/* ============================================================
SILVERLINES — beta login & local account
------------------------------------------------------------
Client-only auth GATE for the private beta. It stands in front
of the whole app until a real backend (Infomaniak / Postgres)
takes over. Flow:
invite code → create account (first run)
→ sign in (returning, signed out)
The account lives in localStorage ('silverlines.account.v1',
global/allow-listed). Password is stored ONLY as a salted
SHA-256 hash locally — it is re-entered over TLS and re-hashed
with Argon2id server-side at migration; the local hash is then
discarded. See the migration plan.
Everything is wrapped in an IIFE — the app shares ONE global
lexical scope across all Babel files, so we expose exactly three
handles: window.Auth, window.AuthGate, window.useAccount.
Primitives (Icon, cx, Avatar, Chip, useState…) resolve through
that shared scope at render time (core.jsx loads first).
============================================================ */
(function () {
'use strict';
/* ---- shake keyframes (self-contained; do not depend on owner.jsx) ---- */
try {
var st = document.createElement('style');
st.textContent = '@keyframes authShake{10%,90%{transform:translateX(-2px)}20%,80%{transform:translateX(4px)}30%,50%,70%{transform:translateX(-7px)}40%,60%{transform:translateX(7px)}}.auth-shake{animation:authShake .42s cubic-bezier(.36,.07,.19,.97) both}';
document.head.appendChild(st);
} catch (e) {}
/* ============================================================
SHA-256 (pure JS, synchronous) — no crypto.subtle (async +
unavailable on file://). The invite generator embeds the SAME
function so codes validate identically on both sides.
============================================================ */
var K = [
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2];
function AUTH_sha256bytes(str) {
var utf8 = unescape(encodeURIComponent(str));
var bytes = [];
for (var i = 0; i < utf8.length; i++) bytes.push(utf8.charCodeAt(i) & 0xff);
var H = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
var bitLen = bytes.length * 8;
bytes.push(0x80);
while (bytes.length % 64 !== 56) bytes.push(0);
for (var i = 7; i >= 0; i--) bytes.push(Math.floor(bitLen / Math.pow(2, 8 * i)) & 0xff);
function rotr(n, x) { return (x >>> n) | (x << (32 - n)); }
var w = new Array(64);
for (var j = 0; j < bytes.length; j += 64) {
for (var i = 0; i < 16; i++) {
w[i] = (bytes[j + i * 4] << 24) | (bytes[j + i * 4 + 1] << 16) | (bytes[j + i * 4 + 2] << 8) | (bytes[j + i * 4 + 3]);
}
for (var i = 16; i < 64; i++) {
var s0 = rotr(7, w[i - 15]) ^ rotr(18, w[i - 15]) ^ (w[i - 15] >>> 3);
var s1 = rotr(17, w[i - 2]) ^ rotr(19, w[i - 2]) ^ (w[i - 2] >>> 10);
w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
}
var a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
for (var i = 0; i < 64; i++) {
var S1 = rotr(6, e) ^ rotr(11, e) ^ rotr(25, e);
var ch = (e & f) ^ ((~e) & g);
var t1 = (h + S1 + ch + K[i] + w[i]) | 0;
var S0 = rotr(2, a) ^ rotr(13, a) ^ rotr(22, a);
var maj = (a & b) ^ (a & c) ^ (b & c);
var t2 = (S0 + maj) | 0;
h = g; g = f; f = e; e = (d + t1) | 0; d = c; c = b; b = a; a = (t1 + t2) | 0;
}
H[0] = (H[0] + a) | 0; H[1] = (H[1] + b) | 0; H[2] = (H[2] + c) | 0; H[3] = (H[3] + d) | 0;
H[4] = (H[4] + e) | 0; H[5] = (H[5] + f) | 0; H[6] = (H[6] + g) | 0; H[7] = (H[7] + h) | 0;
}
var out = [];
for (var i = 0; i < 8; i++) out.push((H[i] >>> 24) & 0xff, (H[i] >>> 16) & 0xff, (H[i] >>> 8) & 0xff, H[i] & 0xff);
return out;
}
function AUTH_sha256hex(str) {
return AUTH_sha256bytes(str).map(function (b) { return ('0' + b.toString(16)).slice(-2); }).join('');
}
/* ============================================================
INVITE CODES — SLBETA-BBBB-MMMM
BBBB = random body; MMMM = MAC of the body under a baked-in
pepper. No plaintext code list ships. Casual-gate only — the
server re-validates redeemed codes against the invites table.
============================================================ */
var ALPHABET = '23456789ABCDEFGHJKMNPQRSTVWXYZ'; // 30 chars, no 0/O/1/I/L/U
/* pepper split so it isn't one greppable literal (kept in sync with tools/gen-invites.mjs) */
var AUTH_PA = '9f2e8c1a7d40b6f5';
var AUTH_PB = 'c47af0e91d6b25a3';
var PEPPER = AUTH_PA + AUTH_PB;
function macFor(body) {
var digest = AUTH_sha256bytes('slbeta.v1|' + body + '|' + PEPPER);
var mac = '';
for (var i = 0; i < 4; i++) mac += ALPHABET.charAt(digest[i] % ALPHABET.length);
return mac;
}
function validateInvite(input) {
if (!input) return false;
var norm = String(input).toUpperCase().replace(/[^0-9A-Z]/g, '');
if (norm.indexOf('SLBETA') !== 0) return false;
var rest = norm.slice(6);
if (rest.length !== 8) return false;
var body = rest.slice(0, 4), mac = rest.slice(4, 8);
for (var i = 0; i < body.length; i++) if (ALPHABET.indexOf(body.charAt(i)) < 0) return false;
return macFor(body) === mac;
}
/* ============================================================
ACCOUNT store — silverlines.account.v1 (global key)
============================================================ */
var ACCOUNT_KEY = 'silverlines.account.v1';
var SETTINGS_KEY = 'silverlines.settings.v1';
var PALETTE = ['#22D48A', '#F57F45', '#F2B24A', '#BD2555', '#9FC1E8', '#5B0952'];
function rawGet(key) { try { var r = localStorage.getItem(key); return r == null ? null : JSON.parse(r); } catch (e) { return null; } }
function rawSet(key, val) { try { localStorage.setItem(key, JSON.stringify(val)); } catch (e) {} }
function fireAccount() { try { window.dispatchEvent(new CustomEvent('sl-account')); } catch (e) {} }
function makeSalt() {
try {
var arr = new Uint8Array(16);
(window.crypto || window.msCrypto).getRandomValues(arr);
return Array.prototype.map.call(arr, function (b) { return ('0' + b.toString(16)).slice(-2); }).join('');
} catch (e) {
var s = '';
for (var i = 0; i < 32; i++) s += Math.floor(Math.random() * 16).toString(16);
return s;
}
}
function hashPw(salt, pw) { return AUTH_sha256hex(salt + '|' + pw); }
function hashId(id) { var h = 0, s = String(id || ''); for (var i = 0; i < s.length; i++) h = (h * 31 + s.charCodeAt(i)) | 0; return Math.abs(h); }
function mergeSettings(patch) {
var s = rawGet(SETTINGS_KEY) || {};
rawSet(SETTINGS_KEY, Object.assign({}, s, patch));
}
var Auth = {
current: function () { return rawGet(ACCOUNT_KEY); },
isAuthed: function () { var a = rawGet(ACCOUNT_KEY); return !!(a && a.signedIn); },
hasAccount: function () { return !!rawGet(ACCOUNT_KEY); },
validateInvite: validateInvite,
color: function (id) { return PALETTE[hashId(id) % PALETTE.length]; },
createAccount: function (o) {
var salt = makeSalt();
var now = Date.now();
var rec = {
v: 1,
id: 'acc-' + now + '-' + Math.floor(Math.random() * 1e6).toString(36),
company: (o.company || '').trim(),
name: (o.name || '').trim(),
email: (o.email || '').trim(),
role: 'Producer',
passSalt: salt,
passHash: hashPw(salt, o.password || ''),
invite: (o.invite || '').toUpperCase().replace(/[^0-9A-Z-]/g, ''),
plan: 'beta-producer',
createdAt: now, lastLoginAt: now, signedIn: true,
};
rawSet(ACCOUNT_KEY, rec);
mergeSettings({ name: rec.name, email: rec.email, role: 'Producer' });
window.PLAN = window.resolvePlan(rec);
fireAccount();
return rec;
},
signIn: function (email, password) {
var rec = rawGet(ACCOUNT_KEY);
if (!rec) return { ok: false, reason: 'no-account' };
if (email && rec.email && email.trim().toLowerCase() !== rec.email.toLowerCase()) return { ok: false, reason: 'email' };
if (hashPw(rec.passSalt, password || '') !== rec.passHash) return { ok: false, reason: 'password' };
rec.signedIn = true; rec.lastLoginAt = Date.now();
rawSet(ACCOUNT_KEY, rec);
window.PLAN = window.resolvePlan(rec);
fireAccount();
return { ok: true };
},
signOut: function () {
var rec = rawGet(ACCOUNT_KEY);
if (rec) { rec.signedIn = false; rawSet(ACCOUNT_KEY, rec); }
fireAccount();
},
updateProfile: function (patch) {
var rec = rawGet(ACCOUNT_KEY);
if (!rec) return;
if (patch.name != null) rec.name = patch.name;
if (patch.email != null) rec.email = patch.email;
if (patch.role != null) rec.role = patch.role;
if (patch.company != null) rec.company = patch.company;
rawSet(ACCOUNT_KEY, rec);
mergeSettings({ name: rec.name, email: rec.email });
fireAccount();
},
/* full device reset — drops the account and ALL local silverlines data */
reset: function () {
try {
var kill = [];
for (var i = 0; i < localStorage.length; i++) {
var k = localStorage.key(i);
if (/^(silverlines|producer)\./.test(k) || /^@[^.]+\./.test(k)) kill.push(k);
}
kill.forEach(function (k) { localStorage.removeItem(k); });
} catch (e) {}
fireAccount();
},
};
window.Auth = Auth;
/* ---- live-updating hook for identity across the app ---- */
function initialsOf(name) {
var parts = String(name || '').trim().split(/\s+/).filter(Boolean);
if (!parts.length) return 'P';
if (parts.length === 1) return parts[0].slice(0, 2).toUpperCase();
return (parts[0][0] + parts[parts.length - 1][0]).toUpperCase();
}
function useAccount() {
var s = useState(function () { return Auth.current(); });
var acc = s[0], setAcc = s[1];
useEffect(function () {
var h = function () { setAcc(Auth.current()); };
window.addEventListener('sl-account', h);
return function () { window.removeEventListener('sl-account', h); };
}, []);
var a = acc || {};
return {
raw: acc,
name: a.name || 'Producer',
email: a.email || '',
company: a.company || '',
role: a.role || 'Producer',
color: acc ? Auth.color(acc.id) : '#22D48A',
initials: initialsOf(a.name || 'Producer'),
};
}
window.useAccount = useAccount;
/* ============================================================
UI — the gate
============================================================ */
function BrandMark() {
return (
Silverlines
Production OS
);
}
function Field(props) {
return (
{props.icon ? : null}
{props.trailing || null}
);
}
function InviteStep(props) {
var s = useState(''); var code = s[0], setCode = s[1];
var sh = useState(false); var shake = sh[0], setShake = sh[1];
var er = useState(false); var err = er[0], setErr = er[1];
var submit = function () {
if (validateInvite(code)) { props.onValid(code); return; }
setErr(true); setShake(true); setTimeout(function () { setShake(false); }, 460);
};
return (
Private beta
Enter your invite code
Silverlines is in private beta. Enter the code we sent you to set up your production company.
{err ?
That code isn’t valid. Check it and try again.
: null}
No code? Email support@silverlines.app to join the beta.
);
}
function AccountStep(props) {
var f = useState({ company: '', name: '', email: '', pw: '', pw2: '' }); var v = f[0], setV = f[1];
var er = useState(''); var err = er[0], setErr = er[1];
var sh = useState(false); var shake = sh[0], setShake = sh[1];
var show = useState(false); var showPw = show[0], setShow = show[1];
var upd = function (k) { return function (val) { setV(Object.assign({}, v, (function () { var o = {}; o[k] = val; return o; })())); if (err) setErr(''); }; };
var fail = function (m) { setErr(m); setShake(true); setTimeout(function () { setShake(false); }, 460); };
var submit = function () {
if (!v.company.trim()) return fail('Add your production company name.');
if (!v.name.trim()) return fail('Add your name.');
if (!/.+@.+\..+/.test(v.email.trim())) return fail('Enter a valid email address.');
if (v.pw.length < 8) return fail('Password must be at least 8 characters.');
if (v.pw !== v.pw2) return fail('Passwords don’t match.');
Auth.createAccount({ company: v.company, name: v.name, email: v.email, password: v.pw, invite: props.invite });
props.onDone();
};
return (
Invite accepted
Create your company
You’ll be the owner — invite your team and crew once you’re in.
} />
{err ?
{err}
: null}
);
}
function SignInStep(props) {
var rec = Auth.current() || {};
var p = useState(''); var pw = p[0], setPw = p[1];
var show = useState(false); var showPw = show[0], setShow = show[1];
var sh = useState(false); var shake = sh[0], setShake = sh[1];
var er = useState(''); var err = er[0], setErr = er[1];
var rs = useState(false); var resetting = rs[0], setResetting = rs[1];
var rv = useState(''); var resetVal = rv[0], setResetVal = rv[1];
var submit = function () {
var r = Auth.signIn(rec.email, pw);
if (r.ok) { props.onDone(); return; }
setErr('Wrong password. Try again.'); setShake(true); setTimeout(function () { setShake(false); }, 460);
};
return (
Welcome back
{rec.company || 'Sign in'}
Sign in to continue to your productions.
{rec.email || rec.name}Owner
} />
{err ?
{err}
: null}
{!resetting ? (
) : (
This erases the account and all local data on this device. Type DELETE to confirm.
)}
);
}
function AuthGate(props) {
var ctx = (typeof useContext === 'function' && typeof AccessContext !== 'undefined') ? (useContext(AccessContext) || {}) : {};
var theme = ctx.theme, setTheme = ctx.setTheme;
var st = useState(function () { var rec = Auth.current(); return (rec && !rec.signedIn) ? 'signin' : 'invite'; });
var step = st[0], setStep = st[1];
var iv = useState(''); var invite = iv[0], setInvite = iv[1];
var day = theme === 'day';
return (