@autobusal/common 1.36.1 → 1.37.0

package/Button/Button.tsx

@@ -5,6 +5,13 @@ interface Props {
   type?: 'button' | 'submit'
   size?: 'medium' | 'small'
   loading?: boolean
+  /*
+   * Claude - 2026-08-30: a button that cannot be disabled is a real gap, not
+   * a style choice - the screen that hit it (bulk send with nothing selected)
+   * had to fall back to a bespoke <button> to express it, which is how that
+   * screen ended up not looking like the rest of the dashboard.
+   */
+  disabled?: boolean
   active?: boolean
   subtype?: 'secondary' | 'delete'
   text: string | JSX.Element
@@ -19,7 +26,7 @@ interface Props {
   value?: string
 }
 
-const Button = ({ type, size, loading, active, subtype, text, noMargin, maxWidth, onClick, name, value }: Props) => (
+const Button = ({ type, size, loading, disabled, active, subtype, text, noMargin, maxWidth, onClick, name, value }: Props) => (
   <ButtonStyled
     $size={ size }
     type={ loading ? 'button' : type }
@@ -27,6 +34,12 @@ const Button = ({ type, size, loading, active, subtype, text, noMargin, maxWidth
     $subtype={ subtype }
     $margin={ noMargin ? false : true }
     $maxWidth={ maxWidth }
+    /*
+     * A loading button is disabled too: it already refuses to submit (the
+     * type swap above), and without this the pointer still says "click me"
+     * while a request is in flight.
+     */
+    disabled={ disabled || loading }
     onClick={ onClick }
     name={ name }
     value={ value }

package/Button/styles.ts

@@ -70,4 +70,14 @@ export const ButtonStyled = styled.button<ButtonType>`
   &:hover {
     box-shadow: 0 4px 15px ${ props => props.theme.primary.normal };
   }
+  /*
+   * Claude - 2026-08-30: a disabled button has to LOOK unavailable, or the
+   * only feedback is a click that does nothing. Faded rather than restyled,
+   * so it is still recognisably the same button in the same place.
+   */
+  &:disabled {
+    opacity: 0.5;
+    cursor: not-allowed;
+  }
+
 `;

package/Drive/Drive.tsx

@@ -26,7 +26,10 @@ const Drive = ({ locations, t }: Props): JSX.Element => {
   }
 
   // we get the coordinates for the roads to paint
-  const geometryData = MapData?.features[0].geometry.coordinates;
+  // Claude - 2026-08-29 (audit A7-26): ONE feature now, not a GeoJSON
+  // envelope - and optional the whole way down, because "no line to draw" is
+  // an ordinary answer here rather than only a failed request
+  const geometryData = MapData?.geometry?.coordinates;
 
   // we paint the drive lines
   const lines = geometryData?.map((item, index) => {

package/Drive/services.ts

@@ -1,32 +1,41 @@
 import { useQuery, UseQueryResult } from '@tanstack/react-query';
 import { apiClient } from '@autobusal/providers';
-import { GeoJsonData } from './types';
+import { DriveLine } from './types';
 
-export const useGetDriveData = (coordinates: number[][]): UseQueryResult<GeoJsonData> => (
+export const useGetDriveData = (coordinates: number[][]): UseQueryResult<DriveLine | null> => (
   useQuery({
     // Edited: Ferjolt Ozuni - Date: 2026-08-01
     // The key was a bare ['drive-data'] with the coordinates absent, so
     // every route on the site shared one cached itinerary: open one route
     // page and then another, and the second drew the first one's road line.
     queryKey: ['drive-data', { coordinates }],
-    // With no key configured (or a route with fewer than two placed stops)
-    // this only buys a 401 and a console error on every route page view.
-    // Skipping it leaves the map showing stops and no road, which is what
-    // it already did - just quietly.
-    enabled: Boolean(import.meta.env.VITE_OPEN_ROUTE_SERVICE_KEY) && coordinates.length > 1,
+    /*
+     * Claude - 2026-08-29 (audit A7-26, low)
+     *
+     * ASKED THROUGH OUR OWN API, not from the browser. OpenRouteService
+     * answers a browser with no Access-Control-Allow-Origin, so this request
+     * never actually left - every route page logged a CORS failure and drew
+     * its stops with no road between them. And it carried a metered
+     * third-party API key, in the bundle, on a public page.
+     *
+     * obtapi has asked ORS from the server since August for the DISTANCE on
+     * this very geometry (Libraries\Routes\Distance, whose own header
+     * explains why); this is the same call with the line kept. Cached
+     * server-side per geometry, so one answer serves every visitor to a pair
+     * instead of each of them paying for their own.
+     *
+     * The coordinates go over as [lat, lng] pairs - the order this codebase
+     * writes a coordinate in everywhere except the ORS request itself, which
+     * the server now flips.
+     */
+    enabled: coordinates.length > 1,
     queryFn: async () => (
       await apiClient
-        .post('https://api.openrouteservice.org/v2/directions/driving-car/geojson', {
-          coordinates
-        }, {
-          headers: {
-            Authorization: import.meta.env.VITE_OPEN_ROUTE_SERVICE_KEY
-          },
-          withCredentials: false,
-          withXSRFToken: false
+        .post('/api/routes/directions', {
+          points: coordinates.map(point => [point[1], point[0]])
         })
         .then(response => (
-          response.data
+          response.data?.line ?? null
         ))
     )
   })

package/Drive/types.ts

@@ -1,11 +1,15 @@
-export interface GeoJsonData {
-  features: FeaturesData[]
-}
-
-interface FeaturesData {
+/**
+ * Claude - 2026-08-29 (audit A7-26): the drive line is now ONE feature, not
+ * a GeoJSON envelope - obtapi's /routes/directions returns the LineString it
+ * picked out of the provider's answer, or null when there is no line to draw
+ * (no provider configured, fewer than two placed stops, or the provider
+ * unreachable). That also removes the `features[0]` the consumer subscripted,
+ * which was one empty collection away from throwing.
+ */
+export interface DriveLine {
   geometry: GeometryData
 }
 
 interface GeometryData {
   coordinates: string[][]
-}
+}

package/Seats/Preview.tsx

@@ -18,6 +18,21 @@ const Preview = ({ bus, occupied, picked, selected, t, onSelect, onClose }: Prop
   const items = bus.seats.map((item, index) => {
     const isOccupied = occupied.includes(item.no) || picked.includes(item.no);
 
+    /*
+     * Claude - 2026-08-29 (audit A3-08c, low)
+     *
+     * A TAKEN SEAT SAYS SO, rather than only being red. It stayed an enabled
+     * button whose click was silently swallowed, and colour was the single
+     * thing distinguishing it - so a colour-blind buyer, a screen-reader
+     * user, or anybody on a washed-out phone screen in daylight could only
+     * tell a sold seat from a free one by clicking it and getting nothing.
+     *
+     * `disabled` rather than a quiet no-op, because that is what stops a
+     * pointer, a keyboard and assistive technology at once; onSelect keeps
+     * its own guard regardless. The title carries the reason for a mouse and
+     * aria-label carries it for a reader, since the visible content is a bare
+     * seat number either way.
+     */
     return (
       <ButtonOccupy
         key={ index }
@@ -28,6 +43,12 @@ const Preview = ({ bus, occupied, picked, selected, t, onSelect, onClose }: Prop
         $height={ item.height }
         $selected={ selected === item.no }
         $occupied={ isOccupied }
+        disabled={ isOccupied }
+        aria-pressed={ selected === item.no }
+        title={ isOccupied ? t('seats.taken', { ns: 'common', number: item.no }) : undefined }
+        aria-label={ isOccupied
+          ? t('seats.taken', { ns: 'common', number: item.no })
+          : t('seats.free', { ns: 'common', number: item.no }) }
         onClick={ () => onSelect(item.no, isOccupied) }
       >
         <MdEventSeat /> { item.no }

package/Seats/styles.ts

@@ -89,12 +89,25 @@ export const ButtonOccupy = styled.button<{
     background: ${ props => props.theme.primary.normal };
   ` }
 
+  /*
+   * Claude - 2026-08-29 (audit A3-08c, low): a taken seat is disabled as well
+   * as red, so it reads as unavailable to somebody who cannot see the colour.
+   * The strike-through and the cursor are the non-colour half of that signal;
+   * losing the hover response is the other half - a control that answers
+   * nothing should not look like it is about to.
+   */
   ${ props => props.$occupied && css`
     color: #FFFFFF;
     background: ${ props => props.theme.font.error };
+    text-decoration: line-through;
   ` }
 
-  &:hover {
+  &:disabled {
+    cursor: not-allowed;
+    opacity: .75;
+  }
+
+  &:hover:not(:disabled) {
     opacity: .8;
   }
 `;

package/Table/Actions/Icon.tsx

@@ -1,6 +1,6 @@
 import { TFunction } from 'i18next';
 import { AiOutlineCheck, AiOutlineCloudDownload } from 'react-icons/ai';
-import { BiEditAlt, BiTransfer, BiTrash } from 'react-icons/bi';
+import { BiEditAlt, BiEnvelope, BiMessageDetail, BiTransfer, BiTrash } from 'react-icons/bi';
 import { FaCity, FaTrash } from 'react-icons/fa';
 import { GiMoneyStack } from 'react-icons/gi';
 import { IoDocumentLockOutline } from 'react-icons/io5';
@@ -22,6 +22,25 @@ const Icon = ({ type, t }: Props): (JSX.Element | null) => {
     case 'delete':
       return <BiTrash title={ t('table.actions.delete', { ns: 'common' }) } />;
 
+    /*
+     * Claude - 2026-08-30: two verbs the operator-invitation list needs.
+     *
+     * Added to the shared vocabulary rather than drawn as bespoke buttons on
+     * that one screen: an action that looks like an action everywhere else is
+     * the entire point of this component, and the screen that prompted this
+     * had hand-rolled its own row controls precisely because these were
+     * missing.
+     *
+     * 'compose' is writing the text that will be sent; 'send' is sending it.
+     * Two steps, two icons - a single 'mail' for both would make the
+     * destructive-ish one (it really posts) look like the harmless one.
+     */
+    case 'compose':
+      return <BiMessageDetail title={ t('table.actions.custom.compose', { ns: 'common' }) } />;
+
+    case 'send':
+      return <BiEnvelope title={ t('table.actions.custom.send', { ns: 'common' }) } />;
+
     case 'login_as':
       return <RiLoginCircleLine title={ t('table.actions.custom.login_as', { ns: 'common' }) } />;
 

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@autobusal/common",
-  "version": "1.36.1",
+  "version": "1.37.0",
   "author": "Ferjolt Ozuni",
   "type": "module",
-  "main": "index.ts"
+  "main": "index.ts",
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/CHANGELOG.md

@@ -1,771 +0,0 @@
-# Changelog
-
-## 1.36.0 (2026-08-29)
-
-- Editors offer Save & Close alongside Save & Stay, so correcting a record no longer bounces you back to its list every time (opt-in per page, editing only). The pair is driven from here (Viewer + Actions).
-
-## 1.35.0 (2026-08-29)
-
-- RouteFeature's compact chip draws a real tooltip on hover AND on focus, so a tap reveals the amenity name; `title` alone was invisible on touch and slow on desktop.
-- Calendar treats an unparseable defaultValue as nothing chosen, and anchors an empty picker on its minDate - so a floored picker (the return leg) opens on the month being travelled rather than on today or on January.
-
-## 1.34.1 (2026-08-29)
-
-- Meta's stale-tag cleanup can no longer remove a tag React owns: it now identifies leftovers by having existed before React rendered, not by comparing values (Sentry BUSMAGUS-7 - on a prerendered page the leftover and the live tag carry the same value, so the old comparison deleted React's own node and the next navigation crashed on removeChild).
-
-## 1.34.0 (2026-08-29)
-
-- Calendar renders one month per page - the neighbouring months' days are blank padding now, so a grid no longer shows two different 1sts and 31sts.
-- Calendar takes `maxYears`, raising a single picker's ceiling above what its type allows (booking pickers stay at one year); Viewer forwards it on 'picker' rows.
-- New SearchableSelect: a <select> you can type into - accent-insensitive matching, group headings, inert disabled options, written for the operator's stop picker.
-- BackWithTitle takes `actions`, rendered as pill links at the far end of the title line.
-- Table row actions for 'cities' and 'stations'.
-
-## 1.33.14 (2026-08-26)
-
-- ChooseSeat: seat-selection add-on mode - `optional` + `fee` props; unpicked state shows the free-auto note, a made choice gets a back-to-automatic control. Default behaviour (required free pick) unchanged.
-
-## 1.33.13
-
-### Fixed
-
-- **`RouteItem` no longer advertises "From 0.00"**: zero-fare rows are unpriced legs search never sells, so they no longer count toward the cheapest-of figure. (Audit RT-11b.)
-
-## 1.33.12
-
-### Added
-
-- **`DefaultLocaleGate`** - the mirror of `LocaleGate` for the UNPREFIXED public branch: a visitor whose stored language is not the brand default is redirected from `/help` to `/{lang}/help`, so the page shown always matches the address (and its canonical). Crawlers carry no localStorage and keep seeing the canonical default-language page. (Audit decision CMS-07c.)
-
-## 1.33.11
-
-### Fixed
-
-- **The "Add Funds" link in the Agents and Visitors lists 404'd.** It pointed at `/admin/funds/manage/:id`, a route that has never existed; the funds form lives at `/account/funds/manage/:id` (admin + financer). (Platform audit ADM-06g.)
-
-## 1.33.9
-
-### Fixed
-
-- **Every field built through `Viewer` was unnamed.** The label was a `<span>` beside an input with no id, so each one announced as a bare "edit text" and clicking a label did nothing - across every admin and account form in the app, not one screen. `Item` now mints a `useId`-prefixed id for single-control rows and the label is a real `<label htmlFor>`. Additive: no caller changes, and the styled rule set was empty either way.
-
-### Added
-
-- `Table` and `Viewer` take an optional `confirm`, so a destructive action can ask a question specific to what it destroys rather than the generic one. Existing callers keep the generic question.
-
-## 1.33.8
-
-### Added
-
-- **`Table` headers can sort.** A header cell now takes an optional sort key and direction and renders as a control when it does, so a table backed by a paginated, server-sorted endpoint can drive it from the header rather than a separate control. Tables that pass no sort key are untouched and render exactly as before.
-
-## 1.33.7
-
-### Changed
-
-- **`Required` renders a real `<label>`, and takes an optional `htmlFor`.** It was a `styled.span` sitting beside the field it named, which is a label to a sighted reader and nothing at all to a screen reader - every field it introduced announced as a bare "edit text". Nothing in the stylesheets selects `label` and a flex item computes identically either way, so this is semantics only.
-- **`Password` and `Calendar` take an optional `id`.** A caller cannot associate a visible label with a field it has no way to name, so the shared inputs had to be able to accept one before the forms using them could be fixed.
-- `AiAssist/AiReviewModal` runs its three HTML panes through `sanitizeHtml`. Everything the model returns is HTML rendered into an admin's browser, and every other sink in the codebase sanitises; this one did not.
-
-## 1.33.6
-
-### Added
-
-- **New `Map/Tiles` component - the one place the basemap comes from.** The same `TileLayer` line was copy-pasted into `Drive.tsx`, `@autobusal/map`'s `Display.tsx` and magus's own `RouteMap.tsx`, with a fourth copy in the mobile app, all hardcoding `tile.openstreetmap.org`. OSM's Tile Usage Policy does not cover commercial or heavy application use, and those servers throttle or block by referer and volume without notice - so the exposure was never the bill, it was that reacting to a block meant editing three repos, publishing to npm, redeploying both frontends and shipping a mobile store release.
-
-  The URL now comes from `/settings/get` (`map.tile_url`) rather than the build, so all four clients switch from one server env var. `null` - the state until a provider is chosen - means the built-in OpenStreetMap default, so this changes nothing for anyone on upgrade. Attribution is rendered by the component rather than travelling with the URL, since ODbL requires it whoever serves the tiles.
-
-### Changed
-
-- `Drive.tsx` renders `<Tiles />` instead of its own `TileLayer`.
-
-## 1.33.4
-
-### Added
-
-- **New `LocalizedFields` component** - a generic per-language field editor generalising SeoOverride (fixed to title/description) and Faqs/Translations (fixed to question/answer) into one taking an arbitrary field list. A section with just one translatable field (a category name, a menu label) no longer needs its own bespoke ~120-line copy of the same editor to support more than English+Albanian.
-
-## 1.33.3
-
-### Added
-
-- **`RouteItem` shows a "from" price** next to the route name/code - the lowest fare across the route's own `prices`, using the row's own pre-formatted `adult_display` (same currency/decimal convention as everywhere else). Both `browse` and `view` modes get it; a route with no prices at all shows nothing, same as it always could.
-
-## 1.33.2
-
-### Added
-
-- **`Meta` now defaults `og:image`/`twitter:image` to the label's own homepage hero photo** (`{settings.url}/home/background-light.jpg`) when a page doesn't pass its own `image`. Most of the ~136 call sites never had a share-preview image at all, so a link pasted into a chat assistant or social post previewed with nothing. A page with something more specific (an operator's logo, a blog post's own photo) still passes its own `image` and wins - this only fills the gap.
-
-## 1.33.1
-
-### Added
-
-- **`Table` accepts an optional `onReorder(draggedId, targetId)` prop.** When set, every row becomes an HTML5 drag source/drop target (dims to 40% opacity while being dragged) and a completed drag reports the dragged row's id and the row it was dropped on - the caller decides what "reorder" means for its own data. Omitted by every existing table, so this is purely additive; first consumer is `@autobusal/admin-menu` 1.1.2.
-
-## 1.33.0
-
-### Fixed
-
-- **`Viewer`'s `type: 'component'` rows never actually rendered, anywhere.** `Data.tsx` returned `null` for any item whose `name` was `undefined` before the switch statement that handled `'component'` ever ran - and a component row never HAS a name, it isn't a registered form field. Every SectionHeading divider, every `AiFieldAssist` Generate/Improve/Translate trigger, and every description paragraph moved inside a form's own box (SMS/Flex, this cycle) had silently never rendered, in any tab that used one, despite compiling clean and sitting right there in the bundle. Moved the `'component'` case to an early return above the name guard instead of weakening the guard's condition, which would have broken TypeScript's narrowing of `item.name` to `string` for every other case below it.
-- **AI trigger buttons and the review modal rendered raw i18n keys** (`ai_assist.trigger.generate`) instead of translated text. `ai_assist.*` lives in the `common` namespace, but the `t` passed into `AiFieldAssist`/`AiReviewModal` defaults to whatever namespace the calling page's own `useTranslation()` uses (`normal`/`whitelabel`) - every call now passes `{ ns: 'common' }`.
-- **`AiReviewModal` showed a generic "Request failed with status code 422"** instead of the real provider error on a failed generate/translate/improve. Removed its local error state/display entirely - `apiClient`'s existing global response interceptor already toasts `error.response.data.message` on any 422, the same mechanism every other form in the app already relies on; a local `onError` reading react-query's plain `Error.message` could only ever see Axios's generic text, never the backend's.
-
-## 1.32.0
-
-### Added
-
-- **Drag & drop on `File`**, the shared upload control used everywhere in the app - drop a file directly onto it instead of always going through the native picker. The control's own footprint (a single 38px-tall inline button) is unchanged everywhere it is already used; only a border/background highlight appears while dragging. A dropped file is handed to the same hidden `<input>` react-hook-form already registered, via a real dispatched `change` event, so every existing caller's validation/onChange keeps working with no changes on their end.
-
-### Fixed
-
-- **A checkbox row with a long notice no longer stretches sideways.** `.row-checkbox`'s label+input are laid out `flex-direction: row-reverse`, and the row's own notice/error text (a plain div) was sharing that same row - a short notice fit fine, but a longer one (two sentences, easily) stretched the row's WIDTH to fit on one line, visibly pushing the checkbox by however long the text happened to be. Every div child of a checkbox row now gets `flex-basis: 100%`, dropping straight onto its own full-width line; the label and input are unaffected.
-
-## 1.31.0
-
-### Added
-
-- **A `row-component` field spans the full row width**, same as `row-textarea-html` already did - what lets a Viewer form's own section headings (`SectionHeading`, admin-label's Content/styles.ts) sit as a full-width divider instead of sharing a row with whatever field lands beside them.
-
-## 1.30.0
-
-### Changed
-
-- **`Viewer`'s field grid stays at two columns on every screen width.** It
-  used to widen to three columns at >=1300px - fine for a form of
-  independent, unrelated fields, but a form built for a two-column rhythm
-  (one field, a divider row, a related pair, a divider row, ...) reflows
-  into three and starts mixing fields from different logical groups onto
-  the same row, with nothing to say which group a given row belongs to.
-  Affects every Viewer-based form in the app, not just admin-label's.
-
-## 1.29.0
-
-### Added
-
-- **`AiFieldAssist` + the AI review modal.** The one AI-review surface every
-  content admin form shares - Generate/Improve/Translate triggers that open
-  a modal where a draft is always reviewed (and can be hand-edited or
-  revised on a follow-up instruction) before an explicit Insert writes it
-  into the calling field. Renders nothing at all when no AI provider is
-  enabled for the label - the visibility gate the AI plan calls for, with
-  no separate flag to keep in sync.
-- **`Viewer`'s `'component'` field type accepts a function** of the form's
-  own `setValue`, not just plain JSX - the only way a component embedded in
-  the field list (AiFieldAssist writing a draft into a SIBLING field like
-  content_en) can reach state Viewer has always kept internal. Existing
-  callers passing plain JSX are unaffected.
-
-## 1.28.0
-
-### Added
-
-- **`Row` takes an optional `actions`**, overriding the table's list for that
-  row. The table-level prop is one array for every row, which cannot express
-  an action only some rows have earned - a ticket download belongs to a paid
-  order and to no other. `Rows` falls back to the table's list, so every
-  existing caller is unaffected.
-- **`print` and `invoice` row-action icons.** Distinct from the existing
-  generic `download`.
-
-
-## 1.27.5
-
-### Added
-
-- **`placeholder` on a `select`** — a leading empty option, for "nothing
-  chosen".
-
-  A select whose value matches no option silently displays the first one and
-  the browser submits it as though it had been picked. That is exactly how
-  every profile whose owner never touched the country field was saved as
-  **Afghanistan**: it sorts first, and nothing had ever been selected.
-  Changing the default from `0` to `''` did not help on its own — neither
-  value exists as an option, so the browser fell back either way.
-
-  Rendered only when placeholder text is supplied, so a select with a real
-  default (sex, status, a type) does not grow an empty row it never wanted.
-
-## 1.27.4
-
-### Fixed
-
-- **The calendar allowed a different set of days depending on the visitor's
-  timezone.** Day cells are built with `createDate`, which is `Date.UTC(...)`;
-  the selectable bounds were built with `new Date(y, m, d)` — *local*
-  midnight. Those are not the same instant, so the boundary day fell on
-  either side of the limit depending on where the visitor was sitting.
-
-  The consequence on the money path: **same-day departures were not
-  selectable west of Greenwich.** A visitor in New York or Los Angeles could
-  not pick today, because local midnight there is *after* the cell's UTC
-  midnight, so today's cell tested as below the minimum. Same-day selling was
-  deliberately enabled — this had been quietly undoing it for those visitors,
-  and it is invisible from Europe. Both sides are UTC now, so the comparison
-  is exact and identical everywhere.
-
-  Found while chasing an apparent off-by-one in the birth-date picker, which
-  turned out to be this skew wearing a different hat.
-
-## 1.27.3
-
-### Fixed
-
-- **The birth-date picker offered today, which the API refuses.** obtapi
-  validates with `before:today`, so the calendar was letting you choose an
-  answer and then calling it wrong. It now stops at yesterday.
-
-  The year steps back too when yesterday fell in the previous one: the
-  maximum is built from `today.getFullYear() + limits.max.year`, so on 1
-  January a month/day of 31 December would otherwise have resolved to the
-  coming 31 December rather than the one just gone. Checked against 1
-  January, 1 March and a leap year.
-
-## 1.27.2
-
-### Fixed
-
-- **A birth date no longer defaults to today.** `Calendar` pre-fills with
-  today when given no value, which is right for every other use of it — a
-  departure, a report range, a broadcast day — and wrong for exactly one:
-  nobody is born today. On the profile-completion form it meant anybody who
-  filled in the fields that *looked* empty saved a date of birth of today,
-  silently, and that is the field a passenger's age is judged by when they
-  book. Reproduced end to end: the row saved `dob = <today>`.
-
-  `type="dob"` now starts empty so the field reads as unanswered. The picker
-  still opens on the current month — `createDate('')` is an Invalid Date and
-  the grid built from it renders as nothing — but that anchor is display
-  only; what the form submits stays empty until a day is clicked, and
-  obtapi's new `required|date_format:d/m/Y|before:today` says so if it is
-  left that way.
-
-
-## 1.27.1
-
-### Removed
-
-- **Everything 1.27.0 added for multi-TLD** — `localeHref`, the `LocaleDomain`
-  type, `Meta`'s domain-resolved canonical and hreflang, and
-  `ChangeLanguage`'s cross-domain navigation. `Meta` is back to resolving both
-  from `window.location.origin` plus the `/{locale}/` prefix.
-
-  The product decision changed after the code landed: ccTLDs will **301 to
-  `.com/{locale}/`** rather than be real per-country sites, so none of this
-  had a caller and none of it ever would. A ccTLD's geo signal multiplies
-  content that already exists, and a new ccTLD starts at zero authority while
-  a subdirectory inherits the domain's on day one.
-
-  **Do not downgrade to 1.26.1 to get this** — 1.27.0 is published, so
-  `@latest` would reintroduce it. This version is 1.26.1's behaviour with a
-  higher number.
-
-## 1.26.1
-
-### Fixed
-
-- **`Table` drew an empty "Options" column when a table had only
-  top-of-table controls.** `create`, `search` and `extra` all live *above* the
-  table — `Actions/Get` already returns null for each — but `Header` and
-  `Rows` decided whether to draw the options column from `actions.length > 0`,
-  which counted them. A table using the component purely for sorting, search
-  and paging therefore got an "Options" heading with an empty cell under every
-  row.
-
-  Invisible on the admin screens, where every table has row actions anyway;
-  visible the moment the public bus-company directory used it. The row/top
-  split is one shared list now (`Table/rowActions.ts`) rather than a condition
-  repeated in three files that could drift.
-
-## 1.26.0
-
-### Added
-
-- **`HandoffBanner`** — "You are managing *X* as its administrator", shown on a
-  brand's own domain for the length of a brand handoff, with a **Finish**
-  button that ends the session. Rendered by both apps' private layouts; renders
-  nothing at all unless `/bff/session` reports a handoff, so an ordinary
-  session costs one request. See `magus/BRAND_HANDOFF_PLAN.md`.
-
-  Not the same component as magus's `ImpersonationBanner` and not driven by the
-  same signal: that one reads `localStorage['impersonating']`, which page
-  JavaScript sets and can therefore be wrong. This reads the BFF session, which
-  is the only thing that actually knows. There is also nothing on this origin to
-  *revert* to — the admin's own session is alive and untouched on a different
-  origin — so the action is an explicit end, not a revert.
-
-- **`handoff` action on `Table`** — its own icon and label rather than borrowing
-  `login_as`, for the same reason `reply` is not `approve`: `login_as` changes
-  who you are *within* a brand, a handoff leaves for another brand's domain in a
-  new tab.
-
-### Notes
-
-- **There is deliberately no `pagehide`/`sendBeacon` revoke.** One was built, to
-  shorten the window when somebody closes the tab, and testing removed it:
-  `pagehide` with `persisted === false` also fires on a plain **page refresh**,
-  so F5 revoked the token and dumped the admin on the logged-out screen.
-  Measured — an identical reload driven by curl, with no beacon in play, keeps
-  the session. No browser API distinguishes closing from reloading at that
-  moment, so what remains is two mechanisms that both work (the Finish button
-  and the two-hour token expiry) rather than three where one misfires.
-
-- The banner puts **Finish next to the message** rather than at the far edge.
-  `space-between` reads better but the whitelabel admin's content column is a
-  fixed 1491px that overflows the viewport at ordinary window sizes, which put
-  the button off-screen at x=1856 — the one control that reliably ends the
-  session cannot be the one you have to scroll sideways to find.
-
-## 1.25.1
-
-**The SEO override wears the site's own form clothes.**
-
-`SeoOverride` declared its own `Field`/`Label`/`Input`/`Textarea` and restated the global field styling with *different* values — transparent instead of `inputs.background`, a primary-coloured border, its own font size — then sat on the bare page rather than a card. On a country or city screen that made the two SEO fields the only ones on screen not matching the form directly beneath them, which is the opposite of what its own comment claimed.
-
-It uses `.box` and `.row` now, the site's own card and field classes, with plain inputs so `GlobalStyles` reaches them exactly as it reaches every `Viewer` row. Being controlled is the only thing that genuinely differs from a Viewer row, and that is a state concern, not a visual one. The textarea keeps a single rule, for height: `GlobalStyles` gives every text input 38px, right for one line and useless for a description.
-
-Reaches the label SEO tab too, which had the same problem. Checked it does not land inside another card — `admin-label`'s `Options` is the tab strip, not a wrapper around the tab bodies.
-
-## 1.25.0
-
-**New `setDepartureZone(zone)` — the date picker floors on today WHERE THE COACH LEAVES.**
-
-`setServerToday` was already an improvement on the buyer's device clock, but it is still the wrong clock: it is *our* date, in Tirana, and a coach leaving Bari has nothing to do with it. Only the departure city can say whether the 4th is still today for that journey.
-
-Falls back to `serverToday`, then to the device, so the bare search form (no journey chosen yet) behaves exactly as before. An unresolvable zone returns null and falls back too — a picker that refuses to open because a timezone lookup failed would be far worse than one flooring a day out.
-
-## 1.24.0
-
-**`Policy` is now `Information`.**
-
-- `Policy` → `Information`, `useGetPolicy` → `useGetInformation`, and the endpoint behind it moves from `/api/routes/policy` to `/api/routes/information`. **Breaking**: update the import.
-- `RouteItem`'s `ReadPolicy` → `ReadInformation`, reading `route_item.information`.
-- Translation keys: `policy.title` → `information.title`, `route_item.policy` → `route_item.information`.
-
-The rename follows the Flexible Ticket model, where what a ticket permits comes from the add-on and the operator's own windows — not from this box.
-
-All notable changes to `@autobusal/common` are documented here. This project follows
-[Keep a Changelog](https://keepachangelog.com/) and [Semantic Versioning](https://semver.org/).
-
-> Note: 1.10.0 through 1.15.1 were published without changelog entries. The
-> gap is left as-is rather than reconstructed after the fact.
-
-## 1.23.0
-
-An unbookable date is inert, not merely faded.
-
-It was dimmed and otherwise fully interactive: the pointer cursor and the
-hover highlight still invited a click, and the click was answered with a
-browser alert saying the date was invalid. The calendar offered a day, let
-somebody reach for it, then told them off for taking the offer.
-
-`pointer-events: none` removes it from the conversation entirely — no cursor
-change, no hover, no click to refuse — alongside the `aria-disabled` and
-`tabIndex=-1` already on the element. Unreachable by mouse, keyboard and
-screen reader alike, and the alert is gone with it.
-
-## 1.22.0
-
-The booking calendar floors on the SERVER's date, not the browser's.
-
-`new Date()` is the buyer's device clock, which says nothing about where they
-are travelling. Somebody in Shanghai at 06:00 on the 5th, looking at an
-Italian coach that does not leave until the evening of the 4th, had that day
-greyed out — while the server would have sold them the seat quite happily. The
-calendar was refusing a sale the API accepted.
-
-It also makes the picker agree with the date strip beside it, which has always
-been built server-side; the two used to disagree about which day came first.
-
-A date of birth keeps the local clock, because that one genuinely is about the
-person in front of the screen.
-
-## 1.21.0
-
-`reply` joins the table actions with its own icon and label. The operator
-review page was borrowing `approve`, so the button on a review about them read
-"Approve" — which is the one thing they cannot do to it.
-
-## 1.20.0
-
-`Rating` — stars, average and count, or nothing at all. Rendering nothing is
-the feature: obtapi withholds a score until there are enough published reviews
-to say something honest, so an absent rating has to read as "not saying yet"
-rather than as a zero. Anything filling the gap with empty stars would turn a
-new operator into a badly-rated one. Half stars are drawn, because rounding 3.5
-down loses the difference between middling and good — precisely the range where
-a reader is still deciding.
-
-## 1.19.0
-
-`extra` joins `create` and `search` as a top-of-table slot rather than a
-per-row action. Any table opting into the extra slot also rendered one empty,
-iconless, still-clickable button in every row's options cell — Icon has no
-case for `extra`, so it drew nothing while taking the click. The refund queue
-has been doing this all along; the new review queue would have too.
-
-## [1.18.0] - 2026-08-02
-
-### Added
-
-- **`SeoOverride`** - a per-language editor for the SEO title/description
-  overrides, shared by the label, country and city forms. One language is
-  shown at a time (a brand writes copy for one or two, and thirteen sets of
-  empty inputs invite nobody to fill any of them in) and the languages that
-  already have copy are marked, so it is obvious which are done. Controlled
-  and deliberately form-less: those pages submit every field in one request,
-  so an editor with its own save would either post a partial update or leave
-  two save buttons meaning different things on one screen.
-
-## [1.17.0] - 2026-08-02
-
-### Added
-
-- **Locale-prefixed URLs.** `localiseRoutes()` mirrors an absolute-path route
-  tree under `/:locale`, and `LocaleGate` guards that branch - rejecting a
-  prefix that is not one of the brand's languages, redirecting the default
-  language back to its unprefixed home so only one URL is canonical, and
-  switching i18n to whatever the URL asks for. `splitLocale`/`withLocale`/
-  `localeFromPath` are the shared, router-free definition of a localised
-  path, so the crawler and the sitemap agree with the components.
-- **hreflang alternates on every page.** Emitted from `Meta`, which already
-  sits on ~136 call sites, so every real page gains them at once and a new
-  page cannot forget them. `x-default` points at the unprefixed URL.
-  Suppressed for noindex pages and whenever a caller passes an explicit
-  canonical, which the path-derived alternates would contradict.
-
-### Changed
-
-- **`ChangeLanguage` navigates** instead of only swapping the rendered text -
-  behind an explicit `localised` prop, so the account and admin areas (which
-  are deliberately not locale-prefixed) keep switching in place rather than
-  navigating to a 404.
-- **The canonical drops a trailing slash.** Apache serves a prerendered page
-  from a directory and 301s `/contact` to `/contact/`, so the same page used
-  to advertise whichever form the visitor happened to arrive on. Harmless
-  when it was the only path-derived tag; not harmless now that the alternates
-  come from the same value, because one page would announce two URL sets.
-
-## [1.16.0] - 2026-08-01
-
-### Added
-
-- **The date field can tell its form when the day changes.** `ViewData.onChange`
-  was already honoured by `select` and `checkbox`, but not by `date`/`dob`/
-  `picker`, so a form whose other fields depend on the chosen day had no way
-  to observe it short of not using `Viewer` at all. `Calendar` now takes an
-  optional `onChange(DD/MM/YYYY)` and `Viewer` passes `item.onChange` through
-  to it. Purely additive - existing callers are unaffected.
-
-## [1.15.6] - 2026-08-01
-
-### Changed
-
-- **An admin sees the real site while maintenance is on.** Deliberately
-  admin only - an operator or agent signing in still gets the holding page,
-  because the site is not open to them either. Presentation, not
-  protection: obtapi still decides what any account may do.
-- `Calendar` takes an optional `minDate`, which can only RAISE the floor
-  the type already sets. Used by the return leg so it cannot start before
-  the outbound date.
-
-### Fixed
-
-- `Required` rendered a fragment, so in the column-flex form rows the label
-  and its asterisk became two flex items and the asterisk dropped onto its
-  own line.
-
-## [1.15.5] - 2026-08-01
-
-### Added
-
-- `Required` - marks a form label as mandatory. The asterisk is
-  `aria-hidden`, since a screen reader announcing "star" tells nobody
-  anything; the input's own validation carries the semantics.
-
-## [1.15.4] - 2026-08-01
-
-### Fixed
-
-- **The language dropdown opened upward over the navbar.** It positioned
-  itself with `bottom: calc((-1 * languages * 27px) - 50px - 8px)`, guessing
-  where its own bottom edge should land by multiplying an assumed 27px row
-  height by the language count. The rows are not 27px, so the error grew
-  with every language a brand enabled - at thirteen it was far enough out to
-  open over the page instead of below the trigger. Now `top: 100%`, which
-  needs no arithmetic and cannot drift, plus a height cap so a brand with
-  twenty languages does not run off the screen.
-- **`RouteItem` showed the wrong arrival country.** The city read
-  `locations[lastLocation]` but the country read `locations[1]`. Identical
-  on a two-stop route, wrong on anything longer: Tirana-Veria-Thessaloniki
-  rendered "Thessaloniki (alb)", because `locations[1]` is Elbasan.
-- Country codes render upper case here too, matching the search results.
-
-## [1.15.3] - 2026-08-01
-
-### Changed
-
-- **Language switcher shows just the language name**, left-aligned, with
-  the panel title left-aligned too. The "Change to" prefix on every row
-  said nothing the panel's own title and the flag beside it were not
-  already saying. One component serves both the public header and the
-  panel sidebar, so both are fixed.
-- **The route map fits the trip** instead of sitting at a fixed zoom 6
-  centred on the first stop. Every route drew the same view of the Balkans
-  and none of them filled it, so following a route meant panning.
-
-### Fixed
-
-- **`getCoordinates` sent every interior stop twice** - a four-stop route
-  went out as A,B,B,C,C,D,D,D, with the last point repeated against
-  itself. Directions APIs reject consecutive identical coordinates, so the
-  request failed and the map fell back to bare markers with no road line.
-- **`useGetDriveData` cached on a bare `['drive-data']` key**, with the
-  coordinates absent - so every route on the site shared one itinerary and
-  the second route page you opened drew the first one's road.
-- Stops with no coordinates are dropped rather than plotted at 0,0, which
-  put a pin off the west coast of Africa and dragged the fitted view
-  across the Atlantic.
-- The query is skipped entirely when no `VITE_OPEN_ROUTE_SERVICE_KEY` is
-  configured, instead of a guaranteed 401 on every route page view.
-- A stray `}` inside the `ButtonChange` styled-component template.
-
-## [1.15.2] - 2026-08-01
-
-### Added
-
-- `RouteFeature` takes an optional `compact` prop: icon only, with the name
-  as a hover tooltip and a help cursor to advertise that the hover does
-  something. Opt-in, because the browse and route-view pages have the room
-  and their labels earn it - only the search results card asks for this.
-
-### Fixed
-
-- `RouteFeature`'s image had **no `alt` at all**. That mattered already; it
-  matters more in compact mode, where the image is the only content and a
-  screen reader would otherwise announce nothing whatsoever per amenity.
-
-## [1.9.0] - 2026-07-31
-
-### Added
-
-- **`Viewer`/`Actions`/`Button` support a second submit-type action** via an
-  optional `onTest` prop on `Viewer` and a new `'test'` entry in its
-  `actions` array. A form with two submit buttons can't otherwise tell
-  which one triggered submission - `Button` now forwards a native
-  `name`/`value` pair, and `Viewer`'s `onSubmit` reads the submit event's
-  `submitter` to route to `onTest` instead of `onSave` when the 'test'
-  button was clicked, while keeping the exact same current form values.
-  First consumer: `@autobusal/admin-label` 1.10.0's "Test" button on the
-  SMTP settings tab.
-
-## [1.8.3] - 2026-07-31
-
-### Fixed
-
-- **`Meta.tsx`'s `useSoleMetaOwnership` no longer runs on every render.**
-  It fired on every render of every `<Meta>` usage (136 call sites, no
-  dependency array) and directly removed `<head>` children via raw DOM
-  `.remove()` calls each time. The duplicate-tag problem it exists for -
-  React's `createRoot` not reconciling against tags baked into the
-  prerendered static HTML - can only exist before React's first render;
-  every render after that, `<title>`/`<meta>`/`<link>` in `<head>` are
-  exclusively React 19's own hoisting mechanism's doing, and it already
-  correctly swaps them out as components mount/unmount with no help
-  needed. Re-running this raw removal on every navigation instead raced
-  that hoisting: it could delete a node mid-transition that React's own
-  reconciler still held a reference to, and the next time React tried to
-  remove or replace that now-detached node, `parentNode` was null and it
-  threw an uncaught `TypeError: Cannot read properties of null (reading
-  'removeChild')` - not render-phase, so no `ErrorBoundary` catches it,
-  silently aborting whatever navigation was in flight (URL updates,
-  page never re-renders). This is the actual root cause of the frozen-
-  navigation bug worked around piecemeal in `@autobusal/providers`
-  1.6.6-1.6.8, `@autobusal/hooks` 1.3.1, and `@autobusal/auth`
-  1.5.2-1.5.4 - all of which targeted `GoogleReCaptchaProvider` as a
-  contributing trigger, but the crash reproduced identically with that
-  provider removed entirely, on ~any route rendering `<Meta>`. Now
-  scoped to a module-level flag so the cleanup runs exactly once, on the
-  app's first `<Meta>` mount - it does its one real job (wiping stale
-  prerendered tags before first paint) and never touches the DOM again.
-
-## [1.8.2] - 2026-07-30
-
-### Fixed
-
-- **`Meta.tsx` duplicate description/canonical/OG/Twitter tags.** The
-  existing title-only dedup (`useSoleTitleOwnership`, since 1.5.1) is now
-  `useSoleMetaOwnership` and covers every tag Meta renders, not just
-  `<title>`. Surfaced by the new build-time prerender step: React doesn't
-  reconcile against tags already sitting in `<head>` from a source other
-  than its own current render (a prerendered snapshot's baked-in
-  description, a leftover from a pre-locale-detection render, ...), so
-  multiple `<meta name="description">`/`og:description`/etc could coexist
-  - crawlers commonly read the FIRST occurrence, which could be the stale
-    one, not the page's real content.
-
-## [1.8.1] - 2026-07-30
-
-### Fixed
-
-- **Added `loading="lazy" decoding="async"` to below-the-fold list images**
-  (`BlogItem/Image.tsx` preview/short thumbnails, `CompanyItem.tsx`,
-  `RouteItem.tsx` operator logos) - none had lazy loading, so a search
-  results page or operator/agent listing loaded every logo eagerly
-  regardless of position. `BlogItem/Image.tsx`'s `type="view"` (the single
-  article's own hero image, likely that page's LCP element) instead gets
-  `loading="eager" fetchPriority="high"`.
-
-## [1.8.0] - 2026-07-30
-
-### Added
-
-- **GA4 SPA pageview tracking in `Meta`.** gtag.js only auto-sends a
-  page_view on its initial `config` call - every client-side route change
-  was invisible to analytics (pairs with `@autobusal/providers` 1.6.2, which
-  disables the automatic one). Meta now sends an explicit pageview
-  (`location.pathname + location.search`, current title) whenever the path
-  changes, since it's already rendered on nearly every real page. Excluded
-  from the effect's dependencies on purpose: a title-only change (e.g. a
-  language switch) does not fire a new pageview, only an actual navigation
-  does.
-
-## [1.7.0] - 2026-07-30
-
-### Added
-
-- **New `JsonLd` component** - renders a schema.org `<script type="application/ld+json">` block from a plain object, with `<` escaped to `\u003c` so a string value containing "</script>" can't break out of the tag. No hoisting needed (unlike Meta's title/meta/link) - Google explicitly supports structured data anywhere in the document, so this renders in place. First consumers: `@autobusal/providers`' `Preload.tsx` (sitewide Organization + WebSite) and `route-view`/magus's `BlogView.tsx` (BusTrip/BreadcrumbList, Article).
-
-## [1.6.0] - 2026-07-30
-
-### Added
-
-- **`Meta` now emits a canonical `<link>` and `og:url` on every page by
-  default**, even when the caller passes no `url` prop - previously `url`
-  was never passed at any of this component's ~136 call sites across both
-  apps, so no page anywhere had a canonical tag. Defaults to the current
-  path (`location.pathname`, via `react-router-dom`'s `useLocation`) with
-  the origin prepended - query strings are naturally excluded, so a search
-  results page with `?sfrom=X&sto=Y` or a paginated `?page=N` correctly
-  canonicalizes to its bare path instead of creating unbounded near-duplicate
-  URLs. `url` can still be passed explicitly to override.
-
-## [1.5.1] - 2026-07-30
-
-### Fixed
-
-- **`Meta.tsx` and `@autobusal/providers`'s `Preload.tsx` both render a
-  `<title>`, and React 19's native hoisting (added in 1.5.0, see above) does
-  NOT dedupe `<title>` between separate component instances.** Both ended up
-  as real, simultaneous DOM nodes - technically invalid HTML (a document must
-  not have more than one title element), even though `document.title` itself
-  still resolved correctly by spec ("first title in tree order" happened to
-  always be this one). `Meta` now takes exclusive ownership on mount: it
-  removes any other `<title>` element in `<head>` the instant its own real
-  page title exists, so exactly one survives.
-
-## [1.5.0] - 2026-07-30
-
-### Fixed
-
-- **`Meta.tsx` migrated off `react-helmet` to React 19's native document
-  metadata support.** react-helmet 6.1.0 (unmaintained since ~2021) was
-  discovered to be completely non-functional under React 19: zero of its DOM
-  writes were ever committing on any route, on any fresh page load, in either
-  consuming app - confirmed via the absence of `[data-react-helmet]` in the
-  DOM and by bisecting back through the app's dependency history to before
-  any of today's changes. Every page's `<title>`, `description`, `robots`,
-  `og:*`/`twitter:*` tags were silently frozen at whatever the static
-  `index.html` shipped, for every real user and JS-executing crawler landing
-  directly on a URL. `<title>`/`<meta>`/`<link>` are now rendered as plain
-  elements - React 19 auto-hoists and deduplicates them into `<head>` with no
-  library needed, and the same "deepest/last-rendered wins" semantics Helmet
-  was supposed to provide (a page's own `<Meta>` overriding
-  `@autobusal/providers`'s app-shell fallback title) now actually work.
-
-## [1.4.7] - 2026-07-30
-
-### Fixed
-
-- **Blog thumbnails missing `alt` text (`BlogItem/Image.tsx`).** Neither the
-  preview/short grid thumbnail nor the full article image had `alt` - added a
-  required `title` prop (threaded through from `BlogItem.tsx`'s
-  `article.title`) used as the `alt` text on both.
-
-## [1.4.6] - 2026-07-29
-
-### Fixed
-
-- `Autocomplete/Autocomplete.tsx`: the "From"/"To" route-search inputs kept showing a station's display name in the language that was active when it was selected, since the displayed text (`q`) was plain component state that never resynced when `data` was rebuilt with fresh, relocalized names after a language switch (e.g. "(Alle Stationen)" stayed baked in after switching German -> English). Now re-derives the display name from the selected `value` whenever `data` changes.
-
-## [1.4.5] - 2026-07-28
-
-### Fixed
-
-- `File/File.tsx`: a `required` file-input field blocked saving ANY record that already had a file (image, document, etc.) unless the user re-uploaded it, since a file input can never carry over its previous value - the `required` rule now skips when a `value` (existing file URL) is already present. Found via a live sanity pass: this froze several existing records (e.g. a bus with a real image) out of being editable at all.
-
-## [1.4.4] - 2026-07-24
-
-### Fixed
-
-- `BlogItem.tsx` and `Policy.tsx`: article/policy content is now run through `@autobusal/utilities`'s `sanitizeHtml` before being rendered via `dangerouslySetInnerHTML`, closing an XSS gap where an already-compromised admin account could persist JS in blog articles or policy pages.
-
-## [1.4.3] - 2026-07-19
-
-### Changed
-
-- **`Meta` (`Meta.tsx`) is now brand-configurable, eliminating the per-brand SEO fork.**
-  Merged magus's rich SEO `Meta` (robots, canonical, Open Graph and Twitter card tags, plus
-  optional `image`/`url`/`type`/`noIndex` props) into the shared component, and replaced the
-  hard-coded "BusMagus" strings with a `VITE_APP_NAME` build-time env: the `<title>` suffix,
-  `og:title`/`twitter:title` and `og:site_name` derive from that brand name, and when it is
-  unset the title renders bare (no suffix) with `og:site_name` omitted — so a brand that has
-  not configured a name is unaffected. This lets every whitelabel consume the published
-  `Meta` and pass its own brand via env, instead of magus vite-aliasing `@autobusal/common`
-  to a local `src/modules/Common` copy just to override this one file. `children` is now
-  optional; the prop set is a superset of the previous one, so all existing `<Meta title=…>`
-  call sites are unaffected.
-
-## [1.4.2] - 2026-07-19
-
-### Added
-
-- **Cross-field validation + masked pre-fill for `Password` (`Password/Password.tsx`).** Added
-  an optional `getValues` prop (react-hook-form's `UseFormGetValues`) that is threaded into
-  `Validate(...)`, enabling cross-field rules like `matches:password` (e.g. a
-  password-confirmation field). Added an optional `defaultValue` prop applied to the input so
-  an admin edit form can render a saved secret as masked dots instead of blank, so editing a
-  different field no longer wipes the stored password on save.
-- **Keyboard accessibility for the calendar day picker (`Calendar/Days.tsx`,
-  `Calendar/styles.ts`).** Day cells now expose `role="button"`, `tabIndex` (`-1` when
-  disabled), `aria-disabled`, `aria-pressed`, and an `onKeyDown` handler that activates on
-  Enter/Space, plus a `:focus-visible` outline. Days are now selectable via keyboard, not
-  only mouse.
-- **Debounced type-to-filter search (`Table/Top/Search.tsx`).** The table search input now
-  submits automatically ~500ms after the user stops typing (via a `useEffect`/`setTimeout`
-  with an initial-render guard using `useRef`), instead of requiring an Enter press that
-  nothing on screen advertised. Explicit Enter submit is preserved.
-
-### Changed
-
-- **`Password` pre-fill wired through the dynamic viewer (`Viewer/Data.tsx`).** The `password`
-  field case now passes `defaultValue={ value.string }` to `Password`, so saved password
-  values hydrate as masked input in generated forms.
-- **Confirm-password persistence of language selection (`ChangeLanguage/ChangeLanguage.tsx`).**
-  Language changes are now persisted to `localStorage['language']` so the chosen language
-  survives reloads rather than resetting to the default.
-- **Explicit `common` namespace on i18n lookups (`Gender.tsx`, `Seats/ChooseSeat.tsx`).**
-  Translation calls now pass `{ ns: 'common' }` (gender male/female labels; seat
-  chosen/choose labels) so the correct namespace resolves and the raw key is no longer shown
-  when the component is used outside the default namespace context.
-- **Styled Calendar browse dropdown (`Calendar/Browse/styles.ts`).** The select now has a
-  visible border, border-radius, padding, pointer cursor, and a custom chevron background,
-  replacing `border: none` so it reads as an interactive control.
-
-### Fixed
-
-- **Missing image alt text (`Avatar.tsx`, `CompanyItem/CompanyItem.tsx`, `RouteItem/RouteItem.tsx`).**
-  Operator/company logo `<img>` tags now include `alt={ ...company }`, giving screen readers a
-  meaningful label and a fallback when the logo fails to load.
-
-Authored by Ferjolt Ozuni. Consolidated from the magus and alvavel whitelabel patch sets into canonical @autobusal source (eliminates per-repo patch-package divergence).