spine-framework 0.3.145 → 0.4.0

package/.framework/src/pages/admin/kb/KBAdminPage.tsx

@@ -1,14 +1,71 @@
+// CIL[BEGIN stable_id="~/.framework/src/pages/admin/kb/KBAdminPage.tsx:module_header:module_header" type="module_header" identity="module_header" parent="~/.framework/src/pages/admin/kb/KBAdminPage.tsx"]
+// CIL[DOC-MACRO purpose="Renders the admin knowledge base page with article list and editor."]
+// CIL[DOC-RESPONSIBILITY responsibility="Provide the top-level React component for managing KB articles and categories."]
+// CIL[DOC-CONTEXT module="admin/kb" layer="page" related_files=".framework/src/components/admin/PageInstructions.tsx,.framework/src/components/kb/KBArticleEditor.tsx,.framework/src/components/kb/KBArticleList.tsx"]
+// CIL[DOC-CONTRACT inputs="URL parameters (typeSlug, id) and mode prop" outputs="JSX for list or editor view" errors="None" side_effects="Programmatic navigation via react-router"]
+// CIL[DOC-MICRO logic_summary="Imports subcomponents and conditionally renders the list or editor based on mode and id." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-AUDIENCE audience="admin-ui"]
+
 import { useParams, useNavigate } from 'react-router-dom'
 import { KBArticleList } from '../../../components/kb/KBArticleList'
 import { KBArticleEditor } from '../../../components/kb/KBArticleEditor'
 import { PageInstructions } from '../../../components/admin/PageInstructions'
+// CIL[DOC-VECTOR type="context" content="purpose='Renders the admin knowledge base page with article list and editor.'; No verified external callers; imports: .framework/src/components/kb/KBArticleList.tsx,.framework/src/components/kb/KBArticleEditor.tsx,.framework/src/components/admin/PageInstructions.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/admin/kb/KBAdminPage.tsx:module_header:module_header"]
+// CIL[BEGIN stable_id="~/.framework/src/pages/admin/kb/KBAdminPage.tsx:kb_type_slugs:constant" type="constant" identity="KB_TYPE_SLUGS" parent="~/.framework/src/pages/admin/kb/KBAdminPage.tsx"]
+// CIL[DOC-MACRO purpose="Defines the allowed knowledge base type slugs."]
+// CIL[DOC-RESPONSIBILITY responsibility="Enumerate valid KB categories used by the admin page and article list."]
+// CIL[DOC-CONTEXT module="admin/kb" layer="data" related_files=".framework/src/components/admin/PageInstructions.tsx,.framework/src/components/kb/KBArticleEditor.tsx,.framework/src/components/kb/KBArticleList.tsx,.framework/src/pages/admin/kb/KBAdminPage.tsx"]
+// CIL[DOC-CONTRACT inputs="None" outputs="Array of type slug strings" errors="None" side_effects="None"]
+// CIL[DOC-MICRO logic_summary="Static string array enumerating valid knowledge base categories." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 
 const KB_TYPE_SLUGS = ['kb-spine-admin', 'kb-spine-internal', 'kb-spine-public', 'kb-account']
+// CIL[DOC-VECTOR type="context" content="purpose='Defines the allowed knowledge base type slugs.'; No verified external callers; imports: .framework/src/components/kb/KBArticleList.tsx,.framework/src/components/kb/KBArticleEditor.tsx,.framework/src/components/admin/PageInstructions.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/admin/kb/KBAdminPage.tsx:kb_type_slugs:constant"]
+
 
+// CIL[BEGIN stable_id="~/.framework/src/pages/admin/kb/KBAdminPage.tsx:KBAdminPageProps:interface" type="interface" identity="KBAdminPageProps" parent="~/.framework/src/pages/admin/kb/KBAdminPage.tsx"]
+// CIL[DOC-MACRO purpose="Defines the props accepted by the KBAdminPage component."]
+// CIL[DOC-RESPONSIBILITY responsibility="Declare the optional mode prop for view/edit/new state."]
+// CIL[DOC-CONTEXT module="admin/kb" layer="interface" related_files=".framework/src/components/admin/PageInstructions.tsx,.framework/src/components/kb/KBArticleEditor.tsx,.framework/src/components/kb/KBArticleList.tsx,.framework/src/pages/admin/kb/KBAdminPage.tsx"]
+// CIL[DOC-CONTRACT inputs="None" outputs="Type definition for KBAdminPageProps" errors="None" side_effects="None"]
+// CIL[DOC-MICRO logic_summary="Optional mode union type supporting view, edit, and new modes." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 interface KBAdminPageProps {
   mode?: 'view' | 'edit' | 'new'
 }
+// CIL[DOC-VECTOR type="context" content="purpose='Defines the props accepted by the KBAdminPage component.'; No verified external callers; imports: .framework/src/components/kb/KBArticleList.tsx,.framework/src/components/kb/KBArticleEditor.tsx,.framework/src/components/admin/PageInstructions.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/admin/kb/KBAdminPage.tsx:KBAdminPageProps:interface"]
+
 
+// CIL[BEGIN stable_id="~/.framework/src/pages/admin/kb/KBAdminPage.tsx:kbadminpage:function" type="function" identity="KBAdminPage" parent="~/.framework/src/pages/admin/kb/KBAdminPage.tsx"]
+// CIL[DOC-MACRO purpose="Displays the knowledge base article list or editor based on route mode and id."]
+// CIL[DOC-RESPONSIBILITY responsibility="Render the admin KB page and route user actions to the appropriate editor/list views."]
+// CIL[DOC-CONTEXT module="admin/kb" layer="page" related_files=".framework/src/components/admin/PageInstructions.tsx,.framework/src/components/kb/KBArticleEditor.tsx,.framework/src/components/kb/KBArticleList.tsx,.framework/src/pages/admin/kb/KBAdminPage.tsx"]
+// CIL[DOC-CONTRACT inputs="mode prop and URL params typeSlug/id" outputs="JSX with KBArticleList or KBArticleEditor" errors="None" side_effects="Navigates using useNavigate"]
+// CIL[DOC-MICRO logic_summary="Determines list mode from the mode prop and absence of id, then renders list or editor with navigation callbacks." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export function KBAdminPage({ mode = 'view' }: KBAdminPageProps) {
   const { typeSlug, id } = useParams<{ typeSlug: string; id: string }>()
   const navigate = useNavigate()
@@ -62,3 +119,10 @@ export function KBAdminPage({ mode = 'view' }: KBAdminPageProps) {
     </>
   )
 }
+// CIL[DOC-VECTOR type="context" content="purpose='Displays the knowledge base article list or editor based on route mode and id.'; No verified external callers; imports: .framework/src/components/kb/KBArticleList.tsx,.framework/src/components/kb/KBArticleEditor.tsx,.framework/src/components/admin/PageInstructions.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/admin/kb/KBAdminPage.tsx:kbadminpage:function"]

package/.framework/src/pages/auth/AuthConfirmPage.tsx

@@ -1,61 +1,64 @@
-// CIL[BEGIN chunk_id="AuthConfirmPage_module_header_1783662155" type="module_header" identity="module_header" parent="none"]
-// CIL[DOC-MACRO purpose="Import React hooks, routing, Supabase, and UI components for auth confirmation"]
-// CIL[DOC-RESPONSIBILITY responsibility="Provide necessary imports for token verification and password reset functionality"]
-// CIL[DOC-CONTEXT module="src/pages/auth/AuthConfirmPage" layer="frontend-page" related_files="[\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"custom/apps/portal/pages/ContentPage.tsx\",\".framework/src/components/ui/dialog.tsx\",\".framework/functions/_shared/principal.ts\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="React hooks, routing, Supabase client, LoadingSpinner" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Standard imports for auth callback page with token handling" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[BEGIN stable_id="~/.framework/src/pages/auth/AuthConfirmPage.tsx:module_header:module_header" type="module_header" identity="module_header" parent="~/.framework/src/pages/auth/AuthConfirmPage.tsx"]
+// CIL[DOC-MACRO purpose="Defines the AuthConfirmPage React component for confirming email signup and password reset tokens."]
+// CIL[DOC-RESPONSIBILITY responsibility="Import dependencies, the Supabase client, and shared UI components."]
+// CIL[DOC-CONTEXT module="AuthConfirmPage" layer="pages/auth" related_files=".framework/src/components/ui/LoadingSpinner.tsx,.framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="N/A" outputs="N/A" errors="N/A" side_effects="N/A"]
+// CIL[DOC-MICRO logic_summary="Top-level module imports for the auth confirmation page." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-AUDIENCE audience="developer"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-page. Direct callers: 0. Direct calls: 0. Related files: custom/apps/cortex/pages/operations/OperationsDashboard.tsx, custom/apps/portal/pages/ContentPage.tsx, .framework/src/components/ui/dialog.tsx, .framework/functions/_shared/principal.ts, .framework/src/pages/admin/TypeDetailPage.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[DOC-AUDIENCE audience="developers maintaining auth flows"]
 import React, { useState, useEffect } from 'react'
 import { Link, useNavigate, useSearchParams } from 'react-router-dom'
 import { supabase } from '../../lib/supabase'
+import { useAuth } from '../../contexts/AuthContext'
 import { LoadingSpinner } from '../../components/ui/LoadingSpinner'
-// CIL[END chunk_id="AuthConfirmPage_module_header_1783662155"]
-// CIL[BEGIN chunk_id="AuthConfirmPage_stage_1783662155" type="type" identity="stage" parent="none"]
-// CIL[DOC-MACRO purpose="Define authentication confirmation page states for token verification flow"]
-// CIL[DOC-RESPONSIBILITY responsibility="Provide type definition for all possible page states during auth confirmation"]
-// CIL[DOC-CONTEXT module="src/pages/auth/AuthConfirmPage" layer="frontend-page" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\"custom/apps/portal/pages/ContentPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/src/pages/admin/IntegrationsPage.tsx\",\".framework/src/pages/admin/RolesPage.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="Stage union type" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Type definition for auth confirmation flow states" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-page. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, custom/apps/portal/pages/ContentPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/src/pages/admin/IntegrationsPage.tsx, .framework/src/pages/admin/RolesPage.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+import {
+  clearPendingRegistration,
+  finalizeRegistration,
+  readPendingRegistration,
+} from '../../lib/registration'
+// CIL[DOC-VECTOR type="context" content="purpose='Defines the AuthConfirmPage React component for confirming email signup and password reset tokens.'; No verified external callers; imports: .framework/src/lib/supabase.ts,.framework/src/components/ui/LoadingSpinner.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/auth/AuthConfirmPage.tsx:module_header:module_header"]
+// CIL[BEGIN stable_id="~/.framework/src/pages/auth/AuthConfirmPage.tsx:stage:type" type="type" identity="Stage" parent="~/.framework/src/pages/auth/AuthConfirmPage.tsx"]
+// CIL[DOC-MACRO purpose="Union type describing the possible stages of the email and password confirmation flow."]
+// CIL[DOC-RESPONSIBILITY responsibility="Define the string literal stage values used by the AuthConfirmPage state machine."]
+// CIL[DOC-CONTEXT module="AuthConfirmPage" layer="pages/auth" related_files=".framework/src/components/ui/LoadingSpinner.tsx,.framework/src/lib/supabase.ts,.framework/src/pages/auth/AuthConfirmPage.tsx"]
+// CIL[DOC-CONTRACT inputs="N/A" outputs="Stage union string literal" errors="N/A" side_effects="N/A"]
+// CIL[DOC-MICRO logic_summary="Literal union type for the component's UI and verification state." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 type Stage =
   | 'verifying'
   | 'signup_success'
   | 'set_password'
   | 'password_saved'
   | 'error'
-// CIL[END chunk_id="AuthConfirmPage_stage_1783662155"]
-// CIL[BEGIN chunk_id="AuthConfirmPage_authconfirmpage_1783662155" type="function" identity="AuthConfirmPage" parent="none"]
-// CIL[DOC-MACRO purpose="Handle email confirmation and password reset flows with token verification"]
-// CIL[DOC-RESPONSIBILITY responsibility="Verify auth tokens, handle signup confirmation, and manage password reset flow"]
-// CIL[DOC-CONTEXT module="src/pages/auth/AuthConfirmPage" layer="frontend-page" related_files="[\"custom/apps/portal/pages/ContentPage.tsx\",\".framework/src/pages/admin/RolesPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/src/components/ui/dialog.tsx\",\".framework/functions/_shared/principal.ts\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="authenticated session or password reset form" errors="token errors, validation errors" side_effects="updates auth state, creates user session"]
-// CIL[DOC-MICRO logic_summary="Token verification with multiple flow handling and error states" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-page. Direct callers: 0. Direct calls: 0. Related files: custom/apps/portal/pages/ContentPage.tsx, .framework/src/pages/admin/RolesPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/src/components/ui/dialog.tsx, .framework/functions/_shared/principal.ts, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+
+// CIL[DOC-VECTOR type="context" content="purpose='Union type describing the possible stages of the email and password confirmation flow.'; No verified external callers; imports: .framework/src/lib/supabase.ts,.framework/src/components/ui/LoadingSpinner.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/auth/AuthConfirmPage.tsx:stage:type"]
+// CIL[BEGIN stable_id="~/.framework/src/pages/auth/AuthConfirmPage.tsx:authconfirmpage:function" type="function" identity="AuthConfirmPage" parent="~/.framework/src/pages/auth/AuthConfirmPage.tsx"]
+// CIL[DOC-MACRO purpose="Render the authentication confirmation page and allow users to set a new password after a recovery flow."]
+// CIL[DOC-RESPONSIBILITY responsibility="Verify the OTP token hash, display success or error UI, and handle the new password form submission."]
+// CIL[DOC-CONTEXT module="AuthConfirmPage" layer="pages/auth" related_files=".framework/src/components/ui/LoadingSpinner.tsx,.framework/src/lib/supabase.ts,.framework/src/pages/auth/AuthConfirmPage.tsx"]
+// CIL[DOC-CONTRACT inputs="token_hash and type URL query parameters" outputs="JSX for the verifying, error, signup success, set password, or password saved states" errors="Invalid or missing confirmation link, expired or invalid OTP, failed password update, mismatched or short passwords" side_effects="Calls supabase.auth.verifyOtp and supabase.auth.updateUser; navigates to / on success after a timeout"]
+// CIL[DOC-MICRO logic_summary="Reads token_hash and type from the query string, verifies the OTP with Supabase, then renders a stage-based UI and processes password form submission with client-side validation." notable_decisions="['hash/implicit session fallback via getSession + PASSWORD_RECOVERY listener','resumes spine.pending_registration intent after signup confirm via finalizeRegistration + refreshUser']"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-NOTE type="change" content="Batch4b: links with no token_hash fall back to supabase.auth.getSession (implicit/hash flow); successful signup confirms resume pending registration intent — non-invite runs authenticated complete-registration, invite just rebinds context"]
 export function AuthConfirmPage() {
   const [searchParams] = useSearchParams()
   const navigate = useNavigate()
+  const { refreshUser } = useAuth()
 
   const tokenHash = searchParams.get('token_hash')
   const type = searchParams.get('type') as 'signup' | 'recovery' | string | null
@@ -69,37 +72,98 @@ export function AuthConfirmPage() {
   const [isSaving, setIsSaving] = useState(false)
 
   useEffect(() => {
-    if (!tokenHash || !type) {
-      setErrorMessage('Invalid or missing confirmation link. Please request a new one.')
-      setStage('error')
-      return
+    let cancelled = false
+
+    // After a confirmed signup, resume the pending registration intent saved
+    // in sessionStorage before the email round-trip (spine.pending_registration).
+    // Invite intents need no server call — the stub was claimed by the
+    // auth.users trigger when signUp ran.
+    const finishSignup = async () => {
+      const intent = readPendingRegistration()
+      try {
+        if (intent && !intent.invite && intent.path) {
+          const result = await finalizeRegistration(intent)
+          clearPendingRegistration()
+          await refreshUser()
+          if (cancelled) return
+          setStage('signup_success')
+          setTimeout(() => navigate(
+            result.status === 'pending' ? '/auth/pending-approval' : '/',
+            { replace: true }
+          ), 1500)
+          return
+        }
+        if (intent) clearPendingRegistration()
+        await refreshUser()
+        if (cancelled) return
+        setStage('signup_success')
+        setTimeout(() => navigate('/', { replace: true }), 1500)
+      } catch {
+        // Keep the intent — /register?resume=1 retries it and surfaces the
+        // error. The signup itself is still confirmed.
+        if (cancelled) return
+        setStage('signup_success')
+        setTimeout(() => navigate('/register?resume=1', { replace: true }), 1500)
+      }
     }
 
-    ;(async () => {
-      const { error } = await supabase.auth.verifyOtp({
-        token_hash: tokenHash,
-        type: type as any,
-      })
+    if (tokenHash && type) {
+      ;(async () => {
+        const { error } = await supabase.auth.verifyOtp({
+          token_hash: tokenHash,
+          type: type as any,
+        })
 
-      if (error) {
-        if (error.message.includes('expired') || error.message.includes('otp_expired')) {
-          setErrorMessage('This link has expired. Links are valid for 1 hour.')
-        } else if (error.message.includes('invalid')) {
-          setErrorMessage('This link is invalid or has already been used.')
+        if (error) {
+          if (error.message.includes('expired') || error.message.includes('otp_expired')) {
+            setErrorMessage('This link has expired. Links are valid for 1 hour.')
+          } else if (error.message.includes('invalid')) {
+            setErrorMessage('This link is invalid or has already been used.')
+          } else {
+            setErrorMessage(error.message)
+          }
+          setStage('error')
+          return
+        }
+
+        if (type === 'recovery') {
+          setStage('set_password')
         } else {
-          setErrorMessage(error.message)
+          void finishSignup()
         }
-        setStage('error')
-        return
-      }
+      })()
+      return () => { cancelled = true }
+    }
 
-      if (type === 'recovery') {
+    // Hash/implicit callback: detectSessionInUrl consumes #access_token before
+    // this page reads params, so a live session means the link verified.
+    const hashType = new URLSearchParams(window.location.hash.replace(/^#/, '')).get('type')
+    if (hashType === 'recovery') {
+      setStage('set_password')
+      return () => { cancelled = true }
+    }
+
+    const { data: { subscription } } = supabase.auth.onAuthStateChange((event) => {
+      if (event === 'PASSWORD_RECOVERY' && !cancelled) {
         setStage('set_password')
-      } else {
-        setStage('signup_success')
-        setTimeout(() => navigate('/', { replace: true }), 1500)
       }
+    })
+
+    ;(async () => {
+      const { data: { session } } = await supabase.auth.getSession()
+      if (cancelled) return
+      if (session) {
+        await finishSignup()
+        return
+      }
+      setErrorMessage('Invalid or missing confirmation link. Please request a new one.')
+      setStage('error')
     })()
+
+    return () => {
+      cancelled = true
+      subscription.unsubscribe()
+    }
   }, [])
 
   const handleSetPassword = async (e: React.FormEvent) => {
@@ -210,8 +274,8 @@ export function AuthConfirmPage() {
     <div className="min-h-screen flex items-center justify-center bg-slate-50 py-12 px-4 sm:px-6 lg:px-8">
       <div className="max-w-md w-full space-y-8">
         <div>
-          <div className="mx-auto h-12 w-12 flex items-center justify-center rounded-full bg-slate-900">
-            <span className="text-white font-bold text-xl">S</span>
+          <div className="mx-auto flex items-center justify-center">
+            <img src="/spine-logo.svg" alt="Spine Framework" className="h-14 w-auto" />
           </div>
           <h2 className="mt-6 text-center text-3xl font-extrabold text-slate-900">
             Set a new password
@@ -286,4 +350,10 @@ export function AuthConfirmPage() {
     </div>
   )
 }
-// CIL[END chunk_id="AuthConfirmPage_authconfirmpage_1783662155"]
+// CIL[DOC-VECTOR type="context" content="purpose='Render the authentication confirmation page and allow users to set a new password after a recovery flow.'; No verified external callers; imports: .framework/src/lib/supabase.ts,.framework/src/components/ui/LoadingSpinner.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/auth/AuthConfirmPage.tsx:authconfirmpage:function"]

package/.framework/src/pages/auth/ForgotPasswordPage.tsx

@@ -1,39 +1,38 @@
-// CIL[BEGIN chunk_id="ForgotPasswordPage_module_header_1783662155" type="module_header" identity="module_header" parent="none"]
-// CIL[DOC-MACRO purpose="Import React hooks, routing, Supabase, and UI components for password reset"]
-// CIL[DOC-RESPONSIBILITY responsibility="Provide necessary imports for password reset functionality"]
-// CIL[DOC-CONTEXT module="src/pages/auth/ForgotPasswordPage" layer="frontend-page" related_files="[\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"custom/apps/portal/pages/ContentPage.tsx\",\".framework/src/components/ui/dialog.tsx\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/principal.ts\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="React hooks, routing, Supabase client, LoadingSpinner" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Standard imports for password reset page with email handling" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[BEGIN stable_id="~/.framework/src/pages/auth/ForgotPasswordPage.tsx:module_header:module_header" type="module_header" identity="module_header" parent="~/.framework/src/pages/auth/ForgotPasswordPage.tsx"]
+// CIL[DOC-MACRO purpose="Provides imports and entry-point metadata for the ForgotPasswordPage component."]
+// CIL[DOC-RESPONSIBILITY responsibility="Declare module dependencies and export the ForgotPasswordPage component."]
+// CIL[DOC-CONTEXT module="auth" layer="presentation" related_files=".framework/src/components/ui/LoadingSpinner.tsx,.framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Imports React, routing, Supabase client, and a loading spinner; contains no runtime logic." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-AUDIENCE audience="developer"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-page. Direct callers: 0. Direct calls: 0. Related files: custom/apps/cortex/pages/operations/OperationsDashboard.tsx, custom/apps/portal/pages/ContentPage.tsx, .framework/src/components/ui/dialog.tsx, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/principal.ts, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[DOC-AUDIENCE audience="developers,ui-maintainers"]
+
 import React, { useState } from 'react'
 import { Link } from 'react-router-dom'
 import { supabase } from '../../lib/supabase'
 import { LoadingSpinner } from '../../components/ui/LoadingSpinner'
-// CIL[END chunk_id="ForgotPasswordPage_module_header_1783662155"]
-// CIL[BEGIN chunk_id="ForgotPasswordPage_forgotpasswordpage_1783662155" type="function" identity="ForgotPasswordPage" parent="none"]
-// CIL[DOC-MACRO purpose="Handle password reset request form with email submission and success states"]
-// CIL[DOC-RESPONSIBILITY responsibility="Manage password reset flow, form submission, and user feedback states"]
-// CIL[DOC-CONTEXT module="src/pages/auth/ForgotPasswordPage" layer="frontend-page" related_files="[\"custom/apps/portal/pages/ContentPage.tsx\",\".framework/src/pages/admin/RolesPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/src/components/ui/dialog.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="password reset email or error message" errors="validation errors, API errors" side_effects="sends password reset email via Supabase"]
-// CIL[DOC-MICRO logic_summary="Form with email validation, async submission, and success confirmation" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-page. Direct callers: 0. Direct calls: 0. Related files: custom/apps/portal/pages/ContentPage.tsx, .framework/src/pages/admin/RolesPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/src/components/ui/dialog.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+import { TurnstileWidget, turnstileEnabled } from '../../components/auth/TurnstileWidget'
+
+// CIL[DOC-VECTOR type="context" content="purpose='Provides imports and entry-point metadata for the ForgotPasswordPage component.'; No verified external callers; imports: .framework/src/lib/supabase.ts,.framework/src/components/ui/LoadingSpinner.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/auth/ForgotPasswordPage.tsx:module_header:module_header"]
+// CIL[BEGIN stable_id="~/.framework/src/pages/auth/ForgotPasswordPage.tsx:ForgotPasswordPage:component" type="component" identity="ForgotPasswordPage" parent="~/.framework/src/pages/auth/ForgotPasswordPage.tsx"]
+// CIL[DOC-MACRO purpose="Render a password-reset request page and submit the email to Supabase."]
+// CIL[DOC-RESPONSIBILITY responsibility="Provide a UI for users to enter their email and trigger a password reset email."]
+// CIL[DOC-CONTEXT module="auth" layer="presentation" related_files=".framework/src/components/ui/LoadingSpinner.tsx,.framework/src/lib/supabase.ts,.framework/src/pages/auth/ForgotPasswordPage.tsx"]
+// CIL[DOC-CONTRACT inputs="email (string from user input)" outputs="Rendered JSX form or success confirmation; local state updates for loading/submitted/error." errors="Supabase resetPasswordForEmail errors surfaced to the UI." side_effects="Calls supabase.auth.resetPasswordForEmail with a redirectTo URL; updates component state."]
+// CIL[DOC-MICRO logic_summary="Manages email, loading, submitted and error state. On submit it prevents default, clears errors, sets loading, calls Supabase reset, and on success shows a confirmation with a back-to-login link." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+
 export function ForgotPasswordPage() {
   const [email, setEmail] = useState('')
+  const [captchaToken, setCaptchaToken] = useState<string | null>(null)
   const [isLoading, setIsLoading] = useState(false)
   const [submitted, setSubmitted] = useState(false)
   const [error, setError] = useState('')
@@ -46,6 +45,7 @@ export function ForgotPasswordPage() {
     try {
       const { error: resetError } = await supabase.auth.resetPasswordForEmail(email, {
         redirectTo: `${window.location.origin}/auth/confirm`,
+        captchaToken: captchaToken ?? undefined,
       })
 
       if (resetError) {
@@ -90,8 +90,8 @@ export function ForgotPasswordPage() {
     <div className="min-h-screen flex items-center justify-center bg-slate-50 py-12 px-4 sm:px-6 lg:px-8">
       <div className="max-w-md w-full space-y-8">
         <div>
-          <div className="mx-auto h-12 w-12 flex items-center justify-center rounded-full bg-slate-900">
-            <span className="text-white font-bold text-xl">S</span>
+          <div className="mx-auto flex items-center justify-center">
+            <img src="/spine-logo.svg" alt="Spine Framework" className="h-14 w-auto" />
           </div>
           <h2 className="mt-6 text-center text-3xl font-extrabold text-slate-900">
             Reset your password
@@ -125,10 +125,12 @@ export function ForgotPasswordPage() {
             />
           </div>
 
+          <TurnstileWidget onToken={setCaptchaToken} />
+
           <div>
             <button
               type="submit"
-              disabled={isLoading}
+              disabled={isLoading || (turnstileEnabled && !captchaToken)}
               className="group relative w-full flex justify-center py-2 px-4 border border-transparent rounded-[5px] shadow-sm text-sm font-medium text-white bg-slate-900 hover:bg-slate-800 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-accent-blue disabled:opacity-50 disabled:cursor-not-allowed"
             >
               {isLoading ? (
@@ -152,4 +154,10 @@ export function ForgotPasswordPage() {
     </div>
   )
 }
-// CIL[END chunk_id="ForgotPasswordPage_forgotpasswordpage_1783662155"]
+// CIL[DOC-VECTOR type="context" content="purpose='Render a password-reset request page and submit the email to Supabase.'; No verified external callers; imports: .framework/src/lib/supabase.ts,.framework/src/components/ui/LoadingSpinner.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/auth/ForgotPasswordPage.tsx:ForgotPasswordPage:component"]

package/.framework/src/pages/auth/LoginPage.tsx

@@ -1,40 +1,38 @@
-// CIL[BEGIN chunk_id="LoginPage_module_header_1783662155" type="module_header" identity="module_header" parent="none"]
-// CIL[DOC-MACRO purpose="Import React hooks and components for login page functionality"]
-// CIL[DOC-RESPONSIBILITY responsibility="Provide necessary imports for React component, routing, auth context, and UI elements"]
-// CIL[DOC-CONTEXT module="src/pages/auth/LoginPage" layer="frontend-page" related_files="[\"custom/apps/portal/pages/ContentPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"custom/apps/portal/pages/CoursesPage.tsx\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/src/pages/admin/RolesPage.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="React, useState, Link, useAuth, LoadingSpinner" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Standard React component imports for authentication page" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[BEGIN stable_id="~/.framework/src/pages/auth/LoginPage.tsx:module_header:module_header" type="module_header" identity="module_header" parent="~/.framework/src/pages/auth/LoginPage.tsx"]
+// CIL[DOC-MACRO purpose="Module header for the LoginPage component: imports, dependencies, and module-level context."]
+// CIL[DOC-RESPONSIBILITY responsibility="Declare module-level imports and setup for the authentication login page."]
+// CIL[DOC-CONTEXT module="auth" layer="presentation" related_files=".framework/src/components/ui/LoadingSpinner.tsx,.framework/src/contexts/AuthContext.tsx"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Imports React, routing, auth context, and the LoadingSpinner UI component." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.85" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-AUDIENCE audience="developer"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-page. Direct callers: 0. Direct calls: 0. Related files: custom/apps/portal/pages/ContentPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, custom/apps/portal/pages/CoursesPage.tsx, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/src/pages/admin/RolesPage.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[DOC-AUDIENCE audience="developers"]
+
 import React, { useState } from 'react'
 import { Link, useNavigate } from 'react-router-dom'
 import { useAuth } from '../../contexts/AuthContext'
 import { LoadingSpinner } from '../../components/ui/LoadingSpinner'
-// CIL[END chunk_id="LoginPage_module_header_1783662155"]
-// CIL[BEGIN chunk_id="LoginPage_loginpage_1783662155" type="function" identity="LoginPage" parent="none"]
-// CIL[DOC-MACRO purpose="Render login form with email/password inputs and authentication handling"]
-// CIL[DOC-RESPONSIBILITY responsibility="Manage login state, form submission, error display, and user authentication flow"]
-// CIL[DOC-CONTEXT module="src/pages/auth/LoginPage" layer="frontend-page" related_files="[\"custom/apps/portal/pages/ContentPage.tsx\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/src/pages/admin/RolesPage.tsx\",\"custom/apps/cortex/functions/custom_cil-embeddings.ts\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="authenticated user session or error message" errors="login failure, network errors" side_effects="updates auth context state"]
-// CIL[DOC-MICRO logic_summary="Form with controlled state, async login call, loading states, and error handling" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-page. Direct callers: 0. Direct calls: 0. Related files: custom/apps/portal/pages/ContentPage.tsx, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/src/pages/admin/RolesPage.tsx, custom/apps/cortex/functions/custom_cil-embeddings.ts, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+import { TurnstileWidget, turnstileEnabled } from '../../components/auth/TurnstileWidget'
+
+// CIL[DOC-VECTOR type="context" content="purpose='Module header for the LoginPage component: imports, dependencies, and module-level context.'; No verified external callers; imports: .framework/src/contexts/AuthContext.tsx,.framework/src/components/ui/LoadingSpinner.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/auth/LoginPage.tsx:module_header:module_header"]
+// CIL[BEGIN stable_id="~/.framework/src/pages/auth/LoginPage.tsx:LoginPage:component" type="component" identity="LoginPage" parent="~/.framework/src/pages/auth/LoginPage.tsx"]
+// CIL[DOC-MACRO purpose="Render the login form and handle user authentication."]
+// CIL[DOC-RESPONSIBILITY responsibility="Collect email and password, call auth login, and navigate to the appropriate post-login route."]
+// CIL[DOC-CONTEXT module="auth" layer="presentation" related_files=".framework/src/components/ui/LoadingSpinner.tsx,.framework/src/contexts/AuthContext.tsx,.framework/src/pages/auth/LoginPage.tsx"]
+// CIL[DOC-CONTRACT inputs="none (reads from local form state and AuthContext)" outputs="JSX login page" errors="displays authentication error message" side_effects="calls login API and navigates with react-router"]
+// CIL[DOC-MICRO logic_summary="Manages email/password/isLoading state; on submit prevents default, calls login, fetches spine.config.json, resolves default app by role, and navigates." notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export function LoginPage() {
   const [email, setEmail] = useState('')
   const [password, setPassword] = useState('')
+  const [captchaToken, setCaptchaToken] = useState<string | null>(null)
   const [error, setError] = useState('')
   const [isLoading, setIsLoading] = useState(false)
   
@@ -47,7 +45,7 @@ export function LoginPage() {
     setIsLoading(true)
 
     try {
-      const user = await login(email, password)
+      const user = await login(email, password, captchaToken ?? undefined)
       const role = user?.roles?.[0]
       if (!role) {
         navigate('/')
@@ -75,8 +73,8 @@ export function LoginPage() {
     <div className="min-h-screen flex items-center justify-center bg-slate-50 py-12 px-4 sm:px-6 lg:px-8">
       <div className="max-w-md w-full space-y-8">
         <div>
-          <div className="mx-auto h-12 w-12 flex items-center justify-center rounded-full bg-slate-900">
-            <span className="text-white font-bold text-xl">S</span>
+          <div className="mx-auto flex items-center justify-center">
+            <img src="/spine-logo.svg" alt="Spine Framework" className="h-14 w-auto" />
           </div>
           <h2 className="mt-6 text-center text-3xl font-extrabold text-slate-900">
             Sign in to Spine
@@ -152,10 +150,12 @@ export function LoginPage() {
             </div>
           </div>
 
+          <TurnstileWidget onToken={setCaptchaToken} />
+
           <div>
             <button
               type="submit"
-              disabled={isLoading}
+              disabled={isLoading || (turnstileEnabled && !captchaToken)}
               className="group relative w-full flex justify-center py-2 px-4 border border-transparent rounded-[5px] shadow-sm text-sm font-medium text-white bg-slate-900 hover:bg-slate-800 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-accent-blue disabled:opacity-50 disabled:cursor-not-allowed"
             >
               {isLoading ? (
@@ -173,4 +173,10 @@ export function LoginPage() {
     </div>
   )
 }
-// CIL[END chunk_id="LoginPage_loginpage_1783662155"]
+// CIL[DOC-VECTOR type="context" content="purpose='Render the login form and handle user authentication.'; No verified external callers; imports: .framework/src/contexts/AuthContext.tsx,.framework/src/components/ui/LoadingSpinner.tsx"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/pages/auth/LoginPage.tsx:LoginPage:component"]