@eifi1/ui-kit 0.28.1 → 0.29.0

package/dist/auth/complete-name-dialog.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/complete-name-dialog.tsx"],"sourcesContent":["import { useContext, useEffect, useId, useRef, useState } from \"react\";\nimport type { KeyboardEvent, ReactNode } from \"react\";\n\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { usePromisePending } from \"../components/danger-confirm\";\nimport { DialogFrame } from \"../components/dialog-frame\";\nimport { ModalCloseContext } from \"../components/modal\";\nimport { Button, Input } from \"../components/ui\";\nimport { personNameOk, PERSON_NAME_MAX_LENGTH } from \"./form-rules\";\n\n/** What `CompleteNameDialog` hands `onSave`: both names, trimmed, 1–120 characters —\n *  `PATCH /auth/me {first_name, last_name}` (§6.1). */\nexport interface CompleteNameValues {\n  firstName: string;\n  lastName: string;\n}\n\n/**\n * Every string the dialog renders — the `completeName` namespace of `<UiKitProvider\n * labels>`, overridable per instance through `labels`.\n */\nexport interface CompleteNameLabels {\n  title: string;\n  description: string;\n  firstName: string;\n  lastName: string;\n  save: string;\n  /** Dismisses the dialog until the next sign-in. */\n  later: string;\n  /** Under the fields when `onSave` rejected and the app passed no `error`. */\n  failed: string;\n}\n\nexport const DEFAULT_COMPLETE_NAME_LABELS: CompleteNameLabels = {\n  title: \"Complete your name\",\n  description: \"First and last name are now asked for separately. Check what is filled in and add what is missing.\",\n  firstName: \"First name\",\n  lastName: \"Last name\",\n  save: \"Save\",\n  later: \"Later\",\n  failed: \"Your name could not be saved. Please try again.\",\n};\n\nexport interface CompleteNameDialogProps {\n  /** What the account holds now — after the migration, the old display name (§3.3). */\n  firstName?: string;\n  /** Usually empty: that is why the dialog is up. */\n  lastName?: string;\n  /**\n   * Save the names (`PATCH /auth/me`). Resolve and the dialog closes (`onClose(true)`);\n   * reject and it stays open with the names kept and `error` — or \"Your name could not\n   * be saved\" — under them.\n   */\n  onSave: (values: CompleteNameValues) => Promise<unknown>;\n  /**\n   * The dialog has closed: `true` after a resolved `onSave`, `false` for \"Later\", Escape,\n   * the backdrop and Back. `false` only DEFERS it: the app shows it again after the\n   * next sign-in while `/auth/me` still answers `name_incomplete: true`.\n   */\n  onClose: (saved: boolean) => void;\n  /** The app's words for the last failed save, instead of `labels.failed`. Hidden again\n   *  once a name is edited. */\n  error?: ReactNode;\n  /** Kept-mounted mode, as on `Modal`: left out, the dialog is open while mounted. */\n  open?: boolean;\n  labels?: Partial<CompleteNameLabels>;\n}\n\n/**\n * \"Complete your name\" — asked once after sign-in of a user whose name was migrated\n * (docs/auth-harmonization.md §3.3). keksdose's and Kurvenschmiede's accounts had one\n * `display_name`; it moved whole into `first_name`, `last_name` stayed empty, and\n * nothing was split by guesswork (§2.4). The app shows this while `/auth/me` answers\n * `name_incomplete: true` — never for a demo user.\n *\n * Both names prefilled with what is there; \"Save\" waits until both have 1–120\n * characters after trimming. **\"Later\" only defers it**: nothing else waits on a\n * complete name, no page is blocked, and the app asks again at the next sign-in.\n *\n * The promise handling is `ReauthDialog`'s: busy while `onSave` runs (the fields\n * read-only, \"Later\" disabled, Escape held — a request that has left cannot be called\n * back by closing the dialog), closed on resolve, kept open on reject. Save is a\n * `commit` control, so a `WriteLockProvider` above it locks it with its reason.\n *\n * Focus starts in the first EMPTY field — the last name, as a rule — because filling it\n * in is the whole of what the dialog is for.\n */\nexport function CompleteNameDialog({\n  firstName: initialFirst = \"\",\n  lastName: initialLast = \"\",\n  onSave,\n  onClose,\n  error,\n  open,\n  labels: labelsProp,\n}: CompleteNameDialogProps) {\n  const labels = useKitLabels(\"completeName\", DEFAULT_COMPLETE_NAME_LABELS, labelsProp);\n  const [first, setFirst] = useState(initialFirst);\n  const [last, setLast] = useState(initialLast);\n  // A failed save describes the names that were sent; an edit makes it stale.\n  const [failed, setFailed] = useState(false);\n  const { pending, run } = usePromisePending();\n  const [done, setDone] = useState(false);\n  const saved = useRef(false);\n  const formId = useId();\n  const firstRef = useRef<HTMLInputElement>(null);\n  const lastRef = useRef<HTMLInputElement>(null);\n  const isOpen = open ?? true;\n\n  // Reopened (kept-mounted): start again from what the account holds. During render,\n  // as ReauthDialog wipes its password, so no frame shows the old draft.\n  const [wasOpen, setWasOpen] = useState(isOpen);\n  if (wasOpen !== isOpen) {\n    setWasOpen(isOpen);\n    if (isOpen) {\n      setFirst(initialFirst);\n      setLast(initialLast);\n      setFailed(false);\n      setDone(false);\n    }\n  }\n\n  // After Modal's own effect, so its trap has recorded the trigger before focus moves.\n  useEffect(() => {\n    if (!isOpen) return;\n    saved.current = false;\n    const target = firstRef.current?.value.trim() ? lastRef.current : firstRef.current;\n    target?.focus();\n  }, [isOpen]);\n\n  const canSave = personNameOk(first) && personNameOk(last);\n\n  const submit = () => {\n    if (pending || !canSave) return;\n    setFailed(false);\n    const values = { firstName: first.trim(), lastName: last.trim() };\n    let result: Promise<unknown>;\n    try {\n      result = Promise.resolve(onSave(values));\n    } catch (err) {\n      result = Promise.reject(err);\n    }\n    // A rejection must not go unhandled; usePromisePending clears `pending` on it.\n    result.catch(() => setFailed(true));\n    run(result, () => {\n      saved.current = true;\n      setDone(true);\n    });\n  };\n\n  const edit = (set: (value: string) => void) => (value: string) => {\n    set(value);\n    setFailed(false);\n  };\n\n  const message = failed ? (error ?? labels.failed) : undefined;\n\n  return (\n    <DialogFrame\n      open={open}\n      title={labels.title}\n      description={labels.description}\n      onClose={() => onClose(saved.current)}\n      onKeyDown={(e: KeyboardEvent<HTMLDivElement>) => {\n        if (pending && e.key === \"Escape\") e.preventDefault();\n      }}\n      aria-busy={pending || undefined}\n      actions={\n        <CompleteNameActions\n          formId={formId}\n          done={done}\n          busy={pending}\n          canSave={canSave}\n          laterLabel={labels.later}\n          saveLabel={labels.save}\n        />\n      }\n    >\n      <form\n        id={formId}\n        noValidate\n        className=\"grid gap-3 @container\"\n        onSubmit={(e) => {\n          e.preventDefault();\n          submit();\n        }}\n      >\n        <div className=\"grid gap-3 @xs:grid-cols-2\">\n          <Input\n            ref={firstRef}\n            name=\"given-name\"\n            autoComplete=\"given-name\"\n            label={labels.firstName}\n            value={first}\n            onChange={(e) => edit(setFirst)(e.target.value)}\n            maxLength={PERSON_NAME_MAX_LENGTH}\n            readOnly={pending}\n            required\n          />\n          <Input\n            ref={lastRef}\n            name=\"family-name\"\n            autoComplete=\"family-name\"\n            label={labels.lastName}\n            value={last}\n            onChange={(e) => edit(setLast)(e.target.value)}\n            maxLength={PERSON_NAME_MAX_LENGTH}\n            readOnly={pending}\n            required\n          />\n        </div>\n        {message !== undefined && (\n          <p role=\"alert\" className=\"text-xs text-[var(--danger)]\">\n            {message}\n          </p>\n        )}\n      </form>\n    </DialogFrame>\n  );\n}\n\n/** The actions row, inside the `Modal`, where its animated close is in context: a\n *  resolved save lowers the panel through it, as \"Later\" and Escape do. */\nfunction CompleteNameActions({\n  formId,\n  done,\n  busy,\n  canSave,\n  laterLabel,\n  saveLabel,\n}: {\n  formId: string;\n  done: boolean;\n  busy: boolean;\n  canSave: boolean;\n  laterLabel: string;\n  saveLabel: string;\n}) {\n  const close = useContext(ModalCloseContext);\n  useEffect(() => {\n    if (done) close?.();\n  }, [done, close]);\n  return (\n    <>\n      <Button type=\"button\" variant=\"ghost\" disabled={busy} onClick={() => close?.()}>\n        {laterLabel}\n      </Button>\n      <Button type=\"submit\" form={formId} commit disabled={!busy && !canSave} pending={busy}>\n        {saveLabel}\n      </Button>\n    </>\n  );\n}\n"],"mappings":";AAwKQ,SA2EJ,UA3EI,KAmBA,YAnBA;AAxKR,SAAS,YAAY,WAAW,OAAO,QAAQ,gBAAgB;AAG/D,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB;AAClC,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,QAAQ,aAAa;AAC9B,SAAS,cAAc,8BAA8B;AAyB9C,MAAM,+BAAmD;AAAA,EAC9D,OAAO;AAAA,EACP,aAAa;AAAA,EACb,WAAW;AAAA,EACX,UAAU;AAAA,EACV,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQ;AACV;AA8CO,SAAS,mBAAmB;AAAA,EACjC,WAAW,eAAe;AAAA,EAC1B,UAAU,cAAc;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAA4B;AAC1B,QAAM,SAAS,aAAa,gBAAgB,8BAA8B,UAAU;AACpF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,YAAY;AAC/C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,WAAW;AAE5C,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,EAAE,SAAS,IAAI,IAAI,kBAAkB;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,QAAQ,OAAO,KAAK;AAC1B,QAAM,SAAS,MAAM;AACrB,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,UAAU,OAAyB,IAAI;AAC7C,QAAM,SAAS,QAAQ;AAIvB,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,MAAM;AAC7C,MAAI,YAAY,QAAQ;AACtB,eAAW,MAAM;AACjB,QAAI,QAAQ;AACV,eAAS,YAAY;AACrB,cAAQ,WAAW;AACnB,gBAAU,KAAK;AACf,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAGA,YAAU,MAAM;AACd,QAAI,CAAC,OAAQ;AACb,UAAM,UAAU;AAChB,UAAM,SAAS,SAAS,SAAS,MAAM,KAAK,IAAI,QAAQ,UAAU,SAAS;AAC3E,YAAQ,MAAM;AAAA,EAChB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,UAAU,aAAa,KAAK,KAAK,aAAa,IAAI;AAExD,QAAM,SAAS,MAAM;AACnB,QAAI,WAAW,CAAC,QAAS;AACzB,cAAU,KAAK;AACf,UAAM,SAAS,EAAE,WAAW,MAAM,KAAK,GAAG,UAAU,KAAK,KAAK,EAAE;AAChE,QAAI;AACJ,QAAI;AACF,eAAS,QAAQ,QAAQ,OAAO,MAAM,CAAC;AAAA,IACzC,SAAS,KAAK;AACZ,eAAS,QAAQ,OAAO,GAAG;AAAA,IAC7B;AAEA,WAAO,MAAM,MAAM,UAAU,IAAI,CAAC;AAClC,QAAI,QAAQ,MAAM;AAChB,YAAM,UAAU;AAChB,cAAQ,IAAI;AAAA,IACd,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,CAAC,QAAiC,CAAC,UAAkB;AAChE,QAAI,KAAK;AACT,cAAU,KAAK;AAAA,EACjB;AAEA,QAAM,UAAU,SAAU,SAAS,OAAO,SAAU;AAEpD,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,OAAO,OAAO;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,SAAS,MAAM,QAAQ,MAAM,OAAO;AAAA,MACpC,WAAW,CAAC,MAAqC;AAC/C,YAAI,WAAW,EAAE,QAAQ,SAAU,GAAE,eAAe;AAAA,MACtD;AAAA,MACA,aAAW,WAAW;AAAA,MACtB,SACE;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,WAAW,OAAO;AAAA;AAAA,MACpB;AAAA,MAGF;AAAA,QAAC;AAAA;AAAA,UACC,IAAI;AAAA,UACJ,YAAU;AAAA,UACV,WAAU;AAAA,UACV,UAAU,CAAC,MAAM;AACf,cAAE,eAAe;AACjB,mBAAO;AAAA,UACT;AAAA,UAEA;AAAA,iCAAC,SAAI,WAAU,8BACb;AAAA;AAAA,gBAAC;AAAA;AAAA,kBACC,KAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,OAAO,OAAO;AAAA,kBACd,OAAO;AAAA,kBACP,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,EAAE,OAAO,KAAK;AAAA,kBAC9C,WAAW;AAAA,kBACX,UAAU;AAAA,kBACV,UAAQ;AAAA;AAAA,cACV;AAAA,cACA;AAAA,gBAAC;AAAA;AAAA,kBACC,KAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,OAAO,OAAO;AAAA,kBACd,OAAO;AAAA,kBACP,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,EAAE,OAAO,KAAK;AAAA,kBAC7C,WAAW;AAAA,kBACX,UAAU;AAAA,kBACV,UAAQ;AAAA;AAAA,cACV;AAAA,eACF;AAAA,YACC,YAAY,UACX,oBAAC,OAAE,MAAK,SAAQ,WAAU,gCACvB,mBACH;AAAA;AAAA;AAAA,MAEJ;AAAA;AAAA,EACF;AAEJ;AAIA,SAAS,oBAAoB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOG;AACD,QAAM,QAAQ,WAAW,iBAAiB;AAC1C,YAAU,MAAM;AACd,QAAI,KAAM,SAAQ;AAAA,EACpB,GAAG,CAAC,MAAM,KAAK,CAAC;AAChB,SACE,iCACE;AAAA,wBAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,UAAU,MAAM,SAAS,MAAM,QAAQ,GAC1E,sBACH;AAAA,IACA,oBAAC,UAAO,MAAK,UAAS,MAAM,QAAQ,QAAM,MAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,SAAS,MAC9E,qBACH;AAAA,KACF;AAEJ;","names":[]}

package/dist/auth/email-tag.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The address tag: `you@example.com` → `you+kastlan@example.com`, the app's own name as
+ * a sub-address of the address a person types for themselves (docs/auth-harmonization.md
+ * §4.5, Marcel 2026-10-05). Lifted from keksdose (`features/auth/email-tag.ts`, feedback
+ * dev#481), where the tag was the constant `keksdose`; here it is the app's.
+ *
+ * **Structurally valid is not the same as deliverable.** `+` is an ordinary character in
+ * the local part under RFC 5322, and sub-addressing — `user+tag@host` delivered to
+ * `user@host` — is specified (RFC 5233). But it is specified as a convention the
+ * RECEIVING server may implement: Gmail, Outlook, iCloud, Fastmail and Proton do; many
+ * Exchange installs, small hosters and corporate filters do not, and some web forms
+ * refuse the character outright.
+ *
+ * Which is why every caller OFFERS the result and never applies it. Silently registering
+ * somebody as `you+kastlan@example.com` would send the verification mail — the one
+ * message the account depends on — down a delivery path nobody checked, and make the
+ * address they sign in with one they never typed. The tag is a convenience for the
+ * person who wants it: one click, with the exact resulting address on the button
+ * (`RegisterForm` does this with its `emailTag`).
+ *
+ * The tagged address is then the identity. The server trims and lower-cases an address
+ * at every entry and never strips a tag, so `you@…` and `you+kastlan@…` are two
+ * different accounts; sign-in stays exact (§4.5), which is why `SignInForm`'s hint after
+ * a failed sign-in names the tagged address rather than trying it.
+ *
+ * Offer it only where a person types an address FOR THEMSELVES — sign-up, a later email
+ * change in the profile — never in a field for someone else's (an invite dialog, a
+ * share), where the tag would be a guess about another person's mail server.
+ */
+/**
+ * `taggedEmail("you@example.com", "kastlan")` → `"you+kastlan@example.com"`, or `null`
+ * when there is nothing to offer:
+ *
+ *  - the address is not complete enough to split — no local part, no domain, or a
+ *    domain without an inner dot (the shape the field's own `type="email"` accepts), so
+ *    the offer cannot appear before the address is plausible or linger once it stops
+ *    being one;
+ *  - the address already carries a `+` — the person's own scheme wins, and stacking a
+ *    second tag on it would be wrong;
+ *  - the tag is empty or not a plain name (see `TAG_SHAPE`).
+ *
+ * The tag is the app's name in lower case (`keksdose`, `kastlan`, `kurvenschmiede`); it
+ * is trimmed and lower-cased here, so `"Kastlan"` gives the same answer. The address is
+ * trimmed and otherwise kept as typed — normalising it is the server's job (server-kit's
+ * `normalise_email`).
+ */
+declare function taggedEmail(email: string, tag: string): string | null;
+/**
+ * The trimmed address split at its last `@`, or `null` while it is not complete enough
+ * to split: no local part, no domain, or a domain without an inner dot — the shape the
+ * field's own `type="email"` accepts.
+ *
+ * @internal `RegisterForm` gates its submit on it; not part of the barrel.
+ */
+declare function emailParts(email: string): {
+    local: string;
+    domain: string;
+} | null;
+
+export { emailParts, taggedEmail };

package/dist/auth/email-tag.js

@@ -0,0 +1,23 @@
+"use client";
+const TAG_SHAPE = /^[a-z0-9][a-z0-9._-]*$/;
+function taggedEmail(email, tag) {
+  const name = tag.trim().toLowerCase();
+  if (!TAG_SHAPE.test(name)) return null;
+  const parts = emailParts(email);
+  if (!parts || parts.local.includes("+")) return null;
+  return `${parts.local}+${name}@${parts.domain}`;
+}
+function emailParts(email) {
+  const trimmed = email.trim();
+  const at = trimmed.lastIndexOf("@");
+  if (at <= 0 || at === trimmed.length - 1) return null;
+  const local = trimmed.slice(0, at);
+  const domain = trimmed.slice(at + 1);
+  if (!domain.includes(".") || domain.startsWith(".") || domain.endsWith(".")) return null;
+  return { local, domain };
+}
+export {
+  emailParts,
+  taggedEmail
+};
+//# sourceMappingURL=email-tag.js.map

package/dist/auth/email-tag.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/email-tag.ts"],"sourcesContent":["/**\n * The address tag: `you@example.com` → `you+kastlan@example.com`, the app's own name as\n * a sub-address of the address a person types for themselves (docs/auth-harmonization.md\n * §4.5, Marcel 2026-10-05). Lifted from keksdose (`features/auth/email-tag.ts`, feedback\n * dev#481), where the tag was the constant `keksdose`; here it is the app's.\n *\n * **Structurally valid is not the same as deliverable.** `+` is an ordinary character in\n * the local part under RFC 5322, and sub-addressing — `user+tag@host` delivered to\n * `user@host` — is specified (RFC 5233). But it is specified as a convention the\n * RECEIVING server may implement: Gmail, Outlook, iCloud, Fastmail and Proton do; many\n * Exchange installs, small hosters and corporate filters do not, and some web forms\n * refuse the character outright.\n *\n * Which is why every caller OFFERS the result and never applies it. Silently registering\n * somebody as `you+kastlan@example.com` would send the verification mail — the one\n * message the account depends on — down a delivery path nobody checked, and make the\n * address they sign in with one they never typed. The tag is a convenience for the\n * person who wants it: one click, with the exact resulting address on the button\n * (`RegisterForm` does this with its `emailTag`).\n *\n * The tagged address is then the identity. The server trims and lower-cases an address\n * at every entry and never strips a tag, so `you@…` and `you+kastlan@…` are two\n * different accounts; sign-in stays exact (§4.5), which is why `SignInForm`'s hint after\n * a failed sign-in names the tagged address rather than trying it.\n *\n * Offer it only where a person types an address FOR THEMSELVES — sign-up, a later email\n * change in the profile — never in a field for someone else's (an invite dialog, a\n * share), where the tag would be a guess about another person's mail server.\n */\n\n/** What a tag may be: the app's name, lower case — letters, digits, `.`, `_`, `-`. A\n *  space, `@` or `+` would make the result something other than a sub-address. */\nconst TAG_SHAPE = /^[a-z0-9][a-z0-9._-]*$/;\n\n/**\n * `taggedEmail(\"you@example.com\", \"kastlan\")` → `\"you+kastlan@example.com\"`, or `null`\n * when there is nothing to offer:\n *\n *  - the address is not complete enough to split — no local part, no domain, or a\n *    domain without an inner dot (the shape the field's own `type=\"email\"` accepts), so\n *    the offer cannot appear before the address is plausible or linger once it stops\n *    being one;\n *  - the address already carries a `+` — the person's own scheme wins, and stacking a\n *    second tag on it would be wrong;\n *  - the tag is empty or not a plain name (see `TAG_SHAPE`).\n *\n * The tag is the app's name in lower case (`keksdose`, `kastlan`, `kurvenschmiede`); it\n * is trimmed and lower-cased here, so `\"Kastlan\"` gives the same answer. The address is\n * trimmed and otherwise kept as typed — normalising it is the server's job (server-kit's\n * `normalise_email`).\n */\nexport function taggedEmail(email: string, tag: string): string | null {\n  const name = tag.trim().toLowerCase();\n  if (!TAG_SHAPE.test(name)) return null;\n  const parts = emailParts(email);\n  if (!parts || parts.local.includes(\"+\")) return null;\n  return `${parts.local}+${name}@${parts.domain}`;\n}\n\n/**\n * The trimmed address split at its last `@`, or `null` while it is not complete enough\n * to split: no local part, no domain, or a domain without an inner dot — the shape the\n * field's own `type=\"email\"` accepts.\n *\n * @internal `RegisterForm` gates its submit on it; not part of the barrel.\n */\nexport function emailParts(email: string): { local: string; domain: string } | null {\n  const trimmed = email.trim();\n  const at = trimmed.lastIndexOf(\"@\");\n  if (at <= 0 || at === trimmed.length - 1) return null;\n  const local = trimmed.slice(0, at);\n  const domain = trimmed.slice(at + 1);\n  if (!domain.includes(\".\") || domain.startsWith(\".\") || domain.endsWith(\".\")) return null;\n  return { local, domain };\n}\n"],"mappings":";AAgCA,MAAM,YAAY;AAmBX,SAAS,YAAY,OAAe,KAA4B;AACrE,QAAM,OAAO,IAAI,KAAK,EAAE,YAAY;AACpC,MAAI,CAAC,UAAU,KAAK,IAAI,EAAG,QAAO;AAClC,QAAM,QAAQ,WAAW,KAAK;AAC9B,MAAI,CAAC,SAAS,MAAM,MAAM,SAAS,GAAG,EAAG,QAAO;AAChD,SAAO,GAAG,MAAM,KAAK,IAAI,IAAI,IAAI,MAAM,MAAM;AAC/C;AASO,SAAS,WAAW,OAAyD;AAClF,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,KAAK,QAAQ,YAAY,GAAG;AAClC,MAAI,MAAM,KAAK,OAAO,QAAQ,SAAS,EAAG,QAAO;AACjD,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE;AACjC,QAAM,SAAS,QAAQ,MAAM,KAAK,CAAC;AACnC,MAAI,CAAC,OAAO,SAAS,GAAG,KAAK,OAAO,WAAW,GAAG,KAAK,OAAO,SAAS,GAAG,EAAG,QAAO;AACpF,SAAO,EAAE,OAAO,OAAO;AACzB;","names":[]}

package/dist/auth/forgot-password-form.d.ts

@@ -0,0 +1,79 @@
+import * as react from 'react';
+import { ComponentPropsWithoutRef, ReactNode } from 'react';
+import { AuthHeadingLevel } from './status-parts.js';
+
+/** Every string the form renders — the `forgotPassword` namespace. keksdose's words
+ *  (`auth.forgot.*`), which kastlan took over unchanged. */
+interface ForgotPasswordLabels {
+    /** The heading. */
+    title: string;
+    /** Under the heading, before the field. */
+    intro: string;
+    /** The email field's label. */
+    email: string;
+    submit: string;
+    /** The one answer, whatever the server knows — given the address as typed. */
+    sent: (email: string) => string;
+    /** Under it: how long the link lives, and where else to look. */
+    sentHint: string;
+    /** The link back to the sign-in page, on both states. */
+    backToSignIn: string;
+    /** A request that did not go through: a throttle, an outage. Never "unknown
+     *  address" — the endpoint does not say. */
+    error: string;
+}
+declare const DEFAULT_FORGOT_PASSWORD_LABELS: ForgotPasswordLabels;
+interface ForgotPasswordFormProps extends Omit<ComponentPropsWithoutRef<"div">, "onSubmit" | "children" | "title"> {
+    /**
+     * The address was submitted, trimmed: send `POST /auth/password-reset/request`.
+     * Resolve when the server answered — whatever it answered: it is `204` whether or not
+     * an account exists. Reject only when the request did not go through (a throttle, an
+     * outage); the form then stays, with the address, and says so. The form never sends a
+     * request itself (§8).
+     */
+    onSubmit: (email: string) => Promise<unknown> | void;
+    /** "Back to sign in" — the app's `/login`. Default `/login`. */
+    signInHref?: string;
+    /** The field's start value — the address the sign-in form already had, so someone
+     *  whose password just failed need not type it twice. */
+    defaultEmail?: string;
+    /**
+     * The app's words for a failed request (a `429`: "Too many requests — try again in
+     * an hour"), or `undefined` for the kit's `error`. The same hook as `SignInForm`'s.
+     */
+    describeError?: (error: unknown) => ReactNode | undefined;
+    /** App content under the intro — a notice, a support address. */
+    formContent?: ReactNode;
+    /** The heading. Default `labels.title`; `null` draws none, for a page that puts it
+     *  in `AuthLayout`'s `title` instead. */
+    title?: ReactNode;
+    /** The heading's level. Default `h2`, under the page's `h1`. */
+    headingAs?: AuthHeadingLevel;
+    labels?: Partial<ForgotPasswordLabels>;
+}
+/**
+ * "I forgot my password" for every app (docs/auth-harmonization.md §7): one field, then
+ * the same sentence whatever the answer — keksdose's `ForgotPasswordPage`
+ * (features/auth/forgot-password-page.tsx), kastlan's copy of it, as one component.
+ *
+ * **It always ends on the same message**: "If an account exists for …, the link is on
+ * its way." The server answers `204` whether or not the address has an account — so the
+ * page cannot be used to find out who has one — and the page must not undo that by
+ * saying more than the server knows. Worded as a promise ("we sent you a link"), a typo
+ * would look like a mail-delivery problem and send the person waiting instead of trying
+ * their other address (keksdose #198). The address shown is the one they typed, so a
+ * typo is visible.
+ *
+ * The only failure it can show is a request that did not go through (throttled, the
+ * server down), never "unknown address". §4.5's fallback to a tagged address
+ * (`you+kastlan@…` when `you@…` has no account) is the server's and changes nothing here.
+ *
+ * The submit is not disabled while the field is empty — a browser that autofills
+ * withholds the value until the first interaction, and a disabled button would swallow
+ * that first click; the field's own `required` answers an empty submit instead. After a
+ * submit the confirmation takes focus, because the button that had it is gone with the
+ * form.
+ */
+declare function ForgotPasswordForm({ onSubmit, signInHref, defaultEmail, describeError, formContent, title, headingAs: Heading, labels: labelsProp, className, ...rest }: ForgotPasswordFormProps): react.JSX.Element;
+
+export { DEFAULT_FORGOT_PASSWORD_LABELS, ForgotPasswordForm, type ForgotPasswordFormProps, type ForgotPasswordLabels };

package/dist/auth/forgot-password-form.js

@@ -0,0 +1,120 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { useId, useRef, useState } from "react";
+import { MailCheck } from "lucide-react";
+import { cn } from "../lib/cn.js";
+import { useKitLabels } from "../i18n/kit-labels.js";
+import { AlertBanner } from "../components/alert-banner.js";
+import { TextLink } from "../components/text-link.js";
+import { Button, Input } from "../components/ui.js";
+import { FORM_HEADING_CLASS, INTRO_CLASS, OutcomeMessage, isThenable, useFocusWhen } from "./status-parts.js";
+const DEFAULT_FORGOT_PASSWORD_LABELS = {
+  title: "Forgot password",
+  intro: "Enter your account\u2019s email address. We\u2019ll send you a link to choose a new password.",
+  email: "Email",
+  submit: "Send the link",
+  sent: (email) => `If an account exists for ${email}, the link is on its way.`,
+  sentHint: "The link is valid for one hour and works exactly once. Check your spam folder too.",
+  backToSignIn: "Back to sign in",
+  error: "The request failed. Please try again later."
+};
+function ForgotPasswordForm({
+  onSubmit,
+  signInHref = "/login",
+  defaultEmail = "",
+  describeError,
+  formContent,
+  title,
+  headingAs: Heading = "h2",
+  labels: labelsProp,
+  className,
+  ...rest
+}) {
+  const labels = useKitLabels("forgotPassword", DEFAULT_FORGOT_PASSWORD_LABELS, labelsProp);
+  const [email, setEmail] = useState(defaultEmail);
+  const [pending, setPending] = useState(false);
+  const [failure, setFailure] = useState(null);
+  const [sentTo, setSentTo] = useState(null);
+  const headingId = useId();
+  const sentRef = useRef(null);
+  useFocusWhen(sentTo !== null, sentRef);
+  const heading = title === null ? null : /* @__PURE__ */ jsx(Heading, { id: headingId, className: FORM_HEADING_CLASS, children: title ?? labels.title });
+  const back = /* @__PURE__ */ jsx("p", { className: "text-center text-sm", children: /* @__PURE__ */ jsx(TextLink, { href: signInHref, tone: "primary", children: labels.backToSignIn }) });
+  if (sentTo !== null) {
+    return /* @__PURE__ */ jsxs("div", { ...rest, "data-state": "sent", className: cn("space-y-3", className), children: [
+      heading,
+      /* @__PURE__ */ jsxs(OutcomeMessage, { icon: /* @__PURE__ */ jsx(MailCheck, { className: "text-[var(--success)]" }), focusRef: sentRef, children: [
+        /* @__PURE__ */ jsx("p", { className: INTRO_CLASS, children: labels.sent(sentTo) }),
+        /* @__PURE__ */ jsx("p", { className: "text-xs text-[var(--text-muted)]", children: labels.sentHint })
+      ] }),
+      back
+    ] });
+  }
+  const submit = (e) => {
+    e.preventDefault();
+    const address = email.trim();
+    if (pending || address === "") return;
+    setFailure(null);
+    let result;
+    try {
+      result = onSubmit(address);
+    } catch (error) {
+      setFailure(describeError?.(error) ?? labels.error);
+      return;
+    }
+    if (!isThenable(result)) {
+      setSentTo(address);
+      return;
+    }
+    setPending(true);
+    result.then(
+      () => {
+        setPending(false);
+        setSentTo(address);
+      },
+      (error) => {
+        setPending(false);
+        setFailure(describeError?.(error) ?? labels.error);
+      }
+    );
+  };
+  return /* @__PURE__ */ jsxs("div", { ...rest, "data-state": "form", className: cn("space-y-3", className), children: [
+    /* @__PURE__ */ jsxs(
+      "form",
+      {
+        className: "space-y-3",
+        "aria-labelledby": title === null ? void 0 : headingId,
+        onSubmit: submit,
+        children: [
+          heading,
+          /* @__PURE__ */ jsx("p", { className: INTRO_CLASS, children: labels.intro }),
+          formContent,
+          /* @__PURE__ */ jsx(
+            Input,
+            {
+              type: "email",
+              name: "email",
+              autoComplete: "email",
+              label: labels.email,
+              value: email,
+              onChange: (e) => {
+                setEmail(e.target.value);
+                if (failure) setFailure(null);
+              },
+              readOnly: pending,
+              required: true
+            }
+          ),
+          failure != null && /* @__PURE__ */ jsx(AlertBanner, { tone: "danger", size: "sm", role: "alert", children: failure }),
+          /* @__PURE__ */ jsx(Button, { type: "submit", className: "w-full", pending, children: labels.submit })
+        ]
+      }
+    ),
+    back
+  ] });
+}
+export {
+  DEFAULT_FORGOT_PASSWORD_LABELS,
+  ForgotPasswordForm
+};
+//# sourceMappingURL=forgot-password-form.js.map

package/dist/auth/forgot-password-form.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/forgot-password-form.tsx"],"sourcesContent":["import { useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, FormEvent, ReactNode } from \"react\";\nimport { MailCheck } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { TextLink } from \"../components/text-link\";\nimport { Button, Input } from \"../components/ui\";\nimport { FORM_HEADING_CLASS, INTRO_CLASS, OutcomeMessage, isThenable, useFocusWhen } from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `forgotPassword` namespace. keksdose's words\n *  (`auth.forgot.*`), which kastlan took over unchanged. */\nexport interface ForgotPasswordLabels {\n  /** The heading. */\n  title: string;\n  /** Under the heading, before the field. */\n  intro: string;\n  /** The email field's label. */\n  email: string;\n  submit: string;\n  /** The one answer, whatever the server knows — given the address as typed. */\n  sent: (email: string) => string;\n  /** Under it: how long the link lives, and where else to look. */\n  sentHint: string;\n  /** The link back to the sign-in page, on both states. */\n  backToSignIn: string;\n  /** A request that did not go through: a throttle, an outage. Never \"unknown\n   *  address\" — the endpoint does not say. */\n  error: string;\n}\n\nexport const DEFAULT_FORGOT_PASSWORD_LABELS: ForgotPasswordLabels = {\n  title: \"Forgot password\",\n  intro: \"Enter your account’s email address. We’ll send you a link to choose a new password.\",\n  email: \"Email\",\n  submit: \"Send the link\",\n  sent: (email) => `If an account exists for ${email}, the link is on its way.`,\n  sentHint: \"The link is valid for one hour and works exactly once. Check your spam folder too.\",\n  backToSignIn: \"Back to sign in\",\n  error: \"The request failed. Please try again later.\",\n};\n\n/* ── The form ────────────────────────────────────────────────────────────── */\n\nexport interface ForgotPasswordFormProps\n  extends Omit<ComponentPropsWithoutRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /**\n   * The address was submitted, trimmed: send `POST /auth/password-reset/request`.\n   * Resolve when the server answered — whatever it answered: it is `204` whether or not\n   * an account exists. Reject only when the request did not go through (a throttle, an\n   * outage); the form then stays, with the address, and says so. The form never sends a\n   * request itself (§8).\n   */\n  onSubmit: (email: string) => Promise<unknown> | void;\n  /** \"Back to sign in\" — the app's `/login`. Default `/login`. */\n  signInHref?: string;\n  /** The field's start value — the address the sign-in form already had, so someone\n   *  whose password just failed need not type it twice. */\n  defaultEmail?: string;\n  /**\n   * The app's words for a failed request (a `429`: \"Too many requests — try again in\n   * an hour\"), or `undefined` for the kit's `error`. The same hook as `SignInForm`'s.\n   */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** App content under the intro — a notice, a support address. */\n  formContent?: ReactNode;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<ForgotPasswordLabels>;\n}\n\n/**\n * \"I forgot my password\" for every app (docs/auth-harmonization.md §7): one field, then\n * the same sentence whatever the answer — keksdose's `ForgotPasswordPage`\n * (features/auth/forgot-password-page.tsx), kastlan's copy of it, as one component.\n *\n * **It always ends on the same message**: \"If an account exists for …, the link is on\n * its way.\" The server answers `204` whether or not the address has an account — so the\n * page cannot be used to find out who has one — and the page must not undo that by\n * saying more than the server knows. Worded as a promise (\"we sent you a link\"), a typo\n * would look like a mail-delivery problem and send the person waiting instead of trying\n * their other address (keksdose #198). The address shown is the one they typed, so a\n * typo is visible.\n *\n * The only failure it can show is a request that did not go through (throttled, the\n * server down), never \"unknown address\". §4.5's fallback to a tagged address\n * (`you+kastlan@…` when `you@…` has no account) is the server's and changes nothing here.\n *\n * The submit is not disabled while the field is empty — a browser that autofills\n * withholds the value until the first interaction, and a disabled button would swallow\n * that first click; the field's own `required` answers an empty submit instead. After a\n * submit the confirmation takes focus, because the button that had it is gone with the\n * form.\n */\nexport function ForgotPasswordForm({\n  onSubmit,\n  signInHref = \"/login\",\n  defaultEmail = \"\",\n  describeError,\n  formContent,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ForgotPasswordFormProps) {\n  const labels = useKitLabels(\"forgotPassword\", DEFAULT_FORGOT_PASSWORD_LABELS, labelsProp);\n  const [email, setEmail] = useState(defaultEmail);\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const [sentTo, setSentTo] = useState<string | null>(null);\n  const headingId = useId();\n  const sentRef = useRef<HTMLDivElement>(null);\n  useFocusWhen(sentTo !== null, sentRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const back = (\n    <p className=\"text-center text-sm\">\n      <TextLink href={signInHref} tone=\"primary\">\n        {labels.backToSignIn}\n      </TextLink>\n    </p>\n  );\n\n  if (sentTo !== null) {\n    return (\n      <div {...rest} data-state=\"sent\" className={cn(\"space-y-3\", className)}>\n        {heading}\n        <OutcomeMessage icon={<MailCheck className=\"text-[var(--success)]\" />} focusRef={sentRef}>\n          <p className={INTRO_CLASS}>{labels.sent(sentTo)}</p>\n          <p className=\"text-xs text-[var(--text-muted)]\">{labels.sentHint}</p>\n        </OutcomeMessage>\n        {back}\n      </div>\n    );\n  }\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    const address = email.trim();\n    if (pending || address === \"\") return;\n    setFailure(null);\n    let result: unknown;\n    try {\n      result = onSubmit(address);\n    } catch (error) {\n      setFailure(describeError?.(error) ?? labels.error);\n      return;\n    }\n    if (!isThenable(result)) {\n      setSentTo(address);\n      return;\n    }\n    setPending(true);\n    result.then(\n      () => {\n        setPending(false);\n        setSentTo(address);\n      },\n      (error: unknown) => {\n        setPending(false);\n        setFailure(describeError?.(error) ?? labels.error);\n      },\n    );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={cn(\"space-y-3\", className)}>\n      <form\n        className=\"space-y-3\"\n        aria-labelledby={title === null ? undefined : headingId}\n        onSubmit={submit}\n      >\n        {heading}\n        <p className={INTRO_CLASS}>{labels.intro}</p>\n        {formContent}\n        <Input\n          type=\"email\"\n          name=\"email\"\n          autoComplete=\"email\"\n          label={labels.email}\n          value={email}\n          onChange={(e) => {\n            setEmail(e.target.value);\n            if (failure) setFailure(null);\n          }}\n          readOnly={pending}\n          required\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n      {back}\n    </div>\n  );\n}\n"],"mappings":";AA2HM,cAgBE,YAhBF;AA3HN,SAAS,OAAO,QAAQ,gBAAgB;AAExC,SAAS,iBAAiB;AAC1B,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAS,QAAQ,aAAa;AAC9B,SAAS,oBAAoB,aAAa,gBAAgB,YAAY,oBAAoB;AA0BnF,MAAM,iCAAuD;AAAA,EAClE,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM,CAAC,UAAU,4BAA4B,KAAK;AAAA,EAClD,UAAU;AAAA,EACV,cAAc;AAAA,EACd,OAAO;AACT;AAyDO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,aAAa;AAAA,EACb,eAAe;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA4B;AAC1B,QAAM,SAAS,aAAa,kBAAkB,gCAAgC,UAAU;AACxF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,YAAY;AAC/C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAwB,IAAI;AACxD,QAAM,YAAY,MAAM;AACxB,QAAM,UAAU,OAAuB,IAAI;AAC3C,eAAa,WAAW,MAAM,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,OACJ,oBAAC,OAAE,WAAU,uBACX,8BAAC,YAAS,MAAM,YAAY,MAAK,WAC9B,iBAAO,cACV,GACF;AAGF,MAAI,WAAW,MAAM;AACnB,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,GAAG,aAAa,SAAS,GAClE;AAAA;AAAA,MACD,qBAAC,kBAAe,MAAM,oBAAC,aAAU,WAAU,yBAAwB,GAAI,UAAU,SAC/E;AAAA,4BAAC,OAAE,WAAW,aAAc,iBAAO,KAAK,MAAM,GAAE;AAAA,QAChD,oBAAC,OAAE,WAAU,oCAAoC,iBAAO,UAAS;AAAA,SACnE;AAAA,MACC;AAAA,OACH;AAAA,EAEJ;AAEA,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,WAAW,YAAY,GAAI;AAC/B,eAAW,IAAI;AACf,QAAI;AACJ,QAAI;AACF,eAAS,SAAS,OAAO;AAAA,IAC3B,SAAS,OAAO;AACd,iBAAW,gBAAgB,KAAK,KAAK,OAAO,KAAK;AACjD;AAAA,IACF;AACA,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,gBAAU,OAAO;AACjB;AAAA,IACF;AACA,eAAW,IAAI;AACf,WAAO;AAAA,MACL,MAAM;AACJ,mBAAW,KAAK;AAChB,kBAAU,OAAO;AAAA,MACnB;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAChB,mBAAW,gBAAgB,KAAK,KAAK,OAAO,KAAK;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,SACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,GAAG,aAAa,SAAS,GACnE;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QACV,mBAAiB,UAAU,OAAO,SAAY;AAAA,QAC9C,UAAU;AAAA,QAET;AAAA;AAAA,UACD,oBAAC,OAAE,WAAW,aAAc,iBAAO,OAAM;AAAA,UACxC;AAAA,UACD;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,MAAK;AAAA,cACL,cAAa;AAAA,cACb,OAAO,OAAO;AAAA,cACd,OAAO;AAAA,cACP,UAAU,CAAC,MAAM;AACf,yBAAS,EAAE,OAAO,KAAK;AACvB,oBAAI,QAAS,YAAW,IAAI;AAAA,cAC9B;AAAA,cACA,UAAU;AAAA,cACV,UAAQ;AAAA;AAAA,UACV;AAAA,UACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,UAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,SACtC,iBAAO,QACV;AAAA;AAAA;AAAA,IACF;AAAA,IACC;AAAA,KACH;AAEJ;","names":[]}

package/dist/auth/form-rules.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The few hard rules of the sign-up and sign-in forms, in one place — and the only ones
+ * (docs/auth-harmonization.md §3.1, §8). The servers check the same; the kit adds no
+ * rule of its own, and everything the strength meter shows beyond these is advice.
+ *
+ * @internal Shared by RegisterForm, SignInForm and CompleteNameDialog; the coordinator
+ * decides whether the constants join the barrel.
+ */
+/** At least 8 characters. */
+declare const PASSWORD_MIN_LENGTH = 8;
+/** At most 72 BYTES — bcrypt reads no further, so a longer password would be silently
+ *  cut. "ü" is two bytes, an emoji four. */
+declare const PASSWORD_MAX_BYTES = 72;
+/** A first or last name: 1–120 characters after trimming — the old `display_name`
+ *  limit, so a migrated name fits (§3.1). */
+declare const PERSON_NAME_MAX_LENGTH = 120;
+/** 1–120 characters after trimming. */
+declare function personNameOk(value: string): boolean;
+/**
+ * Why a new password and its confirmation may not be submitted yet, or `null` when they
+ * may — keksdose's `passwordPairError` (features/auth/password-fields.tsx). Characters
+ * are counted as code points, as the strength meter counts them: an emoji is one
+ * character to the person typing it.
+ */
+declare function newPasswordProblem(password: string, confirm: string): "length" | "bytes" | "mismatch" | null;
+
+export { PASSWORD_MAX_BYTES, PASSWORD_MIN_LENGTH, PERSON_NAME_MAX_LENGTH, newPasswordProblem, personNameOk };

package/dist/auth/form-rules.js

@@ -0,0 +1,23 @@
+"use client";
+import { passwordByteLength } from "../components/password-strength.js";
+const PASSWORD_MIN_LENGTH = 8;
+const PASSWORD_MAX_BYTES = 72;
+const PERSON_NAME_MAX_LENGTH = 120;
+function personNameOk(value) {
+  const length = value.trim().length;
+  return length >= 1 && length <= PERSON_NAME_MAX_LENGTH;
+}
+function newPasswordProblem(password, confirm) {
+  if ([...password].length < PASSWORD_MIN_LENGTH) return "length";
+  if (passwordByteLength(password) > PASSWORD_MAX_BYTES) return "bytes";
+  if (password !== confirm) return "mismatch";
+  return null;
+}
+export {
+  PASSWORD_MAX_BYTES,
+  PASSWORD_MIN_LENGTH,
+  PERSON_NAME_MAX_LENGTH,
+  newPasswordProblem,
+  personNameOk
+};
+//# sourceMappingURL=form-rules.js.map

package/dist/auth/form-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/form-rules.ts"],"sourcesContent":["import { passwordByteLength } from \"../components/password-strength\";\n\n/**\n * The few hard rules of the sign-up and sign-in forms, in one place — and the only ones\n * (docs/auth-harmonization.md §3.1, §8). The servers check the same; the kit adds no\n * rule of its own, and everything the strength meter shows beyond these is advice.\n *\n * @internal Shared by RegisterForm, SignInForm and CompleteNameDialog; the coordinator\n * decides whether the constants join the barrel.\n */\n\n/** At least 8 characters. */\nexport const PASSWORD_MIN_LENGTH = 8;\n\n/** At most 72 BYTES — bcrypt reads no further, so a longer password would be silently\n *  cut. \"ü\" is two bytes, an emoji four. */\nexport const PASSWORD_MAX_BYTES = 72;\n\n/** A first or last name: 1–120 characters after trimming — the old `display_name`\n *  limit, so a migrated name fits (§3.1). */\nexport const PERSON_NAME_MAX_LENGTH = 120;\n\n/** 1–120 characters after trimming. */\nexport function personNameOk(value: string): boolean {\n  const length = value.trim().length;\n  return length >= 1 && length <= PERSON_NAME_MAX_LENGTH;\n}\n\n/**\n * Why a new password and its confirmation may not be submitted yet, or `null` when they\n * may — keksdose's `passwordPairError` (features/auth/password-fields.tsx). Characters\n * are counted as code points, as the strength meter counts them: an emoji is one\n * character to the person typing it.\n */\nexport function newPasswordProblem(password: string, confirm: string): \"length\" | \"bytes\" | \"mismatch\" | null {\n  if ([...password].length < PASSWORD_MIN_LENGTH) return \"length\";\n  if (passwordByteLength(password) > PASSWORD_MAX_BYTES) return \"bytes\";\n  if (password !== confirm) return \"mismatch\";\n  return null;\n}\n"],"mappings":";AAAA,SAAS,0BAA0B;AAY5B,MAAM,sBAAsB;AAI5B,MAAM,qBAAqB;AAI3B,MAAM,yBAAyB;AAG/B,SAAS,aAAa,OAAwB;AACnD,QAAM,SAAS,MAAM,KAAK,EAAE;AAC5B,SAAO,UAAU,KAAK,UAAU;AAClC;AAQO,SAAS,mBAAmB,UAAkB,SAAyD;AAC5G,MAAI,CAAC,GAAG,QAAQ,EAAE,SAAS,oBAAqB,QAAO;AACvD,MAAI,mBAAmB,QAAQ,IAAI,mBAAoB,QAAO;AAC9D,MAAI,aAAa,QAAS,QAAO;AACjC,SAAO;AACT;","names":[]}

package/dist/auth/new-password-fields.d.ts

@@ -0,0 +1,38 @@
+import * as react from 'react';
+import { ReactNode, Ref } from 'react';
+
+/** @internal The words the fields show — the host form's own labels. */
+interface NewPasswordFieldsText {
+    password: ReactNode;
+    confirm: ReactNode;
+    mismatch: ReactNode;
+}
+/** @internal */
+interface NewPasswordFieldsProps {
+    password: string;
+    confirm: string;
+    onPasswordChange: (value: string) => void;
+    onConfirmChange: (value: string) => void;
+    text: NewPasswordFieldsText;
+    /** A request is running: both fields `readOnly` (not `disabled`, which would drop
+     *  the focus of the one being typed in). */
+    busy?: boolean;
+    passwordRef?: Ref<HTMLInputElement>;
+}
+/**
+ * "Choose a password": the field, the strength meter with its advisory checklist, and
+ * the confirmation — keksdose's `PasswordFields`, which its register form, its reset
+ * page and its forced-change step share so that every screen choosing a password does
+ * it under the same rules and the same feedback. Here `RegisterForm` and
+ * `SignInForm`'s set-a-new-password step share it.
+ *
+ * Both fields are `new-password`: a password manager offers to generate one and never
+ * fills in the current one. The confirmation carries the mismatch as its own `error`,
+ * attached with `aria-describedby`; the key is always passed, so the message coming and
+ * going never remounts the field under the typist.
+ *
+ * @internal Not part of the barrel; the forms are.
+ */
+declare function NewPasswordFields({ password, confirm, onPasswordChange, onConfirmChange, text, busy, passwordRef, }: NewPasswordFieldsProps): react.JSX.Element;
+
+export { NewPasswordFields, type NewPasswordFieldsProps, type NewPasswordFieldsText };

package/dist/auth/new-password-fields.js

@@ -0,0 +1,54 @@
+"use client";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { PasswordStrengthMeter } from "../components/password-strength.js";
+import { Input } from "../components/ui.js";
+import { PASSWORD_MAX_BYTES, PASSWORD_MIN_LENGTH } from "./form-rules.js";
+function NewPasswordFields({
+  password,
+  confirm,
+  onPasswordChange,
+  onConfirmChange,
+  text,
+  busy = false,
+  passwordRef
+}) {
+  const mismatch = confirm !== "" && confirm !== password;
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsxs("div", { children: [
+      /* @__PURE__ */ jsx(
+        Input,
+        {
+          ref: passwordRef,
+          type: "password",
+          name: "new-password",
+          autoComplete: "new-password",
+          label: text.password,
+          value: password,
+          onChange: (e) => onPasswordChange(e.target.value),
+          minLength: PASSWORD_MIN_LENGTH,
+          readOnly: busy,
+          required: true
+        }
+      ),
+      /* @__PURE__ */ jsx(PasswordStrengthMeter, { value: password, minLength: PASSWORD_MIN_LENGTH, maxBytes: PASSWORD_MAX_BYTES })
+    ] }),
+    /* @__PURE__ */ jsx(
+      Input,
+      {
+        type: "password",
+        name: "confirm-password",
+        autoComplete: "new-password",
+        label: text.confirm,
+        value: confirm,
+        onChange: (e) => onConfirmChange(e.target.value),
+        readOnly: busy,
+        error: mismatch ? text.mismatch : void 0,
+        required: true
+      }
+    )
+  ] });
+}
+export {
+  NewPasswordFields
+};
+//# sourceMappingURL=new-password-fields.js.map

package/dist/auth/new-password-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/new-password-fields.tsx"],"sourcesContent":["import type { ReactNode, Ref } from \"react\";\nimport { PasswordStrengthMeter } from \"../components/password-strength\";\nimport { Input } from \"../components/ui\";\nimport { PASSWORD_MAX_BYTES, PASSWORD_MIN_LENGTH } from \"./form-rules\";\n\n/** @internal The words the fields show — the host form's own labels. */\nexport interface NewPasswordFieldsText {\n  password: ReactNode;\n  confirm: ReactNode;\n  mismatch: ReactNode;\n}\n\n/** @internal */\nexport interface NewPasswordFieldsProps {\n  password: string;\n  confirm: string;\n  onPasswordChange: (value: string) => void;\n  onConfirmChange: (value: string) => void;\n  text: NewPasswordFieldsText;\n  /** A request is running: both fields `readOnly` (not `disabled`, which would drop\n   *  the focus of the one being typed in). */\n  busy?: boolean;\n  passwordRef?: Ref<HTMLInputElement>;\n}\n\n/**\n * \"Choose a password\": the field, the strength meter with its advisory checklist, and\n * the confirmation — keksdose's `PasswordFields`, which its register form, its reset\n * page and its forced-change step share so that every screen choosing a password does\n * it under the same rules and the same feedback. Here `RegisterForm` and\n * `SignInForm`'s set-a-new-password step share it.\n *\n * Both fields are `new-password`: a password manager offers to generate one and never\n * fills in the current one. The confirmation carries the mismatch as its own `error`,\n * attached with `aria-describedby`; the key is always passed, so the message coming and\n * going never remounts the field under the typist.\n *\n * @internal Not part of the barrel; the forms are.\n */\nexport function NewPasswordFields({\n  password,\n  confirm,\n  onPasswordChange,\n  onConfirmChange,\n  text,\n  busy = false,\n  passwordRef,\n}: NewPasswordFieldsProps) {\n  const mismatch = confirm !== \"\" && confirm !== password;\n  return (\n    <>\n      <div>\n        <Input\n          ref={passwordRef}\n          type=\"password\"\n          name=\"new-password\"\n          autoComplete=\"new-password\"\n          label={text.password}\n          value={password}\n          onChange={(e) => onPasswordChange(e.target.value)}\n          minLength={PASSWORD_MIN_LENGTH}\n          readOnly={busy}\n          required\n        />\n        {/* The 72-byte cap is passed because a SIGN-IN password has one (bcrypt); the\n            minimum is passed rather than left to the meter's own default 8, so the two\n            cannot drift apart. */}\n        <PasswordStrengthMeter value={password} minLength={PASSWORD_MIN_LENGTH} maxBytes={PASSWORD_MAX_BYTES} />\n      </div>\n      {/* A typo'd password costs a reset mail — and under keksdose's end-to-end\n          encryption, data (feedback #124) — so it is typed twice. */}\n      <Input\n        type=\"password\"\n        name=\"confirm-password\"\n        autoComplete=\"new-password\"\n        label={text.confirm}\n        value={confirm}\n        onChange={(e) => onConfirmChange(e.target.value)}\n        readOnly={busy}\n        error={mismatch ? text.mismatch : undefined}\n        required\n      />\n    </>\n  );\n}\n"],"mappings":";AAkDI,mBAEI,KADF,YADF;AAjDJ,SAAS,6BAA6B;AACtC,SAAS,aAAa;AACtB,SAAS,oBAAoB,2BAA2B;AAoCjD,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP;AACF,GAA2B;AACzB,QAAM,WAAW,YAAY,MAAM,YAAY;AAC/C,SACE,iCACE;AAAA,yBAAC,SACC;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,KAAK;AAAA,UACL,MAAK;AAAA,UACL,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO,KAAK;AAAA,UACZ,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,iBAAiB,EAAE,OAAO,KAAK;AAAA,UAChD,WAAW;AAAA,UACX,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,MAIA,oBAAC,yBAAsB,OAAO,UAAU,WAAW,qBAAqB,UAAU,oBAAoB;AAAA,OACxG;AAAA,IAGA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAK;AAAA,QACL,cAAa;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,OAAO;AAAA,QACP,UAAU,CAAC,MAAM,gBAAgB,EAAE,OAAO,KAAK;AAAA,QAC/C,UAAU;AAAA,QACV,OAAO,WAAW,KAAK,WAAW;AAAA,QAClC,UAAQ;AAAA;AAAA,IACV;AAAA,KACF;AAEJ;","names":[]}

package/dist/auth/not-found-page.d.ts

@@ -0,0 +1,57 @@
+import * as react from 'react';
+import { ComponentPropsWithoutRef, ReactNode } from 'react';
+import { AuthHeadingLevel } from './status-parts.js';
+
+/** Every string the page renders — the `notFound` namespace. keksdose's words
+ *  (`error.not_found_*`), which kastlan took over. */
+interface NotFoundLabels {
+    /** The heading. */
+    title: string;
+    /** Under it. */
+    body: string;
+    /** The way out for everyone — to `homeHref`. */
+    home: string;
+    /** The second way out for someone signed in — to `appHref`. */
+    app: string;
+}
+declare const DEFAULT_NOT_FOUND_LABELS: NotFoundLabels;
+interface NotFoundPageProps extends Omit<ComponentPropsWithoutRef<"div">, "children" | "title"> {
+    /** "Go to the start page". Default `/`, which takes a signed-in user into the app and
+     *  anyone else to sign-in in all three apps. */
+    homeHref?: string;
+    /**
+     * "Back to the app", beside it — pass it while someone is signed in. A LITERAL page
+     * (keksdose's `/budget`), never the "last visited page" an app restores on start: a
+     * stale one of those pointing at a route that is gone is the likeliest way a
+     * signed-in user lands here (keksdose's not-found-page.tsx).
+     */
+    appHref?: string;
+    /** App content under the text — a search field, a support address. */
+    children?: ReactNode;
+    /** `false` adds no `noindex` — for a preview inside another page. Default `true`. */
+    noIndex?: boolean;
+    /** The heading's level. Default `h2`, under `AuthLayout`'s `h1`; `h1` where the page
+     *  stands alone (inside the app shell). */
+    headingAs?: AuthHeadingLevel;
+    labels?: Partial<NotFoundLabels>;
+}
+/**
+ * What an unknown address renders (the router's catch-all), signed out and signed in —
+ * keksdose's `NotFoundPage` (app/not-found-page.tsx, feedback #129), which kastlan took
+ * over on `AuthLayout` (docs/auth-harmonization.md §7).
+ *
+ * In place of the silent `<Navigate to="/">` keksdose had: bouncing every typo, dead link
+ * and fabricated URL to the start page is what Search Console reports as a soft 404, and
+ * it hid broken links. An SPA cannot send a real 404 status — the web server answers
+ * every path with index.html — so the page says it in words and calls
+ * {@link useNoIndex}, which makes a crawler drop it (the server's `X-Robots-Tag` is the
+ * authoritative half).
+ *
+ * It is the page's CONTENT, not a frame, so it sits in either: as `AuthLayout`'s child
+ * for a visitor (`headingAs` default `h2`, under the layout's title), or bare inside the
+ * app shell for someone signed in (`headingAs="h1"`, and `appHref`). The large "404" is
+ * decoration — the heading says it in words — and hidden from a screen reader.
+ */
+declare function NotFoundPage({ homeHref, appHref, children, noIndex, headingAs: Heading, labels: labelsProp, className, ...rest }: NotFoundPageProps): react.JSX.Element;
+
+export { DEFAULT_NOT_FOUND_LABELS, type NotFoundLabels, NotFoundPage, type NotFoundPageProps };

package/dist/auth/not-found-page.js

@@ -0,0 +1,40 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { cn } from "../lib/cn.js";
+import { useKitLabels } from "../i18n/kit-labels.js";
+import { useNoIndex } from "../hooks/use-noindex.js";
+import { Button } from "../components/ui.js";
+const DEFAULT_NOT_FOUND_LABELS = {
+  title: "Page not found",
+  body: "This address doesn\u2019t exist (any more). It may be a typo, or the page has moved.",
+  home: "Go to the start page",
+  app: "Back to the app"
+};
+function NotFoundPage({
+  homeHref = "/",
+  appHref,
+  children,
+  noIndex = true,
+  headingAs: Heading = "h2",
+  labels: labelsProp,
+  className,
+  ...rest
+}) {
+  const labels = useKitLabels("notFound", DEFAULT_NOT_FOUND_LABELS, labelsProp);
+  useNoIndex(noIndex);
+  return /* @__PURE__ */ jsxs("div", { ...rest, className: cn("flex flex-col items-center gap-2 py-4 text-center", className), children: [
+    /* @__PURE__ */ jsx("p", { "aria-hidden": true, className: "text-6xl font-bold leading-none tracking-tight text-[var(--text-placeholder)]", children: "404" }),
+    /* @__PURE__ */ jsx(Heading, { className: "mt-2 text-xl font-semibold text-[var(--text-primary)]", children: labels.title }),
+    /* @__PURE__ */ jsx("p", { className: "max-w-prose text-sm text-[var(--text-secondary)]", children: labels.body }),
+    children,
+    /* @__PURE__ */ jsxs("div", { className: "mt-4 flex flex-wrap justify-center gap-3", children: [
+      /* @__PURE__ */ jsx(Button, { href: homeHref, variant: "brand", children: labels.home }),
+      appHref !== void 0 && /* @__PURE__ */ jsx(Button, { href: appHref, variant: "secondary", children: labels.app })
+    ] })
+  ] });
+}
+export {
+  DEFAULT_NOT_FOUND_LABELS,
+  NotFoundPage
+};
+//# sourceMappingURL=not-found-page.js.map

package/dist/auth/not-found-page.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/not-found-page.tsx"],"sourcesContent":["import type { ComponentPropsWithoutRef, ReactNode } from \"react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { useNoIndex } from \"../hooks/use-noindex\";\nimport { Button } from \"../components/ui\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/** Every string the page renders — the `notFound` namespace. keksdose's words\n *  (`error.not_found_*`), which kastlan took over. */\nexport interface NotFoundLabels {\n  /** The heading. */\n  title: string;\n  /** Under it. */\n  body: string;\n  /** The way out for everyone — to `homeHref`. */\n  home: string;\n  /** The second way out for someone signed in — to `appHref`. */\n  app: string;\n}\n\nexport const DEFAULT_NOT_FOUND_LABELS: NotFoundLabels = {\n  title: \"Page not found\",\n  body: \"This address doesn’t exist (any more). It may be a typo, or the page has moved.\",\n  home: \"Go to the start page\",\n  app: \"Back to the app\",\n};\n\nexport interface NotFoundPageProps extends Omit<ComponentPropsWithoutRef<\"div\">, \"children\" | \"title\"> {\n  /** \"Go to the start page\". Default `/`, which takes a signed-in user into the app and\n   *  anyone else to sign-in in all three apps. */\n  homeHref?: string;\n  /**\n   * \"Back to the app\", beside it — pass it while someone is signed in. A LITERAL page\n   * (keksdose's `/budget`), never the \"last visited page\" an app restores on start: a\n   * stale one of those pointing at a route that is gone is the likeliest way a\n   * signed-in user lands here (keksdose's not-found-page.tsx).\n   */\n  appHref?: string;\n  /** App content under the text — a search field, a support address. */\n  children?: ReactNode;\n  /** `false` adds no `noindex` — for a preview inside another page. Default `true`. */\n  noIndex?: boolean;\n  /** The heading's level. Default `h2`, under `AuthLayout`'s `h1`; `h1` where the page\n   *  stands alone (inside the app shell). */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<NotFoundLabels>;\n}\n\n/**\n * What an unknown address renders (the router's catch-all), signed out and signed in —\n * keksdose's `NotFoundPage` (app/not-found-page.tsx, feedback #129), which kastlan took\n * over on `AuthLayout` (docs/auth-harmonization.md §7).\n *\n * In place of the silent `<Navigate to=\"/\">` keksdose had: bouncing every typo, dead link\n * and fabricated URL to the start page is what Search Console reports as a soft 404, and\n * it hid broken links. An SPA cannot send a real 404 status — the web server answers\n * every path with index.html — so the page says it in words and calls\n * {@link useNoIndex}, which makes a crawler drop it (the server's `X-Robots-Tag` is the\n * authoritative half).\n *\n * It is the page's CONTENT, not a frame, so it sits in either: as `AuthLayout`'s child\n * for a visitor (`headingAs` default `h2`, under the layout's title), or bare inside the\n * app shell for someone signed in (`headingAs=\"h1\"`, and `appHref`). The large \"404\" is\n * decoration — the heading says it in words — and hidden from a screen reader.\n */\nexport function NotFoundPage({\n  homeHref = \"/\",\n  appHref,\n  children,\n  noIndex = true,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: NotFoundPageProps) {\n  const labels = useKitLabels(\"notFound\", DEFAULT_NOT_FOUND_LABELS, labelsProp);\n  useNoIndex(noIndex);\n  return (\n    <div {...rest} className={cn(\"flex flex-col items-center gap-2 py-4 text-center\", className)}>\n      <p aria-hidden className=\"text-6xl font-bold leading-none tracking-tight text-[var(--text-placeholder)]\">\n        404\n      </p>\n      <Heading className=\"mt-2 text-xl font-semibold text-[var(--text-primary)]\">{labels.title}</Heading>\n      <p className=\"max-w-prose text-sm text-[var(--text-secondary)]\">{labels.body}</p>\n      {children}\n      <div className=\"mt-4 flex flex-wrap justify-center gap-3\">\n        <Button href={homeHref} variant=\"brand\">\n          {labels.home}\n        </Button>\n        {appHref !== undefined && (\n          <Button href={appHref} variant=\"secondary\">\n            {labels.app}\n          </Button>\n        )}\n      </div>\n    </div>\n  );\n}\n"],"mappings":";AA+EM,cAMA,YANA;AA9EN,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AAgBhB,MAAM,2BAA2C;AAAA,EACtD,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,KAAK;AACP;AAwCO,SAAS,aAAa;AAAA,EAC3B,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAAsB;AACpB,QAAM,SAAS,aAAa,YAAY,0BAA0B,UAAU;AAC5E,aAAW,OAAO;AAClB,SACE,qBAAC,SAAK,GAAG,MAAM,WAAW,GAAG,qDAAqD,SAAS,GACzF;AAAA,wBAAC,OAAE,eAAW,MAAC,WAAU,iFAAgF,iBAEzG;AAAA,IACA,oBAAC,WAAQ,WAAU,yDAAyD,iBAAO,OAAM;AAAA,IACzF,oBAAC,OAAE,WAAU,oDAAoD,iBAAO,MAAK;AAAA,IAC5E;AAAA,IACD,qBAAC,SAAI,WAAU,4CACb;AAAA,0BAAC,UAAO,MAAM,UAAU,SAAQ,SAC7B,iBAAO,MACV;AAAA,MACC,YAAY,UACX,oBAAC,UAAO,MAAM,SAAS,SAAQ,aAC5B,iBAAO,KACV;AAAA,OAEJ;AAAA,KACF;AAEJ;","names":[]}