@antelopejs/dms 0.6.2 → 0.7.0

package/dist/validation/issue-message.d.ts

@@ -0,0 +1 @@
+export declare function firstIssueMessage(error: unknown): string;

package/dist/validation/issue-message.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.firstIssueMessage = firstIssueMessage;
+const zod_1 = require("zod");
+function firstIssueMessage(error) {
+    const [issue] = error instanceof zod_1.ZodError ? error.issues : [];
+    return issue ? issue.message : String(error);
+}
+//# sourceMappingURL=issue-message.js.map

package/dist/validation/issue-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-message.js","sourceRoot":"","sources":["../../src/validation/issue-message.ts"],"names":[],"mappings":";;AAOA,8CAGC;AAVD,6BAA+B;AAO/B,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,cAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/validation/member-invite.schema.d.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 export declare const INVITE_NAME_MAX_LENGTH = 100;
 export declare const INVITE_FULL_NAME_MAX_LENGTH: number;
 export declare const INVITE_EMAILS_MAX = 50;
-export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     emails: z.ZodArray<z.ZodString, "many">;
     name: z.ZodOptional<z.ZodString>;
     firstname: z.ZodOptional<z.ZodString>;
@@ -10,11 +10,9 @@ export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<
     roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     language: z.ZodString;
     asTenantOwner: z.ZodBoolean;
-    skipEmailValidation: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     language: string;
     asTenantOwner: boolean;
-    skipEmailValidation: boolean;
     emails: string[];
     name?: string | undefined;
     roles?: string[] | undefined;
@@ -28,11 +26,9 @@ export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<
     roles?: string[] | undefined;
     firstname?: string | undefined;
     lastname?: string | undefined;
-    skipEmailValidation?: boolean | undefined;
 }>, {
     language: string;
     asTenantOwner: boolean;
-    skipEmailValidation: boolean;
     emails: string[];
     name?: string | undefined;
     roles?: string[] | undefined;
@@ -46,29 +42,9 @@ export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<
     roles?: string[] | undefined;
     firstname?: string | undefined;
     lastname?: string | undefined;
-    skipEmailValidation?: boolean | undefined;
 }>, {
     language: string;
     asTenantOwner: boolean;
-    skipEmailValidation: boolean;
-    emails: string[];
-    name?: string | undefined;
-    roles?: string[] | undefined;
-    firstname?: string | undefined;
-    lastname?: string | undefined;
-}, {
-    language: string;
-    asTenantOwner: boolean;
-    emails: string[];
-    name?: string | undefined;
-    roles?: string[] | undefined;
-    firstname?: string | undefined;
-    lastname?: string | undefined;
-    skipEmailValidation?: boolean | undefined;
-}>, {
-    language: string;
-    asTenantOwner: boolean;
-    skipEmailValidation: boolean;
     emails: string[];
     name?: string | undefined;
     roles?: string[] | undefined;

package/dist/validation/member-invite.schema.js

@@ -33,32 +33,11 @@ const memberInviteObjectSchema = zod_1.z.object({
     roles: zod_1.z.array(zod_1.z.string()).optional(),
     language: zod_1.z.string(),
     asTenantOwner: zod_1.z.boolean(),
-    skipEmailValidation: zod_1.z.boolean().default(false),
 });
-function addIssue(ctx, path, message) {
-    ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message, path: [path] });
-}
-function requireNamesWhenValidationSkipped(data, ctx) {
-    if (!data.skipEmailValidation)
-        return;
-    if (data.emails.length > 1) {
-        addIssue(ctx, EMAILS_KEY, "$page.settings.members.invite.skip_validation_single_email");
-    }
-    if (data.name)
-        return;
-    if (!data.firstname) {
-        addIssue(ctx, "firstname", "$page.settings.members.invite.firstname_required");
-    }
-    if (!data.lastname) {
-        addIssue(ctx, "lastname", "$page.settings.members.invite.lastname_required");
-    }
-}
-exports.memberInviteSchema = zod_1.z.preprocess(acceptLegacySingleEmail, memberInviteObjectSchema
-    .refine((data) => data.asTenantOwner || (data.roles && data.roles.length > 0), {
+exports.memberInviteSchema = zod_1.z.preprocess(acceptLegacySingleEmail, memberInviteObjectSchema.refine((data) => data.asTenantOwner || (data.roles && data.roles.length > 0), {
     message: "$page.settings.members.invite.roles_required",
     path: ["roles"],
-})
-    .superRefine(requireNamesWhenValidationSkipped));
+}));
 function resolveInviteeNameParts(payload) {
     if (payload.firstname || payload.lastname || !payload.name) {
         return { firstname: payload.firstname, lastname: payload.lastname };

package/dist/validation/member-invite.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"member-invite.schema.js","sourceRoot":"","sources":["../../src/validation/member-invite.schema.ts"],"names":[],"mappings":";;;AAyHA,0DAQC;AAMD,gDAEC;AAzID,6BAAwB;AAOX,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAG7B,QAAA,2BAA2B,GAAG,8BAAsB,GAAG,CAAC,CAAC;AAMzD,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC;AAM7B,SAAS,uBAAuB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpE,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9C,CAAC;AAOD,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,8BAAsB,CAAC,CAAC;AAErE,MAAM,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAC;SACN,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;SAC9C,GAAG,CAAC,CAAC,EAAE,+CAA+C,CAAC;SACvD,GAAG,CAAC,yBAAiB,EAAE,+CAA+C,CAAC;IAC1E,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,mCAA2B,CAAC,CAAC,QAAQ,EAAE;IACnE,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE;IAC1B,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAChD,CAAC,CAAC;AAIH,SAAS,QAAQ,CAAC,GAAoB,EAAE,IAAY,EAAE,OAAe;IACnE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAMD,SAAS,iCAAiC,CACxC,IAAwB,EACxB,GAAoB;IAEpB,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAAE,OAAO;IACtC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CACN,GAAG,EACH,UAAU,EACV,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO;IACtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,QAAQ,CACN,GAAG,EACH,WAAW,EACX,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,QAAQ,CACN,GAAG,EACH,UAAU,EACV,iDAAiD,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAEY,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAC5C,uBAAuB,EACvB,wBAAwB;KACrB,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EACrE;IACE,OAAO,EAAE,8CAA8C;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC;CAChB,CACF;KACA,WAAW,CAAC,iCAAiC,CAAC,CAClD,CAAC;AAeF,SAAgB,uBAAuB,CACrC,OAAqE;IAErE,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;AAC9D,CAAC;AAMD,SAAgB,kBAAkB,CAAC,MAAyB;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"member-invite.schema.js","sourceRoot":"","sources":["../../src/validation/member-invite.schema.ts"],"names":[],"mappings":";;;AA+EA,0DAQC;AAMD,gDAEC;AA/FD,6BAAwB;AAOX,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAG7B,QAAA,2BAA2B,GAAG,8BAAsB,GAAG,CAAC,CAAC;AAMzD,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC;AAM7B,SAAS,uBAAuB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpE,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9C,CAAC;AAOD,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,8BAAsB,CAAC,CAAC;AAErE,MAAM,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAC;SACN,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;SAC9C,GAAG,CAAC,CAAC,EAAE,+CAA+C,CAAC;SACvD,GAAG,CAAC,yBAAiB,EAAE,+CAA+C,CAAC;IAC1E,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,mCAA2B,CAAC,CAAC,QAAQ,EAAE;IACnE,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAC5C,uBAAuB,EACvB,wBAAwB,CAAC,MAAM,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EACrE;IACE,OAAO,EAAE,8CAA8C;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC;CAChB,CACF,CACF,CAAC;AAeF,SAAgB,uBAAuB,CACrC,OAAqE;IAErE,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;AAC9D,CAAC;AAMD,SAAgB,kBAAkB,CAAC,MAAyB;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/frontend-vue/dms.frontend.ts

@@ -17,6 +17,7 @@ import fontPreloadPlugin from "./layers/dms-layout/app/plugins/font-preload";
 import permissionPreviewPrepaintPlugin from "./layers/dms-layout/app/plugins/permission-preview-prepaint";
 import regionalPreferencesPlugin from "./layers/dms-layout/app/plugins/regional-preferences";
 import seoPlugin from "./layers/dms-layout/app/plugins/seo";
+import sidePanelHostPlugin from "./layers/dms-layout/app/plugins/side-panel-host";
 import onboardingMiddleware from "./layers/dms-onboarding/app/middleware/onboarding.global";
 import registerPlugin from "./layers/dms-ui/app/plugins/register";
 import shortcutsPlugin from "./layers/dms-ui/app/plugins/shortcuts";
@@ -170,6 +171,7 @@ function registerPlugins(sdk: Parameters<DmsFrontendModule["setup"]>[0]): void {
   sdk.registerPlugin(accessibilityPlugin);
   sdk.registerPlugin(regionalPreferencesPlugin);
   sdk.registerPlugin(seoPlugin);
+  sdk.registerPlugin(sidePanelHostPlugin);
   sdk.registerPlugin(registerPlugin);
   sdk.registerPlugin(shortcutsPlugin);
   sdk.registerPlugin(tableViewDisplaysPlugin);

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/forgot-validation.vue

@@ -124,6 +124,9 @@ async function requestForgotPassword() {
     });
 
     startCooldown();
+    // The refusal was about the previous code: the new one starts clean.
+    clearFormError();
+    codeError.value = undefined;
 
     toast.add({
       title: t("page.validate.request_sended"),

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/signup.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { useTemplateRef } from "vue";
+import { onMounted, useTemplateRef } from "vue";
 import * as z from "zod";
 import type { FormSubmitEvent } from "@nuxt/ui";
 import StageCard from "../../../../dms-layout/app/build/components/layout/StageCard.vue";
@@ -15,14 +15,70 @@ import {
   useLiveFormErrors,
   useLocalizedSchema,
 } from "#dms-core/app/composables/useFormValidation";
+import { resolveApiErrorMessage } from "#dms-core/app/composables/useApiError";
 
 const MIN_NAME_LENGTH = 2;
 
+/** Why an invitation link cannot open the signup form. */
+type ClosedInvitation = "invalid" | "expired" | "revoked" | "replaced" | "used";
+type InvitationState = "checking" | "open" | ClosedInvitation;
+
+interface ClosedInvitationNotice {
+  icon: string;
+  title: string;
+  description: string;
+}
+
+// The refusals the server gives a link it would not sign up with.
+const CLOSED_INVITATION_CODES: Record<string, ClosedInvitation> = {
+  "error.invalid_token": "invalid",
+  "error.invite_expired": "expired",
+  "error.invite_revoked": "revoked",
+  "error.invite_replaced": "replaced",
+  "error.invite_used": "used",
+};
+
+const CLOSED_INVITATION_NOTICES: Record<
+  ClosedInvitation,
+  ClosedInvitationNotice
+> = {
+  invalid: {
+    icon: "i-ph-link-break",
+    title: "page.signup.invalid_invitation_title",
+    description: "page.signup.invalid_invitation_description",
+  },
+  expired: {
+    icon: "i-ph-hourglass",
+    title: "page.signup.invitation_expired_title",
+    description: "page.signup.invitation_expired_description",
+  },
+  revoked: {
+    icon: "i-ph-prohibit",
+    title: "page.signup.invitation_revoked_title",
+    description: "page.signup.invitation_revoked_description",
+  },
+  replaced: {
+    icon: "i-ph-envelope-simple",
+    title: "page.signup.invitation_replaced_title",
+    description: "page.signup.invitation_replaced_description",
+  },
+  used: {
+    icon: "i-ph-user-check",
+    title: "page.signup.invitation_used_title",
+    description: "page.signup.invitation_used_description",
+  },
+};
+
+function closedInvitationOf(error: unknown): ClosedInvitation | undefined {
+  return CLOSED_INVITATION_CODES[resolveApiErrorMessage(error)];
+}
+
 const { locale, locales, setLocale } = useI18n();
 const config = useDmsRuntimeConfig();
 const homepage = useHomepage();
 const dmsApp = useDmsApp();
 const { formError, clearFormError, showError } = useAuthFormError();
+const { $authFetch } = useAuthFetch();
 const form = useTemplateRef<AuthFormHandle>("form");
 
 const route = useDmsRoute();
@@ -35,6 +91,34 @@ const hasInvitationToken = computed(
   () => typeof queryToken.value === "string" && queryToken.value !== "",
 );
 
+const invitationState = ref<InvitationState>(
+  hasInvitationToken.value ? "checking" : "invalid",
+);
+const closedInvitation = computed(() =>
+  invitationState.value in CLOSED_INVITATION_NOTICES
+    ? CLOSED_INVITATION_NOTICES[invitationState.value as ClosedInvitation]
+    : undefined,
+);
+
+// A revoked, replaced or expired link says so as the page opens, rather than
+// after the whole form was filled. The server answers with the very check the
+// signup runs; any other failure leaves the form to the signup to settle.
+async function checkInvitation(): Promise<void> {
+  try {
+    await $authFetch("/api/auth/validate-invite-token", {
+      method: "POST",
+      body: { token: queryToken.value, email: queryEmail.value },
+    });
+    invitationState.value = "open";
+  } catch (error: unknown) {
+    invitationState.value = closedInvitationOf(error) ?? "open";
+  }
+}
+
+onMounted(() => {
+  if (invitationState.value === "checking") void checkInvitation();
+});
+
 // The invitation link carries the language the invitee was invited in: the
 // page opens in it, and the footer switcher still lets them pick another one
 // before the account is created with whichever is current.
@@ -80,6 +164,12 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
       ),
     );
   } catch (error: unknown) {
+    // The invitation can be retired while the form is open.
+    const closed = closedInvitationOf(error);
+    if (closed) {
+      invitationState.value = closed;
+      return;
+    }
     // A refused value (an address already used) shows under its field;
     // anything else above the form.
     await showError(error, "page.signup.error_title", {
@@ -95,11 +185,11 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
 
 <template>
   <StageCard
-    v-if="!hasInvitationToken"
-    icon="i-ph-link-break"
+    v-if="closedInvitation"
+    :icon="closedInvitation.icon"
     tone="warning"
-    :title="$t('page.signup.invalid_invitation_title')"
-    :description="$t('page.signup.invalid_invitation_description')"
+    :title="$t(closedInvitation.title)"
+    :description="$t(closedInvitation.description)"
     data-testid="signup-invalid-invitation"
   >
     <UButton
@@ -111,6 +201,16 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
     />
   </StageCard>
 
+  <StageCard
+    v-else-if="invitationState === 'checking'"
+    icon="i-ph-spinner"
+    icon-class="animate-spin"
+    tone="neutral"
+    :title="$t('page.signup.create_account_title')"
+    :description="$t('page.signup.checking_invitation')"
+    data-testid="signup-checking-invitation"
+  />
+
   <StageCard
     v-else
     :title="$t('page.signup.create_account_title')"

package/frontend-vue/layers/dms-auth/i18n/locales/auth-en-GB.json

@@ -27,6 +27,15 @@
       "error_title": "Account creation error",
       "invalid_invitation_title": "This invitation link is invalid or incomplete",
       "invalid_invitation_description": "Open the link from your invitation email again, or ask the workspace owner to send you a new invitation. Already have an account? Log in.",
+      "checking_invitation": "Checking your invitation…",
+      "invitation_expired_title": "This invitation has expired",
+      "invitation_expired_description": "Ask the person who invited you to send you a new invitation. Already have an account? Log in.",
+      "invitation_revoked_title": "This invitation was revoked",
+      "invitation_revoked_description": "The person who invited you cancelled it. If you still need access, ask them for a new invitation.",
+      "invitation_replaced_title": "This invitation was replaced by a newer email",
+      "invitation_replaced_description": "A newer invitation was sent to this address, and only its link works. Open the latest invitation email, or ask the person who invited you to send it again.",
+      "invitation_used_title": "This invitation was already used",
+      "invitation_used_description": "An account was already created with this invitation. Log in to continue.",
       "description": "You've been invited. Choose your name and a password to join.",
       "submit": "Create my account"
     },
@@ -55,8 +64,8 @@
       "title_success": "Password changed",
       "title_forget": "Forgot password",
       "description_success": "Your password has been reset. Sign in with your new password.",
-      "description_validation": "We sent a 6-digit code to {email}. Enter it to choose a new password.",
-      "description_forget": "Enter the e-mail address of your account. We'll send you a 6-digit code to reset your password.",
+      "description_validation": "We sent a 6-character code to {email}. Enter it to choose a new password.",
+      "description_forget": "Enter the e-mail address of your account. We'll send you a 6-character code to reset your password.",
       "error_title": "Reset error",
       "title_inbox": "Check your inbox",
       "send_code": "Send the code",
@@ -368,7 +377,8 @@
           "add_method": "Add method",
           "add_named": "Add {method}",
           "password_prompt": "Confirm your password to add a sign-in method.",
-          "password_continue": "Continue"
+          "password_continue": "Continue",
+          "email_setup_description": "We sent a 6-digit code to {email}. Enter it to turn on email codes."
         },
         "backup": {
           "title": "Backup codes",
@@ -415,6 +425,7 @@
           "email_already_used": "This email address is already used by another account.",
           "invalid_2fa_code": "That verification code is invalid or has expired.",
           "rate_limited": "Please wait a minute before asking for another code.",
+          "email_change_too_many_attempts": "Too many wrong codes. Ask for a new one.",
           "no_backup_codes": "You have no backup codes.",
           "session_not_found": "This session no longer exists."
         }
@@ -442,6 +453,11 @@
       "identity_malformed": "The provider returned an unusable identity, please try again."
     },
     "rate_limited": "Too many attempts, please try again in a minute.",
-    "too_many_sign_in_attempts": "Too many sign-in attempts. Please try again in a few minutes."
+    "too_many_sign_in_attempts": "Too many sign-in attempts. Please try again in a few minutes.",
+    "too_many_2fa_attempts": "Too many wrong codes. Go back and sign in again with your password.",
+    "too_many_2fa_attempts_account": "Too many wrong codes on this account. Wait up to an hour, then sign in again.",
+    "2fa_challenge_used": "This verification is already complete. Sign in again with your password.",
+    "invalid_2fa_token": "This verification has expired or is invalid. Sign in again with your password.",
+    "too_many_current_password_attempts": "Too many wrong passwords. Wait 15 minutes, then try again."
   }
 }

package/frontend-vue/layers/dms-auth/i18n/locales/auth-fr-FR.json

@@ -27,6 +27,15 @@
       "error_title": "Erreur de création de compte",
       "invalid_invitation_title": "Ce lien d'invitation est invalide ou incomplet",
       "invalid_invitation_description": "Rouvrez le lien de votre e-mail d'invitation, ou demandez au propriétaire de l'espace de travail de vous envoyer une nouvelle invitation. Vous avez déjà un compte ? Connectez-vous.",
+      "checking_invitation": "Vérification de votre invitation…",
+      "invitation_expired_title": "Cette invitation a expiré",
+      "invitation_expired_description": "Demandez à la personne qui vous a invité de vous envoyer une nouvelle invitation. Vous avez déjà un compte ? Connectez-vous.",
+      "invitation_revoked_title": "Cette invitation a été révoquée",
+      "invitation_revoked_description": "La personne qui vous a invité l'a annulée. Si vous avez toujours besoin d'un accès, demandez-lui une nouvelle invitation.",
+      "invitation_replaced_title": "Cette invitation a été remplacée par un e-mail plus récent",
+      "invitation_replaced_description": "Une invitation plus récente a été envoyée à cette adresse, et seul son lien fonctionne. Ouvrez le dernier e-mail d'invitation, ou demandez à la personne qui vous a invité de vous le renvoyer.",
+      "invitation_used_title": "Cette invitation a déjà été utilisée",
+      "invitation_used_description": "Un compte a déjà été créé avec cette invitation. Connectez-vous pour continuer.",
       "description": "Vous avez été invité. Choisissez votre nom et un mot de passe pour nous rejoindre.",
       "submit": "Créer mon compte"
     },
@@ -55,8 +64,8 @@
       "title_success": "Mot de passe modifié",
       "title_forget": "Mot de passe oublié",
       "description_success": "Votre mot de passe a été réinitialisé. Connectez-vous avec votre nouveau mot de passe.",
-      "description_validation": "Nous avons envoyé un code à 6 chiffres à {email}. Saisissez-le pour choisir un nouveau mot de passe.",
-      "description_forget": "Saisissez l'adresse e-mail de votre compte. Nous vous enverrons un code à 6 chiffres pour réinitialiser votre mot de passe.",
+      "description_validation": "Nous avons envoyé un code à 6 caractères à {email}. Saisissez-le pour choisir un nouveau mot de passe.",
+      "description_forget": "Saisissez l'adresse e-mail de votre compte. Nous vous enverrons un code à 6 caractères pour réinitialiser votre mot de passe.",
       "error_title": "Erreur de réinitialisation",
       "title_inbox": "Consultez votre boîte mail",
       "send_code": "Envoyer le code",
@@ -368,7 +377,8 @@
           "add_method": "Ajouter une méthode",
           "add_named": "Ajouter « {method} »",
           "password_prompt": "Confirmez votre mot de passe pour ajouter une méthode de connexion.",
-          "password_continue": "Continuer"
+          "password_continue": "Continuer",
+          "email_setup_description": "Nous avons envoyé un code à 6 chiffres à {email}. Saisissez-le pour activer les codes par e-mail."
         },
         "backup": {
           "title": "Codes de secours",
@@ -415,6 +425,7 @@
           "email_already_used": "Cette adresse e-mail est déjà utilisée par un autre compte.",
           "invalid_2fa_code": "Ce code de vérification est invalide ou a expiré.",
           "rate_limited": "Patientez une minute avant de demander un autre code.",
+          "email_change_too_many_attempts": "Trop de codes erronés. Demandez-en un nouveau.",
           "no_backup_codes": "Vous n'avez aucun code de secours.",
           "session_not_found": "Cette session n'existe plus."
         }
@@ -442,6 +453,11 @@
       "identity_malformed": "Le fournisseur a renvoyé une identité inexploitable, réessayez."
     },
     "rate_limited": "Trop de tentatives, réessayez dans une minute.",
-    "too_many_sign_in_attempts": "Trop de tentatives de connexion. Réessayez dans quelques minutes."
+    "too_many_sign_in_attempts": "Trop de tentatives de connexion. Réessayez dans quelques minutes.",
+    "too_many_2fa_attempts": "Trop de codes erronés. Revenez en arrière et reconnectez-vous avec votre mot de passe.",
+    "too_many_2fa_attempts_account": "Trop de codes erronés sur ce compte. Patientez jusqu'à une heure, puis reconnectez-vous.",
+    "2fa_challenge_used": "Cette vérification est déjà validée. Reconnectez-vous avec votre mot de passe.",
+    "invalid_2fa_token": "Cette vérification a expiré ou n'est pas valide. Reconnectez-vous avec votre mot de passe.",
+    "too_many_current_password_attempts": "Trop de mots de passe erronés. Patientez 15 minutes, puis réessayez."
   }
 }

package/frontend-vue/layers/dms-core/app/composables/useFieldErrors.ts

@@ -126,7 +126,8 @@ const FIELD_PREFIXED_MESSAGE = /^([\w.]+):\s+(.+)$/s;
 const BARE_I18N_KEY = /^[a-z0-9_]+(\.[a-z0-9_]+)+$/i;
 const LIST_SEPARATOR = /\s*,\s*/;
 
-function statusOf(error: unknown): number | undefined {
+/** The HTTP status of a fetch error; undefined for a network failure. */
+export function apiErrorStatus(error: unknown): number | undefined {
   if (typeof error !== "object" || error === null) return undefined;
   const { statusCode, status, response } = error as FetchErrorLike;
   return statusCode ?? status ?? response?.status;
@@ -321,7 +322,7 @@ export function resolveFieldErrors<F extends string>(
   error: unknown,
   options: ResolveFieldErrorsOptions<F>,
 ): FieldErrorResolution {
-  const status = statusOf(error);
+  const status = apiErrorStatus(error);
   if (!isClientError(status)) return { fields: [], hasUnmatched: true };
   const body = bodyOf(error);
   const mapped = lookupCode(codeOf(body), options.codes);

package/frontend-vue/layers/dms-core/app/types/menu.ts

@@ -6,6 +6,19 @@ export type MenuItemVariant = "default" | "accent";
 /** Semantic state dot of a menu entry, mirroring `MenuItemStatus` in the backend. */
 export type MenuItemStatus = "success" | "warning" | "error" | "neutral";
 
+/**
+ * Tone of a counted menu badge, mirroring `Tone` in the backend: the server
+ * serves it as `badgeTone` next to `badge`; neutral when absent.
+ */
+export type MenuItemBadgeTone =
+  | "neutral"
+  | "primary"
+  | "secondary"
+  | "success"
+  | "warning"
+  | "error"
+  | "info";
+
 /** Query parameters carried by a menu entry's link. */
 export type MenuItemQuery = Record<string, string>;
 
@@ -27,6 +40,8 @@ export interface DmsMenuItem extends NavigationMenuItem {
   fullId?: string;
   variant?: MenuItemVariant;
   status?: MenuItemStatus;
+  /** The tone of the entry's counted `badge`. */
+  badgeTone?: MenuItemBadgeTone;
   /**
    * Set by "Preview as role" only, on an entry the previewed role could not
    * open: the menu draws it hatched and locked. Never set outside a preview.

package/frontend-vue/layers/dms-core/i18n/locales/core-en-GB.json

@@ -56,8 +56,11 @@
     "email_already_requested": "This email address has already been requested. Please wait before trying again.",
     "email_validation_disabled": "Email validation is disabled on this instance.",
     "invalid_token": "The validation code is invalid.",
-    "invalid_or_expired_token": "This link is invalid or has expired. Please request a new one.",
+    "invalid_or_expired_token": "This code is invalid or has expired. Please request a new one.",
     "invite_expired": "This invitation has expired. Please request a new one.",
+    "invite_revoked": "This invitation was revoked. Please request a new one.",
+    "invite_replaced": "This invitation was replaced by a newer email. Please open the latest one.",
+    "invite_used": "This invitation was already used. Please log in.",
     "onboarding_already_completed": "Onboarding already completed.",
     "admin_already_set": "An administrator account already exists.",
     "user_creation_failed": "The user account could not be created. Please try again.",

package/frontend-vue/layers/dms-core/i18n/locales/core-fr-FR.json

@@ -56,8 +56,11 @@
     "email_already_validated": "Cette adresse e-mail a déjà été validée.",
     "email_validation_disabled": "La validation par e-mail est désactivée sur cette instance.",
     "invalid_token": "Le code de validation est invalide.",
-    "invalid_or_expired_token": "Ce lien est invalide ou a expiré. Veuillez en demander un nouveau.",
+    "invalid_or_expired_token": "Ce code est invalide ou a expiré. Veuillez en demander un nouveau.",
     "invite_expired": "Cette invitation a expiré. Veuillez en demander une nouvelle.",
+    "invite_revoked": "Cette invitation a été révoquée. Veuillez en demander une nouvelle.",
+    "invite_replaced": "Cette invitation a été remplacée par un e-mail plus récent. Veuillez ouvrir le plus récent.",
+    "invite_used": "Cette invitation a déjà été utilisée. Veuillez vous connecter.",
     "onboarding_already_completed": "L'onboarding a déjà été completé.",
     "admin_already_set": "Un compte administrateur existe déjà.",
     "user_creation_failed": "Le compte utilisateur n'a pas pu être créé. Veuillez réessayer.",

package/frontend-vue/layers/dms-layout/app/assets/css/main.css

@@ -196,6 +196,13 @@
     --dms-shadow-cmdk:
       0 1px 2px rgb(11 17 20 / 0.06), 0 30px 80px rgb(11 17 20 / 0.18);
     --dms-halo-accent: 0 0 0 6px rgb(27 162 175 / 0.12);
+    /* Assistant mode swaps the accent halo for a violet (secondary) one,
+       and tints its surfaces and lines with the same violet. Plain rgb():
+       Chromium fringes the anti-aliased edge of an oklab colour-mix border
+       with its complementary yellow. */
+    --dms-assistant-halo: 0 0 0 6px rgb(124 58 237 / 0.1);
+    --dms-assistant-tint: rgb(124 58 237 / 0.08);
+    --dms-assistant-line: rgb(124 58 237 / 0.3);
     /* Base surfaces (v2 --shadow-card/-pop/-modal, --overlay, --glow-accent):
      cards, floating panels (menus, popovers, toasts), modals and drawers,
      their backdrop, and the ring of a selected card. */
@@ -313,6 +320,9 @@
     --dms-shadow-cmdk:
       0 50px 140px rgb(0 0 0 / 0.7), inset 0 1px 0 rgb(255 255 255 / 0.04);
     --dms-halo-accent: 0 0 0 8px rgb(77 217 230 / 0.07);
+    --dms-assistant-halo: 0 0 0 8px rgb(167 139 250 / 0.09);
+    --dms-assistant-tint: rgb(167 139 250 / 0.12);
+    --dms-assistant-line: rgb(167 139 250 / 0.4);
     --dms-shadow-card: inset 0 1px 0 rgb(255 255 255 / 0.03);
     --dms-shadow-pop: 0 16px 40px rgb(0 0 0 / 0.55), 0 0 0 1px rgb(0 0 0 / 0.2);
     --dms-shadow-modal:
@@ -540,6 +550,16 @@
   }
 }
 
+/* The violet sweep across the command palette's assistant skeleton. */
+@keyframes dms-assistant-sweep {
+  from {
+    transform: translateX(-120%);
+  }
+  to {
+    transform: translateX(120%);
+  }
+}
+
 @keyframes dms-fresh-in {
   from {
     opacity: 0;

package/frontend-vue/layers/dms-layout/app/build/components/layout/CommandPaletteAssistantAnswer.vue

@@ -0,0 +1,75 @@
+<script setup lang="ts">
+import { computed, onErrorCaptured, ref } from "vue";
+import { EYEBROW_CLASS } from "#dms-ui/app/build/utils/eyebrow";
+
+interface CommandPaletteAssistantAnswerFrameProps {
+  /** The assistant's resolved label, shown as the frame's eyebrow. */
+  label: string;
+  icon: string;
+  /** Registered name of the module's answer component. */
+  component: string;
+  prompt: string;
+  close: () => void;
+}
+
+const props = defineProps<CommandPaletteAssistantAnswerFrameProps>();
+const { t } = useI18n();
+
+const answerComponent = computed(() => resolveDmsComponent(props.component));
+const isLoading = ref(true);
+const hasFailed = ref(false);
+const eyebrowClass = [
+  EYEBROW_CLASS,
+  "mb-2 flex items-center gap-1.5 text-secondary",
+];
+// Line widths of the loading skeleton, after the v2 mockup.
+const SKELETON_WIDTHS = ["w-[82%]", "w-[64%]", "w-[40%]"];
+
+// A rejected async setup would leave the skeleton up for good: the frame
+// states the failure instead, and the other palette content keeps working.
+onErrorCaptured((error) => {
+  console.error("[command-palette] the assistant answer failed", error);
+  hasFailed.value = true;
+  isLoading.value = false;
+  return false;
+});
+</script>
+
+<template>
+  <section
+    class="text-toned m-1.5 rounded-xl border border-(--dms-assistant-line) bg-(--dms-assistant-tint) px-4 py-3.5 text-left text-sm/relaxed"
+    :aria-label="props.label"
+    :aria-busy="isLoading"
+    data-slot="assistantAnswer"
+  >
+    <p :class="eyebrowClass">
+      <UIcon :name="props.icon" class="size-3.5" />
+      {{ props.label }}
+    </p>
+    <p v-if="hasFailed || !answerComponent" role="alert" class="text-muted">
+      {{ t("commandPalette.assistant.failed") }}
+    </p>
+    <Suspense v-else @pending="isLoading = true" @resolve="isLoading = false">
+      <component
+        :is="answerComponent"
+        :prompt="props.prompt"
+        :close="props.close"
+      />
+      <template #fallback>
+        <div
+          role="status"
+          class="after:via-secondary/25 relative grid gap-2.5 overflow-hidden py-1.5 after:absolute after:inset-0 after:bg-linear-100 after:from-transparent after:from-30% after:to-transparent after:to-70% motion-safe:after:animate-[dms-assistant-sweep_1.6s_ease-out_infinite]"
+        >
+          <span class="sr-only">
+            {{ t("commandPalette.assistant.loading") }}
+          </span>
+          <USkeleton
+            v-for="width in SKELETON_WIDTHS"
+            :key="width"
+            :class="['h-3 bg-(--dms-assistant-tint)', width]"
+          />
+        </div>
+      </template>
+    </Suspense>
+  </section>
+</template>