@data-club/ai-hub 0.0.1

package/dist/components/AuthGate/index.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `AIHub.AuthGate` — the auth-state router.
+ *
+ * Reads `useAIHubAuth()` and renders:
+ *
+ * - `<DataClubAIHubLogin />` when no user is present.
+ * - `<DataClubAIHubChangePassword variant="forced" />` when a user is
+ *   present but `mustChangePassword === true`.
+ * - `children` (the chat / admin / whatever) otherwise.
+ *
+ * While the provider is still hydrating from a stored token (`hydrating ===
+ * true`) the gate renders nothing — preventing a one-frame flash of the
+ * login card before the cached session resolves.
+ *
+ * Tier 3 wrappers compose this primitive as the second layer (after
+ * `AIHub.Provider`) so the auth UX is handled automatically; Tier 1 / 2
+ * wrappers get the same behavior for free via `<DataClubAIHub />`.
+ *
+ * @see SPECIFICATIONS.md §7.1   — exports
+ * @see SPECIFICATIONS.md §7.2.1 — auth-owned-by-library policy
+ * @see SPECIFICATIONS.md §7.9   — Tier-3 composition example
+ * @see ui-sketches/01-login.md
+ * @see ui-sketches/02-change-password.md
+ */
+import { type ReactNode } from "react";
+import type { AIHubTexts, DeepPartial } from "../../auth/texts.js";
+import { type AIHubLoginClassNames } from "../DataClubAIHubLogin/index.js";
+import { type AIHubChangePasswordClassNames } from "../ChangePassword/index.js";
+/**
+ * Props for `AIHub.AuthGate`. The branding / i18n props mirror
+ * `<DataClubAIHub />` — Tier 3 wrappers pass them through here so the
+ * auto-rendered Login + ChangePassword screens get branded without the
+ * wrapper having to render those screens manually.
+ */
+export interface AuthGateProps {
+    /**
+     * Rendered when the user is authenticated and is not in the forced
+     * change-password state. The wrapper is responsible for the actual
+     * chat / admin tree.
+     */
+    children: ReactNode;
+    /**
+     * Title text on the login card. Forwarded to `<DataClubAIHubLogin />`.
+     * Defaults to `"ai-hub"`.
+     */
+    productName?: string;
+    /**
+     * Placeholder shown inside the username input on the login card.
+     * Forwarded to `<DataClubAIHubLogin />`. Defaults to empty.
+     */
+    usernamePlaceholder?: string;
+    /**
+     * Wrapper-supplied i18n applied to both auto-rendered auth screens.
+     */
+    texts?: DeepPartial<AIHubTexts>;
+    /** Per-element class overrides forwarded to `<DataClubAIHubLogin />`. */
+    loginClassNames?: Partial<AIHubLoginClassNames>;
+    /**
+     * Per-element class overrides forwarded to
+     * `<DataClubAIHubChangePassword />`.
+     */
+    changePasswordClassNames?: Partial<AIHubChangePasswordClassNames>;
+    /**
+     * Optional `className` forwarded onto the login root.
+     */
+    loginClassName?: string;
+    /**
+     * Optional `className` forwarded onto the change-password root.
+     */
+    changePasswordClassName?: string;
+}
+/**
+ * Renders the right screen for the current auth state.
+ *
+ * @param props - see `AuthGateProps`.
+ * @returns the rendered subtree.
+ */
+export declare function AuthGate(props: AuthGateProps): ReactNode;
+//# sourceMappingURL=index.d.ts.map

package/dist/components/AuthGate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/AuthGate/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAGvC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,4BAA4B,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,EAAE,SAAS,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAChC,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChD;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAClE;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,CA2CxD"}

package/dist/components/AuthGate/index.js

@@ -0,0 +1,61 @@
+import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * `AIHub.AuthGate` — the auth-state router.
+ *
+ * Reads `useAIHubAuth()` and renders:
+ *
+ * - `<DataClubAIHubLogin />` when no user is present.
+ * - `<DataClubAIHubChangePassword variant="forced" />` when a user is
+ *   present but `mustChangePassword === true`.
+ * - `children` (the chat / admin / whatever) otherwise.
+ *
+ * While the provider is still hydrating from a stored token (`hydrating ===
+ * true`) the gate renders nothing — preventing a one-frame flash of the
+ * login card before the cached session resolves.
+ *
+ * Tier 3 wrappers compose this primitive as the second layer (after
+ * `AIHub.Provider`) so the auth UX is handled automatically; Tier 1 / 2
+ * wrappers get the same behavior for free via `<DataClubAIHub />`.
+ *
+ * @see SPECIFICATIONS.md §7.1   — exports
+ * @see SPECIFICATIONS.md §7.2.1 — auth-owned-by-library policy
+ * @see SPECIFICATIONS.md §7.9   — Tier-3 composition example
+ * @see ui-sketches/01-login.md
+ * @see ui-sketches/02-change-password.md
+ */
+import {} from "react";
+import { useAIHubAuth } from "../../context/useAIHubAuth.js";
+import { DataClubAIHubLogin, } from "../DataClubAIHubLogin/index.js";
+import { DataClubAIHubChangePassword, } from "../ChangePassword/index.js";
+/**
+ * Renders the right screen for the current auth state.
+ *
+ * @param props - see `AuthGateProps`.
+ * @returns the rendered subtree.
+ */
+export function AuthGate(props) {
+    const auth = useAIHubAuth();
+    if (auth.hydrating) {
+        // Render nothing — we don't know yet whether the stored token is valid.
+        // FOUC-of-login-card avoidance.
+        return null;
+    }
+    if (!auth.user) {
+        return (_jsx(DataClubAIHubLogin, { ...(props.productName !== undefined ? { productName: props.productName } : {}), ...(props.usernamePlaceholder !== undefined
+                ? { usernamePlaceholder: props.usernamePlaceholder }
+                : {}), ...(props.texts !== undefined ? { texts: props.texts } : {}), ...(props.loginClassNames !== undefined
+                ? { classNames: props.loginClassNames }
+                : {}), ...(props.loginClassName !== undefined
+                ? { className: props.loginClassName }
+                : {}) }));
+    }
+    if (auth.mustChangePassword) {
+        return (_jsx(DataClubAIHubChangePassword, { variant: "forced", ...(props.texts !== undefined ? { texts: props.texts } : {}), ...(props.changePasswordClassNames !== undefined
+                ? { classNames: props.changePasswordClassNames }
+                : {}), ...(props.changePasswordClassName !== undefined
+                ? { className: props.changePasswordClassName }
+                : {}) }));
+    }
+    return _jsx(_Fragment, { children: props.children });
+}
+//# sourceMappingURL=index.js.map

package/dist/components/AuthGate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/AuthGate/index.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAkB,MAAM,OAAO,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EACL,kBAAkB,GAEnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC;AA8CpC;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAE5B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,wEAAwE;QACxE,gCAAgC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CACL,KAAC,kBAAkB,OACb,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC3E,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC,KACH,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzD,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,eAAe,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC,KACH,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC,GACP,CACH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,CACL,KAAC,2BAA2B,IAC1B,OAAO,EAAC,QAAQ,KACZ,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzD,CAAC,KAAK,CAAC,wBAAwB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,wBAAwB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC,KACH,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,uBAAuB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC,GACP,CACH,CAAC;IACJ,CAAC;IAED,OAAO,4BAAG,KAAK,CAAC,QAAQ,GAAI,CAAC;AAC/B,CAAC"}

package/dist/components/CacheBadge/index.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `<CacheBadge />` — small per-message badge surfacing provider token
+ * usage on an assistant bubble. Renders an inline icon + a compact
+ * token count, with the full breakdown in a `title`-attribute tooltip
+ * on hover.
+ *
+ * **What it shows.** Letta reports five things per assistant turn (via
+ * `AIHubMessageUsage`): input tokens, output tokens, cache-read tokens
+ * (prompt-cache HIT — provider charged ~0.1x), cache-write tokens
+ * (provider charged ~1.25x, Anthropic only), reasoning tokens, and a
+ * rolling context-window estimate.
+ *
+ * The headline number we show in the badge is the **cache-hit
+ * percentage of the prompt** — `cache_read / (input + cache_read +
+ * cache_write)`. That number is the single most useful at-a-glance
+ * signal:
+ *   - 0%  → cache is cold (cost is the worst case)
+ *   - 80% → ~10x cheaper system prompt than a cold turn
+ *
+ * The full numbers live in the tooltip. We use the native `title`
+ * attribute instead of a custom popover to keep the component
+ * lightweight and dependency-free (no portals, no animation, no
+ * focus management — perfect for a peripheral info chip).
+ *
+ * **When to render.** Only when the parent passes a `usage` prop with
+ * at least one non-null number. Messages without a usage stamp (e.g.
+ * historical conversations from before this feature shipped, or
+ * tool-only assistant turns where Letta didn't report anything)
+ * simply don't render the badge.
+ *
+ * Exported under `AIHub.CacheBadge` (re-exported via the namespace).
+ *
+ * @see AIHubMessageUsage in `../../types.ts`
+ * @see SPECIFICATIONS.md §9.4 — `usage` SSE event
+ */
+import type { ReactNode } from "react";
+import type { AIHubMessageUsage } from "../../types.js";
+/** BEM class names emitted by `<CacheBadge />`. */
+export interface CacheBadgeClassNames {
+    /** Outer span; `data-cache-state="hot|warm|cold|none"` for skinning. */
+    root: string;
+    /** The leading icon character (default 💾). */
+    icon: string;
+    /** The headline percentage label. */
+    label: string;
+}
+/** Localizable strings for the badge headline + tooltip. */
+export interface CacheBadgeTexts {
+    /** Headline shown when there's no cache info at all (e.g. providers that don't report). */
+    noCacheLabel: string;
+    /** Headline shown when this turn was a full cache miss (no tokens served from cache). */
+    missLabel: string;
+    /** Headline shown when this turn was a cache priming write — read=0 but write>0. */
+    writePrimingLabel: string;
+    /** Headline prefix for cache hits — full text is `${hitLabel} ${N}%`. */
+    hitLabel: string;
+    /** Tooltip line prefixes. Keep short — the tooltip is `title` only. */
+    hitTooltipLabel: string;
+    writeTooltipLabel: string;
+    inputLabel: string;
+    outputLabel: string;
+    reasoningLabel: string;
+    contextLabel: string;
+    totalLabel: string;
+}
+export declare const DEFAULT_TEXTS: CacheBadgeTexts;
+/** Props for `<CacheBadge />`. */
+export interface CacheBadgeProps {
+    /** Per-message usage, as returned by `GET /sessions/:id/messages`. */
+    usage: AIHubMessageUsage;
+    /** Optional class-name overrides. */
+    classNames?: Partial<CacheBadgeClassNames>;
+    /** Optional text overrides (l10n). */
+    texts?: Partial<CacheBadgeTexts>;
+}
+/**
+ * Computes the cache-hit ratio (0..1) over the prompt-side tokens.
+ *
+ * Denominator: `input + cache_read + cache_write` — every prompt
+ * token the provider saw, regardless of whether it served from cache
+ * or wrote new. We exclude `output` and `reasoning` because those
+ * are completion-side and can't benefit from prompt caching.
+ *
+ * Exported so the test suite can assert numerically.
+ */
+export declare function computeCacheHitRatio(usage: AIHubMessageUsage): number | null;
+export declare function CacheBadge({ usage, classNames, texts, }: CacheBadgeProps): ReactNode;
+//# sourceMappingURL=index.d.ts.map

package/dist/components/CacheBadge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/CacheBadge/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf;AAQD,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,aAAa,EAAE,eAYP,CAAC;AAEtB,kCAAkC;AAClC,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,KAAK,EAAE,iBAAiB,CAAC;IACzB,qCAAqC;IACrC,UAAU,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3C,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAO5E;AAsFD,wBAAgB,UAAU,CAAC,EACzB,KAAK,EACL,UAAU,EACV,KAAK,GACN,EAAE,eAAe,GAAG,SAAS,CAqC7B"}

package/dist/components/CacheBadge/index.js

@@ -0,0 +1,127 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+const DEFAULT_CLASS_NAMES = Object.freeze({
+    root: "data-club-ai-hub__cache-badge",
+    icon: "data-club-ai-hub__cache-badge__icon",
+    label: "data-club-ai-hub__cache-badge__label",
+});
+export const DEFAULT_TEXTS = Object.freeze({
+    noCacheLabel: "no data",
+    missLabel: "MISS",
+    writePrimingLabel: "PRIMING",
+    hitLabel: "HIT",
+    hitTooltipLabel: "Cache hit",
+    writeTooltipLabel: "Cache write",
+    inputLabel: "Input",
+    outputLabel: "Output",
+    reasoningLabel: "Reasoning",
+    contextLabel: "Context",
+    totalLabel: "Total",
+});
+/**
+ * Computes the cache-hit ratio (0..1) over the prompt-side tokens.
+ *
+ * Denominator: `input + cache_read + cache_write` — every prompt
+ * token the provider saw, regardless of whether it served from cache
+ * or wrote new. We exclude `output` and `reasoning` because those
+ * are completion-side and can't benefit from prompt caching.
+ *
+ * Exported so the test suite can assert numerically.
+ */
+export function computeCacheHitRatio(usage) {
+    const read = usage.cache_read ?? 0;
+    const write = usage.cache_write ?? 0;
+    const input = usage.input ?? 0;
+    const denom = read + write + input;
+    if (denom === 0)
+        return null;
+    return read / denom;
+}
+function bucketState(usage, ratio) {
+    if (ratio === null)
+        return "none";
+    if (ratio === 0) {
+        // No cache hit. Distinguish full-miss (nothing cached anywhere)
+        // from priming (we WROTE to the cache this turn — next turn will
+        // benefit). The latter is good news, the former is bad news, so
+        // the user-facing labels should differ.
+        return (usage.cache_write ?? 0) > 0 ? "priming" : "miss";
+    }
+    if (ratio >= 0.6)
+        return "hot";
+    if (ratio >= 0.1)
+        return "warm";
+    return "cold";
+}
+/** Formats a token count as a compact human-readable string: 1234 → 1.2k. */
+function formatTokens(n) {
+    if (n === null || n === undefined)
+        return "—";
+    if (n < 1000)
+        return String(n);
+    if (n < 1_000_000)
+        return `${(n / 1000).toFixed(1)}k`;
+    return `${(n / 1_000_000).toFixed(2)}M`;
+}
+/** Builds the `title`-attribute tooltip text from the usage object. */
+function buildTooltip(usage, texts) {
+    const lines = [];
+    if (usage.cache_read !== null && usage.cache_read !== undefined) {
+        lines.push(`${texts.hitTooltipLabel}: ${formatTokens(usage.cache_read)}`);
+    }
+    if (usage.cache_write !== null && usage.cache_write !== undefined) {
+        lines.push(`${texts.writeTooltipLabel}: ${formatTokens(usage.cache_write)}`);
+    }
+    if (usage.input !== null && usage.input !== undefined) {
+        lines.push(`${texts.inputLabel}: ${formatTokens(usage.input)}`);
+    }
+    if (usage.output !== null && usage.output !== undefined) {
+        lines.push(`${texts.outputLabel}: ${formatTokens(usage.output)}`);
+    }
+    if (usage.reasoning !== null && usage.reasoning !== undefined && usage.reasoning > 0) {
+        lines.push(`${texts.reasoningLabel}: ${formatTokens(usage.reasoning)}`);
+    }
+    if (usage.context !== null && usage.context !== undefined) {
+        lines.push(`${texts.contextLabel}: ${formatTokens(usage.context)}`);
+    }
+    if (usage.total !== null && usage.total !== undefined) {
+        lines.push(`${texts.totalLabel}: ${formatTokens(usage.total)}`);
+    }
+    return lines.join("\n");
+}
+/** Returns true when the usage object has at least one usable numeric field. */
+function hasAnyData(usage) {
+    return ((usage.input ?? null) !== null ||
+        (usage.output ?? null) !== null ||
+        (usage.cache_read ?? null) !== null ||
+        (usage.cache_write ?? null) !== null ||
+        (usage.reasoning ?? null) !== null ||
+        (usage.context ?? null) !== null ||
+        (usage.total ?? null) !== null);
+}
+export function CacheBadge({ usage, classNames, texts, }) {
+    if (!hasAnyData(usage))
+        return null;
+    const cls = { ...DEFAULT_CLASS_NAMES, ...(classNames ?? {}) };
+    const t = { ...DEFAULT_TEXTS, ...(texts ?? {}) };
+    const ratio = computeCacheHitRatio(usage);
+    const state = bucketState(usage, ratio);
+    // Headline label — varies by state so the user gets an immediate
+    // diagnostic signal at-a-glance.
+    let headline;
+    if (state === "none") {
+        headline = t.noCacheLabel;
+    }
+    else if (state === "miss") {
+        headline = t.missLabel;
+    }
+    else if (state === "priming") {
+        headline = t.writePrimingLabel;
+    }
+    else {
+        // hot / warm / cold — ratio is guaranteed non-null here.
+        headline = `${t.hitLabel} ${Math.round((ratio ?? 0) * 100)}%`;
+    }
+    const tooltip = buildTooltip(usage, t);
+    return (_jsxs("span", { className: cls.root, "data-testid": "cache-badge", "data-cache-state": state, title: tooltip, role: "status", "aria-label": tooltip, children: [_jsx("span", { className: cls.icon, "aria-hidden": "true", children: "\uD83D\uDCBE" }), _jsx("span", { className: cls.label, children: headline })] }));
+}
+//# sourceMappingURL=index.js.map

package/dist/components/CacheBadge/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/CacheBadge/index.tsx"],"names":[],"mappings":";AAkDA,MAAM,mBAAmB,GAAyB,MAAM,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,+BAA+B;IACrC,IAAI,EAAE,qCAAqC;IAC3C,KAAK,EAAE,sCAAsC;CAC9C,CAAyB,CAAC;AAsB3B,MAAM,CAAC,MAAM,aAAa,GAAoB,MAAM,CAAC,MAAM,CAAC;IAC1D,YAAY,EAAE,SAAS;IACvB,SAAS,EAAE,MAAM;IACjB,iBAAiB,EAAE,SAAS;IAC5B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,WAAW;IAC5B,iBAAiB,EAAE,aAAa;IAChC,UAAU,EAAE,OAAO;IACnB,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,WAAW;IAC3B,YAAY,EAAE,SAAS;IACvB,UAAU,EAAE,OAAO;CACpB,CAAoB,CAAC;AAYtB;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IACnC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,IAAI,GAAG,KAAK,CAAC;AACtB,CAAC;AAwBD,SAAS,WAAW,CAAC,KAAwB,EAAE,KAAoB;IACjE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,wCAAwC;QACxC,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,CAA4B;IAChD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAC9C,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,SAAS;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IACtD,OAAO,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,KAAwB,EAAE,KAAsB;IACpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,eAAe,KAAK,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,iBAAiB,KAAK,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,KAAK,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,KAAwB;IAC1C,OAAO,CACL,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAC9B,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI;QAC/B,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI;QACnC,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,IAAI;QACpC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI;QAClC,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI;QAChC,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EACzB,KAAK,EACL,UAAU,EACV,KAAK,GACW;IAChB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAyB,EAAE,GAAG,mBAAmB,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IACpF,MAAM,CAAC,GAAoB,EAAE,GAAG,aAAa,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAElE,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,iEAAiE;IACjE,iCAAiC;IACjC,IAAI,QAAgB,CAAC;IACrB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5B,CAAC;SAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5B,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC;IACzB,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,QAAQ,GAAG,CAAC,CAAC,iBAAiB,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,yDAAyD;QACzD,QAAQ,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEvC,OAAO,CACL,gBACE,SAAS,EAAE,GAAG,CAAC,IAAI,iBACP,aAAa,sBACP,KAAK,EACvB,KAAK,EAAE,OAAO,EACd,IAAI,EAAC,QAAQ,gBACD,OAAO,aAEnB,eAAM,SAAS,EAAE,GAAG,CAAC,IAAI,iBAAc,MAAM,6BAEtC,EACP,eAAM,SAAS,EAAE,GAAG,CAAC,KAAK,YAAG,QAAQ,GAAQ,IACxC,CACR,CAAC;AACJ,CAAC"}

package/dist/components/ChangePassword/index.d.ts

@@ -0,0 +1,109 @@
+/**
+ * `<DataClubAIHubChangePassword />` — the built-in change-password screen.
+ *
+ * Two variants in one component:
+ *
+ * - **Forced** (`variant="forced"`) — auto-rendered after login when
+ *   `useAIHubAuth().mustChangePassword === true`. No `current_password`
+ *   field, no cancel button (there is nowhere else to go), with an
+ *   `intro_message` explaining the requirement. Submit calls
+ *   `client.changePassword(null, newPassword)` — the change-only token
+ *   is itself the proof of authentication.
+ * - **Voluntary** (`variant="voluntary"`) — opened from the user-menu
+ *   ([00-shell.md](ui-sketches/00-shell.md)). Includes `current_password`
+ *   and a `Cancel` button that fires `onCancel`. Submit calls
+ *   `client.changePassword(currentPassword, newPassword)`.
+ *
+ * Each password field carries its own `show_password_toggle` — the
+ * regression-guard for the per-field pattern is in
+ * `__tests__/components/ChangePassword.test.tsx`.
+ *
+ * The client mirrors the §8.5 password policy via
+ * `validatePasswordPolicyClient` so the form surfaces too-short /
+ * too-simple errors *before* sending; the server is authoritative and
+ * its banner wins if the two ever disagree.
+ *
+ * @see SPECIFICATIONS.md §7.2.1 (and §7.3 — auth is owned by the library)
+ * @see SPECIFICATIONS.md §8.5  — password policy + forced/voluntary semantics
+ * @see ui-sketches/02-change-password.md — visual contract
+ */
+import { type ReactNode } from "react";
+import { type AIHubTexts, type DeepPartial } from "../../auth/texts.js";
+/**
+ * BEM class names emitted by `<DataClubAIHubChangePassword />`. Wrappers
+ * pass a partial map via `classNames` to override individual entries for
+ * utility-CSS frameworks.
+ */
+export interface AIHubChangePasswordClassNames {
+    /** Outer page wrapper (centers the card in the viewport). */
+    root: string;
+    /** The card itself. */
+    card: string;
+    /** Gradient title at the top. */
+    title: string;
+    /** Intro message (forced variant only). */
+    intro: string;
+    /** Error banner shown above the form on failure. */
+    errorBanner: string;
+    /** Form container. */
+    form: string;
+    /** Label / field group wrapper. */
+    fieldGroup: string;
+    /** `<label>` for an input. */
+    fieldLabel: string;
+    /** Inline field-level error message. */
+    fieldError: string;
+    /** Password input wrapper (input + show toggle). */
+    passwordWrapper: string;
+    /** The password `<input>` itself. */
+    passwordInput: string;
+    /** The show/hide-password toggle button. */
+    passwordToggle: string;
+    /** Submit button. */
+    submitButton: string;
+    /** Cancel button (voluntary variant only). */
+    cancelButton: string;
+    /** Spinner glyph rendered inside the submit button while saving. */
+    spinner: string;
+}
+/**
+ * Props for `<DataClubAIHubChangePassword />`. See §7.2.1.
+ */
+export interface DataClubAIHubChangePasswordProps {
+    /**
+     * Which variant to render. **`"forced"`** (default — what `AuthGate`
+     * mounts after a successful login with `is_initial_password=true`) hides
+     * the current-password field + cancel button, and shows an intro
+     * message. **`"voluntary"`** (from the user-menu) shows all three fields
+     * + a cancel button.
+     */
+    variant?: "forced" | "voluntary";
+    /**
+     * Fires after a successful password change. The provider has already
+     * stored the fresh session token + refreshed `/auth/me` when this fires,
+     * so the caller can read the now-updated `useAIHubAuth().user` directly.
+     */
+    onChanged?: () => void;
+    /**
+     * Fires when the user clicks Cancel on the voluntary variant. Ignored on
+     * the forced variant (there is nowhere else to go).
+     */
+    onCancel?: () => void;
+    /** Extra class merged onto the root wrapper alongside the BEM defaults. */
+    className?: string;
+    /** Per-element class-name overrides. */
+    classNames?: Partial<AIHubChangePasswordClassNames>;
+    /**
+     * Wrapper-supplied i18n. Missing keys fall back to English defaults.
+     * Only the `changePassword` namespace is consulted by this component.
+     */
+    texts?: DeepPartial<AIHubTexts>;
+}
+/**
+ * Renders the change-password card.
+ *
+ * @param props - see `DataClubAIHubChangePasswordProps`.
+ * @returns the rendered card.
+ */
+export declare function DataClubAIHubChangePassword(props: DataClubAIHubChangePasswordProps): ReactNode;
+//# sourceMappingURL=index.d.ts.map

package/dist/components/ChangePassword/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/ChangePassword/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAIjE,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAI7B;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,eAAe,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;CACjB;AA0BD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,UAAU,CAAC,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACpD;;;OAGG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,SAAS,CAoOX"}

package/dist/components/ChangePassword/index.js

@@ -0,0 +1,142 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * `<DataClubAIHubChangePassword />` — the built-in change-password screen.
+ *
+ * Two variants in one component:
+ *
+ * - **Forced** (`variant="forced"`) — auto-rendered after login when
+ *   `useAIHubAuth().mustChangePassword === true`. No `current_password`
+ *   field, no cancel button (there is nowhere else to go), with an
+ *   `intro_message` explaining the requirement. Submit calls
+ *   `client.changePassword(null, newPassword)` — the change-only token
+ *   is itself the proof of authentication.
+ * - **Voluntary** (`variant="voluntary"`) — opened from the user-menu
+ *   ([00-shell.md](ui-sketches/00-shell.md)). Includes `current_password`
+ *   and a `Cancel` button that fires `onCancel`. Submit calls
+ *   `client.changePassword(currentPassword, newPassword)`.
+ *
+ * Each password field carries its own `show_password_toggle` — the
+ * regression-guard for the per-field pattern is in
+ * `__tests__/components/ChangePassword.test.tsx`.
+ *
+ * The client mirrors the §8.5 password policy via
+ * `validatePasswordPolicyClient` so the form surfaces too-short /
+ * too-simple errors *before* sending; the server is authoritative and
+ * its banner wins if the two ever disagree.
+ *
+ * @see SPECIFICATIONS.md §7.2.1 (and §7.3 — auth is owned by the library)
+ * @see SPECIFICATIONS.md §8.5  — password policy + forced/voluntary semantics
+ * @see ui-sketches/02-change-password.md — visual contract
+ */
+import { useState } from "react";
+import { AIHubRequestError } from "../../client/AIHubClient.js";
+import { useAIHubAuth } from "../../context/useAIHubAuth.js";
+import { resolveAIHubTexts, } from "../../auth/texts.js";
+import { validatePasswordPolicyClient } from "../../auth/passwordPolicy.js";
+import { PasswordInput } from "../internal/PasswordInput.js";
+/**
+ * Default BEM class names. Stable, kebab-case, scoped under
+ * `data-club-ai-hub__change-password`. Wrappers override individual entries
+ * via `classNames`.
+ */
+const DEFAULT_CLASS_NAMES = Object.freeze({
+    root: "data-club-ai-hub__change-password",
+    card: "data-club-ai-hub__change-password-card",
+    title: "data-club-ai-hub__change-password-card__title",
+    intro: "data-club-ai-hub__change-password-card__intro",
+    errorBanner: "data-club-ai-hub__change-password-card__error",
+    form: "data-club-ai-hub__change-password-card__form",
+    fieldGroup: "data-club-ai-hub__change-password-card__field",
+    fieldLabel: "data-club-ai-hub__change-password-card__label",
+    fieldError: "data-club-ai-hub__change-password-card__field-error",
+    passwordWrapper: "data-club-ai-hub__change-password-card__password",
+    passwordInput: "data-club-ai-hub__change-password-card__input data-club-ai-hub__change-password-card__input--password",
+    passwordToggle: "data-club-ai-hub__change-password-card__toggle",
+    submitButton: "data-club-ai-hub__change-password-card__submit",
+    cancelButton: "data-club-ai-hub__change-password-card__cancel",
+    spinner: "data-club-ai-hub__spinner",
+});
+/**
+ * Renders the change-password card.
+ *
+ * @param props - see `DataClubAIHubChangePasswordProps`.
+ * @returns the rendered card.
+ */
+export function DataClubAIHubChangePassword(props) {
+    const auth = useAIHubAuth();
+    const variant = props.variant ?? "forced";
+    const classes = { ...DEFAULT_CLASS_NAMES, ...(props.classNames ?? {}) };
+    const texts = resolveAIHubTexts(props.texts).changePassword;
+    const [currentPassword, setCurrentPassword] = useState("");
+    const [newPassword, setNewPassword] = useState("");
+    const [confirmPassword, setConfirmPassword] = useState("");
+    const [submitting, setSubmitting] = useState(false);
+    const [errorMessage, setErrorMessage] = useState(null);
+    // Client-side validation produces an inline field-error message — separate
+    // from the top-of-card error banner, which is reserved for server errors.
+    const fieldError = (() => {
+        if (newPassword.length === 0 && confirmPassword.length === 0)
+            return null;
+        const policy = validatePasswordPolicyClient(newPassword);
+        if (!policy.ok) {
+            if (policy.code === "password_too_short")
+                return texts.passwordTooShortError;
+            return texts.passwordTooSimpleError;
+        }
+        if (confirmPassword.length > 0 && newPassword !== confirmPassword) {
+            return texts.passwordsMustMatchError;
+        }
+        return null;
+    })();
+    // Submit-disable predicate: voluntary needs all three; forced needs two.
+    const fieldsFilled = newPassword.length > 0 &&
+        confirmPassword.length > 0 &&
+        newPassword === confirmPassword &&
+        (variant === "forced" || currentPassword.length > 0);
+    const submitDisabled = submitting || !fieldsFilled || fieldError !== null;
+    const handleSubmit = async (e) => {
+        e.preventDefault();
+        if (submitDisabled)
+            return;
+        setSubmitting(true);
+        setErrorMessage(null);
+        try {
+            await auth.changePassword(variant === "voluntary" ? currentPassword : null, newPassword);
+            props.onChanged?.();
+        }
+        catch (err) {
+            if (err instanceof AIHubRequestError) {
+                // Map the wire error code to a localized banner. Server's
+                // password-policy errors trump the client mirror — the server is
+                // authoritative (§8.5).
+                if (err.code === "password_too_short") {
+                    setErrorMessage(texts.passwordTooShortError);
+                }
+                else if (err.code === "password_too_simple") {
+                    setErrorMessage(texts.passwordTooSimpleError);
+                }
+                else if (err.code === "unauthorized" || err.status === 401) {
+                    setErrorMessage(texts.invalidCurrentPasswordError);
+                }
+                else if (err.code === "network") {
+                    setErrorMessage(texts.networkError);
+                }
+                else {
+                    // Fall back to the server message — it's safe to surface per §9.
+                    setErrorMessage(err.message || texts.networkError);
+                }
+            }
+            else {
+                setErrorMessage(texts.networkError);
+            }
+        }
+        finally {
+            setSubmitting(false);
+        }
+    };
+    const rootClass = props.className !== undefined
+        ? `${classes.root} ${props.className}`
+        : classes.root;
+    return (_jsx("div", { className: rootClass, "data-testid": "change-password-root", "data-variant": variant, children: _jsxs("div", { className: classes.card, role: "form", "aria-labelledby": "dc-aih-change-password-title", children: [_jsx("h1", { id: "dc-aih-change-password-title", className: classes.title, children: texts.title }), variant === "forced" ? (_jsx("p", { className: classes.intro, "data-testid": "change-password-intro", children: texts.forcedChangePasswordIntro })) : null, errorMessage !== null ? (_jsx("div", { className: classes.errorBanner, role: "alert", "aria-live": "polite", "data-testid": "change-password-error", children: errorMessage })) : null, _jsxs("form", { className: classes.form, onSubmit: handleSubmit, noValidate: true, children: [variant === "voluntary" ? (_jsxs("div", { className: classes.fieldGroup, children: [_jsx("label", { htmlFor: "dc-aih-change-current", className: classes.fieldLabel, children: texts.currentPasswordLabel }), _jsx(PasswordInput, { id: "dc-aih-change-current", value: currentPassword, onChange: setCurrentPassword, name: "current_password", autoComplete: "current-password", disabled: submitting, required: true, autoFocus: true, showAriaLabel: texts.showPasswordAriaLabel, hideAriaLabel: texts.hidePasswordAriaLabel, wrapperClassName: classes.passwordWrapper, inputClassName: classes.passwordInput, toggleClassName: classes.passwordToggle, testId: "change-current-field" })] })) : null, _jsxs("div", { className: classes.fieldGroup, children: [_jsx("label", { htmlFor: "dc-aih-change-new", className: classes.fieldLabel, children: texts.newPasswordLabel }), _jsx(PasswordInput, { id: "dc-aih-change-new", value: newPassword, onChange: setNewPassword, name: "new_password", autoComplete: "new-password", disabled: submitting, required: true, ...(variant === "forced" ? { autoFocus: true } : {}), showAriaLabel: texts.showPasswordAriaLabel, hideAriaLabel: texts.hidePasswordAriaLabel, wrapperClassName: classes.passwordWrapper, inputClassName: classes.passwordInput, toggleClassName: classes.passwordToggle, testId: "change-new-field" })] }), _jsxs("div", { className: classes.fieldGroup, children: [_jsx("label", { htmlFor: "dc-aih-change-confirm", className: classes.fieldLabel, children: texts.confirmPasswordLabel }), _jsx(PasswordInput, { id: "dc-aih-change-confirm", value: confirmPassword, onChange: setConfirmPassword, name: "confirm_password", autoComplete: "new-password", disabled: submitting, required: true, showAriaLabel: texts.showPasswordAriaLabel, hideAriaLabel: texts.hidePasswordAriaLabel, wrapperClassName: classes.passwordWrapper, inputClassName: classes.passwordInput, toggleClassName: classes.passwordToggle, testId: "change-confirm-field" }), fieldError !== null ? (_jsx("div", { className: classes.fieldError, role: "status", "aria-live": "polite", "data-testid": "change-password-field-error", children: fieldError })) : null] }), _jsx("button", { type: "submit", className: classes.submitButton, disabled: submitDisabled, "data-testid": "change-password-submit", children: submitting ? (_jsxs(_Fragment, { children: [_jsx("span", { className: classes.spinner, "aria-hidden": "true" }), texts.savingButton] })) : (texts.changePasswordButton) }), variant === "voluntary" ? (_jsx("button", { type: "button", className: classes.cancelButton, onClick: () => props.onCancel?.(), disabled: submitting, "data-testid": "change-password-cancel", children: texts.cancelButton })) : null] })] }) }));
+}
+//# sourceMappingURL=index.js.map