@eifi1/ui-kit 0.28.1 → 0.30.0

package/dist/auth/status-parts.js

@@ -0,0 +1,83 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { useEffect, useRef } from "react";
+import { cn } from "../lib/cn.js";
+const FORM_HEADING_CLASS = "text-base font-semibold text-[var(--text-primary)]";
+const STATUS_HEADING_CLASS = "text-center text-base font-semibold text-[var(--text-primary)]";
+const INTRO_CLASS = "text-sm text-[var(--text-secondary)]";
+const OUTCOME_CLASS = "border-0 bg-transparent px-0 py-3";
+function withQuery(href, key, value) {
+  const hash = href.indexOf("#");
+  const base = hash === -1 ? href : href.slice(0, hash);
+  const fragment = hash === -1 ? "" : href.slice(hash);
+  const separator = base.includes("?") ? base.endsWith("?") || base.endsWith("&") ? "" : "&" : "?";
+  return `${base}${separator}${encodeURIComponent(key)}=${encodeURIComponent(value)}${fragment}`;
+}
+function useOncePerKey(key, start, settle) {
+  const latest = useRef({ start, settle });
+  useEffect(() => {
+    latest.current = { start, settle };
+  });
+  const current = useRef(null);
+  useEffect(() => {
+    if (key === null) {
+      current.current = null;
+      return;
+    }
+    if (current.current === key) return;
+    current.current = key;
+    const report = (result) => {
+      if (current.current === key) latest.current.settle(key, result);
+    };
+    let started;
+    try {
+      started = latest.current.start(key);
+    } catch (error) {
+      report({ ok: false, error });
+      return;
+    }
+    Promise.resolve(started).then(
+      (value) => report({ ok: true, value }),
+      (error) => report({ ok: false, error })
+    );
+  }, [key]);
+}
+function isThenable(value) {
+  return typeof value?.then === "function";
+}
+function useFocusWhen(active, ref) {
+  useEffect(() => {
+    if (active) ref.current?.focus();
+  }, [active, ref]);
+}
+function OutcomeMessage({
+  icon,
+  children,
+  focusRef,
+  className
+}) {
+  return /* @__PURE__ */ jsxs(
+    "div",
+    {
+      ref: focusRef,
+      tabIndex: -1,
+      className: cn("flex flex-col items-center gap-2 py-2 text-center outline-none", className),
+      children: [
+        /* @__PURE__ */ jsx("span", { "aria-hidden": true, className: "[&_svg]:size-10", children: icon }),
+        children
+      ]
+    }
+  );
+}
+export {
+  FORM_HEADING_CLASS,
+  INTRO_CLASS,
+  OUTCOME_CLASS,
+  OutcomeMessage,
+  STATUS_HEADING_CLASS,
+  isThenable,
+  useFocusWhen,
+  useOncePerKey,
+  withQuery
+};
+//# sourceMappingURL=status-parts.js.map

package/dist/auth/status-parts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/status-parts.tsx"],"sourcesContent":["import { useEffect, useRef } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { cn } from \"../lib/cn\";\n\n/**\n * The pieces the signed-out status pages share — {@link ForgotPasswordForm},\n * {@link ResetPasswordForm}, {@link VerifyEmailStatus}, {@link AcceptInvitation} and\n * {@link NotFoundPage} (docs/auth-harmonization.md §7).\n *\n * @internal Not part of the barrel; the pages are.\n */\n\n/** A heading level a page part may take. Default `h2`, under the page's `h1`\n *  (`AuthLayout`'s `title`, the app's name), as on `SignInForm`'s steps; deeper for a\n *  page embedded in another (a preview, the docs). */\nexport type AuthHeadingLevel = \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\";\n\n/** The form pages' heading: start-aligned, the size of `SignInForm`'s step headings. */\nexport const FORM_HEADING_CLASS = \"text-base font-semibold text-[var(--text-primary)]\";\n/** The status pages' heading: centred over the centred outcome below it. */\nexport const STATUS_HEADING_CLASS = \"text-center text-base font-semibold text-[var(--text-primary)]\";\nexport const INTRO_CLASS = \"text-sm text-[var(--text-secondary)]\";\n\n/**\n * kastlan's outcome block (verify-email-page, reset-password-page): the kit's\n * `EmptyState` without its dashed box, because it already sits in `AuthLayout`'s card —\n * a box in a box. The icon and the title carry the tone.\n */\nexport const OUTCOME_CLASS = \"border-0 bg-transparent px-0 py-3\";\n\n/** `href` with `key=value` added to its query, before any `#fragment`: the reset page's\n *  \"Sign in\" carries the address (`/login?email=ada%40example.com`). */\nexport function withQuery(href: string, key: string, value: string): string {\n  const hash = href.indexOf(\"#\");\n  const base = hash === -1 ? href : href.slice(0, hash);\n  const fragment = hash === -1 ? \"\" : href.slice(hash);\n  const separator = base.includes(\"?\") ? (base.endsWith(\"?\") || base.endsWith(\"&\") ? \"\" : \"&\") : \"?\";\n  return `${base}${separator}${encodeURIComponent(key)}=${encodeURIComponent(value)}${fragment}`;\n}\n\n/** What a callback's promise came to. */\nexport type Settled<T> = { ok: true; value: T } | { ok: false; error: unknown };\n\n/**\n * Run `start(key)` ONCE per key, and hand what it settles to into `settle` — unless the\n * key moved on in the meantime, when the stale answer is dropped.\n *\n * keksdose's verify-email and join pages fire their request from an effect behind a\n * `useRef` guard, and say why: the token is single-use, and StrictMode's\n * mount → unmount → remount would send it twice and turn a success into \"invalid\" on\n * the second answer. The guard is the same here; there is deliberately no \"unmounted\"\n * flag set in the cleanup, because StrictMode's simulated unmount would set it and the\n * remount would never clear the guard — the page would hang on its spinner (the bug\n * keksdose hit on /join with a react-query observer). A state update after a real\n * unmount is a no-op in React 18 and later.\n *\n * `key === null` runs nothing (no token, not signed in yet) and forgets the last key, so\n * the same token runs again once it is back.\n */\nexport function useOncePerKey<T>(\n  key: string | null,\n  start: (key: string) => T | Promise<T>,\n  settle: (key: string, result: Settled<T>) => void,\n): void {\n  const latest = useRef({ start, settle });\n  useEffect(() => {\n    latest.current = { start, settle };\n  });\n  const current = useRef<string | null>(null);\n  useEffect(() => {\n    if (key === null) {\n      current.current = null;\n      return;\n    }\n    if (current.current === key) return;\n    current.current = key;\n    const report = (result: Settled<T>) => {\n      if (current.current === key) latest.current.settle(key, result);\n    };\n    let started: T | Promise<T>;\n    try {\n      started = latest.current.start(key);\n    } catch (error) {\n      report({ ok: false, error });\n      return;\n    }\n    Promise.resolve(started).then(\n      (value) => report({ ok: true, value }),\n      (error: unknown) => report({ ok: false, error }),\n    );\n  }, [key]);\n}\n\n/** Whether a callback's return is a promise to wait for. A callback that returns\n *  nothing is done when it returns. */\nexport function isThenable(value: unknown): value is PromiseLike<unknown> {\n  return typeof (value as PromiseLike<unknown> | null)?.then === \"function\";\n}\n\n/**\n * Move focus to `ref` when `active` turns true — the outcome a person's own submit led\n * to (\"If an account exists … the link is on its way\", \"Your password has been\n * changed\"). The submit button they pressed is gone with the form, which drops focus to\n * `<body>`; a screen reader then hears nothing at all. Focusing the message (a\n * `tabIndex={-1}` box) reads it out and leaves the next Tab where the page continues.\n */\nexport function useFocusWhen(active: boolean, ref: { current: HTMLElement | null }): void {\n  useEffect(() => {\n    if (active) ref.current?.focus();\n  }, [active, ref]);\n}\n\n/** The box {@link useFocusWhen} focuses: centred, no focus ring of its own (it is not a\n *  control; the ring would read as one). */\nexport function OutcomeMessage({\n  icon,\n  children,\n  focusRef,\n  className,\n}: {\n  icon: ReactNode;\n  children: ReactNode;\n  focusRef?: { current: HTMLDivElement | null };\n  className?: string;\n}) {\n  return (\n    <div\n      ref={focusRef}\n      tabIndex={-1}\n      className={cn(\"flex flex-col items-center gap-2 py-2 text-center outline-none\", className)}\n    >\n      <span aria-hidden className=\"[&_svg]:size-10\">\n        {icon}\n      </span>\n      {children}\n    </div>\n  );\n}\n"],"mappings":";AA8HI,SAKE,KALF;AA9HJ,SAAS,WAAW,cAAc;AAElC,SAAS,UAAU;AAgBZ,MAAM,qBAAqB;AAE3B,MAAM,uBAAuB;AAC7B,MAAM,cAAc;AAOpB,MAAM,gBAAgB;AAItB,SAAS,UAAU,MAAc,KAAa,OAAuB;AAC1E,QAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,QAAM,OAAO,SAAS,KAAK,OAAO,KAAK,MAAM,GAAG,IAAI;AACpD,QAAM,WAAW,SAAS,KAAK,KAAK,KAAK,MAAM,IAAI;AACnD,QAAM,YAAY,KAAK,SAAS,GAAG,IAAK,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,GAAG,IAAI,KAAK,MAAO;AAC/F,SAAO,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,KAAK,CAAC,GAAG,QAAQ;AAC9F;AAqBO,SAAS,cACd,KACA,OACA,QACM;AACN,QAAM,SAAS,OAAO,EAAE,OAAO,OAAO,CAAC;AACvC,YAAU,MAAM;AACd,WAAO,UAAU,EAAE,OAAO,OAAO;AAAA,EACnC,CAAC;AACD,QAAM,UAAU,OAAsB,IAAI;AAC1C,YAAU,MAAM;AACd,QAAI,QAAQ,MAAM;AAChB,cAAQ,UAAU;AAClB;AAAA,IACF;AACA,QAAI,QAAQ,YAAY,IAAK;AAC7B,YAAQ,UAAU;AAClB,UAAM,SAAS,CAAC,WAAuB;AACrC,UAAI,QAAQ,YAAY,IAAK,QAAO,QAAQ,OAAO,KAAK,MAAM;AAAA,IAChE;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACpC,SAAS,OAAO;AACd,aAAO,EAAE,IAAI,OAAO,MAAM,CAAC;AAC3B;AAAA,IACF;AACA,YAAQ,QAAQ,OAAO,EAAE;AAAA,MACvB,CAAC,UAAU,OAAO,EAAE,IAAI,MAAM,MAAM,CAAC;AAAA,MACrC,CAAC,UAAmB,OAAO,EAAE,IAAI,OAAO,MAAM,CAAC;AAAA,IACjD;AAAA,EACF,GAAG,CAAC,GAAG,CAAC;AACV;AAIO,SAAS,WAAW,OAA+C;AACxE,SAAO,OAAQ,OAAuC,SAAS;AACjE;AASO,SAAS,aAAa,QAAiB,KAA4C;AACxF,YAAU,MAAM;AACd,QAAI,OAAQ,KAAI,SAAS,MAAM;AAAA,EACjC,GAAG,CAAC,QAAQ,GAAG,CAAC;AAClB;AAIO,SAAS,eAAe;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKG;AACD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,KAAK;AAAA,MACL,UAAU;AAAA,MACV,WAAW,GAAG,kEAAkE,SAAS;AAAA,MAEzF;AAAA,4BAAC,UAAK,eAAW,MAAC,WAAU,mBACzB,gBACH;AAAA,QACC;AAAA;AAAA;AAAA,EACH;AAEJ;","names":[]}

package/dist/auth/verify-email.d.ts

@@ -0,0 +1,126 @@
+import * as react from 'react';
+import { ReactNode, ComponentPropsWithoutRef } from 'react';
+import { AuthHeadingLevel } from './status-parts.js';
+
+/** Every string the verification page and banner render — the `verifyEmail` namespace.
+ *  keksdose's words (`verify_email.*`, and its server's "has expired"). */
+interface VerifyEmailLabels {
+    /** The page's heading. */
+    title: string;
+    /** While the link is redeemed. */
+    verifying: string;
+    verified: string;
+    /** The way on from the page — into the app, or to sign-in. */
+    continue: string;
+    invalid: string;
+    expired: string;
+    /** The page was opened without a `token`. */
+    noToken: string;
+    /** Under `invalid`: why a link stops working. */
+    invalidHint: string;
+    /** Under a dead link, signed out: where a new one comes from. */
+    requestInApp: string;
+    /** Under a dead link, signed in, beside "Send again". */
+    requestHere: string;
+    /** The resend button, on the page and in the banner. */
+    resend: string;
+    /** The resend button while a just-sent mail cools down, given the seconds left. */
+    resendIn: (seconds: number) => string;
+    /** Said (and shown) after a resend went out. */
+    resent: string;
+    /** Said (and shown) after a resend failed. */
+    resendError: string;
+    /** The banner's message. */
+    banner: string;
+    /** The banner's ×: it defers, it does not close anything. */
+    dismiss: string;
+}
+declare const DEFAULT_VERIFY_EMAIL_LABELS: VerifyEmailLabels;
+/** What became of a confirmation link that did not verify. */
+type VerifyEmailFailure = "invalid" | "expired";
+interface VerifyEmailStatusProps extends Omit<ComponentPropsWithoutRef<"div">, "children" | "title"> {
+    /** The link's token — the app's `?token=`. Empty: the link was cut short, and the
+     *  page says so without asking anyone. */
+    token: string;
+    /**
+     * Redeem it — `POST /auth/verify-email {token}`, once per token, on mount. A POST and
+     * not the link's own GET (§10.10): a mail scanner that opens every link must not
+     * confirm an address nobody read. Resolve when it verified (an address that already
+     * was counts: keksdose's redeem is idempotent); reject with the client's error.
+     */
+    onVerify: (token: string) => Promise<unknown>;
+    /** Which dead end a rejection is. Default: `invalid` for everything — §5.2's servers
+     *  answer one `token_invalid`; an app whose server tells expiry apart maps it here. */
+    classifyError?: (error: unknown) => VerifyEmailFailure;
+    /** 0.29.1: the words for a refused resend — the server's own sentence (a throttle's
+     *  "try again in N minutes"), else the kit's `resendError`. */
+    describeError?: (error: unknown) => string | undefined;
+    /** Someone is signed in on this device: "Continue" goes into the app, and a dead link
+     *  offers "Send again" (with `onResend`). */
+    signedIn?: boolean;
+    /** Send a new confirmation mail (`POST /auth/verify-email/resend`) — offered on a dead
+     *  link while signed in. */
+    onResend?: () => Promise<unknown> | void;
+    /** Seconds "Send again" waits after a mail went out. Default 60; `0` never waits. */
+    cooldown?: number;
+    /** Where "Continue" goes. Default `/` signed in, `/login` signed out. */
+    continueHref?: string;
+    /** App content under "confirmed" — keksdose's "Others can now share a budget with you
+     *  directly." */
+    verifiedContent?: ReactNode;
+    /** The heading. Default `labels.title`; `null` draws none, for a page that puts it in
+     *  `AuthLayout`'s `title` instead. */
+    title?: ReactNode;
+    /** The heading's level. Default `h2`, under the page's `h1`. */
+    headingAs?: AuthHeadingLevel;
+    labels?: Partial<VerifyEmailLabels>;
+}
+/**
+ * Redeem an email-confirmation link (`/verify-email?token=…`, docs/auth-harmonization.md
+ * §7) — keksdose's `VerifyEmailPage` (features/auth/verify-email-page.tsx), with
+ * kastlan's outcome blocks and its separate "expired".
+ *
+ * Opened from an inbox, often in a browser with no session, so the token is the only
+ * credential and the page renders signed-out. It redeems once per token on mount
+ * (StrictMode's double effect included — the token is single-use) and shows one of:
+ * confirmed; not valid; expired; or the link had no token at all. Verification gates
+ * nothing (§2.8), so every outcome ends on "Continue". Signed in, a dead link also
+ * offers "Send again", which waits `cooldown` seconds after a mail went out.
+ *
+ * The outcome replaces the spinner, which says nothing to a screen reader on its own,
+ * so it is also announced.
+ */
+declare function VerifyEmailStatus({ token, onVerify, classifyError, describeError, signedIn, onResend, cooldown, continueHref, verifiedContent, title, headingAs: Heading, labels: labelsProp, className, ...rest }: VerifyEmailStatusProps): react.JSX.Element;
+interface EmailVerificationBannerProps {
+    /** Send a new confirmation mail (`POST /auth/verify-email/resend`). Resolve when it
+     *  went out; reject and the banner says it could not. */
+    onResend: () => Promise<unknown> | void;
+    /** 0.29.1: the words for a refused resend — the server's own sentence, else the kit's. */
+    describeError?: (error: unknown) => string | undefined;
+    /** Seconds "Send again" waits after a mail went out. Default 60; `0` never waits. */
+    cooldown?: number;
+    /** The ×, "Not now". The banner does not hide itself: the app stops rendering it —
+     *  keksdose for the rest of the session. Left out, no ×. */
+    onDismiss?: () => void;
+    /** `strip` (default): keksdose's band across the top of the shell. `box`: kastlan's
+     *  callout inside the page. */
+    variant?: "strip" | "box";
+    /** The app's sentence after the kit's — keksdose's "Until you do, nobody can share a
+     *  budget with you directly." */
+    children?: ReactNode;
+    className?: string;
+    labels?: Partial<VerifyEmailLabels>;
+}
+/**
+ * The nudge for a signed-in account whose address is not confirmed — keksdose's
+ * `VerifyEmailBanner` (features/auth/verify-email-banner.tsx), kastlan's copy of it.
+ *
+ * A prompt, not a wall: verification gates nothing (§2.8). The app renders it while
+ * `/auth/me` says `email_verified: false`, and stops when the user dismisses it or the
+ * page above confirms the address. "Send again" waits `cooldown` seconds after a mail
+ * went out (the button says how long), and its outcome is written into the banner and
+ * read out — no toast needed.
+ */
+declare function EmailVerificationBanner({ onResend, describeError, cooldown, onDismiss, variant, children, className, labels: labelsProp, }: EmailVerificationBannerProps): react.JSX.Element;
+
+export { DEFAULT_VERIFY_EMAIL_LABELS, EmailVerificationBanner, type EmailVerificationBannerProps, type VerifyEmailFailure, type VerifyEmailLabels, VerifyEmailStatus, type VerifyEmailStatusProps };

package/dist/auth/verify-email.js

@@ -0,0 +1,243 @@
+"use client";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
+import { CheckCircle2, MailWarning, TimerOff, XCircle } from "lucide-react";
+import { cn } from "../lib/cn.js";
+import { useKitLabels } from "../i18n/kit-labels.js";
+import { useAnnounce } from "../hooks/use-announce.js";
+import { AlertBanner } from "../components/alert-banner.js";
+import { LoadingState } from "../components/loading-state.js";
+import { Button, EmptyState } from "../components/ui.js";
+import { OUTCOME_CLASS, STATUS_HEADING_CLASS, isThenable, useOncePerKey } from "./status-parts.js";
+import { authErrorCode } from "./auth-errors.js";
+const DEFAULT_VERIFY_EMAIL_LABELS = {
+  title: "Confirm your email address",
+  verifying: "Confirming\u2026",
+  verified: "Your email address is confirmed.",
+  continue: "Continue",
+  invalid: "This confirmation link is not valid",
+  expired: "This confirmation link has expired",
+  noToken: "This link is missing its confirmation token.",
+  invalidHint: "The link may have expired or already been used.",
+  requestInApp: "You can request a new one from inside the app.",
+  requestHere: "You can request a new one here.",
+  resend: "Send again",
+  resendIn: (seconds) => `Send again in ${seconds} s`,
+  resent: "Confirmation email sent",
+  resendError: "Could not send the confirmation email",
+  banner: "Please confirm your email address.",
+  dismiss: "Not now"
+};
+const DEFAULT_COOLDOWN = 60;
+function useResend(onResend, cooldown) {
+  const [phase, setPhase] = useState("idle");
+  const [error, setError] = useState(void 0);
+  const [remaining, setRemaining] = useState(0);
+  const counting = remaining > 0;
+  useEffect(() => {
+    if (!counting) return;
+    const id = setInterval(() => setRemaining((r) => Math.max(0, r - 1)), 1e3);
+    return () => clearInterval(id);
+  }, [counting]);
+  const sent = () => {
+    setPhase("sent");
+    setRemaining(Math.max(0, Math.round(cooldown)));
+  };
+  const send = () => {
+    if (!onResend || phase === "sending" || counting) return;
+    let result;
+    try {
+      result = onResend();
+    } catch (e) {
+      setError(e);
+      setPhase("failed");
+      return;
+    }
+    if (!isThenable(result)) {
+      sent();
+      return;
+    }
+    setPhase("sending");
+    result.then(sent, (e) => {
+      setError(e);
+      setPhase("failed");
+    });
+  };
+  return { phase, remaining, send, error };
+}
+function ResendButton({
+  state,
+  labels,
+  variant
+}) {
+  return /* @__PURE__ */ jsx(
+    Button,
+    {
+      type: "button",
+      variant,
+      size: variant === "secondary" ? "sm" : void 0,
+      onClick: state.send,
+      pending: state.phase === "sending",
+      disabledReason: state.remaining > 0 ? labels.resent : void 0,
+      children: state.remaining > 0 ? labels.resendIn(state.remaining) : labels.resend
+    }
+  );
+}
+function ResendStatus({
+  phase,
+  error,
+  describeError,
+  labels,
+  className
+}) {
+  const failed = phase === "failed" ? describeError?.(error) ?? labels.resendError : "";
+  return /* @__PURE__ */ jsx(
+    "span",
+    {
+      role: "status",
+      className: cn(phase === "failed" ? "text-[var(--danger)]" : "text-[var(--success)]", className),
+      children: phase === "sent" ? labels.resent : failed
+    }
+  );
+}
+function defaultVerifyFailure(error) {
+  return authErrorCode(error) === "token_expired" ? "expired" : "invalid";
+}
+function VerifyEmailStatus({
+  token,
+  onVerify,
+  classifyError,
+  describeError,
+  signedIn = false,
+  onResend,
+  cooldown = DEFAULT_COOLDOWN,
+  continueHref,
+  verifiedContent,
+  title,
+  headingAs: Heading = "h2",
+  labels: labelsProp,
+  className,
+  ...rest
+}) {
+  const labels = useKitLabels("verifyEmail", DEFAULT_VERIFY_EMAIL_LABELS, labelsProp);
+  const [settled, setSettled] = useState(null);
+  const outcome = token === "" ? "invalid" : settled?.token === token ? settled.outcome : "verifying";
+  const { announce, regionProps } = useAnnounce();
+  const resend = useResend(onResend, cooldown);
+  useOncePerKey(token === "" ? null : token, onVerify, (key, result) => {
+    const next = result.ok ? "verified" : (classifyError ?? defaultVerifyFailure)(result.error);
+    setSettled({ token: key, outcome: next });
+    announce(labels[next]);
+  });
+  const href = continueHref ?? (signedIn ? "/" : "/login");
+  const continueButton = /* @__PURE__ */ jsx(Button, { href, replace: true, variant: outcome === "verified" ? "brand" : "secondary", children: labels.continue });
+  const canResend = signedIn && onResend !== void 0;
+  let body;
+  if (outcome === "verifying") {
+    body = /* @__PURE__ */ jsx(LoadingState, { size: "sm", label: labels.verifying });
+  } else if (outcome === "verified") {
+    body = /* @__PURE__ */ jsx(
+      EmptyState,
+      {
+        tone: "success",
+        icon: /* @__PURE__ */ jsx(CheckCircle2, {}),
+        title: labels.verified,
+        hint: verifiedContent,
+        action: continueButton,
+        className: OUTCOME_CLASS
+      }
+    );
+  } else {
+    const hint = /* @__PURE__ */ jsxs(Fragment, { children: [
+      outcome === "invalid" && token !== "" ? `${labels.invalidHint} ` : "",
+      canResend ? labels.requestHere : labels.requestInApp
+    ] });
+    body = /* @__PURE__ */ jsx(
+      EmptyState,
+      {
+        tone: "danger",
+        icon: outcome === "expired" ? /* @__PURE__ */ jsx(TimerOff, {}) : /* @__PURE__ */ jsx(XCircle, {}),
+        title: token === "" ? labels.noToken : labels[outcome],
+        hint,
+        action: /* @__PURE__ */ jsxs(Fragment, { children: [
+          canResend && /* @__PURE__ */ jsx(ResendButton, { state: resend, labels, variant: "brand" }),
+          continueButton
+        ] }),
+        className: OUTCOME_CLASS
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxs(
+    "div",
+    {
+      ...rest,
+      "data-state": outcome,
+      "aria-busy": outcome === "verifying" || void 0,
+      className: cn("space-y-3", className),
+      children: [
+        title === null ? null : /* @__PURE__ */ jsx(Heading, { className: STATUS_HEADING_CLASS, children: title ?? labels.title }),
+        body,
+        canResend && /* @__PURE__ */ jsx(
+          ResendStatus,
+          {
+            phase: resend.phase,
+            error: resend.error,
+            describeError,
+            labels,
+            className: "block text-center text-xs"
+          }
+        ),
+        /* @__PURE__ */ jsx("div", { ...regionProps })
+      ]
+    }
+  );
+}
+function EmailVerificationBanner({
+  onResend,
+  describeError,
+  cooldown = DEFAULT_COOLDOWN,
+  onDismiss,
+  variant = "strip",
+  children,
+  className,
+  labels: labelsProp
+}) {
+  const labels = useKitLabels("verifyEmail", DEFAULT_VERIFY_EMAIL_LABELS, labelsProp);
+  const resend = useResend(onResend, cooldown);
+  return /* @__PURE__ */ jsxs(
+    AlertBanner,
+    {
+      tone: "warning",
+      variant,
+      icon: /* @__PURE__ */ jsx(MailWarning, {}),
+      action: /* @__PURE__ */ jsx(ResendButton, { state: resend, labels, variant: "secondary" }),
+      onDismiss,
+      dismissLabel: onDismiss ? labels.dismiss : void 0,
+      className,
+      children: [
+        labels.banner,
+        children != null && children !== false && /* @__PURE__ */ jsxs(Fragment, { children: [
+          " ",
+          children
+        ] }),
+        " ",
+        /* @__PURE__ */ jsx(
+          ResendStatus,
+          {
+            phase: resend.phase,
+            error: resend.error,
+            describeError,
+            labels,
+            className: "font-medium"
+          }
+        )
+      ]
+    }
+  );
+}
+export {
+  DEFAULT_VERIFY_EMAIL_LABELS,
+  EmailVerificationBanner,
+  VerifyEmailStatus
+};
+//# sourceMappingURL=verify-email.js.map

package/dist/auth/verify-email.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/verify-email.tsx"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, ReactNode } from \"react\";\nimport { CheckCircle2, MailWarning, TimerOff, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { useAnnounce } from \"../hooks/use-announce\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button, EmptyState } from \"../components/ui\";\nimport { OUTCOME_CLASS, STATUS_HEADING_CLASS, isThenable, useOncePerKey } from \"./status-parts\";\nimport { authErrorCode } from \"./auth-errors\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the verification page and banner render — the `verifyEmail` namespace.\n *  keksdose's words (`verify_email.*`, and its server's \"has expired\"). */\nexport interface VerifyEmailLabels {\n  /** The page's heading. */\n  title: string;\n  /** While the link is redeemed. */\n  verifying: string;\n  verified: string;\n  /** The way on from the page — into the app, or to sign-in. */\n  continue: string;\n  invalid: string;\n  expired: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** Under `invalid`: why a link stops working. */\n  invalidHint: string;\n  /** Under a dead link, signed out: where a new one comes from. */\n  requestInApp: string;\n  /** Under a dead link, signed in, beside \"Send again\". */\n  requestHere: string;\n  /** The resend button, on the page and in the banner. */\n  resend: string;\n  /** The resend button while a just-sent mail cools down, given the seconds left. */\n  resendIn: (seconds: number) => string;\n  /** Said (and shown) after a resend went out. */\n  resent: string;\n  /** Said (and shown) after a resend failed. */\n  resendError: string;\n  /** The banner's message. */\n  banner: string;\n  /** The banner's ×: it defers, it does not close anything. */\n  dismiss: string;\n}\n\nexport const DEFAULT_VERIFY_EMAIL_LABELS: VerifyEmailLabels = {\n  title: \"Confirm your email address\",\n  verifying: \"Confirming…\",\n  verified: \"Your email address is confirmed.\",\n  continue: \"Continue\",\n  invalid: \"This confirmation link is not valid\",\n  expired: \"This confirmation link has expired\",\n  noToken: \"This link is missing its confirmation token.\",\n  invalidHint: \"The link may have expired or already been used.\",\n  requestInApp: \"You can request a new one from inside the app.\",\n  requestHere: \"You can request a new one here.\",\n  resend: \"Send again\",\n  resendIn: (seconds) => `Send again in ${seconds} s`,\n  resent: \"Confirmation email sent\",\n  resendError: \"Could not send the confirmation email\",\n  banner: \"Please confirm your email address.\",\n  dismiss: \"Not now\",\n};\n\n/** A minute: long enough that an impatient second click does not mail twice, short\n *  enough that a mail lost to a spam filter can be re-sent without leaving the page. The\n *  server's own limit is the real one (kastlan: 3 an hour per address). */\nconst DEFAULT_COOLDOWN = 60;\n\n/* ── Resend ──────────────────────────────────────────────────────────────── */\n\ntype ResendPhase = \"idle\" | \"sending\" | \"sent\" | \"failed\";\n\n/**\n * \"Send again\" with its own memory: busy while the request runs, then — after a mail\n * went out — held for `cooldown` seconds with the countdown on the button, so a second\n * click cannot mail twice and a throttled server is not asked to refuse. A failure frees\n * it at once. The outcome is a polite live region that is always rendered (a region that\n * mounts with its message is often not read), and visible.\n */\nfunction useResend(onResend: (() => Promise<unknown> | void) | undefined, cooldown: number) {\n  const [phase, setPhase] = useState<ResendPhase>(\"idle\");\n  // The refusal itself, for `describeError` (0.29.1): the server's own sentence — keksdose's\n  // per-address throttle, \"try again in N minutes\" — beats a fixed \"could not send\".\n  const [error, setError] = useState<unknown>(undefined);\n  const [remaining, setRemaining] = useState(0);\n  const counting = remaining > 0;\n  useEffect(() => {\n    if (!counting) return;\n    const id = setInterval(() => setRemaining((r) => Math.max(0, r - 1)), 1000);\n    return () => clearInterval(id);\n  }, [counting]);\n\n  const sent = () => {\n    setPhase(\"sent\");\n    setRemaining(Math.max(0, Math.round(cooldown)));\n  };\n  const send = () => {\n    if (!onResend || phase === \"sending\" || counting) return;\n    let result: unknown;\n    try {\n      result = onResend();\n    } catch (e) {\n      setError(e);\n      setPhase(\"failed\");\n      return;\n    }\n    if (!isThenable(result)) {\n      sent();\n      return;\n    }\n    setPhase(\"sending\");\n    result.then(sent, (e: unknown) => {\n      setError(e);\n      setPhase(\"failed\");\n    });\n  };\n  return { phase, remaining, send, error };\n}\n\nfunction ResendButton({\n  state,\n  labels,\n  variant,\n}: {\n  state: ReturnType<typeof useResend>;\n  labels: VerifyEmailLabels;\n  variant: \"secondary\" | \"brand\";\n}) {\n  return (\n    <Button\n      type=\"button\"\n      variant={variant}\n      size={variant === \"secondary\" ? \"sm\" : undefined}\n      onClick={state.send}\n      pending={state.phase === \"sending\"}\n      // `disabledReason`, not `disabled`: the button just pressed has the focus, and a\n      // native `disabled` would drop it to <body>. The reason is what just happened.\n      disabledReason={state.remaining > 0 ? labels.resent : undefined}\n    >\n      {state.remaining > 0 ? labels.resendIn(state.remaining) : labels.resend}\n    </Button>\n  );\n}\n\nfunction ResendStatus({\n  phase,\n  error,\n  describeError,\n  labels,\n  className,\n}: {\n  phase: ResendPhase;\n  error?: unknown;\n  describeError?: (error: unknown) => string | undefined;\n  labels: VerifyEmailLabels;\n  className?: string;\n}) {\n  const failed = phase === \"failed\" ? (describeError?.(error) ?? labels.resendError) : \"\";\n  return (\n    <span\n      role=\"status\"\n      className={cn(phase === \"failed\" ? \"text-[var(--danger)]\" : \"text-[var(--success)]\", className)}\n    >\n      {phase === \"sent\" ? labels.resent : failed}\n    </span>\n  );\n}\n\n/* ── The page ────────────────────────────────────────────────────────────── */\n\n/** What became of a confirmation link that did not verify. */\nexport type VerifyEmailFailure = \"invalid\" | \"expired\";\n\n/** The default when the app gives no `classifyError`: the coded refusal decides. */\nfunction defaultVerifyFailure(error: unknown): VerifyEmailFailure {\n  return authErrorCode(error) === \"token_expired\" ? \"expired\" : \"invalid\";\n}\n\nexport interface VerifyEmailStatusProps extends Omit<ComponentPropsWithoutRef<\"div\">, \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=`. Empty: the link was cut short, and the\n   *  page says so without asking anyone. */\n  token: string;\n  /**\n   * Redeem it — `POST /auth/verify-email {token}`, once per token, on mount. A POST and\n   * not the link's own GET (§10.10): a mail scanner that opens every link must not\n   * confirm an address nobody read. Resolve when it verified (an address that already\n   * was counts: keksdose's redeem is idempotent); reject with the client's error.\n   */\n  onVerify: (token: string) => Promise<unknown>;\n  /** Which dead end a rejection is. Default: `invalid` for everything — §5.2's servers\n   *  answer one `token_invalid`; an app whose server tells expiry apart maps it here. */\n  classifyError?: (error: unknown) => VerifyEmailFailure;\n  /** 0.29.1: the words for a refused resend — the server's own sentence (a throttle's\n   *  \"try again in N minutes\"), else the kit's `resendError`. */\n  describeError?: (error: unknown) => string | undefined;\n  /** Someone is signed in on this device: \"Continue\" goes into the app, and a dead link\n   *  offers \"Send again\" (with `onResend`). */\n  signedIn?: boolean;\n  /** Send a new confirmation mail (`POST /auth/verify-email/resend`) — offered on a dead\n   *  link while signed in. */\n  onResend?: () => Promise<unknown> | void;\n  /** Seconds \"Send again\" waits after a mail went out. Default 60; `0` never waits. */\n  cooldown?: number;\n  /** Where \"Continue\" goes. Default `/` signed in, `/login` signed out. */\n  continueHref?: string;\n  /** App content under \"confirmed\" — keksdose's \"Others can now share a budget with you\n   *  directly.\" */\n  verifiedContent?: ReactNode;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it in\n   *  `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<VerifyEmailLabels>;\n}\n\ntype VerifyOutcome = \"verified\" | VerifyEmailFailure;\n\n/**\n * Redeem an email-confirmation link (`/verify-email?token=…`, docs/auth-harmonization.md\n * §7) — keksdose's `VerifyEmailPage` (features/auth/verify-email-page.tsx), with\n * kastlan's outcome blocks and its separate \"expired\".\n *\n * Opened from an inbox, often in a browser with no session, so the token is the only\n * credential and the page renders signed-out. It redeems once per token on mount\n * (StrictMode's double effect included — the token is single-use) and shows one of:\n * confirmed; not valid; expired; or the link had no token at all. Verification gates\n * nothing (§2.8), so every outcome ends on \"Continue\". Signed in, a dead link also\n * offers \"Send again\", which waits `cooldown` seconds after a mail went out.\n *\n * The outcome replaces the spinner, which says nothing to a screen reader on its own,\n * so it is also announced.\n */\nexport function VerifyEmailStatus({\n  token,\n  onVerify,\n  classifyError,\n  describeError,\n  signedIn = false,\n  onResend,\n  cooldown = DEFAULT_COOLDOWN,\n  continueHref,\n  verifiedContent,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: VerifyEmailStatusProps) {\n  const labels = useKitLabels(\"verifyEmail\", DEFAULT_VERIFY_EMAIL_LABELS, labelsProp);\n  const [settled, setSettled] = useState<{ token: string; outcome: VerifyOutcome } | null>(null);\n  const outcome: VerifyOutcome | \"verifying\" =\n    token === \"\" ? \"invalid\" : settled?.token === token ? settled.outcome : \"verifying\";\n  const { announce, regionProps } = useAnnounce();\n  const resend = useResend(onResend, cooldown);\n\n  useOncePerKey(token === \"\" ? null : token, onVerify, (key, result) => {\n    // Without a classifier, the coded refusal decides (0.29.1): `token_expired` is\n    // \"expired\", anything else \"invalid\".\n    const next: VerifyOutcome = result.ok\n      ? \"verified\"\n      : (classifyError ?? defaultVerifyFailure)(result.error);\n    setSettled({ token: key, outcome: next });\n    announce(labels[next]);\n  });\n\n  const href = continueHref ?? (signedIn ? \"/\" : \"/login\");\n  // `replace`: the token is spent, so Back must not land on this page again (keksdose F1).\n  const continueButton = (\n    <Button href={href} replace variant={outcome === \"verified\" ? \"brand\" : \"secondary\"}>\n      {labels.continue}\n    </Button>\n  );\n  const canResend = signedIn && onResend !== undefined;\n\n  let body: ReactNode;\n  if (outcome === \"verifying\") {\n    body = <LoadingState size=\"sm\" label={labels.verifying} />;\n  } else if (outcome === \"verified\") {\n    body = (\n      <EmptyState\n        tone=\"success\"\n        icon={<CheckCircle2 />}\n        title={labels.verified}\n        hint={verifiedContent}\n        action={continueButton}\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else {\n    const hint = (\n      <>\n        {outcome === \"invalid\" && token !== \"\" ? `${labels.invalidHint} ` : \"\"}\n        {canResend ? labels.requestHere : labels.requestInApp}\n      </>\n    );\n    body = (\n      <EmptyState\n        tone=\"danger\"\n        icon={outcome === \"expired\" ? <TimerOff /> : <XCircle />}\n        title={token === \"\" ? labels.noToken : labels[outcome]}\n        hint={hint}\n        action={\n          <>\n            {canResend && <ResendButton state={resend} labels={labels} variant=\"brand\" />}\n            {continueButton}\n          </>\n        }\n        className={OUTCOME_CLASS}\n      />\n    );\n  }\n\n  return (\n    <div\n      {...rest}\n      data-state={outcome}\n      aria-busy={outcome === \"verifying\" || undefined}\n      className={cn(\"space-y-3\", className)}\n    >\n      {title === null ? null : <Heading className={STATUS_HEADING_CLASS}>{title ?? labels.title}</Heading>}\n      {body}\n      {canResend && (\n        <ResendStatus\n          phase={resend.phase}\n          error={resend.error}\n          describeError={describeError}\n          labels={labels}\n          className=\"block text-center text-xs\"\n        />\n      )}\n      {/* Rendered from the start, so the outcome is read when it arrives. */}\n      <div {...regionProps} />\n    </div>\n  );\n}\n\n/* ── The banner ──────────────────────────────────────────────────────────── */\n\nexport interface EmailVerificationBannerProps {\n  /** Send a new confirmation mail (`POST /auth/verify-email/resend`). Resolve when it\n   *  went out; reject and the banner says it could not. */\n  onResend: () => Promise<unknown> | void;\n  /** 0.29.1: the words for a refused resend — the server's own sentence, else the kit's. */\n  describeError?: (error: unknown) => string | undefined;\n  /** Seconds \"Send again\" waits after a mail went out. Default 60; `0` never waits. */\n  cooldown?: number;\n  /** The ×, \"Not now\". The banner does not hide itself: the app stops rendering it —\n   *  keksdose for the rest of the session. Left out, no ×. */\n  onDismiss?: () => void;\n  /** `strip` (default): keksdose's band across the top of the shell. `box`: kastlan's\n   *  callout inside the page. */\n  variant?: \"strip\" | \"box\";\n  /** The app's sentence after the kit's — keksdose's \"Until you do, nobody can share a\n   *  budget with you directly.\" */\n  children?: ReactNode;\n  className?: string;\n  labels?: Partial<VerifyEmailLabels>;\n}\n\n/**\n * The nudge for a signed-in account whose address is not confirmed — keksdose's\n * `VerifyEmailBanner` (features/auth/verify-email-banner.tsx), kastlan's copy of it.\n *\n * A prompt, not a wall: verification gates nothing (§2.8). The app renders it while\n * `/auth/me` says `email_verified: false`, and stops when the user dismisses it or the\n * page above confirms the address. \"Send again\" waits `cooldown` seconds after a mail\n * went out (the button says how long), and its outcome is written into the banner and\n * read out — no toast needed.\n */\nexport function EmailVerificationBanner({\n  onResend,\n  describeError,\n  cooldown = DEFAULT_COOLDOWN,\n  onDismiss,\n  variant = \"strip\",\n  children,\n  className,\n  labels: labelsProp,\n}: EmailVerificationBannerProps) {\n  const labels = useKitLabels(\"verifyEmail\", DEFAULT_VERIFY_EMAIL_LABELS, labelsProp);\n  const resend = useResend(onResend, cooldown);\n  return (\n    <AlertBanner\n      tone=\"warning\"\n      variant={variant}\n      icon={<MailWarning />}\n      action={<ResendButton state={resend} labels={labels} variant=\"secondary\" />}\n      onDismiss={onDismiss}\n      dismissLabel={onDismiss ? labels.dismiss : undefined}\n      className={className}\n    >\n      {labels.banner}\n      {children != null && children !== false && <> {children}</>}{\" \"}\n      <ResendStatus\n        phase={resend.phase}\n        error={resend.error}\n        describeError={describeError}\n        labels={labels}\n        className=\"font-medium\"\n      />\n    </AlertBanner>\n  );\n}\n"],"mappings":";AAsII,SAkKE,UAlKF,KAkKE,YAlKF;AAtIJ,SAAS,WAAW,gBAAgB;AAEpC,SAAS,cAAc,aAAa,UAAU,eAAe;AAC7D,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,QAAQ,kBAAkB;AACnC,SAAS,eAAe,sBAAsB,YAAY,qBAAqB;AAC/E,SAAS,qBAAqB;AAuCvB,MAAM,8BAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,WAAW;AAAA,EACX,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,cAAc;AAAA,EACd,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,UAAU,CAAC,YAAY,iBAAiB,OAAO;AAAA,EAC/C,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;AAKA,MAAM,mBAAmB;AAazB,SAAS,UAAU,UAAuD,UAAkB;AAC1F,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAsB,MAAM;AAGtD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAkB,MAAS;AACrD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,CAAC;AAC5C,QAAM,WAAW,YAAY;AAC7B,YAAU,MAAM;AACd,QAAI,CAAC,SAAU;AACf,UAAM,KAAK,YAAY,MAAM,aAAa,CAAC,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,GAAI;AAC1E,WAAO,MAAM,cAAc,EAAE;AAAA,EAC/B,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,OAAO,MAAM;AACjB,aAAS,MAAM;AACf,iBAAa,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EAChD;AACA,QAAM,OAAO,MAAM;AACjB,QAAI,CAAC,YAAY,UAAU,aAAa,SAAU;AAClD,QAAI;AACJ,QAAI;AACF,eAAS,SAAS;AAAA,IACpB,SAAS,GAAG;AACV,eAAS,CAAC;AACV,eAAS,QAAQ;AACjB;AAAA,IACF;AACA,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,WAAK;AACL;AAAA,IACF;AACA,aAAS,SAAS;AAClB,WAAO,KAAK,MAAM,CAAC,MAAe;AAChC,eAAS,CAAC;AACV,eAAS,QAAQ;AAAA,IACnB,CAAC;AAAA,EACH;AACA,SAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AACzC;AAEA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,MAAM,YAAY,cAAc,OAAO;AAAA,MACvC,SAAS,MAAM;AAAA,MACf,SAAS,MAAM,UAAU;AAAA,MAGzB,gBAAgB,MAAM,YAAY,IAAI,OAAO,SAAS;AAAA,MAErD,gBAAM,YAAY,IAAI,OAAO,SAAS,MAAM,SAAS,IAAI,OAAO;AAAA;AAAA,EACnE;AAEJ;AAEA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,SAAS,UAAU,WAAY,gBAAgB,KAAK,KAAK,OAAO,cAAe;AACrF,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,WAAW,GAAG,UAAU,WAAW,yBAAyB,yBAAyB,SAAS;AAAA,MAE7F,oBAAU,SAAS,OAAO,SAAS;AAAA;AAAA,EACtC;AAEJ;AAQA,SAAS,qBAAqB,OAAoC;AAChE,SAAO,cAAc,KAAK,MAAM,kBAAkB,YAAY;AAChE;AAyDO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,eAAe,6BAA6B,UAAU;AAClF,QAAM,CAAC,SAAS,UAAU,IAAI,SAA2D,IAAI;AAC7F,QAAM,UACJ,UAAU,KAAK,YAAY,SAAS,UAAU,QAAQ,QAAQ,UAAU;AAC1E,QAAM,EAAE,UAAU,YAAY,IAAI,YAAY;AAC9C,QAAM,SAAS,UAAU,UAAU,QAAQ;AAE3C,gBAAc,UAAU,KAAK,OAAO,OAAO,UAAU,CAAC,KAAK,WAAW;AAGpE,UAAM,OAAsB,OAAO,KAC/B,cACC,iBAAiB,sBAAsB,OAAO,KAAK;AACxD,eAAW,EAAE,OAAO,KAAK,SAAS,KAAK,CAAC;AACxC,aAAS,OAAO,IAAI,CAAC;AAAA,EACvB,CAAC;AAED,QAAM,OAAO,iBAAiB,WAAW,MAAM;AAE/C,QAAM,iBACJ,oBAAC,UAAO,MAAY,SAAO,MAAC,SAAS,YAAY,aAAa,UAAU,aACrE,iBAAO,UACV;AAEF,QAAM,YAAY,YAAY,aAAa;AAE3C,MAAI;AACJ,MAAI,YAAY,aAAa;AAC3B,WAAO,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,WAAW;AAAA,EAC1D,WAAW,YAAY,YAAY;AACjC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,oBAAC,gBAAa;AAAA,QACpB,OAAO,OAAO;AAAA,QACd,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,OAAO;AACL,UAAM,OACJ,iCACG;AAAA,kBAAY,aAAa,UAAU,KAAK,GAAG,OAAO,WAAW,MAAM;AAAA,MACnE,YAAY,OAAO,cAAc,OAAO;AAAA,OAC3C;AAEF,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,YAAY,YAAY,oBAAC,YAAS,IAAK,oBAAC,WAAQ;AAAA,QACtD,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO,OAAO;AAAA,QACrD;AAAA,QACA,QACE,iCACG;AAAA,uBAAa,oBAAC,gBAAa,OAAO,QAAQ,QAAgB,SAAQ,SAAQ;AAAA,UAC1E;AAAA,WACH;AAAA,QAEF,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ,cAAY;AAAA,MACZ,aAAW,YAAY,eAAe;AAAA,MACtC,WAAW,GAAG,aAAa,SAAS;AAAA,MAEnC;AAAA,kBAAU,OAAO,OAAO,oBAAC,WAAQ,WAAW,sBAAuB,mBAAS,OAAO,OAAM;AAAA,QACzF;AAAA,QACA,aACC;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,OAAO;AAAA,YACd,OAAO,OAAO;AAAA,YACd;AAAA,YACA;AAAA,YACA,WAAU;AAAA;AAAA,QACZ;AAAA,QAGF,oBAAC,SAAK,GAAG,aAAa;AAAA;AAAA;AAAA,EACxB;AAEJ;AAmCO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,UAAU;AAAA,EACV;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAAiC;AAC/B,QAAM,SAAS,aAAa,eAAe,6BAA6B,UAAU;AAClF,QAAM,SAAS,UAAU,UAAU,QAAQ;AAC3C,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,MAAM,oBAAC,eAAY;AAAA,MACnB,QAAQ,oBAAC,gBAAa,OAAO,QAAQ,QAAgB,SAAQ,aAAY;AAAA,MACzE;AAAA,MACA,cAAc,YAAY,OAAO,UAAU;AAAA,MAC3C;AAAA,MAEC;AAAA,eAAO;AAAA,QACP,YAAY,QAAQ,aAAa,SAAS,iCAAE;AAAA;AAAA,UAAE;AAAA,WAAS;AAAA,QAAK;AAAA,QAC7D;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,OAAO;AAAA,YACd,OAAO,OAAO;AAAA,YACd;AAAA,YACA;AAAA,YACA,WAAU;AAAA;AAAA,QACZ;AAAA;AAAA;AAAA,EACF;AAEJ;","names":[]}

package/dist/chart.d.ts

@@ -13,7 +13,10 @@ export { TimeTickUnit } from './components/series-chart-ticks.js';
 import 'recharts';
 import 'react';
 import './lib/direction.js';
-import './kit-labels-Du0uHBq4.js';
+import './delete-account-setting-CGVMckMw.js';
+import './components/tooltip.js';
+import './hooks/use-anchored-rect.js';
+import './lib/clipping.js';
 import './data-table-labels-DUELeXpa.js';
 import './components/data-table-sort.js';
 import './components/swipeable-row.js';
@@ -23,9 +26,6 @@ import './components/popover.js';
 import './components/chip.js';
 import 'lucide-react';
 import './components/field-sync.js';
-import './components/tooltip.js';
-import './hooks/use-anchored-rect.js';
-import './lib/clipping.js';
 import './wizard/types.js';
 import './tour/tour.js';
 import './search/command-palette.js';
@@ -45,6 +45,7 @@ import './components/modal.js';
 import './hooks/use-search-param-state.js';
 import './components/measured-grid.js';
 import './components/user-avatar.js';
+import './lib/person-name.js';
 import './components/status-dot.js';
 import './components/progress-bar.js';
 import './components/signed-amount.js';
@@ -64,8 +65,27 @@ import './components/authed-image.js';
 import './components/image-grid.js';
 import './components/lightbox.js';
 import './components/write-lock.js';
-import './components/account-chips.js';
+import './auth/sign-in-form.js';
+import './shell/topbar-controls.js';
+import './theme/palette-presets.js';
+import './theme/theme-store.js';
+import 'zustand/middleware';
+import 'zustand';
+import './auth/complete-name-dialog.js';
+import './auth/forgot-password-form.js';
+import './auth/status-parts.js';
+import './auth/reset-password-form.js';
+import './auth/verify-email.js';
+import './auth/not-found-page.js';
+import './auth/accept-invitation.js';
+import './shell/company-switcher.js';
+import './account/email-change-setting.js';
+import './account/sessions-setting.js';
 import './lib/format.js';
+import './account/data-export-setting.js';
+import './components/account-chips.js';
+import './admin/admin-parts.js';
+import './admin/admin-action-log.js';
 import './components/reauth-dialog.js';
 import './components/server-wake.js';
 import './lib/server-wake.js';

package/dist/components/account-chips.d.ts

@@ -1,5 +1,5 @@
 import * as react from 'react';
-import { ReactNode, ReactElement } from 'react';
+import { ReactElement, ReactNode } from 'react';
 import { LucideIcon } from 'lucide-react';
 import { DateInput, FormatDateStyle, FormatRelativeTimeOptions } from '../lib/format.js';
 import { ChipTone, ChipSize, ChipVariant, ChipShape } from './chip.js';
@@ -78,18 +78,58 @@ declare function RoleChip<R extends string = string>({ value: role, roles, size,
  * - `registered` — an allowlist row whose address has an account now (Kurvenschmiede).
  * - `unverified` — the email address is not confirmed (keksdose).
  * - `passwordChange` — must set a new password at the next sign-in (keksdose).
+ * - `deletion` — 0.30.0: the user asked for the account to be deleted
+ *   (docs/user-admin-harmonization.md §2.1, §6.4). It is deactivated at once and erased
+ *   on a date (`after_days`: keksdose, Kurvenschmiede) or by an operator (kastlan). The
+ *   chip says the date when there is one ({@link AccountStateChipProps.date}), and
+ *   "Deletion requested" when there is none. It stands IN PLACE of `inactive`: an
+ *   account marked for deletion is always deactivated, and two chips would say it twice.
  *
  * An account can be several at once (inactive AND unverified): render one chip per
  * state, as keksdose's state column does.
  */
-type AccountState = "active" | "inactive" | "invited" | "registered" | "unverified" | "passwordChange";
-type AccountStateLabels = Record<AccountState, string>;
-declare const DEFAULT_ACCOUNT_STATE_LABELS: AccountStateLabels;
-/** The default tone of each state: green for the normal case, red for switched off,
- *  amber for something the user still has to do, blue for an open invitation. */
+type AccountState = "active" | "inactive" | "invited" | "registered" | "unverified" | "passwordChange" | "deletion";
+/**
+ * The `accountState` namespace. One word per state, plus the two forms of `deletion`.
+ *
+ * The 0.30 keys are OPTIONAL, like every key added to a namespace an app annotates
+ * (`const L: AccountStateLabels = {…}`): a new required key would be a compile error in
+ * each app on its next update. Left out, they fall back to the provider's, then English.
+ */
+interface AccountStateLabels extends Record<Exclude<AccountState, "deletion">, string> {
+    /** 0.30.0: an account marked for deletion with no date — kastlan's `operator` mode,
+     *  where an operator erases it (§6.4). "Deletion requested". */
+    deletion?: string;
+    /** 0.30.0: an account that will be erased on `date`, already formatted in the
+     *  reader's locale — the `after_days` mode. "Deletion on 6 Nov 2026". */
+    deletionOn?: (date: string) => string;
+}
+declare const DEFAULT_ACCOUNT_STATE_LABELS: {
+    active: string;
+    inactive: string;
+    invited: string;
+    registered: string;
+    unverified: string;
+    passwordChange: string;
+    deletion: string;
+    deletionOn: (date: string) => string;
+};
+/** The default tone of each state: green for the normal case, red for switched off
+ *  (and for going, `deletion`), amber for something the user still has to do, blue for
+ *  an open invitation. */
 declare const ACCOUNT_STATE_TONES: Readonly<Record<AccountState, ChipTone>>;
 interface AccountStateChipProps extends AccountChipLook {
     state: AccountState;
+    /**
+     * 0.30.0, `state="deletion"` only: the day the account will be erased — the row's
+     * `deletion_scheduled_at` (§3.2, §6.4). Formatted as a date in the reader's locale
+     * ("Deletion on 6 Nov 2026"), through the provider's `formatDate` when the app set
+     * one, as {@link DateMark} does. Missing or `null` — an operator erases it, so there
+     * is no date — the chip says "Deletion requested". Ignored for every other state.
+     */
+    date?: DateInput;
+    /** Over the provider's locale, for the `deletion` date. */
+    locale?: string;
     /** Over {@link ACCOUNT_STATE_TONES} — Kurvenschmiede draws `inactive` neutral. */
     tone?: ChipTone;
     /** Over the label, for an app whose word for the state is its own ("Deactivated"). */
@@ -101,7 +141,7 @@ interface AccountStateChipProps extends AccountChipLook {
  * An account's state as a chip, in the kit's words and tones. Carries `data-state`
  * with the key.
  */
-declare function AccountStateChip({ state, tone, children, labels: labelsProp, size, variant, shape, caps, className, ...rest }: AccountStateChipProps): react.JSX.Element;
+declare function AccountStateChip({ state, date, locale: localeProp, tone, children, labels: labelsProp, size, variant, shape, caps, className, ...rest }: AccountStateChipProps): react.JSX.Element;
 interface DateMarkProps {
     value: DateInput;
     /**