@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/components/auth/Auth_Invitation.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Invitation.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Invitation.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,iCAAiC,GAA0B;IACtE,EAAE,GAAG,EAAE,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,yCAAyC,EAAE;IAC/G,EAAE,GAAG,EAAE,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,0DAA0D,EAAE;IACxI,EAAE,GAAG,EAAE,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACvH,EAAE,GAAG,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE;IAC/G,EAAE,GAAG,EAAE,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC7G,EAAE,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE;IAC3G,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC3H,EAAE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,oEAAoE,EAAE;IACrJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAChJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,qCAAqC,EAAE;IACvH,EAAE,GAAG,EAAE,mBAAmB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAChJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACtI,EAAE,GAAG,EAAE,mBAAmB,CAAC,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kDAAkD,EAAE;IAC1I,EAAE,GAAG,EAAE,mBAAmB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IACnJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACnI,EAAE,GAAG,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACrG,EAAE,GAAG,EAAE,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,8DAA8D,EAAE;IAC1I,EAAE,GAAG,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,gHAAgH,EAAE;IACvM,EAAE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE;IAChJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IACvJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iIAAiI,EAAE;IACpN,EAAE,GAAG,EAAE,mBAAmB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+LAA+L,EAAE;IACpR,EAAE,GAAG,EAAE,mBAAmB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0IAA0I,EAAE;IACnO,EAAE,GAAG,EAAE,mBAAmB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,6HAA6H,EAAE;IACrN,EAAE,GAAG,EAAE,mBAAmB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,iGAAiG,EAAE;IAC/K,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IAC3J,EAAE,GAAG,EAAE,mBAAmB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iOAAiO,EAAE;IAC1T,EAAE,GAAG,EAAE,mBAAmB,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,wIAAwI,EAAE;IAC/N,EAAE,GAAG,EAAE,mBAAmB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iJAAiJ,EAAE;IAC1O;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;KAClG;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,qDAAqD;QAC9D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;KACjG;IACD,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACnJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACnJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACrI,EAAE,GAAG,EAAE,mBAAmB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACvJ;QACE,GAAG,EAAE,mBAAmB,CAAC,kBAAkB;QAC3C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EACL,0VAA0V;KAC7V;CACF,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,iCAAiC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels, UserInvitationLabel } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsUserInvitationLabels: LabellingUnitaryDef[] = [\n  { ref: UserInvitationLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the accept-invitation screen' },\n  { ref: UserInvitationLabel.SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line explaining the invitation being accepted' },\n  { ref: UserInvitationLabel.EMAIL_ADDRESS, kind: LabelKind.LABEL, purpose: 'Field label for the invited email address' },\n  { ref: UserInvitationLabel.FIRST_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the first-name input' },\n  { ref: UserInvitationLabel.LAST_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the last-name input' },\n  { ref: UserInvitationLabel.PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the password input' },\n  { ref: UserInvitationLabel.CONFIRM_PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the confirm-password input' },\n  { ref: UserInvitationLabel.ACCEPT_INVITATION, kind: LabelKind.BUTTON, purpose: 'Primary button that accepts the invitation and creates the account' },\n  { ref: UserInvitationLabel.ACCEPTING_INVITATION, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the invitation is being accepted' },\n  { ref: UserInvitationLabel.DECLINE_INVITATION, kind: LabelKind.BUTTON, purpose: 'Button that declines the invitation' },\n  { ref: UserInvitationLabel.DECLINING_INVITATION, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the invitation is being declined' },\n  { ref: UserInvitationLabel.DECLINE_SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the invitation was declined' },\n  { ref: UserInvitationLabel.DECLINE_SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body text confirming the invitation was declined' },\n  { ref: UserInvitationLabel.INVALID_LINK, kind: LabelKind.MESSAGE, purpose: 'Error shown when the invitation link is missing, invalid, or expired' },\n  { ref: UserInvitationLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the invitation cannot be processed' },\n  { ref: UserInvitationLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link to the sign-in screen' },\n  { ref: UserInvitationLabel.CONTINUE_LINK, kind: LabelKind.LABEL, purpose: 'Link to continue into the app after accepting the invitation' },\n  { ref: UserInvitationLabel.METHOD_CHOICE_HINT, kind: LabelKind.DESCRIPTION, purpose: 'Intro hint above the method chooser inviting the user to choose how they will sign in to accept the invitation' },\n  { ref: UserInvitationLabel.PASSWORD_MISMATCH, kind: LabelKind.MESSAGE, purpose: 'Validation error when password and confirmation do not match' },\n  { ref: UserInvitationLabel.UNEXPECTED_ERROR, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when accepting the invitation fails unexpectedly' },\n  { ref: UserInvitationLabel.SCIM_MANAGED_TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the informational state shown when the org is directory-managed (SCIM) and the invitee cannot set a local credential' },\n  { ref: UserInvitationLabel.SCIM_MANAGED_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body explaining that a directory-managed (SCIM) account is provisioned by the organization directory — sign in via SSO or wait to be provisioned automatically; no local password is set here' },\n  { ref: UserInvitationLabel.PASSKEY_UNAVAILABLE_HINT, kind: LabelKind.MESSAGE, purpose: 'Message shown for the passkey method when the browser has no WebAuthn/passkey support, telling the user to choose another sign-in method' },\n  { ref: UserInvitationLabel.PASSKEY_DESCRIPTION, kind: LabelKind.DESCRIPTION, purpose: 'Short description above the passkey accept form explaining the invitee will be prompted by their device to create a passkey' },\n  { ref: UserInvitationLabel.PASSKEY_CREATE, kind: LabelKind.BUTTON, purpose: 'Primary button that accepts the invitation by creating a passkey (starts the WebAuthn ceremony)' },\n  { ref: UserInvitationLabel.PASSKEY_CREATING, kind: LabelKind.MESSAGE, purpose: 'In-progress status shown while the passkey is being created and verified' },\n  { ref: UserInvitationLabel.NO_METHOD_AVAILABLE_HINT, kind: LabelKind.MESSAGE, purpose: 'Informational message shown when the organization exposes no sign-in method on the invitation screen (e.g. an SSO-only org whose invitee arrived before directory provisioning), directing them to continue on the sign-in page' },\n  { ref: UserInvitationLabel.SIGN_IN_REQUIRED_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown after accepting an invitation that did not sign the user in: the invitation is accepted and they must sign in separately' },\n  { ref: UserInvitationLabel.SIGN_IN_REQUIRED_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body explaining the invitation was accepted, but this account cannot be signed in from the invitation link and must sign in on the sign-in page' },\n  {\n    ref: UserInvitationLabel.POLICY_MIN_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the minimum required length',\n    params: [{ key: 'minLength', meaning: 'minimum number of characters the password must contain' }],\n  },\n  {\n    ref: UserInvitationLabel.POLICY_MAX_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the maximum allowed length',\n    params: [{ key: 'maxLength', meaning: 'maximum number of characters the password may contain' }],\n  },\n  { ref: UserInvitationLabel.POLICY_UPPERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one uppercase letter' },\n  { ref: UserInvitationLabel.POLICY_LOWERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one lowercase letter' },\n  { ref: UserInvitationLabel.POLICY_NUMBER, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one digit' },\n  { ref: UserInvitationLabel.POLICY_SPECIAL_CHAR, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one special character' },\n  {\n    ref: UserInvitationLabel.POLICY_BLOCKLISTED,\n    kind: LabelKind.DESCRIPTION,\n    purpose:\n      'Refusal shown when the chosen password is a known common guess, the application\\'s own name, or the local part of the user\\'s own email address. It reports a property of THIS password rather than an unmet rule, so it must not read like the other hints — there is no character the user can add to satisfy it, only a different password to choose.',\n  },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, PublicLayoutsUserInvitationLabels);\n"]}
+{"version":3,"file":"Auth_Invitation.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Invitation.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/J,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,iCAAiC,GAA0B;IACtE,EAAE,GAAG,EAAE,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,yCAAyC,EAAE;IAC/G,EAAE,GAAG,EAAE,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,0DAA0D,EAAE;IACxI,EAAE,GAAG,EAAE,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACvH,EAAE,GAAG,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE;IAC/G,EAAE,GAAG,EAAE,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC7G,EAAE,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE;IAC3G,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC3H,EAAE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,oEAAoE,EAAE;IACrJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAChJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,qCAAqC,EAAE;IACvH,EAAE,GAAG,EAAE,mBAAmB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAChJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACtI,EAAE,GAAG,EAAE,mBAAmB,CAAC,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kDAAkD,EAAE;IAC1I,EAAE,GAAG,EAAE,mBAAmB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IACnJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACnI,EAAE,GAAG,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACrG,EAAE,GAAG,EAAE,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,8DAA8D,EAAE;IAC1I,EAAE,GAAG,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,gHAAgH,EAAE;IACvM,EAAE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE;IAChJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IACvJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iIAAiI,EAAE;IACpN,EAAE,GAAG,EAAE,mBAAmB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+LAA+L,EAAE;IACpR,EAAE,GAAG,EAAE,mBAAmB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0IAA0I,EAAE;IACnO,EAAE,GAAG,EAAE,mBAAmB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,6HAA6H,EAAE;IACrN,EAAE,GAAG,EAAE,mBAAmB,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,iGAAiG,EAAE;IAC/K,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE;IAC3J,EAAE,GAAG,EAAE,mBAAmB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iOAAiO,EAAE;IAC1T,EAAE,GAAG,EAAE,mBAAmB,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,wIAAwI,EAAE;IAC/N,EAAE,GAAG,EAAE,mBAAmB,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iJAAiJ,EAAE;IAC1O;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KACjH;IACD;QACE,GAAG,EAAE,mBAAmB,CAAC,iBAAiB;QAC1C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EAAE,qDAAqD;QAC9D,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,uDAAuD,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KAChH;IACD,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACnJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACnJ,EAAE,GAAG,EAAE,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACrI,EAAE,GAAG,EAAE,mBAAmB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACvJ;QACE,GAAG,EAAE,mBAAmB,CAAC,kBAAkB;QAC3C,IAAI,EAAE,SAAS,CAAC,WAAW;QAC3B,OAAO,EACL,0VAA0V;KAC7V;CACF,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,iCAAiC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels, UserInvitationLabel } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsUserInvitationLabels: LabellingUnitaryDef[] = [\n  { ref: UserInvitationLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the accept-invitation screen' },\n  { ref: UserInvitationLabel.SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line explaining the invitation being accepted' },\n  { ref: UserInvitationLabel.EMAIL_ADDRESS, kind: LabelKind.LABEL, purpose: 'Field label for the invited email address' },\n  { ref: UserInvitationLabel.FIRST_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the first-name input' },\n  { ref: UserInvitationLabel.LAST_NAME, kind: LabelKind.LABEL, purpose: 'Field label for the last-name input' },\n  { ref: UserInvitationLabel.PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the password input' },\n  { ref: UserInvitationLabel.CONFIRM_PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the confirm-password input' },\n  { ref: UserInvitationLabel.ACCEPT_INVITATION, kind: LabelKind.BUTTON, purpose: 'Primary button that accepts the invitation and creates the account' },\n  { ref: UserInvitationLabel.ACCEPTING_INVITATION, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the invitation is being accepted' },\n  { ref: UserInvitationLabel.DECLINE_INVITATION, kind: LabelKind.BUTTON, purpose: 'Button that declines the invitation' },\n  { ref: UserInvitationLabel.DECLINING_INVITATION, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the invitation is being declined' },\n  { ref: UserInvitationLabel.DECLINE_SUCCESS_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the invitation was declined' },\n  { ref: UserInvitationLabel.DECLINE_SUCCESS_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body text confirming the invitation was declined' },\n  { ref: UserInvitationLabel.INVALID_LINK, kind: LabelKind.MESSAGE, purpose: 'Error shown when the invitation link is missing, invalid, or expired' },\n  { ref: UserInvitationLabel.ERROR_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when the invitation cannot be processed' },\n  { ref: UserInvitationLabel.LOGIN_LINK, kind: LabelKind.LABEL, purpose: 'Link to the sign-in screen' },\n  { ref: UserInvitationLabel.CONTINUE_LINK, kind: LabelKind.LABEL, purpose: 'Link to continue into the app after accepting the invitation' },\n  { ref: UserInvitationLabel.METHOD_CHOICE_HINT, kind: LabelKind.DESCRIPTION, purpose: 'Intro hint above the method chooser inviting the user to choose how they will sign in to accept the invitation' },\n  { ref: UserInvitationLabel.PASSWORD_MISMATCH, kind: LabelKind.MESSAGE, purpose: 'Validation error when password and confirmation do not match' },\n  { ref: UserInvitationLabel.UNEXPECTED_ERROR, kind: LabelKind.MESSAGE, purpose: 'Generic error shown when accepting the invitation fails unexpectedly' },\n  { ref: UserInvitationLabel.SCIM_MANAGED_TITLE, kind: LabelKind.HEADING, purpose: 'Heading of the informational state shown when the org is directory-managed (SCIM) and the invitee cannot set a local credential' },\n  { ref: UserInvitationLabel.SCIM_MANAGED_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body explaining that a directory-managed (SCIM) account is provisioned by the organization directory — sign in via SSO or wait to be provisioned automatically; no local password is set here' },\n  { ref: UserInvitationLabel.PASSKEY_UNAVAILABLE_HINT, kind: LabelKind.MESSAGE, purpose: 'Message shown for the passkey method when the browser has no WebAuthn/passkey support, telling the user to choose another sign-in method' },\n  { ref: UserInvitationLabel.PASSKEY_DESCRIPTION, kind: LabelKind.DESCRIPTION, purpose: 'Short description above the passkey accept form explaining the invitee will be prompted by their device to create a passkey' },\n  { ref: UserInvitationLabel.PASSKEY_CREATE, kind: LabelKind.BUTTON, purpose: 'Primary button that accepts the invitation by creating a passkey (starts the WebAuthn ceremony)' },\n  { ref: UserInvitationLabel.PASSKEY_CREATING, kind: LabelKind.MESSAGE, purpose: 'In-progress status shown while the passkey is being created and verified' },\n  { ref: UserInvitationLabel.NO_METHOD_AVAILABLE_HINT, kind: LabelKind.MESSAGE, purpose: 'Informational message shown when the organization exposes no sign-in method on the invitation screen (e.g. an SSO-only org whose invitee arrived before directory provisioning), directing them to continue on the sign-in page' },\n  { ref: UserInvitationLabel.SIGN_IN_REQUIRED_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown after accepting an invitation that did not sign the user in: the invitation is accepted and they must sign in separately' },\n  { ref: UserInvitationLabel.SIGN_IN_REQUIRED_MESSAGE, kind: LabelKind.MESSAGE, purpose: 'Body explaining the invitation was accepted, but this account cannot be signed in from the invitation link and must sign in on the sign-in page' },\n  {\n    ref: UserInvitationLabel.POLICY_MIN_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the minimum required length',\n    params: [{ key: 'minLength', meaning: 'minimum number of characters the password must contain', isCount: true }],\n  },\n  {\n    ref: UserInvitationLabel.POLICY_MAX_LENGTH,\n    kind: LabelKind.DESCRIPTION,\n    purpose: 'Password-policy hint for the maximum allowed length',\n    params: [{ key: 'maxLength', meaning: 'maximum number of characters the password may contain', isCount: true }],\n  },\n  { ref: UserInvitationLabel.POLICY_UPPERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one uppercase letter' },\n  { ref: UserInvitationLabel.POLICY_LOWERCASE, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one lowercase letter' },\n  { ref: UserInvitationLabel.POLICY_NUMBER, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one digit' },\n  { ref: UserInvitationLabel.POLICY_SPECIAL_CHAR, kind: LabelKind.DESCRIPTION, purpose: 'Password-policy hint requiring at least one special character' },\n  {\n    ref: UserInvitationLabel.POLICY_BLOCKLISTED,\n    kind: LabelKind.DESCRIPTION,\n    purpose:\n      'Refusal shown when the chosen password is a known common guess, the application\\'s own name, or the local part of the user\\'s own email address. It reports a property of THIS password rather than an unmet rule, so it must not read like the other hints — there is no character the user can add to satisfy it, only a different password to choose.',\n  },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, PublicLayoutsUserInvitationLabels);\n"]}

package/dist/esm/components/auth/Auth_Main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Main.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.tsx"],"names":[],"mappings":"AACA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAgDjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAA;AAoEvH,MAAM,WAAW,wCAAwC;CACxD;AAED,eAAO,MAAM,mCAAmC,GAAI,IAAI,wCAAwC,KAAG,KAAK,CAAC,GAAG,CAAC,OAgc5G,CAAC;AAEF,wBAAgB,SAAS,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,wCAAwC,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAI5J"}
+{"version":3,"file":"Auth_Main.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.tsx"],"names":[],"mappings":"AACA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAmDjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAA;AAiFvH,MAAM,WAAW,wCAAwC;CACxD;AAED,eAAO,MAAM,mCAAmC,GAAI,IAAI,wCAAwC,KAAG,KAAK,CAAC,GAAG,CAAC,OA+d5G,CAAC;AAEF,wBAAgB,SAAS,CAAC,EAAE,MAAgC,EAAE,GAAG,KAAK,EAAE,EAAE,wCAAwC,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAI5J"}

package/dist/esm/components/auth/Auth_Main.js

@@ -3,9 +3,10 @@ import { useMemo, useState, useCallback, useEffect, useRef } from 'react';
 import { Navigate, useLocation } from 'react-router-dom';
 import { FrontendComponentType, UserAuthLabel } from '@wildo-ai/presets-components-models';
 import { ValidationMode } from '@wildo-ai/zod-decorators';
-import { AuthMethod, AuthSessionPurpose, getEnabledFirstFactorMethods, getEnabledMethods, AuthIdentifyFormDtoSchema, } from '@wildo-ai/saas-models';
+import { AuthMethod, AuthRedirectErrorCode, AuthSessionPurpose, getEnabledFirstFactorMethods, getEnabledMethods, AuthIdentifyFormDtoSchema, } from '@wildo-ai/saas-models';
 import { useUserOrgs } from '../../core/security/useUserOrgs.js';
 import { useAuthSession } from '../../core/security/useAuthSession.js';
+import { SessionEndReason } from '../../core/events/events.frontend.schemas.js';
 import { PasskeyAutofillExpiredError, PasskeySignInMediation } from '../../core/security/security.frontend.schemas.js';
 import { browserSupportsWebAuthnAutofill, WebAuthnAbortService } from '@simplewebauthn/browser';
 import { organizationOnboardingNavigationTarget } from '../../core/security/organization-onboarding.frontend.utils.js';
@@ -28,6 +29,7 @@ import { resolveOAuthProviderDisplayLabel, resolvePublicOAuthProviderEntries } f
 import { OAuthProvidersSection, SSO_PROVIDER_BRAND_META } from '../../components/auth/utils/OAuthProvidersSection.js';
 import { useMfaContinuationNavigation } from '../../components/auth/utils/useMfaContinuationNavigation.js';
 import { LabeledDivider } from '../../components/auth/utils/LabeledDivider.js';
+import { AuthPrivacyNoticeLink } from '../../components/auth/utils/AuthPrivacyNoticeLink.js';
 import { AUTH_METHOD_COMPONENTS } from '../../components/auth/methods/auth-method-components.js';
 import { resolveAuthMethodChoiceLabel } from '../../components/auth/methods/auth-method-presentation.js';
 import { AuthMethodChoiceList } from '../../components/auth/utils/AuthMethodChoiceList.js';
@@ -76,9 +78,21 @@ function waitForPasskeyAutofillField(timeoutMs) {
 }
 /** How long the page waits for the email field before giving up on offering passkey autofill. */
 const PASSKEY_AUTOFILL_FIELD_WAIT_MS = 3000;
+/**
+ * The authored words for each code an external sign-in redirects back with (#2567). Total over
+ * `AuthRedirectErrorCode`, so a code added to the vocabulary must be given words here before it compiles.
+ */
+const AUTH_REDIRECT_ERROR_LABELS = {
+    [AuthRedirectErrorCode.SAML_LOGIN_FAILED]: { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' },
+    [AuthRedirectErrorCode.SAML_AUTH_FAILED]: { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' },
+    [AuthRedirectErrorCode.MISSING_PARAMS]: { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' },
+    [AuthRedirectErrorCode.OAUTH_FAILED]: { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' },
+    // A sign-out that did not finish at the provider is a caution, not a failure of what the person asked for here.
+    [AuthRedirectErrorCode.SAML_SLO_FAILED]: { label: UserAuthLabel.PROVIDER_SIGN_OUT_FAILED, variant: 'warning' },
+};
 export const PublicLayoutPreset_UserAuth_Default = ({}) => {
     const { auth, identifyByEmail, initiateOAuth2Login } = useUserOrgs();
-    const { signInWithPasskey } = useAuthSession();
+    const { signInWithPasskey, endedSessionReason } = useAuthSession();
     const resolvedAuth = useResolvedAuthConfig();
     const location = useLocation();
     const enabledSocialOAuth2Providers = useMemo(() => {
@@ -97,10 +111,29 @@ export const PublicLayoutPreset_UserAuth_Default = ({}) => {
     const publicRoutes = CommonRoutePaths;
     const postAuthRedirect = useMemo(() => resolvePostAuthRedirect(location.search), [location.search]);
     const authRedirectTarget = useMemo(() => extractAuthRedirectFromSearch(location.search), [location.search]);
+    /**
+     * An external sign-in sent the person back here with an error code (#2567). Only the CODE is read, and it chooses
+     * authored words; any text the URL carries is never shown, because a link can carry any sentence and the page would
+     * present it as the application's own error. An unrecognised code reads as a failed provider sign-in.
+     */
     const redirectedAuthError = useMemo(() => {
-        const searchParams = new URLSearchParams(location.search);
-        return searchParams.get('reason') ?? searchParams.get('error');
-    }, [location.search]);
+        const code = new URLSearchParams(location.search).get('error');
+        if (!code)
+            return null;
+        const { label, variant } = AUTH_REDIRECT_ERROR_LABELS[code]
+            ?? { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' };
+        return { text: tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, label), variant };
+    }, [location.search, tComponent]);
+    /**
+     * Why the person is here when the BACKEND ended their session (#2541), in authored words. An account that can no
+     * longer sign in (deactivated, suspended, pending) is told that an administrator must restore it, because trying
+     * again cannot work; any other refused session is told it ended and to sign in again.
+     */
+    const endedSessionNotice = endedSessionReason === SessionEndReason.ACCOUNT_NOT_ACTIVE
+        ? { text: t(UserAuthLabel.ACCOUNT_NOT_ACTIVE_NOTICE), variant: 'destructive' }
+        : endedSessionReason === SessionEndReason.SESSION_ENDED
+            ? { text: t(UserAuthLabel.SESSION_ENDED_NOTICE), variant: 'info' }
+            : null;
     const passwordLostHref = useMemo(() => appendAuthRedirectToPath(publicRoutes.passwordLost, authRedirectTarget), [authRedirectTarget, publicRoutes.passwordLost]);
     const registerHref = useMemo(() => appendAuthRedirectToPath(publicRoutes.register, authRedirectTarget), [authRedirectTarget, publicRoutes.register]);
     const [activeMethod, setActiveMethod] = useState(null);
@@ -313,7 +346,7 @@ export const PublicLayoutPreset_UserAuth_Default = ({}) => {
                             ? t(UserAuthLabel.REAUTH_TITLE)
                             : t(UserAuthLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: auth.purpose === AuthSessionPurpose.REAUTH
                             ? t(UserAuthLabel.REAUTH_SUB_TITLE)
-                            : t(UserAuthLabel.SUB_TITLE) })] }), showPreIdentifyOAuth && (_jsx(OAuthProvidersSection, { providers: enabledSocialOAuth2Providers, onProviderClick: handleOAuth2Click, isLoading: auth.isLoading, continueWithLabel: t(UserAuthLabel.CONTINUE_WITH), translate: translate, dividerLabel: t(UserAuthLabel.DIVIDER_OR), showDivider: showDivider })), !auth.error && redirectedAuthError && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: redirectedAuthError }) })), showIdentifyForm && isIdentifierStepOffered && (_jsx(AutomatedForm, { schema: AuthIdentifyFormDtoSchema, defaultValues: { email: '' }, onSubmit: handleIdentify, validationMode: ValidationMode.ON_BLUR, disabled: auth.isLoading, labels: {
+                            : t(UserAuthLabel.SUB_TITLE) })] }), showPreIdentifyOAuth && (_jsx(OAuthProvidersSection, { providers: enabledSocialOAuth2Providers, onProviderClick: handleOAuth2Click, isLoading: auth.isLoading, continueWithLabel: t(UserAuthLabel.CONTINUE_WITH), translate: translate, dividerLabel: t(UserAuthLabel.DIVIDER_OR), showDivider: showDivider })), !auth.error && endedSessionNotice && (_jsx(Alert, { variant: endedSessionNotice.variant, "data-session-ended-notice": endedSessionReason ?? undefined, children: _jsx(AlertDescription, { children: endedSessionNotice.text }) })), !auth.error && redirectedAuthError && (_jsx(Alert, { variant: redirectedAuthError.variant, children: _jsx(AlertDescription, { children: redirectedAuthError.text }) })), showIdentifyForm && isIdentifierStepOffered && (_jsx(AutomatedForm, { schema: AuthIdentifyFormDtoSchema, defaultValues: { email: '' }, onSubmit: handleIdentify, validationMode: ValidationMode.ON_BLUR, disabled: auth.isLoading, labels: {
                     fields: { email: t(UserAuthLabel.EMAIL_ADDRESS) },
                 }, layoutTemplate: IdentifyFormTemplate }, "identify")), showIdentifyForm && isPasskeySignInOffered && (_jsxs(_Fragment, { children: [_jsx(LabeledDivider, { label: t(UserAuthLabel.DIVIDER_OR) }), _jsxs(Button, { variant: ButtonVariants_Variant.OUTLINE, className: "w-full", labelOverflow: ButtonLabelOverflow.WRAP, onClick: handlePasskeySignInClick, disabled: auth.isLoading, "data-passkey-sign-in": "", children: [_jsx(AuthMethodIcon, { method: AuthMethod.PASSKEY }), t(UserAuthLabel.PASSKEY_SIGN_IN)] })] })), currentActiveMethod && !showIdentifyForm && (() => {
                 const MethodComponent = AUTH_METHOD_COMPONENTS[currentActiveMethod];
@@ -359,7 +392,7 @@ export const PublicLayoutPreset_UserAuth_Default = ({}) => {
                                 translate,
                             }),
                         }), onSelect: setActiveMethod, disabled: auth.isLoading })] })), offersNoEntryPoint && (_jsx(Alert, { "data-auth-no-entry-point": "", children: _jsx(AlertDescription, { children: t(UserAuthLabel.NO_SIGN_IN_METHOD_AVAILABLE) }) })), !isIdentifierStepOffered && !hasIdentification && auth.error && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: auth.error }) })), _jsxs("div", { className: "text-center space-y-item pt-group", children: [currentActiveMethod === AuthMethod.PASSWORD && !showIdentifyForm && (_jsx(Text, { children: _jsx(Link, { href: passwordLostHref, children: t(UserAuthLabel.FORGOT_PASSWORD) }) })), auth.purpose !== AuthSessionPurpose.REAUTH
-                        && resolvedAuth.registrationConfig.publicRegistrationAvailable && (_jsxs(Text, { children: [t(UserAuthLabel.NO_ACCOUNT), ' ', _jsx(Link, { href: registerHref, children: t(UserAuthLabel.SIGNUP_LINK) })] }))] })] }));
+                        && resolvedAuth.registrationConfig.publicRegistrationAvailable && (_jsxs(Text, { children: [t(UserAuthLabel.NO_ACCOUNT), ' ', _jsx(Link, { href: registerHref, children: t(UserAuthLabel.SIGNUP_LINK) })] })), _jsx(AuthPrivacyNoticeLink, { label: t(UserAuthLabel.PRIVACY_NOTICE_LINK) })] })] }));
 };
 export function Auth_Main({ preset = CorePresetNames.DEFAULT, ...props }) {
     const Component = createComponentResolver(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, 'Auth_Main')(preset);

package/dist/esm/components/auth/Auth_Main.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Main.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.tsx"],"names":[],"mappings":";AACA,OAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,iBAAiB,EACjB,yBAAyB,GAI1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,+BAA+B,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,sCAAsC,EAAE,MAAM,0EAA0E,CAAC;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,gCAAgC,EAAE,iCAAiC,EAAE,MAAM,uFAAuF,CAAC;AAE5K,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iEAAiE,CAAC;AACjI,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,0DAA0D,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAiC,MAAM,oEAAoE,CAAC;AAC3I,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,0DAA0D,CAAC;AAG1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAA;AACzH,OAAO,EAAG,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAEtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;AACjD,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAE/C;;;GAGG;AACH,MAAM,oBAAoB,GAAa,GAAG,EAAE;IAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,wBAAwB;KAC1D,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAE3F,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,OAAO,GAAG,EAEzB,IAAI,CAAC,KAAK,IAAI,CACb,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,IAAI,CAAC,KAAK,GAAoB,GAC3C,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAChC,eAAe,EAAC,QAAG,EACnB,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAAC,SAAiB;IACpD,MAAM,QAAQ,GAAG,iCAAiC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YACD,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,KAAK,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAM5C,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,EAA4C,EAAqB,EAAE;IACrH,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,WAAW,EAAE,CAAC;IACrE,MAAM,EAAE,iBAAiB,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,4BAA4B,GAAG,OAAO,CAAC,GAAG,EAAE;QAChD,OAAO,iCAAiC,CAAC;YACvC,eAAe,EAAE,YAAY,CAAC,UAAU,EAAE,qBAAqB;SAChE,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrD,MAAM,6BAA6B,GAAG,OAAO,CAAC,GAAG,EAAE;QACjD,OAAO,uCAAuC,CAC5C,4BAA4B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAC7E,CAAC;IACJ,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpD,SAAS,EAAE,qBAAqB,CAAC,wBAAwB;QACzD,IAAI,EAAE,6BAA6B;KACpC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC3F,MAAM,YAAY,GAAG,gBAAgB,CAAC;IACtC,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC9C,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClB,CAAC;IACF,MAAM,kBAAkB,GAAG,OAAO,CAChC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EACpD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClB,CAAC;IACF,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtB,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,wBAAwB,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,CAAC,EAC7E,CAAC,kBAAkB,EAAE,YAAY,CAAC,YAAY,CAAC,CAChD,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CAAC,wBAAwB,CAAC,YAAY,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACzE,CAAC,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,CAC5C,CAAC;IAEF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAC;IAE1E,oGAAoG;IACpG,4BAA4B,CAAC;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK;QACjC,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,IAAI,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC;IAE/C,MAAM,2BAA2B,GAAsB,OAAO,CAAC,GAAG,EAAE;QAClE,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU;YAAE,OAAO,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAC9D,6GAA6G;QAC7G,kHAAkH;QAClH,+GAA+G;QAC/G,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC,CAAC;IAC/E,CAAC,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAE7C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE;QACjC,IAAI,2BAA2B,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,kBAAkB,GAAG,IAAI,CAAC,cAAc,EAAE,wBAAkD,CAAC;QACnG,IAAI,kBAAkB,IAAI,sBAAsB,CAAC,kBAAkB,CAAC;YAAE,OAAO,kBAAkB,CAAC;QAChG,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,MAAoB,CAAC;IAC7D,CAAC,EAAE,CAAC,2BAA2B,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEjF,MAAM,mBAAmB,GAAG,YAAY,IAAI,aAAa,CAAC;IAC1D,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CACxC,CAAC;IAEF;;;;;;;;;;;;;;OAcG;IACH,MAAM,kCAAkC,GAAG,2BAA2B,CAAC,IAAI,CACzE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,IAAI,CAAC,CAAC,mBAAmB,CACjE,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,WAAmB,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,EAAE,IAAyB,EAAE,EAAE;QACzD,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,WAAW,CAAC,CAAC,SAAiC,EAAE,EAAE;QACjF,mEAAmE;QACnE,sDAAsD;QACtD,iEAAiE;QACjE,qDAAqD;IACvD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,MAAc,EAAE,EAAE;QAC5D,oDAAoD;IACtD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,wBAAwB,GAAG,4BAA4B,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC;IAChF,MAAM,oBAAoB,GAAG,wBAAwB,IAAI,gBAAgB,CAAC;IAE1E;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,EAAE;QAC5C,MAAM,OAAO,GAAG,4BAA4B,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAC5F,IAAI,CAAC,wBAAwB;YAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,wBAAwB,EAAE,YAAY,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9E,MAAM,uBAAuB,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,IAAI,wBAAwB,CAAC,IAAI,GAAG,CAAC,CAAC;IAEpH,MAAM,WAAW,GAAG,oBAAoB,IAAI,uBAAuB,CAAC;IAEpE;;;;OAIG;IACH,4GAA4G;IAC5G,iGAAiG;IACjG,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;WAClH,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM;WAC1C,OAAO,MAAM,KAAK,WAAW;WAC7B,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IAClC;;;;;;;;OAQG;IACH,MAAM,kBAAkB,GAAG,gBAAgB,IAAI,CAAC,uBAAuB,IAAI,CAAC,sBAAsB,IAAI,CAAC,oBAAoB,CAAC;IAC5H;;;;;OAKG;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEtD,MAAM,wBAAwB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACtD,qBAAqB,CAAC,OAAO,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,8FAA8F;YAC9F,sFAAsF;QACxF,CAAC;gBAAS,CAAC;YACT,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;YACtC,gBAAgB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB;;;;;OAKG;IACH;;;;;OAKG;IACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACvD,oBAAoB,CAAC,OAAO,GAAG,iBAAiB,CAAC;IAEjD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,IAAI,CAAC,sBAAsB;YAAE,OAAO,SAAS,CAAC;QAC/E,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC,CAAC,MAAM,+BAA+B,EAAE,CAAC;gBAAE,OAAO;YACvD,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;YAChF,mGAAmG;YACnG,kGAAkG;YAClG,qGAAqG;YACrG,sGAAsG;YACtG,iBAAiB;YACjB,OAAO,CAAC,SAAS,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,oBAAoB,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;oBACvE,OAAO;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,2BAA2B,CAAC,IAAI,qBAAqB,CAAC,OAAO;wBAAE,OAAO;gBAC/F,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;YACjB,oBAAoB,CAAC,cAAc,EAAE,CAAC;QACxC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;IAEvE,SAAS,CAAC,GAAG,EAAE;QACb,QAAQ,CACN,kBAAkB,OAAO,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,mBAAmB,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,mBAAmB,IAAI,MAAM,EAAE,CACzQ,CAAC;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAE1G,qHAAqH;IACrH,MAAM,4BAA4B,GAAG,sCAAsC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtG,IAAI,4BAA4B,EAAE,CAAC;QACjC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,4BAA4B,EAAE,OAAO,SAAG,CAAC;IAChE,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B;;;;;;;;;;OAUG;IACH,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cACL,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM;4BACzC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC;4BAC/B,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAClB,EACV,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAC/B,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM;4BACzC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC;4BACnC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,GACzB,IACH,EAEL,oBAAoB,IAAI,CACvB,KAAC,qBAAqB,IACpB,SAAS,EAAE,4BAA4B,EACvC,eAAe,EAAE,iBAAiB,EAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EACzB,iBAAiB,EAAE,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,EACjD,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,EACzC,WAAW,EAAE,WAAW,GACxB,CACH,EAEA,CAAC,IAAI,CAAC,KAAK,IAAI,mBAAmB,IAAI,CACrC,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,mBAAmB,GAAoB,GACpD,CACT,EAGA,gBAAgB,IAAI,uBAAuB,IAAI,CAC9C,KAAC,aAAa,IAEZ,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAC5B,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,IAAI,CAAC,SAAS,EACxB,MAAM,EAAE;oBACN,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE;iBAClD,EACD,cAAc,EAAE,oBAAoB,IAThC,UAAU,CAUd,CACH,EAGA,gBAAgB,IAAI,sBAAsB,IAAI,CAC7C,8BACE,KAAC,cAAc,IAAC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,GAAI,EACtD,MAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAC,QAAQ,EAClB,aAAa,EAAE,mBAAmB,CAAC,IAAI,EACvC,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,IAAI,CAAC,SAAS,0BACH,EAAE,aAEvB,KAAC,cAAc,IAAC,MAAM,EAAE,UAAU,CAAC,OAAO,GAAI,EAC7C,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,IAC1B,IACR,CACJ,EAGA,mBAAmB,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE;gBACjD,MAAM,eAAe,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;gBACpE,IAAI,CAAC,eAAe;oBAAE,OAAO,IAAI,CAAC;gBAClC,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;gBAC/F,IAAI,CAAC,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAE/B,MAAM,KAAK,GAA6B;oBACtC,SAAS;oBACT,KAAK;oBACL,YAAY;oBACZ,SAAS,EAAE,wBAAwB;oBACnC,OAAO,EAAE,sBAAsB;oBAC/B,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,CAAC;oBACD,kBAAkB;iBACnB,CAAC;gBAEF,OAAO,KAAC,eAAe,OAAK,KAAK,GAAI,CAAC;YACxC,CAAC,CAAC,EAAE,EAOH,kCAAkC,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAC3F,KAAC,IAAI,cAAE,CAAC,CAAC,aAAa,CAAC,4BAA4B,CAAC,GAAQ,CAC7D,EAGA,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CACrD,8BACE,KAAC,cAAc,IAAC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAI,EAEjE,KAAC,oBAAoB,IACnB,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAoB,CAAC;wBACxE;;;;;;;;;;2BAUG;wBACH,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,EAAE;4BACzD,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;4BAClF,eAAe,EAAE,4BAA4B;4BAC7C,oBAAoB,EAAE,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;4BACpD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;4BACnC,0BAA0B,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,gCAAgC,CAAC;gCACzE,WAAW,EAAE,QAAQ,CAAC,WAAW;gCACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;gCACjC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gCACjD,UAAU,EAAE,uBAAuB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK;gCAChE,SAAS;6BACV,CAAC;yBACH,CAAC,EACF,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,IAAI,CAAC,SAAS,GACxB,IACD,CACJ,EAEA,kBAAkB,IAAI,CACrB,KAAC,KAAK,gCAA0B,EAAE,YAChC,KAAC,gBAAgB,cAAE,CAAC,CAAC,aAAa,CAAC,2BAA2B,CAAC,GAAoB,GAC7E,CACT,EAGA,CAAC,uBAAuB,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,CAC/D,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,IAAI,CAAC,KAAK,GAAoB,GAC3C,CACT,EAMD,eAAK,SAAS,EAAC,mCAAmC,aAe/C,mBAAmB,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,gBAAgB,IAAI,CACnE,KAAC,IAAI,cACH,KAAC,IAAI,IAAC,IAAI,EAAE,gBAAgB,YAAG,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,GAAQ,GAClE,CACR,EAEA,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM;2BACtC,YAAY,CAAC,kBAAkB,CAAC,2BAA2B,IAAI,CAClE,MAAC,IAAI,eACF,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,GAAG,EACjC,KAAC,IAAI,IAAC,IAAI,EAAE,YAAY,YAAG,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAQ,IAC1D,CACR,IACG,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAmE;IACvI,MAAM,SAAS,GAAG,uBAAuB,CAA2C,qBAAqB,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;IACzJ,QAAQ,CAAC,0BAA0B,MAAM,cAAc,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACjH,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["\nimport React, { useMemo, useState, useCallback, useEffect, useRef } from 'react';\nimport { Navigate, useLocation } from 'react-router-dom';\nimport { FrontendComponentType, UserAuthLabel } from '@wildo-ai/presets-components-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport {\n  AuthMethod,\n  AuthSessionPurpose,\n  getEnabledFirstFactorMethods,\n  getEnabledMethods,\n  AuthIdentifyFormDtoSchema,\n  type AuthIdentifyFormDto,\n  type AvailableMethod,\n  type AuthenticationResponse,\n} from '@wildo-ai/saas-models';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { PasskeyAutofillExpiredError, PasskeySignInMediation } from '~wildo-frontend-lib/core/security/security.frontend.schemas';\nimport { browserSupportsWebAuthnAutofill, WebAuthnAbortService } from '@simplewebauthn/browser';\nimport { organizationOnboardingNavigationTarget } from '~wildo-frontend-lib/core/security/organization-onboarding.frontend.utils';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { Button, ButtonLabelOverflow, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport {\n  appendAuthRedirectToPath,\n  extractAuthRedirectFromSearch,\n  resolvePostAuthRedirect,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { collectFrontendProviderDisplayLabelKeys } from '~wildo-frontend-lib/core/external-providers/frontend-provider-display-label.frontend.utils';\nimport { resolveOAuthProviderDisplayLabel, resolvePublicOAuthProviderEntries } from '~wildo-frontend-lib/components/auth/utils/oauth-provider-display-label.frontend.utils';\n\nimport { OAuthProvidersSection, SSO_PROVIDER_BRAND_META } from '~wildo-frontend-lib/components/auth/utils/OAuthProvidersSection';\nimport { useMfaContinuationNavigation } from '~wildo-frontend-lib/components/auth/utils/useMfaContinuationNavigation';\nimport { LabeledDivider } from '~wildo-frontend-lib/components/auth/utils/LabeledDivider';\nimport { AUTH_METHOD_COMPONENTS, type AuthMethodComponentProps } from '~wildo-frontend-lib/components/auth/methods/auth-method-components';\nimport { resolveAuthMethodChoiceLabel } from '~wildo-frontend-lib/components/auth/methods/auth-method-presentation';\nimport { AuthMethodChoiceList } from '~wildo-frontend-lib/components/auth/utils/AuthMethodChoiceList';\nimport { AuthMethodIcon } from '~wildo-frontend-lib/components/auth/utils/AuthMethodIcon';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas'\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper'\nimport {  CorePresetNames } from '@wildo-ai/presets-components-models'\n\nconst logger = LoggerFrontendService.getLogger();\nconst logDebug = logger.debugByType('Auth_Main');\nlogger.setDebugTypeLogging('Auth_Main', false);\n\n/**\n * Self-sufficient template for the email identification form.\n * Reads auth error from `useUserOrgs()`, labels from `useI18n()`.\n */\nconst IdentifyFormTemplate: React.FC = () => {\n  const { auth } = useUserOrgs();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH,\n  });\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, key);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"email\" />\n\n      {auth.error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{auth.error}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserAuthLabel.CONTINUE)}\n        submittingLabel=\"…\"\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Resolve once the sign-in email field carrying the `webauthn` autocomplete token is in the document.\n *\n * Passkey autofill must start AFTER that input exists: the browser attaches its passkey list to it, and\n * the WebAuthn helper refuses to start a conditional request without one. The form renders\n * asynchronously (it waits for its labels), so this polls one frame at a time, bounded, and answers\n * `null` if the field never appears — autofill is then simply not offered.\n */\nfunction waitForPasskeyAutofillField(timeoutMs: number): Promise<Element | null> {\n  const selector = 'input[autocomplete~=\"webauthn\"]';\n  return new Promise((resolve) => {\n    const deadline = Date.now() + timeoutMs;\n    const probe = () => {\n      const field = document.querySelector(selector);\n      if (field || Date.now() >= deadline) {\n        resolve(field);\n        return;\n      }\n      requestAnimationFrame(probe);\n    };\n    probe();\n  });\n}\n\n/** How long the page waits for the email field before giving up on offering passkey autofill. */\nconst PASSKEY_AUTOFILL_FIELD_WAIT_MS = 3000;\n\n// --- Contract ---\nexport interface PublicLayoutPreset_UserAuth_DefaultProps {\n}\n\nexport const PublicLayoutPreset_UserAuth_Default = ({}: PublicLayoutPreset_UserAuth_DefaultProps): React.JSX.Element => {\n  const { auth, identifyByEmail, initiateOAuth2Login } = useUserOrgs();\n  const { signInWithPasskey } = useAuthSession();\n  const resolvedAuth = useResolvedAuthConfig();\n  const location = useLocation();\n  const enabledSocialOAuth2Providers = useMemo(() => {\n    return resolvePublicOAuthProviderEntries({\n      publicProviders: resolvedAuth.globalAuth?.socialOAuth2Providers,\n    });\n  }, [resolvedAuth.globalAuth?.socialOAuth2Providers]);\n  const socialOAuth2ProviderLabelKeys = useMemo(() => {\n    return collectFrontendProviderDisplayLabelKeys(\n      enabledSocialOAuth2Providers.map((provider) => provider.displayNameLabelKey),\n    );\n  }, [enabledSocialOAuth2Providers]);\n  const { t: translate, tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH,\n    keys: socialOAuth2ProviderLabelKeys,\n  });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, key);\n  const publicRoutes = CommonRoutePaths;\n  const postAuthRedirect = useMemo(\n    () => resolvePostAuthRedirect(location.search),\n    [location.search],\n  );\n  const authRedirectTarget = useMemo(\n    () => extractAuthRedirectFromSearch(location.search),\n    [location.search],\n  );\n  const redirectedAuthError = useMemo(() => {\n    const searchParams = new URLSearchParams(location.search);\n    return searchParams.get('reason') ?? searchParams.get('error');\n  }, [location.search]);\n  const passwordLostHref = useMemo(\n    () => appendAuthRedirectToPath(publicRoutes.passwordLost, authRedirectTarget),\n    [authRedirectTarget, publicRoutes.passwordLost],\n  );\n  const registerHref = useMemo(\n    () => appendAuthRedirectToPath(publicRoutes.register, authRedirectTarget),\n    [authRedirectTarget, publicRoutes.register],\n  );\n\n  const [activeMethod, setActiveMethod] = useState<AuthMethod | null>(null);\n\n  // Shared with the registration screen (#972), so a session owing a second factor is routed one way.\n  useMfaContinuationNavigation({\n    mfaRequired: auth.mfaRequired,\n    mfaSessionId: auth.mfaSessionId,\n    usableSecondFactorMethods: auth.usableSecondFactorMethods,\n    email: auth.identification?.email,\n    authRedirectTarget,\n  });\n\n  const hasIdentification = !!auth.identification;\n  const sessionId = auth.identification?.sessionId || '';\n  const email = auth.identification?.email || '';\n\n  const availableFirstFactorMethods: AvailableMethod[] = useMemo(() => {\n    if (!hasIdentification || !auth.identification?.userExists) return [];\n    const methods = auth.identification?.firstFactorMethods || [];\n    // Rendered in the order the server sent (#1218). The backend orders by `AUTH_METHOD_PRECEDENCE` and computes\n    // `defaultFirstFactorMethod` as the head of that same list, so re-sorting here would put a different method first\n    // from the one the server named as the default — which is exactly what it used to do for an SSO-routed domain.\n    return methods.filter((m) => AUTH_METHOD_COMPONENTS[m.method as AuthMethod]);\n  }, [hasIdentification, auth.identification]);\n\n  const defaultMethod = useMemo(() => {\n    if (availableFirstFactorMethods.length === 0) return null;\n    const defaultFromBackend = auth.identification?.defaultFirstFactorMethod as AuthMethod | undefined;\n    if (defaultFromBackend && AUTH_METHOD_COMPONENTS[defaultFromBackend]) return defaultFromBackend;\n    return availableFirstFactorMethods[0].method as AuthMethod;\n  }, [availableFirstFactorMethods, auth.identification?.defaultFirstFactorMethod]);\n\n  const currentActiveMethod = activeMethod || defaultMethod;\n  const alternativeMethods = availableFirstFactorMethods.filter(\n    (m) => m.method !== currentActiveMethod\n  );\n\n  /*\n   * Does the person's organization REQUIRE the method currently shown? (#1220)\n   *\n   * `enforcedFirstFactor` is set by the backend only where an enterprise connection declares\n   * `enforcement.requireSSO`. Until #1220 this arrived as a `required` boolean that NOTHING here read\n   * — a claim on the wire that no surface checked — and it could not safely be read, because the same\n   * field was also set on any method that can serve as a second factor whenever the user type demands\n   * MFA. Consuming that would have announced a passkey as a mandatory first factor.\n   *\n   * Read on the ACTIVE method rather than on the list, because the notice explains the thing the\n   * person is looking at. The interesting case is the one where alternatives exist beside it: a tenant\n   * that allows a password fallback, or that names break-glass accounts and therefore keeps the\n   * password field for EVERY address at the domain so the list cannot be read as an oracle for who\n   * those accounts are. There the two methods look like peers and are not.\n   */\n  const activeMethodIsOrganizationEnforced = availableFirstFactorMethods.some(\n    (m) => m.method === currentActiveMethod && m.enforcedFirstFactor,\n  );\n\n  const handleOAuth2Click = async (providerRef: string) => {\n    try {\n      await initiateOAuth2Login(providerRef, authRedirectTarget);\n    } catch {\n      // Error is already handled in AuthSessionContext\n    }\n  };\n\n  const handleIdentify = async (data: AuthIdentifyFormDto) => {\n    await identifyByEmail(data.email);\n  };\n\n  const handleFirstFactorSuccess = useCallback((_response: AuthenticationResponse) => {\n    // Token storage and MFA redirect are handled by AuthSessionContext\n    // and the authenticateWithPassword flow respectively.\n    // Nothing to do here — the auth state update triggers re-renders\n    // and the MFA redirect is handled at the page level.\n  }, []);\n\n  const handleFirstFactorError = useCallback((_error: string) => {\n    // Errors are displayed within each method component\n  }, []);\n\n  const hasSocialOAuth2Providers = enabledSocialOAuth2Providers.length > 0;\n  const showIdentifyForm = !hasIdentification || !auth.identification?.userExists;\n  const showPreIdentifyOAuth = hasSocialOAuth2Providers && showIdentifyForm;\n\n  /*\n   * The identifier step is the door to EVERY method reached by saying who you are, so it is offered\n   * when ANY identify-reachable method is enabled — not when PASSWORD is (#1219). Gating it on the\n   * password made a user type that signs in by magic link unable to sign in at all: the email address\n   * is the one thing that sign-in needs, and the page hid the field that collects it.\n   *\n   * The password INPUT stays gated on the password, and by a stronger authority than this map: it is a\n   * Phase-2 method component, rendered only for a method the identify RESPONSE returned for this\n   * person. So nothing below has to re-decide it.\n   *\n   * `EXTERNAL_OAUTH2` counts only when a social provider actually resolves, mirroring\n   * `_buildAvailableMethodObject`, which returns null for it when the application configures none.\n   *\n   * An UNRESOLVED policy offers the step. The identifier form is not an access control — the backend\n   * decides what a person may use, and refuses on its own — so treating \"I do not know yet\" as\n   * \"closed\" would lock the whole sign-in page over a config the page had not loaded, while\n   * protecting nothing.\n   */\n  const identifyReachableMethods = useMemo(() => {\n    const methods = getEnabledFirstFactorMethods(resolvedAuth.userTypeAuth?.authMethodsEnabled);\n    if (!hasSocialOAuth2Providers) methods.delete(AuthMethod.EXTERNAL_OAUTH2);\n    return methods;\n  }, [hasSocialOAuth2Providers, resolvedAuth.userTypeAuth?.authMethodsEnabled]);\n  const isIdentifierStepOffered = !resolvedAuth.userTypeAuth?.authMethodsEnabled || identifyReachableMethods.size > 0;\n\n  const showDivider = showPreIdentifyOAuth && isIdentifierStepOffered;\n\n  /*\n   * Username-less passkey sign-in is offered before any email is typed, when the application enables\n   * passkeys for this frontend's user type and the browser speaks WebAuthn. Not during re-authentication:\n   * a re-proof must be the SAME person, and a discoverable ceremony lets the device pick any account.\n   */\n  // Read through the shared helper: `authMethodsEnabled` accepts both `true` and `{ enabled: true }`, and the\n  // backend decides with the same helper, so the page must not offer less than the server accepts.\n  const isPasskeySignInOffered = getEnabledMethods(resolvedAuth.userTypeAuth?.authMethodsEnabled).has(AuthMethod.PASSKEY)\n    && auth.purpose !== AuthSessionPurpose.REAUTH\n    && typeof window !== 'undefined'\n    && !!window.PublicKeyCredential;\n  /*\n   * The page offers NO way in: no identifier step, no passkey button, no social provider (#1255).\n   *\n   * Without this it rendered the heading and subtitle and then nothing — the one alert below that\n   * could speak is gated on `auth.error`, and with no form nothing can produce an error. The three\n   * terms are exactly the three entry points rendered in the identify phase, so a passkey-only or\n   * social-only type is not a dead end and gets no notice. An UNRESOLVED policy offers the identifier\n   * step (see `isIdentifierStepOffered`), so this never flashes while the config is loading.\n   */\n  const offersNoEntryPoint = showIdentifyForm && !isIdentifierStepOffered && !isPasskeySignInOffered && !showPreIdentifyOAuth;\n  /*\n   * While a ceremony the person started with the button is open, autofill must not restart: starting a\n   * WebAuthn request aborts the pending one, so a restart timed after the button would close the picker\n   * the person is looking at. When the button ceremony ends — refused or cancelled; a success leaves the\n   * page — `autofillEpoch` moves and the autofill effect starts a fresh wait.\n   */\n  const buttonCeremonyLiveRef = useRef(false);\n  const [autofillEpoch, setAutofillEpoch] = useState(0);\n\n  const handlePasskeySignInClick = useCallback(async () => {\n    buttonCeremonyLiveRef.current = true;\n    try {\n      await signInWithPasskey(PasskeySignInMediation.MODAL);\n    } catch {\n      // Already reported: the context puts the user-facing message on `auth.error`, which the email\n      // form renders. Caught here only so a refused ceremony is not an unhandled rejection.\n    } finally {\n      buttonCeremonyLiveRef.current = false;\n      setAutofillEpoch((epoch) => epoch + 1);\n    }\n  }, [signInWithPasskey]);\n\n  /*\n   * Passkey AUTOFILL: while the email form is on screen, a conditional passkey request waits for the\n   * person to pick a passkey from the email field's autofill list. It is cancelled when the form goes\n   * away (an email was submitted, or sign-in completed), and a modal request started by the button\n   * replaces it — the WebAuthn helper aborts the pending one itself.\n   */\n  /*\n   * The latest `signInWithPasskey`, read through a ref so the autofill effect does NOT re-run when the\n   * callback's identity changes. The effect's cleanup cancels the one global WebAuthn ceremony, so a\n   * re-run triggered by an unrelated context re-render would cancel a ceremony the person started with\n   * the button, and open a second session for nothing.\n   */\n  const signInWithPasskeyRef = useRef(signInWithPasskey);\n  signInWithPasskeyRef.current = signInWithPasskey;\n\n  useEffect(() => {\n    if (!isReady || !showIdentifyForm || !isPasskeySignInOffered) return undefined;\n    let cancelled = false;\n    void (async () => {\n      if (!(await browserSupportsWebAuthnAutofill())) return;\n      const field = await waitForPasskeyAutofillField(PASSKEY_AUTOFILL_FIELD_WAIT_MS);\n      // One waiting request at a time, restarted only when its challenge ran out. Anything else ends the\n      // loop: the page moved on, the button began its own ceremony, or a picked passkey failed (already\n      // reported on `auth.error`). An idle sign-in tab therefore costs one options call per sign-in window\n      // (the `expiresInSeconds` the server answered), which is what the per-IP limit on the options door is\n      // sized against.\n      while (!cancelled) {\n        try {\n          await signInWithPasskeyRef.current(PasskeySignInMediation.CONDITIONAL);\n          return;\n        } catch (error) {\n          if (!(error instanceof PasskeyAutofillExpiredError) || buttonCeremonyLiveRef.current) return;\n        }\n      }\n    })();\n    return () => {\n      cancelled = true;\n      WebAuthnAbortService.cancelCeremony();\n    };\n  }, [isReady, showIdentifyForm, isPasskeySignInOffered, autofillEpoch]);\n\n  useEffect(() => {\n    logDebug(\n      `Render isReady=${isReady} accessToken=${auth.accessToken ? 'yes' : 'no'} authLoading=${auth.isLoading ? 'yes' : 'no'} identification=${hasIdentification ? 'yes' : 'no'} showIdentify=${showIdentifyForm ? 'yes' : 'no'} activeMethod=${currentActiveMethod ?? 'none'}`,\n    );\n  }, [isReady, auth.accessToken, auth.isLoading, hasIdentification, showIdentifyForm, currentActiveMethod]);\n\n  // Parked at organization onboarding (#1090): the organization is the only step left, whatever this screen was doing.\n  const organizationOnboardingTarget = organizationOnboardingNavigationTarget(auth, authRedirectTarget);\n  if (organizationOnboardingTarget) {\n    return <Navigate to={organizationOnboardingTarget} replace />;\n  }\n\n  if (auth.accessToken) {\n    return <Navigate to={postAuthRedirect} replace />;\n  }\n\n  if (!isReady) return null;\n\n  /*\n   * ONE element owns the vertical rhythm of the screen. Every block used to bring its own margin, so\n   * whichever pair nobody had thought about got none — the \"Forgot password?\" link sat flush against the\n   * last alternative-method button (measured: 0px). The container spaces every adjacent pair, including\n   * ones a future phase adds.\n   *\n   * `space-y-group` (block flow) and NOT `flex flex-col gap-group`, because of `LabeledDivider`'s own\n   * `my-group`. In block flow the sibling margin and the divider's margin COLLAPSE, so an \"or\" divider\n   * gets one group-step each side — the spacing it has on the registration and invitation screens, which\n   * are block flow too. A flex gap does not collapse with margins and gave this screen twice that.\n   */\n  return (\n    <div className=\"space-y-group\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>\n          {auth.purpose === AuthSessionPurpose.REAUTH\n            ? t(UserAuthLabel.REAUTH_TITLE)\n            : t(UserAuthLabel.TITLE)}\n        </Heading>\n        <Text className=\"max-w-sm mx-auto\">\n          {auth.purpose === AuthSessionPurpose.REAUTH\n            ? t(UserAuthLabel.REAUTH_SUB_TITLE)\n            : t(UserAuthLabel.SUB_TITLE)}\n        </Text>\n      </div>\n\n      {showPreIdentifyOAuth && (\n        <OAuthProvidersSection\n          providers={enabledSocialOAuth2Providers}\n          onProviderClick={handleOAuth2Click}\n          isLoading={auth.isLoading}\n          continueWithLabel={t(UserAuthLabel.CONTINUE_WITH)}\n          translate={translate}\n          dividerLabel={t(UserAuthLabel.DIVIDER_OR)}\n          showDivider={showDivider}\n        />\n      )}\n\n      {!auth.error && redirectedAuthError && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{redirectedAuthError}</AlertDescription>\n        </Alert>\n      )}\n\n      {/* Phase 1: Identification — email input before any method is shown */}\n      {showIdentifyForm && isIdentifierStepOffered && (\n        <AutomatedForm\n          key=\"identify\"\n          schema={AuthIdentifyFormDtoSchema}\n          defaultValues={{ email: '' }}\n          onSubmit={handleIdentify}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={auth.isLoading}\n          labels={{\n            fields: { email: t(UserAuthLabel.EMAIL_ADDRESS) },\n          }}\n          layoutTemplate={IdentifyFormTemplate}\n        />\n      )}\n\n      {/* Phase 1b: Username-less passkey sign-in — the device offers the person's accounts */}\n      {showIdentifyForm && isPasskeySignInOffered && (\n        <>\n          <LabeledDivider label={t(UserAuthLabel.DIVIDER_OR)} />\n          <Button\n            variant={ButtonVariants_Variant.OUTLINE}\n            className=\"w-full\"\n            labelOverflow={ButtonLabelOverflow.WRAP}\n            onClick={handlePasskeySignInClick}\n            disabled={auth.isLoading}\n            data-passkey-sign-in=\"\"\n          >\n            <AuthMethodIcon method={AuthMethod.PASSKEY} />\n            {t(UserAuthLabel.PASSKEY_SIGN_IN)}\n          </Button>\n        </>\n      )}\n\n      {/* Phase 2: After identification — render active first-factor method */}\n      {currentActiveMethod && !showIdentifyForm && (() => {\n        const MethodComponent = AUTH_METHOD_COMPONENTS[currentActiveMethod];\n        if (!MethodComponent) return null;\n        const methodConfig = availableFirstFactorMethods.find((m) => m.method === currentActiveMethod);\n        if (!methodConfig) return null;\n\n        const props: AuthMethodComponentProps = {\n          sessionId,\n          email,\n          methodConfig,\n          onSuccess: handleFirstFactorSuccess,\n          onError: handleFirstFactorError,\n          factorLevel: 'first',\n          isLoading: auth.isLoading,\n          t,\n          authRedirectTarget,\n        };\n\n        return <MethodComponent {...props} />;\n      })()}\n\n      {/*\n        The enforcement notice belongs with the alternatives, not with the method above: on its own an\n        enforced method needs no explanation — it is simply how you sign in. What needs explaining is\n        why a password field is sitting underneath one.\n      */}\n      {activeMethodIsOrganizationEnforced && alternativeMethods.length > 0 && !showIdentifyForm && (\n        <Text>{t(UserAuthLabel.ORGANIZATION_ENFORCED_METHOD)}</Text>\n      )}\n\n      {/* Phase 3: Alternative methods — shown as buttons below the active method */}\n      {alternativeMethods.length > 0 && !showIdentifyForm && (\n        <>\n          <LabeledDivider label={t(UserAuthLabel.OTHER_METHODS_DIVIDER)} />\n\n          <AuthMethodChoiceList\n            methods={alternativeMethods.map((method) => method.method as AuthMethod)}\n            /*\n             * Named by the PROVIDER where the descriptor names one — \"Continue with Google\", the same\n             * words the pre-identify buttons and the active enterprise method already use. The\n             * descriptor is looked up rather than passed through the list's props because the list is\n             * shared with the second-factor and enrollment choosers, which have no descriptors; the\n             * naming data belongs to this surface, not to the list.\n             *\n             * `find` by method is sound because `identify` emits at most ONE entry per method — a\n             * method standing for several providers carries them in its own `oauth2ProviderRefs`,\n             * which is exactly the case the resolver declines to name.\n             */\n            labelFor={(method) => resolveAuthMethodChoiceLabel(method, {\n              offeredMethod: alternativeMethods.find((candidate) => candidate.method === method),\n              socialProviders: enabledSocialOAuth2Providers,\n              continueWithTemplate: t(UserAuthLabel.CONTINUE_WITH),\n              translateLabel: (label) => t(label),\n              resolveSocialProviderLabel: (provider) => resolveOAuthProviderDisplayLabel({\n                providerRef: provider.providerRef,\n                displayName: provider.displayName,\n                displayNameLabelKey: provider.displayNameLabelKey,\n                brandLabel: SSO_PROVIDER_BRAND_META[provider.providerRef]?.label,\n                translate,\n              }),\n            })}\n            onSelect={setActiveMethod}\n            disabled={auth.isLoading}\n          />\n        </>\n      )}\n\n      {offersNoEntryPoint && (\n        <Alert data-auth-no-entry-point=\"\">\n          <AlertDescription>{t(UserAuthLabel.NO_SIGN_IN_METHOD_AVAILABLE)}</AlertDescription>\n        </Alert>\n      )}\n\n      {/* No identifier form to carry it: the error has nowhere else to be read. */}\n      {!isIdentifierStepOffered && !hasIdentification && auth.error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{auth.error}</AlertDescription>\n        </Alert>\n      )}\n\n      {/*\n        Navigation AWAY from this form (recover a password, create an account) is a different group\n        from the actions above it, so it sits one extra group-step apart rather than at the plain gap.\n      */}\n      <div className=\"text-center space-y-item pt-group\">\n        {/*\n          Password recovery belongs to the PASSWORD step, and to no other (#1220).\n          \n          This used to render on `hasIdentification && userExists`, and `userExists` is hard-wired\n          `true` on every identify response for enumeration safety — so it reduced to \"any address that\n          has been typed\". It offered recovery to an account with no password at all, and to a domain\n          routed to its own identity provider, where the link leads somewhere the person's credential\n          does not live. It also sat in a sibling element outside the method-render block, so no branch\n          could have conditioned it on the active method.\n          \n          Gated on the ACTIVE method rather than on `PASSWORD` merely being offered: someone who has\n          switched to a passkey is not looking at a password field, and recovery beside it is an answer\n          to a question they did not ask.\n        */}\n        {currentActiveMethod === AuthMethod.PASSWORD && !showIdentifyForm && (\n          <Text>\n            <Link href={passwordLostHref}>{t(UserAuthLabel.FORGOT_PASSWORD)}</Link>\n          </Text>\n        )}\n\n        {auth.purpose !== AuthSessionPurpose.REAUTH\n          && resolvedAuth.registrationConfig.publicRegistrationAvailable && (\n          <Text>\n            {t(UserAuthLabel.NO_ACCOUNT)}{' '}\n            <Link href={registerHref}>{t(UserAuthLabel.SIGNUP_LINK)}</Link>\n          </Text>\n        )}\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_Main({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_UserAuth_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_UserAuth_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, 'Auth_Main')(preset);\n  logDebug(`Resolve wrapper preset=${preset} component=${Component.displayName ?? Component.name ?? 'anonymous'}`);\n  return <Component {...props} />;\n}\n"]}
+{"version":3,"file":"Auth_Main.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.tsx"],"names":[],"mappings":";AACA,OAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,iBAAiB,EACjB,yBAAyB,GAI1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,+BAA+B,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,sCAAsC,EAAE,MAAM,0EAA0E,CAAC;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,gEAAgE,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAA8B,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,gCAAgC,EAAE,iCAAiC,EAAE,MAAM,uFAAuF,CAAC;AAE5K,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iEAAiE,CAAC;AACjI,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,0DAA0D,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iEAAiE,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAiC,MAAM,oEAAoE,CAAC;AAC3I,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,0DAA0D,CAAC;AAG1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iFAAiF,CAAA;AACzH,OAAO,EAAG,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAEtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;AACjD,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAE/C;;;GAGG;AACH,MAAM,oBAAoB,GAAa,GAAG,EAAE;IAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,qBAAqB,CAAC,wBAAwB;KAC1D,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAE3F,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,MAAC,UAAU,eACT,KAAC,SAAS,IAAC,IAAI,EAAC,OAAO,GAAG,EAEzB,IAAI,CAAC,KAAK,IAAI,CACb,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,IAAI,CAAC,KAAK,GAAoB,GAC3C,CACT,EAED,KAAC,YAAY,IACX,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAChC,eAAe,EAAC,QAAG,EACnB,SAAS,SACT,IACS,CACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAAC,SAAiB;IACpD,MAAM,QAAQ,GAAG,iCAAiC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YACD,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,KAAK,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAE5C;;;GAGG;AACH,MAAM,0BAA0B,GAA4F;IAC1H,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,uBAAuB,EAAE,OAAO,EAAE,aAAa,EAAE;IACnH,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,uBAAuB,EAAE,OAAO,EAAE,aAAa,EAAE;IAClH,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,uBAAuB,EAAE,OAAO,EAAE,aAAa,EAAE;IAChH,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,uBAAuB,EAAE,OAAO,EAAE,aAAa,EAAE;IAC9G,gHAAgH;IAChH,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,wBAAwB,EAAE,OAAO,EAAE,SAAS,EAAE;CAC/G,CAAC;AAMF,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,EAA4C,EAAqB,EAAE;IACrH,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,WAAW,EAAE,CAAC;IACrE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,4BAA4B,GAAG,OAAO,CAAC,GAAG,EAAE;QAChD,OAAO,iCAAiC,CAAC;YACvC,eAAe,EAAE,YAAY,CAAC,UAAU,EAAE,qBAAqB;SAChE,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrD,MAAM,6BAA6B,GAAG,OAAO,CAAC,GAAG,EAAE;QACjD,OAAO,uCAAuC,CAC5C,4BAA4B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAC7E,CAAC;IACJ,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpD,SAAS,EAAE,qBAAqB,CAAC,wBAAwB;QACzD,IAAI,EAAE,6BAA6B;KACpC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC3F,MAAM,YAAY,GAAG,gBAAgB,CAAC;IACtC,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC9C,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClB,CAAC;IACF,MAAM,kBAAkB,GAAG,OAAO,CAChC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EACpD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClB,CAAC;IACF;;;;OAIG;IACH,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,0BAA0B,CAAC,IAA6B,CAAC;eAC/E,EAAE,KAAK,EAAE,aAAa,CAAC,uBAAuB,EAAE,OAAO,EAAE,aAAsB,EAAE,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9F,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAClC;;;;OAIG;IACH,MAAM,kBAAkB,GAAG,kBAAkB,KAAK,gBAAgB,CAAC,kBAAkB;QACnF,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,yBAAyB,CAAC,EAAE,OAAO,EAAE,aAAsB,EAAE;QACvF,CAAC,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,aAAa;YACrD,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAe,EAAE;YAC3E,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,wBAAwB,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,CAAC,EAC7E,CAAC,kBAAkB,EAAE,YAAY,CAAC,YAAY,CAAC,CAChD,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CAAC,wBAAwB,CAAC,YAAY,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACzE,CAAC,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,CAC5C,CAAC;IAEF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAC;IAE1E,oGAAoG;IACpG,4BAA4B,CAAC;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK;QACjC,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,IAAI,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC;IAE/C,MAAM,2BAA2B,GAAsB,OAAO,CAAC,GAAG,EAAE;QAClE,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU;YAAE,OAAO,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAC9D,6GAA6G;QAC7G,kHAAkH;QAClH,+GAA+G;QAC/G,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAoB,CAAC,CAAC,CAAC;IAC/E,CAAC,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAE7C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE;QACjC,IAAI,2BAA2B,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,kBAAkB,GAAG,IAAI,CAAC,cAAc,EAAE,wBAAkD,CAAC;QACnG,IAAI,kBAAkB,IAAI,sBAAsB,CAAC,kBAAkB,CAAC;YAAE,OAAO,kBAAkB,CAAC;QAChG,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,MAAoB,CAAC;IAC7D,CAAC,EAAE,CAAC,2BAA2B,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEjF,MAAM,mBAAmB,GAAG,YAAY,IAAI,aAAa,CAAC;IAC1D,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CACxC,CAAC;IAEF;;;;;;;;;;;;;;OAcG;IACH,MAAM,kCAAkC,GAAG,2BAA2B,CAAC,IAAI,CACzE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,IAAI,CAAC,CAAC,mBAAmB,CACjE,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,WAAmB,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,EAAE,IAAyB,EAAE,EAAE;QACzD,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,WAAW,CAAC,CAAC,SAAiC,EAAE,EAAE;QACjF,mEAAmE;QACnE,sDAAsD;QACtD,iEAAiE;QACjE,qDAAqD;IACvD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,MAAc,EAAE,EAAE;QAC5D,oDAAoD;IACtD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,wBAAwB,GAAG,4BAA4B,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC;IAChF,MAAM,oBAAoB,GAAG,wBAAwB,IAAI,gBAAgB,CAAC;IAE1E;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,EAAE;QAC5C,MAAM,OAAO,GAAG,4BAA4B,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAC5F,IAAI,CAAC,wBAAwB;YAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,wBAAwB,EAAE,YAAY,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9E,MAAM,uBAAuB,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,IAAI,wBAAwB,CAAC,IAAI,GAAG,CAAC,CAAC;IAEpH,MAAM,WAAW,GAAG,oBAAoB,IAAI,uBAAuB,CAAC;IAEpE;;;;OAIG;IACH,4GAA4G;IAC5G,iGAAiG;IACjG,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;WAClH,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM;WAC1C,OAAO,MAAM,KAAK,WAAW;WAC7B,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IAClC;;;;;;;;OAQG;IACH,MAAM,kBAAkB,GAAG,gBAAgB,IAAI,CAAC,uBAAuB,IAAI,CAAC,sBAAsB,IAAI,CAAC,oBAAoB,CAAC;IAC5H;;;;;OAKG;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEtD,MAAM,wBAAwB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACtD,qBAAqB,CAAC,OAAO,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,8FAA8F;YAC9F,sFAAsF;QACxF,CAAC;gBAAS,CAAC;YACT,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;YACtC,gBAAgB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB;;;;;OAKG;IACH;;;;;OAKG;IACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACvD,oBAAoB,CAAC,OAAO,GAAG,iBAAiB,CAAC;IAEjD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,IAAI,CAAC,sBAAsB;YAAE,OAAO,SAAS,CAAC;QAC/E,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC,CAAC,MAAM,+BAA+B,EAAE,CAAC;gBAAE,OAAO;YACvD,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;YAChF,mGAAmG;YACnG,kGAAkG;YAClG,qGAAqG;YACrG,sGAAsG;YACtG,iBAAiB;YACjB,OAAO,CAAC,SAAS,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,oBAAoB,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;oBACvE,OAAO;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,2BAA2B,CAAC,IAAI,qBAAqB,CAAC,OAAO;wBAAE,OAAO;gBAC/F,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;YACjB,oBAAoB,CAAC,cAAc,EAAE,CAAC;QACxC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;IAEvE,SAAS,CAAC,GAAG,EAAE;QACb,QAAQ,CACN,kBAAkB,OAAO,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,mBAAmB,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,mBAAmB,IAAI,MAAM,EAAE,CACzQ,CAAC;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAE1G,qHAAqH;IACrH,MAAM,4BAA4B,GAAG,sCAAsC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtG,IAAI,4BAA4B,EAAE,CAAC;QACjC,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,4BAA4B,EAAE,OAAO,SAAG,CAAC;IAChE,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,SAAG,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B;;;;;;;;;;OAUG;IACH,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,eAAK,SAAS,EAAC,6BAA6B,aAC1C,KAAC,OAAO,cACL,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM;4BACzC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC;4BAC/B,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAClB,EACV,KAAC,IAAI,IAAC,SAAS,EAAC,kBAAkB,YAC/B,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM;4BACzC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC;4BACnC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,GACzB,IACH,EAEL,oBAAoB,IAAI,CACvB,KAAC,qBAAqB,IACpB,SAAS,EAAE,4BAA4B,EACvC,eAAe,EAAE,iBAAiB,EAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EACzB,iBAAiB,EAAE,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,EACjD,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,EACzC,WAAW,EAAE,WAAW,GACxB,CACH,EAEA,CAAC,IAAI,CAAC,KAAK,IAAI,kBAAkB,IAAI,CACpC,KAAC,KAAK,IAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,+BAA6B,kBAAkB,IAAI,SAAS,YACpG,KAAC,gBAAgB,cAAE,kBAAkB,CAAC,IAAI,GAAoB,GACxD,CACT,EAEA,CAAC,IAAI,CAAC,KAAK,IAAI,mBAAmB,IAAI,CACrC,KAAC,KAAK,IAAC,OAAO,EAAE,mBAAmB,CAAC,OAAO,YACzC,KAAC,gBAAgB,cAAE,mBAAmB,CAAC,IAAI,GAAoB,GACzD,CACT,EAGA,gBAAgB,IAAI,uBAAuB,IAAI,CAC9C,KAAC,aAAa,IAEZ,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAC5B,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,cAAc,CAAC,OAAO,EACtC,QAAQ,EAAE,IAAI,CAAC,SAAS,EACxB,MAAM,EAAE;oBACN,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE;iBAClD,EACD,cAAc,EAAE,oBAAoB,IAThC,UAAU,CAUd,CACH,EAGA,gBAAgB,IAAI,sBAAsB,IAAI,CAC7C,8BACE,KAAC,cAAc,IAAC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,GAAI,EACtD,MAAC,MAAM,IACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,SAAS,EAAC,QAAQ,EAClB,aAAa,EAAE,mBAAmB,CAAC,IAAI,EACvC,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,IAAI,CAAC,SAAS,0BACH,EAAE,aAEvB,KAAC,cAAc,IAAC,MAAM,EAAE,UAAU,CAAC,OAAO,GAAI,EAC7C,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,IAC1B,IACR,CACJ,EAGA,mBAAmB,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE;gBACjD,MAAM,eAAe,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;gBACpE,IAAI,CAAC,eAAe;oBAAE,OAAO,IAAI,CAAC;gBAClC,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;gBAC/F,IAAI,CAAC,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAE/B,MAAM,KAAK,GAA6B;oBACtC,SAAS;oBACT,KAAK;oBACL,YAAY;oBACZ,SAAS,EAAE,wBAAwB;oBACnC,OAAO,EAAE,sBAAsB;oBAC/B,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,CAAC;oBACD,kBAAkB;iBACnB,CAAC;gBAEF,OAAO,KAAC,eAAe,OAAK,KAAK,GAAI,CAAC;YACxC,CAAC,CAAC,EAAE,EAOH,kCAAkC,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAC3F,KAAC,IAAI,cAAE,CAAC,CAAC,aAAa,CAAC,4BAA4B,CAAC,GAAQ,CAC7D,EAGA,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CACrD,8BACE,KAAC,cAAc,IAAC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAI,EAEjE,KAAC,oBAAoB,IACnB,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAoB,CAAC;wBACxE;;;;;;;;;;2BAUG;wBACH,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,EAAE;4BACzD,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;4BAClF,eAAe,EAAE,4BAA4B;4BAC7C,oBAAoB,EAAE,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;4BACpD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;4BACnC,0BAA0B,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,gCAAgC,CAAC;gCACzE,WAAW,EAAE,QAAQ,CAAC,WAAW;gCACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;gCACjC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gCACjD,UAAU,EAAE,uBAAuB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK;gCAChE,SAAS;6BACV,CAAC;yBACH,CAAC,EACF,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,IAAI,CAAC,SAAS,GACxB,IACD,CACJ,EAEA,kBAAkB,IAAI,CACrB,KAAC,KAAK,gCAA0B,EAAE,YAChC,KAAC,gBAAgB,cAAE,CAAC,CAAC,aAAa,CAAC,2BAA2B,CAAC,GAAoB,GAC7E,CACT,EAGA,CAAC,uBAAuB,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,CAC/D,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,IAAI,CAAC,KAAK,GAAoB,GAC3C,CACT,EAMD,eAAK,SAAS,EAAC,mCAAmC,aAe/C,mBAAmB,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,gBAAgB,IAAI,CACnE,KAAC,IAAI,cACH,KAAC,IAAI,IAAC,IAAI,EAAE,gBAAgB,YAAG,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,GAAQ,GAClE,CACR,EAEA,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM;2BACtC,YAAY,CAAC,kBAAkB,CAAC,2BAA2B,IAAI,CAClE,MAAC,IAAI,eACF,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,GAAG,EACjC,KAAC,IAAI,IAAC,IAAI,EAAE,YAAY,YAAG,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAQ,IAC1D,CACR,EAOD,KAAC,qBAAqB,IAAC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAI,IAClE,IACF,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,KAAK,EAAmE;IACvI,MAAM,SAAS,GAAG,uBAAuB,CAA2C,qBAAqB,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;IACzJ,QAAQ,CAAC,0BAA0B,MAAM,cAAc,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACjH,OAAO,KAAC,SAAS,OAAK,KAAK,GAAI,CAAC;AAClC,CAAC","sourcesContent":["\nimport React, { useMemo, useState, useCallback, useEffect, useRef } from 'react';\nimport { Navigate, useLocation } from 'react-router-dom';\nimport { FrontendComponentType, UserAuthLabel } from '@wildo-ai/presets-components-models';\nimport { ValidationMode } from '@wildo-ai/zod-decorators';\nimport {\n  AuthMethod,\n  AuthRedirectErrorCode,\n  AuthSessionPurpose,\n  getEnabledFirstFactorMethods,\n  getEnabledMethods,\n  AuthIdentifyFormDtoSchema,\n  type AuthIdentifyFormDto,\n  type AvailableMethod,\n  type AuthenticationResponse,\n} from '@wildo-ai/saas-models';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useAuthSession } from '~wildo-frontend-lib/core/security/useAuthSession';\nimport { SessionEndReason } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\nimport { PasskeyAutofillExpiredError, PasskeySignInMediation } from '~wildo-frontend-lib/core/security/security.frontend.schemas';\nimport { browserSupportsWebAuthnAutofill, WebAuthnAbortService } from '@simplewebauthn/browser';\nimport { organizationOnboardingNavigationTarget } from '~wildo-frontend-lib/core/security/organization-onboarding.frontend.utils';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { AutomatedForm } from '~wildo-frontend-lib/components/form/automated/AutomatedForm';\nimport { Button, ButtonLabelOverflow, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { FormLayout } from '~wildo-frontend-lib/components/resources/skeleton/FormLayout';\nimport { FormField } from '~wildo-frontend-lib/components/form/automated/FormField';\nimport { SubmitButton } from '~wildo-frontend-lib/components/resources/skeleton/SubmitButton';\nimport { Heading } from '~wildo-frontend-lib/components/typography/heading';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Link } from '~wildo-frontend-lib/components/typography/link';\nimport { Alert, AlertDescription, type AlertVariants_Variant } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport {\n  appendAuthRedirectToPath,\n  extractAuthRedirectFromSearch,\n  resolvePostAuthRedirect,\n} from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\nimport { collectFrontendProviderDisplayLabelKeys } from '~wildo-frontend-lib/core/external-providers/frontend-provider-display-label.frontend.utils';\nimport { resolveOAuthProviderDisplayLabel, resolvePublicOAuthProviderEntries } from '~wildo-frontend-lib/components/auth/utils/oauth-provider-display-label.frontend.utils';\n\nimport { OAuthProvidersSection, SSO_PROVIDER_BRAND_META } from '~wildo-frontend-lib/components/auth/utils/OAuthProvidersSection';\nimport { useMfaContinuationNavigation } from '~wildo-frontend-lib/components/auth/utils/useMfaContinuationNavigation';\nimport { LabeledDivider } from '~wildo-frontend-lib/components/auth/utils/LabeledDivider';\nimport { AuthPrivacyNoticeLink } from '~wildo-frontend-lib/components/auth/utils/AuthPrivacyNoticeLink';\nimport { AUTH_METHOD_COMPONENTS, type AuthMethodComponentProps } from '~wildo-frontend-lib/components/auth/methods/auth-method-components';\nimport { resolveAuthMethodChoiceLabel } from '~wildo-frontend-lib/components/auth/methods/auth-method-presentation';\nimport { AuthMethodChoiceList } from '~wildo-frontend-lib/components/auth/utils/AuthMethodChoiceList';\nimport { AuthMethodIcon } from '~wildo-frontend-lib/components/auth/utils/AuthMethodIcon';\n\nimport { ComponentPresetProps } from '~wildo-frontend-lib/core/components-registry/component-registry.frontend.schemas'\nimport { createComponentResolver } from '~wildo-frontend-lib/core/components-registry/component-resolver.frontend.helper'\nimport {  CorePresetNames } from '@wildo-ai/presets-components-models'\n\nconst logger = LoggerFrontendService.getLogger();\nconst logDebug = logger.debugByType('Auth_Main');\nlogger.setDebugTypeLogging('Auth_Main', false);\n\n/**\n * Self-sufficient template for the email identification form.\n * Reads auth error from `useUserOrgs()`, labels from `useI18n()`.\n */\nconst IdentifyFormTemplate: React.FC = () => {\n  const { auth } = useUserOrgs();\n  const { tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH,\n  });\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, key);\n\n  if (!isReady) return null;\n\n  return (\n    <FormLayout>\n      <FormField name=\"email\" />\n\n      {auth.error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{auth.error}</AlertDescription>\n        </Alert>\n      )}\n\n      <SubmitButton\n        label={t(UserAuthLabel.CONTINUE)}\n        submittingLabel=\"…\"\n        fullWidth\n      />\n    </FormLayout>\n  );\n};\n\n/**\n * Resolve once the sign-in email field carrying the `webauthn` autocomplete token is in the document.\n *\n * Passkey autofill must start AFTER that input exists: the browser attaches its passkey list to it, and\n * the WebAuthn helper refuses to start a conditional request without one. The form renders\n * asynchronously (it waits for its labels), so this polls one frame at a time, bounded, and answers\n * `null` if the field never appears — autofill is then simply not offered.\n */\nfunction waitForPasskeyAutofillField(timeoutMs: number): Promise<Element | null> {\n  const selector = 'input[autocomplete~=\"webauthn\"]';\n  return new Promise((resolve) => {\n    const deadline = Date.now() + timeoutMs;\n    const probe = () => {\n      const field = document.querySelector(selector);\n      if (field || Date.now() >= deadline) {\n        resolve(field);\n        return;\n      }\n      requestAnimationFrame(probe);\n    };\n    probe();\n  });\n}\n\n/** How long the page waits for the email field before giving up on offering passkey autofill. */\nconst PASSKEY_AUTOFILL_FIELD_WAIT_MS = 3000;\n\n/**\n * The authored words for each code an external sign-in redirects back with (#2567). Total over\n * `AuthRedirectErrorCode`, so a code added to the vocabulary must be given words here before it compiles.\n */\nconst AUTH_REDIRECT_ERROR_LABELS: Record<AuthRedirectErrorCode, { label: UserAuthLabel; variant: AlertVariants_Variant }> = {\n  [AuthRedirectErrorCode.SAML_LOGIN_FAILED]: { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' },\n  [AuthRedirectErrorCode.SAML_AUTH_FAILED]: { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' },\n  [AuthRedirectErrorCode.MISSING_PARAMS]: { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' },\n  [AuthRedirectErrorCode.OAUTH_FAILED]: { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' },\n  // A sign-out that did not finish at the provider is a caution, not a failure of what the person asked for here.\n  [AuthRedirectErrorCode.SAML_SLO_FAILED]: { label: UserAuthLabel.PROVIDER_SIGN_OUT_FAILED, variant: 'warning' },\n};\n\n// --- Contract ---\nexport interface PublicLayoutPreset_UserAuth_DefaultProps {\n}\n\nexport const PublicLayoutPreset_UserAuth_Default = ({}: PublicLayoutPreset_UserAuth_DefaultProps): React.JSX.Element => {\n  const { auth, identifyByEmail, initiateOAuth2Login } = useUserOrgs();\n  const { signInWithPasskey, endedSessionReason } = useAuthSession();\n  const resolvedAuth = useResolvedAuthConfig();\n  const location = useLocation();\n  const enabledSocialOAuth2Providers = useMemo(() => {\n    return resolvePublicOAuthProviderEntries({\n      publicProviders: resolvedAuth.globalAuth?.socialOAuth2Providers,\n    });\n  }, [resolvedAuth.globalAuth?.socialOAuth2Providers]);\n  const socialOAuth2ProviderLabelKeys = useMemo(() => {\n    return collectFrontendProviderDisplayLabelKeys(\n      enabledSocialOAuth2Providers.map((provider) => provider.displayNameLabelKey),\n    );\n  }, [enabledSocialOAuth2Providers]);\n  const { t: translate, tComponent, isReady } = useI18n({\n    component: FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH,\n    keys: socialOAuth2ProviderLabelKeys,\n  });\n\n  const t = (key: string) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, key);\n  const publicRoutes = CommonRoutePaths;\n  const postAuthRedirect = useMemo(\n    () => resolvePostAuthRedirect(location.search),\n    [location.search],\n  );\n  const authRedirectTarget = useMemo(\n    () => extractAuthRedirectFromSearch(location.search),\n    [location.search],\n  );\n  /**\n   * An external sign-in sent the person back here with an error code (#2567). Only the CODE is read, and it chooses\n   * authored words; any text the URL carries is never shown, because a link can carry any sentence and the page would\n   * present it as the application's own error. An unrecognised code reads as a failed provider sign-in.\n   */\n  const redirectedAuthError = useMemo(() => {\n    const code = new URLSearchParams(location.search).get('error');\n    if (!code) return null;\n    const { label, variant } = AUTH_REDIRECT_ERROR_LABELS[code as AuthRedirectErrorCode]\n      ?? { label: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, variant: 'destructive' as const };\n    return { text: tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, label), variant };\n  }, [location.search, tComponent]);\n  /**\n   * Why the person is here when the BACKEND ended their session (#2541), in authored words. An account that can no\n   * longer sign in (deactivated, suspended, pending) is told that an administrator must restore it, because trying\n   * again cannot work; any other refused session is told it ended and to sign in again.\n   */\n  const endedSessionNotice = endedSessionReason === SessionEndReason.ACCOUNT_NOT_ACTIVE\n    ? { text: t(UserAuthLabel.ACCOUNT_NOT_ACTIVE_NOTICE), variant: 'destructive' as const }\n    : endedSessionReason === SessionEndReason.SESSION_ENDED\n      ? { text: t(UserAuthLabel.SESSION_ENDED_NOTICE), variant: 'info' as const }\n      : null;\n  const passwordLostHref = useMemo(\n    () => appendAuthRedirectToPath(publicRoutes.passwordLost, authRedirectTarget),\n    [authRedirectTarget, publicRoutes.passwordLost],\n  );\n  const registerHref = useMemo(\n    () => appendAuthRedirectToPath(publicRoutes.register, authRedirectTarget),\n    [authRedirectTarget, publicRoutes.register],\n  );\n\n  const [activeMethod, setActiveMethod] = useState<AuthMethod | null>(null);\n\n  // Shared with the registration screen (#972), so a session owing a second factor is routed one way.\n  useMfaContinuationNavigation({\n    mfaRequired: auth.mfaRequired,\n    mfaSessionId: auth.mfaSessionId,\n    usableSecondFactorMethods: auth.usableSecondFactorMethods,\n    email: auth.identification?.email,\n    authRedirectTarget,\n  });\n\n  const hasIdentification = !!auth.identification;\n  const sessionId = auth.identification?.sessionId || '';\n  const email = auth.identification?.email || '';\n\n  const availableFirstFactorMethods: AvailableMethod[] = useMemo(() => {\n    if (!hasIdentification || !auth.identification?.userExists) return [];\n    const methods = auth.identification?.firstFactorMethods || [];\n    // Rendered in the order the server sent (#1218). The backend orders by `AUTH_METHOD_PRECEDENCE` and computes\n    // `defaultFirstFactorMethod` as the head of that same list, so re-sorting here would put a different method first\n    // from the one the server named as the default — which is exactly what it used to do for an SSO-routed domain.\n    return methods.filter((m) => AUTH_METHOD_COMPONENTS[m.method as AuthMethod]);\n  }, [hasIdentification, auth.identification]);\n\n  const defaultMethod = useMemo(() => {\n    if (availableFirstFactorMethods.length === 0) return null;\n    const defaultFromBackend = auth.identification?.defaultFirstFactorMethod as AuthMethod | undefined;\n    if (defaultFromBackend && AUTH_METHOD_COMPONENTS[defaultFromBackend]) return defaultFromBackend;\n    return availableFirstFactorMethods[0].method as AuthMethod;\n  }, [availableFirstFactorMethods, auth.identification?.defaultFirstFactorMethod]);\n\n  const currentActiveMethod = activeMethod || defaultMethod;\n  const alternativeMethods = availableFirstFactorMethods.filter(\n    (m) => m.method !== currentActiveMethod\n  );\n\n  /*\n   * Does the person's organization REQUIRE the method currently shown? (#1220)\n   *\n   * `enforcedFirstFactor` is set by the backend only where an enterprise connection declares\n   * `enforcement.requireSSO`. Until #1220 this arrived as a `required` boolean that NOTHING here read\n   * — a claim on the wire that no surface checked — and it could not safely be read, because the same\n   * field was also set on any method that can serve as a second factor whenever the user type demands\n   * MFA. Consuming that would have announced a passkey as a mandatory first factor.\n   *\n   * Read on the ACTIVE method rather than on the list, because the notice explains the thing the\n   * person is looking at. The interesting case is the one where alternatives exist beside it: a tenant\n   * that allows a password fallback, or that names break-glass accounts and therefore keeps the\n   * password field for EVERY address at the domain so the list cannot be read as an oracle for who\n   * those accounts are. There the two methods look like peers and are not.\n   */\n  const activeMethodIsOrganizationEnforced = availableFirstFactorMethods.some(\n    (m) => m.method === currentActiveMethod && m.enforcedFirstFactor,\n  );\n\n  const handleOAuth2Click = async (providerRef: string) => {\n    try {\n      await initiateOAuth2Login(providerRef, authRedirectTarget);\n    } catch {\n      // Error is already handled in AuthSessionContext\n    }\n  };\n\n  const handleIdentify = async (data: AuthIdentifyFormDto) => {\n    await identifyByEmail(data.email);\n  };\n\n  const handleFirstFactorSuccess = useCallback((_response: AuthenticationResponse) => {\n    // Token storage and MFA redirect are handled by AuthSessionContext\n    // and the authenticateWithPassword flow respectively.\n    // Nothing to do here — the auth state update triggers re-renders\n    // and the MFA redirect is handled at the page level.\n  }, []);\n\n  const handleFirstFactorError = useCallback((_error: string) => {\n    // Errors are displayed within each method component\n  }, []);\n\n  const hasSocialOAuth2Providers = enabledSocialOAuth2Providers.length > 0;\n  const showIdentifyForm = !hasIdentification || !auth.identification?.userExists;\n  const showPreIdentifyOAuth = hasSocialOAuth2Providers && showIdentifyForm;\n\n  /*\n   * The identifier step is the door to EVERY method reached by saying who you are, so it is offered\n   * when ANY identify-reachable method is enabled — not when PASSWORD is (#1219). Gating it on the\n   * password made a user type that signs in by magic link unable to sign in at all: the email address\n   * is the one thing that sign-in needs, and the page hid the field that collects it.\n   *\n   * The password INPUT stays gated on the password, and by a stronger authority than this map: it is a\n   * Phase-2 method component, rendered only for a method the identify RESPONSE returned for this\n   * person. So nothing below has to re-decide it.\n   *\n   * `EXTERNAL_OAUTH2` counts only when a social provider actually resolves, mirroring\n   * `_buildAvailableMethodObject`, which returns null for it when the application configures none.\n   *\n   * An UNRESOLVED policy offers the step. The identifier form is not an access control — the backend\n   * decides what a person may use, and refuses on its own — so treating \"I do not know yet\" as\n   * \"closed\" would lock the whole sign-in page over a config the page had not loaded, while\n   * protecting nothing.\n   */\n  const identifyReachableMethods = useMemo(() => {\n    const methods = getEnabledFirstFactorMethods(resolvedAuth.userTypeAuth?.authMethodsEnabled);\n    if (!hasSocialOAuth2Providers) methods.delete(AuthMethod.EXTERNAL_OAUTH2);\n    return methods;\n  }, [hasSocialOAuth2Providers, resolvedAuth.userTypeAuth?.authMethodsEnabled]);\n  const isIdentifierStepOffered = !resolvedAuth.userTypeAuth?.authMethodsEnabled || identifyReachableMethods.size > 0;\n\n  const showDivider = showPreIdentifyOAuth && isIdentifierStepOffered;\n\n  /*\n   * Username-less passkey sign-in is offered before any email is typed, when the application enables\n   * passkeys for this frontend's user type and the browser speaks WebAuthn. Not during re-authentication:\n   * a re-proof must be the SAME person, and a discoverable ceremony lets the device pick any account.\n   */\n  // Read through the shared helper: `authMethodsEnabled` accepts both `true` and `{ enabled: true }`, and the\n  // backend decides with the same helper, so the page must not offer less than the server accepts.\n  const isPasskeySignInOffered = getEnabledMethods(resolvedAuth.userTypeAuth?.authMethodsEnabled).has(AuthMethod.PASSKEY)\n    && auth.purpose !== AuthSessionPurpose.REAUTH\n    && typeof window !== 'undefined'\n    && !!window.PublicKeyCredential;\n  /*\n   * The page offers NO way in: no identifier step, no passkey button, no social provider (#1255).\n   *\n   * Without this it rendered the heading and subtitle and then nothing — the one alert below that\n   * could speak is gated on `auth.error`, and with no form nothing can produce an error. The three\n   * terms are exactly the three entry points rendered in the identify phase, so a passkey-only or\n   * social-only type is not a dead end and gets no notice. An UNRESOLVED policy offers the identifier\n   * step (see `isIdentifierStepOffered`), so this never flashes while the config is loading.\n   */\n  const offersNoEntryPoint = showIdentifyForm && !isIdentifierStepOffered && !isPasskeySignInOffered && !showPreIdentifyOAuth;\n  /*\n   * While a ceremony the person started with the button is open, autofill must not restart: starting a\n   * WebAuthn request aborts the pending one, so a restart timed after the button would close the picker\n   * the person is looking at. When the button ceremony ends — refused or cancelled; a success leaves the\n   * page — `autofillEpoch` moves and the autofill effect starts a fresh wait.\n   */\n  const buttonCeremonyLiveRef = useRef(false);\n  const [autofillEpoch, setAutofillEpoch] = useState(0);\n\n  const handlePasskeySignInClick = useCallback(async () => {\n    buttonCeremonyLiveRef.current = true;\n    try {\n      await signInWithPasskey(PasskeySignInMediation.MODAL);\n    } catch {\n      // Already reported: the context puts the user-facing message on `auth.error`, which the email\n      // form renders. Caught here only so a refused ceremony is not an unhandled rejection.\n    } finally {\n      buttonCeremonyLiveRef.current = false;\n      setAutofillEpoch((epoch) => epoch + 1);\n    }\n  }, [signInWithPasskey]);\n\n  /*\n   * Passkey AUTOFILL: while the email form is on screen, a conditional passkey request waits for the\n   * person to pick a passkey from the email field's autofill list. It is cancelled when the form goes\n   * away (an email was submitted, or sign-in completed), and a modal request started by the button\n   * replaces it — the WebAuthn helper aborts the pending one itself.\n   */\n  /*\n   * The latest `signInWithPasskey`, read through a ref so the autofill effect does NOT re-run when the\n   * callback's identity changes. The effect's cleanup cancels the one global WebAuthn ceremony, so a\n   * re-run triggered by an unrelated context re-render would cancel a ceremony the person started with\n   * the button, and open a second session for nothing.\n   */\n  const signInWithPasskeyRef = useRef(signInWithPasskey);\n  signInWithPasskeyRef.current = signInWithPasskey;\n\n  useEffect(() => {\n    if (!isReady || !showIdentifyForm || !isPasskeySignInOffered) return undefined;\n    let cancelled = false;\n    void (async () => {\n      if (!(await browserSupportsWebAuthnAutofill())) return;\n      const field = await waitForPasskeyAutofillField(PASSKEY_AUTOFILL_FIELD_WAIT_MS);\n      // One waiting request at a time, restarted only when its challenge ran out. Anything else ends the\n      // loop: the page moved on, the button began its own ceremony, or a picked passkey failed (already\n      // reported on `auth.error`). An idle sign-in tab therefore costs one options call per sign-in window\n      // (the `expiresInSeconds` the server answered), which is what the per-IP limit on the options door is\n      // sized against.\n      while (!cancelled) {\n        try {\n          await signInWithPasskeyRef.current(PasskeySignInMediation.CONDITIONAL);\n          return;\n        } catch (error) {\n          if (!(error instanceof PasskeyAutofillExpiredError) || buttonCeremonyLiveRef.current) return;\n        }\n      }\n    })();\n    return () => {\n      cancelled = true;\n      WebAuthnAbortService.cancelCeremony();\n    };\n  }, [isReady, showIdentifyForm, isPasskeySignInOffered, autofillEpoch]);\n\n  useEffect(() => {\n    logDebug(\n      `Render isReady=${isReady} accessToken=${auth.accessToken ? 'yes' : 'no'} authLoading=${auth.isLoading ? 'yes' : 'no'} identification=${hasIdentification ? 'yes' : 'no'} showIdentify=${showIdentifyForm ? 'yes' : 'no'} activeMethod=${currentActiveMethod ?? 'none'}`,\n    );\n  }, [isReady, auth.accessToken, auth.isLoading, hasIdentification, showIdentifyForm, currentActiveMethod]);\n\n  // Parked at organization onboarding (#1090): the organization is the only step left, whatever this screen was doing.\n  const organizationOnboardingTarget = organizationOnboardingNavigationTarget(auth, authRedirectTarget);\n  if (organizationOnboardingTarget) {\n    return <Navigate to={organizationOnboardingTarget} replace />;\n  }\n\n  if (auth.accessToken) {\n    return <Navigate to={postAuthRedirect} replace />;\n  }\n\n  if (!isReady) return null;\n\n  /*\n   * ONE element owns the vertical rhythm of the screen. Every block used to bring its own margin, so\n   * whichever pair nobody had thought about got none — the \"Forgot password?\" link sat flush against the\n   * last alternative-method button (measured: 0px). The container spaces every adjacent pair, including\n   * ones a future phase adds.\n   *\n   * `space-y-group` (block flow) and NOT `flex flex-col gap-group`, because of `LabeledDivider`'s own\n   * `my-group`. In block flow the sibling margin and the divider's margin COLLAPSE, so an \"or\" divider\n   * gets one group-step each side — the spacing it has on the registration and invitation screens, which\n   * are block flow too. A flex gap does not collapse with margins and gave this screen twice that.\n   */\n  return (\n    <div className=\"space-y-group\">\n      <div className=\"text-center space-y-item-xs\">\n        <Heading>\n          {auth.purpose === AuthSessionPurpose.REAUTH\n            ? t(UserAuthLabel.REAUTH_TITLE)\n            : t(UserAuthLabel.TITLE)}\n        </Heading>\n        <Text className=\"max-w-sm mx-auto\">\n          {auth.purpose === AuthSessionPurpose.REAUTH\n            ? t(UserAuthLabel.REAUTH_SUB_TITLE)\n            : t(UserAuthLabel.SUB_TITLE)}\n        </Text>\n      </div>\n\n      {showPreIdentifyOAuth && (\n        <OAuthProvidersSection\n          providers={enabledSocialOAuth2Providers}\n          onProviderClick={handleOAuth2Click}\n          isLoading={auth.isLoading}\n          continueWithLabel={t(UserAuthLabel.CONTINUE_WITH)}\n          translate={translate}\n          dividerLabel={t(UserAuthLabel.DIVIDER_OR)}\n          showDivider={showDivider}\n        />\n      )}\n\n      {!auth.error && endedSessionNotice && (\n        <Alert variant={endedSessionNotice.variant} data-session-ended-notice={endedSessionReason ?? undefined}>\n          <AlertDescription>{endedSessionNotice.text}</AlertDescription>\n        </Alert>\n      )}\n\n      {!auth.error && redirectedAuthError && (\n        <Alert variant={redirectedAuthError.variant}>\n          <AlertDescription>{redirectedAuthError.text}</AlertDescription>\n        </Alert>\n      )}\n\n      {/* Phase 1: Identification — email input before any method is shown */}\n      {showIdentifyForm && isIdentifierStepOffered && (\n        <AutomatedForm\n          key=\"identify\"\n          schema={AuthIdentifyFormDtoSchema}\n          defaultValues={{ email: '' }}\n          onSubmit={handleIdentify}\n          validationMode={ValidationMode.ON_BLUR}\n          disabled={auth.isLoading}\n          labels={{\n            fields: { email: t(UserAuthLabel.EMAIL_ADDRESS) },\n          }}\n          layoutTemplate={IdentifyFormTemplate}\n        />\n      )}\n\n      {/* Phase 1b: Username-less passkey sign-in — the device offers the person's accounts */}\n      {showIdentifyForm && isPasskeySignInOffered && (\n        <>\n          <LabeledDivider label={t(UserAuthLabel.DIVIDER_OR)} />\n          <Button\n            variant={ButtonVariants_Variant.OUTLINE}\n            className=\"w-full\"\n            labelOverflow={ButtonLabelOverflow.WRAP}\n            onClick={handlePasskeySignInClick}\n            disabled={auth.isLoading}\n            data-passkey-sign-in=\"\"\n          >\n            <AuthMethodIcon method={AuthMethod.PASSKEY} />\n            {t(UserAuthLabel.PASSKEY_SIGN_IN)}\n          </Button>\n        </>\n      )}\n\n      {/* Phase 2: After identification — render active first-factor method */}\n      {currentActiveMethod && !showIdentifyForm && (() => {\n        const MethodComponent = AUTH_METHOD_COMPONENTS[currentActiveMethod];\n        if (!MethodComponent) return null;\n        const methodConfig = availableFirstFactorMethods.find((m) => m.method === currentActiveMethod);\n        if (!methodConfig) return null;\n\n        const props: AuthMethodComponentProps = {\n          sessionId,\n          email,\n          methodConfig,\n          onSuccess: handleFirstFactorSuccess,\n          onError: handleFirstFactorError,\n          factorLevel: 'first',\n          isLoading: auth.isLoading,\n          t,\n          authRedirectTarget,\n        };\n\n        return <MethodComponent {...props} />;\n      })()}\n\n      {/*\n        The enforcement notice belongs with the alternatives, not with the method above: on its own an\n        enforced method needs no explanation — it is simply how you sign in. What needs explaining is\n        why a password field is sitting underneath one.\n      */}\n      {activeMethodIsOrganizationEnforced && alternativeMethods.length > 0 && !showIdentifyForm && (\n        <Text>{t(UserAuthLabel.ORGANIZATION_ENFORCED_METHOD)}</Text>\n      )}\n\n      {/* Phase 3: Alternative methods — shown as buttons below the active method */}\n      {alternativeMethods.length > 0 && !showIdentifyForm && (\n        <>\n          <LabeledDivider label={t(UserAuthLabel.OTHER_METHODS_DIVIDER)} />\n\n          <AuthMethodChoiceList\n            methods={alternativeMethods.map((method) => method.method as AuthMethod)}\n            /*\n             * Named by the PROVIDER where the descriptor names one — \"Continue with Google\", the same\n             * words the pre-identify buttons and the active enterprise method already use. The\n             * descriptor is looked up rather than passed through the list's props because the list is\n             * shared with the second-factor and enrollment choosers, which have no descriptors; the\n             * naming data belongs to this surface, not to the list.\n             *\n             * `find` by method is sound because `identify` emits at most ONE entry per method — a\n             * method standing for several providers carries them in its own `oauth2ProviderRefs`,\n             * which is exactly the case the resolver declines to name.\n             */\n            labelFor={(method) => resolveAuthMethodChoiceLabel(method, {\n              offeredMethod: alternativeMethods.find((candidate) => candidate.method === method),\n              socialProviders: enabledSocialOAuth2Providers,\n              continueWithTemplate: t(UserAuthLabel.CONTINUE_WITH),\n              translateLabel: (label) => t(label),\n              resolveSocialProviderLabel: (provider) => resolveOAuthProviderDisplayLabel({\n                providerRef: provider.providerRef,\n                displayName: provider.displayName,\n                displayNameLabelKey: provider.displayNameLabelKey,\n                brandLabel: SSO_PROVIDER_BRAND_META[provider.providerRef]?.label,\n                translate,\n              }),\n            })}\n            onSelect={setActiveMethod}\n            disabled={auth.isLoading}\n          />\n        </>\n      )}\n\n      {offersNoEntryPoint && (\n        <Alert data-auth-no-entry-point=\"\">\n          <AlertDescription>{t(UserAuthLabel.NO_SIGN_IN_METHOD_AVAILABLE)}</AlertDescription>\n        </Alert>\n      )}\n\n      {/* No identifier form to carry it: the error has nowhere else to be read. */}\n      {!isIdentifierStepOffered && !hasIdentification && auth.error && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>{auth.error}</AlertDescription>\n        </Alert>\n      )}\n\n      {/*\n        Navigation AWAY from this form (recover a password, create an account) is a different group\n        from the actions above it, so it sits one extra group-step apart rather than at the plain gap.\n      */}\n      <div className=\"text-center space-y-item pt-group\">\n        {/*\n          Password recovery belongs to the PASSWORD step, and to no other (#1220).\n          \n          This used to render on `hasIdentification && userExists`, and `userExists` is hard-wired\n          `true` on every identify response for enumeration safety — so it reduced to \"any address that\n          has been typed\". It offered recovery to an account with no password at all, and to a domain\n          routed to its own identity provider, where the link leads somewhere the person's credential\n          does not live. It also sat in a sibling element outside the method-render block, so no branch\n          could have conditioned it on the active method.\n          \n          Gated on the ACTIVE method rather than on `PASSWORD` merely being offered: someone who has\n          switched to a passkey is not looking at a password field, and recovery beside it is an answer\n          to a question they did not ask.\n        */}\n        {currentActiveMethod === AuthMethod.PASSWORD && !showIdentifyForm && (\n          <Text>\n            <Link href={passwordLostHref}>{t(UserAuthLabel.FORGOT_PASSWORD)}</Link>\n          </Text>\n        )}\n\n        {auth.purpose !== AuthSessionPurpose.REAUTH\n          && resolvedAuth.registrationConfig.publicRegistrationAvailable && (\n          <Text>\n            {t(UserAuthLabel.NO_ACCOUNT)}{' '}\n            <Link href={registerHref}>{t(UserAuthLabel.SIGNUP_LINK)}</Link>\n          </Text>\n        )}\n\n        {/*\n          The privacy notice (#2976). Sign-in is the first screen most people meet, and for staff provisioned by an\n          identity provider often the only one before their data is processed; `AuthPrivacyNoticeLink` records why, and\n          draws nothing while the application serves no notice.\n        */}\n        <AuthPrivacyNoticeLink label={t(UserAuthLabel.PRIVACY_NOTICE_LINK)} />\n      </div>\n    </div>\n  );\n};\n\nexport function Auth_Main({ preset = CorePresetNames.DEFAULT, ...props }: PublicLayoutPreset_UserAuth_DefaultProps & ComponentPresetProps): React.JSX.Element {\n  const Component = createComponentResolver<PublicLayoutPreset_UserAuth_DefaultProps>(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, 'Auth_Main')(preset);\n  logDebug(`Resolve wrapper preset=${preset} component=${Component.displayName ?? Component.name ?? 'anonymous'}`);\n  return <Component {...props} />;\n}\n"]}

package/dist/esm/components/auth/Auth_Main.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Main.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA0C,MAAM,qCAAqC,CAAC;AAMzJ,eAAO,MAAM,2BAA2B,EAAE,mBAAmB,EA6C5D,CAAC"}
+{"version":3,"file":"Auth_Main.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA0C,MAAM,qCAAqC,CAAC;AAMzJ,eAAO,MAAM,2BAA2B,EAAE,mBAAmB,EAsD5D,CAAC"}

package/dist/esm/components/auth/Auth_Main.labels.js

@@ -46,7 +46,16 @@ export const PublicLayoutsUserAuthLabels = [
     { ref: UserAuthLabel.PASSKEY_SIGN_IN, kind: LabelKind.BUTTON, purpose: 'Button shown before any email is typed that opens the device passkey picker, so a person signs in by choosing one of their accounts' },
     { ref: UserAuthLabel.REAUTH_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when re-authenticating an already-known user (step-up)' },
     { ref: UserAuthLabel.REAUTH_SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line for the re-authentication screen' },
+    { ref: UserAuthLabel.SESSION_ENDED_NOTICE, kind: LabelKind.MESSAGE, purpose: "Notice above sign-in when the person's session was ended by the application rather than by them (it expired or was revoked): tells them their session ended and to sign in again" },
+    { ref: UserAuthLabel.ACCOUNT_NOT_ACTIVE_NOTICE, kind: LabelKind.MESSAGE, purpose: 'Notice above sign-in when the session ended because the account can no longer sign in (it was deactivated or suspended, or is not yet active): signing in again will not work, so it tells the person to contact an administrator to restore access' },
+    { ref: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, kind: LabelKind.MESSAGE, purpose: 'Error above sign-in after signing in through an external provider (single sign-on, a social account) did not complete and sent the person back here: tells them it did not work and to try again' },
+    { ref: UserAuthLabel.PROVIDER_SIGN_OUT_FAILED, kind: LabelKind.MESSAGE, purpose: "Notice above sign-in when signing out of the organization's single sign-on provider did not complete, so the person may still be signed in there" },
     { ref: UserAuthLabel.SSO_CONFIGURATION_ERROR, kind: LabelKind.MESSAGE, purpose: 'Error under an enterprise SSO sign-in button that cannot start because its connection is not fully configured; the person should contact their administrator' },
+    {
+        ref: UserAuthLabel.PRIVACY_NOTICE_LINK,
+        kind: LabelKind.LABEL,
+        purpose: "Link text at the foot of the sign-in screen and of the accept-invitation screen to the application's own privacy notice, e.g. \"Privacy notice\". Shown before the person has a session, and only when the application serves a notice; it opens the notice in a new tab so a form already started is not lost.",
+    },
 ];
 registerComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, PublicLayoutsUserAuthLabels);
 //# sourceMappingURL=Auth_Main.labels.js.map

package/dist/esm/components/auth/Auth_Main.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_Main.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzJ,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAA0B;IAChE,EAAE,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACpG,EAAE,GAAG,EAAE,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACnH,EAAE,GAAG,EAAE,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACtH,EAAE,GAAG,EAAE,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACnI,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACrG,EAAE,GAAG,EAAE,aAAa,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAC1H,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACpI,EAAE,GAAG,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gEAAgE,EAAE;IACnI,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE;IACzH,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,yEAAyE,EAAE;IAC7I,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACpH,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACnH,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,wEAAwE,EAAE;IAC1I,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sDAAsD,EAAE;IACxH;QACE,GAAG,EAAE,aAAa,CAAC,aAAa;QAChC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,yEAAyE;QAClF,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;KACnG;IACD,EAAE,GAAG,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,6DAA6D,EAAE;IAChI,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,kDAAkD,EAAE;IAC3H,EAAE,GAAG,EAAE,aAAa,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC5H,EAAE,GAAG,EAAE,aAAa,CAAC,2BAA2B,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAC1J,EAAE,GAAG,EAAE,aAAa,CAAC,6BAA6B,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,wEAAwE,EAAE;IAC/J,EAAE,GAAG,EAAE,aAAa,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sEAAsE,EAAE;IACpJ,EAAE,GAAG,EAAE,aAAa,CAAC,2BAA2B,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kLAAkL,EAAE;IACxQ,EAAE,GAAG,EAAE,aAAa,CAAC,4BAA4B,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iJAAiJ,EAAE;IACxO,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,iDAAiD,EAAE;IAC1H,EAAE,GAAG,EAAE,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAC9H,EAAE,GAAG,EAAE,aAAa,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACxH,EAAE,GAAG,EAAE,aAAa,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,0DAA0D,EAAE;IAClI,EAAE,GAAG,EAAE,aAAa,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACpI,EAAE,GAAG,EAAE,aAAa,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACvI,EAAE,GAAG,EAAE,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACrI,EAAE,GAAG,EAAE,aAAa,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,wDAAwD,EAAE;IAChI,EAAE,GAAG,EAAE,aAAa,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kEAAkE,EAAE;IACnJ,EAAE,GAAG,EAAE,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACvH,EAAE,GAAG,EAAE,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,mEAAmE,EAAE;IACjJ,EAAE,GAAG,EAAE,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACnI,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,qIAAqI,EAAE;IAC9M,EAAE,GAAG,EAAE,aAAa,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IAC7I,EAAE,GAAG,EAAE,aAAa,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,kDAAkD,EAAE;IACjI,EAAE,GAAG,EAAE,aAAa,CAAC,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8JAA8J,EAAE;CACjP,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels, UserAuthLabel } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsUserAuthLabels: LabellingUnitaryDef[] = [\n  { ref: UserAuthLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Main heading of the sign-in screen' },\n  { ref: UserAuthLabel.SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line under the sign-in heading' },\n  { ref: UserAuthLabel.EMAIL_ADDRESS, kind: LabelKind.LABEL, purpose: 'Field label for the email-identification input' },\n  { ref: UserAuthLabel.EMAIL_PLACEHOLDER, kind: LabelKind.PLACEHOLDER, purpose: 'Placeholder inside the email-identification input' },\n  { ref: UserAuthLabel.PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the password input' },\n  { ref: UserAuthLabel.PASSWORD_PLACEHOLDER, kind: LabelKind.PLACEHOLDER, purpose: 'Placeholder inside the password input' },\n  { ref: UserAuthLabel.FORGOT_PASSWORD, kind: LabelKind.LABEL, purpose: 'Link to the password-recovery flow shown to existing users' },\n  { ref: UserAuthLabel.NO_ACCOUNT, kind: LabelKind.LABEL, purpose: 'Prompt preceding the sign-up link for users without an account' },\n  { ref: UserAuthLabel.SIGNUP_LINK, kind: LabelKind.LABEL, purpose: 'Link text that navigates to the registration screen' },\n  { ref: UserAuthLabel.HAS_ACCOUNT, kind: LabelKind.LABEL, purpose: 'Prompt preceding the sign-in link for users who already have an account' },\n  { ref: UserAuthLabel.SIGNIN_LINK, kind: LabelKind.LABEL, purpose: 'Link text that navigates to the sign-in screen' },\n  { ref: UserAuthLabel.SUBMIT, kind: LabelKind.BUTTON, purpose: 'Primary submit button for the authentication form' },\n  { ref: UserAuthLabel.CONTINUE, kind: LabelKind.BUTTON, purpose: 'Button that submits the email to continue past the identification step' },\n  { ref: UserAuthLabel.SUCCESS, kind: LabelKind.MESSAGE, purpose: 'Confirmation shown after a successful authentication' },\n  {\n    ref: UserAuthLabel.CONTINUE_WITH,\n    kind: LabelKind.BUTTON,\n    purpose: 'OAuth button label inviting the user to continue with a social provider',\n    params: [{ key: 'provider', meaning: 'display name of the OAuth provider (e.g. Google, GitHub)' }],\n  },\n  { ref: UserAuthLabel.DIVIDER_OR, kind: LabelKind.LABEL, purpose: 'Divider word separating OAuth providers from the email form' },\n  { ref: UserAuthLabel.MAGIC_LINK_SEND, kind: LabelKind.BUTTON, purpose: 'Button that emails a one-time magic sign-in link' },\n  { ref: UserAuthLabel.MAGIC_LINK_SENT_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the magic link was sent' },\n  { ref: UserAuthLabel.MAGIC_LINK_SENT_DESCRIPTION, kind: LabelKind.MESSAGE, purpose: 'Body text telling the user to check their inbox for the magic link' },\n  { ref: UserAuthLabel.MAGIC_LINK_TRY_ANOTHER_METHOD, kind: LabelKind.BUTTON, purpose: 'Link to fall back to another sign-in method after sending a magic link' },\n  { ref: UserAuthLabel.OTHER_METHODS_DIVIDER, kind: LabelKind.LABEL, purpose: 'Divider introducing alternative sign-in methods below the active one' },\n  { ref: UserAuthLabel.NO_SIGN_IN_METHOD_AVAILABLE, kind: LabelKind.MESSAGE, purpose: 'Notice that this sign-in page offers no way to sign in for this kind of account, and that the person should contact whoever runs the application; shown instead of an empty page' },\n  { ref: UserAuthLabel.ORGANIZATION_ENFORCED_METHOD, kind: LabelKind.MESSAGE, purpose: \"Notice that the person's organization requires the method shown above, so the other methods on the page are fallbacks rather than equal choices\" },\n  { ref: UserAuthLabel.METHOD_PASSWORD, kind: LabelKind.BUTTON, purpose: 'Selector button for the password sign-in method' },\n  { ref: UserAuthLabel.METHOD_MAGIC_LINK, kind: LabelKind.BUTTON, purpose: 'Selector button for the magic-link sign-in method' },\n  { ref: UserAuthLabel.METHOD_PASSKEY, kind: LabelKind.BUTTON, purpose: 'Selector button for the passkey sign-in method' },\n  { ref: UserAuthLabel.METHOD_SMS_OTP, kind: LabelKind.BUTTON, purpose: 'Selector button for the SMS one-time-code sign-in method' },\n  { ref: UserAuthLabel.METHOD_ORG_SSO, kind: LabelKind.BUTTON, purpose: 'Selector button for the organization single sign-on method' },\n  { ref: UserAuthLabel.METHOD_EXTERNAL_OAUTH2, kind: LabelKind.BUTTON, purpose: 'Selector button for an external OAuth2 sign-in method' },\n  { ref: UserAuthLabel.PASSKEY_DESCRIPTION, kind: LabelKind.DESCRIPTION, purpose: 'Helper text explaining the passkey sign-in option' },\n  { ref: UserAuthLabel.PASSKEY_BUTTON, kind: LabelKind.BUTTON, purpose: 'Button that triggers the passkey authentication prompt' },\n  { ref: UserAuthLabel.PASSKEY_AUTHENTICATING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the passkey challenge is being verified' },\n  { ref: UserAuthLabel.PASSKEY_ERROR, kind: LabelKind.MESSAGE, purpose: 'Error shown when passkey authentication fails' },\n  { ref: UserAuthLabel.PASSKEY_UNSUPPORTED, kind: LabelKind.MESSAGE, purpose: 'Notice shown when the device or browser does not support passkeys' },\n  { ref: UserAuthLabel.PASSKEY_CANCELLED, kind: LabelKind.MESSAGE, purpose: 'Notice shown when the user cancels the passkey prompt' },\n  { ref: UserAuthLabel.PASSKEY_SIGN_IN, kind: LabelKind.BUTTON, purpose: 'Button shown before any email is typed that opens the device passkey picker, so a person signs in by choosing one of their accounts' },\n  { ref: UserAuthLabel.REAUTH_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when re-authenticating an already-known user (step-up)' },\n  { ref: UserAuthLabel.REAUTH_SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line for the re-authentication screen' },\n  { ref: UserAuthLabel.SSO_CONFIGURATION_ERROR, kind: LabelKind.MESSAGE, purpose: 'Error under an enterprise SSO sign-in button that cannot start because its connection is not fully configured; the person should contact their administrator' },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, PublicLayoutsUserAuthLabels);\n"]}
+{"version":3,"file":"Auth_Main.labels.js","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_Main.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzJ,4EAA4E;AAC5E,8EAA8E;AAC9E,4DAA4D;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAA0B;IAChE,EAAE,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACpG,EAAE,GAAG,EAAE,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACnH,EAAE,GAAG,EAAE,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACtH,EAAE,GAAG,EAAE,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACnI,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACrG,EAAE,GAAG,EAAE,aAAa,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAC1H,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACpI,EAAE,GAAG,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gEAAgE,EAAE;IACnI,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE;IACzH,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,yEAAyE,EAAE;IAC7I,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACpH,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACnH,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,wEAAwE,EAAE;IAC1I,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sDAAsD,EAAE;IACxH;QACE,GAAG,EAAE,aAAa,CAAC,aAAa;QAChC,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,yEAAyE;QAClF,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;KACnG;IACD,EAAE,GAAG,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,6DAA6D,EAAE;IAChI,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,kDAAkD,EAAE;IAC3H,EAAE,GAAG,EAAE,aAAa,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC5H,EAAE,GAAG,EAAE,aAAa,CAAC,2BAA2B,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAC1J,EAAE,GAAG,EAAE,aAAa,CAAC,6BAA6B,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,wEAAwE,EAAE;IAC/J,EAAE,GAAG,EAAE,aAAa,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sEAAsE,EAAE;IACpJ,EAAE,GAAG,EAAE,aAAa,CAAC,2BAA2B,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kLAAkL,EAAE;IACxQ,EAAE,GAAG,EAAE,aAAa,CAAC,4BAA4B,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iJAAiJ,EAAE;IACxO,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,iDAAiD,EAAE;IAC1H,EAAE,GAAG,EAAE,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAC9H,EAAE,GAAG,EAAE,aAAa,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACxH,EAAE,GAAG,EAAE,aAAa,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,0DAA0D,EAAE;IAClI,EAAE,GAAG,EAAE,aAAa,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACpI,EAAE,GAAG,EAAE,aAAa,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACvI,EAAE,GAAG,EAAE,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACrI,EAAE,GAAG,EAAE,aAAa,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,wDAAwD,EAAE;IAChI,EAAE,GAAG,EAAE,aAAa,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kEAAkE,EAAE;IACnJ,EAAE,GAAG,EAAE,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACvH,EAAE,GAAG,EAAE,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,mEAAmE,EAAE;IACjJ,EAAE,GAAG,EAAE,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACnI,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,qIAAqI,EAAE;IAC9M,EAAE,GAAG,EAAE,aAAa,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IAC7I,EAAE,GAAG,EAAE,aAAa,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,kDAAkD,EAAE;IACjI,EAAE,GAAG,EAAE,aAAa,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kLAAkL,EAAE;IACjQ,EAAE,GAAG,EAAE,aAAa,CAAC,yBAAyB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qPAAqP,EAAE;IACzU,EAAE,GAAG,EAAE,aAAa,CAAC,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kMAAkM,EAAE;IACpR,EAAE,GAAG,EAAE,aAAa,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kJAAkJ,EAAE;IACrO,EAAE,GAAG,EAAE,aAAa,CAAC,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,8JAA8J,EAAE;IAChP;QACE,GAAG,EAAE,aAAa,CAAC,mBAAmB;QACtC,IAAI,EAAE,SAAS,CAAC,KAAK;QACrB,OAAO,EAAE,iTAAiT;KAC3T;CACF,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels, UserAuthLabel } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + per-key\n// purpose / kind / variable meaning. Statically scanned by the dev companion;\n// NOT imported at runtime, so it never ships in the bundle.\n\nexport const PublicLayoutsUserAuthLabels: LabellingUnitaryDef[] = [\n  { ref: UserAuthLabel.TITLE, kind: LabelKind.HEADING, purpose: 'Main heading of the sign-in screen' },\n  { ref: UserAuthLabel.SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line under the sign-in heading' },\n  { ref: UserAuthLabel.EMAIL_ADDRESS, kind: LabelKind.LABEL, purpose: 'Field label for the email-identification input' },\n  { ref: UserAuthLabel.EMAIL_PLACEHOLDER, kind: LabelKind.PLACEHOLDER, purpose: 'Placeholder inside the email-identification input' },\n  { ref: UserAuthLabel.PASSWORD, kind: LabelKind.LABEL, purpose: 'Field label for the password input' },\n  { ref: UserAuthLabel.PASSWORD_PLACEHOLDER, kind: LabelKind.PLACEHOLDER, purpose: 'Placeholder inside the password input' },\n  { ref: UserAuthLabel.FORGOT_PASSWORD, kind: LabelKind.LABEL, purpose: 'Link to the password-recovery flow shown to existing users' },\n  { ref: UserAuthLabel.NO_ACCOUNT, kind: LabelKind.LABEL, purpose: 'Prompt preceding the sign-up link for users without an account' },\n  { ref: UserAuthLabel.SIGNUP_LINK, kind: LabelKind.LABEL, purpose: 'Link text that navigates to the registration screen' },\n  { ref: UserAuthLabel.HAS_ACCOUNT, kind: LabelKind.LABEL, purpose: 'Prompt preceding the sign-in link for users who already have an account' },\n  { ref: UserAuthLabel.SIGNIN_LINK, kind: LabelKind.LABEL, purpose: 'Link text that navigates to the sign-in screen' },\n  { ref: UserAuthLabel.SUBMIT, kind: LabelKind.BUTTON, purpose: 'Primary submit button for the authentication form' },\n  { ref: UserAuthLabel.CONTINUE, kind: LabelKind.BUTTON, purpose: 'Button that submits the email to continue past the identification step' },\n  { ref: UserAuthLabel.SUCCESS, kind: LabelKind.MESSAGE, purpose: 'Confirmation shown after a successful authentication' },\n  {\n    ref: UserAuthLabel.CONTINUE_WITH,\n    kind: LabelKind.BUTTON,\n    purpose: 'OAuth button label inviting the user to continue with a social provider',\n    params: [{ key: 'provider', meaning: 'display name of the OAuth provider (e.g. Google, GitHub)' }],\n  },\n  { ref: UserAuthLabel.DIVIDER_OR, kind: LabelKind.LABEL, purpose: 'Divider word separating OAuth providers from the email form' },\n  { ref: UserAuthLabel.MAGIC_LINK_SEND, kind: LabelKind.BUTTON, purpose: 'Button that emails a one-time magic sign-in link' },\n  { ref: UserAuthLabel.MAGIC_LINK_SENT_TITLE, kind: LabelKind.HEADING, purpose: 'Heading confirming the magic link was sent' },\n  { ref: UserAuthLabel.MAGIC_LINK_SENT_DESCRIPTION, kind: LabelKind.MESSAGE, purpose: 'Body text telling the user to check their inbox for the magic link' },\n  { ref: UserAuthLabel.MAGIC_LINK_TRY_ANOTHER_METHOD, kind: LabelKind.BUTTON, purpose: 'Link to fall back to another sign-in method after sending a magic link' },\n  { ref: UserAuthLabel.OTHER_METHODS_DIVIDER, kind: LabelKind.LABEL, purpose: 'Divider introducing alternative sign-in methods below the active one' },\n  { ref: UserAuthLabel.NO_SIGN_IN_METHOD_AVAILABLE, kind: LabelKind.MESSAGE, purpose: 'Notice that this sign-in page offers no way to sign in for this kind of account, and that the person should contact whoever runs the application; shown instead of an empty page' },\n  { ref: UserAuthLabel.ORGANIZATION_ENFORCED_METHOD, kind: LabelKind.MESSAGE, purpose: \"Notice that the person's organization requires the method shown above, so the other methods on the page are fallbacks rather than equal choices\" },\n  { ref: UserAuthLabel.METHOD_PASSWORD, kind: LabelKind.BUTTON, purpose: 'Selector button for the password sign-in method' },\n  { ref: UserAuthLabel.METHOD_MAGIC_LINK, kind: LabelKind.BUTTON, purpose: 'Selector button for the magic-link sign-in method' },\n  { ref: UserAuthLabel.METHOD_PASSKEY, kind: LabelKind.BUTTON, purpose: 'Selector button for the passkey sign-in method' },\n  { ref: UserAuthLabel.METHOD_SMS_OTP, kind: LabelKind.BUTTON, purpose: 'Selector button for the SMS one-time-code sign-in method' },\n  { ref: UserAuthLabel.METHOD_ORG_SSO, kind: LabelKind.BUTTON, purpose: 'Selector button for the organization single sign-on method' },\n  { ref: UserAuthLabel.METHOD_EXTERNAL_OAUTH2, kind: LabelKind.BUTTON, purpose: 'Selector button for an external OAuth2 sign-in method' },\n  { ref: UserAuthLabel.PASSKEY_DESCRIPTION, kind: LabelKind.DESCRIPTION, purpose: 'Helper text explaining the passkey sign-in option' },\n  { ref: UserAuthLabel.PASSKEY_BUTTON, kind: LabelKind.BUTTON, purpose: 'Button that triggers the passkey authentication prompt' },\n  { ref: UserAuthLabel.PASSKEY_AUTHENTICATING, kind: LabelKind.MESSAGE, purpose: 'In-progress status while the passkey challenge is being verified' },\n  { ref: UserAuthLabel.PASSKEY_ERROR, kind: LabelKind.MESSAGE, purpose: 'Error shown when passkey authentication fails' },\n  { ref: UserAuthLabel.PASSKEY_UNSUPPORTED, kind: LabelKind.MESSAGE, purpose: 'Notice shown when the device or browser does not support passkeys' },\n  { ref: UserAuthLabel.PASSKEY_CANCELLED, kind: LabelKind.MESSAGE, purpose: 'Notice shown when the user cancels the passkey prompt' },\n  { ref: UserAuthLabel.PASSKEY_SIGN_IN, kind: LabelKind.BUTTON, purpose: 'Button shown before any email is typed that opens the device passkey picker, so a person signs in by choosing one of their accounts' },\n  { ref: UserAuthLabel.REAUTH_TITLE, kind: LabelKind.HEADING, purpose: 'Heading shown when re-authenticating an already-known user (step-up)' },\n  { ref: UserAuthLabel.REAUTH_SUB_TITLE, kind: LabelKind.DESCRIPTION, purpose: 'Supporting line for the re-authentication screen' },\n  { ref: UserAuthLabel.SESSION_ENDED_NOTICE, kind: LabelKind.MESSAGE, purpose: \"Notice above sign-in when the person's session was ended by the application rather than by them (it expired or was revoked): tells them their session ended and to sign in again\" },\n  { ref: UserAuthLabel.ACCOUNT_NOT_ACTIVE_NOTICE, kind: LabelKind.MESSAGE, purpose: 'Notice above sign-in when the session ended because the account can no longer sign in (it was deactivated or suspended, or is not yet active): signing in again will not work, so it tells the person to contact an administrator to restore access' },\n  { ref: UserAuthLabel.PROVIDER_SIGN_IN_FAILED, kind: LabelKind.MESSAGE, purpose: 'Error above sign-in after signing in through an external provider (single sign-on, a social account) did not complete and sent the person back here: tells them it did not work and to try again' },\n  { ref: UserAuthLabel.PROVIDER_SIGN_OUT_FAILED, kind: LabelKind.MESSAGE, purpose: \"Notice above sign-in when signing out of the organization's single sign-on provider did not complete, so the person may still be signed in there\" },\n  { ref: UserAuthLabel.SSO_CONFIGURATION_ERROR, kind: LabelKind.MESSAGE, purpose: 'Error under an enterprise SSO sign-in button that cannot start because its connection is not fully configured; the person should contact their administrator' },\n  {\n    ref: UserAuthLabel.PRIVACY_NOTICE_LINK,\n    kind: LabelKind.LABEL,\n    purpose: \"Link text at the foot of the sign-in screen and of the accept-invitation screen to the application's own privacy notice, e.g. \\\"Privacy notice\\\". Shown before the person has a session, and only when the application serves a notice; it opens the notice in a new tab so a form already started is not lost.\",\n  },\n];\nregisterComponentLabels(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, PublicLayoutsUserAuthLabels);\n"]}

package/dist/esm/components/auth/Auth_OAuthConsent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth_OAuthConsent.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAoDxH;;;;;GAKG;AACH,MAAM,WAAW,4CAA4C;IAC3D,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,oGAAoG;AACpG,eAAO,MAAM,uCAAuC,GAClD,QAAQ,4CAA4C,KACnD,KAAK,CAAC,GAAG,CAAC,OAqKZ,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,4CAA4C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAMzF"}
+{"version":3,"file":"Auth_OAuthConsent.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/Auth_OAuthConsent.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAIjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kFAAkF,CAAC;AAoDxH;;;;;GAKG;AACH,MAAM,WAAW,4CAA4C;IAC3D,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,oGAAoG;AACpG,eAAO,MAAM,uCAAuC,GAClD,QAAQ,4CAA4C,KACnD,KAAK,CAAC,GAAG,CAAC,OAqKZ,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,MAAgC,EAChC,GAAG,KAAK,EACT,EAAE,4CAA4C,GAAG,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAMzF"}

package/dist/esm/components/auth/Auth_OAuthConsent.js

@@ -1,6 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { Navigate, useSearchParams } from 'react-router-dom';
+import { OAuthConsentDecision } from '@wildo-ai/saas-models';
 import { CorePresetNames, FrontendComponentType, UserOAuthConsentLabel } from '@wildo-ai/presets-components-models';
 import { createComponentResolver } from '../../core/components-registry/component-resolver.frontend.helper.js';
 import { Button, ButtonVariants_Variant } from '../../components/actions/button.js';
@@ -118,7 +119,7 @@ export const PublicLayoutPreset_OAuthConsent_Default = (_props) => {
         try {
             const { redirect_to } = await getManualCallsHttpClient().oauthConsentDecision(consent.consent_token, decision, 
             // Only an APPROVE meaningfully "remembers"; a deny sends `false` harmlessly.
-            decision === 'approve' && remember);
+            decision === OAuthConsentDecision.APPROVE && remember);
             // Complete the OAuth redirect back to the third-party client (carries `code` or the error).
             window.location.assign(redirect_to);
         }
@@ -144,7 +145,7 @@ export const PublicLayoutPreset_OAuthConsent_Default = (_props) => {
     if (status === 'error' || !consent) {
         return (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: t(errorLabel ?? UserOAuthConsentLabel.ERROR_GENERIC) }) }));
     }
-    return (_jsxs("div", { className: "space-y-group", children: [_jsxs("div", { className: "text-center space-y-item-xs", children: [_jsx(Heading, { children: t(UserOAuthConsentLabel.TITLE, { clientName: consent.client.name }) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserOAuthConsentLabel.SUB_TITLE) })] }), consent.scopes.length > 0 && (_jsxs("div", { className: "space-y-element", children: [_jsx(Text, { className: "font-medium", children: t(UserOAuthConsentLabel.SCOPES_INTRO) }), _jsx("ul", { className: "space-y-item-xs", children: consent.scopes.map((scope) => (_jsx("li", { children: _jsx(Text, { children: scope }) }, scope))) })] })), consent.resource && (_jsx(Text, { className: "text-sm break-all", children: t(UserOAuthConsentLabel.AGENT_ENDPOINT, { resource: consent.resource }) })), _jsxs("label", { className: "flex items-center gap-item-xs cursor-pointer", children: [_jsx(CheckboxRoot, { checked: remember, onCheckedChange: (c) => setRemember(c === true) }), _jsx(Text, { children: t(UserOAuthConsentLabel.REMEMBER) })] }), _jsxs("div", { className: "flex gap-element", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, className: "flex-1", onClick: () => decide('deny'), children: t(UserOAuthConsentLabel.DENY) }), _jsx(Button, { variant: ButtonVariants_Variant.DEFAULT, className: "flex-1", onClick: () => decide('approve'), children: t(UserOAuthConsentLabel.APPROVE) })] })] }));
+    return (_jsxs("div", { className: "space-y-group", children: [_jsxs("div", { className: "text-center space-y-item-xs", children: [_jsx(Heading, { children: t(UserOAuthConsentLabel.TITLE, { clientName: consent.client.name }) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserOAuthConsentLabel.SUB_TITLE) })] }), consent.scopes.length > 0 && (_jsxs("div", { className: "space-y-element", children: [_jsx(Text, { className: "font-medium", children: t(UserOAuthConsentLabel.SCOPES_INTRO) }), _jsx("ul", { className: "space-y-item-xs", children: consent.scopes.map((scope) => (_jsx("li", { children: _jsx(Text, { children: scope }) }, scope))) })] })), consent.resource && (_jsx(Text, { className: "text-sm break-all", children: t(UserOAuthConsentLabel.AGENT_ENDPOINT, { resource: consent.resource }) })), _jsxs("label", { className: "flex items-center gap-item-xs cursor-pointer", children: [_jsx(CheckboxRoot, { checked: remember, onCheckedChange: (c) => setRemember(c === true) }), _jsx(Text, { children: t(UserOAuthConsentLabel.REMEMBER) })] }), _jsxs("div", { className: "flex gap-element", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, className: "flex-1", onClick: () => decide(OAuthConsentDecision.DENY), children: t(UserOAuthConsentLabel.DENY) }), _jsx(Button, { variant: ButtonVariants_Variant.DEFAULT, className: "flex-1", onClick: () => decide(OAuthConsentDecision.APPROVE), children: t(UserOAuthConsentLabel.APPROVE) })] })] }));
 };
 /**
  * Preset-resolving wrapper for the OIDC consent screen (mirrors every other `PUBLIC_LAYOUTS` auth