@eifi1/ui-kit 0.28.0 → 0.29.0

package/README.md

@@ -382,14 +382,14 @@ columns, strings and permissions (see the note at the top of `src/feedback/feedb
 
 <!-- BEGIN GENERATED: exports — node scripts/gen-export-inventory.mjs -->
 
-**1414 names from 206 modules** — 665 values and 749 types. _Italic_ is a type-only export.
+**1478 names from 219 modules** — 692 values and 786 types. _Italic_ is a type-only export.
 
 Generated from `dist/index.d.ts` by `node scripts/gen-export-inventory.mjs`; the count
 is pinned by `src/__tests__/public-surface.test.ts`. Do not edit between the markers.
 
 | Entry point | Names |
 |---|---|
-| `@eifi1/ui-kit` | 1414 |
+| `@eifi1/ui-kit` | 1478 |
 | `@eifi1/ui-kit/chart` | 104 |
 | `@eifi1/ui-kit/shell` | 24 |
 | `@eifi1/ui-kit/data-table` | 51 |
@@ -416,6 +416,7 @@ re-slicing of it, never a second API.
 | `lib/qr-encode` | `encodeQr`, _`QrEncodeOptions`_, _`QrErrorCorrection`_, _`QrMatrix`_ |
 | `lib/server-wake` | `attachServerWake`, `createServerWake`, `serverWake`, `watchReadsAnd`, `wrapFetch`, _`AxiosLikeInstance`_, _`ServerWakeAxiosConfig`_, _`ServerWakeFilter`_, _`ServerWakeOptions`_, _`ServerWakeRequest`_, _`ServerWakeStage`_, _`ServerWakeWatcher`_ |
 | `lib/translation-review` | `DEFAULT_TRANSLATION_REVIEW_FILTER`, `DEFAULT_TRANSLATION_REVIEW_SWIPE`, `dropReviews`, `filterTranslationRows`, `flattenStrings`, `fromApiReview`, `groupTranslationRows`, `keyInArea`, `keyInAreas`, `keyNamespace`, `mergeReviews`, `placeholderMismatch`, `placeholderTokens`, `REVIEW_STATUSES`, `reviewAreaOf`, `reviewStatus`, `reviewUndo`, `reviewWrite`, `summariseRows`, `toApiWrite`, `TRANSLATION_REVIEW_SWIPE_ACTIONS`, `translationCorrections`, `translationReviewSwipePlan`, `translationRows`, `unreviewedRows`, _`ApiTranslationReview`_, _`ApiTranslationReviewWrite`_, _`ReviewStatus`_, _`TranslationCorrection`_, _`TranslationReview`_, _`TranslationReviewFilter`_, _`TranslationReviewKey`_, _`TranslationReviewSwipeAction`_, _`TranslationReviewSwipeBinding`_, _`TranslationReviewUndo`_, _`TranslationReviewWrite`_, _`TranslationRow`_, _`TranslationRowGroup`_, _`TranslationRowsInput`_, _`TranslationSummary`_, _`TranslationVerdict`_ |
+| `lib/person-name` | `formatPersonName`, `personInitials`, _`PersonName`_ |
 | `lib/countries` | `COUNTRY_CODES`, `countryName` |
 | `lib/iban` | `compactIban`, `formatIban`, `IBAN_LENGTHS`, `ibanCheckDigits`, `ibanProblem`, `isQrIban`, `isValidIban`, _`IbanKind`_, _`IbanProblem`_ |
 | `lib/isin` | `formatIsin`, `isinCheckDigit`, `isValidIsin` |
@@ -462,9 +463,9 @@ re-slicing of it, never a second API.
 | Module | Exports |
 |---|---|
 | `i18n/kit-labels` | `DEFAULT_APP_SHELL_LABELS`, `DEFAULT_CALCULATOR_LABELS`, `DEFAULT_COMBOBOX_LABELS`, `DEFAULT_COMMON_LABELS`, `DEFAULT_CURRENCY_LABELS`, `DEFAULT_DATE_PICKER_LABELS`, `DEFAULT_FILE_LABELS`, `DEFAULT_MULTI_SELECT_LABELS`, `DEFAULT_PICKER_SHEET_LABELS`, `DEFAULT_SWIPEABLE_ROW_LABELS`, `DEFAULT_TOP_BAR_LABELS`, `formatFileSize`, `missingKitLabels`, `UiKitProvider`, `useKitChartTooltipPlacement`, `useKitDateFormatter`, `useKitFileLabels`, `useKitLabelOverrides`, `useKitLabels`, `useKitLink`, `useKitLocale`, `useKitWeekStart`, _`AppShellLabels`_, _`CalculatorLabels`_, _`ChartTooltipPlacement`_, _`ComboboxLabels`_, _`CommonLabels`_, _`CurrencyLabels`_, _`DatePickerLabels`_, _`FileLabels`_, _`KitDateFormatContext`_, _`KitDateFormatter`_, _`KitLinkComponent`_, _`KitLinkProps`_, _`LabelOverride`_, _`MultiSelectLabels`_, _`PickerSheetLabels`_, _`SwipeableRowLabels`_, _`TopBarLabels`_, _`UiKitLabelOverrides`_, _`UiKitLabels`_, _`UiKitProviderProps`_ |
+| `i18n/languages` | `formatLocaleOf`, `KIT_LANGUAGES`, `languageOptions`, `loadUiKitLabels`, `peekUiKitLabels`, `resolveLanguage`, `useUiKitLabels`, _`KitLanguage`_, _`KitLanguageCode`_ |
 | `i18n/defaults` | `DEFAULT_UI_KIT_LABELS` |
 | `i18n/review` | `kitLabelStrings`, _`KitLabelStringsOptions`_ |
-| `i18n/languages` | `formatLocaleOf`, `KIT_LANGUAGES`, `languageOptions`, `loadUiKitLabels`, `peekUiKitLabels`, `resolveLanguage`, `useUiKitLabels`, _`KitLanguage`_, _`KitLanguageCode`_ |
 | `i18n/plurals` | `withAllPlurals` |
 
 ### components
@@ -478,7 +479,7 @@ re-slicing of it, never a second API.
 | `components/file-button` | `DEFAULT_FILE_PICKER_LABELS`, `FileButton`, `matchesAccept`, `useFilePicker`, _`FileButtonProps`_, _`FilePickerLabels`_, _`FileRejection`_, _`FileRejectionReason`_, _`FileScreenOptions`_, _`UseFilePickerOptions`_, _`UseFilePickerReturn`_ |
 | `components/form-actions` | `DEFAULT_FORM_ACTIONS_LABELS`, `FormActions`, _`FormActionsAlign`_, _`FormActionsDestructive`_, _`FormActionsLabels`_, _`FormActionsPlacement`_, _`FormActionsProps`_, _`FormActionsStickyWithin`_, _`FormActionsSubmitProps`_, _`FormActionsSubmitShortcut`_, _`ResponsiveFormActionsPlacement`_ |
 | `components/iban-input` | `DEFAULT_IBAN_INPUT_LABELS`, `IbanInput`, _`IbanInputLabels`_, _`IbanInputProps`_ |
-| `components/legal` | `DEFAULT_LEGAL_LABELS`, `LegalFooter`, `LegalLayout`, `LegalLinks`, `LegalSection`, _`LegalFooterProps`_, _`LegalFramedSectionLabels`_, _`LegalLabels`_, _`LegalLayoutProps`_, _`LegalLink`_, _`LegalLinksProps`_, _`LegalOperator`_, _`LegalOperatorSectionLabels`_, _`LegalOperatorText`_, _`LegalPageKey`_, _`LegalSectionProps`_, _`LegalTextSectionLabels`_ |
+| `components/legal` | `DEFAULT_LEGAL_LABELS`, `LEGAL_HREFS`, `LegalFooter`, `LegalLayout`, `LegalLinks`, `legalOperatorText`, `LegalSection`, `useLegalLabels`, _`LegalFooterProps`_, _`LegalFramedSectionLabels`_, _`LegalLabels`_, _`LegalLayoutProps`_, _`LegalLink`_, _`LegalLinksProps`_, _`LegalOperator`_, _`LegalOperatorSectionLabels`_, _`LegalOperatorText`_, _`LegalPageKey`_, _`LegalSectionProps`_, _`LegalTextSectionLabels`_ |
 | `components/phone-input` | `DEFAULT_PHONE_INPUT_LABELS`, `PhoneInput`, _`PhoneInputLabels`_, _`PhoneInputProps`_ |
 | `components/share-card` | `DEFAULT_SHARE_CARD_LABELS`, `ShareCard`, `ShareDialog`, `SharePanel`, _`ShareAddRequest`_, _`ShareCandidate`_, _`ShareCardLabels`_, _`ShareCardProps`_, _`ShareDialogProps`_, _`ShareGrantee`_, _`SharePanelProps`_, _`SharePendingGrant`_, _`ShareRole`_ |
 | `components/field` | `Field`, _`FieldControlProps`_, _`FieldLabelVisibility`_, _`FieldProps`_, _`FieldRenderMeta`_ |
@@ -621,6 +622,22 @@ re-slicing of it, never a second API.
 | `feedback/feedback-submit` | `useFeedbackSubmit`, _`FeedbackCreatePayload`_, _`FeedbackSubmit`_, _`UseFeedbackSubmitOptions`_ |
 | `feedback/feedback-crash` | `createCrashReporter`, _`CrashFiling`_, _`CrashReportCreate`_, _`CrashReporter`_, _`CrashReporterOptions`_, _`CrashReportResponse`_ |
 
+### auth
+
+| Module | Exports |
+|---|---|
+| `auth/register-form` | `DEFAULT_REGISTER_LABELS`, `RegisterForm`, _`RegisterFormProps`_, _`RegisterLabels`_, _`RegisterValues`_ |
+| `auth/sign-in-form` | `DEFAULT_SIGN_IN_LABELS`, `SignInForm`, _`SignInAction`_, _`SignInAnswer`_, _`SignInCodeValues`_, _`SignInCredentials`_, _`SignInFormProps`_, _`SignInLabels`_, _`SignInNewPasswordValues`_, _`SignInStep`_ |
+| `auth/complete-name-dialog` | `CompleteNameDialog`, `DEFAULT_COMPLETE_NAME_LABELS`, _`CompleteNameDialogProps`_, _`CompleteNameLabels`_, _`CompleteNameValues`_ |
+| `auth/email-tag` | `taggedEmail` |
+| `auth/auth-errors` | `authErrorCode`, `isAuthError`, _`AuthErrorCode`_ |
+| `auth/forgot-password-form` | `DEFAULT_FORGOT_PASSWORD_LABELS`, `ForgotPasswordForm`, _`ForgotPasswordFormProps`_, _`ForgotPasswordLabels`_ |
+| `auth/reset-password-form` | `DEFAULT_RESET_PASSWORD_LABELS`, `ResetPasswordForm`, _`ResetPasswordCheck`_, _`ResetPasswordFormProps`_, _`ResetPasswordLabels`_, _`ResetPasswordResult`_, _`ResetPasswordValues`_ |
+| `auth/verify-email` | `DEFAULT_VERIFY_EMAIL_LABELS`, `EmailVerificationBanner`, `VerifyEmailStatus`, _`EmailVerificationBannerProps`_, _`VerifyEmailFailure`_, _`VerifyEmailLabels`_, _`VerifyEmailStatusProps`_ |
+| `auth/not-found-page` | `DEFAULT_NOT_FOUND_LABELS`, `NotFoundPage`, _`NotFoundLabels`_, _`NotFoundPageProps`_ |
+| `auth/accept-invitation` | `AcceptInvitation`, `DEFAULT_ACCEPT_INVITATION_LABELS`, _`AcceptInvitationFailure`_, _`AcceptInvitationLabels`_, _`AcceptInvitationProps`_, _`AcceptInvitationResult`_ |
+| `auth/status-parts` | _`AuthHeadingLevel`_ |
+
 ### shell
 
 | Module | Exports |
@@ -633,6 +650,7 @@ re-slicing of it, never a second API.
 | `shell/topbar-action-menu` | `TopBarActionMenu`, _`TopBarMenuEntry`_, _`TopBarMenuHeader`_ |
 | `shell/top-bar-brand` | `TopBarBrand`, _`TopBarBrandProps`_ |
 | `shell/auth-layout` | `AuthLayout`, _`AuthLayoutProps`_ |
+| `shell/company-switcher` | `CompanySwitcher`, `DEFAULT_COMPANY_SWITCHER_LABELS`, _`CompanySwitcherCompany`_, _`CompanySwitcherLabels`_, _`CompanySwitcherProps`_ |
 
 ### wizard
 

package/dist/auth/accept-invitation.d.ts

@@ -0,0 +1,90 @@
+import * as react from 'react';
+import { ComponentPropsWithoutRef, ReactNode } from 'react';
+import { AuthHeadingLevel } from './status-parts.js';
+
+/** Every string the page renders — the `acceptInvitation` namespace. keksdose's words
+ *  where its `/join` page has them (`budget_share.join*`). */
+interface AcceptInvitationLabels {
+    /** The heading. */
+    title: string;
+    /** While the invitation is accepted. */
+    accepting: string;
+    /** Accepted, when the app did not say into what. */
+    accepted: string;
+    /** Accepted, given what it attached the account to — a company, a team, a budget. */
+    joined: (name: string) => string;
+    /** Into the app, from every outcome but "sign in first". */
+    continue: string;
+    /** The token is unknown, spent, or for another address. */
+    invalid: string;
+    expired: string;
+    /** The page was opened without a `token`. */
+    noToken: string;
+    /** Under `invalid` and `expired`: an invitation is re-sent as a new one (§4.4). */
+    askAgain: string;
+    /** Nobody is signed in: an existing account accepts after sign-in (§4.4). */
+    signInFirst: string;
+    /** Under it. */
+    signInHint: string;
+    signIn: string;
+    /** Beside "Sign in", with `registerHref`. */
+    register: string;
+}
+declare const DEFAULT_ACCEPT_INVITATION_LABELS: AcceptInvitationLabels;
+/** What `onAccept` may resolve with. */
+interface AcceptInvitationResult {
+    /** What the invitation attached the account to, by name — "Example Property Ltd",
+     *  "Team North", a budget. Said in the confirmation. */
+    name?: string;
+}
+/** What became of an invitation that was not accepted. `signIn`: the server wants a
+ *  session first (a `401`), which `signedIn` did not know about. */
+type AcceptInvitationFailure = "invalid" | "expired" | "signIn";
+interface AcceptInvitationProps extends Omit<ComponentPropsWithoutRef<"div">, "children" | "title"> {
+    /** The invitation's token — the app's `?invite=` / `?token=`. Empty: the link was cut
+     *  short, and the page says so without asking anyone. */
+    token: string;
+    /** Someone is signed in on this device. Until then the page asks for a sign-in and
+     *  sends nothing: accepting attaches the invitation to the SIGNED-IN account. */
+    signedIn: boolean;
+    /**
+     * Accept it — `POST /auth/invitations/accept {token}`, once per token, as soon as
+     * someone is signed in. Resolve (with what it attached the account to, if the app
+     * knows); reject with the client's error.
+     */
+    onAccept: (token: string) => Promise<AcceptInvitationResult | void | undefined>;
+    /** Which dead end a rejection is. Default: `invitation_expired` is `expired`,
+     *  anything else `invalid` (§5.2's codes). Map a `401` to `signIn` here. */
+    classifyError?: (error: unknown) => AcceptInvitationFailure;
+    /** "Continue" — into the app. Default `/`. */
+    continueHref?: string;
+    /** "Sign in" — the app's `/login`, with a way back here (`?next=…`). Default
+     *  `/login`. */
+    signInHref?: string;
+    /** "Create account" beside "Sign in", for an invitation that may lead to a new
+     *  account — the app's `/register?invite=…`. Left out, none. */
+    registerHref?: string;
+    /** The heading. Default `labels.title`; `null` draws none, for a page that puts it in
+     *  `AuthLayout`'s `title` instead. */
+    title?: ReactNode;
+    /** The heading's level. Default `h2`, under the page's `h1`. */
+    headingAs?: AuthHeadingLevel;
+    labels?: Partial<AcceptInvitationLabels>;
+}
+/**
+ * Accept an invitation with an EXISTING account (docs/auth-harmonization.md §4.4): the
+ * link leads here, the person signs in if they are not, and the app attaches the
+ * invitation — a kastlan user joining a second company, a Kurvenschmiede member a team,
+ * a keksdose user a shared budget. A new address never needs this page: its link opens
+ * the sign-up form, which spends the invitation itself.
+ *
+ * keksdose's `JoinSharePage` (features/budgets/join-page.tsx) is the model: it accepts
+ * on load, once (the token is single-use, and StrictMode's double effect would send it
+ * twice), and shows the outcome where its spinner was. The outcomes: accepted, with the
+ * way into the app; not valid; expired (both say to ask for a new invitation, since
+ * "resend" mints a new token); or "sign in first", with nothing sent. "Continue" REPLACES
+ * this page in the history: the token is spent, so Back must not land here again.
+ */
+declare function AcceptInvitation({ token, signedIn, onAccept, classifyError, continueHref, signInHref, registerHref, title, headingAs: Heading, labels: labelsProp, className, ...rest }: AcceptInvitationProps): react.JSX.Element;
+
+export { AcceptInvitation, type AcceptInvitationFailure, type AcceptInvitationLabels, type AcceptInvitationProps, type AcceptInvitationResult, DEFAULT_ACCEPT_INVITATION_LABELS };

package/dist/auth/accept-invitation.js

@@ -0,0 +1,117 @@
+"use client";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { useState } from "react";
+import { CheckCircle2, LogIn, TimerOff, XCircle } from "lucide-react";
+import { cn } from "../lib/cn.js";
+import { useKitLabels } from "../i18n/kit-labels.js";
+import { useAnnounce } from "../hooks/use-announce.js";
+import { LoadingState } from "../components/loading-state.js";
+import { Button, EmptyState } from "../components/ui.js";
+import { authErrorCode } from "./auth-errors.js";
+import { OUTCOME_CLASS, STATUS_HEADING_CLASS, useOncePerKey } from "./status-parts.js";
+const DEFAULT_ACCEPT_INVITATION_LABELS = {
+  title: "Accept invitation",
+  accepting: "Joining\u2026",
+  accepted: "Invitation accepted.",
+  joined: (name) => `You\u2019ve joined ${name}.`,
+  continue: "Continue",
+  invalid: "Could not join with this link",
+  expired: "This invitation has expired",
+  noToken: "This link is missing its invite token.",
+  askAgain: "Ask the person who invited you to send a new invitation.",
+  signInFirst: "Sign in to accept this invitation",
+  signInHint: "Use the account the invitation was sent to.",
+  signIn: "Sign in",
+  register: "Create account"
+};
+function AcceptInvitation({
+  token,
+  signedIn,
+  onAccept,
+  classifyError,
+  continueHref = "/",
+  signInHref = "/login",
+  registerHref,
+  title,
+  headingAs: Heading = "h2",
+  labels: labelsProp,
+  className,
+  ...rest
+}) {
+  const labels = useKitLabels("acceptInvitation", DEFAULT_ACCEPT_INVITATION_LABELS, labelsProp);
+  const [settled, setSettled] = useState(null);
+  const { announce, regionProps } = useAnnounce();
+  useOncePerKey(token !== "" && signedIn ? token : null, onAccept, (key, result) => {
+    if (result.ok) {
+      const name = result.value?.name?.trim() || void 0;
+      setSettled({ token: key, outcome: "accepted", name });
+      announce(name ? labels.joined(name) : labels.accepted);
+      return;
+    }
+    const failure = classifyError?.(result.error) ?? (authErrorCode(result.error) === "invitation_expired" ? "expired" : "invalid");
+    setSettled({ token: key, outcome: failure });
+    announce(failure === "signIn" ? labels.signInFirst : labels[failure]);
+  });
+  const outcome = token === "" ? "invalid" : settled?.token === token ? settled.outcome : signedIn ? "accepting" : "signIn";
+  const continueButton = (variant) => /* @__PURE__ */ jsx(Button, { href: continueHref, replace: true, variant, children: labels.continue });
+  let body;
+  if (outcome === "accepting") {
+    body = /* @__PURE__ */ jsx(LoadingState, { size: "sm", label: labels.accepting });
+  } else if (outcome === "accepted") {
+    body = /* @__PURE__ */ jsx(
+      EmptyState,
+      {
+        tone: "success",
+        icon: /* @__PURE__ */ jsx(CheckCircle2, {}),
+        title: settled?.name ? labels.joined(settled.name) : labels.accepted,
+        action: continueButton("brand"),
+        className: OUTCOME_CLASS
+      }
+    );
+  } else if (outcome === "signIn") {
+    body = /* @__PURE__ */ jsx(
+      EmptyState,
+      {
+        icon: /* @__PURE__ */ jsx(LogIn, {}),
+        title: labels.signInFirst,
+        hint: labels.signInHint,
+        action: /* @__PURE__ */ jsxs(Fragment, { children: [
+          /* @__PURE__ */ jsx(Button, { href: signInHref, variant: "brand", children: labels.signIn }),
+          registerHref !== void 0 && /* @__PURE__ */ jsx(Button, { href: registerHref, variant: "secondary", children: labels.register })
+        ] }),
+        className: OUTCOME_CLASS
+      }
+    );
+  } else {
+    body = /* @__PURE__ */ jsx(
+      EmptyState,
+      {
+        tone: "danger",
+        icon: outcome === "expired" ? /* @__PURE__ */ jsx(TimerOff, {}) : /* @__PURE__ */ jsx(XCircle, {}),
+        title: token === "" ? labels.noToken : labels[outcome],
+        hint: labels.askAgain,
+        action: signedIn ? continueButton("secondary") : void 0,
+        className: OUTCOME_CLASS
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxs(
+    "div",
+    {
+      ...rest,
+      "data-state": outcome,
+      "aria-busy": outcome === "accepting" || void 0,
+      className: cn("space-y-3", className),
+      children: [
+        title === null ? null : /* @__PURE__ */ jsx(Heading, { className: STATUS_HEADING_CLASS, children: title ?? labels.title }),
+        body,
+        /* @__PURE__ */ jsx("div", { ...regionProps })
+      ]
+    }
+  );
+}
+export {
+  AcceptInvitation,
+  DEFAULT_ACCEPT_INVITATION_LABELS
+};
+//# sourceMappingURL=accept-invitation.js.map

package/dist/auth/accept-invitation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/accept-invitation.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport type { ComponentPropsWithoutRef, ReactNode } from \"react\";\nimport { CheckCircle2, LogIn, TimerOff, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { useAnnounce } from \"../hooks/use-announce\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button, EmptyState } from \"../components/ui\";\nimport { authErrorCode } from \"./auth-errors\";\nimport { OUTCOME_CLASS, STATUS_HEADING_CLASS, useOncePerKey } from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the page renders — the `acceptInvitation` namespace. keksdose's words\n *  where its `/join` page has them (`budget_share.join*`). */\nexport interface AcceptInvitationLabels {\n  /** The heading. */\n  title: string;\n  /** While the invitation is accepted. */\n  accepting: string;\n  /** Accepted, when the app did not say into what. */\n  accepted: string;\n  /** Accepted, given what it attached the account to — a company, a team, a budget. */\n  joined: (name: string) => string;\n  /** Into the app, from every outcome but \"sign in first\". */\n  continue: string;\n  /** The token is unknown, spent, or for another address. */\n  invalid: string;\n  expired: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** Under `invalid` and `expired`: an invitation is re-sent as a new one (§4.4). */\n  askAgain: string;\n  /** Nobody is signed in: an existing account accepts after sign-in (§4.4). */\n  signInFirst: string;\n  /** Under it. */\n  signInHint: string;\n  signIn: string;\n  /** Beside \"Sign in\", with `registerHref`. */\n  register: string;\n}\n\nexport const DEFAULT_ACCEPT_INVITATION_LABELS: AcceptInvitationLabels = {\n  title: \"Accept invitation\",\n  accepting: \"Joining…\",\n  accepted: \"Invitation accepted.\",\n  joined: (name) => `You’ve joined ${name}.`,\n  continue: \"Continue\",\n  invalid: \"Could not join with this link\",\n  expired: \"This invitation has expired\",\n  noToken: \"This link is missing its invite token.\",\n  askAgain: \"Ask the person who invited you to send a new invitation.\",\n  signInFirst: \"Sign in to accept this invitation\",\n  signInHint: \"Use the account the invitation was sent to.\",\n  signIn: \"Sign in\",\n  register: \"Create account\",\n};\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onAccept` may resolve with. */\nexport interface AcceptInvitationResult {\n  /** What the invitation attached the account to, by name — \"Example Property Ltd\",\n   *  \"Team North\", a budget. Said in the confirmation. */\n  name?: string;\n}\n\n/** What became of an invitation that was not accepted. `signIn`: the server wants a\n *  session first (a `401`), which `signedIn` did not know about. */\nexport type AcceptInvitationFailure = \"invalid\" | \"expired\" | \"signIn\";\n\ntype Outcome = \"accepted\" | AcceptInvitationFailure;\n\nexport interface AcceptInvitationProps extends Omit<ComponentPropsWithoutRef<\"div\">, \"children\" | \"title\"> {\n  /** The invitation's token — the app's `?invite=` / `?token=`. Empty: the link was cut\n   *  short, and the page says so without asking anyone. */\n  token: string;\n  /** Someone is signed in on this device. Until then the page asks for a sign-in and\n   *  sends nothing: accepting attaches the invitation to the SIGNED-IN account. */\n  signedIn: boolean;\n  /**\n   * Accept it — `POST /auth/invitations/accept {token}`, once per token, as soon as\n   * someone is signed in. Resolve (with what it attached the account to, if the app\n   * knows); reject with the client's error.\n   */\n  onAccept: (token: string) => Promise<AcceptInvitationResult | void | undefined>;\n  /** Which dead end a rejection is. Default: `invitation_expired` is `expired`,\n   *  anything else `invalid` (§5.2's codes). Map a `401` to `signIn` here. */\n  classifyError?: (error: unknown) => AcceptInvitationFailure;\n  /** \"Continue\" — into the app. Default `/`. */\n  continueHref?: string;\n  /** \"Sign in\" — the app's `/login`, with a way back here (`?next=…`). Default\n   *  `/login`. */\n  signInHref?: string;\n  /** \"Create account\" beside \"Sign in\", for an invitation that may lead to a new\n   *  account — the app's `/register?invite=…`. Left out, none. */\n  registerHref?: string;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it in\n   *  `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<AcceptInvitationLabels>;\n}\n\n/**\n * Accept an invitation with an EXISTING account (docs/auth-harmonization.md §4.4): the\n * link leads here, the person signs in if they are not, and the app attaches the\n * invitation — a kastlan user joining a second company, a Kurvenschmiede member a team,\n * a keksdose user a shared budget. A new address never needs this page: its link opens\n * the sign-up form, which spends the invitation itself.\n *\n * keksdose's `JoinSharePage` (features/budgets/join-page.tsx) is the model: it accepts\n * on load, once (the token is single-use, and StrictMode's double effect would send it\n * twice), and shows the outcome where its spinner was. The outcomes: accepted, with the\n * way into the app; not valid; expired (both say to ask for a new invitation, since\n * \"resend\" mints a new token); or \"sign in first\", with nothing sent. \"Continue\" REPLACES\n * this page in the history: the token is spent, so Back must not land here again.\n */\nexport function AcceptInvitation({\n  token,\n  signedIn,\n  onAccept,\n  classifyError,\n  continueHref = \"/\",\n  signInHref = \"/login\",\n  registerHref,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: AcceptInvitationProps) {\n  const labels = useKitLabels(\"acceptInvitation\", DEFAULT_ACCEPT_INVITATION_LABELS, labelsProp);\n  const [settled, setSettled] = useState<{ token: string; outcome: Outcome; name?: string } | null>(null);\n  const { announce, regionProps } = useAnnounce();\n\n  useOncePerKey(token !== \"\" && signedIn ? token : null, onAccept, (key, result) => {\n    if (result.ok) {\n      const name = result.value?.name?.trim() || undefined;\n      setSettled({ token: key, outcome: \"accepted\", name });\n      announce(name ? labels.joined(name) : labels.accepted);\n      return;\n    }\n    const failure: AcceptInvitationFailure =\n      classifyError?.(result.error) ?? (authErrorCode(result.error) === \"invitation_expired\" ? \"expired\" : \"invalid\");\n    setSettled({ token: key, outcome: failure });\n    announce(failure === \"signIn\" ? labels.signInFirst : labels[failure]);\n  });\n\n  const outcome: Outcome | \"accepting\" =\n    token === \"\"\n      ? \"invalid\"\n      : settled?.token === token\n        ? settled.outcome\n        : signedIn\n          ? \"accepting\"\n          : \"signIn\";\n\n  const continueButton = (variant: \"brand\" | \"secondary\") => (\n    <Button href={continueHref} replace variant={variant}>\n      {labels.continue}\n    </Button>\n  );\n\n  let body: ReactNode;\n  if (outcome === \"accepting\") {\n    body = <LoadingState size=\"sm\" label={labels.accepting} />;\n  } else if (outcome === \"accepted\") {\n    body = (\n      <EmptyState\n        tone=\"success\"\n        icon={<CheckCircle2 />}\n        title={settled?.name ? labels.joined(settled.name) : labels.accepted}\n        action={continueButton(\"brand\")}\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else if (outcome === \"signIn\") {\n    body = (\n      <EmptyState\n        icon={<LogIn />}\n        title={labels.signInFirst}\n        hint={labels.signInHint}\n        action={\n          <>\n            <Button href={signInHref} variant=\"brand\">\n              {labels.signIn}\n            </Button>\n            {registerHref !== undefined && (\n              <Button href={registerHref} variant=\"secondary\">\n                {labels.register}\n              </Button>\n            )}\n          </>\n        }\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else {\n    body = (\n      <EmptyState\n        tone=\"danger\"\n        icon={outcome === \"expired\" ? <TimerOff /> : <XCircle />}\n        title={token === \"\" ? labels.noToken : labels[outcome]}\n        hint={labels.askAgain}\n        action={signedIn ? continueButton(\"secondary\") : undefined}\n        className={OUTCOME_CLASS}\n      />\n    );\n  }\n\n  return (\n    <div\n      {...rest}\n      data-state={outcome}\n      aria-busy={outcome === \"accepting\" || undefined}\n      className={cn(\"space-y-3\", className)}\n    >\n      {title === null ? null : <Heading className={STATUS_HEADING_CLASS}>{title ?? labels.title}</Heading>}\n      {body}\n      {/* Rendered from the start, so the outcome is read when it arrives. */}\n      <div {...regionProps} />\n    </div>\n  );\n}\n"],"mappings":";AAiKI,SAyBM,UAzBN,KAyBM,YAzBN;AAjKJ,SAAS,gBAAgB;AAEzB,SAAS,cAAc,OAAO,UAAU,eAAe;AACvD,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,QAAQ,kBAAkB;AACnC,SAAS,qBAAqB;AAC9B,SAAS,eAAe,sBAAsB,qBAAqB;AAkC5D,MAAM,mCAA2D;AAAA,EACtE,OAAO;AAAA,EACP,WAAW;AAAA,EACX,UAAU;AAAA,EACV,QAAQ,CAAC,SAAS,sBAAiB,IAAI;AAAA,EACvC,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,EACV,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AACZ;AA+DO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA0B;AACxB,QAAM,SAAS,aAAa,oBAAoB,kCAAkC,UAAU;AAC5F,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoE,IAAI;AACtG,QAAM,EAAE,UAAU,YAAY,IAAI,YAAY;AAE9C,gBAAc,UAAU,MAAM,WAAW,QAAQ,MAAM,UAAU,CAAC,KAAK,WAAW;AAChF,QAAI,OAAO,IAAI;AACb,YAAM,OAAO,OAAO,OAAO,MAAM,KAAK,KAAK;AAC3C,iBAAW,EAAE,OAAO,KAAK,SAAS,YAAY,KAAK,CAAC;AACpD,eAAS,OAAO,OAAO,OAAO,IAAI,IAAI,OAAO,QAAQ;AACrD;AAAA,IACF;AACA,UAAM,UACJ,gBAAgB,OAAO,KAAK,MAAM,cAAc,OAAO,KAAK,MAAM,uBAAuB,YAAY;AACvG,eAAW,EAAE,OAAO,KAAK,SAAS,QAAQ,CAAC;AAC3C,aAAS,YAAY,WAAW,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,EACtE,CAAC;AAED,QAAM,UACJ,UAAU,KACN,YACA,SAAS,UAAU,QACjB,QAAQ,UACR,WACE,cACA;AAEV,QAAM,iBAAiB,CAAC,YACtB,oBAAC,UAAO,MAAM,cAAc,SAAO,MAAC,SACjC,iBAAO,UACV;AAGF,MAAI;AACJ,MAAI,YAAY,aAAa;AAC3B,WAAO,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,WAAW;AAAA,EAC1D,WAAW,YAAY,YAAY;AACjC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,oBAAC,gBAAa;AAAA,QACpB,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAO;AAAA,QAC5D,QAAQ,eAAe,OAAO;AAAA,QAC9B,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,WAAW,YAAY,UAAU;AAC/B,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAM,oBAAC,SAAM;AAAA,QACb,OAAO,OAAO;AAAA,QACd,MAAM,OAAO;AAAA,QACb,QACE,iCACE;AAAA,8BAAC,UAAO,MAAM,YAAY,SAAQ,SAC/B,iBAAO,QACV;AAAA,UACC,iBAAiB,UAChB,oBAAC,UAAO,MAAM,cAAc,SAAQ,aACjC,iBAAO,UACV;AAAA,WAEJ;AAAA,QAEF,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,OAAO;AACL,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,YAAY,YAAY,oBAAC,YAAS,IAAK,oBAAC,WAAQ;AAAA,QACtD,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO,OAAO;AAAA,QACrD,MAAM,OAAO;AAAA,QACb,QAAQ,WAAW,eAAe,WAAW,IAAI;AAAA,QACjD,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ,cAAY;AAAA,MACZ,aAAW,YAAY,eAAe;AAAA,MACtC,WAAW,GAAG,aAAa,SAAS;AAAA,MAEnC;AAAA,kBAAU,OAAO,OAAO,oBAAC,WAAQ,WAAW,sBAAuB,mBAAS,OAAO,OAAM;AAAA,QACzF;AAAA,QAED,oBAAC,SAAK,GAAG,aAAa;AAAA;AAAA;AAAA,EACxB;AAEJ;","names":[]}

package/dist/auth/auth-errors.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every
+ * refusal the auth routes answer carries a machine-readable `code`, and the pages
+ * recognise the CODE, never the server's sentence.
+ *
+ * Today each app's pages print the server's `detail` string (keksdose's
+ * `extractApiErrorMessage`), which is English on every locale and, on a credential
+ * check, would be an account-enumeration oracle if it ever said more than one thing.
+ * keksdose already keys one refusal on a code (`features/budgets/plan-limit.ts`,
+ * `402 {detail, code: "plan_budget_limit"}`); §5.2 makes that the rule for auth. Each
+ * app switches its server and its pages together (§9).
+ *
+ * - `invalid_credentials` — unknown address, wrong password AND deactivated account:
+ *   one answer, in the same time (§2.10). `401`.
+ * - `registration_closed` — the sign-up gate refused the address. `403`.
+ * - `email_taken` — an account with this address exists. `409`.
+ * - `invitation_invalid`, `invitation_expired` — the `invite` token of a sign-up or an
+ *   accept (§4.4).
+ * - `token_invalid` — a one-time token (reset, verification, a sign-in challenge) is
+ *   unknown, spent or expired.
+ * - `account_inactive` — **no server answers it.** §2.10 decided that a deactivated
+ *   account gets `invalid_credentials`, because a separate answer after a correct
+ *   password would confirm a leaked one. It stays in the union only for a future server
+ *   step that is past the password (an admin view, a signed-in refresh) and may say so.
+ */
+type AuthErrorCode = "invalid_credentials" | "registration_closed" | "email_taken" | "invitation_invalid" | "invitation_expired" | "token_invalid" | "account_inactive";
+/**
+ * The {@link AuthErrorCode} an error carries, or `undefined` when it carries none.
+ *
+ * Reads the parsed response body wherever the apps' HTTP clients put it, without
+ * depending on any of them:
+ *
+ *  1. `err.response.data` — axios (keksdose's, kastlan's and Kurvenschmiede's clients;
+ *     keksdose's `isPlanBudgetLimitRefusal` reads the same path);
+ *  2. `err.data` — ofetch's `FetchError`, and most `fetch` wrappers that parse the body;
+ *  3. `err.body` — the generated OpenAPI clients' `ApiError`;
+ *  4. `err` itself — a body thrown as it came (`throw await res.json()`).
+ *
+ * In each, `code` or FastAPI's nested `detail.code`. Last, `err.code` — but only when
+ * it is one of the codes above: axios writes its OWN codes there (`ERR_NETWORK`,
+ * `ECONNABORTED`, `ERR_BAD_REQUEST`), and so does Node, so an unknown value is never
+ * read as a refusal. The HTTP status is not checked: the code is the contract, and the
+ * status differs per refusal (401, 403, 409, 410).
+ */
+declare function authErrorCode(err: unknown): AuthErrorCode | undefined;
+/**
+ * Whether `err` is a coded auth refusal — any of them, or the one named:
+ *
+ * ```ts
+ * try { await api.register(values) }
+ * catch (err) { if (isAuthError(err, "email_taken")) … }
+ * ```
+ *
+ * The kit's `SignInForm` and `RegisterForm` call it on what their callbacks reject
+ * with, so an app's `onSubmit` can simply let its client's error through. See
+ * {@link authErrorCode} for the shapes it reads.
+ */
+declare function isAuthError(err: unknown, code?: AuthErrorCode): boolean;
+
+export { type AuthErrorCode, authErrorCode, isAuthError };

package/dist/auth/auth-errors.js

@@ -0,0 +1,32 @@
+"use client";
+const CODES = /* @__PURE__ */ new Set([
+  "invalid_credentials",
+  "registration_closed",
+  "email_taken",
+  "invitation_invalid",
+  "invitation_expired",
+  "token_invalid",
+  "account_inactive"
+]);
+const isBag = (value) => typeof value === "object" && value !== null;
+function known(value) {
+  return typeof value === "string" && CODES.has(value) ? value : void 0;
+}
+function codeOfBody(body) {
+  if (!isBag(body)) return void 0;
+  return known(body.code) ?? (isBag(body.detail) ? known(body.detail.code) : void 0);
+}
+function authErrorCode(err) {
+  if (!isBag(err)) return void 0;
+  const response = err.response;
+  return (isBag(response) ? codeOfBody(response.data) : void 0) ?? codeOfBody(err.data) ?? codeOfBody(err.body) ?? codeOfBody(err);
+}
+function isAuthError(err, code) {
+  const found = authErrorCode(err);
+  return found !== void 0 && (code === void 0 || found === code);
+}
+export {
+  authErrorCode,
+  isAuthError
+};
+//# sourceMappingURL=auth-errors.js.map

package/dist/auth/auth-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/auth-errors.ts"],"sourcesContent":["/**\n * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every\n * refusal the auth routes answer carries a machine-readable `code`, and the pages\n * recognise the CODE, never the server's sentence.\n *\n * Today each app's pages print the server's `detail` string (keksdose's\n * `extractApiErrorMessage`), which is English on every locale and, on a credential\n * check, would be an account-enumeration oracle if it ever said more than one thing.\n * keksdose already keys one refusal on a code (`features/budgets/plan-limit.ts`,\n * `402 {detail, code: \"plan_budget_limit\"}`); §5.2 makes that the rule for auth. Each\n * app switches its server and its pages together (§9).\n *\n * - `invalid_credentials` — unknown address, wrong password AND deactivated account:\n *   one answer, in the same time (§2.10). `401`.\n * - `registration_closed` — the sign-up gate refused the address. `403`.\n * - `email_taken` — an account with this address exists. `409`.\n * - `invitation_invalid`, `invitation_expired` — the `invite` token of a sign-up or an\n *   accept (§4.4).\n * - `token_invalid` — a one-time token (reset, verification, a sign-in challenge) is\n *   unknown, spent or expired.\n * - `account_inactive` — **no server answers it.** §2.10 decided that a deactivated\n *   account gets `invalid_credentials`, because a separate answer after a correct\n *   password would confirm a leaked one. It stays in the union only for a future server\n *   step that is past the password (an admin view, a signed-in refresh) and may say so.\n */\nexport type AuthErrorCode =\n  | \"invalid_credentials\"\n  | \"registration_closed\"\n  | \"email_taken\"\n  | \"invitation_invalid\"\n  | \"invitation_expired\"\n  | \"token_invalid\"\n  | \"account_inactive\";\n\nconst CODES: ReadonlySet<string> = new Set<AuthErrorCode>([\n  \"invalid_credentials\",\n  \"registration_closed\",\n  \"email_taken\",\n  \"invitation_invalid\",\n  \"invitation_expired\",\n  \"token_invalid\",\n  \"account_inactive\",\n]);\n\ntype Bag = Record<string, unknown>;\n\nconst isBag = (value: unknown): value is Bag => typeof value === \"object\" && value !== null;\n\n/** A known code, or undefined. */\nfunction known(value: unknown): AuthErrorCode | undefined {\n  return typeof value === \"string\" && CODES.has(value) ? (value as AuthErrorCode) : undefined;\n}\n\n/** `{code}` on a parsed body, or FastAPI's `{detail: {code}}` — what an\n *  `HTTPException(detail={\"code\": …})` serialises to. */\nfunction codeOfBody(body: unknown): AuthErrorCode | undefined {\n  if (!isBag(body)) return undefined;\n  return known(body.code) ?? (isBag(body.detail) ? known(body.detail.code) : undefined);\n}\n\n/**\n * The {@link AuthErrorCode} an error carries, or `undefined` when it carries none.\n *\n * Reads the parsed response body wherever the apps' HTTP clients put it, without\n * depending on any of them:\n *\n *  1. `err.response.data` — axios (keksdose's, kastlan's and Kurvenschmiede's clients;\n *     keksdose's `isPlanBudgetLimitRefusal` reads the same path);\n *  2. `err.data` — ofetch's `FetchError`, and most `fetch` wrappers that parse the body;\n *  3. `err.body` — the generated OpenAPI clients' `ApiError`;\n *  4. `err` itself — a body thrown as it came (`throw await res.json()`).\n *\n * In each, `code` or FastAPI's nested `detail.code`. Last, `err.code` — but only when\n * it is one of the codes above: axios writes its OWN codes there (`ERR_NETWORK`,\n * `ECONNABORTED`, `ERR_BAD_REQUEST`), and so does Node, so an unknown value is never\n * read as a refusal. The HTTP status is not checked: the code is the contract, and the\n * status differs per refusal (401, 403, 409, 410).\n */\nexport function authErrorCode(err: unknown): AuthErrorCode | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (\n    (isBag(response) ? codeOfBody(response.data) : undefined) ??\n    codeOfBody(err.data) ??\n    codeOfBody(err.body) ??\n    codeOfBody(err)\n  );\n}\n\n/**\n * Whether `err` is a coded auth refusal — any of them, or the one named:\n *\n * ```ts\n * try { await api.register(values) }\n * catch (err) { if (isAuthError(err, \"email_taken\")) … }\n * ```\n *\n * The kit's `SignInForm` and `RegisterForm` call it on what their callbacks reject\n * with, so an app's `onSubmit` can simply let its client's error through. See\n * {@link authErrorCode} for the shapes it reads.\n */\nexport function isAuthError(err: unknown, code?: AuthErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && (code === undefined || found === code);\n}\n"],"mappings":";AAkCA,MAAM,QAA6B,oBAAI,IAAmB;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,MAAM,QAAQ,CAAC,UAAiC,OAAO,UAAU,YAAY,UAAU;AAGvF,SAAS,MAAM,OAA2C;AACxD,SAAO,OAAO,UAAU,YAAY,MAAM,IAAI,KAAK,IAAK,QAA0B;AACpF;AAIA,SAAS,WAAW,MAA0C;AAC5D,MAAI,CAAC,MAAM,IAAI,EAAG,QAAO;AACzB,SAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI;AAC7E;AAoBO,SAAS,cAAc,KAAyC;AACrE,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UACG,MAAM,QAAQ,IAAI,WAAW,SAAS,IAAI,IAAI,WAC/C,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,KACnB,WAAW,GAAG;AAElB;AAcO,SAAS,YAAY,KAAc,MAA+B;AACvE,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,WAAc,SAAS,UAAa,UAAU;AACjE;","names":[]}

package/dist/auth/complete-name-dialog.d.ts

@@ -0,0 +1,71 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+
+/** What `CompleteNameDialog` hands `onSave`: both names, trimmed, 1–120 characters —
+ *  `PATCH /auth/me {first_name, last_name}` (§6.1). */
+interface CompleteNameValues {
+    firstName: string;
+    lastName: string;
+}
+/**
+ * Every string the dialog renders — the `completeName` namespace of `<UiKitProvider
+ * labels>`, overridable per instance through `labels`.
+ */
+interface CompleteNameLabels {
+    title: string;
+    description: string;
+    firstName: string;
+    lastName: string;
+    save: string;
+    /** Dismisses the dialog until the next sign-in. */
+    later: string;
+    /** Under the fields when `onSave` rejected and the app passed no `error`. */
+    failed: string;
+}
+declare const DEFAULT_COMPLETE_NAME_LABELS: CompleteNameLabels;
+interface CompleteNameDialogProps {
+    /** What the account holds now — after the migration, the old display name (§3.3). */
+    firstName?: string;
+    /** Usually empty: that is why the dialog is up. */
+    lastName?: string;
+    /**
+     * Save the names (`PATCH /auth/me`). Resolve and the dialog closes (`onClose(true)`);
+     * reject and it stays open with the names kept and `error` — or "Your name could not
+     * be saved" — under them.
+     */
+    onSave: (values: CompleteNameValues) => Promise<unknown>;
+    /**
+     * The dialog has closed: `true` after a resolved `onSave`, `false` for "Later", Escape,
+     * the backdrop and Back. `false` only DEFERS it: the app shows it again after the
+     * next sign-in while `/auth/me` still answers `name_incomplete: true`.
+     */
+    onClose: (saved: boolean) => void;
+    /** The app's words for the last failed save, instead of `labels.failed`. Hidden again
+     *  once a name is edited. */
+    error?: ReactNode;
+    /** Kept-mounted mode, as on `Modal`: left out, the dialog is open while mounted. */
+    open?: boolean;
+    labels?: Partial<CompleteNameLabels>;
+}
+/**
+ * "Complete your name" — asked once after sign-in of a user whose name was migrated
+ * (docs/auth-harmonization.md §3.3). keksdose's and Kurvenschmiede's accounts had one
+ * `display_name`; it moved whole into `first_name`, `last_name` stayed empty, and
+ * nothing was split by guesswork (§2.4). The app shows this while `/auth/me` answers
+ * `name_incomplete: true` — never for a demo user.
+ *
+ * Both names prefilled with what is there; "Save" waits until both have 1–120
+ * characters after trimming. **"Later" only defers it**: nothing else waits on a
+ * complete name, no page is blocked, and the app asks again at the next sign-in.
+ *
+ * The promise handling is `ReauthDialog`'s: busy while `onSave` runs (the fields
+ * read-only, "Later" disabled, Escape held — a request that has left cannot be called
+ * back by closing the dialog), closed on resolve, kept open on reject. Save is a
+ * `commit` control, so a `WriteLockProvider` above it locks it with its reason.
+ *
+ * Focus starts in the first EMPTY field — the last name, as a rule — because filling it
+ * in is the whole of what the dialog is for.
+ */
+declare function CompleteNameDialog({ firstName: initialFirst, lastName: initialLast, onSave, onClose, error, open, labels: labelsProp, }: CompleteNameDialogProps): react.JSX.Element;
+
+export { CompleteNameDialog, type CompleteNameDialogProps, type CompleteNameLabels, type CompleteNameValues, DEFAULT_COMPLETE_NAME_LABELS };