@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/components/auth/Auth_ChatIdentityLink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_ChatIdentityLink.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_ChatIdentityLink.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACpH,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,gBAAgB,EAChB,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAC1H,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACnI,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,8EAA8E,CAAC;AAEpJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,4CAA4C;AAC5C,IAAK,kBAWJ;AAXD,WAAK,kBAAkB;IACrB,iDAAiD;IACjD,yCAAmB,CAAA;IACnB,yEAAyE;IACzE,qCAAe,CAAA;IACf,yDAAyD;IACzD,yCAAmB,CAAA;IACnB,+CAA+C;IAC/C,uCAAiB,CAAA;IACjB,mEAAmE;IACnE,qCAAe,CAAA;AACjB,CAAC,EAXI,kBAAkB,KAAlB,kBAAkB,QAWtB;AAQD,MAAM,SAAS,GAAG,qBAAqB,CAAC,iCAAiC,CAAC;AAE1E,SAAS,gBAAgB,CAAC,mBAAiD;IACzE,OAAO,kCAAkC,CAAC,sBAAsB,CAAC;QAC/D,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;QACxD,mBAAmB;QACnB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,kBAAkB,EAAE,IAAI;QACxB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,2CAA2C,GAAG,CACzD,MAAwD,EACrC,EAAE;IACrB,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAC;IACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAClF,MAAM,CAAC,GAAG,CAAC,GAA0B,EAAE,MAA+B,EAAU,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACtH,MAAM,EAAE,WAAW,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC9C,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,eAAe,EAAE,CAAC;IAE1D,0FAA0F;IAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7B,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,8BAA8B,CAAC,eAAe,CAAC;QAChF,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,8BAA8B,CAAC,KAAK,CAAC;QAC7D,IAAI,EAAE,yBAAyB,CAAC,YAAY,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;KACvF,CAAC,CAAC,CAAC;IACJ,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAqB,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrF,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAiC,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC5D,gGAAgG;IAChG,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,qHAAqH;IACrH,qHAAqH;IACrH,gHAAgH;IAChH,yCAAyC;IACzC,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACtD,YAAY,CAAC,OAAO,GAAG,wBAAwB,CAAC;IAEhD,MAAM,UAAU,GAAG,WAAW,CAC5B,GAAG,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,EACzH,CAAC,IAAI,CAAC,CACP,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,2EAA2E;QAClG,IAAI,UAAU,CAAC,OAAO;YAAE,OAAO,CAAC,+EAA+E;QAC/G,IAAI,YAAY,CAAC,GAAG,CAAC,8BAA8B,CAAC,KAAK,CAAC;YAAE,eAAe,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACtC,cAAc,CAAC,OAAO,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;aAC9F,IAAI,CAAC,CAAC,MAA+B,EAAE,EAAE;YACxC,IAAI,SAAS;gBAAE,OAAO;YACtB,UAAU,CAAC,MAAM,CAAC,CAAC;YACnB,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,SAAS;gBAAE,OAAO;YACtB,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;QACF,2FAA2F;QAC3F,uDAAuD;IACzD,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,UAAU,CAAC,OAAO;YAAE,OAAO;QAC/B,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,OAAO,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzG,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,6FAA6F;IAC7F,MAAM,SAAS,GAAG,MAAM,KAAK,kBAAkB,CAAC,MAAM;WACjD,CAAC,MAAM,KAAK,kBAAkB,CAAC,KAAK,IAAI,OAAO,EAAE,QAAQ,KAAK,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAClH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IAC3B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS;YAAE,KAAK,QAAQ,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE1B;;;;OAIG;IACH,MAAM,WAAW,GAAG,CAAC,UAAiC,EAAE,SAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;QAC9F,CAAC,CAAC,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAG,CAAC,CAAC,UAAU,CAAC,GAAU;QACjJ,CAAC,CAAC,CACA,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAE,SAAS;YACpB,4GAA4G;YAC5G,yFAAyF;YACzF,OAAO,EAAE,GAAG,EAAE;gBACZ,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;qBACpH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC;oBAAE,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,CAAC,YAEA,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,GACpC,CACV,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,WAAW,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAEjE,oEAAoE;IACpE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1H,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,SAAG,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,kBAAkB,CAAC,OAAO,IAAI,MAAM,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;QAC/F,OAAO,CACL,eAAK,SAAS,EAAC,kDAAkD,aAC/D,KAAC,cAAc,KAAG,EACjB,OAAO,IAAI,KAAC,IAAI,cAAE,CAAC,CAAC,MAAM,KAAK,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAQ,IAC/H,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,kBAAkB,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACpD,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAAW,EACzD,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAoB,GAC1F,EACP,SAAS,IACN,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAW,EAC3D,KAAC,IAAI,cAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAQ,EACtD,SAAS,IACN,CACP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,+BAA+B,CAAC,aAAa,EAAE,CAAC;QACvE,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,GAAW,EAClE,KAAC,IAAI,cAAE,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,GAAQ,EACrD,SAAS,IACN,CACP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,+BAA+B,CAAC,wBAAwB,EAAE,CAAC;QAClF,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,GAAW,EACrE,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,GAAoB,GAC3E,EACP,SAAS,IACN,CACP,CAAC;IACJ,CAAC;IAED,yGAAyG;IACzG,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,oBAAoB;QAC9E,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,mBAAmB,EAAE,SAAS,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAC5H,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,UAAU,GAAG,CAAC,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE/H,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAW,EACnD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAQ,IACtE,EACN,cAAI,SAAS,EAAC,iBAAiB,aAC7B,uBAAI,KAAC,IAAI,IAAC,SAAS,EAAC,aAAa,YAAE,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAQ,GAAK,EACtF,cAAI,SAAS,EAAC,iBAAiB,aAC5B,YAAY,KAAK,SAAS,IAAI,KAAC,IAAI,cAAE,YAAY,GAAQ,EAC1D,KAAC,IAAI,IAAC,SAAS,EAAC,mBAAmB,YAAE,UAAU,GAAQ,IACpD,IACF,EACL,KAAC,KAAK,IAAC,OAAO,EAAC,SAAS,YACtB,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,GAAoB,GAC3E,EACR,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,GAAQ,EACxH,eAAK,SAAS,EAAC,kBAAkB,aAC9B,WAAW,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACpD,KAAC,MAAM,IAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAE,OAAO,YACjF,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAC1B,IACL,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,GAAG,eAAe,CAAC,OAAO,EAChC,GAAG,KAAK,EACgE;IACxE,MAAM,SAAS,GAAG,uBAAuB,CACvC,SAAS,EACT,uBAAuB,CACxB,CAAC,MAAM,CAAC,CAAC;IACV,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useRef, useState } from 'react';\nimport { Navigate, useNavigate, useSearchParams } from 'react-router-dom';\nimport { ChatIdentityLinkLabel, CorePresetNames, FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport {\n  CHAT_IDENTITY_LINK_PAGE_PATH,\n  ChatIdentityLinkPageQueryParam,\n  ChatIdentityLinkPreviewStanding,\n  ChatIdentityLinks_Operations,\n  CoreResourceType,\n  ResourceOperationVariantType,\n  ResourcesConfig_OperationPathUtils,\n  parseChatIdentityLinkHost,\n  type ChatIdentityLinkPreview,\n} from '@wildo-ai/saas-models';\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { appendAuthRedirectToPath, buildAuthRedirectTarget } from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { ChatSignInCompletionOutcome, useChatSignInCompletion } from '~wildo-frontend-lib/core/external-providers/chat-sign-in-completion.frontend';\n\n/**\n * The chat-link page (#2660) — the body rendered by {@link AuthPage_ChatIdentityLink}.\n *\n * A chat bot (Slack, Microsoft Teams) answers a person it does not know yet with a one-time link to this page,\n * carrying the organization the bot is installed for and a token naming the person's chat account. The page:\n *\n *   1. sends a visitor who is not signed in to sign in, returning here with the same link;\n *   2. takes the token out of the address bar once the member is signed in. The sign-in page's own address still\n *      carries the link on the way, which is one reason the token is single use and lasts fifteen minutes;\n *   3. asks `chatIdentityLinks.previewLink` which chat account the token names, WITHOUT using it;\n *   4. shows that account, with a warning to continue only if it is the member's own, and links it on an\n *      explicit click (`chatIdentityLinks.completeLink`).\n *\n * The confirmation is the point of step 3. A link is obtained without the member meaning to in one way only:\n * someone else's chat account asks the bot for a link and sends it to the member. The account line then names THAT\n * account, and it is where the member can see it. Nothing completes on load.\n *\n * The vendor's ids are ALWAYS shown, under the names when there are names. A chat user sets their own display name and\n * a vendor does not require it to be unique, so in exactly that attack the name can read as the member's own; the ids\n * cannot be chosen. Even so, the confirmation is a check a hurried member can miss: the email sent once a link exists\n * (`SecurityAlertType.CHAT_ACCOUNT_LINKED`) is the backstop, and it points to where the member unlinks it.\n *\n * A chat host may open the page in a window of its OWN (Microsoft Teams' authentication window, for a message-extension\n * search) and wait to be told the sign-in ended. The link then carries a host marker (`ChatIdentityLinkPageQueryParam.HOST`),\n * read once with the link, so it survives both the sign-in round trip and the strip of the query. The page tells the\n * providers serving `FRONTEND_CHAT_SIGN_IN_COMPLETION` for that host (#2790), without knowing which host it is:\n *   - a working link (completed now, or already linked to the member) → told SUCCEEDED at once, so the host can close\n *     its window and carry on;\n *   - anything else → told FAILED only when the member presses Close, so the explanation stays readable until then.\n * In the window of a host a provider SERVES, Close replaces \"back to the app\" and \"cancel\": going to the home page inside\n * the host's window would leave it open on the application. With no marker, or a marker no provider serves, nothing is\n * loaded and the page is unchanged.\n *\n * Copy is resolved through {@link ChatIdentityLinkLabel} (component `PUBLIC_LAYOUTS_CHAT_IDENTITY_LINK`); the\n * label metadata lives in the companion-scanned `Auth_ChatIdentityLink.labels.ts`. A refusal from the backend\n * (expired, used, replaced, another organization) is shown through the error message it carries.\n */\n\n/** Where the page is in the link's life. */\nenum ChatLinkPageStatus {\n  /** Reading which chat account the link names. */\n  LOADING = 'loading',\n  /** The account is shown; nothing is linked until the member confirms. */\n  READY = 'ready',\n  /** The member confirmed; the link is being completed. */\n  LINKING = 'linking',\n  /** The chat account now acts as the member. */\n  LINKED = 'linked',\n  /** The link cannot be used, or the page was opened without one. */\n  ERROR = 'error',\n}\n\n/** Props for the chat-link page preset. Self-driven from the link's query and the session, so it takes none. */\nexport interface PublicLayoutPreset_ChatIdentityLink_DefaultProps {\n  /** Reserved: the page is URL/session-driven and currently accepts no props. */\n  readonly _selfDriven?: never;\n}\n\nconst COMPONENT = FrontendComponentType.PUBLIC_LAYOUTS_CHAT_IDENTITY_LINK;\n\nfunction operationPathKey(operationIdentifier: ChatIdentityLinks_Operations): string {\n  return ResourcesConfig_OperationPathUtils.createOperationPathKey({\n    resourceIdentifier: CoreResourceType.CHAT_IDENTITY_LINKS,\n    operationIdentifier,\n    variantType: ResourceOperationVariantType.API_CALL,\n    isOperationDefault: true,\n    isBulkOperation: false,\n  });\n}\n\n/** Default preset implementation for {@link FrontendComponentType.PUBLIC_LAYOUTS_CHAT_IDENTITY_LINK}. */\nexport const PublicLayoutPreset_ChatIdentityLink_Default = (\n  _props: PublicLayoutPreset_ChatIdentityLink_DefaultProps,\n): React.JSX.Element => {\n  const { auth } = useUserOrgs();\n  const accessToken = auth?.accessToken;\n  const { tComponent, isReady, formatDateTime } = useI18n({ component: COMPONENT });\n  const t = (key: ChatIdentityLinkLabel, params?: Record<string, string>): string => tComponent(COMPONENT, key, params);\n  const { doOperation } = useResourceRegistry();\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const navigate = useNavigate();\n  const [searchParams, setSearchParams] = useSearchParams();\n\n  // Read once: the token leaves the address bar as soon as the member is signed in (below).\n  const [link] = useState(() => ({\n    organizationId: searchParams.get(ChatIdentityLinkPageQueryParam.ORGANIZATION_ID),\n    token: searchParams.get(ChatIdentityLinkPageQueryParam.TOKEN),\n    host: parseChatIdentityLinkHost(searchParams.get(ChatIdentityLinkPageQueryParam.HOST)),\n  }));\n  const host = useChatSignInCompletion(link.host);\n  const [status, setStatus] = useState<ChatLinkPageStatus>(ChatLinkPageStatus.LOADING);\n  const [preview, setPreview] = useState<ChatIdentityLinkPreview | null>(null);\n  const [failure, setFailure] = useState<string | null>(null);\n  // A synchronous double click must not send two completions; the token is single use either way.\n  const linkingRef = useRef(false);\n  // The preview runs once per link, when the member is signed in. It keys on BEING signed in rather than on the access\n  // token, because a session refresh hands out a new token and must not re-preview a link this page already spent. The\n  // operation runner and the error mapper are read through refs so a provider handing out new function identities\n  // cannot make the page ask again either.\n  const doOperationRef = useRef(doOperation);\n  doOperationRef.current = doOperation;\n  const toMessageRef = useRef(toUserFacingErrorMessage);\n  toMessageRef.current = toUserFacingErrorMessage;\n\n  const requestFor = useCallback(\n    () => ({ contextualParameters: { organizationId: link.organizationId ?? '' }, requestData: { token: link.token ?? '' } }),\n    [link],\n  );\n\n  const signedIn = Boolean(accessToken);\n  useEffect(() => {\n    if (!signedIn) return; // the Navigate guard below sends the visitor to sign in first, link intact\n    if (linkingRef.current) return; // completing or completed: the link is spent, there is nothing left to preview\n    if (searchParams.has(ChatIdentityLinkPageQueryParam.TOKEN)) setSearchParams({}, { replace: true });\n    if (!link.organizationId || !link.token) {\n      setStatus(ChatLinkPageStatus.ERROR);\n      setFailure(null);\n      return;\n    }\n    let cancelled = false;\n    setStatus(ChatLinkPageStatus.LOADING);\n    doOperationRef.current(operationPathKey(ChatIdentityLinks_Operations.PREVIEW_LINK), requestFor())\n      .then((answer: ChatIdentityLinkPreview) => {\n        if (cancelled) return;\n        setPreview(answer);\n        setStatus(ChatLinkPageStatus.READY);\n      })\n      .catch((error: unknown) => {\n        if (cancelled) return;\n        setFailure(toMessageRef.current(error));\n        setStatus(ChatLinkPageStatus.ERROR);\n      });\n    return () => {\n      cancelled = true;\n    };\n    // `searchParams` is read for the strip only; re-running on its change would preview twice.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [signedIn, link, requestFor]);\n\n  const confirm = useCallback(async () => {\n    if (linkingRef.current) return;\n    linkingRef.current = true;\n    setStatus(ChatLinkPageStatus.LINKING);\n    try {\n      await doOperationRef.current(operationPathKey(ChatIdentityLinks_Operations.COMPLETE_LINK), requestFor());\n      setStatus(ChatLinkPageStatus.LINKED);\n    } catch (error) {\n      linkingRef.current = false;\n      setFailure(toMessageRef.current(error));\n      setStatus(ChatLinkPageStatus.ERROR);\n    }\n  }, [requestFor]);\n\n  // A working link is told to the host at once (see the module note); a failure only on Close.\n  const linkWorks = status === ChatLinkPageStatus.LINKED\n    || (status === ChatLinkPageStatus.READY && preview?.standing === ChatIdentityLinkPreviewStanding.LINKED_TO_YOU);\n  const tellHost = host.tell;\n  useEffect(() => {\n    if (linkWorks) void tellHost(ChatSignInCompletionOutcome.SUCCEEDED);\n  }, [linkWorks, tellHost]);\n\n  /**\n   * How the member leaves: home, as always; Close only in the window of a host a provider actually SERVES, telling it\n   * how the sign-in ended. A marker no provider serves (the host's frontend facet not scoped here, or a marked link\n   * opened elsewhere) keeps the way home: a Close that nothing answers would leave the member stuck.\n   */\n  const leaveButton = (labelInTab: ChatIdentityLinkLabel, className?: string) => (!host.hostServed\n    ? <Button variant={ButtonVariants_Variant.OUTLINE} className={className} onClick={() => navigate(CommonRoutePaths.home)}>{t(labelInTab)}</Button>\n    : (\n      <Button\n        variant={ButtonVariants_Variant.OUTLINE}\n        className={className}\n        // A Close that told nobody (a marked link opened outside the host's window, a provider that failed to load)\n        // falls back to the way home, so the member is never left on a button that does nothing.\n        onClick={() => {\n          void tellHost(linkWorks ? ChatSignInCompletionOutcome.SUCCEEDED : ChatSignInCompletionOutcome.FAILED, { repeat: true })\n            .then((told) => { if (told === 0) navigate(CommonRoutePaths.home); });\n        }}\n      >\n        {t(ChatIdentityLinkLabel.CLOSE_HOST_WINDOW)}\n      </Button>\n    ));\n  const backToApp = leaveButton(ChatIdentityLinkLabel.BACK_TO_APP);\n\n  // Not signed in → sign in, returning to this exact link afterwards.\n  if (!accessToken) {\n    const target = buildAuthRedirectTarget({ pathname: CHAT_IDENTITY_LINK_PAGE_PATH, search: `?${searchParams.toString()}` });\n    return <Navigate to={appendAuthRedirectToPath(CommonRoutePaths.login, target)} replace />;\n  }\n\n  if (!isReady || status === ChatLinkPageStatus.LOADING || status === ChatLinkPageStatus.LINKING) {\n    return (\n      <div className=\"py-region flex flex-col items-center gap-element\">\n        <LoadingSpinner />\n        {isReady && <Text>{t(status === ChatLinkPageStatus.LINKING ? ChatIdentityLinkLabel.LINKING : ChatIdentityLinkLabel.LOADING)}</Text>}\n      </div>\n    );\n  }\n\n  if (status === ChatLinkPageStatus.ERROR || !preview) {\n    return (\n      <div className=\"space-y-group\">\n        <Heading>{t(ChatIdentityLinkLabel.ERROR_TITLE)}</Heading>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{failure ?? t(ChatIdentityLinkLabel.ERROR_INCOMPLETE_LINK)}</AlertDescription>\n        </Alert>\n        {backToApp}\n      </div>\n    );\n  }\n\n  if (status === ChatLinkPageStatus.LINKED) {\n    return (\n      <div className=\"space-y-group text-center\">\n        <Heading>{t(ChatIdentityLinkLabel.SUCCESS_TITLE)}</Heading>\n        <Text>{t(ChatIdentityLinkLabel.SUCCESS_MESSAGE)}</Text>\n        {backToApp}\n      </div>\n    );\n  }\n\n  if (preview.standing === ChatIdentityLinkPreviewStanding.LINKED_TO_YOU) {\n    return (\n      <div className=\"space-y-group text-center\">\n        <Heading>{t(ChatIdentityLinkLabel.ALREADY_LINKED_TITLE)}</Heading>\n        <Text>{t(ChatIdentityLinkLabel.ALREADY_LINKED)}</Text>\n        {backToApp}\n      </div>\n    );\n  }\n\n  if (preview.standing === ChatIdentityLinkPreviewStanding.LINKED_TO_ANOTHER_MEMBER) {\n    return (\n      <div className=\"space-y-group\">\n        <Heading>{t(ChatIdentityLinkLabel.LINKED_TO_ANOTHER_TITLE)}</Heading>\n        <Alert variant=\"destructive\">\n          <AlertDescription>{t(ChatIdentityLinkLabel.LINKED_TO_ANOTHER)}</AlertDescription>\n        </Alert>\n        {backToApp}\n      </div>\n    );\n  }\n\n  // The names when the vendor reported them, and the ids always: the names are the chat user's own choice.\n  const accountNames = preview.chatUserDisplayName && preview.workspaceDisplayName\n    ? t(ChatIdentityLinkLabel.ACCOUNT_NAMED, { chatUser: preview.chatUserDisplayName, workspace: preview.workspaceDisplayName })\n    : undefined;\n  const accountIds = t(ChatIdentityLinkLabel.ACCOUNT_IDS, { chatUserId: preview.chatUserId, workspaceId: preview.workspaceRef });\n\n  return (\n    <div className=\"space-y-group\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>{t(ChatIdentityLinkLabel.TITLE)}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(ChatIdentityLinkLabel.INTRO)}</Text>\n      </div>\n      <dl className=\"space-y-item-xs\">\n        <dt><Text className=\"font-medium\">{t(ChatIdentityLinkLabel.ACCOUNT_LABEL)}</Text></dt>\n        <dd className=\"space-y-item-xs\">\n          {accountNames !== undefined && <Text>{accountNames}</Text>}\n          <Text className=\"font-mono text-sm\">{accountIds}</Text>\n        </dd>\n      </dl>\n      <Alert variant=\"warning\">\n        <AlertDescription>{t(ChatIdentityLinkLabel.WARNING_NOT_YOURS)}</AlertDescription>\n      </Alert>\n      <Text className=\"text-sm\">{t(ChatIdentityLinkLabel.EXPIRES_AT, { expiresAt: formatDateTime(preview.expiresAt) })}</Text>\n      <div className=\"flex gap-element\">\n        {leaveButton(ChatIdentityLinkLabel.CANCEL, 'flex-1')}\n        <Button variant={ButtonVariants_Variant.DEFAULT} className=\"flex-1\" onClick={confirm}>\n          {t(ChatIdentityLinkLabel.CONFIRM)}\n        </Button>\n      </div>\n    </div>\n  );\n};\n\n/**\n * Preset-resolving wrapper for the chat-link page (mirrors every other `PUBLIC_LAYOUTS` page), so an application can\n * swap in its own through the component registry. {@link AuthPage_ChatIdentityLink} renders this wrapper.\n */\nexport function Auth_ChatIdentityLink({\n  preset = CorePresetNames.DEFAULT,\n  ...props\n}: PublicLayoutPreset_ChatIdentityLink_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_ChatIdentityLink_DefaultProps>(\n    COMPONENT,\n    'Auth_ChatIdentityLink',\n  )(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_ChatIdentityLink.labels.d.ts

@@ -0,0 +1,3 @@
+import { type LabellingUnitaryDef } from '@wildo-ai/presets-components-models';
+export declare const PublicLayoutsChatIdentityLinkLabels: LabellingUnitaryDef[];
+//# sourceMappingURL=Auth_ChatIdentityLink.labels.d.ts.map

package/dist/esm/components/auth/Auth_ChatIdentityLink.labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_ChatIdentityLink.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_ChatIdentityLink.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAM7C,eAAO,MAAM,mCAAmC,EAAE,mBAAmB,EA0CpE,CAAC"}

package/dist/esm/components/auth/Auth_ChatIdentityLink.labels.js

@@ -0,0 +1,49 @@
+import { ChatIdentityLinkLabel, FrontendComponentType, LabelKind, registerComponentLabels, } from '@wildo-ai/presets-components-models';
+// Companion-only label metadata for the chat-link page (#2660): keys + params + per-key purpose / kind. Statically
+// scanned by the dev companion to plan `components.PUBLIC_LAYOUTS_CHAT_IDENTITY_LINK.*` label generation; NOT
+// imported at runtime, so these description strings never ship in the browser bundle.
+export const PublicLayoutsChatIdentityLinkLabels = [
+    { ref: ChatIdentityLinkLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the page where a signed-in member links a chat account (Slack, Microsoft Teams) to themselves' },
+    { ref: ChatIdentityLinkLabel.INTRO, kind: LabelKind.DESCRIPTION, purpose: 'Explains that once linked, what the chat account approves or asks for in this organization runs with the member\'s own permissions' },
+    { ref: ChatIdentityLinkLabel.LOADING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the page reads which chat account the link names' },
+    { ref: ChatIdentityLinkLabel.ACCOUNT_LABEL, kind: LabelKind.LABEL, purpose: 'Label of the line naming the chat account the link would connect' },
+    {
+        ref: ChatIdentityLinkLabel.ACCOUNT_NAMED,
+        kind: LabelKind.MESSAGE,
+        purpose: 'The chat account, as the chat vendor names the person and the workspace. Shown above the ids, never instead of them: a chat user sets their own name',
+        params: [
+            { key: 'chatUser', meaning: 'The person\'s name in the chat tool, as the chat vendor reported it' },
+            { key: 'workspace', meaning: 'The chat workspace\'s name, as the chat vendor reported it' },
+        ],
+    },
+    {
+        ref: ChatIdentityLinkLabel.ACCOUNT_IDS,
+        kind: LabelKind.MESSAGE,
+        purpose: 'The chat account by the chat vendor\'s own ids for the person and the workspace, always shown, so the member can check it against their own profile in the chat tool',
+        params: [
+            { key: 'chatUserId', meaning: 'The chat vendor\'s own id for the person' },
+            { key: 'workspaceId', meaning: 'The chat vendor\'s own id for the workspace' },
+        ],
+    },
+    { ref: ChatIdentityLinkLabel.EXPIRES_AT, kind: LabelKind.MESSAGE, purpose: 'Says until when the link can be used', params: [{ key: 'expiresAt', meaning: 'The moment the link stops working, already formatted for display' }] },
+    { ref: ChatIdentityLinkLabel.WARNING_NOT_YOURS, kind: LabelKind.MESSAGE, purpose: 'Warns the member to continue only if the named chat account is their own: if someone sent them the link, that person\'s chat account would act as them' },
+    { ref: ChatIdentityLinkLabel.CONFIRM, kind: LabelKind.BUTTON, purpose: 'Links the named chat account to the signed-in member' },
+    { ref: ChatIdentityLinkLabel.CANCEL, kind: LabelKind.BUTTON, purpose: 'Leaves without linking anything' },
+    { ref: ChatIdentityLinkLabel.LINKING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the link is being completed' },
+    { ref: ChatIdentityLinkLabel.SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading once the chat account is linked to the member' },
+    { ref: ChatIdentityLinkLabel.SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Tells the member they can go back to their chat, where the account now acts as them' },
+    { ref: ChatIdentityLinkLabel.ALREADY_LINKED_TITLE, kind: LabelKind.HEADING, purpose: 'Heading when the chat account is already linked to the member' },
+    { ref: ChatIdentityLinkLabel.ALREADY_LINKED, kind: LabelKind.MESSAGE, purpose: 'Says nothing needs doing: the chat account already acts as the member' },
+    { ref: ChatIdentityLinkLabel.LINKED_TO_ANOTHER_TITLE, kind: LabelKind.HEADING, purpose: 'Heading when the chat account is linked to a different member' },
+    { ref: ChatIdentityLinkLabel.LINKED_TO_ANOTHER, kind: LabelKind.MESSAGE, purpose: 'Explains that the other member, or an administrator, must unlink the chat account before it can be linked again' },
+    { ref: ChatIdentityLinkLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading when the link cannot be used (expired, already used, replaced, or for another organization)' },
+    { ref: ChatIdentityLinkLabel.ERROR_INCOMPLETE_LINK, kind: LabelKind.MESSAGE, purpose: 'Error when the page was opened without the organization or the token the bot\'s link carries' },
+    { ref: ChatIdentityLinkLabel.BACK_TO_APP, kind: LabelKind.BUTTON, purpose: 'Goes to the application\'s home page' },
+    {
+        ref: ChatIdentityLinkLabel.CLOSE_HOST_WINDOW,
+        kind: LabelKind.BUTTON,
+        purpose: 'Shown instead of going home when a chat app (Microsoft Teams) opened this page in its own sign-in window: closes that window and returns to the chat',
+    },
+];
+registerComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_CHAT_IDENTITY_LINK, PublicLayoutsChatIdentityLinkLabels);
+//# sourceMappingURL=Auth_ChatIdentityLink.labels.js.map

package/dist/esm/components/auth/Auth_ChatIdentityLink.labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth_ChatIdentityLink.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_ChatIdentityLink.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,SAAS,EAET,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,mHAAmH;AACnH,8GAA8G;AAC9G,sFAAsF;AAEtF,MAAM,CAAC,MAAM,mCAAmC,GAA0B;IACxE,EAAE,GAAG,EAAE,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0GAA0G,EAAE;IAClL,EAAE,GAAG,EAAE,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,oIAAoI,EAAE;IAChN,EAAE,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,2EAA2E,EAAE;IACrJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,kEAAkE,EAAE;IAChJ;QACE,GAAG,EAAE,qBAAqB,CAAC,aAAa;QACxC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,sJAAsJ;QAC/J,MAAM,EAAE;YACN,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,qEAAqE,EAAE;YACnG,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,4DAA4D,EAAE;SAC5F;KACF;IACD;QACE,GAAG,EAAE,qBAAqB,CAAC,WAAW;QACtC,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,OAAO,EAAE,sKAAsK;QAC/K,MAAM,EAAE;YACN,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,0CAA0C,EAAE;YAC1E,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,6CAA6C,EAAE;SAC/E;KACF;IACD,EAAE,GAAG,EAAE,qBAAqB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,EAAE;IAChO,EAAE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,wJAAwJ,EAAE;IAC5O,EAAE,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,sDAAsD,EAAE;IAC/H,EAAE,GAAG,EAAE,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACzG,EAAE,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sDAAsD,EAAE;IAChI,EAAE,GAAG,EAAE,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACvI,EAAE,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qFAAqF,EAAE;IACvK,EAAE,GAAG,EAAE,qBAAqB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACtJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE;IACxJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACzJ,EAAE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iHAAiH,EAAE;IACrM,EAAE,GAAG,EAAE,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qGAAqG,EAAE;IACnL,EAAE,GAAG,EAAE,qBAAqB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8FAA8F,EAAE;IACtL,EAAE,GAAG,EAAE,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,sCAAsC,EAAE;IACnH;QACE,GAAG,EAAE,qBAAqB,CAAC,iBAAiB;QAC5C,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,sJAAsJ;KAChK;CACF,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,iCAAiC,EAAE,mCAAmC,CAAC,CAAC","sourcesContent":["import {\n  ChatIdentityLinkLabel,\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the chat-link page (#2660): keys + params + per-key purpose / kind. Statically\n// scanned by the dev companion to plan `components.PUBLIC_LAYOUTS_CHAT_IDENTITY_LINK.*` label generation; NOT\n// imported at runtime, so these description strings never ship in the browser bundle.\n\nexport const PublicLayoutsChatIdentityLinkLabels: LabellingUnitaryDef[] = [\n  { ref: ChatIdentityLinkLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the page where a signed-in member links a chat account (Slack, Microsoft Teams) to themselves' },\n  { ref: ChatIdentityLinkLabel.INTRO, kind: LabelKind.DESCRIPTION, purpose: 'Explains that once linked, what the chat account approves or asks for in this organization runs with the member\\'s own permissions' },\n  { ref: ChatIdentityLinkLabel.LOADING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the page reads which chat account the link names' },\n  { ref: ChatIdentityLinkLabel.ACCOUNT_LABEL, kind: LabelKind.LABEL, purpose: 'Label of the line naming the chat account the link would connect' },\n  {\n    ref: ChatIdentityLinkLabel.ACCOUNT_NAMED,\n    kind: LabelKind.MESSAGE,\n    purpose: 'The chat account, as the chat vendor names the person and the workspace. Shown above the ids, never instead of them: a chat user sets their own name',\n    params: [\n      { key: 'chatUser', meaning: 'The person\\'s name in the chat tool, as the chat vendor reported it' },\n      { key: 'workspace', meaning: 'The chat workspace\\'s name, as the chat vendor reported it' },\n    ],\n  },\n  {\n    ref: ChatIdentityLinkLabel.ACCOUNT_IDS,\n    kind: LabelKind.MESSAGE,\n    purpose: 'The chat account by the chat vendor\\'s own ids for the person and the workspace, always shown, so the member can check it against their own profile in the chat tool',\n    params: [\n      { key: 'chatUserId', meaning: 'The chat vendor\\'s own id for the person' },\n      { key: 'workspaceId', meaning: 'The chat vendor\\'s own id for the workspace' },\n    ],\n  },\n  { ref: ChatIdentityLinkLabel.EXPIRES_AT, kind: LabelKind.MESSAGE, purpose: 'Says until when the link can be used', params: [{ key: 'expiresAt', meaning: 'The moment the link stops working, already formatted for display' }] },\n  { ref: ChatIdentityLinkLabel.WARNING_NOT_YOURS, kind: LabelKind.MESSAGE, purpose: 'Warns the member to continue only if the named chat account is their own: if someone sent them the link, that person\\'s chat account would act as them' },\n  { ref: ChatIdentityLinkLabel.CONFIRM, kind: LabelKind.BUTTON, purpose: 'Links the named chat account to the signed-in member' },\n  { ref: ChatIdentityLinkLabel.CANCEL, kind: LabelKind.BUTTON, purpose: 'Leaves without linking anything' },\n  { ref: ChatIdentityLinkLabel.LINKING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the link is being completed' },\n  { ref: ChatIdentityLinkLabel.SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading once the chat account is linked to the member' },\n  { ref: ChatIdentityLinkLabel.SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Tells the member they can go back to their chat, where the account now acts as them' },\n  { ref: ChatIdentityLinkLabel.ALREADY_LINKED_TITLE, kind: LabelKind.HEADING, purpose: 'Heading when the chat account is already linked to the member' },\n  { ref: ChatIdentityLinkLabel.ALREADY_LINKED, kind: LabelKind.MESSAGE, purpose: 'Says nothing needs doing: the chat account already acts as the member' },\n  { ref: ChatIdentityLinkLabel.LINKED_TO_ANOTHER_TITLE, kind: LabelKind.HEADING, purpose: 'Heading when the chat account is linked to a different member' },\n  { ref: ChatIdentityLinkLabel.LINKED_TO_ANOTHER, kind: LabelKind.MESSAGE, purpose: 'Explains that the other member, or an administrator, must unlink the chat account before it can be linked again' },\n  { ref: ChatIdentityLinkLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading when the link cannot be used (expired, already used, replaced, or for another organization)' },\n  { ref: ChatIdentityLinkLabel.ERROR_INCOMPLETE_LINK, kind: LabelKind.MESSAGE, purpose: 'Error when the page was opened without the organization or the token the bot\\'s link carries' },\n  { ref: ChatIdentityLinkLabel.BACK_TO_APP, kind: LabelKind.BUTTON, purpose: 'Goes to the application\\'s home page' },\n  {\n    ref: ChatIdentityLinkLabel.CLOSE_HOST_WINDOW,\n    kind: LabelKind.BUTTON,\n    purpose: 'Shown instead of going home when a chat app (Microsoft Teams) opened this page in its own sign-in window: closes that window and returns to the chat',\n  },\n];\n\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_CHAT_IDENTITY_LINK, PublicLayoutsChatIdentityLinkLabels);\n"]}

package/dist/esm/components/auth/Auth_Invitation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Invitation.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Invitation.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAqDjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAwRxH,MAAM,WAAW,8CAA8C;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,yCAAyC,GAAI,mBAGvD,8CAA8C,KAAG,KAAK,CAAC,GAAG,CAAC,OAmnB7D,CAAC;AAEF,wBAAgB,eAAe,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,8CAA8C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGxK"}
+{"version":3,"file":"Auth_Invitation.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Invitation.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAsDjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAwRxH,MAAM,WAAW,8CAA8C;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,yCAAyC,GAAI,mBAGvD,8CAA8C,KAAG,KAAK,CAAC,GAAG,CAAC,OA2nB7D,CAAC;AAEF,wBAAgB,eAAe,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,8CAA8C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAGxK"}

package/dist/esm/components/auth/Auth_Invitation.js

@@ -20,6 +20,7 @@ import { SubmitButton } from '../../components/resources/skeleton/SubmitButton.j
 import { LoadingSpinner } from '../../components/feedback/loading-spinner.js';
 import { Heading } from '../../components/typography/heading.js';
 import { AuthSecondaryLink } from '../../components/auth/utils/AuthSecondaryLink.js';
+import { AuthPrivacyNoticeLink } from '../../components/auth/utils/AuthPrivacyNoticeLink.js';
 import { Text } from '../../components/typography/text.js';
 import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
@@ -545,7 +546,7 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
     // SCIM-managed org → informational only, NO password/method form (locked decision:
     // the directory is the identity authority, so no local credential is set here).
     if (invitationInfo.managementMode === InvitationManagementMode.SCIM) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.SCIM_MANAGED_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.SCIM_MANAGED_MESSAGE) }), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), declineError && (_jsx(Alert, { variant: "destructive", className: "mb-group", children: _jsx(AlertDescription, { children: declineError }) })), _jsxs("div", { className: "text-center mt-group space-y-item-sm", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleDecline, disabled: isDeclining, className: "w-full", children: isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION) }), _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) })] })] }));
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.SCIM_MANAGED_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.SCIM_MANAGED_MESSAGE) }), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), declineError && (_jsx(Alert, { variant: "destructive", className: "mb-group", children: _jsx(AlertDescription, { children: declineError }) })), _jsxs("div", { className: "text-center mt-group space-y-item-sm", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleDecline, disabled: isDeclining, className: "w-full", children: isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION) }), _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }), _jsx(AuthPrivacyNoticeLink, { label: tAuth(UserAuthLabel.PRIVACY_NOTICE_LINK) })] })] }));
     }
     // OPEN / SSO org → the method chooser.
     return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.SUB_TITLE) }), invitationInfo.organizationName && (_jsx(Text, { className: "text-sm text-muted-foreground", children: invitationInfo.organizationName })), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), hasActionableMethod ? (_jsxs(_Fragment, { children: [_jsx(Text, { className: "text-sm text-muted-foreground text-center mb-element", children: t(UserInvitationLabel.METHOD_CHOICE_HINT) }), renderActiveMethod(), alternativeMethods.length > 0 && (_jsxs(_Fragment, { children: [_jsx(LabeledDivider, { label: tAuth(UserAuthLabel.OTHER_METHODS_DIVIDER) }), _jsx(AuthMethodChoiceList, { methods: alternativeMethods.map((method) => method.method), 
@@ -570,7 +571,7 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
               resolved, yielding an empty set with mode OPEN. Route the invitee to the sign-in page,
               where email→domain SSO resolution works and the enterprise / OAuth JIT consumes the invite.
             */
-            _jsx(Alert, { children: _jsx(AlertDescription, { children: t(UserInvitationLabel.NO_METHOD_AVAILABLE_HINT) }) })), declineError && (_jsx(Alert, { variant: "destructive", className: "mt-group", children: _jsx(AlertDescription, { children: declineError }) })), _jsxs("div", { className: "text-center mt-group space-y-item-sm", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleDecline, disabled: methodSubmitInFlight || isDeclining, className: "w-full", children: isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION) }), _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) })] })] }));
+            _jsx(Alert, { children: _jsx(AlertDescription, { children: t(UserInvitationLabel.NO_METHOD_AVAILABLE_HINT) }) })), declineError && (_jsx(Alert, { variant: "destructive", className: "mt-group", children: _jsx(AlertDescription, { children: declineError }) })), _jsxs("div", { className: "text-center mt-group space-y-item-sm", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleDecline, disabled: methodSubmitInFlight || isDeclining, className: "w-full", children: isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION) }), _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }), _jsx(AuthPrivacyNoticeLink, { label: tAuth(UserAuthLabel.PRIVACY_NOTICE_LINK) })] })] }));
 };
 export function Auth_Invitation({ preset = CorePresetNames.DEFAULT, ...props }) {
     const Component = createComponentResolver(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, 'Auth_Invitation')(preset);

package/dist/esm/components/auth/Auth_Invitation.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Invitation.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Invitation.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AACjI,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,wBAAwB,EACxB,2BAA2B,GAM5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAE5F,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EAAE,cAAc,EAAE,MAAM,0DAA0D,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gEAAgE,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACxI,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EACL,iCAAiC,GAClC,MAAM,6EAA6E,CAAC;AACrF,OAAO,EACL,sBAAsB,GAEvB,MAAM,oEAAoE,CAAC;AAG5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAE1H;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,6BAA6B,GAA4B,IAAI,GAAG,CAAC;IACrE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,eAAe;IAC1B,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAA0C,CAAC,EACrE,eAAe,EACf,cAAc,GACf,EAAE,EAAE;IACH,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,8BAA8B;KAChE,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAEjG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,+BAA+B,IAAC,KAAK,EAAE,eAAe,GAAI,EAC3D,KAAC,SAAS,IAAC,IAAI,EAAC,WAAW,GAAG,EAC9B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAC7B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAC7B,KAAC,SAAS,IAAC,IAAI,EAAC,iBAAiB,GAAG,EAEpC,KAAC,yBAAyB,IAAC,SAAS,EAAC,UAAU,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,GAAI,EAE/E,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAC/C,eAAe,EAAE,CAAC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,EAC5D,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,2BAA2B,GAI5B,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IACrC,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,OAAO,CACL,MAAC,UAAU,eACR,eAAe,IAAI,CAClB,KAAC,IAAI,IAAC,SAAS,EAAC,2CAA2C,YAAE,eAAe,GAAQ,CACrF,EACD,KAAC,SAAS,IAAC,IAAI,EAAC,WAAW,GAAG,EAC9B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAE5B,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,EAC3C,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,EACrD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,uBAAuB,GAMxB,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IACzD,MAAM,cAAc,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACxD,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,4FAA4F;IAC5F,mEAAmE;IACnE,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC3E,EAAE,CACH,CAAC;IAEF,gGAAgG;IAChG,+FAA+F;IAC/F,kFAAkF;IAClF,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,IAA+C,EAAE,EAAE;QACzF,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACvC,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE5C,OAAO,CACL,KAAC,aAAa,IACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC9C,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,EACvE,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,SAAS,EAAE,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;gBAC5C,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;aAC3C;SACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,CACpB,KAAC,2BAA2B,IAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,GAAI,CACtF,GACD,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,yBAAyB,GAI1B,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CACtC,MAAC,UAAU,eACR,eAAe,IAAI,CAClB,KAAC,IAAI,IAAC,SAAS,EAAC,2CAA2C,YAAE,eAAe,GAAQ,CACrF,EACD,KAAC,IAAI,IAAC,SAAS,EAAC,2CAA2C,YACxD,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,GACtC,EACP,KAAC,SAAS,IAAC,IAAI,EAAC,WAAW,GAAG,EAC9B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAE5B,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAC5C,eAAe,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,EACxD,SAAS,SACT,IACS,CACd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB,GAMtB,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE;IACzD,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IAClF,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC3E,EAAE,CACH,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CACL,KAAC,KAAK,cACJ,KAAC,gBAAgB,cACd,CAAC,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,GAC/B,GACb,CACT,CAAC;IACJ,CAAC;IAED,OAAO,CACL,KAAC,aAAa,IACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC9C,QAAQ,EAAE,CAAC,IAA+C,EAAE,EAAE,CAC5D,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,EACnF,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,SAAS,EAAE,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;gBAC5C,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;aAC3C;SACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,CACpB,KAAC,yBAAyB,IAAC,eAAe,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAI,CACpF,GACD,CACH,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,EACxD,KAAK,EACL,KAAK,GAC0C,EAAqB,EAAE;IACtE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE,CAAC;IACpD,kGAAkG;IAClG,qGAAqG;IACrG,8FAA8F;IAC9F,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAE7C,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,cAAc,GAAG,OAAO,CAC5B,GAAG,EAAE,CAAC;QACJ,qBAAqB,CAAC,8BAA8B;QACpD,qBAAqB,CAAC,wBAAwB;KAC/C,EACD,EAAE,CACH,CAAC;IACF,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACtE,gGAAgG;IAChG,kGAAkG;IAClG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACtE,6FAA6F;IAC7F,8FAA8F;IAC9F,4FAA4F;IAC5F,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,0FAA0F;IAC1F,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,iGAAiG;IACjG,+FAA+F;IAC/F,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAoC,IAAI,CAAC,CAAC;IAC9F,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAChE,kFAAkF;IAClF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAC;IAE1E,6FAA6F;IAC7F,iGAAiG;IACjG,iGAAiG;IACjG,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5H,kFAAkF;IAClF,6EAA6E;IAC7E,gFAAgF;IAChF,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,KAAK,GAAG,WAAW,CACvB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAChF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,iFAAiF;IACjF,uFAAuF;IACvF,MAAM,uBAAuB,GAAG,OAAO,CACrC,GAAG,EAAE,CAAC,0BAA0B,CAAC,UAAU,EAAE,qBAAqB,CAAC,wBAAwB,CAAC,EAC5F,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC,qFAAqF;IACrF,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpG,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5G,oFAAoF;IACpF,2CAA2C;IAC3C,MAAM,YAAY,GAAG,cAAc,EAAE,YAAY,IAAI,KAAK,CAAC;IAE3D,sFAAsF;IACtF,uFAAuF;IACvF,wFAAwF;IACxF,oCAAoC;IACpC,MAAM,cAAc,GAAwB,OAAO,CACjD,GAAG,EAAE,CAAC,cAAc,EAAE,cAAc,IAAI,YAAY,CAAC,cAAc,IAAI,uBAAuB,EAC9F,CAAC,cAAc,EAAE,cAAc,EAAE,YAAY,CAAC,cAAc,CAAC,CAC9D,CAAC;IAEF,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAC3E,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,eAAe,EAClE,EAAE,OAAO,EAAE,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CACjF,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAER,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,WAAwB,EAAE,EAAE;QAC/D,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IACvC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,6EAA6E;IAC7E,gFAAgF;IAChF,SAAS,CAAC,GAAG,EAAE;QACb,mFAAmF;QACnF,kFAAkF;QAClF,iFAAiF;QACjF,qCAAqC;QACrC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,cAAc,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,wBAAwB,EAAE;aACvB,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACb,IAAI,CAAC,SAAS;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACpB,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACrG,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,8FAA8F;QAC9F,8FAA8F;QAC9F,oGAAoG;QACpG,gGAAgG;QAChG,sDAAsD;QACtD,uDAAuD;IACzD,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE9B;;;;;;OAMG;IACH,MAAM,gBAAgB,GAAsB,OAAO,CAAC,GAAG,EAAE;QACvD,MAAM,OAAO,GAAG,cAAc,EAAE,2BAA2B,IAAI,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC,CAAC;IAC1F,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAErB,6FAA6F;IAC7F,6FAA6F;IAC7F,sEAAsE;IACtE,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAExD,kGAAkG;IAClG,6FAA6F;IAC7F,oEAAoE;IACpE,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,IAAI,mBAAmB,IAAI,yBAAyB,CAAC;IAEhG,2DAA2D;IAC3D,MAAM,aAAa,GAAG,OAAO,CAC3B,GAAG,EAAE,CAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAiC,IAAI,IAAI,EACrE,CAAC,gBAAgB,CAAC,CACnB,CAAC;IAEF,MAAM,mBAAmB,GAAG,YAAY,IAAI,aAAa,CAAC;IAC1D,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;IAE5F;;;;;OAKG;IACH,4BAA4B,CAAC;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,KAAK,EAAE,YAAY,IAAI,SAAS;QAChC,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,EAAE,IAA2B,EAAE,EAAE;QAC/E,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC5F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,iCAAiC,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClG,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,KAAc,EAAsB,EAAE;YAC3D,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACvC,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;gBACpC,eAAe,EAAE,KAAM;gBACvB,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;gBACxC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;aACrC,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,cAAc;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpD,8EAA8E;YAC9E,oHAAoH;QACtH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACvC,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE3E,iGAAiG;IACjG,oFAAoF;IACpF,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,EAAE,SAAkB,EAAE,QAAiB,EAAiB,EAAE;QACrG,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;gBACpC,eAAe,EAAE,KAAM;gBACvB,SAAS;gBACT,QAAQ;gBACR,gBAAgB,EAAE,UAAU,CAAC,OAAO;aACrC,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,cAAc,EAAE,CAAC;gBAC3B,yFAAyF;gBACzF,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,EAAE,0BAA0B,CAAC;YACnD,IAAI,OAAO,EAAE,CAAC;gBACZ,uFAAuF;gBACvF,oFAAoF;gBACpF,sCAAsC;gBACtC,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAA4D,EAAE,CAAC,CAAC;oBAC1H,MAAM,wBAAwB,EAAE,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC;oBACP,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,gGAAgG;gBAClG,CAAC;YACH,CAAC;YACD,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;QAChG,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,eAAe,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACT,4BAA4B,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE3D,2FAA2F;IAC3F,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,qBAAqB,GAAG,WAAW,CAAC,KAAK,EAAE,SAAkB,EAAE,QAAiB,EAAiB,EAAE;QACvG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,gBAAgB,CAAC;gBACjE,eAAe,EAAE,KAAM;gBACvB,SAAS;gBACT,QAAQ;gBACR,gBAAgB,EAAE,UAAU,CAAC,UAAU;gBACvC,sGAAsG;gBACtG,qGAAqG;gBACrG,QAAQ,EAAE,kBAAkB;aAC7B,CAAC,CAAC;YACH,uGAAuG;YACvG,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,gBAAgB;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;;gBAC5E,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,gGAAgG;YAChG,kGAAkG;YAClG,8FAA8F;YAC9F,gEAAgE;YAChE,WAAW,CAAC,CAAC,EAAE,2CAA2C,EAAE,EAAE,gBAAgB,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;YACzG,MAAM,CAAC,CAAC;QACV,CAAC;gBAAS,CAAC;YACT,2FAA2F;YAC3F,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAE7C,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,WAAW,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,eAAe,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEzC,mFAAmF;IACnF,oFAAoF;IACpF,kFAAkF;IAClF,sBAAsB;IACtB,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,SAAiC,EAAE,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,MAAc,EAAE,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,MAAM,kBAAkB,GAAG,GAAoB,EAAE;QAC/C,IAAI,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAE/B,IAAI,mBAAmB,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;YAChD,OAAO,CACL,KAAC,aAAa,IACZ,MAAM,EAAE,oBAAoB,EAC5B,aAAa,EAAE;oBACb,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,EAAE;oBACZ,eAAe,EAAE,EAAE;iBACpB,EACD,QAAQ,EAAE,sBAAsB,EAChC,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW,EACvC,WAAW,EAAE,eAAe,EAC5B,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,SAAS,EAAE,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;wBAC5C,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;wBAC1C,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;wBACzC,eAAe,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;qBACzD;iBACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,KAAC,sBAAsB,IAAC,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,GAAI,GAC/G,CACH,CAAC;QACJ,CAAC;QAED,IAAI,mBAAmB,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;YAClD,kFAAkF;YAClF,iFAAiF;YACjF,uFAAuF;YACvF,wEAAwE;YACxE,OAAO,CACL,KAAC,uBAAuB,IACtB,eAAe,EAAE,YAAY,EAC7B,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW,EACvC,QAAQ,EAAE,qBAAqB,EAC/B,CAAC,EAAE,CAAC,EACJ,KAAK,EAAE,KAAK,GACZ,CACH,CAAC;QACJ,CAAC;QAED,IAAI,mBAAmB,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YAC/C,qFAAqF;YACrF,2EAA2E;YAC3E,sFAAsF;YACtF,kFAAkF;YAClF,OAAO,CACL,KAAC,qBAAqB,IACpB,eAAe,EAAE,YAAY,EAC7B,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW,EACvC,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,CAAC,EAAE,CAAC,GACJ,CACH,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,gFAAgF;QAChF,sFAAsF;QACtF,uFAAuF;QACvF,uFAAuF;QACvF,MAAM,eAAe,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,KAAK,GAA6B;YACtC,SAAS,EAAE,EAAE,EAAE,6CAA6C;YAC5D,KAAK,EAAE,YAAY,IAAI,EAAE;YACzB,YAAY;YACZ,SAAS,EAAE,mBAAmB;YAC9B,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW;YACxC,CAAC,EAAE,uBAAuB;SAC3B,CAAC;QAEF,OAAO,KAAC,eAAe,OAAK,KAAK,GAAI,CAAC;IACxC,CAAC,CAAC;IAEF,oFAAoF;IACpF,uFAAuF;IACvF,gFAAgF;IAChF,kDAAkD;IAClD,8FAA8F;IAC9F,6FAA6F;IAC7F,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACnD,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,GAAW,EACvD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAQ,IAC3E,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,GACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,GAAW,EACjE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,GAAQ,IACtF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,aAAa,CAAC,GAAqB,GAC1F,IACL,CACJ,CAAC;IACJ,CAAC;IAED,qHAAqH;IACrH,sFAAsF;IACtF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,GAAW,EAClE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,GAAQ,IACvF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,GACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,gGAAgG;IAChG,oCAAoC;IACpC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAW,EAC/D,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,GAAQ,EAC3F,YAAY,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,YAAY,GAAQ,CACtE,IACG,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,GACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CACL,cAAK,SAAS,EAAC,2CAA2C,YACxD,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,GAAI,GACxB,CACP,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;QACjC,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,GAAW,EACvD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,SAAS,IAAI,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAQ,IACxF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,GACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,gFAAgF;IAChF,IAAI,cAAc,CAAC,cAAc,KAAK,wBAAwB,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,GAAW,EAC9D,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAC/B,CAAC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,GACvC,EACN,YAAY,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,YAAY,GAAQ,CACtE,IACG,EAEL,YAAY,IAAI,CACf,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,EAAC,SAAS,EAAC,UAAU,YAC/C,KAAC,gBAAgB,cAAE,YAAY,GAAoB,GAC7C,CACT,EAED,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAC,QAAQ,YAEjB,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,GAC/F,EACT,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,IACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAW,EACjD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAQ,EAC3E,cAAc,CAAC,gBAAgB,IAAI,CAClC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,cAAc,CAAC,gBAAgB,GAAQ,CACzF,EACA,YAAY,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,YAAY,GAAQ,CACtE,IACG,EAEL,mBAAmB,CAAC,CAAC,CAAC,CACrB,8BACE,KAAC,IAAI,IAAC,SAAS,EAAC,sDAAsD,YACnE,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,GACrC,EAGN,kBAAkB,EAAE,EAGpB,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,CAChC,8BACE,KAAC,cAAc,IAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAI,EAErE,KAAC,oBAAoB,IACnB,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAoB,CAAC;gCACxE;;;;;;;mCAOG;gCACH,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,EAAE;oCACzD,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;oCAClF,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC;oCACxD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;oCACvC,0BAA0B,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW;iCACvF,CAAC,EACF,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACzE,QAAQ,EAAE,oBAAoB,IAAI,WAAW,GAC7C,IACD,CACJ,IACA,CACJ,CAAC,CAAC,CAAC;YACF;;;;;;cAME;YACF,KAAC,KAAK,cACJ,KAAC,gBAAgB,cACd,CAAC,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,GAC/B,GACb,CACT,EAEA,YAAY,IAAI,CACf,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,EAAC,SAAS,EAAC,UAAU,YAC/C,KAAC,gBAAgB,cAAE,YAAY,GAAoB,GAC7C,CACT,EAED,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,oBAAoB,IAAI,WAAW,EAC7C,SAAS,EAAC,QAAQ,YAEjB,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,GAC/F,EACT,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,IACvF,IACL,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyE;IACnJ,MAAM,SAAS,GAAG,uBAAuB,CAAiD,qBAAqB,CAAC,8BAA8B,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate, useLocation } from 'react-router-dom';\nimport { useFormContext } from 'react-hook-form';\nimport { CorePresetNames, FrontendComponentType, UserAuthLabel, UserInvitationLabel } from '@wildo-ai/presets-components-models';\nimport {\n  AuthNextStep,\n  AuthMethod,\n  AuthUtils,\n  InvitationManagementMode,\n  UserInvitationFormDtoSchema,\n  type AuthenticationResponse,\n  type AuthInvitationInfoResponse,\n  type AvailableMethod,\n  type PasswordPolicyRules,\n  type UserInvitationFormDto,\n} from '@wildo-ai/saas-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport { startRegistration } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/browser';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { type FormMethods } from '~wildo-frontend-lib/components/form/Form';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { PasswordStrengthIndicator, DEFAULT_PASSWORD_POLICY } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport { LabeledDivider } from '~wildo-frontend-lib/components/auth/utils/LabeledDivider';\nimport { AuthMethodChoiceList } from '~wildo-frontend-lib/components/auth/utils/AuthMethodChoiceList';\nimport { resolveAuthMethodChoiceLabel } from '~wildo-frontend-lib/components/auth/methods/auth-method-presentation';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { AuthSecondaryLink } from '~wildo-frontend-lib/components/auth/utils/AuthSecondaryLink';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { makeComponentLabelResolver } from '~wildo-frontend-lib/core/i18n/component-label-resolution.utils';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useError } from '~wildo-frontend-lib/core/errors/useError';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport { extractAuthRedirectFromSearch, resolvePostAuthRedirect } from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { useMfaContinuationNavigation } from '~wildo-frontend-lib/components/auth/utils/useMfaContinuationNavigation';\nimport {\n  resolvePasswordViolationsToLabels,\n} from '~wildo-frontend-lib/components/auth/utils/resolvePasswordViolationsToLabels';\nimport {\n  AUTH_METHOD_COMPONENTS,\n  type AuthMethodComponentProps,\n} from '~wildo-frontend-lib/components/auth/methods/auth-method-components';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * First-factor methods the PUBLIC invitation-accept chooser knows how to render.\n *\n * The invitation-info endpoint returns whatever the org allows for a joining member,\n * but the chooser can only surface methods that are usable BEFORE the invitee has an\n * account/session:\n *  - `PASSWORD` / `MAGIC_LINK` / `PASSKEY` → invitation-specific accept sub-forms that drive\n *    `acceptInvitation` (set a password / email a link / enroll a passkey). NOT the login\n *    method components — those authenticate an EXISTING account, which an invitee lacks. In\n *    particular the login magic-link (`magicLinkSend`) is ACTIVE-only and never accepts the\n *    invite; the passkey login component authenticates an already-enrolled credential.\n *  - `ORG_SAML` / `ORG_OPENID_CONNECT` / `EXTERNAL_OAUTH2` → the shared login method\n *    components, which are account-agnostic (full-page redirect) and consume the `INVITED`\n *    membership via enterprise-SSO JIT / OAuth JIT (email match on the live membership, no token).\n *\n * Session-bound MFA methods (`SMS_OTP` / `EMAIL_OTP` / `TOTP`) are intentionally\n * excluded — they need a session the invitee does not have.\n */\nconst INVITATION_RENDERABLE_METHODS: ReadonlySet<AuthMethod> = new Set([\n  AuthMethod.PASSWORD,\n  AuthMethod.ORG_SAML,\n  AuthMethod.ORG_OPENID_CONNECT,\n  AuthMethod.EXTERNAL_OAUTH2,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n]);\n\n\ninterface InvitationFormTemplateProps {\n  invitationEmail?: string;\n  /**\n   * The effective (org-merged) password policy the parent resolved from the\n   * invitation-info response — the SAME policy the backend accept endpoint enforces —\n   * falling back to the app-level policy. Passed in (not read from `useResolvedAuthConfig`\n   * here) so the strength indicator matches what the org actually requires.\n   */\n  passwordPolicy: PasswordPolicyRules;\n}\n\n/**\n * Password-method accept form body — first/last name + optional password with the\n * strength indicator + a hidden username field for password-manager autofill.\n *\n * Rendered only when `PASSWORD` is the active chooser method. Password is OPTIONAL\n * here (a passwordless accept creates the account and the user adds a credential\n * later); the enclosing chooser owns the method-choice hint, so this template no\n * longer renders a standalone \"password is optional\" aside.\n */\nconst InvitationFormTemplate: React.FC<InvitationFormTemplateProps> = ({\n  invitationEmail,\n  passwordPolicy,\n}) => {\n  const { formState } = useFormContext();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION,\n  });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, key);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <CredentialUsernameAutofillField email={invitationEmail} />\n      <FormField name=\"firstName\" />\n      <FormField name=\"lastName\" />\n      <FormField name=\"password\" />\n      <FormField name=\"confirmPassword\" />\n\n      <PasswordStrengthIndicator fieldName=\"password\" policy={passwordPolicy} t={t} />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserInvitationLabel.ACCEPT_INVITATION)}\n        submittingLabel={t(UserInvitationLabel.ACCEPTING_INVITATION)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Body of the magic-link accept sub-form (first/last name + send button). Split out so it\n * can read `formState.errors.root` via `useFormContext` inside the `AutomatedForm` provider.\n */\nconst InvitationMagicLinkTemplate: React.FC<{\n  invitationEmail?: string;\n  t: (key: string) => string;\n  tAuth: (key: string) => string;\n}> = ({ invitationEmail, t, tAuth }) => {\n  const { formState } = useFormContext();\n  return (\n    <FormLayout>\n      {invitationEmail && (\n        <Text className=\"text-sm text-muted-foreground text-center\">{invitationEmail}</Text>\n      )}\n      <FormField name=\"firstName\" />\n      <FormField name=\"lastName\" />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={tAuth(UserAuthLabel.MAGIC_LINK_SEND)}\n        submittingLabel={tAuth(UserAuthLabel.MAGIC_LINK_SEND)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Magic-link ACCEPT sub-form — the invitation-aware counterpart of the login\n * `MagicLinkAuthMethod`.\n *\n * The login component sends a *login* magic link via `magicLinkSend`, which never accepts\n * the invitation: `sendMagicLink` resolves users ACTIVE-only, so a not-yet-activated\n * (`PENDING_INVITATION`) invitee gets no email, and `verifyMagicLink` rejects any non-ACTIVE\n * user and never flips the INVITED membership. So it is NOT reused here.\n *\n * Instead this drives the purpose-built `acceptInvitation({ credentialMethod: MAGIC_LINK })`\n * endpoint, which ACTIVATES the invitee + flips the membership FIRST and only THEN mints +\n * emails the link — so the eventual `verifyMagicLink` click (now ACTIVE) establishes the\n * session. First/last name are collected because the accept DTO requires them (the invitee's\n * profile is seeded at acceptance). No session is issued (the parent switches to a terminal\n * \"check your email\" state); the session lands when the invitee clicks the emailed link.\n */\nconst InvitationMagicLinkForm: React.FC<{\n  invitationEmail?: string;\n  disabled?: boolean;\n  onSubmit: (firstName?: string, lastName?: string) => Promise<void>;\n  t: (key: string) => string;\n  tAuth: (key: string) => string;\n}> = ({ invitationEmail, disabled, onSubmit, t, tAuth }) => {\n  const formMethodsRef = useRef<FormMethods | null>(null);\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  // Only the name fields — reuse the accept form schema's first/last (with their autocomplete\n  // decorators); the credential is the emailed link, not a password.\n  const schema = useMemo(\n    () => UserInvitationFormDtoSchema.pick({ firstName: true, lastName: true }),\n    [],\n  );\n\n  // On success the PARENT switches to the terminal \"check your email\" state — the accept consumed\n  // the token + accepted the invite, so there is NO in-place \"sent\" / \"try another method\" state\n  // (that would dead-end on the now-consumed token). Only errors are surfaced here.\n  const handleSubmit = useCallback(async (data: { firstName?: string; lastName?: string }) => {\n    formMethodsRef.current?.clearErrors('root');\n    try {\n      await onSubmit(data.firstName?.trim() || undefined, data.lastName?.trim() || undefined);\n    } catch (e: unknown) {\n      formMethodsRef.current?.setError('root', {\n        type: 'server',\n        message: toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)),\n      });\n    }\n  }, [onSubmit, t, toUserFacingErrorMessage]);\n\n  return (\n    <AutomatedForm\n      schema={schema}\n      defaultValues={{ firstName: '', lastName: '' }}\n      onSubmit={handleSubmit}\n      validationMode={ValidationMode.ON_BLUR}\n      disabled={disabled}\n      onFormReady={(formMethods) => { formMethodsRef.current = formMethods; }}\n      labels={{\n        fields: {\n          firstName: t(UserInvitationLabel.FIRST_NAME),\n          lastName: t(UserInvitationLabel.LAST_NAME),\n        },\n      }}\n      layoutTemplate={() => (\n        <InvitationMagicLinkTemplate invitationEmail={invitationEmail} t={t} tAuth={tAuth} />\n      )}\n    />\n  );\n};\n\n/**\n * Body of the passkey accept sub-form. The ceremony error is owned by the parent (the WebAuthn\n * flow runs outside the form), so it is passed in rather than read from `formState`.\n */\nconst InvitationPasskeyTemplate: React.FC<{\n  invitationEmail?: string;\n  error?: string | null;\n  t: (key: string) => string;\n}> = ({ invitationEmail, error, t }) => (\n  <FormLayout>\n    {invitationEmail && (\n      <Text className=\"text-sm text-muted-foreground text-center\">{invitationEmail}</Text>\n    )}\n    <Text className=\"text-sm text-muted-foreground text-center\">\n      {t(UserInvitationLabel.PASSKEY_DESCRIPTION)}\n    </Text>\n    <FormField name=\"firstName\" />\n    <FormField name=\"lastName\" />\n\n    {error && (\n      <Alert variant=\"destructive\">\n        <AlertDescription>{error}</AlertDescription>\n      </Alert>\n    )}\n\n    <SubmitButton\n      label={t(UserInvitationLabel.PASSKEY_CREATE)}\n      submittingLabel={t(UserInvitationLabel.PASSKEY_CREATING)}\n      fullWidth\n    />\n  </FormLayout>\n);\n\n/**\n * Passkey ENROLL-at-accept sub-form (Phase 3). Collects the invitee's name (the accept DTO\n * requires it; the profile is seeded at acceptance), then hands off to the parent's `onSubmit`,\n * which drives `acceptInvitation({credentialMethod: PASSKEY})` — the invitation token bootstraps\n * the session and the response carries a WebAuthn registration challenge — runs the browser\n * ceremony (`startRegistration`), and completes it against the authenticated\n * `/auth/passkey/register/verify` route. Passkey enrollment is the GO-FORWARD credential, not\n * this session's authenticator, so a cancelled/failed ceremony is non-fatal (the invitee is\n * already signed in and can add a passkey later). Falls back to an informational message when the\n * browser has no WebAuthn support.\n */\nconst InvitationPasskeyForm: React.FC<{\n  invitationEmail?: string;\n  disabled?: boolean;\n  error?: string | null;\n  onSubmit: (firstName?: string, lastName?: string) => Promise<void>;\n  t: (key: string) => string;\n}> = ({ invitationEmail, disabled, error, onSubmit, t }) => {\n  const isSupported = typeof window !== 'undefined' && !!window.PublicKeyCredential;\n  const schema = useMemo(\n    () => UserInvitationFormDtoSchema.pick({ firstName: true, lastName: true }),\n    [],\n  );\n\n  if (!isSupported) {\n    return (\n      <Alert>\n        <AlertDescription>\n          {t(UserInvitationLabel.PASSKEY_UNAVAILABLE_HINT)}\n        </AlertDescription>\n      </Alert>\n    );\n  }\n\n  return (\n    <AutomatedForm\n      schema={schema}\n      defaultValues={{ firstName: '', lastName: '' }}\n      onSubmit={(data: { firstName?: string; lastName?: string }) =>\n        onSubmit(data.firstName?.trim() || undefined, data.lastName?.trim() || undefined)}\n      validationMode={ValidationMode.ON_BLUR}\n      disabled={disabled}\n      labels={{\n        fields: {\n          firstName: t(UserInvitationLabel.FIRST_NAME),\n          lastName: t(UserInvitationLabel.LAST_NAME),\n        },\n      }}\n      layoutTemplate={() => (\n        <InvitationPasskeyTemplate invitationEmail={invitationEmail} error={error} t={t} />\n      )}\n    />\n  );\n};\n\n// --- Contract ---\nexport interface PublicLayoutPreset_UserInvitation_DefaultProps {\n  token?: string;\n  email?: string;\n}\n\nexport const PublicLayoutPreset_UserInvitation_Default = ({\n  token,\n  email,\n}: PublicLayoutPreset_UserInvitation_DefaultProps): React.JSX.Element => {\n  const { auth, acceptInvitation } = useAuthSession();\n  // Central error handler — the password/passkey paths reach it via `acceptInvitation` (the context\n  // calls `handleError` in its catch); the magic-link path calls the HTTP client directly, so it wires\n  // `handleError` itself (below) to keep central logging + frontend-action execution symmetric.\n  const { handleError } = useError();\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const resolvedAuth = useResolvedAuthConfig();\n\n  // Load BOTH label namespaces: the invitation chrome (`USER_INVITATION`) plus the\n  // login method components' namespace (`USER_AUTH`) — the reused SAML/OIDC/OAuth2/\n  // magic-link components label themselves from `UserAuthLabel.*`, and we hand them\n  // `tAuth`. The array is memoized so `useI18n` doesn't re-request keys every render.\n  const i18nComponents = useMemo(\n    () => [\n      FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION,\n      FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH,\n    ],\n    [],\n  );\n  const { tComponent, isReady } = useI18n({ component: i18nComponents });\n  const location = useLocation();\n  const formMethodsRef = useRef<FormMethods | null>(null);\n  const [isDeclining, setIsDeclining] = useState(false);\n  const [declined, setDeclined] = useState(false);\n  const [declineError, setDeclineError] = useState<string | null>(null);\n  // Passkey enroll-at-accept runs a WebAuthn ceremony AFTER the session is issued. While it runs,\n  // the `auth.accessToken` guard below is suppressed so the component isn't unmounted mid-ceremony.\n  const [passkeyCeremonyInProgress, setPasskeyCeremonyInProgress] = useState(false);\n  const [passkeyError, setPasskeyError] = useState<string | null>(null);\n  // Magic-link accept issues NO session — it emails a link + accepts the invite (consuming the\n  // token). On success we switch to a TERMINAL \"check your email\" state rather than leaving the\n  // chooser visible (whose other methods + decline would now dead-end on the consumed token).\n  const [magicLinkSent, setMagicLinkSent] = useState(false);\n  // #1158: accepted without a session; the invitee's policy requires signing in separately.\n  const [signInRequired, setSignInRequired] = useState(false);\n  // In-flight flag for the magic-link accept (which bypasses the context's `auth.isLoading`), used\n  // to gate the decline / alternative-method buttons so a click can't race the single-use token.\n  const [magicLinkSubmitting, setMagicLinkSubmitting] = useState(false);\n\n  // Invitation-info discovery (SSO/SCIM-aware method set) keyed by the token.\n  const [invitationInfo, setInvitationInfo] = useState<AuthInvitationInfoResponse | null>(null);\n  const [infoLoading, setInfoLoading] = useState(true);\n  const [infoError, setInfoError] = useState<string | null>(null);\n  // User-selected active method; `null` → fall back to the display-ordered default.\n  const [activeMethod, setActiveMethod] = useState<AuthMethod | null>(null);\n\n  // Memoized on `tComponent` so `t`/`tAuth` keep a STABLE identity across renders — the schema\n  // (`invitationFormSchema`) and submit callbacks depend on them, and an unstable `t` would defeat\n  // those memos and churn the sub-form props (risking focus loss on a mid-entry parent re-render).\n  const t = useCallback((key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, key), [tComponent]);\n  // `tAuth` keeps `tComponent`'s key-path-on-miss behaviour, because THIS component\n  // renders its result directly at five sites with no fallback (the magic-link\n  // button, the \"link sent\" heading and body, the methods divider, the per-method\n  // label). Normalizing it to `''` would turn a missing label into an invisible\n  // button and an empty heading — strictly worse than a visible key path.\n  const tAuth = useCallback(\n    (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, key),\n    [tComponent],\n  );\n\n  // The auth-method prop contract's resolver, built through the shared seam so the\n  // `USER_AUTH` namespace binding lives in one place. Same shape as `Auth_MfaChallenge`.\n  const tAuthForMethodComponent = useMemo(\n    () => makeComponentLabelResolver(tComponent, FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH),\n    [tComponent],\n  );\n  const loginPath = CommonRoutePaths.login;\n\n  // Where an already-authenticated invitee is forwarded — including one returning from\n  // an SSO/OAuth JIT round-trip. Mirrors `Auth_Main`: the SSO/OAuth method returns to\n  // this (auth) page, `Auth_AuthCallback` lands here after the code exchange, and this\n  // resolves the post-auth destination (a `redirect` param if present, else app home).\n  const postAuthRedirect = useMemo(() => resolvePostAuthRedirect(location.search), [location.search]);\n  const authRedirectTarget = useMemo(() => extractAuthRedirectFromSearch(location.search), [location.search]);\n\n  // The invitation-info response is authoritative for the invitee email; fall back to\n  // the URL `email` param until it resolves.\n  const inviteeEmail = invitationInfo?.inviteeEmail ?? email;\n\n  // Prefer the org-merged policy the endpoint resolved (the SAME one the backend accept\n  // validates against) so the strength indicator + client pre-check match the org's real\n  // requirements; fall back to the app-level policy until invitation-info resolves / when\n  // the endpoint couldn't resolve it.\n  const passwordPolicy: PasswordPolicyRules = useMemo(\n    () => invitationInfo?.passwordPolicy ?? resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY,\n    [invitationInfo?.passwordPolicy, resolvedAuth.passwordPolicy],\n  );\n\n  const invitationFormSchema = useMemo(() => UserInvitationFormDtoSchema.refine(\n    (data) => !data.password || data.password === data.confirmPassword,\n    { message: t(UserInvitationLabel.PASSWORD_MISMATCH), path: ['confirmPassword'] },\n  ), [t]);\n\n  const handleFormReady = useCallback((formMethods: FormMethods) => {\n    formMethodsRef.current = formMethods;\n  }, []);\n\n  // Fetch invitation-info once per token. The endpoint reads the token WITHOUT\n  // consuming it, so a consumed/expired/invalid token surfaces as an error state.\n  useEffect(() => {\n    // Only an UNauthenticated invitee needs method discovery. If already authenticated\n    // (e.g. returning from an SSO/OAuth JIT round-trip that consumed the token), skip\n    // the fetch — the `accessToken` guard below forwards to the app, and hitting the\n    // now-consumed token would only 4xx.\n    if (!token || auth.accessToken) {\n      setInfoLoading(false);\n      return;\n    }\n    let cancelled = false;\n    setInfoLoading(true);\n    setInfoError(null);\n    getManualCallsHttpClient()\n      .getInvitationInfo(token)\n      .then((info) => {\n        if (!cancelled) setInvitationInfo(info);\n      })\n      .catch((e: unknown) => {\n        if (!cancelled) setInfoError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));\n      })\n      .finally(() => {\n        if (!cancelled) setInfoLoading(false);\n      });\n    return () => { cancelled = true; };\n    // `t` is intentionally omitted from deps. It is memoized on the i18n component bundle (stable\n    // across ordinary renders), so omitting it does NOT capture a per-render-stale closure; it is\n    // omitted so a later i18n-bundle reload cannot re-trigger this one-shot discovery fetch. A rejected\n    // fetch therefore labels the error with the `t` bound when the effect first ran — an acceptable\n    // fallback in the narrow window before i18n is ready.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [token, auth.accessToken]);\n\n  /*\n   * Renderable first-factor methods from the org's policy, in the order the server sent (#1218).\n   *\n   * The invitation-info endpoint builds this list through the SAME `buildFirstFactorMethodsForPolicy` the sign-in\n   * page's `identify` uses, which orders by `AUTH_METHOD_PRECEDENCE`. That is why this page can stop re-sorting and\n   * why it inherits the fix rather than needing its own: filtering preserves order.\n   */\n  const availableMethods: AvailableMethod[] = useMemo(() => {\n    const methods = invitationInfo?.availableFirstFactorMethods ?? [];\n    return methods.filter((m) => INVITATION_RENDERABLE_METHODS.has(m.method as AuthMethod));\n  }, [invitationInfo]);\n\n  // Every renderable method is actionable (PASSKEY now enrolls at accept — Phase 3). The empty\n  // state (route to sign-in) is reserved for an org exposing NO renderable first-factor method\n  // (e.g. an SSO-only org whose per-connection lookup did not resolve).\n  const hasActionableMethod = availableMethods.length > 0;\n\n  // Any accept in flight — gates the decline / alternative-method buttons so a click can't race the\n  // single-use token. Password sets `auth.isLoading` via the context; magic-link + passkey run\n  // outside it (`magicLinkSubmitting` / `passkeyCeremonyInProgress`).\n  const methodSubmitInFlight = auth.isLoading || magicLinkSubmitting || passkeyCeremonyInProgress;\n\n  // Default to the first renderable method in display order.\n  const defaultMethod = useMemo(\n    () => (availableMethods[0]?.method as AuthMethod | undefined) ?? null,\n    [availableMethods],\n  );\n\n  const currentActiveMethod = activeMethod ?? defaultMethod;\n  const alternativeMethods = availableMethods.filter((m) => m.method !== currentActiveMethod);\n\n  /*\n   * The routing every auth screen shares (#972): nothing usable → the enrollment gate, which for an\n   * INVITATION session completes it and signs the invitee in (#603); something usable → the challenge.\n   * This screen already honours a `redirect` param for its post-auth destination, so the same target\n   * rides the MFA detour — the inline copy this replaced dropped it there.\n   */\n  useMfaContinuationNavigation({\n    mfaRequired: auth.mfaRequired,\n    mfaSessionId: auth.mfaSessionId,\n    usableSecondFactorMethods: auth.usableSecondFactorMethods,\n    email: inviteeEmail || undefined,\n    authRedirectTarget,\n  });\n\n  const handleInvitationSubmit = useCallback(async (data: UserInvitationFormDto) => {\n    formMethodsRef.current?.clearErrors('root');\n\n    if (data.password) {\n      const policyResult = AuthUtils.validatePasswordAgainstPolicy(data.password, passwordPolicy);\n      if (!policyResult.valid) {\n        formMethodsRef.current?.setError('root', {\n          type: 'policy',\n          message: resolvePasswordViolationsToLabels(policyResult.violations, t, passwordPolicy).join('. '),\n        });\n        return;\n      }\n    }\n\n    const normalizeText = (value?: string): string | undefined => {\n      const trimmed = value?.trim();\n      return trimmed ? trimmed : undefined;\n    };\n\n    try {\n      const result = await acceptInvitation({\n        invitationToken: token!,\n        firstName: normalizeText(data.firstName),\n        lastName: normalizeText(data.lastName),\n        password: data.password || undefined,\n      });\n      if (result?.signInRequired) setSignInRequired(true);\n      // Session issued → the `auth.accessToken` guard forwards to the app (honoring\n      // `postAuthRedirect`); MFA-gated → the `mfaRequired` effect routes; no session (#1158) → the sign-in state renders.\n    } catch (e: unknown) {\n      formMethodsRef.current?.setError('root', {\n        type: 'server',\n        message: toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)),\n      });\n    }\n  }, [acceptInvitation, passwordPolicy, t, token, toUserFacingErrorMessage]);\n\n  // Passkey enroll-at-accept: accept (bootstraps the session from the invitation token + returns a\n  // WebAuthn challenge) → run the browser ceremony → verify against the authenticated\n  // register-verify route. See `InvitationPasskeyForm`.\n  const handlePasskeySubmit = useCallback(async (firstName?: string, lastName?: string): Promise<void> => {\n    setPasskeyError(null);\n    setPasskeyCeremonyInProgress(true);\n    try {\n      const result = await acceptInvitation({\n        invitationToken: token!,\n        firstName,\n        lastName,\n        credentialMethod: AuthMethod.PASSKEY,\n      });\n      if (result?.signInRequired) {\n        // #1158: no session, so there is no ceremony to run; the terminal sign-in state renders.\n        setSignInRequired(true);\n        return;\n      }\n      const options = result?.passkeyRegistrationOptions;\n      if (options) {\n        // Session issued + a challenge. Enrollment failure is NON-FATAL — the invitation token\n        // already bootstrapped the session, so the invitee proceeds signed in and can add a\n        // passkey later in security settings.\n        try {\n          const credential = await startRegistration({ optionsJSON: options as unknown as PublicKeyCredentialCreationOptionsJSON });\n          await getManualCallsHttpClient().passkeyRegisterVerify({ response: credential });\n        } catch {\n          // Swallow — the session is already issued, so a cancelled/failed ceremony (or the rare\n          // cross-tab logout that clears the session mid-prompt and 401s the verify) is non-fatal:\n          // releasing the flag hands control to the `accessToken` guard, which forwards when the\n          // session survived and otherwise leaves the invitee on the accept screen (benign — they retry).\n        }\n      }\n      // Session path: releasing the flag (finally) → the `auth.accessToken` guard forwards to the\n      // app. MFA-gated path (no options): `acceptInvitation` set `mfaRequired` and the mfaRequired\n      // effect routes to enrollment (the invitee enrolls the passkey there via the existing route).\n    } catch (e: unknown) {\n      setPasskeyError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));\n    } finally {\n      setPasskeyCeremonyInProgress(false);\n    }\n  }, [acceptInvitation, token, t, toUserFacingErrorMessage]);\n\n  // Magic-link accept: emails a link + accepts the invite (via the HTTP client directly — no\n  // session to manage, like the login magic-link). On success the render switches to the terminal\n  // \"check your email\" state; errors propagate to the sub-form's root error.\n  const handleMagicLinkSubmit = useCallback(async (firstName?: string, lastName?: string): Promise<void> => {\n    setMagicLinkSubmitting(true);\n    try {\n      const response = await getManualCallsHttpClient().acceptInvitation({\n        invitationToken: token!,\n        firstName,\n        lastName,\n        credentialMethod: AuthMethod.MAGIC_LINK,\n        // The emailed link is opened on another page, so the deep link must travel inside it (#1014). Already\n        // same-origin: `extractAuthRedirectFromSearch` sanitised it, and the client and backend check again.\n        redirect: authRedirectTarget,\n      });\n      // #1158: an accept that issued no session sends no link either; say so rather than \"check your email\".\n      if (response.nextStep === AuthNextStep.SIGN_IN_REQUIRED) setSignInRequired(true);\n      else setMagicLinkSent(true);\n    } catch (e: any) {\n      // Route through the central error handler (logging + frontend-action execution, e.g. the global\n      // lockout UI) so a magic-link failure is handled identically to the password/passkey paths, which\n      // reach `handleError` via `acceptInvitation`. Then RE-THROW so the sub-form's own catch still\n      // renders the inline root error (the UX surface the user sees).\n      handleError(e, 'Invitation acceptance failed (magic link)', { credentialMethod: AuthMethod.MAGIC_LINK });\n      throw e;\n    } finally {\n      // The flag just releases the gate; the inline root error is owned by the sub-form's catch.\n      setMagicLinkSubmitting(false);\n    }\n  }, [token, handleError, authRedirectTarget]);\n\n  const handleDecline = useCallback(async () => {\n    setDeclineError(null);\n    if (!token) {\n      setDeclineError(t(UserInvitationLabel.INVALID_LINK));\n      return;\n    }\n\n    setIsDeclining(true);\n    try {\n      await getManualCallsHttpClient().rejectInvitation({ invitationToken: token });\n      setDeclined(true);\n    } catch (e: unknown) {\n      setDeclineError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));\n    } finally {\n      setIsDeclining(false);\n    }\n  }, [t, token, toUserFacingErrorMessage]);\n\n  // The reused method components self-handle their outcome (SSO/OAuth do a full-page\n  // redirect; magic-link shows its own \"sent\" state), so there is nothing to complete\n  // here. On the rare in-place success the `auth.accessToken` guard below lands the\n  // invitee in the app.\n  const handleMethodSuccess = useCallback((_response: AuthenticationResponse) => {}, []);\n  const handleMethodError = useCallback((_error: string) => {}, []);\n\n  /**\n   * Render the active first-factor method:\n   *  - `PASSWORD` / `MAGIC_LINK` / `PASSKEY` → invitation-specific accept sub-forms\n   *    (special-cased; never the login flow).\n   *  - `ORG_SAML` / `ORG_OPENID_CONNECT` / `EXTERNAL_OAUTH2` → the shared login method\n   *    component from the registry.\n   */\n  const renderActiveMethod = (): React.ReactNode => {\n    if (!currentActiveMethod) return null;\n    const methodConfig = availableMethods.find((m) => m.method === currentActiveMethod);\n    if (!methodConfig) return null;\n\n    if (currentActiveMethod === AuthMethod.PASSWORD) {\n      return (\n        <AutomatedForm\n          schema={invitationFormSchema}\n          defaultValues={{\n            firstName: '',\n            lastName: '',\n            password: '',\n            confirmPassword: '',\n          }}\n          onSubmit={handleInvitationSubmit}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={auth.isLoading || isDeclining}\n          onFormReady={handleFormReady}\n          labels={{\n            fields: {\n              firstName: t(UserInvitationLabel.FIRST_NAME),\n              lastName: t(UserInvitationLabel.LAST_NAME),\n              password: t(UserInvitationLabel.PASSWORD),\n              confirmPassword: t(UserInvitationLabel.CONFIRM_PASSWORD),\n            },\n          }}\n          layoutTemplate={() => <InvitationFormTemplate invitationEmail={inviteeEmail} passwordPolicy={passwordPolicy} />}\n        />\n      );\n    }\n\n    if (currentActiveMethod === AuthMethod.MAGIC_LINK) {\n      // NOT the reused login `MagicLinkAuthMethod` (which sends a LOGIN magic link that\n      // never accepts the invite and rejects a not-yet-ACTIVE invitee at verify). This\n      // drives `acceptInvitation({ credentialMethod: MAGIC_LINK })`, which activates + flips\n      // the membership before emailing the link. See `handleMagicLinkSubmit`.\n      return (\n        <InvitationMagicLinkForm\n          invitationEmail={inviteeEmail}\n          disabled={auth.isLoading || isDeclining}\n          onSubmit={handleMagicLinkSubmit}\n          t={t}\n          tAuth={tAuth}\n        />\n      );\n    }\n\n    if (currentActiveMethod === AuthMethod.PASSKEY) {\n      // Passkey ENROLL-at-accept (Phase 3): the login `PasskeyAuthMethod` authenticates an\n      // EXISTING credential, so it is NOT reused. `InvitationPasskeyForm` drives\n      // `acceptInvitation({credentialMethod: PASSKEY})` (bootstraps the session + returns a\n      // WebAuthn challenge) then runs the ceremony + verify. See `handlePasskeySubmit`.\n      return (\n        <InvitationPasskeyForm\n          invitationEmail={inviteeEmail}\n          disabled={auth.isLoading || isDeclining}\n          error={passkeyError}\n          onSubmit={handlePasskeySubmit}\n          t={t}\n        />\n      );\n    }\n\n    // ORG_SAML / ORG_OPENID_CONNECT / EXTERNAL_OAUTH2 — reuse the shared login method\n    // components. They are account-agnostic and self-wire their own hooks/redirects\n    // (full-page IdP redirect / OAuth JIT, which consume the INVITED membership); we only\n    // supply the invitee email + org method config. (PASSWORD, MAGIC_LINK, and PASSKEY are\n    // special-cased above — they need invitation-specific accept wiring, not login reuse.)\n    const MethodComponent = AUTH_METHOD_COMPONENTS[currentActiveMethod];\n    if (!MethodComponent) return null;\n\n    const props: AuthMethodComponentProps = {\n      sessionId: '', // no session for a not-yet-activated invitee\n      email: inviteeEmail ?? '',\n      methodConfig,\n      onSuccess: handleMethodSuccess,\n      onError: handleMethodError,\n      factorLevel: 'first',\n      isLoading: auth.isLoading || isDeclining,\n      t: tAuthForMethodComponent,\n    };\n\n    return <MethodComponent {...props} />;\n  };\n\n  // Already authenticated — including returning from an SSO/OAuth JIT round-trip that\n  // consumed the invite — so forward the invitee into the app rather than re-showing the\n  // accept screen (mirrors `Auth_Main`). Guards against an already-signed-in user\n  // accepting a token minted for a different email.\n  // EXCEPTION: during passkey enroll-at-accept the token is issued BEFORE the WebAuthn ceremony\n  // runs, so suppress the forward until the ceremony finishes (else the component unmounts and\n  // the browser passkey prompt is cancelled); `handlePasskeySubmit` releases the flag when done.\n  // Ordered BEFORE the `!isReady` i18n gate (like `Auth_AuthCallback`): the `<Navigate>` renders no\n  // labels, so a slow/failed label load must not block forwarding an already-authenticated invitee.\n  if (auth.accessToken && !passkeyCeremonyInProgress) {\n    return <Navigate to={postAuthRedirect} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (!token) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.ERROR_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserInvitationLabel.INVALID_LINK)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  if (declined) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.DECLINE_SUCCESS_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserInvitationLabel.DECLINE_SUCCESS_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.CONTINUE_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  // Accepted without a session (#1158): the invitee's policy disables the email-possession sign-in the invitation link\n  // amounts to. Terminal: the membership exists, and they continue on the sign-in page.\n  if (signInRequired) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.SIGN_IN_REQUIRED_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserInvitationLabel.SIGN_IN_REQUIRED_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  // Magic-link accepted — the invite is consumed and a sign-in link was emailed. Terminal state:\n  // the invitee finishes by clicking the emailed link (no chooser/decline — the token is gone, so\n  // any other method would only 4xx).\n  if (magicLinkSent) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{tAuth(UserAuthLabel.MAGIC_LINK_SENT_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{tAuth(UserAuthLabel.MAGIC_LINK_SENT_DESCRIPTION)}</Text>\n          {inviteeEmail && (\n            <Text className=\"text-sm text-muted-foreground\">{inviteeEmail}</Text>\n          )}\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  if (infoLoading) {\n    return (\n      <div className=\"flex items-center justify-center py-group\">\n        <LoadingSpinner size={40} />\n      </div>\n    );\n  }\n\n  if (infoError || !invitationInfo) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.ERROR_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{infoError || t(UserInvitationLabel.INVALID_LINK)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  // SCIM-managed org → informational only, NO password/method form (locked decision:\n  // the directory is the identity authority, so no local credential is set here).\n  if (invitationInfo.managementMode === InvitationManagementMode.SCIM) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.SCIM_MANAGED_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">\n            {t(UserInvitationLabel.SCIM_MANAGED_MESSAGE)}\n          </Text>\n          {inviteeEmail && (\n            <Text className=\"text-sm text-muted-foreground\">{inviteeEmail}</Text>\n          )}\n        </div>\n\n        {declineError && (\n          <Alert variant=\"destructive\" className=\"mb-group\">\n            <AlertDescription>{declineError}</AlertDescription>\n          </Alert>\n        )}\n\n        <div className=\"text-center mt-group space-y-item-sm\">\n          <Button\n            variant={ButtonVariants_Variant.OUTLINE}\n            onClick={handleDecline}\n            disabled={isDeclining}\n            className=\"w-full\"\n          >\n            {isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION)}\n          </Button>\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  // OPEN / SSO org → the method chooser.\n  return (\n    <>\n      <div className=\"text-center space-y-item-xs mb-group\">\n        <Heading>{t(UserInvitationLabel.TITLE)}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(UserInvitationLabel.SUB_TITLE)}</Text>\n        {invitationInfo.organizationName && (\n          <Text className=\"text-sm text-muted-foreground\">{invitationInfo.organizationName}</Text>\n        )}\n        {inviteeEmail && (\n          <Text className=\"text-sm text-muted-foreground\">{inviteeEmail}</Text>\n        )}\n      </div>\n\n      {hasActionableMethod ? (\n        <>\n          <Text className=\"text-sm text-muted-foreground text-center mb-element\">\n            {t(UserInvitationLabel.METHOD_CHOICE_HINT)}\n          </Text>\n\n          {/* Active first-factor method (password form / magic-link form / passkey form / reused SSO·OAuth component). */}\n          {renderActiveMethod()}\n\n          {/* Alternative methods — buttons that switch the active method. */}\n          {alternativeMethods.length > 0 && (\n            <>\n              <LabeledDivider label={tAuth(UserAuthLabel.OTHER_METHODS_DIVIDER)} />\n\n              <AuthMethodChoiceList\n                methods={alternativeMethods.map((method) => method.method as AuthMethod)}\n                /*\n                 * The descriptor names an enterprise connection, so an invitee choosing their\n                 * organization's provider sees ITS name rather than \"Organization sign-in\".\n                 *\n                 * No `socialProviders`: this screen configures no social buttons of its own, and the\n                 * resolver declines to name a provider it cannot resolve rather than printing a raw\n                 * `providerRef` — so a social alternative keeps the generic kind here, deliberately.\n                 */\n                labelFor={(method) => resolveAuthMethodChoiceLabel(method, {\n                  offeredMethod: alternativeMethods.find((candidate) => candidate.method === method),\n                  continueWithTemplate: tAuth(UserAuthLabel.CONTINUE_WITH),\n                  translateLabel: (label) => tAuth(label),\n                  resolveSocialProviderLabel: (provider) => provider.displayName ?? provider.providerRef,\n                })}\n                onSelect={(method) => { setActiveMethod(method); setPasskeyError(null); }}\n                disabled={methodSubmitInFlight || isDeclining}\n              />\n            </>\n          )}\n        </>\n      ) : (\n        /*\n          No renderable first-factor method on this screen — a valid state, not an error. The\n          common case is an SSO-only org whose invitee arrives before directory provisioning: the\n          token-keyed endpoint omits ORG_SAML/ORG_OPENID_CONNECT when no per-connection lookup\n          resolved, yielding an empty set with mode OPEN. Route the invitee to the sign-in page,\n          where email→domain SSO resolution works and the enterprise / OAuth JIT consumes the invite.\n        */\n        <Alert>\n          <AlertDescription>\n            {t(UserInvitationLabel.NO_METHOD_AVAILABLE_HINT)}\n          </AlertDescription>\n        </Alert>\n      )}\n\n      {declineError && (\n        <Alert variant=\"destructive\" className=\"mt-group\">\n          <AlertDescription>{declineError}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"text-center mt-group space-y-item-sm\">\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          onClick={handleDecline}\n          disabled={methodSubmitInFlight || isDeclining}\n          className=\"w-full\"\n        >\n          {isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION)}\n        </Button>\n        <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n      </div>\n    </>\n  );\n};\n\nexport function Auth_Invitation({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_UserInvitation_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_UserInvitation_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, 'Auth_Invitation')(preset);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_Invitation.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Invitation.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AACjI,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,wBAAwB,EACxB,2BAA2B,GAM5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAE5F,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EAAE,cAAc,EAAE,MAAM,0DAA0D,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iEAAiE,CAAC;AACxG,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gEAAgE,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACxI,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EACL,iCAAiC,GAClC,MAAM,6EAA6E,CAAC;AACrF,OAAO,EACL,sBAAsB,GAEvB,MAAM,oEAAoE,CAAC;AAG5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAC;AAE1H;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,6BAA6B,GAA4B,IAAI,GAAG,CAAC;IACrE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,eAAe;IAC1B,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAA0C,CAAC,EACrE,eAAe,EACf,cAAc,GACf,EAAE,EAAE;IACH,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,8BAA8B;KAChE,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAEjG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,+BAA+B,IAAC,KAAK,EAAE,eAAe,GAAI,EAC3D,KAAC,SAAS,IAAC,IAAI,EAAC,WAAW,GAAG,EAC9B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAC7B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAC7B,KAAC,SAAS,IAAC,IAAI,EAAC,iBAAiB,GAAG,EAEpC,KAAC,yBAAyB,IAAC,SAAS,EAAC,UAAU,EAAC,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,GAAI,EAE/E,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAC/C,eAAe,EAAE,CAAC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,EAC5D,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,2BAA2B,GAI5B,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IACrC,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,OAAO,CACL,MAAC,UAAU,eACR,eAAe,IAAI,CAClB,KAAC,IAAI,IAAC,SAAS,EAAC,2CAA2C,YAAE,eAAe,GAAQ,CACrF,EACD,KAAC,SAAS,IAAC,IAAI,EAAC,WAAW,GAAG,EAC9B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAE5B,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CACxB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAoB,GAC9D,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,EAC3C,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,EACrD,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,uBAAuB,GAMxB,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IACzD,MAAM,cAAc,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACxD,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAE7D,4FAA4F;IAC5F,mEAAmE;IACnE,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC3E,EAAE,CACH,CAAC;IAEF,gGAAgG;IAChG,+FAA+F;IAC/F,kFAAkF;IAClF,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,IAA+C,EAAE,EAAE;QACzF,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACvC,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE5C,OAAO,CACL,KAAC,aAAa,IACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC9C,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,EACvE,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,SAAS,EAAE,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;gBAC5C,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;aAC3C;SACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,CACpB,KAAC,2BAA2B,IAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,GAAI,CACtF,GACD,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,yBAAyB,GAI1B,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CACtC,MAAC,UAAU,eACR,eAAe,IAAI,CAClB,KAAC,IAAI,IAAC,SAAS,EAAC,2CAA2C,YAAE,eAAe,GAAQ,CACrF,EACD,KAAC,IAAI,IAAC,SAAS,EAAC,2CAA2C,YACxD,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,GACtC,EACP,KAAC,SAAS,IAAC,IAAI,EAAC,WAAW,GAAG,EAC9B,KAAC,SAAS,IAAC,IAAI,EAAC,UAAU,GAAG,EAE5B,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAC5C,eAAe,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,EACxD,SAAS,SACT,IACS,CACd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB,GAMtB,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE;IACzD,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IAClF,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC3E,EAAE,CACH,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CACL,KAAC,KAAK,cACJ,KAAC,gBAAgB,cACd,CAAC,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,GAC/B,GACb,CACT,CAAC;IACJ,CAAC;IAED,OAAO,CACL,KAAC,aAAa,IACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC9C,QAAQ,EAAE,CAAC,IAA+C,EAAE,EAAE,CAC5D,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,EACnF,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,SAAS,EAAE,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;gBAC5C,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;aAC3C;SACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,CACpB,KAAC,yBAAyB,IAAC,eAAe,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAI,CACpF,GACD,CACH,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,EACxD,KAAK,EACL,KAAK,GAC0C,EAAqB,EAAE;IACtE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE,CAAC;IACpD,kGAAkG;IAClG,qGAAqG;IACrG,8FAA8F;IAC9F,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAE7C,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,cAAc,GAAG,OAAO,CAC5B,GAAG,EAAE,CAAC;QACJ,qBAAqB,CAAC,8BAA8B;QACpD,qBAAqB,CAAC,wBAAwB;KAC/C,EACD,EAAE,CACH,CAAC;IACF,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACtE,gGAAgG;IAChG,kGAAkG;IAClG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACtE,6FAA6F;IAC7F,8FAA8F;IAC9F,4FAA4F;IAC5F,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,0FAA0F;IAC1F,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,iGAAiG;IACjG,+FAA+F;IAC/F,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAoC,IAAI,CAAC,CAAC;IAC9F,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAChE,kFAAkF;IAClF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAC;IAE1E,6FAA6F;IAC7F,iGAAiG;IACjG,iGAAiG;IACjG,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5H,kFAAkF;IAClF,6EAA6E;IAC7E,gFAAgF;IAChF,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,KAAK,GAAG,WAAW,CACvB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAChF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,iFAAiF;IACjF,uFAAuF;IACvF,MAAM,uBAAuB,GAAG,OAAO,CACrC,GAAG,EAAE,CAAC,0BAA0B,CAAC,UAAU,EAAE,qBAAqB,CAAC,wBAAwB,CAAC,EAC5F,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEzC,qFAAqF;IACrF,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpG,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5G,oFAAoF;IACpF,2CAA2C;IAC3C,MAAM,YAAY,GAAG,cAAc,EAAE,YAAY,IAAI,KAAK,CAAC;IAE3D,sFAAsF;IACtF,uFAAuF;IACvF,wFAAwF;IACxF,oCAAoC;IACpC,MAAM,cAAc,GAAwB,OAAO,CACjD,GAAG,EAAE,CAAC,cAAc,EAAE,cAAc,IAAI,YAAY,CAAC,cAAc,IAAI,uBAAuB,EAC9F,CAAC,cAAc,EAAE,cAAc,EAAE,YAAY,CAAC,cAAc,CAAC,CAC9D,CAAC;IAEF,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAC3E,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,eAAe,EAClE,EAAE,OAAO,EAAE,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CACjF,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAER,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,WAAwB,EAAE,EAAE;QAC/D,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IACvC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,6EAA6E;IAC7E,gFAAgF;IAChF,SAAS,CAAC,GAAG,EAAE;QACb,mFAAmF;QACnF,kFAAkF;QAClF,iFAAiF;QACjF,qCAAqC;QACrC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,cAAc,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,wBAAwB,EAAE;aACvB,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACb,IAAI,CAAC,SAAS;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACpB,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACrG,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,8FAA8F;QAC9F,8FAA8F;QAC9F,oGAAoG;QACpG,gGAAgG;QAChG,sDAAsD;QACtD,uDAAuD;IACzD,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE9B;;;;;;OAMG;IACH,MAAM,gBAAgB,GAAsB,OAAO,CAAC,GAAG,EAAE;QACvD,MAAM,OAAO,GAAG,cAAc,EAAE,2BAA2B,IAAI,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC,CAAC;IAC1F,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAErB,6FAA6F;IAC7F,6FAA6F;IAC7F,sEAAsE;IACtE,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAExD,kGAAkG;IAClG,6FAA6F;IAC7F,oEAAoE;IACpE,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,IAAI,mBAAmB,IAAI,yBAAyB,CAAC;IAEhG,2DAA2D;IAC3D,MAAM,aAAa,GAAG,OAAO,CAC3B,GAAG,EAAE,CAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAiC,IAAI,IAAI,EACrE,CAAC,gBAAgB,CAAC,CACnB,CAAC;IAEF,MAAM,mBAAmB,GAAG,YAAY,IAAI,aAAa,CAAC;IAC1D,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;IAE5F;;;;;OAKG;IACH,4BAA4B,CAAC;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,KAAK,EAAE,YAAY,IAAI,SAAS;QAChC,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,EAAE,IAA2B,EAAE,EAAE;QAC/E,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC5F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACvC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,iCAAiC,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClG,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,KAAc,EAAsB,EAAE;YAC3D,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACvC,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;gBACpC,eAAe,EAAE,KAAM;gBACvB,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;gBACxC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;aACrC,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,cAAc;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpD,8EAA8E;YAC9E,oHAAoH;QACtH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACvC,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE3E,iGAAiG;IACjG,oFAAoF;IACpF,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,EAAE,SAAkB,EAAE,QAAiB,EAAiB,EAAE;QACrG,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;gBACpC,eAAe,EAAE,KAAM;gBACvB,SAAS;gBACT,QAAQ;gBACR,gBAAgB,EAAE,UAAU,CAAC,OAAO;aACrC,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,cAAc,EAAE,CAAC;gBAC3B,yFAAyF;gBACzF,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,EAAE,0BAA0B,CAAC;YACnD,IAAI,OAAO,EAAE,CAAC;gBACZ,uFAAuF;gBACvF,oFAAoF;gBACpF,sCAAsC;gBACtC,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAA4D,EAAE,CAAC,CAAC;oBAC1H,MAAM,wBAAwB,EAAE,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC;oBACP,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,gGAAgG;gBAClG,CAAC;YACH,CAAC;YACD,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;QAChG,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,eAAe,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACT,4BAA4B,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE3D,2FAA2F;IAC3F,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,qBAAqB,GAAG,WAAW,CAAC,KAAK,EAAE,SAAkB,EAAE,QAAiB,EAAiB,EAAE;QACvG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,gBAAgB,CAAC;gBACjE,eAAe,EAAE,KAAM;gBACvB,SAAS;gBACT,QAAQ;gBACR,gBAAgB,EAAE,UAAU,CAAC,UAAU;gBACvC,sGAAsG;gBACtG,qGAAqG;gBACrG,QAAQ,EAAE,kBAAkB;aAC7B,CAAC,CAAC;YACH,uGAAuG;YACvG,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,gBAAgB;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;;gBAC5E,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,gGAAgG;YAChG,kGAAkG;YAClG,8FAA8F;YAC9F,gEAAgE;YAChE,WAAW,CAAC,CAAC,EAAE,2CAA2C,EAAE,EAAE,gBAAgB,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;YACzG,MAAM,CAAC,CAAC;QACV,CAAC;gBAAS,CAAC;YACT,2FAA2F;YAC3F,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAE7C,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,WAAW,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,eAAe,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEzC,mFAAmF;IACnF,oFAAoF;IACpF,kFAAkF;IAClF,sBAAsB;IACtB,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,SAAiC,EAAE,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,MAAc,EAAE,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,MAAM,kBAAkB,GAAG,GAAoB,EAAE;QAC/C,IAAI,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAE/B,IAAI,mBAAmB,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;YAChD,OAAO,CACL,KAAC,aAAa,IACZ,MAAM,EAAE,oBAAoB,EAC5B,aAAa,EAAE;oBACb,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,EAAE;oBACZ,eAAe,EAAE,EAAE;iBACpB,EACD,QAAQ,EAAE,sBAAsB,EAChC,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW,EACvC,WAAW,EAAE,eAAe,EAC5B,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,SAAS,EAAE,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;wBAC5C,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;wBAC1C,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;wBACzC,eAAe,EAAE,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;qBACzD;iBACF,EACD,cAAc,EAAE,GAAG,EAAE,CAAC,KAAC,sBAAsB,IAAC,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,GAAI,GAC/G,CACH,CAAC;QACJ,CAAC;QAED,IAAI,mBAAmB,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;YAClD,kFAAkF;YAClF,iFAAiF;YACjF,uFAAuF;YACvF,wEAAwE;YACxE,OAAO,CACL,KAAC,uBAAuB,IACtB,eAAe,EAAE,YAAY,EAC7B,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW,EACvC,QAAQ,EAAE,qBAAqB,EAC/B,CAAC,EAAE,CAAC,EACJ,KAAK,EAAE,KAAK,GACZ,CACH,CAAC;QACJ,CAAC;QAED,IAAI,mBAAmB,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YAC/C,qFAAqF;YACrF,2EAA2E;YAC3E,sFAAsF;YACtF,kFAAkF;YAClF,OAAO,CACL,KAAC,qBAAqB,IACpB,eAAe,EAAE,YAAY,EAC7B,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW,EACvC,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,CAAC,EAAE,CAAC,GACJ,CACH,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,gFAAgF;QAChF,sFAAsF;QACtF,uFAAuF;QACvF,uFAAuF;QACvF,MAAM,eAAe,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,KAAK,GAA6B;YACtC,SAAS,EAAE,EAAE,EAAE,6CAA6C;YAC5D,KAAK,EAAE,YAAY,IAAI,EAAE;YACzB,YAAY;YACZ,SAAS,EAAE,mBAAmB;YAC9B,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW;YACxC,CAAC,EAAE,uBAAuB;SAC3B,CAAC;QAEF,OAAO,KAAC,eAAe,OAAK,KAAK,GAAI,CAAC;IACxC,CAAC,CAAC;IAEF,oFAAoF;IACpF,uFAAuF;IACvF,gFAAgF;IAChF,kDAAkD;IAClD,8FAA8F;IAC9F,6FAA6F;IAC7F,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACnD,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,GAAW,EACvD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAQ,IAC3E,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,GACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,GAAW,EACjE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,GAAQ,IACtF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,aAAa,CAAC,GAAqB,GAC1F,IACL,CACJ,CAAC;IACJ,CAAC;IAED,qHAAqH;IACrH,sFAAsF;IACtF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,GAAW,EAClE,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,GAAQ,IACvF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,GACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,gGAAgG;IAChG,oCAAoC;IACpC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAW,EAC/D,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,GAAQ,EAC3F,YAAY,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,YAAY,GAAQ,CACtE,IACG,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,GACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CACL,cAAK,SAAS,EAAC,2CAA2C,YACxD,KAAC,cAAc,IAAC,IAAI,EAAE,EAAE,GAAI,GACxB,CACP,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;QACjC,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,GAAW,EACvD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,SAAS,IAAI,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAQ,IACxF,EACN,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,GACvF,IACL,CACJ,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,gFAAgF;IAChF,IAAI,cAAc,CAAC,cAAc,KAAK,wBAAwB,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,GAAW,EAC9D,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAC/B,CAAC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,GACvC,EACN,YAAY,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,YAAY,GAAQ,CACtE,IACG,EAEL,YAAY,IAAI,CACf,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,EAAC,SAAS,EAAC,UAAU,YAC/C,KAAC,gBAAgB,cAAE,YAAY,GAAoB,GAC7C,CACT,EAED,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAC,QAAQ,YAEjB,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,GAC/F,EACT,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,EAE3F,KAAC,qBAAqB,IAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAI,IACtE,IACL,CACJ,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,OAAO,cAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAW,EACjD,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAQ,EAC3E,cAAc,CAAC,gBAAgB,IAAI,CAClC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,cAAc,CAAC,gBAAgB,GAAQ,CACzF,EACA,YAAY,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,YAAY,GAAQ,CACtE,IACG,EAEL,mBAAmB,CAAC,CAAC,CAAC,CACrB,8BACE,KAAC,IAAI,IAAC,SAAS,EAAC,sDAAsD,YACnE,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,GACrC,EAGN,kBAAkB,EAAE,EAGpB,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,CAChC,8BACE,KAAC,cAAc,IAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAI,EAErE,KAAC,oBAAoB,IACnB,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAoB,CAAC;gCACxE;;;;;;;mCAOG;gCACH,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,EAAE;oCACzD,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;oCAClF,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC;oCACxD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;oCACvC,0BAA0B,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW;iCACvF,CAAC,EACF,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACzE,QAAQ,EAAE,oBAAoB,IAAI,WAAW,GAC7C,IACD,CACJ,IACA,CACJ,CAAC,CAAC,CAAC;YACF;;;;;;cAME;YACF,KAAC,KAAK,cACJ,KAAC,gBAAgB,cACd,CAAC,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,GAC/B,GACb,CACT,EAEA,YAAY,IAAI,CACf,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,EAAC,SAAS,EAAC,UAAU,YAC/C,KAAC,gBAAgB,cAAE,YAAY,GAAoB,GAC7C,CACT,EAED,eAAK,SAAS,EAAC,sCAAsC,aACnD,KAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,oBAAoB,IAAI,WAAW,EAC7C,SAAS,EAAC,QAAQ,YAEjB,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,GAC/F,EACT,KAAC,iBAAiB,IAAC,IAAI,EAAE,SAAS,YAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAqB,EAM3F,KAAC,qBAAqB,IAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAI,IACtE,IACL,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAyE;IACnJ,MAAM,SAAS,GAAG,uBAAuB,CAAiD,qBAAqB,CAAC,8BAA8B,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3K,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { Navigate, useLocation } from 'react-router-dom';\nimport { useFormContext } from 'react-hook-form';\nimport { CorePresetNames, FrontendComponentType, UserAuthLabel, UserInvitationLabel } from '@wildo-ai/presets-components-models';\nimport {\n  AuthNextStep,\n  AuthMethod,\n  AuthUtils,\n  InvitationManagementMode,\n  UserInvitationFormDtoSchema,\n  type AuthenticationResponse,\n  type AuthInvitationInfoResponse,\n  type AvailableMethod,\n  type PasswordPolicyRules,\n  type UserInvitationFormDto,\n} from '@wildo-ai/saas-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport { startRegistration } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/browser';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { type FormMethods } from '~wildo-frontend-lib/components/form/Form';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { PasswordStrengthIndicator, DEFAULT_PASSWORD_POLICY } from '~wildo-frontend-lib/components/auth/utils/PasswordStrengthIndicator';\nimport { CredentialUsernameAutofillField } from '~wildo-frontend-lib/components/auth/utils/CredentialUsernameAutofillField';\nimport { LabeledDivider } from '~wildo-frontend-lib/components/auth/utils/LabeledDivider';\nimport { AuthMethodChoiceList } from '~wildo-frontend-lib/components/auth/utils/AuthMethodChoiceList';\nimport { resolveAuthMethodChoiceLabel } from '~wildo-frontend-lib/components/auth/methods/auth-method-presentation';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { LoadingSpinner } from '~wildo-frontend-lib/components/feedback/loading-spinner';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { AuthSecondaryLink } from '~wildo-frontend-lib/components/auth/utils/AuthSecondaryLink';\nimport { AuthPrivacyNoticeLink } from '~wildo-frontend-lib/components/auth/utils/AuthPrivacyNoticeLink';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { makeComponentLabelResolver } from '~wildo-frontend-lib/core/i18n/component-label-resolution.utils';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { useError } from '~wildo-frontend-lib/core/errors/useError';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport { extractAuthRedirectFromSearch, resolvePostAuthRedirect } from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { useMfaContinuationNavigation } from '~wildo-frontend-lib/components/auth/utils/useMfaContinuationNavigation';\nimport {\n  resolvePasswordViolationsToLabels,\n} from '~wildo-frontend-lib/components/auth/utils/resolvePasswordViolationsToLabels';\nimport {\n  AUTH_METHOD_COMPONENTS,\n  type AuthMethodComponentProps,\n} from '~wildo-frontend-lib/components/auth/methods/auth-method-components';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas';\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper';\n\n/**\n * First-factor methods the PUBLIC invitation-accept chooser knows how to render.\n *\n * The invitation-info endpoint returns whatever the org allows for a joining member,\n * but the chooser can only surface methods that are usable BEFORE the invitee has an\n * account/session:\n *  - `PASSWORD` / `MAGIC_LINK` / `PASSKEY` → invitation-specific accept sub-forms that drive\n *    `acceptInvitation` (set a password / email a link / enroll a passkey). NOT the login\n *    method components — those authenticate an EXISTING account, which an invitee lacks. In\n *    particular the login magic-link (`magicLinkSend`) is ACTIVE-only and never accepts the\n *    invite; the passkey login component authenticates an already-enrolled credential.\n *  - `ORG_SAML` / `ORG_OPENID_CONNECT` / `EXTERNAL_OAUTH2` → the shared login method\n *    components, which are account-agnostic (full-page redirect) and consume the `INVITED`\n *    membership via enterprise-SSO JIT / OAuth JIT (email match on the live membership, no token).\n *\n * Session-bound MFA methods (`SMS_OTP` / `EMAIL_OTP` / `TOTP`) are intentionally\n * excluded — they need a session the invitee does not have.\n */\nconst INVITATION_RENDERABLE_METHODS: ReadonlySet<AuthMethod> = new Set([\n  AuthMethod.PASSWORD,\n  AuthMethod.ORG_SAML,\n  AuthMethod.ORG_OPENID_CONNECT,\n  AuthMethod.EXTERNAL_OAUTH2,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n]);\n\n\ninterface InvitationFormTemplateProps {\n  invitationEmail?: string;\n  /**\n   * The effective (org-merged) password policy the parent resolved from the\n   * invitation-info response — the SAME policy the backend accept endpoint enforces —\n   * falling back to the app-level policy. Passed in (not read from `useResolvedAuthConfig`\n   * here) so the strength indicator matches what the org actually requires.\n   */\n  passwordPolicy: PasswordPolicyRules;\n}\n\n/**\n * Password-method accept form body — first/last name + optional password with the\n * strength indicator + a hidden username field for password-manager autofill.\n *\n * Rendered only when `PASSWORD` is the active chooser method. Password is OPTIONAL\n * here (a passwordless accept creates the account and the user adds a credential\n * later); the enclosing chooser owns the method-choice hint, so this template no\n * longer renders a standalone \"password is optional\" aside.\n */\nconst InvitationFormTemplate: React.FC<InvitationFormTemplateProps> = ({\n  invitationEmail,\n  passwordPolicy,\n}) => {\n  const { formState } = useFormContext();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION,\n  });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, key);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <CredentialUsernameAutofillField email={invitationEmail} />\n      <FormField name=\"firstName\" />\n      <FormField name=\"lastName\" />\n      <FormField name=\"password\" />\n      <FormField name=\"confirmPassword\" />\n\n      <PasswordStrengthIndicator fieldName=\"password\" policy={passwordPolicy} t={t} />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserInvitationLabel.ACCEPT_INVITATION)}\n        submittingLabel={t(UserInvitationLabel.ACCEPTING_INVITATION)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Body of the magic-link accept sub-form (first/last name + send button). Split out so it\n * can read `formState.errors.root` via `useFormContext` inside the `AutomatedForm` provider.\n */\nconst InvitationMagicLinkTemplate: React.FC<{\n  invitationEmail?: string;\n  t: (key: string) => string;\n  tAuth: (key: string) => string;\n}> = ({ invitationEmail, t, tAuth }) => {\n  const { formState } = useFormContext();\n  return (\n    <FormLayout>\n      {invitationEmail && (\n        <Text className=\"text-sm text-muted-foreground text-center\">{invitationEmail}</Text>\n      )}\n      <FormField name=\"firstName\" />\n      <FormField name=\"lastName\" />\n\n      {formState.errors.root && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{formState.errors.root.message}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={tAuth(UserAuthLabel.MAGIC_LINK_SEND)}\n        submittingLabel={tAuth(UserAuthLabel.MAGIC_LINK_SEND)}\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Magic-link ACCEPT sub-form — the invitation-aware counterpart of the login\n * `MagicLinkAuthMethod`.\n *\n * The login component sends a *login* magic link via `magicLinkSend`, which never accepts\n * the invitation: `sendMagicLink` resolves users ACTIVE-only, so a not-yet-activated\n * (`PENDING_INVITATION`) invitee gets no email, and `verifyMagicLink` rejects any non-ACTIVE\n * user and never flips the INVITED membership. So it is NOT reused here.\n *\n * Instead this drives the purpose-built `acceptInvitation({ credentialMethod: MAGIC_LINK })`\n * endpoint, which ACTIVATES the invitee + flips the membership FIRST and only THEN mints +\n * emails the link — so the eventual `verifyMagicLink` click (now ACTIVE) establishes the\n * session. First/last name are collected because the accept DTO requires them (the invitee's\n * profile is seeded at acceptance). No session is issued (the parent switches to a terminal\n * \"check your email\" state); the session lands when the invitee clicks the emailed link.\n */\nconst InvitationMagicLinkForm: React.FC<{\n  invitationEmail?: string;\n  disabled?: boolean;\n  onSubmit: (firstName?: string, lastName?: string) => Promise<void>;\n  t: (key: string) => string;\n  tAuth: (key: string) => string;\n}> = ({ invitationEmail, disabled, onSubmit, t, tAuth }) => {\n  const formMethodsRef = useRef<FormMethods | null>(null);\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n\n  // Only the name fields — reuse the accept form schema's first/last (with their autocomplete\n  // decorators); the credential is the emailed link, not a password.\n  const schema = useMemo(\n    () => UserInvitationFormDtoSchema.pick({ firstName: true, lastName: true }),\n    [],\n  );\n\n  // On success the PARENT switches to the terminal \"check your email\" state — the accept consumed\n  // the token + accepted the invite, so there is NO in-place \"sent\" / \"try another method\" state\n  // (that would dead-end on the now-consumed token). Only errors are surfaced here.\n  const handleSubmit = useCallback(async (data: { firstName?: string; lastName?: string }) => {\n    formMethodsRef.current?.clearErrors('root');\n    try {\n      await onSubmit(data.firstName?.trim() || undefined, data.lastName?.trim() || undefined);\n    } catch (e: unknown) {\n      formMethodsRef.current?.setError('root', {\n        type: 'server',\n        message: toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)),\n      });\n    }\n  }, [onSubmit, t, toUserFacingErrorMessage]);\n\n  return (\n    <AutomatedForm\n      schema={schema}\n      defaultValues={{ firstName: '', lastName: '' }}\n      onSubmit={handleSubmit}\n      validationMode={ValidationMode.ON_BLUR}\n      disabled={disabled}\n      onFormReady={(formMethods) => { formMethodsRef.current = formMethods; }}\n      labels={{\n        fields: {\n          firstName: t(UserInvitationLabel.FIRST_NAME),\n          lastName: t(UserInvitationLabel.LAST_NAME),\n        },\n      }}\n      layoutTemplate={() => (\n        <InvitationMagicLinkTemplate invitationEmail={invitationEmail} t={t} tAuth={tAuth} />\n      )}\n    />\n  );\n};\n\n/**\n * Body of the passkey accept sub-form. The ceremony error is owned by the parent (the WebAuthn\n * flow runs outside the form), so it is passed in rather than read from `formState`.\n */\nconst InvitationPasskeyTemplate: React.FC<{\n  invitationEmail?: string;\n  error?: string | null;\n  t: (key: string) => string;\n}> = ({ invitationEmail, error, t }) => (\n  <FormLayout>\n    {invitationEmail && (\n      <Text className=\"text-sm text-muted-foreground text-center\">{invitationEmail}</Text>\n    )}\n    <Text className=\"text-sm text-muted-foreground text-center\">\n      {t(UserInvitationLabel.PASSKEY_DESCRIPTION)}\n    </Text>\n    <FormField name=\"firstName\" />\n    <FormField name=\"lastName\" />\n\n    {error && (\n      <Alert variant=\"destructive\">\n        <AlertDescription>{error}</AlertDescription>\n      </Alert>\n    )}\n\n    <SubmitButton\n      label={t(UserInvitationLabel.PASSKEY_CREATE)}\n      submittingLabel={t(UserInvitationLabel.PASSKEY_CREATING)}\n      fullWidth\n    />\n  </FormLayout>\n);\n\n/**\n * Passkey ENROLL-at-accept sub-form (Phase 3). Collects the invitee's name (the accept DTO\n * requires it; the profile is seeded at acceptance), then hands off to the parent's `onSubmit`,\n * which drives `acceptInvitation({credentialMethod: PASSKEY})` — the invitation token bootstraps\n * the session and the response carries a WebAuthn registration challenge — runs the browser\n * ceremony (`startRegistration`), and completes it against the authenticated\n * `/auth/passkey/register/verify` route. Passkey enrollment is the GO-FORWARD credential, not\n * this session's authenticator, so a cancelled/failed ceremony is non-fatal (the invitee is\n * already signed in and can add a passkey later). Falls back to an informational message when the\n * browser has no WebAuthn support.\n */\nconst InvitationPasskeyForm: React.FC<{\n  invitationEmail?: string;\n  disabled?: boolean;\n  error?: string | null;\n  onSubmit: (firstName?: string, lastName?: string) => Promise<void>;\n  t: (key: string) => string;\n}> = ({ invitationEmail, disabled, error, onSubmit, t }) => {\n  const isSupported = typeof window !== 'undefined' && !!window.PublicKeyCredential;\n  const schema = useMemo(\n    () => UserInvitationFormDtoSchema.pick({ firstName: true, lastName: true }),\n    [],\n  );\n\n  if (!isSupported) {\n    return (\n      <Alert>\n        <AlertDescription>\n          {t(UserInvitationLabel.PASSKEY_UNAVAILABLE_HINT)}\n        </AlertDescription>\n      </Alert>\n    );\n  }\n\n  return (\n    <AutomatedForm\n      schema={schema}\n      defaultValues={{ firstName: '', lastName: '' }}\n      onSubmit={(data: { firstName?: string; lastName?: string }) =>\n        onSubmit(data.firstName?.trim() || undefined, data.lastName?.trim() || undefined)}\n      validationMode={ValidationMode.ON_BLUR}\n      disabled={disabled}\n      labels={{\n        fields: {\n          firstName: t(UserInvitationLabel.FIRST_NAME),\n          lastName: t(UserInvitationLabel.LAST_NAME),\n        },\n      }}\n      layoutTemplate={() => (\n        <InvitationPasskeyTemplate invitationEmail={invitationEmail} error={error} t={t} />\n      )}\n    />\n  );\n};\n\n// --- Contract ---\nexport interface PublicLayoutPreset_UserInvitation_DefaultProps {\n  token?: string;\n  email?: string;\n}\n\nexport const PublicLayoutPreset_UserInvitation_Default = ({\n  token,\n  email,\n}: PublicLayoutPreset_UserInvitation_DefaultProps): React.JSX.Element => {\n  const { auth, acceptInvitation } = useAuthSession();\n  // Central error handler — the password/passkey paths reach it via `acceptInvitation` (the context\n  // calls `handleError` in its catch); the magic-link path calls the HTTP client directly, so it wires\n  // `handleError` itself (below) to keep central logging + frontend-action execution symmetric.\n  const { handleError } = useError();\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const resolvedAuth = useResolvedAuthConfig();\n\n  // Load BOTH label namespaces: the invitation chrome (`USER_INVITATION`) plus the\n  // login method components' namespace (`USER_AUTH`) — the reused SAML/OIDC/OAuth2/\n  // magic-link components label themselves from `UserAuthLabel.*`, and we hand them\n  // `tAuth`. The array is memoized so `useI18n` doesn't re-request keys every render.\n  const i18nComponents = useMemo(\n    () => [\n      FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION,\n      FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH,\n    ],\n    [],\n  );\n  const { tComponent, isReady } = useI18n({ component: i18nComponents });\n  const location = useLocation();\n  const formMethodsRef = useRef<FormMethods | null>(null);\n  const [isDeclining, setIsDeclining] = useState(false);\n  const [declined, setDeclined] = useState(false);\n  const [declineError, setDeclineError] = useState<string | null>(null);\n  // Passkey enroll-at-accept runs a WebAuthn ceremony AFTER the session is issued. While it runs,\n  // the `auth.accessToken` guard below is suppressed so the component isn't unmounted mid-ceremony.\n  const [passkeyCeremonyInProgress, setPasskeyCeremonyInProgress] = useState(false);\n  const [passkeyError, setPasskeyError] = useState<string | null>(null);\n  // Magic-link accept issues NO session — it emails a link + accepts the invite (consuming the\n  // token). On success we switch to a TERMINAL \"check your email\" state rather than leaving the\n  // chooser visible (whose other methods + decline would now dead-end on the consumed token).\n  const [magicLinkSent, setMagicLinkSent] = useState(false);\n  // #1158: accepted without a session; the invitee's policy requires signing in separately.\n  const [signInRequired, setSignInRequired] = useState(false);\n  // In-flight flag for the magic-link accept (which bypasses the context's `auth.isLoading`), used\n  // to gate the decline / alternative-method buttons so a click can't race the single-use token.\n  const [magicLinkSubmitting, setMagicLinkSubmitting] = useState(false);\n\n  // Invitation-info discovery (SSO/SCIM-aware method set) keyed by the token.\n  const [invitationInfo, setInvitationInfo] = useState<AuthInvitationInfoResponse | null>(null);\n  const [infoLoading, setInfoLoading] = useState(true);\n  const [infoError, setInfoError] = useState<string | null>(null);\n  // User-selected active method; `null` → fall back to the display-ordered default.\n  const [activeMethod, setActiveMethod] = useState<AuthMethod | null>(null);\n\n  // Memoized on `tComponent` so `t`/`tAuth` keep a STABLE identity across renders — the schema\n  // (`invitationFormSchema`) and submit callbacks depend on them, and an unstable `t` would defeat\n  // those memos and churn the sub-form props (risking focus loss on a mid-entry parent re-render).\n  const t = useCallback((key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, key), [tComponent]);\n  // `tAuth` keeps `tComponent`'s key-path-on-miss behaviour, because THIS component\n  // renders its result directly at five sites with no fallback (the magic-link\n  // button, the \"link sent\" heading and body, the methods divider, the per-method\n  // label). Normalizing it to `''` would turn a missing label into an invisible\n  // button and an empty heading — strictly worse than a visible key path.\n  const tAuth = useCallback(\n    (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, key),\n    [tComponent],\n  );\n\n  // The auth-method prop contract's resolver, built through the shared seam so the\n  // `USER_AUTH` namespace binding lives in one place. Same shape as `Auth_MfaChallenge`.\n  const tAuthForMethodComponent = useMemo(\n    () => makeComponentLabelResolver(tComponent, FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH),\n    [tComponent],\n  );\n  const loginPath = CommonRoutePaths.login;\n\n  // Where an already-authenticated invitee is forwarded — including one returning from\n  // an SSO/OAuth JIT round-trip. Mirrors `Auth_Main`: the SSO/OAuth method returns to\n  // this (auth) page, `Auth_AuthCallback` lands here after the code exchange, and this\n  // resolves the post-auth destination (a `redirect` param if present, else app home).\n  const postAuthRedirect = useMemo(() => resolvePostAuthRedirect(location.search), [location.search]);\n  const authRedirectTarget = useMemo(() => extractAuthRedirectFromSearch(location.search), [location.search]);\n\n  // The invitation-info response is authoritative for the invitee email; fall back to\n  // the URL `email` param until it resolves.\n  const inviteeEmail = invitationInfo?.inviteeEmail ?? email;\n\n  // Prefer the org-merged policy the endpoint resolved (the SAME one the backend accept\n  // validates against) so the strength indicator + client pre-check match the org's real\n  // requirements; fall back to the app-level policy until invitation-info resolves / when\n  // the endpoint couldn't resolve it.\n  const passwordPolicy: PasswordPolicyRules = useMemo(\n    () => invitationInfo?.passwordPolicy ?? resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY,\n    [invitationInfo?.passwordPolicy, resolvedAuth.passwordPolicy],\n  );\n\n  const invitationFormSchema = useMemo(() => UserInvitationFormDtoSchema.refine(\n    (data) => !data.password || data.password === data.confirmPassword,\n    { message: t(UserInvitationLabel.PASSWORD_MISMATCH), path: ['confirmPassword'] },\n  ), [t]);\n\n  const handleFormReady = useCallback((formMethods: FormMethods) => {\n    formMethodsRef.current = formMethods;\n  }, []);\n\n  // Fetch invitation-info once per token. The endpoint reads the token WITHOUT\n  // consuming it, so a consumed/expired/invalid token surfaces as an error state.\n  useEffect(() => {\n    // Only an UNauthenticated invitee needs method discovery. If already authenticated\n    // (e.g. returning from an SSO/OAuth JIT round-trip that consumed the token), skip\n    // the fetch — the `accessToken` guard below forwards to the app, and hitting the\n    // now-consumed token would only 4xx.\n    if (!token || auth.accessToken) {\n      setInfoLoading(false);\n      return;\n    }\n    let cancelled = false;\n    setInfoLoading(true);\n    setInfoError(null);\n    getManualCallsHttpClient()\n      .getInvitationInfo(token)\n      .then((info) => {\n        if (!cancelled) setInvitationInfo(info);\n      })\n      .catch((e: unknown) => {\n        if (!cancelled) setInfoError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));\n      })\n      .finally(() => {\n        if (!cancelled) setInfoLoading(false);\n      });\n    return () => { cancelled = true; };\n    // `t` is intentionally omitted from deps. It is memoized on the i18n component bundle (stable\n    // across ordinary renders), so omitting it does NOT capture a per-render-stale closure; it is\n    // omitted so a later i18n-bundle reload cannot re-trigger this one-shot discovery fetch. A rejected\n    // fetch therefore labels the error with the `t` bound when the effect first ran — an acceptable\n    // fallback in the narrow window before i18n is ready.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [token, auth.accessToken]);\n\n  /*\n   * Renderable first-factor methods from the org's policy, in the order the server sent (#1218).\n   *\n   * The invitation-info endpoint builds this list through the SAME `buildFirstFactorMethodsForPolicy` the sign-in\n   * page's `identify` uses, which orders by `AUTH_METHOD_PRECEDENCE`. That is why this page can stop re-sorting and\n   * why it inherits the fix rather than needing its own: filtering preserves order.\n   */\n  const availableMethods: AvailableMethod[] = useMemo(() => {\n    const methods = invitationInfo?.availableFirstFactorMethods ?? [];\n    return methods.filter((m) => INVITATION_RENDERABLE_METHODS.has(m.method as AuthMethod));\n  }, [invitationInfo]);\n\n  // Every renderable method is actionable (PASSKEY now enrolls at accept — Phase 3). The empty\n  // state (route to sign-in) is reserved for an org exposing NO renderable first-factor method\n  // (e.g. an SSO-only org whose per-connection lookup did not resolve).\n  const hasActionableMethod = availableMethods.length > 0;\n\n  // Any accept in flight — gates the decline / alternative-method buttons so a click can't race the\n  // single-use token. Password sets `auth.isLoading` via the context; magic-link + passkey run\n  // outside it (`magicLinkSubmitting` / `passkeyCeremonyInProgress`).\n  const methodSubmitInFlight = auth.isLoading || magicLinkSubmitting || passkeyCeremonyInProgress;\n\n  // Default to the first renderable method in display order.\n  const defaultMethod = useMemo(\n    () => (availableMethods[0]?.method as AuthMethod | undefined) ?? null,\n    [availableMethods],\n  );\n\n  const currentActiveMethod = activeMethod ?? defaultMethod;\n  const alternativeMethods = availableMethods.filter((m) => m.method !== currentActiveMethod);\n\n  /*\n   * The routing every auth screen shares (#972): nothing usable → the enrollment gate, which for an\n   * INVITATION session completes it and signs the invitee in (#603); something usable → the challenge.\n   * This screen already honours a `redirect` param for its post-auth destination, so the same target\n   * rides the MFA detour — the inline copy this replaced dropped it there.\n   */\n  useMfaContinuationNavigation({\n    mfaRequired: auth.mfaRequired,\n    mfaSessionId: auth.mfaSessionId,\n    usableSecondFactorMethods: auth.usableSecondFactorMethods,\n    email: inviteeEmail || undefined,\n    authRedirectTarget,\n  });\n\n  const handleInvitationSubmit = useCallback(async (data: UserInvitationFormDto) => {\n    formMethodsRef.current?.clearErrors('root');\n\n    if (data.password) {\n      const policyResult = AuthUtils.validatePasswordAgainstPolicy(data.password, passwordPolicy);\n      if (!policyResult.valid) {\n        formMethodsRef.current?.setError('root', {\n          type: 'policy',\n          message: resolvePasswordViolationsToLabels(policyResult.violations, t, passwordPolicy).join('. '),\n        });\n        return;\n      }\n    }\n\n    const normalizeText = (value?: string): string | undefined => {\n      const trimmed = value?.trim();\n      return trimmed ? trimmed : undefined;\n    };\n\n    try {\n      const result = await acceptInvitation({\n        invitationToken: token!,\n        firstName: normalizeText(data.firstName),\n        lastName: normalizeText(data.lastName),\n        password: data.password || undefined,\n      });\n      if (result?.signInRequired) setSignInRequired(true);\n      // Session issued → the `auth.accessToken` guard forwards to the app (honoring\n      // `postAuthRedirect`); MFA-gated → the `mfaRequired` effect routes; no session (#1158) → the sign-in state renders.\n    } catch (e: unknown) {\n      formMethodsRef.current?.setError('root', {\n        type: 'server',\n        message: toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)),\n      });\n    }\n  }, [acceptInvitation, passwordPolicy, t, token, toUserFacingErrorMessage]);\n\n  // Passkey enroll-at-accept: accept (bootstraps the session from the invitation token + returns a\n  // WebAuthn challenge) → run the browser ceremony → verify against the authenticated\n  // register-verify route. See `InvitationPasskeyForm`.\n  const handlePasskeySubmit = useCallback(async (firstName?: string, lastName?: string): Promise<void> => {\n    setPasskeyError(null);\n    setPasskeyCeremonyInProgress(true);\n    try {\n      const result = await acceptInvitation({\n        invitationToken: token!,\n        firstName,\n        lastName,\n        credentialMethod: AuthMethod.PASSKEY,\n      });\n      if (result?.signInRequired) {\n        // #1158: no session, so there is no ceremony to run; the terminal sign-in state renders.\n        setSignInRequired(true);\n        return;\n      }\n      const options = result?.passkeyRegistrationOptions;\n      if (options) {\n        // Session issued + a challenge. Enrollment failure is NON-FATAL — the invitation token\n        // already bootstrapped the session, so the invitee proceeds signed in and can add a\n        // passkey later in security settings.\n        try {\n          const credential = await startRegistration({ optionsJSON: options as unknown as PublicKeyCredentialCreationOptionsJSON });\n          await getManualCallsHttpClient().passkeyRegisterVerify({ response: credential });\n        } catch {\n          // Swallow — the session is already issued, so a cancelled/failed ceremony (or the rare\n          // cross-tab logout that clears the session mid-prompt and 401s the verify) is non-fatal:\n          // releasing the flag hands control to the `accessToken` guard, which forwards when the\n          // session survived and otherwise leaves the invitee on the accept screen (benign — they retry).\n        }\n      }\n      // Session path: releasing the flag (finally) → the `auth.accessToken` guard forwards to the\n      // app. MFA-gated path (no options): `acceptInvitation` set `mfaRequired` and the mfaRequired\n      // effect routes to enrollment (the invitee enrolls the passkey there via the existing route).\n    } catch (e: unknown) {\n      setPasskeyError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));\n    } finally {\n      setPasskeyCeremonyInProgress(false);\n    }\n  }, [acceptInvitation, token, t, toUserFacingErrorMessage]);\n\n  // Magic-link accept: emails a link + accepts the invite (via the HTTP client directly — no\n  // session to manage, like the login magic-link). On success the render switches to the terminal\n  // \"check your email\" state; errors propagate to the sub-form's root error.\n  const handleMagicLinkSubmit = useCallback(async (firstName?: string, lastName?: string): Promise<void> => {\n    setMagicLinkSubmitting(true);\n    try {\n      const response = await getManualCallsHttpClient().acceptInvitation({\n        invitationToken: token!,\n        firstName,\n        lastName,\n        credentialMethod: AuthMethod.MAGIC_LINK,\n        // The emailed link is opened on another page, so the deep link must travel inside it (#1014). Already\n        // same-origin: `extractAuthRedirectFromSearch` sanitised it, and the client and backend check again.\n        redirect: authRedirectTarget,\n      });\n      // #1158: an accept that issued no session sends no link either; say so rather than \"check your email\".\n      if (response.nextStep === AuthNextStep.SIGN_IN_REQUIRED) setSignInRequired(true);\n      else setMagicLinkSent(true);\n    } catch (e: any) {\n      // Route through the central error handler (logging + frontend-action execution, e.g. the global\n      // lockout UI) so a magic-link failure is handled identically to the password/passkey paths, which\n      // reach `handleError` via `acceptInvitation`. Then RE-THROW so the sub-form's own catch still\n      // renders the inline root error (the UX surface the user sees).\n      handleError(e, 'Invitation acceptance failed (magic link)', { credentialMethod: AuthMethod.MAGIC_LINK });\n      throw e;\n    } finally {\n      // The flag just releases the gate; the inline root error is owned by the sub-form's catch.\n      setMagicLinkSubmitting(false);\n    }\n  }, [token, handleError, authRedirectTarget]);\n\n  const handleDecline = useCallback(async () => {\n    setDeclineError(null);\n    if (!token) {\n      setDeclineError(t(UserInvitationLabel.INVALID_LINK));\n      return;\n    }\n\n    setIsDeclining(true);\n    try {\n      await getManualCallsHttpClient().rejectInvitation({ invitationToken: token });\n      setDeclined(true);\n    } catch (e: unknown) {\n      setDeclineError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));\n    } finally {\n      setIsDeclining(false);\n    }\n  }, [t, token, toUserFacingErrorMessage]);\n\n  // The reused method components self-handle their outcome (SSO/OAuth do a full-page\n  // redirect; magic-link shows its own \"sent\" state), so there is nothing to complete\n  // here. On the rare in-place success the `auth.accessToken` guard below lands the\n  // invitee in the app.\n  const handleMethodSuccess = useCallback((_response: AuthenticationResponse) => {}, []);\n  const handleMethodError = useCallback((_error: string) => {}, []);\n\n  /**\n   * Render the active first-factor method:\n   *  - `PASSWORD` / `MAGIC_LINK` / `PASSKEY` → invitation-specific accept sub-forms\n   *    (special-cased; never the login flow).\n   *  - `ORG_SAML` / `ORG_OPENID_CONNECT` / `EXTERNAL_OAUTH2` → the shared login method\n   *    component from the registry.\n   */\n  const renderActiveMethod = (): React.ReactNode => {\n    if (!currentActiveMethod) return null;\n    const methodConfig = availableMethods.find((m) => m.method === currentActiveMethod);\n    if (!methodConfig) return null;\n\n    if (currentActiveMethod === AuthMethod.PASSWORD) {\n      return (\n        <AutomatedForm\n          schema={invitationFormSchema}\n          defaultValues={{\n            firstName: '',\n            lastName: '',\n            password: '',\n            confirmPassword: '',\n          }}\n          onSubmit={handleInvitationSubmit}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={auth.isLoading || isDeclining}\n          onFormReady={handleFormReady}\n          labels={{\n            fields: {\n              firstName: t(UserInvitationLabel.FIRST_NAME),\n              lastName: t(UserInvitationLabel.LAST_NAME),\n              password: t(UserInvitationLabel.PASSWORD),\n              confirmPassword: t(UserInvitationLabel.CONFIRM_PASSWORD),\n            },\n          }}\n          layoutTemplate={() => <InvitationFormTemplate invitationEmail={inviteeEmail} passwordPolicy={passwordPolicy} />}\n        />\n      );\n    }\n\n    if (currentActiveMethod === AuthMethod.MAGIC_LINK) {\n      // NOT the reused login `MagicLinkAuthMethod` (which sends a LOGIN magic link that\n      // never accepts the invite and rejects a not-yet-ACTIVE invitee at verify). This\n      // drives `acceptInvitation({ credentialMethod: MAGIC_LINK })`, which activates + flips\n      // the membership before emailing the link. See `handleMagicLinkSubmit`.\n      return (\n        <InvitationMagicLinkForm\n          invitationEmail={inviteeEmail}\n          disabled={auth.isLoading || isDeclining}\n          onSubmit={handleMagicLinkSubmit}\n          t={t}\n          tAuth={tAuth}\n        />\n      );\n    }\n\n    if (currentActiveMethod === AuthMethod.PASSKEY) {\n      // Passkey ENROLL-at-accept (Phase 3): the login `PasskeyAuthMethod` authenticates an\n      // EXISTING credential, so it is NOT reused. `InvitationPasskeyForm` drives\n      // `acceptInvitation({credentialMethod: PASSKEY})` (bootstraps the session + returns a\n      // WebAuthn challenge) then runs the ceremony + verify. See `handlePasskeySubmit`.\n      return (\n        <InvitationPasskeyForm\n          invitationEmail={inviteeEmail}\n          disabled={auth.isLoading || isDeclining}\n          error={passkeyError}\n          onSubmit={handlePasskeySubmit}\n          t={t}\n        />\n      );\n    }\n\n    // ORG_SAML / ORG_OPENID_CONNECT / EXTERNAL_OAUTH2 — reuse the shared login method\n    // components. They are account-agnostic and self-wire their own hooks/redirects\n    // (full-page IdP redirect / OAuth JIT, which consume the INVITED membership); we only\n    // supply the invitee email + org method config. (PASSWORD, MAGIC_LINK, and PASSKEY are\n    // special-cased above — they need invitation-specific accept wiring, not login reuse.)\n    const MethodComponent = AUTH_METHOD_COMPONENTS[currentActiveMethod];\n    if (!MethodComponent) return null;\n\n    const props: AuthMethodComponentProps = {\n      sessionId: '', // no session for a not-yet-activated invitee\n      email: inviteeEmail ?? '',\n      methodConfig,\n      onSuccess: handleMethodSuccess,\n      onError: handleMethodError,\n      factorLevel: 'first',\n      isLoading: auth.isLoading || isDeclining,\n      t: tAuthForMethodComponent,\n    };\n\n    return <MethodComponent {...props} />;\n  };\n\n  // Already authenticated — including returning from an SSO/OAuth JIT round-trip that\n  // consumed the invite — so forward the invitee into the app rather than re-showing the\n  // accept screen (mirrors `Auth_Main`). Guards against an already-signed-in user\n  // accepting a token minted for a different email.\n  // EXCEPTION: during passkey enroll-at-accept the token is issued BEFORE the WebAuthn ceremony\n  // runs, so suppress the forward until the ceremony finishes (else the component unmounts and\n  // the browser passkey prompt is cancelled); `handlePasskeySubmit` releases the flag when done.\n  // Ordered BEFORE the `!isReady` i18n gate (like `Auth_AuthCallback`): the `<Navigate>` renders no\n  // labels, so a slow/failed label load must not block forwarding an already-authenticated invitee.\n  if (auth.accessToken && !passkeyCeremonyInProgress) {\n    return <Navigate to={postAuthRedirect} replace />;\n  }\n\n  if (!isReady) return null;\n\n  if (!token) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.ERROR_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserInvitationLabel.INVALID_LINK)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  if (declined) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.DECLINE_SUCCESS_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserInvitationLabel.DECLINE_SUCCESS_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.CONTINUE_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  // Accepted without a session (#1158): the invitee's policy disables the email-possession sign-in the invitation link\n  // amounts to. Terminal: the membership exists, and they continue on the sign-in page.\n  if (signInRequired) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.SIGN_IN_REQUIRED_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{t(UserInvitationLabel.SIGN_IN_REQUIRED_MESSAGE)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  // Magic-link accepted — the invite is consumed and a sign-in link was emailed. Terminal state:\n  // the invitee finishes by clicking the emailed link (no chooser/decline — the token is gone, so\n  // any other method would only 4xx).\n  if (magicLinkSent) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{tAuth(UserAuthLabel.MAGIC_LINK_SENT_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{tAuth(UserAuthLabel.MAGIC_LINK_SENT_DESCRIPTION)}</Text>\n          {inviteeEmail && (\n            <Text className=\"text-sm text-muted-foreground\">{inviteeEmail}</Text>\n          )}\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  if (infoLoading) {\n    return (\n      <div className=\"flex items-center justify-center py-group\">\n        <LoadingSpinner size={40} />\n      </div>\n    );\n  }\n\n  if (infoError || !invitationInfo) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.ERROR_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">{infoError || t(UserInvitationLabel.INVALID_LINK)}</Text>\n        </div>\n        <div className=\"text-center\">\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        </div>\n      </>\n    );\n  }\n\n  // SCIM-managed org → informational only, NO password/method form (locked decision:\n  // the directory is the identity authority, so no local credential is set here).\n  if (invitationInfo.managementMode === InvitationManagementMode.SCIM) {\n    return (\n      <>\n        <div className=\"text-center space-y-item-xs mb-group\">\n          <Heading>{t(UserInvitationLabel.SCIM_MANAGED_TITLE)}</Heading>\n          <Text className=\"max-w-sm mx-auto\">\n            {t(UserInvitationLabel.SCIM_MANAGED_MESSAGE)}\n          </Text>\n          {inviteeEmail && (\n            <Text className=\"text-sm text-muted-foreground\">{inviteeEmail}</Text>\n          )}\n        </div>\n\n        {declineError && (\n          <Alert variant=\"destructive\" className=\"mb-group\">\n            <AlertDescription>{declineError}</AlertDescription>\n          </Alert>\n        )}\n\n        <div className=\"text-center mt-group space-y-item-sm\">\n          <Button\n            variant={ButtonVariants_Variant.OUTLINE}\n            onClick={handleDecline}\n            disabled={isDeclining}\n            className=\"w-full\"\n          >\n            {isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION)}\n          </Button>\n          <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n          {/* The directory already holds this person's data (Art. 14(3)); see `AuthPrivacyNoticeLink` (#2976). */}\n          <AuthPrivacyNoticeLink label={tAuth(UserAuthLabel.PRIVACY_NOTICE_LINK)} />\n        </div>\n      </>\n    );\n  }\n\n  // OPEN / SSO org → the method chooser.\n  return (\n    <>\n      <div className=\"text-center space-y-item-xs mb-group\">\n        <Heading>{t(UserInvitationLabel.TITLE)}</Heading>\n        <Text className=\"max-w-sm mx-auto\">{t(UserInvitationLabel.SUB_TITLE)}</Text>\n        {invitationInfo.organizationName && (\n          <Text className=\"text-sm text-muted-foreground\">{invitationInfo.organizationName}</Text>\n        )}\n        {inviteeEmail && (\n          <Text className=\"text-sm text-muted-foreground\">{inviteeEmail}</Text>\n        )}\n      </div>\n\n      {hasActionableMethod ? (\n        <>\n          <Text className=\"text-sm text-muted-foreground text-center mb-element\">\n            {t(UserInvitationLabel.METHOD_CHOICE_HINT)}\n          </Text>\n\n          {/* Active first-factor method (password form / magic-link form / passkey form / reused SSO·OAuth component). */}\n          {renderActiveMethod()}\n\n          {/* Alternative methods — buttons that switch the active method. */}\n          {alternativeMethods.length > 0 && (\n            <>\n              <LabeledDivider label={tAuth(UserAuthLabel.OTHER_METHODS_DIVIDER)} />\n\n              <AuthMethodChoiceList\n                methods={alternativeMethods.map((method) => method.method as AuthMethod)}\n                /*\n                 * The descriptor names an enterprise connection, so an invitee choosing their\n                 * organization's provider sees ITS name rather than \"Organization sign-in\".\n                 *\n                 * No `socialProviders`: this screen configures no social buttons of its own, and the\n                 * resolver declines to name a provider it cannot resolve rather than printing a raw\n                 * `providerRef` — so a social alternative keeps the generic kind here, deliberately.\n                 */\n                labelFor={(method) => resolveAuthMethodChoiceLabel(method, {\n                  offeredMethod: alternativeMethods.find((candidate) => candidate.method === method),\n                  continueWithTemplate: tAuth(UserAuthLabel.CONTINUE_WITH),\n                  translateLabel: (label) => tAuth(label),\n                  resolveSocialProviderLabel: (provider) => provider.displayName ?? provider.providerRef,\n                })}\n                onSelect={(method) => { setActiveMethod(method); setPasskeyError(null); }}\n                disabled={methodSubmitInFlight || isDeclining}\n              />\n            </>\n          )}\n        </>\n      ) : (\n        /*\n          No renderable first-factor method on this screen — a valid state, not an error. The\n          common case is an SSO-only org whose invitee arrives before directory provisioning: the\n          token-keyed endpoint omits ORG_SAML/ORG_OPENID_CONNECT when no per-connection lookup\n          resolved, yielding an empty set with mode OPEN. Route the invitee to the sign-in page,\n          where email→domain SSO resolution works and the enterprise / OAuth JIT consumes the invite.\n        */\n        <Alert>\n          <AlertDescription>\n            {t(UserInvitationLabel.NO_METHOD_AVAILABLE_HINT)}\n          </AlertDescription>\n        </Alert>\n      )}\n\n      {declineError && (\n        <Alert variant=\"destructive\" className=\"mt-group\">\n          <AlertDescription>{declineError}</AlertDescription>\n        </Alert>\n      )}\n\n      <div className=\"text-center mt-group space-y-item-sm\">\n        <Button\n          variant={ButtonVariants_Variant.OUTLINE}\n          onClick={handleDecline}\n          disabled={methodSubmitInFlight || isDeclining}\n          className=\"w-full\"\n        >\n          {isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION)}\n        </Button>\n        <AuthSecondaryLink href={loginPath}>{t(UserInvitationLabel.LOGIN_LINK)}</AuthSecondaryLink>\n        {/*\n          This screen collects the invitee's name and credential before any session exists, the Art. 13(1) moment, and an\n          invited member of an internal tool meets it before sign-in. `AuthPrivacyNoticeLink` records why (#2976). The\n          word is the sign-in screen's (`UserAuthLabel`), whose namespace this screen already loads for its methods.\n        */}\n        <AuthPrivacyNoticeLink label={tAuth(UserAuthLabel.PRIVACY_NOTICE_LINK)} />\n      </div>\n    </>\n  );\n};\n\nexport function Auth_Invitation({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_UserInvitation_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_UserInvitation_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, 'Auth_Invitation')(preset);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_Invitation.labels.js

@@ -36,13 +36,13 @@ export const PublicLayoutsUserInvitationLabels = [
         ref: UserInvitationLabel.POLICY_MIN_LENGTH,
         kind: LabelKind.DESCRIPTION,
         purpose: 'Password-policy hint for the minimum required length',
-        params: [{ key: 'minLength', meaning: 'minimum number of characters the password must contain' }],
+        params: [{ key: 'minLength', meaning: 'minimum number of characters the password must contain', isCount: true }],
     },
     {
         ref: UserInvitationLabel.POLICY_MAX_LENGTH,
         kind: LabelKind.DESCRIPTION,
         purpose: 'Password-policy hint for the maximum allowed length',
-        params: [{ key: 'maxLength', meaning: 'maximum number of characters the password may contain' }],
+        params: [{ key: 'maxLength', meaning: 'maximum number of characters the password may contain', isCount: true }],
     },
     { ref: UserInvitationLabel.POLICY_UPPERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one uppercase letter' },
     { ref: UserInvitationLabel.POLICY_LOWERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one lowercase letter' },