cauthy-auth 0.30.0 → 0.32.0

package/dist/react.js

@@ -21,11 +21,22 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/react.tsx
 var react_exports = {};
 __export(react_exports, {
+  AcceptInvite: () => AcceptInvite,
   Account: () => Account,
+  AccountAgents: () => AccountAgents,
+  AccountEmail: () => AccountEmail,
+  AccountLinked: () => AccountLinked,
+  AccountPasskeys: () => AccountPasskeys,
+  AccountPassword: () => AccountPassword,
+  AccountPhone: () => AccountPhone,
+  AccountProfile: () => AccountProfile,
+  AccountSecondStep: () => AccountSecondStep,
+  AccountSessions: () => AccountSessions,
   CauthyProvider: () => CauthyProvider,
   ForgotPassword: () => ForgotPassword,
   GoogleOneTap: () => GoogleOneTap,
   OrganizationMembers: () => OrganizationMembers,
+  PendingTerms: () => PendingTerms,
   ResetPassword: () => ResetPassword,
   SignIn: () => SignIn,
   SignUp: () => SignUp,
@@ -411,11 +422,11 @@ function createAuthClient(options = {}) {
       if (res.ok) {
         const m = await res.json();
         if (m.password) policy = passwordPolicyOf(m.password);
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passwordSignIn: m.passwordSignIn !== false, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
+    return { providers: [], signUp: true, passwordSignIn: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -562,6 +573,20 @@ function createAuthClient(options = {}) {
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
+    async invitation(token) {
+      const bad = { ok: false, error: { code: "invalid_token", message: "This invitation is not valid, or it has expired." } };
+      if (typeof token !== "string" || token.trim() === "") return bad;
+      try {
+        const res = await doFetch(`${base}/invitation?token=${encodeURIComponent(token.trim())}`, { credentials: "same-origin", headers: { accept: "application/json" } });
+        const body = await res.json().catch(() => null);
+        if (res.ok && body?.invitation) return { ok: true, status: "ok", invitation: body.invitation };
+        const e = body?.error;
+        return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? "") } : UNAVAILABLE };
+      } catch {
+        return { ok: false, error: UNAVAILABLE };
+      }
+    },
+    acceptInvitation: (token, password) => post("/invitation/accept", { token, password }, checkNewPassword(password, policy)),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
       async list(system) {
@@ -787,6 +812,7 @@ var TEXTS = {
     removePhone: "Remove phone",
     bySms: "SMS",
     byWhatsapp: "WhatsApp",
+    channel: "Send codes by",
     checkEmail: "Almost there: open the link we sent to confirm your address \u2014 it signs you in.",
     backToSignIn: "Back to sign in",
     emailMeALink: "Email me a sign-in link",
@@ -798,6 +824,13 @@ var TEXTS = {
     passwordChanged: "Your password was changed. You can sign in with it now.",
     confirming: "Confirming your address\u2026",
     emailConfirmed: "Your address is confirmed. You can sign in now.",
+    invitedTo: "You've been invited to {workspace}",
+    invitedToOrganization: "You've been invited to {organization} on {workspace}",
+    invitedAs: "You will sign in as {email}.",
+    choosePassword: "Choose a password",
+    acceptInvite: "Accept and sign in",
+    openingInvitation: "Opening your invitation\u2026",
+    invitationInvalid: "This invitation is not valid: it was already used, or it has expired. Ask whoever invited you to send it again.",
     profile: "Profile",
     save: "Save",
     saved: "Saved.",
@@ -869,6 +902,9 @@ var TEXTS = {
     organizationDeleted: "{org} was deleted.",
     yes: "Yes",
     cancel: "Cancel",
+    termsChanged: "Our terms changed",
+    termsChangedHelp: "To go on, read and accept",
+    acceptTerms: "Accept",
     errors: {
       not_allowed: "Your role in this organization does not allow that.",
       last_manager: "Somebody else must manage the members first: give that role to another member.",
@@ -912,7 +948,9 @@ var TEXTS = {
       invalid_assertion: "Your company's answer could not be checked. Try again.",
       provisioning_disabled: "Your company's sign-in worked, but this workspace has no account for you. Ask its admin to add you.",
       connection_inactive: "Your company's sign-in is turned off for this workspace.",
-      invalid_grant: "That sign-in expired. Try again."
+      invalid_grant: "That sign-in expired. Try again.",
+      password_disabled: "This workspace does not sign in with a password. Use one of the other ways.",
+      passkeys_disabled: "Passkeys are turned off for this workspace."
     }
   },
   es: {
@@ -954,6 +992,7 @@ var TEXTS = {
     removePhone: "Quitar tel\xE9fono",
     bySms: "SMS",
     byWhatsapp: "WhatsApp",
+    channel: "Enviar los c\xF3digos por",
     checkEmail: "Casi listo: abre el enlace que te enviamos para confirmar tu correo; te deja adentro.",
     backToSignIn: "Volver a entrar",
     emailMeALink: "Env\xEDame un enlace para entrar",
@@ -965,6 +1004,13 @@ var TEXTS = {
     passwordChanged: "Tu contrase\xF1a se cambi\xF3. Ya puedes entrar con ella.",
     confirming: "Confirmando tu correo\u2026",
     emailConfirmed: "Tu correo qued\xF3 confirmado. Ya puedes entrar.",
+    invitedTo: "Te invitaron a {workspace}",
+    invitedToOrganization: "Te invitaron a {organization} en {workspace}",
+    invitedAs: "Vas a entrar como {email}.",
+    choosePassword: "Elige una contrase\xF1a",
+    acceptInvite: "Aceptar y entrar",
+    openingInvitation: "Abriendo tu invitaci\xF3n\u2026",
+    invitationInvalid: "Esta invitaci\xF3n no es v\xE1lida: ya se us\xF3 o venci\xF3. P\xEDdele a quien te invit\xF3 que te la env\xEDe de nuevo.",
     profile: "Perfil",
     save: "Guardar",
     saved: "Guardado.",
@@ -1036,6 +1082,9 @@ var TEXTS = {
     organizationDeleted: "{org} qued\xF3 eliminada.",
     yes: "S\xED",
     cancel: "Cancelar",
+    termsChanged: "Nuestros t\xE9rminos cambiaron",
+    termsChangedHelp: "Para seguir, lee y acepta",
+    acceptTerms: "Aceptar",
     errors: {
       not_allowed: "Tu rol en esta organizaci\xF3n no permite eso.",
       last_manager: "Primero alguien m\xE1s debe administrar los miembros: dale ese rol a otro miembro.",
@@ -1079,7 +1128,9 @@ var TEXTS = {
       invalid_assertion: "No se pudo verificar la respuesta de tu empresa. Intenta de nuevo.",
       provisioning_disabled: "El ingreso con tu empresa funcion\xF3, pero este workspace no tiene una cuenta para ti. P\xEDdele a su admin que te agregue.",
       connection_inactive: "El inicio de sesi\xF3n de tu empresa est\xE1 apagado en este workspace.",
-      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo."
+      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo.",
+      password_disabled: "En este workspace no se entra con contrase\xF1a. Usa una de las otras formas.",
+      passkeys_disabled: "Las llaves de acceso est\xE1n desactivadas en este workspace."
     }
   }
 };
@@ -1194,8 +1245,10 @@ function sameOrigin(to) {
 function useForm(props) {
   const t = { ...TEXTS[props.locale ?? "en"], ...props.texts, errors: { ...TEXTS[props.locale ?? "en"].errors, ...props.texts?.errors } };
   const cx = (slot) => props.classNames?.[slot] ?? `cauthy-${slot}`;
-  const Button = props.components?.Button ?? PlainButton;
-  const Input = props.components?.Input ?? PlainInput;
+  const own = (slot) => props.classNames?.[slot];
+  const C = props.components ?? {};
+  const Button = C.Button ?? PlainButton;
+  const Input = C.Input ?? PlainInput;
   const [error, setError] = (0, import_react.useState)(null);
   const [busy, setBusy] = (0, import_react.useState)(false);
   const [policy, setPolicy] = (0, import_react.useState)(void 0);
@@ -1210,7 +1263,81 @@ function useForm(props) {
     else window.location.assign(sitePath(to) ?? sameOrigin(props.returnTo) ?? "/");
   };
   const root = useRoot(props);
-  return { t, cx, Button, Input, error, setError, busy, setBusy, say, done, root, policy, setPolicy, passwordRule };
+  return { t, cx, own, C, Button, Input, error, setError, busy, setBusy, say, done, root, policy, setPolicy, passwordRule };
+}
+function Note({ f, children, footer }) {
+  const { Text } = f.C;
+  if (Text) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { as: "p", tone: "muted", size: footer ? "sm" : "md", children });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx(footer ? "footer" : "notice"), children });
+}
+function Heading({ f, children }) {
+  const { Text } = f.C;
+  if (Text) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { as: "h2", size: "lg", children });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children });
+}
+function Say({ f, tone, children }) {
+  const { Alert } = f.C;
+  if (Alert) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert, { tone, children });
+  if (tone === "danger") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children });
+}
+function Or({ f, children }) {
+  const { Divider } = f.C;
+  if (Divider) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Divider, { label: children });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("separator"), children });
+}
+function A({ f, href, newTab, children }) {
+  const { Link } = f.C;
+  if (Link) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Link, { href, newTab, children });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href, target: newTab ? "_blank" : void 0, rel: newTab ? "noopener" : void 0, children });
+}
+function Tag({ f, tone, children, plain }) {
+  const { Badge } = f.C;
+  if (Badge) return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    " ",
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Badge, { tone, children })
+  ] });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: plain });
+}
+function Check(p) {
+  const id = (0, import_react.useId)();
+  const { f } = p;
+  const { Checkbox } = f.C;
+  if (Checkbox) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox, { id, name: p.name, checked: p.checked, required: p.required, className: f.own("check"), onChange: p.onChange, children: p.children });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("check"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", name: p.name, checked: p.checked, required: p.required, onChange: (e) => p.onChange(e.target.checked) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: p.children })
+  ] });
+}
+function Pick(p) {
+  const made = (0, import_react.useId)();
+  const id = p.id ?? made;
+  const { f } = p;
+  const { Select } = f.C;
+  if (Select) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Select, { id, name: p.name, value: p.value, options: p.options, disabled: p.disabled, "aria-label": p.label, className: f.own("input"), onChange: p.onChange });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("select", { id, name: p.name, "aria-label": p.label, className: f.cx("input"), value: p.value, disabled: p.disabled, onChange: (e) => p.onChange(e.target.value), children: p.options.map((o) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: o.value, children: o.label }, o.value)) });
+}
+function Labelled({ f, id, label, children }) {
+  const { Field: OwnField } = f.C;
+  if (OwnField) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(OwnField, { id, label, className: f.own("field"), children });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("field"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: f.cx("label"), children: label }),
+    children
+  ] });
+}
+function Documents({ f, documents }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: documents.map((d, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
+    i > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+      f.t.and,
+      " "
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: d.url, newTab: true, children: d.kind === "terms" ? f.t.termsOfService : f.t.privacyPolicy }),
+    " "
+  ] }, d.kind)) });
 }
 var PASSWORD_RULES = ["needs_lowercase", "needs_uppercase", "needs_digit", "needs_symbol", "needs_classes", "breached"];
 function isPasswordRule(e) {
@@ -1228,26 +1355,43 @@ function Field(p) {
   const { f } = p;
   const bad = f.error?.field === p.name ? f.error : null;
   const described = [bad ? `${id}-error` : "", p.hint ? `${id}-hint` : ""].filter(Boolean).join(" ");
+  const input = /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+    f.Input,
+    {
+      id,
+      name: p.name,
+      type: p.type,
+      value: p.value,
+      autoComplete: p.autoComplete,
+      required: p.required,
+      className: f.cx("input"),
+      "aria-invalid": bad ? true : void 0,
+      "aria-describedby": described || void 0,
+      onChange: (e) => p.onChange(e.target.value)
+    }
+  );
+  const { Field: OwnField } = f.C;
+  if (OwnField) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      OwnField,
+      {
+        id,
+        label: p.label,
+        aside: p.aside,
+        help: p.hint && !bad ? p.hint : void 0,
+        error: bad ? f.say(bad) : void 0,
+        required: p.required,
+        className: f.own("field"),
+        children: input
+      }
+    );
+  }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("field"), children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("label"), htmlFor: id, children: [
       p.label,
       p.aside
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-      f.Input,
-      {
-        id,
-        name: p.name,
-        type: p.type,
-        value: p.value,
-        autoComplete: p.autoComplete,
-        required: p.required,
-        className: f.cx("input"),
-        "aria-invalid": bad ? true : void 0,
-        "aria-describedby": described || void 0,
-        onChange: (e) => p.onChange(e.target.value)
-      }
-    ),
+    input,
     p.hint && !bad && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { id: `${id}-hint`, className: f.cx("hint"), children: p.hint }),
     bad && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { id: `${id}-error`, role: "alert", className: f.cx("fieldError"), children: f.say(bad) })
   ] });
@@ -1274,23 +1418,16 @@ function useMailedToken(name, open) {
     open(takeToken(name));
   }, []);
 }
-function SignIn(props) {
-  const auth = useAuth();
-  const f = useForm(props);
-  const [methods, setMethods] = (0, import_react.useState)(null);
-  const [email, setEmail] = (0, import_react.useState)("");
-  const [password, setPassword] = (0, import_react.useState)("");
+function SecondStepForm(p) {
+  const { f, auth } = p;
   const [code, setCode] = (0, import_react.useState)("");
-  const [step, setStep] = (0, import_react.useState)("password");
-  const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
   const [phoneWay, setPhoneWay] = (0, import_react.useState)(null);
   const [phoneSent, setPhoneSent] = (0, import_react.useState)("");
   (0, import_react.useEffect)(() => {
-    if (step !== "code") return;
     void auth.signIn.mfaMethods().then((r) => {
       if (r.ok) setPhoneWay({ totp: r.totp, phone: r.phone, push: r.push, email: r.email });
     });
-  }, [step]);
+  }, []);
   const sendEmail = async () => {
     f.setBusy(true);
     f.setError(null);
@@ -1326,6 +1463,62 @@ function SignIn(props) {
     if (!r.ok) return f.setError(r.error);
     setPhoneSent(r.sentTo);
   };
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.signIn.mfa({ code });
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const to = phoneWay?.phone?.number ?? "";
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.email ? f.t.codeHelpEmail.replace("{to}", phoneWay.email.to) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    phoneWay?.email && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendEmail(), children: f.t.sendEmailAgain }),
+    pushNumber > 0 ? f.C.Text ? (
+      // The application's text: the number to pick drawn large, by its own rules.
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { role: "status", "aria-live": "polite", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.C.Text, { as: "p", children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.C.Text, { as: "p", size: "lg", children: pushNumber }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.C.Text, { as: "p", tone: "muted", children: f.t.pushWaiting })
+      ] })
+    ) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("notice"), role: "status", "aria-live": "polite", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { fontSize: 48, fontWeight: 700, margin: "4px 0", textAlign: "center" }, children: pushNumber }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushWaiting })
+    ] }) : phoneWay?.push && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("button"), onClick: () => void sendPush(), children: f.t.pushSend }),
+    phoneWay?.phone && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendCode(), children: (phoneWay.phone.channel === "whatsapp" ? f.t.sendCodeWhatsapp : f.t.sendCodeSms).replace("{to}", to) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
+  ] });
+}
+function ProviderButtons(p) {
+  const { f } = p;
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: p.providers.map((provider) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(f.Button, { type: "button", className: f.cx("providerButton"), onClick: () => p.onPick(provider.id), children: [
+    provider.iconUrl && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("img", { src: provider.iconUrl, alt: "", width: 18, height: 18, className: f.cx("providerIcon") }),
+    f.t.continueWith,
+    " ",
+    provider.name
+  ] }, provider.id)) });
+}
+function signInOffers(methods) {
+  const password = methods?.passwordSignIn !== false;
+  return { password, email: password || methods?.magicLink === true || methods?.sso === true, passkey: methods?.passkey === true };
+}
+function SignIn(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [methods, setMethods] = (0, import_react.useState)(null);
+  const [email, setEmail] = (0, import_react.useState)("");
+  const [password, setPassword] = (0, import_react.useState)("");
+  const [code, setCode] = (0, import_react.useState)("");
+  const [step, setStep] = (0, import_react.useState)("password");
+  const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
+  const offers = signInOffers(methods);
+  const passwordOn = offers.password;
   const autofill = (0, import_react.useRef)(null);
   const [offer, setOffer] = (0, import_react.useState)(0);
   const [company, setCompany] = (0, import_react.useState)(null);
@@ -1377,10 +1570,18 @@ function SignIn(props) {
   const submit = async (e) => {
     e.preventDefault();
     autofill.current?.abort();
+    if (step === "password" && company?.enforced) {
+      f.setError(null);
+      return toCompany();
+    }
+    if (step === "password" && !passwordOn) {
+      if (company) return toCompany();
+      if (methods?.magicLink) return sendLink();
+      return;
+    }
     f.setBusy(true);
     f.setError(null);
-    if (step === "password" && company?.enforced) return toCompany();
-    const r = step === "code" ? await auth.signIn.mfa({ code }) : step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
+    const r = step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
     f.setBusy(false);
     if (step === "password") challenge.renew();
     if (!r.ok && r.error.code === "sso_required") return toCompany();
@@ -1414,49 +1615,31 @@ function SignIn(props) {
     setStep("sent");
   };
   const general = f.error && !f.error.field ? f.error : null;
+  const asksEmail = offers.email;
   if (step === "opening") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("form"), ...f.root, "aria-busy": "true" });
   if (step === "sent") {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.signInLinkSent }),
-      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.codeFromMail }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
-    ] });
-  }
-  if (step === "code") {
-    const to = phoneWay?.phone?.number ?? "";
-    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.email ? f.t.codeHelpEmail.replace("{to}", phoneWay.email.to) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
-      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-      phoneWay?.email && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendEmail(), children: f.t.sendEmailAgain }),
-      pushNumber > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("notice"), role: "status", "aria-live": "polite", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { fontSize: 48, fontWeight: 700, margin: "4px 0", textAlign: "center" }, children: pushNumber }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushWaiting })
-      ] }) : phoneWay?.push && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("button"), onClick: () => void sendPush(), children: f.t.pushSend }),
-      phoneWay?.phone && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendCode(), children: (phoneWay.phone.channel === "whatsapp" ? f.t.sendCodeWhatsapp : f.t.sendCodeSms).replace("{to}", to) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.signInLinkSent }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.codeFromMail }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
     ] });
   }
+  if (step === "code") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SecondStepForm, { f, auth });
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-    (methods?.providers ?? []).map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(f.Button, { type: "button", className: f.cx("providerButton"), onClick: () => auth.signIn.social(p.id, { returnTo: props.returnTo }), children: [
-      f.t.continueWith,
-      " ",
-      p.name
-    ] }, p.id)),
-    methods?.passkey && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
-    ((methods?.providers.length ?? 0) > 0 || methods?.passkey) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProviderButtons, { f, providers: methods?.providers ?? [], onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+    offers.passkey && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
+    asksEmail && ((methods?.providers.length ?? 0) > 0 || offers.passkey) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Or, { f, children: f.t.orWithEmail }),
+    asksEmail && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
     company && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(f.Button, { type: "button", disabled: f.busy, className: f.cx(company.enforced ? "button" : "providerButton"), onClick: toCompany, children: [
       f.t.continueWith,
       " ",
       company.name
     ] }),
-    company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.ssoOnly }),
-    !company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.ssoOnly }),
+    !company?.enforced && passwordOn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
         Field,
         {
@@ -1468,17 +1651,18 @@ function SignIn(props) {
           autoComplete: "current-password",
           required: true,
           onChange: setPassword,
-          aside: props.links?.forgotPassword ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
+          aside: props.links?.forgotPassword ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
         }
       ),
       challenge.node,
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn })
     ] }),
+    !company?.enforced && !passwordOn && methods?.magicLink && challenge.node,
     methods?.magicLink && !company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
-    methods?.signUp !== false && props.links?.signUp && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { className: f.cx("footer"), children: [
+    methods?.signUp !== false && props.links?.signUp && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Note, { f, footer: true, children: [
       f.t.noAccount,
       " ",
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signUp, children: f.t.createAccount })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.signUp, children: f.t.createAccount })
     ] })
   ] });
 }
@@ -1533,44 +1717,43 @@ function SignUp(props) {
     f.done();
   };
   const general = f.error && !f.error.field ? f.error : null;
+  const passwordOn = methods?.passwordSignIn !== false;
+  const providers = auth.session?.user.isAnonymous === true || methods?.organization?.required ? [] : methods?.providers ?? [];
   if (sent) {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.checkEmail }),
-      props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.checkEmail }),
+      props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn })
+    ] });
+  }
+  const footer = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Note, { f, footer: true, children: [
+    f.t.haveAccount,
+    " ",
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.signIn, children: f.t.signIn })
+  ] });
+  if (!passwordOn) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
+      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProviderButtons, { f, providers, onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+      footer
     ] });
   }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProviderButtons, { f, providers, onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+    providers.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Or, { f, children: f.t.orWithEmail }),
     methods?.organization?.ask && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "organization", type: "text", label: f.t.company, value: organization, autoComplete: "organization", required: methods.organization.required, onChange: setOrganization }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "name", onChange: setName }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.password, value: password, autoComplete: "new-password", required: true, onChange: setPassword, hint: f.passwordRule }),
-    legal && legal.documents.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("check"), children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", name: "acceptLegal", checked: acceptLegal, required: true, onChange: (e) => setAcceptLegal(e.target.checked) }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
-        f.t.iAccept,
-        " ",
-        legal.documents.map((d, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
-          i > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-            f.t.and,
-            " "
-          ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: d.url, target: "_blank", rel: "noopener", children: d.kind === "terms" ? f.t.termsOfService : f.t.privacyPolicy }),
-          " "
-        ] }, d.kind))
-      ] })
+    legal && legal.documents.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Check, { f, name: "acceptLegal", checked: acceptLegal, required: true, onChange: setAcceptLegal, children: [
+      f.t.iAccept,
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Documents, { f, documents: legal.documents })
     ] }),
-    legal?.consentPurposes.map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("check"), children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", name: `consent_${p.key}`, checked: consents[p.key] === true, required: p.required, onChange: (e) => setConsents({ ...consents, [p.key]: e.target.checked }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: p.label })
-    ] }, p.key)),
+    legal?.consentPurposes.map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Check, { f, name: `consent_${p.key}`, checked: consents[p.key] === true, required: p.required, onChange: (on) => setConsents({ ...consents, [p.key]: on }), children: p.label }, p.key)),
     challenge.node,
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signUp }),
-    props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { className: f.cx("footer"), children: [
-      f.t.haveAccount,
-      " ",
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.signIn })
-    ] })
+    footer
   ] });
 }
 function ForgotPassword(props) {
@@ -1592,16 +1775,16 @@ function ForgotPassword(props) {
   const general = f.error && !f.error.field ? f.error : null;
   if (sent) {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.linkSent }),
-      props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.linkSent }),
+      props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn })
     ] });
   }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
     challenge.node,
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.sendLink }),
-    props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("footer"), children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn }) })
+    props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, footer: true, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn }) })
   ] });
 }
 function ResetPassword(props) {
@@ -1625,21 +1808,21 @@ function ResetPassword(props) {
     setChanged(true);
   };
   const general = f.error && !f.error.field ? f.error : null;
-  const back = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn });
+  const back = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn });
   if (changed) {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.passwordChanged }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.passwordChanged }),
       back
     ] });
   }
   if (token === "") {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
-      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-      props.links?.forgotPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.forgotPassword, children: f.t.forgotPassword })
+      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      props.links?.forgotPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.forgotPassword, children: f.t.forgotPassword })
     ] });
   }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.newPassword, value: password, autoComplete: "new-password", required: true, onChange: setPassword, hint: f.passwordRule }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy || token === null, className: f.cx("button"), children: f.t.savePassword })
   ] });
@@ -1661,12 +1844,98 @@ function VerifyEmail(props) {
     });
   });
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, "aria-busy": state === "confirming", children: [
-    state === "confirming" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.confirming }),
-    state === "confirmed" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.emailConfirmed }),
-    state === "failed" && f.error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(f.error) }),
-    state !== "confirming" && props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn })
+    state === "confirming" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.confirming }),
+    state === "confirmed" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.emailConfirmed }),
+    state === "failed" && f.error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(f.error) }),
+    state !== "confirming" && props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn })
   ] });
 }
+function AcceptInvite(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [token, setToken] = (0, import_react.useState)("");
+  const [invitation, setInvitation] = (0, import_react.useState)(null);
+  const [state, setState] = (0, import_react.useState)("opening");
+  const [password, setPassword] = (0, import_react.useState)("");
+  usePasswordPolicy(f, useMethods(auth));
+  useMailedToken("token", (t) => {
+    if (!t) return setState("invalid");
+    setToken(t);
+    void auth.invitation(t).then((r) => {
+      if (r.ok) {
+        setInvitation(r.invitation);
+        return setState("ready");
+      }
+      if (r.error.code !== "invalid_token") f.setError(r.error);
+      setState("invalid");
+    });
+  });
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.acceptInvitation(token, password);
+    f.setBusy(false);
+    if (!r.ok) {
+      if (r.error.code === "invalid_token") return setState("invalid");
+      return f.setError(r.error);
+    }
+    props.onSaved?.({ kind: "invitation.accepted", email: invitation?.email ?? "", ...invitation?.organization ? { organization: invitation.organization } : {} });
+    if (r.status === "mfa_required") return setState("code");
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const back = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn });
+  if (state === "opening") {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("form"), ...f.root, "aria-busy": "true", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.openingInvitation }) });
+  }
+  if (state === "invalid") {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: general ? f.say(general) : f.t.invitationInvalid }),
+      back
+    ] });
+  }
+  if (state === "code") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SecondStepForm, { f, auth });
+  const workspace = invitation?.workspace ?? "";
+  const heading = invitation?.organization ? f.t.invitedToOrganization.replace("{organization}", invitation.organization).replace("{workspace}", workspace) : f.t.invitedTo.replace("{workspace}", workspace);
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: heading }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.invitedAs.replace("{email}", invitation?.email ?? "") }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "email", name: "username", autoComplete: "username", value: invitation?.email ?? "", readOnly: true, hidden: true }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.choosePassword, value: password, autoComplete: "new-password", required: true, onChange: setPassword, hint: f.passwordRule }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.acceptInvite })
+  ] });
+}
+function PendingTerms(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [owed, setOwed] = (0, import_react.useState)(null);
+  (0, import_react.useEffect)(() => {
+    void auth.account.legal().then((r) => setOwed(r.ok ? r.pending : []));
+  }, []);
+  if (!owed || owed.length === 0) return null;
+  const accept = async () => {
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.account.acceptLegal({ kinds: owed.map((d) => d.kind) });
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    setOwed([]);
+    props.onSuccess?.();
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.termsChanged }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Note, { f, children: [
+      f.t.termsChangedHelp,
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Documents, { f, documents: owed })
+    ] }),
+    f.error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(f.error) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("button"), onClick: () => void accept(), children: f.t.acceptTerms })
+  ] });
+}
+var ACCOUNT_SECTIONS = ["profile", "email", "password", "linked", "secondStep", "phone", "passkeys", "agents", "sessions"];
 function useSection(props) {
   const f = useForm({ ...props, unstyled: true });
   const [done, setDone] = (0, import_react.useState)(null);
@@ -1685,37 +1954,65 @@ function useSection(props) {
 function Account(props) {
   const auth = useAuth();
   const { accountUrl } = useSession();
-  const { t, root } = useForm(props);
+  const { root } = useForm(props);
   const cx = (slot) => props.classNames?.[slot] ?? `cauthy-${slot}`;
   const [account, setAccount] = (0, import_react.useState)(null);
-  const [sessions, setSessions] = (0, import_react.useState)([]);
   (0, import_react.useEffect)(() => {
     void auth.account.get().then(setAccount);
-    void auth.account.sessions().then(setSessions);
   }, []);
   if (account === null) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: cx("account"), ...root, "aria-busy": "true" });
   const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleString());
-  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: cx("account"), ...root, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProfilePart, { props, account, onSaved: setAccount }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(EmailPart, { props, account }),
-    account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(PasswordPart, { props }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LinkedPart, { props }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SecondStepPart, { props, account, onChanged: (mfaEnabled) => setAccount({ ...account, mfaEnabled }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(PhonePart, { props, account, onChanged: (mfaEnabled) => setAccount({ ...account, mfaEnabled }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(PasskeysPart, { props, account, accountUrl: accountUrl(), when }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AgentsPart, { props, when }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: cx("section"), children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: cx("heading"), children: t.sessions }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: cx("sessions"), children: sessions.map((s, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: cx("session"), children: [
-        s.device || t.unknownDevice,
-        " \xB7 ",
-        s.ip,
-        " \xB7 ",
-        when(s.createdAt)
-      ] }, i)) }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SignOutEverywhere, { props })
-    ] })
-  ] });
+  const mfa = (mfaEnabled) => setAccount({ ...account, mfaEnabled });
+  const part = (section) => {
+    switch (section) {
+      case "profile":
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProfilePart, { props, account, onSaved: setAccount });
+      case "email":
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(EmailPart, { props, account });
+      case "password":
+        return account.hasPassword ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(PasswordPart, { props }) : null;
+      case "linked":
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LinkedPart, { props });
+      case "secondStep":
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SecondStepPart, { props, account, onChanged: mfa });
+      case "phone":
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(PhonePart, { props, account, onChanged: mfa });
+      case "passkeys":
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(PasskeysPart, { props, account, accountUrl: accountUrl(), when });
+      case "agents":
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AgentsPart, { props, when });
+      case "sessions":
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SessionsPart, { props, when });
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: cx("account"), ...root, children: (props.sections ?? ACCOUNT_SECTIONS).map((section) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react.Fragment, { children: part(section) }, section)) });
+}
+function AccountProfile(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["profile"] });
+}
+function AccountEmail(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["email"] });
+}
+function AccountPassword(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["password"] });
+}
+function AccountLinked(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["linked"] });
+}
+function AccountSecondStep(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["secondStep"] });
+}
+function AccountPhone(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["phone"] });
+}
+function AccountPasskeys(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["passkeys"] });
+}
+function AccountAgents(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["agents"] });
+}
+function AccountSessions(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Account, { ...props, sections: ["sessions"] });
 }
 var OWNER = "owner";
 function memberActions(seat, m) {
@@ -1727,8 +2024,9 @@ function memberActions(seat, m) {
     inviteAgain: seat.can.manageMembers && m.invited
   };
 }
-function rolesToGive(seat, roles) {
-  return seat.role === OWNER ? roles : roles.filter((c) => c.role !== OWNER);
+function rolesToGive(seat, roles, only) {
+  const mine = seat.role === OWNER ? roles : roles.filter((c) => c.role !== OWNER);
+  return only ? mine.filter((c) => only(c.role, c)) : mine;
 }
 function OrganizationMembers(props) {
   const auth = useAuth();
@@ -1745,6 +2043,8 @@ function OrganizationMembers(props) {
   const [gone, setGone] = (0, import_react.useState)(null);
   const id = props.organizationId;
   const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleDateString());
+  const hidden = (action) => props.hide?.includes(action) === true;
+  const saved = (event) => props.onSaved?.(event);
   const load = async () => {
     const [list, people, choices] = await Promise.all([auth.organizations.list(), auth.organizations.members(id), auth.organizations.roles(id)]);
     const mine = list.find((o) => o.id === id) ?? null;
@@ -1752,17 +2052,17 @@ function OrganizationMembers(props) {
     if (mine) setName(mine.name);
     setMembers(people);
     setRoles(choices ?? []);
-    const offered = mine ? rolesToGive(mine, choices ?? []) : [];
+    const offered = mine ? rolesToGive(mine, choices ?? [], props.roles) : [];
     if (offered.length > 0 && !offered.some((c) => c.role === role)) setRole(offered[0].role);
   };
   (0, import_react.useEffect)(() => {
     void load();
   }, [id]);
-  if (gone !== null) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: gone }) });
+  if (gone !== null) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "success", children: gone }) });
   if (seat === void 0) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, "aria-busy": "true" });
-  if (seat === null) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.organizationMissing }) });
+  if (seat === null) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.organizationMissing }) });
   const manage = seat.can.manageMembers;
-  const giveable = rolesToGive(seat, roles);
+  const giveable = rolesToGive(seat, roles, props.roles);
   const label = (r) => roles.find((c) => c.role === r)?.name || r;
   const add = async (e) => {
     e.preventDefault();
@@ -1770,22 +2070,28 @@ function OrganizationMembers(props) {
     if (!r.ok) return;
     setEmail("");
     setDone(f.t.memberAdded.replace("{email}", r.member.email));
+    saved({ kind: "member.added", organizationId: id, userId: r.member.userId, email: r.member.email, role: r.member.role || role });
     await load();
   };
   const change = async (m, next) => {
     const r = await run(() => auth.organizations.setRole(id, m.userId, next));
-    if (r.ok) await load();
+    if (!r.ok) return;
+    saved({ kind: "member.role_changed", organizationId: id, userId: m.userId, role: next, previousRole: m.role });
+    await load();
   };
   const remove = async (m) => {
     setAsking(null);
     const r = await run(() => auth.organizations.remove(id, m.userId));
     if (!r.ok) return;
+    saved({ kind: m.you ? "member.left" : "member.removed", organizationId: id, userId: m.userId });
     if (m.you) setSeat(null);
     else await load();
   };
   const inviteAgain = async (m) => {
     const r = await run(() => auth.organizations.inviteAgain(id, m.userId, { locale: props.locale }));
-    if (r.ok) setDone(f.t.memberInvitationSent);
+    if (!r.ok) return;
+    setDone(f.t.memberInvitationSent);
+    saved({ kind: "member.invited_again", organizationId: id, userId: m.userId });
   };
   const rename = async (e) => {
     e.preventDefault();
@@ -1794,11 +2100,21 @@ function OrganizationMembers(props) {
     setSeat(r.organization);
     setName(r.organization.name);
     setDone(f.t.organizationRenamed.replace("{name}", r.organization.name));
+    saved({ kind: "organization.renamed", organizationId: id, name: r.organization.name });
   };
   const close = async (how) => {
     setAsking(null);
     const r = await run(() => how === "archive" ? auth.organizations.archive(id) : auth.organizations.delete(id));
-    if (r.ok) setGone((how === "archive" ? f.t.organizationArchived : f.t.organizationDeleted).replace("{org}", seat.name));
+    if (!r.ok) return;
+    setGone((how === "archive" ? f.t.organizationArchived : f.t.organizationDeleted).replace("{org}", seat.name));
+    saved({ kind: how === "archive" ? "organization.archived" : "organization.deleted", organizationId: id });
+  };
+  const ask = (key, title, question, yes) => {
+    const { Confirm } = f.C;
+    if (!Confirm) return setAsking(key);
+    void Confirm({ title, body: question, confirmLabel: title, cancelLabel: f.t.cancel, danger: true }).then((ok) => {
+      if (ok) yes();
+    });
   };
   const confirming = (text2, label2, yes) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { role: "group", "aria-label": label2, children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: text2 }),
@@ -1806,81 +2122,96 @@ function OrganizationMembers(props) {
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: yes, children: f.t.yes }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
   ] });
+  const leaveQuestion = f.t.memberLeaveConfirm.replace("{org}", seat.name);
+  const archiveQuestion = f.t.organizationArchiveConfirm.replace("{org}", seat.name);
+  const deleteQuestion = f.t.organizationDeleteConfirm.replace("{org}", seat.name);
+  const archiving = seat.can.archive && !hidden("archive");
+  const deleting = seat.can.delete && !hidden("delete");
+  const renaming = seat.can.update && !hidden("rename");
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("account"), ...root, children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("h2", { className: f.cx("heading"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Heading, { f, children: [
         f.t.members,
         " \xB7 ",
         seat.name
       ] }),
-      problem && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(problem) }),
+      problem && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(problem) }),
       members === null ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.membersHidden }),
-        auth.session && (asking === auth.session.user.id ? confirming(
-          f.t.memberLeaveConfirm.replace("{org}", seat.name),
-          f.t.memberLeave,
-          () => void remove({ userId: auth.session.user.id, you: true })
-        ) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(auth.session.user.id), children: f.t.memberLeave }))
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.membersHidden }),
+        auth.session && !hidden("leave") && (asking === auth.session.user.id ? confirming(leaveQuestion, f.t.memberLeave, () => void remove({ userId: auth.session.user.id, you: true })) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          f.Button,
+          {
+            type: "button",
+            disabled: f.busy,
+            className: f.cx("providerButton"),
+            onClick: () => ask(auth.session.user.id, f.t.memberLeave, leaveQuestion, () => void remove({ userId: auth.session.user.id, you: true })),
+            children: f.t.memberLeave
+          }
+        ))
       ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: members.map((m) => {
         const who = m.name || m.email;
         const may = memberActions(seat, m);
+        const removable = may.remove && !(m.you && hidden("leave"));
+        const question = m.you ? leaveQuestion : f.t.memberRemoveConfirm.replace("{who}", who);
+        const action = m.you ? f.t.memberLeave : f.t.memberRemove;
+        const choices = giveable.some((c) => c.role === m.role) ? giveable : [...roles.filter((c) => c.role === m.role), ...giveable];
         return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
           /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
             who,
             m.name ? ` \xB7 ${m.email}` : "",
-            m.you ? ` (${f.t.memberYou})` : "",
-            m.invited ? ` \xB7 ${f.t.memberInvited}` : "",
-            m.manager ? ` \xB7 ${f.t.memberManager}` : "",
+            m.you && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Tag, { f, plain: ` (${f.t.memberYou})`, children: f.t.memberYou }),
+            f.C.Badge ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+              m.invited && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Tag, { f, tone: "warning", plain: "", children: f.t.memberInvited }),
+              m.manager && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Tag, { f, tone: "success", plain: "", children: f.t.memberManager })
+            ] }) : `${m.invited ? ` \xB7 ${f.t.memberInvited}` : ""}${m.manager ? ` \xB7 ${f.t.memberManager}` : ""}`,
             " \xB7 ",
             when(m.since)
           ] }),
           " ",
           may.changeRole && giveable.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-            "select",
+            Pick,
             {
-              "aria-label": `${f.t.memberRole}: ${who}`,
-              className: f.cx("input"),
+              f,
+              name: `role_${m.userId}`,
+              label: `${f.t.memberRole}: ${who}`,
               value: m.role,
               disabled: f.busy,
-              onChange: (e) => void change(m, e.target.value),
-              children: (giveable.some((c) => c.role === m.role) ? giveable : [...roles.filter((c) => c.role === m.role), ...giveable]).map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: c.role, children: c.name || c.role }, c.role))
+              options: choices.map((c) => ({ value: c.role, label: c.name || c.role })),
+              onChange: (next) => void change(m, next)
             }
-          ) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: label(m.role) }),
+          ) : f.C.Badge ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.C.Badge, { tone: "neutral", children: label(m.role) }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: label(m.role) }),
           " ",
-          asking === m.userId ? confirming(
-            m.you ? f.t.memberLeaveConfirm.replace("{org}", seat.name) : f.t.memberRemoveConfirm.replace("{who}", who),
-            m.you ? f.t.memberLeave : f.t.memberRemove,
-            () => void remove(m)
-          ) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+          asking === m.userId ? confirming(question, action, () => void remove(m)) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
             may.inviteAgain && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
-            may.remove && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(m.userId), children: m.you ? f.t.memberLeave : f.t.memberRemove })
+            removable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => ask(m.userId, action, question, () => void remove(m)), children: action })
           ] })
         ] }, m.userId);
       }) }),
-      done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
+      done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "success", children: done })
     ] }),
     manage && giveable.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.memberAdd }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.memberAdd }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "off", required: true, onChange: setEmail }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("field"), children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: f.cx("label"), children: f.t.memberRole }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("select", { name: "role", className: f.cx("input"), value: role, onChange: (e) => setRole(e.target.value), children: giveable.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: c.role, children: c.name || c.role }, c.role)) })
-      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AddRole, { f, value: role, options: giveable.map((c) => ({ value: c.role, label: c.name || c.role })), onChange: setRole }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.memberAdd })
     ] }),
-    (seat.can.update || seat.can.archive || seat.can.delete) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.organization }),
-      seat.can.update && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { onSubmit: rename, noValidate: true, children: [
+    (renaming || archiving || deleting) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.organization }),
+      renaming && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { onSubmit: rename, noValidate: true, children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "organization", required: true, onChange: setName }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.organizationRename })
       ] }),
-      asking === "archive" ? confirming(f.t.organizationArchiveConfirm.replace("{org}", seat.name), f.t.organizationArchive, () => void close("archive")) : asking === "delete" ? confirming(f.t.organizationDeleteConfirm.replace("{org}", seat.name), f.t.organizationDelete, () => void close("delete")) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-        seat.can.archive && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking("archive"), children: f.t.organizationArchive }),
-        seat.can.delete && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking("delete"), children: f.t.organizationDelete })
+      asking === "archive" ? confirming(archiveQuestion, f.t.organizationArchive, () => void close("archive")) : asking === "delete" ? confirming(deleteQuestion, f.t.organizationDelete, () => void close("delete")) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+        archiving && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => ask("archive", f.t.organizationArchive, archiveQuestion, () => void close("archive")), children: f.t.organizationArchive }),
+        deleting && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => ask("delete", f.t.organizationDelete, deleteQuestion, () => void close("delete")), children: f.t.organizationDelete })
       ] })
     ] })
   ] });
 }
+function AddRole({ f, value, options, onChange }) {
+  const id = (0, import_react.useId)();
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Labelled, { f, id, label: f.t.memberRole, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Pick, { f, id, name: "role", value, options, onChange }) });
+}
 function PasskeysPart({ props, account, accountUrl, when }) {
   const auth = useAuth();
   const { f, done, setDone, run, general } = useSection(props);
@@ -1898,8 +2229,8 @@ function PasskeysPart({ props, account, accountUrl, when }) {
   if (here === null) return null;
   if (!here) {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.passkeys }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: accountUrl, children: f.t.managePasskeys })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.passkeys }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: accountUrl, children: f.t.managePasskeys })
     ] });
   }
   const add = async (e, kind = "device") => {
@@ -1913,18 +2244,21 @@ function PasskeysPart({ props, account, accountUrl, when }) {
     setName("");
     setPassword("");
     setDone(f.t.passkeyAdded);
+    props.onSaved?.({ kind: "passkey.added", id: r.passkey.id });
   };
   const remove = async (id) => {
     const r = await run(() => auth.account.removePasskey(id));
-    if (r.ok) setList(list.filter((p) => p.id !== id));
+    if (!r.ok) return;
+    setList(list.filter((p) => p.id !== id));
+    props.onSaved?.({ kind: "passkey.removed", id });
   };
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.passkeys }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.passkeysHelp }),
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-    list.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.noPasskeys }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: list.map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.passkeys }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.passkeysHelp }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    list.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.noPasskeys }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: list.map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
       p.name || f.t.passkeyUnnamed,
-      p.kind !== "unknown" ? ` \xB7 ${f.t.passkeyKinds[p.kind]}` : "",
+      p.kind !== "unknown" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Tag, { f, plain: ` \xB7 ${f.t.passkeyKinds[p.kind]}`, children: f.t.passkeyKinds[p.kind] }),
       " \xB7 ",
       when(p.createdAt),
       " ",
@@ -1934,7 +2268,7 @@ function PasskeysPart({ props, account, accountUrl, when }) {
     account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.addPasskeyDevice }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void add(null, "security_key"), children: f.t.addSecurityKey }),
-    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
+    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "success", children: done })
   ] });
 }
 function ProfilePart({ props, account, onSaved }) {
@@ -1947,14 +2281,15 @@ function ProfilePart({ props, account, onSaved }) {
     if (!r.ok) return;
     onSaved(r.account);
     setDone(f.t.saved);
+    props.onSaved?.({ kind: "profile.saved", name: r.account.name });
   };
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: submit, noValidate: true, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.profile }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: account.email }),
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.profile }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: account.email }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "name", onChange: setName }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.save }),
-    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
+    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "success", children: done })
   ] });
 }
 function EmailPart({ props, account }) {
@@ -1968,15 +2303,16 @@ function EmailPart({ props, account }) {
     if (!r.ok) return;
     setPassword("");
     setDone(f.t.emailSent.replace("{email}", r.email));
+    props.onSaved?.({ kind: "email.change_requested", email: r.email });
   };
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: submit, noValidate: true, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.emailAddress }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: account.email }),
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.emailAddress }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: account.email }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.newEmail, value: email, autoComplete: "email", required: true, onChange: setEmail }),
     account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.changeEmail }),
-    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
+    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "success", children: done })
   ] });
 }
 function LinkedPart({ props }) {
@@ -1989,21 +2325,26 @@ function LinkedPart({ props }) {
     void auth.account.identities().then(setLinked);
     void auth.methods().then((m) => setOffered(m.providers));
     const back = typeof window === "undefined" ? null : new URLSearchParams(window.location.search);
-    if (back?.get("linked")) setCame(back.get("linked"));
-    else if (back?.get("auth_error")) f.setError({ code: back.get("auth_error"), message: "That account could not be linked. Try again." });
+    const provider = back?.get("linked");
+    if (provider) {
+      setCame(provider);
+      props.onSaved?.({ kind: "identity.linked", provider });
+    } else if (back?.get("auth_error")) f.setError({ code: back.get("auth_error"), message: "That account could not be linked. Try again." });
   }, []);
   if (linked === null) return null;
   const name = (id) => offered.find((p) => p.id === id)?.name ?? id;
   const unlink = async (provider) => {
     const r = await run(() => auth.account.unlink(provider));
-    if (r.ok) setLinked(linked.filter((x) => x.provider !== provider));
+    if (!r.ok) return;
+    setLinked(linked.filter((x) => x.provider !== provider));
+    props.onSaved?.({ kind: "identity.unlinked", provider });
   };
   const here = typeof window === "undefined" ? void 0 : window.location.pathname;
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.linkedAccounts }),
-    came && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: f.t.linked }),
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-    linked.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.noLinkedAccounts }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: linked.map((x) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.linkedAccounts }),
+    came && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "success", children: f.t.linked }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    linked.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.noLinkedAccounts }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: linked.map((x) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
       name(x.provider),
       x.email ? ` \xB7 ${x.email}` : "",
       " ",
@@ -2029,14 +2370,15 @@ function PasswordPart({ props }) {
     setPassword("");
     setNewPassword("");
     setDone(f.t.passwordChangedHere);
+    props.onSaved?.({ kind: "password.changed" });
   };
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: submit, noValidate: true, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.changePassword }),
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.changePassword }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "newPassword", type: "password", label: f.t.newPassword, value: newPassword, autoComplete: "new-password", required: true, onChange: setNewPassword, hint: f.passwordRule }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.changePassword }),
-    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
+    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "success", children: done })
   ] });
 }
 function SecondStepPart({ props, account, onChanged }) {
@@ -2060,6 +2402,7 @@ function SecondStepPart({ props, account, onChanged }) {
     setPassword("");
     setCodes(r.recoveryCodes);
     onChanged(true);
+    props.onSaved?.({ kind: "mfa.enabled" });
   };
   const turnOff = async (e) => {
     e.preventDefault();
@@ -2068,32 +2411,35 @@ function SecondStepPart({ props, account, onChanged }) {
     setPassword("");
     setCodes(null);
     onChanged(false);
+    props.onSaved?.({ kind: "mfa.disabled" });
   };
   const renew = async () => {
     const r = await run(() => auth.account.mfa.recoveryCodes({ password }));
-    if (r.ok) setCodes(r.recoveryCodes);
+    if (!r.ok) return;
+    setCodes(r.recoveryCodes);
+    props.onSaved?.({ kind: "recovery_codes.regenerated" });
   };
   const passwordField = account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword });
   const shown = codes && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.keepCodes }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.keepCodes }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("codes"), children: codes.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: c }) }, c)) })
   ] });
   if (setup) {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: confirm, noValidate: true, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.secondStep }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.addToApp }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.secondStep }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.addToApp }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { className: f.cx("secret"), children: setup.secret }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: setup.otpauthUri, children: f.t.openInApp }),
-      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(A, { f, href: setup.otpauthUri, children: f.t.openInApp }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
     ] });
   }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: account.mfaEnabled ? turnOff : start, noValidate: true, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.secondStep }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: account.mfaEnabled ? f.t.secondStepOn : f.t.secondStepOff }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.secondStep }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: account.mfaEnabled ? f.t.secondStepOn : f.t.secondStepOff }),
     shown,
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     passwordField,
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: account.mfaEnabled ? f.t.turnOff : f.t.turnOn }),
     account.mfaEnabled && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void renew(), children: f.t.newRecoveryCodes })
@@ -2131,6 +2477,7 @@ function PhonePart({ props, account, onChanged }) {
     setPassword("");
     if (r.recoveryCodes.length > 0) setCodes(r.recoveryCodes);
     onChanged(true);
+    props.onSaved?.({ kind: "phone.added", channel });
     await load();
   };
   const remove = async (e) => {
@@ -2141,27 +2488,29 @@ function PhonePart({ props, account, onChanged }) {
     await load();
     const left = await auth.account.mfa.factors();
     onChanged(Boolean(left?.totp));
+    props.onSaved?.({ kind: "phone.removed" });
   };
   const passwordField = account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword });
   if (sentTo) {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: confirm, noValidate: true, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.phone }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.codeSent.replace("{to}", sentTo) }),
-      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.phone }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.codeSent.replace("{to}", sentTo) }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
     ] });
   }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: ways.phone ? remove : add, noValidate: true, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.phone }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: ways.phone ? f.t.phoneOn.replace("{to}", ways.phone.number) : `${f.t.phoneOff} ${f.t.phoneHelp}` }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.phone }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: ways.phone ? f.t.phoneOn.replace("{to}", ways.phone.number) : `${f.t.phoneOff} ${f.t.phoneHelp}` }),
     codes && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.keepCodes }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.keepCodes }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("codes"), children: codes.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: c }) }, c)) })
     ] }),
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     !ways.phone && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "phone", type: "tel", label: f.t.phone, value: number, autoComplete: "tel", required: true, onChange: setNumber }),
-    !ways.phone && ways.phoneChannels.length > 1 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("field"), role: "radiogroup", children: ways.phoneChannels.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("label"), children: [
+    !ways.phone && ways.phoneChannels.length > 1 && f.C.Select && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ChannelPick, { f, value: channel, channels: ways.phoneChannels, onChange: setChannel }),
+    !ways.phone && ways.phoneChannels.length > 1 && !f.C.Select && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("field"), role: "radiogroup", children: ways.phoneChannels.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("label"), children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "radio", name: "channel", value: c, checked: channel === c, onChange: () => setChannel(c) }),
       " ",
       c === "whatsapp" ? f.t.byWhatsapp : f.t.bySms
@@ -2180,12 +2529,14 @@ function AgentsPart({ props, when }) {
   if (list.length === 0) return null;
   const disconnect = async (id) => {
     const r = await run(() => auth.account.disconnectAgent(id));
-    if (r.ok) setList(list.filter((a) => a.id !== id));
+    if (!r.ok) return;
+    setList(list.filter((a) => a.id !== id));
+    props.onSaved?.({ kind: "agent.disconnected", id });
   };
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.agents }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.agentsHelp }),
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.agents }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Note, { f, children: f.t.agentsHelp }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: list.map((a) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
       a.name || f.t.anAgent,
       a.redirectHost ? ` (${a.redirectHost})` : "",
@@ -2199,20 +2550,47 @@ function AgentsPart({ props, when }) {
     ] }, a.id)) })
   ] });
 }
-function SignOutEverywhere({ props }) {
+function SessionsPart({ props, when }) {
   const auth = useAuth();
   const { f, run, general } = useSection(props);
+  const [sessions, setSessions] = (0, import_react.useState)([]);
+  (0, import_react.useEffect)(() => {
+    void auth.account.sessions().then(setSessions);
+  }, []);
   const end = async () => {
     const r = await run(() => auth.account.signOutEverywhere());
     if (!r.ok) return;
+    props.onSaved?.({ kind: "sessions.ended" });
     if (props.onSignedOut) props.onSignedOut();
     else window.location.assign("/");
   };
-  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Heading, { f, children: f.t.sessions }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: sessions.map((s, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
+      s.device || f.t.unknownDevice,
+      " \xB7 ",
+      s.ip,
+      " \xB7 ",
+      when(s.createdAt)
+    ] }, i)) }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("button"), onClick: () => void end(), children: f.t.signOutEverywhere })
   ] });
 }
+function ChannelPick({ f, value, channels, onChange }) {
+  const id = (0, import_react.useId)();
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Labelled, { f, id, label: f.t.channel, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+    Pick,
+    {
+      f,
+      id,
+      name: "channel",
+      value,
+      options: channels.map((c) => ({ value: c, label: c === "whatsapp" ? f.t.byWhatsapp : f.t.bySms })),
+      onChange: (c) => onChange(c)
+    }
+  ) });
+}
 
 // src/react.tsx
 var import_jsx_runtime2 = require("react/jsx-runtime");
@@ -2314,6 +2692,8 @@ function useAuth() {
         googleOneTap: (o) => then(client.signIn.googleOneTap(o))
       },
       signUp: { email: (f) => then(client.signUp.email(f)) },
+      // The invited person is signed in once they accept.
+      acceptInvitation: (token, password) => then(client.acceptInvitation(token, password)),
       signOut: () => then(client.signOut()),
       account: {
         ...client.account,
@@ -2332,11 +2712,22 @@ function useAuth() {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AcceptInvite,
   Account,
+  AccountAgents,
+  AccountEmail,
+  AccountLinked,
+  AccountPasskeys,
+  AccountPassword,
+  AccountPhone,
+  AccountProfile,
+  AccountSecondStep,
+  AccountSessions,
   CauthyProvider,
   ForgotPassword,
   GoogleOneTap,
   OrganizationMembers,
+  PendingTerms,
   ResetPassword,
   SignIn,
   SignUp,