ERROR)));\n    }\n  }, [completeOrganizationOnboarding, t]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  const handleUseDifferentAccount = useCallback(() => {\n    abandonOrganizationOnboarding();\n    navigate(loginPath, { replace: true });\n  }, [abandonOrganizationOnboarding, navigate, loginPath]);\n\n  // Signed in — including by the completion just made here.\n  if (auth.accessToken && !auth.isLoading) {\n    return <Navigate to={postAuthRedirect} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (!auth.onboardingSessionId) {\n    return (\n      <div className=\"space-y-group py-section text-center\">\n        <div className=\"space-y-item-xs\">\n          <Heading>{t(OrganizationOnboardingLabel.TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(OrganizationOnboardingLabel.SESSION_EXPIRED)}</Text>\n        </div>\n        <Text className=\"text-sm\">\n          <Link href={loginPath}>{t(OrganizationOnboardingLabel.SIGN_IN_AGAIN_LINK)}</Link>\n        </Text>\n      </div>\n    );\n  }\n\n  if (obligations === null) return null;\n\n  const useDifferentAccount = (\n    <div className=\"text-center\">\n      <Button variant={ButtonVariants_Variant.GHOST} onClick={handleUseDifferentAccount}>\n        {t(OrganizationOnboardingLabel.USE_DIFFERENT_ACCOUNT)}\n      </Button>\n    </div>\n  );\n\n  if (nextObligation === OnboardingObligation.PROFILE_NAMES) {\n    return (\n      <div className=\"space-y-group\">\n        <div className=\"text-center space-y-item-xs\">\n          <Heading>{t(OrganizationOnboardingLabel.PROFILE_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(OrganizationOnboardingLabel.PROFILE_DESCRIPTION)}</Text>\n        </div>\n\n        <OrganizationOnboardingSubmissionErrorContext.Provider value={submissionError}>\n          <AutomatedForm\n            key={OnboardingObligation.PROFILE_NAMES}\n            schema={ProfileOnboardingFormDtoSchema}\n            defaultValues={{ firstName: '', lastName: '' }}\n            onSubmit={handleProfileSubmit}\n            validationMode={ValidationMode.ON_BLUR}\n            disabled={auth.isLoading}\n            layoutTemplate={ProfileOnboardingFormTemplate}\n            labels={{ fields: { firstName: t(OrganizationOnboardingLabel.FIRST_NAME), lastName: t(OrganizationOnboardingLabel.LAST_NAME) } }}\n          />\n        </OrganizationOnboardingSubmissionErrorContext.Provider>\n\n        {useDifferentAccount}\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"space-y-group\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>{t(OrganizationOnboardingLabel.TITLE)}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(OrganizationOnboardingLabel.DESCRIPTION)}</Text>\n      </div>\n\n      <OrganizationOnboardingSubmissionErrorContext.Provider value={submissionError}>\n        <AutomatedForm\n          key={OnboardingObligation.ORGANIZATION}\n          schema={OrganizationOnboardingFormDtoSchema}\n          defaultValues={{ organizationName: '' }}\n          onSubmit={handleSubmit}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={auth.isLoading}\n          layoutTemplate={OrganizationOnboardingFormTemplate}\n          labels={{ fields: { organizationName: t(OrganizationOnboardingLabel.ORGANIZATION_NAME) } }}\n        />\n      </OrganizationOnboardingSubmissionErrorContext.Provider>\n\n      {useDifferentAccount}\n    </div>\n  );\n};\n\nexport function Auth_OrganizationOnboarding({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OrganizationOnboarding_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OrganizationOnboarding_DefaultProps>(COMPONENT_TYPE, 'Auth_OrganizationOnboarding')(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_OrganizationOnboarding.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OrganizationOnboarding.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAC1H,OAAO,EACL,oBAAoB,EACpB,mCAAmC,EACnC,8BAA8B,GAG/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAC9F,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAElF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAK1H,MAAM,cAAc,GAAG,qBAAqB,CAAC,sCAAsC,CAAC;AAEpF,mFAAmF;AACnF,MAAM,4CAA4C,GAAG,KAAK,CAAC,aAAa,CAAgB,IAAI,CAAC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,kCAAkC,GAAa,GAAG,EAAE;IACxD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAC;IAEvF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,kBAAkB,GAAG,EAEpC,eAAe,IAAI,CAClB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,eAAe,GAAoB,GAChD,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,2BAA2B,CAAC,aAAa,CAAC,EAC5E,eAAe,EAAC,QAAG,EACnB,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF,+GAA+G;AAC/G,MAAM,6BAA6B,GAAa,GAAG,EAAE;IACnD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAC;IAEvF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,WAAW,GAAG,EAC9B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAE5B,eAAe,IAAI,CAClB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,eAAe,GAAoB,GAChD,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,2BAA2B,CAAC,qBAAqB,CAAC,EACpF,eAAe,EAAC,QAAG,EACnB,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAiE;IACrH,MAAM,QAAQ,GAAG,YAAY,EAAE,kBAAkB,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACnE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAgC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,MAA8D,EAA4B,EAAE;IAC5J,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7I,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5G,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE5H,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAE5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgC,IAAI,CAAC,CAAC;IACpF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACjD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,eAAe,CAAC,SAAS,CAAC;aACvB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,cAAc,CAAC,qCAAqC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,gHAAgH;aAC/G,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,cAAc,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAClF,MAAM,cAAc,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,EAAE,IAA8B,EAAE,EAAE;QAC/E,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAEtF,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,IAAmC,EAAE,EAAE;QAC7E,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,uGAAuG;YACvG,mDAAmD;YACnD,qGAAqG;YACrG,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC,EAAE,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAE3F,MAAM,yBAAyB,GAAG,WAAW,CAAC,GAAG,EAAE;QACjD,6BAA6B,EAAE,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,EAAE,CAAC,6BAA6B,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAEzD,0DAA0D;IAC1D,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9B,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aACnD,eAAK,SAAS,EAAC,iBAAiB,aAC9B,KAAC,OAAO,cAAE,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,GAAW,EACzD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,2BAA2B,CAAC,eAAe,CAAC,GAAQ,IACtF,EACN,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YACvB,KAAC,IAAI,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,GAAQ,GAC5E,IACH,CACP,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,mBAAmB,GAAG,CAC1B,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,YAC9E,CAAC,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,GAC9C,GACL,CACP,CAAC;IAEF,IAAI,cAAc,KAAK,oBAAoB,CAAC,aAAa,EAAE,CAAC;QAC1D,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,2BAA2B,CAAC,aAAa,CAAC,GAAW,EACjE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,GAAQ,IAC1F,EAEN,KAAC,4CAA4C,CAAC,QAAQ,IAAC,KAAK,EAAE,eAAe,YAC3E,KAAC,aAAa,IAEZ,MAAM,EAAE,8BAA8B,EACtC,aAAa,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC9C,QAAQ,EAAE,mBAAmB,EAC7B,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,IAAI,CAAC,SAAS,EACxB,cAAc,EAAE,6BAA6B,EAC7C,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,EAAE,IAP3H,oBAAoB,CAAC,aAAa,CAQvC,GACoD,EAEvD,mBAAmB,IAChB,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,GAAW,EACzD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,2BAA2B,CAAC,WAAW,CAAC,GAAQ,IAClF,EAEN,KAAC,4CAA4C,CAAC,QAAQ,IAAC,KAAK,EAAE,eAAe,YAC3E,KAAC,aAAa,IAEZ,MAAM,EAAE,mCAAmC,EAC3C,aAAa,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,EACvC,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,IAAI,CAAC,SAAS,EACxB,cAAc,EAAE,kCAAkC,EAClD,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAPrF,oBAAoB,CAAC,YAAY,CAQtC,GACoD,EAEvD,mBAAmB,IAChB,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAiF;IACvK,MAAM,SAAS,GAAG,uBAAuB,CAAyD,cAAc,EAAE,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;IACzJ,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useState } from 'react';\nimport { Navigate, useLocation, useNavigate } from 'react-router-dom';\nimport { CorePresetNames, FrontendComponentType, OrganizationOnboardingLabel } from '@wildo-ai/presets-components-models';\nimport {\n  OnboardingObligation,\n  OrganizationOnboardingFormDtoSchema,\n  ProfileOnboardingFormDtoSchema,\n  type OrganizationOnboardingFormDto,\n  type ProfileOnboardingFormDto,\n} from '@wildo-ai/saas-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport {\n  appendAuthRedirectToPath,\n  extractAuthRedirectFromSearch,\n  resolvePostAuthRedirect,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n// --- Contract ---\nexport interface PublicLayoutPreset_OrganizationOnboarding_DefaultProps {}\n\nconst COMPONENT_TYPE = FrontendComponentType.PUBLIC_LAYOUTS_ORGANIZATION_ONBOARDING;\n\n/** What went wrong with the last submission, rendered inside the form template. */\nconst OrganizationOnboardingSubmissionErrorContext = React.createContext<string | null>(null);\n\n/**\n * Module-scope form template: the organization name, the submission error, and the submit button. Labels come\n * from this component's own namespace; the error is handed in through context because the template is\n * module-scope and the submission lives in the preset.\n */\nconst OrganizationOnboardingFormTemplate: React.FC = () => {\n  const { tComponent, isReady } = useI18n({ component: COMPONENT_TYPE });\n  const submissionError = React.useContext(OrganizationOnboardingSubmissionErrorContext);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"organizationName\" />\n\n      {submissionError && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{submissionError}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={tComponent(COMPONENT_TYPE, OrganizationOnboardingLabel.SUBMIT_BUTTON)}\n        submittingLabel=\"…\"\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/** The names step's form template (#1374): the two name fields, the submission error and the submit button. */\nconst ProfileOnboardingFormTemplate: React.FC = () => {\n  const { tComponent, isReady } = useI18n({ component: COMPONENT_TYPE });\n  const submissionError = React.useContext(OrganizationOnboardingSubmissionErrorContext);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"firstName\" />\n      <FormField name=\"lastName\" />\n\n      {submissionError && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{submissionError}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={tComponent(COMPONENT_TYPE, OrganizationOnboardingLabel.PROFILE_SUBMIT_BUTTON)}\n        submittingLabel=\"…\"\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * What a parked session owes, from the public session state (#1374). A server older than `pendingObligations`\n * parked only on the organization, so that is what an absent field means.\n */\nexport function onboardingObligationsFromSessionState(sessionState: { pendingObligations?: unknown } | null | undefined): OnboardingObligation[] {\n  const reported = sessionState?.pendingObligations;\n  if (!Array.isArray(reported)) return [OnboardingObligation.ORGANIZATION];\n  const known = new Set<string>(Object.values(OnboardingObligation));\n  return reported.filter((item): item is OnboardingObligation => typeof item === 'string' && known.has(item));\n}\n\n/**\n * The onboarding screen (#1090, #1374) — named for its first obligation, and the host of every one.\n *\n * An account arrives here with its authentication session parked at `ONBOARDING_PENDING`\n * (`auth.onboardingSessionId`) because its user type names its organization at onboarding and it has none yet.\n * Four answers park it: a registration under deferred verification, an email verification, a second-factor\n * enrollment that settles a registration session, and — since #1091 — any sign-in by an account that still owes\n * its organization. Naming the organization creates it, makes the account its owner, and signs the account in.\n *\n * The session is the auth context's, never read from the URL: it mints, so it is kept out of history and request\n * logs. Nothing is remembered across a reload either, and that loses nothing — the obligation is durable on the\n * server, so a person whose tab lost the session signs in again and is brought straight back here. That is also\n * the answer to a spent session (completed in another tab, expired): the auth context forgets it, and the step\n * says so and offers sign-in.\n *\n * **The way out.** Every auth screen routes a parked context here, so the step offers \"use a different account\":\n * it abandons the parked session and goes to sign-in. The account loses nothing — it is returned here the next\n * time it signs in.\n */\nexport const PublicLayoutPreset_OrganizationOnboarding_Default = (_props: PublicLayoutPreset_OrganizationOnboarding_DefaultProps): React.JSX.Element | null => {\n  const { auth, completeOrganizationOnboarding, completeProfileOnboarding, abandonOrganizationOnboarding, getSessionState } = useAuthSession();\n  const { tComponent, isReady } = useI18n({ component: COMPONENT_TYPE });\n  const t = (key: string) => tComponent(COMPONENT_TYPE, key);\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const location = useLocation();\n  const navigate = useNavigate();\n\n  const authRedirectTarget = useMemo(() => extractAuthRedirectFromSearch(location.search), [location.search]);\n  const postAuthRedirect = useMemo(() => resolvePostAuthRedirect(location.search), [location.search]);\n  const loginPath = useMemo(() => appendAuthRedirectToPath(CommonRoutePaths.login, authRedirectTarget), [authRedirectTarget]);\n\n  const [submissionError, setSubmissionError] = useState<string | null>(null);\n\n  /*\n   * What the parked session still owes, in the order it is asked (#1374). Read from the session the context holds\n   * when the screen opens, then advanced by each completion's answer — so a session parked on the names AND the\n   * organization shows the names step, then the organization step, then signs in. `null` while unknown.\n   */\n  const [obligations, setObligations] = useState<OnboardingObligation[] | null>(null);\n  useEffect(() => {\n    const sessionId = auth.onboardingSessionId;\n    if (!sessionId) { setObligations(null); return; }\n    let cancelled = false;\n    getSessionState(sessionId)\n      .then((state) => { if (!cancelled) setObligations(onboardingObligationsFromSessionState(state)); })\n      // Unreadable ⇒ the organization, the one obligation every server knows; its completion refuses a spent session.\n      .catch(() => { if (!cancelled) setObligations([OnboardingObligation.ORGANIZATION]); });\n    return () => { cancelled = true; };\n  }, [auth.onboardingSessionId]); // eslint-disable-line react-hooks/exhaustive-deps\n  const nextObligation = obligations?.[0];\n\n  const handleProfileSubmit = useCallback(async (data: ProfileOnboardingFormDto) => {\n    setSubmissionError(null);\n    try {\n      const outcome = await completeProfileOnboarding(data.firstName.trim(), data.lastName.trim());\n      if (!outcome.signedIn) setObligations(outcome.pendingObligations);\n    } catch (e: unknown) {\n      setSubmissionError(toUserFacingErrorMessage(e, t(OrganizationOnboardingLabel.COMPLETION_ERROR)));\n    }\n  }, [completeProfileOnboarding, t]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  const handleSubmit = useCallback(async (data: OrganizationOnboardingFormDto) => {\n    setSubmissionError(null);\n    try {\n      const outcome = await completeOrganizationOnboarding(data.organizationName.trim());\n      if (!outcome.signedIn) setObligations(outcome.pendingObligations);\n    } catch (e: unknown) {\n      // A SPENT session needs no branch here: the context forgets it, and this step then renders as expired,\n      // which replaces the form and any error set below.\n      // Guidance (localized first), then the refusal's own label, then this step's words — never raw text.\n      setSubmissionError(toUserFacingErrorMessage(e, t(OrganizationOnboardingLabel.COMPLETION_ERROR)));\n    }\n  }, [completeOrganizationOnboarding, t]); // eslint-disable-line react-hooks/exhaustive-deps\n\n  const handleUseDifferentAccount = useCallback(() => {\n    abandonOrganizationOnboarding();\n    navigate(loginPath, { replace: true });\n  }, [abandonOrganizationOnboarding, navigate, loginPath]);\n\n  // Signed in — including by the completion just made here.\n  if (auth.accessToken && !auth.isLoading) {\n    return <Navigate to={postAuthRedirect} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (!auth.onboardingSessionId) {\n    return (\n      <div className=\"space-y-group py-section text-center\">\n        <div className=\"space-y-item-xs\">\n          <Heading>{t(OrganizationOnboardingLabel.TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(OrganizationOnboardingLabel.SESSION_EXPIRED)}</Text>\n        </div>\n        <Text className=\"text-sm\">\n          <Link href={loginPath}>{t(OrganizationOnboardingLabel.SIGN_IN_AGAIN_LINK)}</Link>\n        </Text>\n      </div>\n    );\n  }\n\n  if (obligations === null) return null;\n\n  const useDifferentAccount = (\n    <div className=\"text-center\">\n      <Button variant={ButtonVariants_Variant.GHOST} onClick={handleUseDifferentAccount}>\n        {t(OrganizationOnboardingLabel.USE_DIFFERENT_ACCOUNT)}\n      </Button>\n    </div>\n  );\n\n  if (nextObligation === OnboardingObligation.PROFILE_NAMES) {\n    return (\n      <div className=\"space-y-group\">\n        <div className=\"text-center space-y-item-xs\">\n          <Heading>{t(OrganizationOnboardingLabel.PROFILE_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(OrganizationOnboardingLabel.PROFILE_DESCRIPTION)}</Text>\n        </div>\n\n        <OrganizationOnboardingSubmissionErrorContext.Provider value={submissionError}>\n          <AutomatedForm\n            key={OnboardingObligation.PROFILE_NAMES}\n            schema={ProfileOnboardingFormDtoSchema}\n            defaultValues={{ firstName: '', lastName: '' }}\n            onSubmit={handleProfileSubmit}\n            validationMode={ValidationMode.ON_BLUR}\n            disabled={auth.isLoading}\n            layoutTemplate={ProfileOnboardingFormTemplate}\n            labels={{ fields: { firstName: t(OrganizationOnboardingLabel.FIRST_NAME), lastName: t(OrganizationOnboardingLabel.LAST_NAME) } }}\n          />\n        </OrganizationOnboardingSubmissionErrorContext.Provider>\n\n        {useDifferentAccount}\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"space-y-group\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>{t(OrganizationOnboardingLabel.TITLE)}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(OrganizationOnboardingLabel.DESCRIPTION)}</Text>\n      </div>\n\n      <OrganizationOnboardingSubmissionErrorContext.Provider value={submissionError}>\n        <AutomatedForm\n          key={OnboardingObligation.ORGANIZATION}\n          schema={OrganizationOnboardingFormDtoSchema}\n          defaultValues={{ organizationName: '' }}\n          onSubmit={handleSubmit}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={auth.isLoading}\n          layoutTemplate={OrganizationOnboardingFormTemplate}\n          labels={{ fields: { organizationName: t(OrganizationOnboardingLabel.ORGANIZATION_NAME) } }}\n        />\n      </OrganizationOnboardingSubmissionErrorContext.Provider>\n\n      {useDifferentAccount}\n    </div>\n  );\n};\n\nexport function Auth_OrganizationOnboarding({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_OrganizationOnboarding_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_OrganizationOnboarding_DefaultProps>(COMPONENT_TYPE, 'Auth_OrganizationOnboarding')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_OrganizationOnboarding.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OrganizationOnboarding.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OrganizationOnboarding.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAAwD,MAAM,qCAAqC,CAAC;AAMvK,eAAO,MAAM,yCAAyC,EAAE,mBAAmB,EAe1E,CAAC"}
+{"version":3,"file":"Auth_OrganizationOnboarding.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OrganizationOnboarding.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAAwD,MAAM,qCAAqC,CAAC;AAMvK,eAAO,MAAM,yCAAyC,EAAE,mBAAmB,EAe1E,CAAC"}

package/dist/esm/components/auth/Auth_OrganizationOnboarding.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OrganizationOnboarding.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OrganizationOnboarding.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEvK,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,EAAE,GAAG,EAAE,2BAA2B,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4EAA4E,EAAE;IAC1J,wGAAwG;IACxG,EAAE,GAAG,EAAE,2BAA2B,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,yGAAyG,EAAE;IAC/L,EAAE,GAAG,EAAE,2BAA2B,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,4FAA4F,EAAE;IAC5L,EAAE,GAAG,EAAE,2BAA2B,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE;IAClI,EAAE,GAAG,EAAE,2BAA2B,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IAChI,EAAE,GAAG,EAAE,2BAA2B,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACxI,EAAE,GAAG,EAAE,2BAA2B,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAC/L,EAAE,GAAG,EAAE,2BAA2B,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,wDAAwD,EAAE;IAChJ,EAAE,GAAG,EAAE,2BAA2B,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACpJ,EAAE,GAAG,EAAE,2BAA2B,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,yFAAyF,EAAE;IAClL,EAAE,GAAG,EAAE,2BAA2B,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,gIAAgI,EAAE;IACxN,EAAE,GAAG,EAAE,2BAA2B,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACrJ,EAAE,GAAG,EAAE,2BAA2B,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,kGAAkG,EAAE;CAChM,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,sCAAsC,EAAE,yCAAyC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OrganizationOnboardingLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOrganizationOnboardingLabels: LabellingUnitaryDef[] = [\n  { ref: OrganizationOnboardingLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the step where a new account names the organization it will own' },\n  // The names step (#1374), for a user type that collects the person's names after the address is proven.\n  { ref: OrganizationOnboardingLabel.PROFILE_TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the step where a person who has just confirmed their account gives their first and last name' },\n  { ref: OrganizationOnboardingLabel.PROFILE_DESCRIPTION, kind: LabelKind.DESCRIPTION, purpose: 'One sentence under that heading saying the names are needed before the account can be used' },\n  { ref: OrganizationOnboardingLabel.FIRST_NAME, kind: LabelKind.LABEL, purpose: 'Label of the first-name field on the names step' },\n  { ref: OrganizationOnboardingLabel.LAST_NAME, kind: LabelKind.LABEL, purpose: 'Label of the last-name field on the names step' },\n  { ref: OrganizationOnboardingLabel.PROFILE_SUBMIT_BUTTON, kind: LabelKind.BUTTON, purpose: 'Button that saves the names and continues' },\n  { ref: OrganizationOnboardingLabel.DESCRIPTION, kind: LabelKind.DESCRIPTION, purpose: 'Explains that naming the organization creates it, makes the account its owner and finishes signing in' },\n  { ref: OrganizationOnboardingLabel.ORGANIZATION_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the name of the organization to create' },\n  { ref: OrganizationOnboardingLabel.SUBMIT_BUTTON, kind: LabelKind.BUTTON, purpose: 'Button that creates the organization and signs the account in' },\n  { ref: OrganizationOnboardingLabel.COMPLETION_ERROR, kind: LabelKind.MESSAGE, purpose: 'Fallback error when creating the organization failed and the server gave no explanation' },\n  { ref: OrganizationOnboardingLabel.SESSION_EXPIRED, kind: LabelKind.MESSAGE, purpose: 'Shown when the onboarding session is no longer valid; reassures that signing in again returns to this step and nothing is lost' },\n  { ref: OrganizationOnboardingLabel.SIGN_IN_AGAIN_LINK, kind: LabelKind.LABEL, purpose: 'Link to the sign-in screen from an expired onboarding step' },\n  { ref: OrganizationOnboardingLabel.USE_DIFFERENT_ACCOUNT, kind: LabelKind.BUTTON, purpose: 'Leaves the onboarding step without creating an organization, to sign in with a different account' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ORGANIZATION_ONBOARDING, PublicLayoutsOrganizationOnboardingLabels);\n"]}
+{"version":3,"file":"Auth_OrganizationOnboarding.labels.js","sourceRoot":"","sources":["../../../../src/components/auth/Auth_OrganizationOnboarding.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEvK,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,EAAE,GAAG,EAAE,2BAA2B,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4EAA4E,EAAE;IAC1J,wGAAwG;IACxG,EAAE,GAAG,EAAE,2BAA2B,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,yGAAyG,EAAE;IAC/L,EAAE,GAAG,EAAE,2BAA2B,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,4FAA4F,EAAE;IAC5L,EAAE,GAAG,EAAE,2BAA2B,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE;IAClI,EAAE,GAAG,EAAE,2BAA2B,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IAChI,EAAE,GAAG,EAAE,2BAA2B,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACxI,EAAE,GAAG,EAAE,2BAA2B,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAC/L,EAAE,GAAG,EAAE,2BAA2B,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,wDAAwD,EAAE;IAChJ,EAAE,GAAG,EAAE,2BAA2B,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACpJ,EAAE,GAAG,EAAE,2BAA2B,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,yFAAyF,EAAE;IAClL,EAAE,GAAG,EAAE,2BAA2B,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,gIAAgI,EAAE;IACxN,EAAE,GAAG,EAAE,2BAA2B,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACrJ,EAAE,GAAG,EAAE,2BAA2B,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,kGAAkG,EAAE;CAChM,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,sCAAsC,EAAE,yCAAyC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, OrganizationOnboardingLabel, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsOrganizationOnboardingLabels: LabellingUnitaryDef[] = [\n  { ref: OrganizationOnboardingLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the step where a new account names the organization it will own' },\n  // The names step (#1374), for a user type that collects the person's names after the address is proven.\n  { ref: OrganizationOnboardingLabel.PROFILE_TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the step where a person who has just confirmed their account gives their first and last name' },\n  { ref: OrganizationOnboardingLabel.PROFILE_DESCRIPTION, kind: LabelKind.DESCRIPTION, purpose: 'One sentence under that heading saying the names are needed before the account can be used' },\n  { ref: OrganizationOnboardingLabel.FIRST_NAME, kind: LabelKind.LABEL, purpose: 'Label of the first-name field on the names step' },\n  { ref: OrganizationOnboardingLabel.LAST_NAME, kind: LabelKind.LABEL, purpose: 'Label of the last-name field on the names step' },\n  { ref: OrganizationOnboardingLabel.PROFILE_SUBMIT_BUTTON, kind: LabelKind.BUTTON, purpose: 'Button that saves the names and continues' },\n  { ref: OrganizationOnboardingLabel.DESCRIPTION, kind: LabelKind.DESCRIPTION, purpose: 'Explains that naming the organization creates it, makes the account its owner and finishes signing in' },\n  { ref: OrganizationOnboardingLabel.ORGANIZATION_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the name of the organization to create' },\n  { ref: OrganizationOnboardingLabel.SUBMIT_BUTTON, kind: LabelKind.BUTTON, purpose: 'Button that creates the organization and signs the account in' },\n  { ref: OrganizationOnboardingLabel.COMPLETION_ERROR, kind: LabelKind.MESSAGE, purpose: 'Fallback error when creating the organization failed and the server gave no explanation' },\n  { ref: OrganizationOnboardingLabel.SESSION_EXPIRED, kind: LabelKind.MESSAGE, purpose: 'Shown when the onboarding session is no longer valid; reassures that signing in again returns to this step and nothing is lost' },\n  { ref: OrganizationOnboardingLabel.SIGN_IN_AGAIN_LINK, kind: LabelKind.LABEL, purpose: 'Link to the sign-in screen from an expired onboarding step' },\n  { ref: OrganizationOnboardingLabel.USE_DIFFERENT_ACCOUNT, kind: LabelKind.BUTTON, purpose: 'Leaves the onboarding step without creating an organization, to sign in with a different account' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_ORGANIZATION_ONBOARDING, PublicLayoutsOrganizationOnboardingLabels);\n"]}

package/dist/esm/components/auth/Auth_PasswordLost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_PasswordLost.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAiD,MAAM,OAAO,CAAC;AA6BtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAqFxH,MAAM,WAAW,gDAAgD;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,2CAA2C,GAAI,wBAGzD,gDAAgD,KAAG,KAAK,CAAC,GAAG,CAAC,OAgN/D,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,gDAAgD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5K"}
+{"version":3,"file":"Auth_PasswordLost.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/Auth_PasswordLost.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAiD,MAAM,OAAO,CAAC;AA6BtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAqFxH,MAAM,WAAW,gDAAgD;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,2CAA2C,GAAI,wBAGzD,gDAAgD,KAAG,KAAK,CAAC,GAAG,CAAC,OAgN/D,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,gDAAgD,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAG5K"}