@eifi1/ui-kit 0.30.0 → 0.31.0

package/dist/auth/sign-in-form.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/sign-in-form.tsx"],"sourcesContent":["import { useEffect, useEffectEvent, useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, FormEvent, ReactNode } from \"react\";\nimport { KeyRound } from \"lucide-react\";\n\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { cn } from \"../lib/cn\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { hasMessage } from \"../components/choice-parts\";\nimport { CurrentPasswordInput } from \"../components/danger-confirm\";\nimport { OneTimeCodeInput } from \"../components/one-time-code-input\";\nimport { TextLink } from \"../components/text-link\";\nimport { Button, Input } from \"../components/ui\";\nimport { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport type { KitErrorCode } from \"./auth-errors\";\nimport { taggedEmail } from \"./email-tag\";\nimport { newPasswordProblem } from \"./form-rules\";\nimport { NewPasswordFields } from \"./new-password-fields\";\n\n/* ── The answers (§5.1) ──────────────────────────────────────────────────── */\n\n/**\n * What a sign-in call answers, in the kit's words — docs/auth-harmonization.md §5.1,\n * keksdose's three shapes. The app maps its own HTTP answer to one of these and resolves\n * with it; a refusal REJECTS (with whatever its client throws — {@link authErrorCode}\n * reads the code out of it).\n *\n * | the server answers (keksdose) | resolve with |\n * |---|---|\n * | `TokenResponse` `{access_token, refresh_token, token_type, user}` | `{ kind: \"signed-in\" }`, after the app has stored the session |\n * | `{requires_2fa: true, challenge_token}` | `{ kind: \"2fa\", challengeToken: challenge_token }` |\n * | `{requires_password_change: true, challenge_token, encrypted}` | `{ kind: \"password-change\", challengeToken: challenge_token, extra: { encrypted } }` |\n * | `401 {code: \"invalid_credentials\"}` | reject — let the client's error through |\n *\n * ```ts\n * async function toAnswer(res: TokenResponse | TwoFactorChallenge | PasswordChangeChallenge): Promise<SignInAnswer> {\n *   if (\"requires_2fa\" in res) return { kind: \"2fa\", challengeToken: res.challenge_token };\n *   if (\"requires_password_change\" in res)\n *     return { kind: \"password-change\", challengeToken: res.challenge_token, extra: { encrypted: res.encrypted } };\n *   await onLoginSuccess(res); // store tokens, load /auth/me, switch language\n *   return { kind: \"signed-in\" };\n * }\n * <SignInForm onSubmit={async (v) => toAnswer(await authApi.login(v))} … />\n * ```\n *\n * The same mapping serves `/auth/login/2fa`, `/auth/login/set-password` and the passkey\n * finish, which answer the same union.\n */\nexport type SignInAnswer =\n  | { kind: \"signed-in\" }\n  | { kind: \"2fa\"; challengeToken: string }\n  | {\n      kind: \"password-change\";\n      challengeToken: string;\n      /** The challenge's app fields, passed through untouched — keksdose's `encrypted`,\n       *  which its note on this step reads (`passwordChangeContent`). */\n      extra?: Readonly<Record<string, unknown>>;\n    };\n\n/** The step on screen: the credentials, the second factor, or a new password. */\nexport type SignInStep = \"credentials\" | \"2fa\" | \"password-change\";\n\n/** What the person did when a call failed — {@link SignInFormProps.describeError}'s\n *  second argument. */\nexport type SignInAction = \"password\" | \"passkey\" | \"code\" | \"set-password\";\n\nexport interface SignInCredentials {\n  /** Trimmed. Lower-casing is the server's (§3.1). */\n  email: string;\n  /** As typed, never trimmed. */\n  password: string;\n}\n\nexport interface SignInCodeValues {\n  challengeToken: string;\n  /** Digits only — {@link OneTimeCodeInput} drops the spaces of \"123 456\". A backup code\n   *  (`kind: \"recovery\"`) is trimmed and otherwise as typed: its dashes and case are the\n   *  server's to normalise, as kastlan's `_normalise_backup_code` does. */\n  code: string;\n  /**\n   * 0.30.0: `\"recovery\"` when the person typed one of their backup codes instead\n   * (`recoveryCode`); absent for the authenticator's code, as before. kastlan's\n   * `/auth/login/2fa` takes either in the same `code` and tells them apart itself; an\n   * app whose server takes a backup code elsewhere routes on this.\n   */\n  kind?: \"recovery\";\n}\n\nexport interface SignInNewPasswordValues {\n  challengeToken: string;\n  password: string;\n}\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/**\n * Every string `SignInForm` renders — the `signIn` namespace of `<UiKitProvider\n * labels>`, overridable per instance through `labels`. keksdose's words where it has\n * them (`auth.*` in its catalogue).\n */\nexport interface SignInLabels {\n  email: string;\n  password: string;\n  /** The submit button. */\n  submit: string;\n  /** The passkey button (`onPasskey`). */\n  passkey: string;\n  /** The link to `forgotHref`. */\n  forgotPassword: string;\n  /** Before the link to `registerHref`. */\n  noAccount: string;\n  /** The link to `registerHref`. */\n  register: string;\n  /** The ONE answer to an unknown address, a wrong password and a deactivated account\n   *  (`invalid_credentials`, §5.2). */\n  invalidCredentials: string;\n  /** Any other failed sign-in (the network, a 500). */\n  failed: string;\n  /** A failed or refused passkey sign-in. */\n  passkeyFailed: string;\n  /**\n   * The hint under `invalidCredentials` (§2.10), shown when `deactivatedContact` is\n   * given. A TEMPLATE: `{contact}` is replaced by the contact — a `mailto:` link for an\n   * address — so a language puts it where its grammar needs it.\n   */\n  deactivatedHint: string;\n  /** The hint under `invalidCredentials` when `emailTag` is given (§4.5), given the\n   *  typed address with the app's tag: \"Signed up with ada+kastlan@example.com?\". */\n  tagHint: (taggedAddress: string) => string;\n  /** The second-factor step's heading. */\n  twoFactorTitle: string;\n  twoFactorIntro: string;\n  /** The code field's label. */\n  code: string;\n  /** The code step's submit button. */\n  verify: string;\n  /** The code was refused. */\n  codeInvalid: string;\n  /** The set-a-new-password step's heading. */\n  setPasswordTitle: string;\n  setPasswordIntro: string;\n  newPassword: string;\n  confirmPassword: string;\n  passwordMismatch: string;\n  /** The set-a-new-password step's submit button. */\n  setPasswordSubmit: string;\n  setPasswordFailed: string;\n  /** A challenge was refused as `token_invalid` — it expired between the steps; the\n   *  form is back on the credentials. */\n  expired: string;\n  /** From the second and third step back to the credentials. */\n  backToSignIn: string;\n  /*\n   * 0.30.0 — OPTIONAL, like `TwoFactorSettingLabels.qrAlt` and for its reason: a new\n   * required key is a compile error at every call site that annotates this interface\n   * (CONTRIBUTING's additive-API rule). Each falls back to the provider's `signIn`, then\n   * English.\n   */\n  /** The second-factor step's switch to a backup code (`recoveryCode`). */\n  useRecoveryCode?: string;\n  /** The switch back, from the backup-code field to the authenticator's code. */\n  useAuthenticatorCode?: string;\n  /** The backup-code field's label. */\n  recoveryCode?: string;\n  /** The step's intro while a backup code is asked for, in place of `twoFactorIntro`. */\n  recoveryIntro?: string;\n  /** Under the backup-code field, given how many letters and digits a code has. */\n  recoveryCodeHint?: (length: number) => string;\n  /** A refused backup code — wrong, or spent already (each one works once). */\n  recoveryCodeInvalid?: string;\n  /** Any step's request was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  wait its `Retry-After` asks for, in seconds ({@link retryAfterSeconds}), or\n   *  `undefined` (or `0`) without one. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n/** `Required`: every key, the 0.30 ones included, has its English here. */\nexport const DEFAULT_SIGN_IN_LABELS: Required<SignInLabels> = {\n  email: \"Email\",\n  password: \"Password\",\n  submit: \"Sign in\",\n  passkey: \"Sign in with a passkey\",\n  forgotPassword: \"Forgot your password?\",\n  noAccount: \"No account yet?\",\n  register: \"Create account\",\n  invalidCredentials: \"The email or password is incorrect.\",\n  failed: \"Sign-in failed. Please try again.\",\n  passkeyFailed: \"Passkey sign-in failed.\",\n  deactivatedHint: \"Account deactivated? Write to {contact}.\",\n  tagHint: (taggedAddress) => `Signed up with ${taggedAddress}? Use that address.`,\n  twoFactorTitle: \"Two-factor authentication\",\n  twoFactorIntro: \"Enter the code your authenticator app shows.\",\n  code: \"2FA code\",\n  verify: \"Verify\",\n  codeInvalid: \"Invalid 2FA code.\",\n  setPasswordTitle: \"Choose a new password\",\n  setPasswordIntro: \"A new password was requested for this account. Choose one and you are straight back in.\",\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  passwordMismatch: \"The passwords don't match.\",\n  setPasswordSubmit: \"Set password and sign in\",\n  setPasswordFailed: \"The password could not be set.\",\n  expired: \"This sign-in has expired. Please sign in again.\",\n  backToSignIn: \"Back to sign in\",\n  useRecoveryCode: \"Use a backup code\",\n  useAuthenticatorCode: \"Use your authenticator app\",\n  recoveryCode: \"Backup code\",\n  recoveryIntro: \"Enter one of the backup codes you saved when you turned on two-factor authentication.\",\n  recoveryCodeHint: (length) => `${length} letters and digits. Dashes and spaces don’t matter.`,\n  recoveryCodeInvalid: \"This backup code is not valid, or it has been used already.\",\n  rateLimited: englishRateLimited,\n};\n\n/* ── Props ───────────────────────────────────────────────────────────────── */\n\nexport interface SignInFormProps extends Omit<ComponentPropsWithoutRef<\"div\">, \"onSubmit\" | \"children\"> {\n  /**\n   * The credentials step was submitted. Send them, and resolve with the answer\n   * ({@link SignInAnswer}) or reject with the client's error. The form never sends a\n   * request itself (§8): keksdose must see the password on its way, to refuse the same\n   * string as an encryption passphrase later.\n   *\n   * On `signed-in` the form's job is over — it stays busy while the app navigates.\n   */\n  onSubmit: (credentials: SignInCredentials) => Promise<SignInAnswer>;\n  /** The second factor was submitted (`/auth/login/2fa`). Resolves with the next answer\n   *  — keksdose may still require a new password after the code. */\n  onCode: (values: SignInCodeValues) => Promise<SignInAnswer>;\n  /** The new password was submitted (`/auth/login/set-password`). Resolves with the\n   *  answer, `signed-in` in practice; keksdose's `key_wrap_unchanged` note is the app's\n   *  to show from here. */\n  onSetPassword: (values: SignInNewPasswordValues) => Promise<SignInAnswer>;\n  /**\n   * The passkey button was pressed: run the ceremony (`/auth/passkey/login/begin|finish`)\n   * and resolve with its answer. It asks for NO email — a passkey is bound to the site,\n   * and the browser offers every one it holds (keksdose #126). Left out, no button: pass\n   * it only where `PublicKeyCredential` exists.\n   */\n  onPasskey?: () => Promise<SignInAnswer>;\n  /**\n   * Passkey autofill (conditional mediation). The email field is\n   * `autoComplete=\"username webauthn\"`, so a pending `navigator.credentials.get({\n   * mediation: \"conditional\" })` lists the site's passkeys in its dropdown. The form\n   * calls this ONCE on mount; arm the request there and resolve with its answer when the\n   * person picks a passkey, or with `null` when nothing happens. The signal aborts on\n   * unmount — cancel the pending request then (keksdose: `armPasskeyAutofill(onDone,\n   * signal)` + `cancelPasskeyAutofill()`). A rejection is silent: the button stays the\n   * reliable path.\n   */\n  passkeyAutofill?: (signal: AbortSignal) => Promise<SignInAnswer | null | undefined>;\n  /** \"Forgot your password?\" goes here — the app's `/forgot-password`. Left out, no\n   *  link. */\n  forgotHref?: string;\n  /** \"No account yet? Create account\" goes here — `/register`. Left out, no line. */\n  registerHref?: string;\n  /** The email field's start value — the reset page ends on \"Sign in\" with the address\n   *  filled in (§6.3). */\n  defaultEmail?: string;\n  /**\n   * The app's address tag (`\"kastlan\"`, §4.5). After `invalid_credentials` the form also\n   * says \"Signed up with you+kastlan@example.com? Use that address.\" — sign-in stays\n   * exact, and the server looks nothing up.\n   */\n  emailTag?: string;\n  /**\n   * Who a deactivated user writes to (§2.10): an address (drawn as a `mailto:` link) or\n   * the app's own node. Shown after `invalid_credentials` as \"Account deactivated? Write\n   * to …\". Left out, no hint.\n   */\n  deactivatedContact?: ReactNode;\n  /** Digits of the second factor. Default 6 (TOTP). */\n  codeLength?: number;\n  /**\n   * 0.30.0: offer a backup code on the second-factor step (kastlan's 0.29 adoption: its\n   * `/auth/login/2fa` takes one of the eight codes minted at 2FA setup, and the kit's\n   * step had no way to type one). A \"Use a backup code\" switch under the code field\n   * swaps the digits-only {@link OneTimeCodeInput} for a plain text field; the code goes\n   * to `onCode` with the same challenge and `kind: \"recovery\"`.\n   *\n   * `true` for a 16-character code (kastlan's `ABCD-EFGH-JKLM-NPQR`), or `{ length }`.\n   * The length counts letters and digits only — the dashes and spaces a printed code is\n   * grouped with don't count — and \"Verify\" waits for it. Left out, no switch.\n   */\n  recoveryCode?: boolean | { length?: number };\n  /** App content at the top of the credentials step — a notice, a demo button. */\n  credentialsContent?: ReactNode;\n  /**\n   * App content on the second-factor step, under its intro. 0.30.0: pass a function and\n   * it gets the challenge token — kastlan kept its own copy of the token for a \"lost\n   * your device?\" link, which the step now hands over.\n   */\n  twoFactorContent?: ReactNode | ((challengeToken: string) => ReactNode);\n  /**\n   * App content on the set-a-new-password step, under its intro — keksdose's\n   * private-mode note (\"Your encrypted data is untouched …\"), which depends on the\n   * challenge: pass a function and it gets the challenge's `extra`.\n   */\n  passwordChangeContent?: ReactNode | ((extra: Readonly<Record<string, unknown>> | undefined) => ReactNode);\n  /**\n   * The app's own words for a failure, or `undefined` for the kit's: the device being\n   * offline, a throttle with its wait (\"try again in an hour\"). Asked first, for every\n   * failure; what it returns replaces the message, and the `invalid_credentials` hints\n   * still follow. A bare `429` needs none since 0.30.0: the kit says `rateLimited`.\n   */\n  describeError?: (error: unknown, action: SignInAction) => ReactNode | undefined;\n  /** The step changed — retitle the page (`AuthLayout`'s `title`) if the app wants. */\n  onStepChange?: (step: SignInStep) => void;\n  /** The level of the second and third step's heading. Default `h2`, under the page's\n   *  `h1`; one level under `AuthLayout`'s `headingAs` where that is embedded lower. */\n  headingAs?: \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\";\n  labels?: Partial<SignInLabels>;\n}\n\n/* ── Parts ───────────────────────────────────────────────────────────────── */\n\ninterface Failure {\n  action: SignInAction;\n  code: KitErrorCode | undefined;\n  message: ReactNode;\n  /** The address the failed credentials carried — the tag hint names its tagged form. */\n  email?: string;\n}\n\n/** `{contact}` in the template, replaced by the contact (a `mailto:` link for an\n *  address). Split, not interpolated, so the link is an element. A template that lost\n *  its placeholder still shows the contact, after it. */\nfunction withContact(template: string, contact: ReactNode): ReactNode[] {\n  const node =\n    typeof contact === \"string\" && contact.includes(\"@\") ? (\n      <TextLink key=\"contact\" href={`mailto:${contact}`} tone=\"secondary\">\n        {contact}\n      </TextLink>\n    ) : (\n      <span key=\"contact\">{contact}</span>\n    );\n  if (!template.includes(\"{contact}\")) return [template, \" \", node];\n  return template\n    .split(/(\\{contact\\})/)\n    .filter((part) => part !== \"\")\n    .map((part) => (part === \"{contact}\" ? node : part));\n}\n\nconst HINT_CLASS = \"text-xs text-[var(--text-secondary)]\";\n\n/** A backup code's letters and digits — kastlan's: 16, printed `ABCD-EFGH-JKLM-NPQR`. */\nconst RECOVERY_CODE_LENGTH = 16;\n\n/** How many letters and digits a typed backup code has: the dashes and spaces it is\n *  printed in groups with don't count, so \"abcd-efgh ijkl mnop\" is 16 — the count\n *  kastlan's server normalises the code to before it compares. */\nfunction recoveryCharacters(value: string): number {\n  return value.replace(/[^\\p{L}\\p{N}]/gu, \"\").length;\n}\nconst INTRO_CLASS = \"text-sm text-[var(--text-secondary)]\";\n\n/* ── The form ────────────────────────────────────────────────────────────── */\n\n/**\n * Sign-in for every app (docs/auth-harmonization.md §5, §8): email and password, or a\n * passkey; then the second factor when it is on; then a new password when an admin\n * required one. keksdose's `LoginPage` and `ForcedPasswordChangeStep`\n * (features/auth/login-page.tsx, forced-password-change.tsx), as one component.\n *\n * **It never sends a request.** Each step hands its input to a callback and renders the\n * {@link SignInAnswer} it resolves with; a rejection is shown in the step it came from.\n * The challenge token lives in this component's state only, as in keksdose, so a reload\n * costs a fresh sign-in — no route, no storage.\n *\n * **One error for every wrong credential** (§2.10, §5.2): `invalid_credentials` shows one\n * sentence, whatever was wrong, plus two hints UNDER it — \"Account deactivated? Write to\n * …\" (`deactivatedContact`) and \"Signed up with you+kastlan@…? Use that address.\"\n * (`emailTag`). Any other failure says \"Sign-in failed\" and no hint: the hints answer a\n * refused credential, not a network that is down. `describeError` puts the app's words\n * on a failure the kit cannot know (a throttled attempt).\n *\n * **The steps.**\n *  - Credentials: the email field is `username webauthn` (passkey autofill, see\n *    `passkeyAutofill`), the password a `CurrentPasswordInput` (a password manager fills\n *    it and never offers a new one). The submit is not disabled while the fields are\n *    empty: a browser that autofills on load withholds the values until the first\n *    interaction, and a disabled button would swallow that first click. The fields'\n *    own `required` answers an empty submit instead. \"Forgot your password?\" sits under\n *    the buttons, where someone whose password just failed is already looking\n *    (keksdose #198).\n *  - Second factor: {@link OneTimeCodeInput}, focused on arrival. \"Verify\" waits for the\n *    whole code. A refused code stays here with its error; `token_invalid` (the\n *    challenge expired) goes back to the credentials and says why. Kurvenschmiede has\n *    no 2FA yet, and the step is here from the start, so adding it is backend work only\n *    (§10.5). With `recoveryCode` (0.30.0) a switch under the field takes a backup code\n *    instead, through the same `onCode` with `kind: \"recovery\"`.\n *\n * **A throttled request** (HTTP 429, {@link isRateLimited}) says \"Too many attempts. Try\n * again in 30 s.\" on any step (0.30.0) — the wait from its `Retry-After`, else \"Wait a\n * moment and try again.\" — after `describeError`, whose words still come first, and\n * instead of \"wrong password\" or \"invalid code\", which would send the person to try\n * another one.\n *  - New password: new + confirm with the strength meter, the 8-character / 72-byte\n *    rules and nothing else (§8). It reads as explained, not blocked (keksdose): the\n *    person did nothing wrong.\n *\n * The password is dropped from state once the credentials are answered; \"Back to sign in\"\n * returns to an empty password field.\n */\nexport function SignInForm({\n  onSubmit,\n  onCode,\n  onSetPassword,\n  onPasskey,\n  passkeyAutofill,\n  forgotHref,\n  registerHref,\n  defaultEmail = \"\",\n  emailTag,\n  deactivatedContact,\n  codeLength = 6,\n  recoveryCode,\n  credentialsContent,\n  twoFactorContent,\n  passwordChangeContent,\n  describeError,\n  onStepChange,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: SignInFormProps) {\n  const labels = useKitLabels(\"signIn\", DEFAULT_SIGN_IN_LABELS, labelsProp);\n  const [step, setStep] = useState<SignInStep>(\"credentials\");\n  const [email, setEmail] = useState(defaultEmail);\n  const [password, setPassword] = useState(\"\");\n  const [code, setCode] = useState(\"\");\n  // 0.30.0: the second factor as a backup code instead of the authenticator's digits.\n  const [useRecovery, setUseRecovery] = useState(false);\n  const [recovery, setRecovery] = useState(\"\");\n  const [newPassword, setNewPassword] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  const [challenge, setChallenge] = useState<{ token: string; extra?: Readonly<Record<string, unknown>> } | null>(\n    null,\n  );\n  // What is running: one call at a time. \"done\" after `signed-in` — the app has the\n  // session and is leaving; the buttons stay busy so nothing is sent twice meanwhile.\n  const [busy, setBusy] = useState<SignInAction | \"done\" | null>(null);\n  const [failure, setFailure] = useState<Failure | null>(null);\n  const headingId = useId();\n\n  const emailRef = useRef<HTMLInputElement>(null);\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const codeRef = useRef<HTMLInputElement>(null);\n  const recoveryRef = useRef<HTMLInputElement>(null);\n  const newPasswordRef = useRef<HTMLInputElement>(null);\n\n  // A late answer after unmount (the app navigated away) must not set state.\n  const mounted = useRef(true);\n  useEffect(() => {\n    mounted.current = true;\n    return () => {\n      mounted.current = false;\n    };\n  }, []);\n\n  const goTo = (next: SignInStep) => {\n    setStep(next);\n    onStepChange?.(next);\n  };\n\n  const present = (answer: SignInAnswer) => {\n    setFailure(null);\n    if (answer.kind === \"signed-in\") {\n      setBusy(\"done\");\n      return;\n    }\n    setBusy(null);\n    // The password has done its work; it does not stay in state for the next steps.\n    setPassword(\"\");\n    setCode(\"\");\n    setRecovery(\"\");\n    setUseRecovery(false);\n    setNewPassword(\"\");\n    setConfirm(\"\");\n    if (answer.kind === \"2fa\") {\n      setChallenge({ token: answer.challengeToken });\n      goTo(\"2fa\");\n    } else if (answer.kind === \"password-change\") {\n      setChallenge({ token: answer.challengeToken, extra: answer.extra });\n      goTo(\"password-change\");\n    }\n  };\n\n  const messageFor = (\n    error: unknown,\n    action: SignInAction,\n    code: KitErrorCode | undefined,\n    recoveryUsed: boolean,\n  ): ReactNode => {\n    const own = describeError?.(error, action);\n    if (hasMessage(own)) return own;\n    // After the app's words, before the kit's generic ones (0.30.0): a throttle is\n    // neither a wrong password nor a wrong code, and saying so sends the person to try\n    // another one — which the limiter counts too.\n    if (isRateLimited(error)) return (labels.rateLimited ?? DEFAULT_SIGN_IN_LABELS.rateLimited)(retryAfterSeconds(error));\n    if (action === \"password\") return code === \"invalid_credentials\" ? labels.invalidCredentials : labels.failed;\n    if (action === \"passkey\") return labels.passkeyFailed;\n    if (action === \"code\") {\n      if (code === \"token_invalid\") return labels.expired;\n      return recoveryUsed\n        ? (labels.recoveryCodeInvalid ?? DEFAULT_SIGN_IN_LABELS.recoveryCodeInvalid)\n        : labels.codeInvalid;\n    }\n    return code === \"token_invalid\" ? labels.expired : labels.setPasswordFailed;\n  };\n\n  const fail = (error: unknown, action: SignInAction, sentEmail?: string, recoveryUsed = false) => {\n    setBusy(null);\n    // Our own abort (a passkey ceremony cancelled by the unmount) is no failure.\n    if ((error as { name?: unknown } | null)?.name === \"AbortError\") return;\n    const code = authErrorCode(error);\n    const message = messageFor(error, action, code, recoveryUsed);\n    // The challenge expired between the steps: only a fresh sign-in helps.\n    if ((action === \"code\" || action === \"set-password\") && code === \"token_invalid\") {\n      setChallenge(null);\n      setCode(\"\");\n      setRecovery(\"\");\n      setUseRecovery(false);\n      setNewPassword(\"\");\n      setConfirm(\"\");\n      goTo(\"credentials\");\n    }\n    setFailure({ action, code, message, email: sentEmail });\n  };\n\n  const attempt = (\n    action: SignInAction,\n    call: () => Promise<SignInAnswer>,\n    sentEmail?: string,\n    recoveryUsed = false,\n  ) => {\n    if (busy) return;\n    setBusy(action);\n    setFailure(null);\n    let result: Promise<SignInAnswer>;\n    try {\n      result = Promise.resolve(call());\n    } catch (error) {\n      result = Promise.reject(error);\n    }\n    result.then(\n      (answer) => {\n        if (mounted.current) present(answer);\n      },\n      (error: unknown) => {\n        if (mounted.current) fail(error, action, sentEmail, recoveryUsed);\n      },\n    );\n  };\n\n  // Passkey autofill: armed once, on mount; the signal aborts on unmount. Its answer\n  // arrives whenever the person picks a passkey from the email field's dropdown — and\n  // is dropped if they have meanwhile started a sign-in of their own.\n  const armAutofill = useEffectEvent((signal: AbortSignal) => passkeyAutofill?.(signal));\n  const autofillAnswered = useEffectEvent((answer: SignInAnswer) => {\n    if (busy === null) present(answer);\n  });\n  useEffect(() => {\n    const controller = new AbortController();\n    let pending: Promise<SignInAnswer | null | undefined>;\n    try {\n      pending = Promise.resolve(armAutofill(controller.signal));\n    } catch (error) {\n      pending = Promise.reject(error);\n    }\n    pending.then(\n      (answer) => {\n        if (answer && !controller.signal.aborted && mounted.current) autofillAnswered(answer);\n      },\n      () => {\n        /* silent — unsupported, declined or aborted; the button stays the way in */\n      },\n    );\n    return () => controller.abort();\n  }, []);\n\n  // Focus follows the step — not on mount (where it would pop a phone's keyboard over\n  // the page), only once the person moved to another step.\n  const shownStep = useRef(step);\n  useEffect(() => {\n    if (shownStep.current === step) return;\n    shownStep.current = step;\n    if (step === \"2fa\") codeRef.current?.focus();\n    else if (step === \"password-change\") newPasswordRef.current?.focus();\n    else if (emailRef.current?.value) passwordRef.current?.focus();\n    else emailRef.current?.focus();\n  }, [step]);\n  // The backup-code switch swaps one field for the other under the focus that pressed\n  // it; the field that came in is where the person is going. Only after a switch on\n  // this step — arriving on it is the effect above.\n  const shownRecovery = useRef(useRecovery);\n  useEffect(() => {\n    if (shownRecovery.current === useRecovery) return;\n    shownRecovery.current = useRecovery;\n    if (step !== \"2fa\") return;\n    (useRecovery ? recoveryRef : codeRef).current?.focus();\n  }, [useRecovery, step]);\n\n  const backToCredentials = () => {\n    if (busy) return;\n    setChallenge(null);\n    setFailure(null);\n    setCode(\"\");\n    setRecovery(\"\");\n    setUseRecovery(false);\n    setNewPassword(\"\");\n    setConfirm(\"\");\n    goTo(\"credentials\");\n  };\n\n  const working = busy !== null;\n  const rootClass = cn(\"space-y-3\", className);\n\n  /* ── Step 2: the second factor ── */\n  if (step === \"2fa\" && challenge) {\n    const recoveryOn = recoveryCode !== undefined && recoveryCode !== false;\n    const recoveryLength = (typeof recoveryCode === \"object\" ? recoveryCode.length : undefined) ?? RECOVERY_CODE_LENGTH;\n    const asRecovery = recoveryOn && useRecovery;\n    const recoveryReady = recoveryCharacters(recovery) === recoveryLength;\n    const ready = asRecovery ? recoveryReady : code.length === codeLength;\n    const submitCode = (e: FormEvent) => {\n      e.preventDefault();\n      if (!ready) return;\n      if (asRecovery) {\n        attempt(\n          \"code\",\n          () => onCode({ challengeToken: challenge.token, code: recovery.trim(), kind: \"recovery\" }),\n          undefined,\n          true,\n        );\n        return;\n      }\n      attempt(\"code\", () => onCode({ challengeToken: challenge.token, code }));\n    };\n    const switchCode = () => {\n      if (working) return;\n      setFailure(null);\n      setCode(\"\");\n      setRecovery(\"\");\n      setUseRecovery((on) => !on);\n    };\n    const codeError = failure?.action === \"code\" ? failure.message : undefined;\n    const content =\n      typeof twoFactorContent === \"function\" ? twoFactorContent(challenge.token) : twoFactorContent;\n    return (\n      <div {...rest} data-step=\"2fa\" className={rootClass}>\n        <form className=\"space-y-3\" aria-labelledby={headingId} onSubmit={submitCode}>\n          <Heading id={headingId} className=\"text-base font-semibold text-[var(--text-primary)]\">\n            {labels.twoFactorTitle}\n          </Heading>\n          <p className={INTRO_CLASS}>\n            {asRecovery ? (labels.recoveryIntro ?? DEFAULT_SIGN_IN_LABELS.recoveryIntro) : labels.twoFactorIntro}\n          </p>\n          {content}\n          {asRecovery ? (\n            // A plain text field, not the digits-only one: a backup code is letters and\n            // digits in printed groups. Nothing a phone keyboard would \"correct\", and no\n            // autofill — the browser's suggestion for an unknown field is the username.\n            <Input\n              ref={recoveryRef}\n              label={labels.recoveryCode ?? DEFAULT_SIGN_IN_LABELS.recoveryCode}\n              name=\"recovery-code\"\n              value={recovery}\n              onChange={(e) => {\n                setRecovery(e.target.value);\n                if (failure) setFailure(null);\n              }}\n              autoComplete=\"off\"\n              autoCapitalize=\"characters\"\n              autoCorrect=\"off\"\n              spellCheck={false}\n              inputClassName=\"font-mono\"\n              hint={(labels.recoveryCodeHint ?? DEFAULT_SIGN_IN_LABELS.recoveryCodeHint)(recoveryLength)}\n              readOnly={working}\n              error={codeError}\n              required\n            />\n          ) : (\n            <OneTimeCodeInput\n              ref={codeRef}\n              label={labels.code}\n              name=\"code\"\n              value={code}\n              length={codeLength}\n              onChange={(next) => {\n                setCode(next);\n                if (failure) setFailure(null);\n              }}\n              readOnly={working}\n              error={codeError}\n              required\n            />\n          )}\n          {recoveryOn && (\n            <p className=\"text-sm\">\n              <Button type=\"button\" variant=\"link\" size=\"sm\" disabled={working} onClick={switchCode}>\n                {asRecovery\n                  ? (labels.useAuthenticatorCode ?? DEFAULT_SIGN_IN_LABELS.useAuthenticatorCode)\n                  : (labels.useRecoveryCode ?? DEFAULT_SIGN_IN_LABELS.useRecoveryCode)}\n              </Button>\n            </p>\n          )}\n          <Button type=\"submit\" className=\"w-full\" disabled={!working && !ready} pending={working}>\n            {labels.verify}\n          </Button>\n        </form>\n        <BackLink label={labels.backToSignIn} onClick={backToCredentials} disabled={working} />\n      </div>\n    );\n  }\n\n  /* ── Step 3: a new password ── */\n  if (step === \"password-change\" && challenge) {\n    const problem = newPasswordProblem(newPassword, confirm);\n    const submitPassword = (e: FormEvent) => {\n      e.preventDefault();\n      if (problem) return;\n      attempt(\"set-password\", () => onSetPassword({ challengeToken: challenge.token, password: newPassword }));\n    };\n    const content =\n      typeof passwordChangeContent === \"function\" ? passwordChangeContent(challenge.extra) : passwordChangeContent;\n    return (\n      <div {...rest} data-step=\"password-change\" className={rootClass}>\n        <form className=\"space-y-3\" aria-labelledby={headingId} onSubmit={submitPassword}>\n          <Heading id={headingId} className=\"text-base font-semibold text-[var(--text-primary)]\">\n            {labels.setPasswordTitle}\n          </Heading>\n          <p className={INTRO_CLASS}>{labels.setPasswordIntro}</p>\n          {content}\n          {/* Which account the new password is for, for the password manager: it files\n              the new password under this username instead of guessing. */}\n          {email !== \"\" && (\n            <input type=\"email\" name=\"username\" autoComplete=\"username\" value={email} readOnly hidden />\n          )}\n          <NewPasswordFields\n            password={newPassword}\n            confirm={confirm}\n            onPasswordChange={setNewPassword}\n            onConfirmChange={setConfirm}\n            busy={working}\n            passwordRef={newPasswordRef}\n            text={{ password: labels.newPassword, confirm: labels.confirmPassword, mismatch: labels.passwordMismatch }}\n          />\n          {failure?.action === \"set-password\" && (\n            <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n              {failure.message}\n            </AlertBanner>\n          )}\n          <Button type=\"submit\" className=\"w-full\" disabled={!working && problem !== null} pending={working}>\n            {labels.setPasswordSubmit}\n          </Button>\n        </form>\n        <BackLink label={labels.backToSignIn} onClick={backToCredentials} disabled={working} />\n      </div>\n    );\n  }\n\n  /* ── Step 1: the credentials ── */\n  const submitCredentials = (e: FormEvent) => {\n    e.preventDefault();\n    const sent = email.trim();\n    if (sent === \"\" || password === \"\") return;\n    attempt(\"password\", () => onSubmit({ email: sent, password }), sent);\n  };\n\n  const refused = failure?.code === \"invalid_credentials\";\n  const tagged =\n    refused && failure?.action === \"password\" && emailTag && failure.email ? taggedEmail(failure.email, emailTag) : null;\n  const showDeactivated = refused && hasMessage(deactivatedContact);\n\n  return (\n    <div {...rest} data-step=\"credentials\" className={rootClass}>\n      <form className=\"space-y-3\" onSubmit={submitCredentials}>\n        {credentialsContent}\n        <Input\n          ref={emailRef}\n          type=\"email\"\n          name=\"email\"\n          // \"webauthn\" lets the browser list passkeys in this field's dropdown, paired\n          // with the conditional request `passkeyAutofill` arms.\n          autoComplete=\"username webauthn\"\n          label={labels.email}\n          value={email}\n          onChange={(e) => setEmail(e.target.value)}\n          readOnly={working}\n          required\n        />\n        <CurrentPasswordInput\n          ref={passwordRef}\n          name=\"password\"\n          label={labels.password}\n          value={password}\n          onValueChange={setPassword}\n          busy={working}\n          required\n        />\n        {failure && (\n          // One live region for the sentence and its hints: they are one answer.\n          <div role=\"alert\" className=\"space-y-1.5\">\n            <AlertBanner tone=\"danger\" size=\"sm\">\n              {failure.message}\n            </AlertBanner>\n            {showDeactivated && (\n              <p className={HINT_CLASS}>{withContact(labels.deactivatedHint, deactivatedContact)}</p>\n            )}\n            {tagged && <p className={HINT_CLASS}>{labels.tagHint(tagged)}</p>}\n          </div>\n        )}\n        <Button type=\"submit\" className=\"w-full\" pending={busy === \"password\" || busy === \"done\"} disabled={busy === \"passkey\"}>\n          {labels.submit}\n        </Button>\n        {onPasskey && (\n          <Button\n            type=\"button\"\n            variant=\"secondary\"\n            className=\"w-full\"\n            pending={busy === \"passkey\"}\n            disabled={busy === \"password\" || busy === \"done\"}\n            onClick={() => attempt(\"passkey\", onPasskey)}\n          >\n            <KeyRound aria-hidden className=\"size-4\" />\n            {labels.passkey}\n          </Button>\n        )}\n      </form>\n      {forgotHref !== undefined && (\n        <p className=\"text-center text-sm\">\n          <TextLink href={forgotHref} tone=\"secondary\">\n            {labels.forgotPassword}\n          </TextLink>\n        </p>\n      )}\n      {registerHref !== undefined && (\n        <p className=\"text-center text-sm text-[var(--text-secondary)]\">\n          {labels.noAccount}{\" \"}\n          <TextLink href={registerHref} tone=\"primary\">\n            {labels.register}\n          </TextLink>\n        </p>\n      )}\n    </div>\n  );\n}\n\n/** \"Back to sign in\" under the second and third step: a button, since it changes the\n *  step in place rather than going anywhere. */\nfunction BackLink({ label, onClick, disabled }: { label: string; onClick: () => void; disabled: boolean }) {\n  return (\n    <p className=\"text-center text-sm\">\n      <Button type=\"button\" variant=\"link\" tone=\"muted\" size=\"sm\" disabled={disabled} onClick={onClick}>\n        {label}\n      </Button>\n    </p>\n  );\n}\n"],"mappings":";AAwUM,cAkUE,YAlUF;AAxUN,SAAS,WAAW,gBAAgB,OAAO,QAAQ,gBAAgB;AAEnE,SAAS,gBAAgB;AAEzB,SAAS,oBAAoB;AAC7B,SAAS,UAAU;AACnB,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,gBAAgB;AACzB,SAAS,QAAQ,aAAa;AAC9B,SAAS,eAAe,oBAAoB,eAAe,yBAAyB;AAEpF,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAgK3B,MAAM,yBAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,SAAS,CAAC,kBAAkB,kBAAkB,aAAa;AAAA,EAC3D,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,kBAAkB,CAAC,WAAW,GAAG,MAAM;AAAA,EACvC,qBAAqB;AAAA,EACrB,aAAa;AACf;AAmHA,SAAS,YAAY,UAAkB,SAAiC;AACtE,QAAM,OACJ,OAAO,YAAY,YAAY,QAAQ,SAAS,GAAG,IACjD,oBAAC,YAAuB,MAAM,UAAU,OAAO,IAAI,MAAK,aACrD,qBADW,SAEd,IAEA,oBAAC,UAAoB,qBAAX,SAAmB;AAEjC,MAAI,CAAC,SAAS,SAAS,WAAW,EAAG,QAAO,CAAC,UAAU,KAAK,IAAI;AAChE,SAAO,SACJ,MAAM,eAAe,EACrB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAAU,SAAS,cAAc,OAAO,IAAK;AACvD;AAEA,MAAM,aAAa;AAGnB,MAAM,uBAAuB;AAK7B,SAAS,mBAAmB,OAAuB;AACjD,SAAO,MAAM,QAAQ,mBAAmB,EAAE,EAAE;AAC9C;AACA,MAAM,cAAc;AAkDb,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAAoB;AAClB,QAAM,SAAS,aAAa,UAAU,wBAAwB,UAAU;AACxE,QAAM,CAAC,MAAM,OAAO,IAAI,SAAqB,aAAa;AAC1D,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,YAAY;AAC/C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,EAAE;AAEnC,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,EAAE;AACjD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,WAAW,YAAY,IAAI;AAAA,IAChC;AAAA,EACF;AAGA,QAAM,CAAC,MAAM,OAAO,IAAI,SAAuC,IAAI;AACnE,QAAM,CAAC,SAAS,UAAU,IAAI,SAAyB,IAAI;AAC3D,QAAM,YAAY,MAAM;AAExB,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAyB,IAAI;AAC7C,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,iBAAiB,OAAyB,IAAI;AAGpD,QAAM,UAAU,OAAO,IAAI;AAC3B,YAAU,MAAM;AACd,YAAQ,UAAU;AAClB,WAAO,MAAM;AACX,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,OAAO,CAAC,SAAqB;AACjC,YAAQ,IAAI;AACZ,mBAAe,IAAI;AAAA,EACrB;AAEA,QAAM,UAAU,CAAC,WAAyB;AACxC,eAAW,IAAI;AACf,QAAI,OAAO,SAAS,aAAa;AAC/B,cAAQ,MAAM;AACd;AAAA,IACF;AACA,YAAQ,IAAI;AAEZ,gBAAY,EAAE;AACd,YAAQ,EAAE;AACV,gBAAY,EAAE;AACd,mBAAe,KAAK;AACpB,mBAAe,EAAE;AACjB,eAAW,EAAE;AACb,QAAI,OAAO,SAAS,OAAO;AACzB,mBAAa,EAAE,OAAO,OAAO,eAAe,CAAC;AAC7C,WAAK,KAAK;AAAA,IACZ,WAAW,OAAO,SAAS,mBAAmB;AAC5C,mBAAa,EAAE,OAAO,OAAO,gBAAgB,OAAO,OAAO,MAAM,CAAC;AAClE,WAAK,iBAAiB;AAAA,IACxB;AAAA,EACF;AAEA,QAAM,aAAa,CACjB,OACA,QACAA,OACA,iBACc;AACd,UAAM,MAAM,gBAAgB,OAAO,MAAM;AACzC,QAAI,WAAW,GAAG,EAAG,QAAO;AAI5B,QAAI,cAAc,KAAK,EAAG,SAAQ,OAAO,eAAe,uBAAuB,aAAa,kBAAkB,KAAK,CAAC;AACpH,QAAI,WAAW,WAAY,QAAOA,UAAS,wBAAwB,OAAO,qBAAqB,OAAO;AACtG,QAAI,WAAW,UAAW,QAAO,OAAO;AACxC,QAAI,WAAW,QAAQ;AACrB,UAAIA,UAAS,gBAAiB,QAAO,OAAO;AAC5C,aAAO,eACF,OAAO,uBAAuB,uBAAuB,sBACtD,OAAO;AAAA,IACb;AACA,WAAOA,UAAS,kBAAkB,OAAO,UAAU,OAAO;AAAA,EAC5D;AAEA,QAAM,OAAO,CAAC,OAAgB,QAAsB,WAAoB,eAAe,UAAU;AAC/F,YAAQ,IAAI;AAEZ,QAAK,OAAqC,SAAS,aAAc;AACjE,UAAMA,QAAO,cAAc,KAAK;AAChC,UAAM,UAAU,WAAW,OAAO,QAAQA,OAAM,YAAY;AAE5D,SAAK,WAAW,UAAU,WAAW,mBAAmBA,UAAS,iBAAiB;AAChF,mBAAa,IAAI;AACjB,cAAQ,EAAE;AACV,kBAAY,EAAE;AACd,qBAAe,KAAK;AACpB,qBAAe,EAAE;AACjB,iBAAW,EAAE;AACb,WAAK,aAAa;AAAA,IACpB;AACA,eAAW,EAAE,QAAQ,MAAAA,OAAM,SAAS,OAAO,UAAU,CAAC;AAAA,EACxD;AAEA,QAAM,UAAU,CACd,QACA,MACA,WACA,eAAe,UACZ;AACH,QAAI,KAAM;AACV,YAAQ,MAAM;AACd,eAAW,IAAI;AACf,QAAI;AACJ,QAAI;AACF,eAAS,QAAQ,QAAQ,KAAK,CAAC;AAAA,IACjC,SAAS,OAAO;AACd,eAAS,QAAQ,OAAO,KAAK;AAAA,IAC/B;AACA,WAAO;AAAA,MACL,CAAC,WAAW;AACV,YAAI,QAAQ,QAAS,SAAQ,MAAM;AAAA,MACrC;AAAA,MACA,CAAC,UAAmB;AAClB,YAAI,QAAQ,QAAS,MAAK,OAAO,QAAQ,WAAW,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AAKA,QAAM,cAAc,eAAe,CAAC,WAAwB,kBAAkB,MAAM,CAAC;AACrF,QAAM,mBAAmB,eAAe,CAAC,WAAyB;AAChE,QAAI,SAAS,KAAM,SAAQ,MAAM;AAAA,EACnC,CAAC;AACD,YAAU,MAAM;AACd,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI;AACJ,QAAI;AACF,gBAAU,QAAQ,QAAQ,YAAY,WAAW,MAAM,CAAC;AAAA,IAC1D,SAAS,OAAO;AACd,gBAAU,QAAQ,OAAO,KAAK;AAAA,IAChC;AACA,YAAQ;AAAA,MACN,CAAC,WAAW;AACV,YAAI,UAAU,CAAC,WAAW,OAAO,WAAW,QAAQ,QAAS,kBAAiB,MAAM;AAAA,MACtF;AAAA,MACA,MAAM;AAAA,MAEN;AAAA,IACF;AACA,WAAO,MAAM,WAAW,MAAM;AAAA,EAChC,GAAG,CAAC,CAAC;AAIL,QAAM,YAAY,OAAO,IAAI;AAC7B,YAAU,MAAM;AACd,QAAI,UAAU,YAAY,KAAM;AAChC,cAAU,UAAU;AACpB,QAAI,SAAS,MAAO,SAAQ,SAAS,MAAM;AAAA,aAClC,SAAS,kBAAmB,gBAAe,SAAS,MAAM;AAAA,aAC1D,SAAS,SAAS,MAAO,aAAY,SAAS,MAAM;AAAA,QACxD,UAAS,SAAS,MAAM;AAAA,EAC/B,GAAG,CAAC,IAAI,CAAC;AAIT,QAAM,gBAAgB,OAAO,WAAW;AACxC,YAAU,MAAM;AACd,QAAI,cAAc,YAAY,YAAa;AAC3C,kBAAc,UAAU;AACxB,QAAI,SAAS,MAAO;AACpB,KAAC,cAAc,cAAc,SAAS,SAAS,MAAM;AAAA,EACvD,GAAG,CAAC,aAAa,IAAI,CAAC;AAEtB,QAAM,oBAAoB,MAAM;AAC9B,QAAI,KAAM;AACV,iBAAa,IAAI;AACjB,eAAW,IAAI;AACf,YAAQ,EAAE;AACV,gBAAY,EAAE;AACd,mBAAe,KAAK;AACpB,mBAAe,EAAE;AACjB,eAAW,EAAE;AACb,SAAK,aAAa;AAAA,EACpB;AAEA,QAAM,UAAU,SAAS;AACzB,QAAM,YAAY,GAAG,aAAa,SAAS;AAG3C,MAAI,SAAS,SAAS,WAAW;AAC/B,UAAM,aAAa,iBAAiB,UAAa,iBAAiB;AAClE,UAAM,kBAAkB,OAAO,iBAAiB,WAAW,aAAa,SAAS,WAAc;AAC/F,UAAM,aAAa,cAAc;AACjC,UAAM,gBAAgB,mBAAmB,QAAQ,MAAM;AACvD,UAAM,QAAQ,aAAa,gBAAgB,KAAK,WAAW;AAC3D,UAAM,aAAa,CAAC,MAAiB;AACnC,QAAE,eAAe;AACjB,UAAI,CAAC,MAAO;AACZ,UAAI,YAAY;AACd;AAAA,UACE;AAAA,UACA,MAAM,OAAO,EAAE,gBAAgB,UAAU,OAAO,MAAM,SAAS,KAAK,GAAG,MAAM,WAAW,CAAC;AAAA,UACzF;AAAA,UACA;AAAA,QACF;AACA;AAAA,MACF;AACA,cAAQ,QAAQ,MAAM,OAAO,EAAE,gBAAgB,UAAU,OAAO,KAAK,CAAC,CAAC;AAAA,IACzE;AACA,UAAM,aAAa,MAAM;AACvB,UAAI,QAAS;AACb,iBAAW,IAAI;AACf,cAAQ,EAAE;AACV,kBAAY,EAAE;AACd,qBAAe,CAAC,OAAO,CAAC,EAAE;AAAA,IAC5B;AACA,UAAM,YAAY,SAAS,WAAW,SAAS,QAAQ,UAAU;AACjE,UAAM,UACJ,OAAO,qBAAqB,aAAa,iBAAiB,UAAU,KAAK,IAAI;AAC/E,WACE,qBAAC,SAAK,GAAG,MAAM,aAAU,OAAM,WAAW,WACxC;AAAA,2BAAC,UAAK,WAAU,aAAY,mBAAiB,WAAW,UAAU,YAChE;AAAA,4BAAC,WAAQ,IAAI,WAAW,WAAU,sDAC/B,iBAAO,gBACV;AAAA,QACA,oBAAC,OAAE,WAAW,aACX,uBAAc,OAAO,iBAAiB,uBAAuB,gBAAiB,OAAO,gBACxF;AAAA,QACC;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,UAIC;AAAA,YAAC;AAAA;AAAA,cACC,KAAK;AAAA,cACL,OAAO,OAAO,gBAAgB,uBAAuB;AAAA,cACrD,MAAK;AAAA,cACL,OAAO;AAAA,cACP,UAAU,CAAC,MAAM;AACf,4BAAY,EAAE,OAAO,KAAK;AAC1B,oBAAI,QAAS,YAAW,IAAI;AAAA,cAC9B;AAAA,cACA,cAAa;AAAA,cACb,gBAAe;AAAA,cACf,aAAY;AAAA,cACZ,YAAY;AAAA,cACZ,gBAAe;AAAA,cACf,OAAO,OAAO,oBAAoB,uBAAuB,kBAAkB,cAAc;AAAA,cACzF,UAAU;AAAA,cACV,OAAO;AAAA,cACP,UAAQ;AAAA;AAAA,UACV;AAAA,YAEA;AAAA,UAAC;AAAA;AAAA,YACC,KAAK;AAAA,YACL,OAAO,OAAO;AAAA,YACd,MAAK;AAAA,YACL,OAAO;AAAA,YACP,QAAQ;AAAA,YACR,UAAU,CAAC,SAAS;AAClB,sBAAQ,IAAI;AACZ,kBAAI,QAAS,YAAW,IAAI;AAAA,YAC9B;AAAA,YACA,UAAU;AAAA,YACV,OAAO;AAAA,YACP,UAAQ;AAAA;AAAA,QACV;AAAA,QAED,cACC,oBAAC,OAAE,WAAU,WACX,8BAAC,UAAO,MAAK,UAAS,SAAQ,QAAO,MAAK,MAAK,UAAU,SAAS,SAAS,YACxE,uBACI,OAAO,wBAAwB,uBAAuB,uBACtD,OAAO,mBAAmB,uBAAuB,iBACxD,GACF;AAAA,QAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,CAAC,OAAO,SAAS,SAC7E,iBAAO,QACV;AAAA,SACF;AAAA,MACA,oBAAC,YAAS,OAAO,OAAO,cAAc,SAAS,mBAAmB,UAAU,SAAS;AAAA,OACvF;AAAA,EAEJ;AAGA,MAAI,SAAS,qBAAqB,WAAW;AAC3C,UAAM,UAAU,mBAAmB,aAAa,OAAO;AACvD,UAAM,iBAAiB,CAAC,MAAiB;AACvC,QAAE,eAAe;AACjB,UAAI,QAAS;AACb,cAAQ,gBAAgB,MAAM,cAAc,EAAE,gBAAgB,UAAU,OAAO,UAAU,YAAY,CAAC,CAAC;AAAA,IACzG;AACA,UAAM,UACJ,OAAO,0BAA0B,aAAa,sBAAsB,UAAU,KAAK,IAAI;AACzF,WACE,qBAAC,SAAK,GAAG,MAAM,aAAU,mBAAkB,WAAW,WACpD;AAAA,2BAAC,UAAK,WAAU,aAAY,mBAAiB,WAAW,UAAU,gBAChE;AAAA,4BAAC,WAAQ,IAAI,WAAW,WAAU,sDAC/B,iBAAO,kBACV;AAAA,QACA,oBAAC,OAAE,WAAW,aAAc,iBAAO,kBAAiB;AAAA,QACnD;AAAA,QAGA,UAAU,MACT,oBAAC,WAAM,MAAK,SAAQ,MAAK,YAAW,cAAa,YAAW,OAAO,OAAO,UAAQ,MAAC,QAAM,MAAC;AAAA,QAE5F;AAAA,UAAC;AAAA;AAAA,YACC,UAAU;AAAA,YACV;AAAA,YACA,kBAAkB;AAAA,YAClB,iBAAiB;AAAA,YACjB,MAAM;AAAA,YACN,aAAa;AAAA,YACb,MAAM,EAAE,UAAU,OAAO,aAAa,SAAS,OAAO,iBAAiB,UAAU,OAAO,iBAAiB;AAAA;AAAA,QAC3G;AAAA,QACC,SAAS,WAAW,kBACnB,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,kBAAQ,SACX;AAAA,QAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,YAAY,MAAM,SAAS,SACvF,iBAAO,mBACV;AAAA,SACF;AAAA,MACA,oBAAC,YAAS,OAAO,OAAO,cAAc,SAAS,mBAAmB,UAAU,SAAS;AAAA,OACvF;AAAA,EAEJ;AAGA,QAAM,oBAAoB,CAAC,MAAiB;AAC1C,MAAE,eAAe;AACjB,UAAM,OAAO,MAAM,KAAK;AACxB,QAAI,SAAS,MAAM,aAAa,GAAI;AACpC,YAAQ,YAAY,MAAM,SAAS,EAAE,OAAO,MAAM,SAAS,CAAC,GAAG,IAAI;AAAA,EACrE;AAEA,QAAM,UAAU,SAAS,SAAS;AAClC,QAAM,SACJ,WAAW,SAAS,WAAW,cAAc,YAAY,QAAQ,QAAQ,YAAY,QAAQ,OAAO,QAAQ,IAAI;AAClH,QAAM,kBAAkB,WAAW,WAAW,kBAAkB;AAEhE,SACE,qBAAC,SAAK,GAAG,MAAM,aAAU,eAAc,WAAW,WAChD;AAAA,yBAAC,UAAK,WAAU,aAAY,UAAU,mBACnC;AAAA;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,KAAK;AAAA,UACL,MAAK;AAAA,UACL,MAAK;AAAA,UAGL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,UACxC,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,KAAK;AAAA,UACL,MAAK;AAAA,UACL,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,eAAe;AAAA,UACf,MAAM;AAAA,UACN,UAAQ;AAAA;AAAA,MACV;AAAA,MACC;AAAA,MAEC,qBAAC,SAAI,MAAK,SAAQ,WAAU,eAC1B;AAAA,4BAAC,eAAY,MAAK,UAAS,MAAK,MAC7B,kBAAQ,SACX;AAAA,QACC,mBACC,oBAAC,OAAE,WAAW,YAAa,sBAAY,OAAO,iBAAiB,kBAAkB,GAAE;AAAA,QAEpF,UAAU,oBAAC,OAAE,WAAW,YAAa,iBAAO,QAAQ,MAAM,GAAE;AAAA,SAC/D;AAAA,MAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,SAAS,SAAS,cAAc,SAAS,QAAQ,UAAU,SAAS,WAC1G,iBAAO,QACV;AAAA,MACC,aACC;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,WAAU;AAAA,UACV,SAAS,SAAS;AAAA,UAClB,UAAU,SAAS,cAAc,SAAS;AAAA,UAC1C,SAAS,MAAM,QAAQ,WAAW,SAAS;AAAA,UAE3C;AAAA,gCAAC,YAAS,eAAW,MAAC,WAAU,UAAS;AAAA,YACxC,OAAO;AAAA;AAAA;AAAA,MACV;AAAA,OAEJ;AAAA,IACC,eAAe,UACd,oBAAC,OAAE,WAAU,uBACX,8BAAC,YAAS,MAAM,YAAY,MAAK,aAC9B,iBAAO,gBACV,GACF;AAAA,IAED,iBAAiB,UAChB,qBAAC,OAAE,WAAU,oDACV;AAAA,aAAO;AAAA,MAAW;AAAA,MACnB,oBAAC,YAAS,MAAM,cAAc,MAAK,WAChC,iBAAO,UACV;AAAA,OACF;AAAA,KAEJ;AAEJ;AAIA,SAAS,SAAS,EAAE,OAAO,SAAS,SAAS,GAA8D;AACzG,SACE,oBAAC,OAAE,WAAU,uBACX,8BAAC,UAAO,MAAK,UAAS,SAAQ,QAAO,MAAK,SAAQ,MAAK,MAAK,UAAoB,SAC7E,iBACH,GACF;AAEJ;","names":["code"]}
+{"version":3,"sources":["../../src/auth/sign-in-form.tsx"],"sourcesContent":["import { useEffect, useEffectEvent, useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, FormEvent, ReactNode } from \"react\";\nimport { KeyRound } from \"lucide-react\";\n\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { cn } from \"../lib/cn\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { hasMessage } from \"../components/choice-parts\";\nimport { CurrentPasswordInput } from \"../components/danger-confirm\";\nimport { OneTimeCodeInput } from \"../components/one-time-code-input\";\nimport { TextLink } from \"../components/text-link\";\nimport { Button, Input } from \"../components/ui\";\nimport { accessAction } from \"../landing/access\";\nimport type { AccessChoice } from \"../landing/access\";\nimport { useLandingLabels } from \"../landing/landing-labels\";\nimport { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport type { KitErrorCode } from \"./auth-errors\";\nimport { taggedEmail } from \"./email-tag\";\nimport { newPasswordProblem } from \"./form-rules\";\nimport { NewPasswordFields } from \"./new-password-fields\";\n\n/* ── The answers (§5.1) ──────────────────────────────────────────────────── */\n\n/**\n * What a sign-in call answers, in the kit's words — docs/auth-harmonization.md §5.1,\n * keksdose's three shapes. The app maps its own HTTP answer to one of these and resolves\n * with it; a refusal REJECTS (with whatever its client throws — {@link authErrorCode}\n * reads the code out of it).\n *\n * | the server answers (keksdose) | resolve with |\n * |---|---|\n * | `TokenResponse` `{access_token, refresh_token, token_type, user}` | `{ kind: \"signed-in\" }`, after the app has stored the session |\n * | `{requires_2fa: true, challenge_token}` | `{ kind: \"2fa\", challengeToken: challenge_token }` |\n * | `{requires_password_change: true, challenge_token, encrypted}` | `{ kind: \"password-change\", challengeToken: challenge_token, extra: { encrypted } }` |\n * | `401 {code: \"invalid_credentials\"}` | reject — let the client's error through |\n *\n * ```ts\n * async function toAnswer(res: TokenResponse | TwoFactorChallenge | PasswordChangeChallenge): Promise<SignInAnswer> {\n *   if (\"requires_2fa\" in res) return { kind: \"2fa\", challengeToken: res.challenge_token };\n *   if (\"requires_password_change\" in res)\n *     return { kind: \"password-change\", challengeToken: res.challenge_token, extra: { encrypted: res.encrypted } };\n *   await onLoginSuccess(res); // store tokens, load /auth/me, switch language\n *   return { kind: \"signed-in\" };\n * }\n * <SignInForm onSubmit={async (v) => toAnswer(await authApi.login(v))} … />\n * ```\n *\n * The same mapping serves `/auth/login/2fa`, `/auth/login/set-password` and the passkey\n * finish, which answer the same union.\n */\nexport type SignInAnswer =\n  | { kind: \"signed-in\" }\n  | { kind: \"2fa\"; challengeToken: string }\n  | {\n      kind: \"password-change\";\n      challengeToken: string;\n      /** The challenge's app fields, passed through untouched — keksdose's `encrypted`,\n       *  which its note on this step reads (`passwordChangeContent`). */\n      extra?: Readonly<Record<string, unknown>>;\n    };\n\n/** The step on screen: the credentials, the second factor, or a new password. */\nexport type SignInStep = \"credentials\" | \"2fa\" | \"password-change\";\n\n/** What the person did when a call failed — {@link SignInFormProps.describeError}'s\n *  second argument. */\nexport type SignInAction = \"password\" | \"passkey\" | \"code\" | \"set-password\";\n\nexport interface SignInCredentials {\n  /** Trimmed. Lower-casing is the server's (§3.1). */\n  email: string;\n  /** As typed, never trimmed. */\n  password: string;\n}\n\nexport interface SignInCodeValues {\n  challengeToken: string;\n  /** Digits only — {@link OneTimeCodeInput} drops the spaces of \"123 456\". A backup code\n   *  (`kind: \"recovery\"`) is trimmed and otherwise as typed: its dashes and case are the\n   *  server's to normalise, as kastlan's `_normalise_backup_code` does. */\n  code: string;\n  /**\n   * 0.30.0: `\"recovery\"` when the person typed one of their backup codes instead\n   * (`recoveryCode`); absent for the authenticator's code, as before. kastlan's\n   * `/auth/login/2fa` takes either in the same `code` and tells them apart itself; an\n   * app whose server takes a backup code elsewhere routes on this.\n   */\n  kind?: \"recovery\";\n}\n\nexport interface SignInNewPasswordValues {\n  challengeToken: string;\n  password: string;\n}\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/**\n * Every string `SignInForm` renders — the `signIn` namespace of `<UiKitProvider\n * labels>`, overridable per instance through `labels`. keksdose's words where it has\n * them (`auth.*` in its catalogue).\n */\nexport interface SignInLabels {\n  email: string;\n  password: string;\n  /** The submit button. */\n  submit: string;\n  /** The passkey button (`onPasskey`). */\n  passkey: string;\n  /** The link to `forgotHref`. */\n  forgotPassword: string;\n  /** Before the link to `registerHref`. */\n  noAccount: string;\n  /** The link to `registerHref`. */\n  register: string;\n  /** The ONE answer to an unknown address, a wrong password and a deactivated account\n   *  (`invalid_credentials`, §5.2). */\n  invalidCredentials: string;\n  /** Any other failed sign-in (the network, a 500). */\n  failed: string;\n  /** A failed or refused passkey sign-in. */\n  passkeyFailed: string;\n  /**\n   * The hint under `invalidCredentials` (§2.10), shown when `deactivatedContact` is\n   * given. A TEMPLATE: `{contact}` is replaced by the contact — a `mailto:` link for an\n   * address — so a language puts it where its grammar needs it.\n   */\n  deactivatedHint: string;\n  /** The hint under `invalidCredentials` when `emailTag` is given (§4.5), given the\n   *  typed address with the app's tag: \"Signed up with ada+kastlan@example.com?\". */\n  tagHint: (taggedAddress: string) => string;\n  /** The second-factor step's heading. */\n  twoFactorTitle: string;\n  twoFactorIntro: string;\n  /** The code field's label. */\n  code: string;\n  /** The code step's submit button. */\n  verify: string;\n  /** The code was refused. */\n  codeInvalid: string;\n  /** The set-a-new-password step's heading. */\n  setPasswordTitle: string;\n  setPasswordIntro: string;\n  newPassword: string;\n  confirmPassword: string;\n  passwordMismatch: string;\n  /** The set-a-new-password step's submit button. */\n  setPasswordSubmit: string;\n  setPasswordFailed: string;\n  /** A challenge was refused as `token_invalid` — it expired between the steps; the\n   *  form is back on the credentials. */\n  expired: string;\n  /** From the second and third step back to the credentials. */\n  backToSignIn: string;\n  /*\n   * 0.30.0 — OPTIONAL, like `TwoFactorSettingLabels.qrAlt` and for its reason: a new\n   * required key is a compile error at every call site that annotates this interface\n   * (CONTRIBUTING's additive-API rule). Each falls back to the provider's `signIn`, then\n   * English.\n   */\n  /** The second-factor step's switch to a backup code (`recoveryCode`). */\n  useRecoveryCode?: string;\n  /** The switch back, from the backup-code field to the authenticator's code. */\n  useAuthenticatorCode?: string;\n  /** The backup-code field's label. */\n  recoveryCode?: string;\n  /** The step's intro while a backup code is asked for, in place of `twoFactorIntro`. */\n  recoveryIntro?: string;\n  /** Under the backup-code field, given how many letters and digits a code has. */\n  recoveryCodeHint?: (length: number) => string;\n  /** A refused backup code — wrong, or spent already (each one works once). */\n  recoveryCodeInvalid?: string;\n  /** Any step's request was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  wait its `Retry-After` asks for, in seconds ({@link retryAfterSeconds}), or\n   *  `undefined` (or `0`) without one. */\n  rateLimited?: (seconds?: number) => string;\n  /** 0.31.0: the link after `noAccount` for an invitation-only app (`access` of kind\n   *  `request`) — a mail to support, in place of `register`. */\n  requestAccess?: string;\n}\n\n/** `Required`: every key, the 0.30 ones included, has its English here. */\nexport const DEFAULT_SIGN_IN_LABELS: Required<SignInLabels> = {\n  email: \"Email\",\n  password: \"Password\",\n  submit: \"Sign in\",\n  passkey: \"Sign in with a passkey\",\n  forgotPassword: \"Forgot your password?\",\n  noAccount: \"No account yet?\",\n  register: \"Create account\",\n  invalidCredentials: \"The email or password is incorrect.\",\n  failed: \"Sign-in failed. Please try again.\",\n  passkeyFailed: \"Passkey sign-in failed.\",\n  deactivatedHint: \"Account deactivated? Write to {contact}.\",\n  tagHint: (taggedAddress) => `Signed up with ${taggedAddress}? Use that address.`,\n  twoFactorTitle: \"Two-factor authentication\",\n  twoFactorIntro: \"Enter the code your authenticator app shows.\",\n  code: \"2FA code\",\n  verify: \"Verify\",\n  codeInvalid: \"Invalid 2FA code.\",\n  setPasswordTitle: \"Choose a new password\",\n  setPasswordIntro: \"A new password was requested for this account. Choose one and you are straight back in.\",\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  passwordMismatch: \"The passwords don't match.\",\n  setPasswordSubmit: \"Set password and sign in\",\n  setPasswordFailed: \"The password could not be set.\",\n  expired: \"This sign-in has expired. Please sign in again.\",\n  backToSignIn: \"Back to sign in\",\n  useRecoveryCode: \"Use a backup code\",\n  useAuthenticatorCode: \"Use your authenticator app\",\n  recoveryCode: \"Backup code\",\n  recoveryIntro: \"Enter one of the backup codes you saved when you turned on two-factor authentication.\",\n  recoveryCodeHint: (length) => `${length} letters and digits. Dashes and spaces don’t matter.`,\n  recoveryCodeInvalid: \"This backup code is not valid, or it has been used already.\",\n  rateLimited: englishRateLimited,\n  requestAccess: \"Request access\",\n};\n\n/* ── Props ───────────────────────────────────────────────────────────────── */\n\nexport interface SignInFormProps extends Omit<ComponentPropsWithoutRef<\"div\">, \"onSubmit\" | \"children\"> {\n  /**\n   * The credentials step was submitted. Send them, and resolve with the answer\n   * ({@link SignInAnswer}) or reject with the client's error. The form never sends a\n   * request itself (§8): keksdose must see the password on its way, to refuse the same\n   * string as an encryption passphrase later.\n   *\n   * On `signed-in` the form's job is over — it stays busy while the app navigates.\n   */\n  onSubmit: (credentials: SignInCredentials) => Promise<SignInAnswer>;\n  /** The second factor was submitted (`/auth/login/2fa`). Resolves with the next answer\n   *  — keksdose may still require a new password after the code. */\n  onCode: (values: SignInCodeValues) => Promise<SignInAnswer>;\n  /** The new password was submitted (`/auth/login/set-password`). Resolves with the\n   *  answer, `signed-in` in practice; keksdose's `key_wrap_unchanged` note is the app's\n   *  to show from here. */\n  onSetPassword: (values: SignInNewPasswordValues) => Promise<SignInAnswer>;\n  /**\n   * The passkey button was pressed: run the ceremony (`/auth/passkey/login/begin|finish`)\n   * and resolve with its answer. It asks for NO email — a passkey is bound to the site,\n   * and the browser offers every one it holds (keksdose #126). Left out, no button: pass\n   * it only where `PublicKeyCredential` exists.\n   */\n  onPasskey?: () => Promise<SignInAnswer>;\n  /**\n   * Passkey autofill (conditional mediation). The email field is\n   * `autoComplete=\"username webauthn\"`, so a pending `navigator.credentials.get({\n   * mediation: \"conditional\" })` lists the site's passkeys in its dropdown. The form\n   * calls this ONCE on mount; arm the request there and resolve with its answer when the\n   * person picks a passkey, or with `null` when nothing happens. The signal aborts on\n   * unmount — cancel the pending request then (keksdose: `armPasskeyAutofill(onDone,\n   * signal)` + `cancelPasskeyAutofill()`). A rejection is silent: the button stays the\n   * reliable path.\n   */\n  passkeyAutofill?: (signal: AbortSignal) => Promise<SignInAnswer | null | undefined>;\n  /** \"Forgot your password?\" goes here — the app's `/forgot-password`. Left out, no\n   *  link. */\n  forgotHref?: string;\n  /** \"No account yet? Create account\" goes here — `/register`. Left out, no line. */\n  registerHref?: string;\n  /**\n   * 0.31.0 (docs/landing-demo-harmonization.md §4.2): how a visitor gets an account —\n   * the same value the landing's `PublicHeader` and `Hero` take. `{kind: \"request\",\n   * email}` turns the line into \"No account yet? Request access\", a mail to support with\n   * the subject and body of `accessAction` (every app is invitation-only); `{kind:\n   * \"register\", href}` keeps \"Create account\", to `href`. Wins over `registerHref`; left\n   * out, `registerHref` works as before.\n   */\n  access?: AccessChoice;\n  /** The email field's start value — the reset page ends on \"Sign in\" with the address\n   *  filled in (§6.3). */\n  defaultEmail?: string;\n  /**\n   * The app's address tag (`\"kastlan\"`, §4.5). After `invalid_credentials` the form also\n   * says \"Signed up with you+kastlan@example.com? Use that address.\" — sign-in stays\n   * exact, and the server looks nothing up.\n   */\n  emailTag?: string;\n  /**\n   * Who a deactivated user writes to (§2.10): an address (drawn as a `mailto:` link) or\n   * the app's own node. Shown after `invalid_credentials` as \"Account deactivated? Write\n   * to …\". Left out, no hint.\n   */\n  deactivatedContact?: ReactNode;\n  /** Digits of the second factor. Default 6 (TOTP). */\n  codeLength?: number;\n  /**\n   * 0.30.0: offer a backup code on the second-factor step (kastlan's 0.29 adoption: its\n   * `/auth/login/2fa` takes one of the eight codes minted at 2FA setup, and the kit's\n   * step had no way to type one). A \"Use a backup code\" switch under the code field\n   * swaps the digits-only {@link OneTimeCodeInput} for a plain text field; the code goes\n   * to `onCode` with the same challenge and `kind: \"recovery\"`.\n   *\n   * `true` for a 16-character code (kastlan's `ABCD-EFGH-JKLM-NPQR`), or `{ length }`.\n   * The length counts letters and digits only — the dashes and spaces a printed code is\n   * grouped with don't count — and \"Verify\" waits for it. Left out, no switch.\n   */\n  recoveryCode?: boolean | { length?: number };\n  /** App content at the top of the credentials step — a notice, a demo button. */\n  credentialsContent?: ReactNode;\n  /**\n   * App content on the second-factor step, under its intro. 0.30.0: pass a function and\n   * it gets the challenge token — kastlan kept its own copy of the token for a \"lost\n   * your device?\" link, which the step now hands over.\n   */\n  twoFactorContent?: ReactNode | ((challengeToken: string) => ReactNode);\n  /**\n   * App content on the set-a-new-password step, under its intro — keksdose's\n   * private-mode note (\"Your encrypted data is untouched …\"), which depends on the\n   * challenge: pass a function and it gets the challenge's `extra`.\n   */\n  passwordChangeContent?: ReactNode | ((extra: Readonly<Record<string, unknown>> | undefined) => ReactNode);\n  /**\n   * The app's own words for a failure, or `undefined` for the kit's: the device being\n   * offline, a throttle with its wait (\"try again in an hour\"). Asked first, for every\n   * failure; what it returns replaces the message, and the `invalid_credentials` hints\n   * still follow. A bare `429` needs none since 0.30.0: the kit says `rateLimited`.\n   */\n  describeError?: (error: unknown, action: SignInAction) => ReactNode | undefined;\n  /** The step changed — retitle the page (`AuthLayout`'s `title`) if the app wants. */\n  onStepChange?: (step: SignInStep) => void;\n  /** The level of the second and third step's heading. Default `h2`, under the page's\n   *  `h1`; one level under `AuthLayout`'s `headingAs` where that is embedded lower. */\n  headingAs?: \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\";\n  labels?: Partial<SignInLabels>;\n}\n\n/* ── Parts ───────────────────────────────────────────────────────────────── */\n\ninterface Failure {\n  action: SignInAction;\n  code: KitErrorCode | undefined;\n  message: ReactNode;\n  /** The address the failed credentials carried — the tag hint names its tagged form. */\n  email?: string;\n}\n\n/** `{contact}` in the template, replaced by the contact (a `mailto:` link for an\n *  address). Split, not interpolated, so the link is an element. A template that lost\n *  its placeholder still shows the contact, after it. */\nfunction withContact(template: string, contact: ReactNode): ReactNode[] {\n  const node =\n    typeof contact === \"string\" && contact.includes(\"@\") ? (\n      <TextLink key=\"contact\" href={`mailto:${contact}`} tone=\"secondary\">\n        {contact}\n      </TextLink>\n    ) : (\n      <span key=\"contact\">{contact}</span>\n    );\n  if (!template.includes(\"{contact}\")) return [template, \" \", node];\n  return template\n    .split(/(\\{contact\\})/)\n    .filter((part) => part !== \"\")\n    .map((part) => (part === \"{contact}\" ? node : part));\n}\n\nconst HINT_CLASS = \"text-xs text-[var(--text-secondary)]\";\n\n/** A backup code's letters and digits — kastlan's: 16, printed `ABCD-EFGH-JKLM-NPQR`. */\nconst RECOVERY_CODE_LENGTH = 16;\n\n/** How many letters and digits a typed backup code has: the dashes and spaces it is\n *  printed in groups with don't count, so \"abcd-efgh ijkl mnop\" is 16 — the count\n *  kastlan's server normalises the code to before it compares. */\nfunction recoveryCharacters(value: string): number {\n  return value.replace(/[^\\p{L}\\p{N}]/gu, \"\").length;\n}\nconst INTRO_CLASS = \"text-sm text-[var(--text-secondary)]\";\n\n/* ── The form ────────────────────────────────────────────────────────────── */\n\n/**\n * Sign-in for every app (docs/auth-harmonization.md §5, §8): email and password, or a\n * passkey; then the second factor when it is on; then a new password when an admin\n * required one. keksdose's `LoginPage` and `ForcedPasswordChangeStep`\n * (features/auth/login-page.tsx, forced-password-change.tsx), as one component.\n *\n * **It never sends a request.** Each step hands its input to a callback and renders the\n * {@link SignInAnswer} it resolves with; a rejection is shown in the step it came from.\n * The challenge token lives in this component's state only, as in keksdose, so a reload\n * costs a fresh sign-in — no route, no storage.\n *\n * **One error for every wrong credential** (§2.10, §5.2): `invalid_credentials` shows one\n * sentence, whatever was wrong, plus two hints UNDER it — \"Account deactivated? Write to\n * …\" (`deactivatedContact`) and \"Signed up with you+kastlan@…? Use that address.\"\n * (`emailTag`). Any other failure says \"Sign-in failed\" and no hint: the hints answer a\n * refused credential, not a network that is down. `describeError` puts the app's words\n * on a failure the kit cannot know (a throttled attempt).\n *\n * **The steps.**\n *  - Credentials: the email field is `username webauthn` (passkey autofill, see\n *    `passkeyAutofill`), the password a `CurrentPasswordInput` (a password manager fills\n *    it and never offers a new one). The submit is not disabled while the fields are\n *    empty: a browser that autofills on load withholds the values until the first\n *    interaction, and a disabled button would swallow that first click. The fields'\n *    own `required` answers an empty submit instead. \"Forgot your password?\" sits under\n *    the buttons, where someone whose password just failed is already looking\n *    (keksdose #198).\n *  - Second factor: {@link OneTimeCodeInput}, focused on arrival. \"Verify\" waits for the\n *    whole code. A refused code stays here with its error; `token_invalid` (the\n *    challenge expired) goes back to the credentials and says why. Kurvenschmiede has\n *    no 2FA yet, and the step is here from the start, so adding it is backend work only\n *    (§10.5). With `recoveryCode` (0.30.0) a switch under the field takes a backup code\n *    instead, through the same `onCode` with `kind: \"recovery\"`.\n *\n * **A throttled request** (HTTP 429, {@link isRateLimited}) says \"Too many attempts. Try\n * again in 30 s.\" on any step (0.30.0) — the wait from its `Retry-After`, else \"Wait a\n * moment and try again.\" — after `describeError`, whose words still come first, and\n * instead of \"wrong password\" or \"invalid code\", which would send the person to try\n * another one.\n *  - New password: new + confirm with the strength meter, the 8-character / 72-byte\n *    rules and nothing else (§8). It reads as explained, not blocked (keksdose): the\n *    person did nothing wrong.\n *\n * The password is dropped from state once the credentials are answered; \"Back to sign in\"\n * returns to an empty password field.\n */\nexport function SignInForm({\n  onSubmit,\n  onCode,\n  onSetPassword,\n  onPasskey,\n  passkeyAutofill,\n  forgotHref,\n  registerHref,\n  access,\n  defaultEmail = \"\",\n  emailTag,\n  deactivatedContact,\n  codeLength = 6,\n  recoveryCode,\n  credentialsContent,\n  twoFactorContent,\n  passwordChangeContent,\n  describeError,\n  onStepChange,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: SignInFormProps) {\n  const labels = useKitLabels(\"signIn\", DEFAULT_SIGN_IN_LABELS, labelsProp);\n  // The mail's subject and body are the landing's words (`landing` namespace), so the\n  // request reads the same from every page that offers it.\n  const landing = useLandingLabels();\n  const accountLink =\n    access === undefined\n      ? registerHref === undefined\n        ? null\n        : { href: registerHref, label: labels.register }\n      : access.kind === \"register\"\n        ? { href: access.href, label: labels.register }\n        : {\n            href: accessAction(access, landing).href,\n            label: labels.requestAccess ?? DEFAULT_SIGN_IN_LABELS.requestAccess,\n          };\n  const [step, setStep] = useState<SignInStep>(\"credentials\");\n  const [email, setEmail] = useState(defaultEmail);\n  const [password, setPassword] = useState(\"\");\n  const [code, setCode] = useState(\"\");\n  // 0.30.0: the second factor as a backup code instead of the authenticator's digits.\n  const [useRecovery, setUseRecovery] = useState(false);\n  const [recovery, setRecovery] = useState(\"\");\n  const [newPassword, setNewPassword] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  const [challenge, setChallenge] = useState<{ token: string; extra?: Readonly<Record<string, unknown>> } | null>(\n    null,\n  );\n  // What is running: one call at a time. \"done\" after `signed-in` — the app has the\n  // session and is leaving; the buttons stay busy so nothing is sent twice meanwhile.\n  const [busy, setBusy] = useState<SignInAction | \"done\" | null>(null);\n  const [failure, setFailure] = useState<Failure | null>(null);\n  const headingId = useId();\n\n  const emailRef = useRef<HTMLInputElement>(null);\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const codeRef = useRef<HTMLInputElement>(null);\n  const recoveryRef = useRef<HTMLInputElement>(null);\n  const newPasswordRef = useRef<HTMLInputElement>(null);\n\n  // A late answer after unmount (the app navigated away) must not set state.\n  const mounted = useRef(true);\n  useEffect(() => {\n    mounted.current = true;\n    return () => {\n      mounted.current = false;\n    };\n  }, []);\n\n  const goTo = (next: SignInStep) => {\n    setStep(next);\n    onStepChange?.(next);\n  };\n\n  const present = (answer: SignInAnswer) => {\n    setFailure(null);\n    if (answer.kind === \"signed-in\") {\n      setBusy(\"done\");\n      return;\n    }\n    setBusy(null);\n    // The password has done its work; it does not stay in state for the next steps.\n    setPassword(\"\");\n    setCode(\"\");\n    setRecovery(\"\");\n    setUseRecovery(false);\n    setNewPassword(\"\");\n    setConfirm(\"\");\n    if (answer.kind === \"2fa\") {\n      setChallenge({ token: answer.challengeToken });\n      goTo(\"2fa\");\n    } else if (answer.kind === \"password-change\") {\n      setChallenge({ token: answer.challengeToken, extra: answer.extra });\n      goTo(\"password-change\");\n    }\n  };\n\n  const messageFor = (\n    error: unknown,\n    action: SignInAction,\n    code: KitErrorCode | undefined,\n    recoveryUsed: boolean,\n  ): ReactNode => {\n    const own = describeError?.(error, action);\n    if (hasMessage(own)) return own;\n    // After the app's words, before the kit's generic ones (0.30.0): a throttle is\n    // neither a wrong password nor a wrong code, and saying so sends the person to try\n    // another one — which the limiter counts too.\n    if (isRateLimited(error)) return (labels.rateLimited ?? DEFAULT_SIGN_IN_LABELS.rateLimited)(retryAfterSeconds(error));\n    if (action === \"password\") return code === \"invalid_credentials\" ? labels.invalidCredentials : labels.failed;\n    if (action === \"passkey\") return labels.passkeyFailed;\n    if (action === \"code\") {\n      if (code === \"token_invalid\") return labels.expired;\n      return recoveryUsed\n        ? (labels.recoveryCodeInvalid ?? DEFAULT_SIGN_IN_LABELS.recoveryCodeInvalid)\n        : labels.codeInvalid;\n    }\n    return code === \"token_invalid\" ? labels.expired : labels.setPasswordFailed;\n  };\n\n  const fail = (error: unknown, action: SignInAction, sentEmail?: string, recoveryUsed = false) => {\n    setBusy(null);\n    // Our own abort (a passkey ceremony cancelled by the unmount) is no failure.\n    if ((error as { name?: unknown } | null)?.name === \"AbortError\") return;\n    const code = authErrorCode(error);\n    const message = messageFor(error, action, code, recoveryUsed);\n    // The challenge expired between the steps: only a fresh sign-in helps.\n    if ((action === \"code\" || action === \"set-password\") && code === \"token_invalid\") {\n      setChallenge(null);\n      setCode(\"\");\n      setRecovery(\"\");\n      setUseRecovery(false);\n      setNewPassword(\"\");\n      setConfirm(\"\");\n      goTo(\"credentials\");\n    }\n    setFailure({ action, code, message, email: sentEmail });\n  };\n\n  const attempt = (\n    action: SignInAction,\n    call: () => Promise<SignInAnswer>,\n    sentEmail?: string,\n    recoveryUsed = false,\n  ) => {\n    if (busy) return;\n    setBusy(action);\n    setFailure(null);\n    let result: Promise<SignInAnswer>;\n    try {\n      result = Promise.resolve(call());\n    } catch (error) {\n      result = Promise.reject(error);\n    }\n    result.then(\n      (answer) => {\n        if (mounted.current) present(answer);\n      },\n      (error: unknown) => {\n        if (mounted.current) fail(error, action, sentEmail, recoveryUsed);\n      },\n    );\n  };\n\n  // Passkey autofill: armed once, on mount; the signal aborts on unmount. Its answer\n  // arrives whenever the person picks a passkey from the email field's dropdown — and\n  // is dropped if they have meanwhile started a sign-in of their own.\n  const armAutofill = useEffectEvent((signal: AbortSignal) => passkeyAutofill?.(signal));\n  const autofillAnswered = useEffectEvent((answer: SignInAnswer) => {\n    if (busy === null) present(answer);\n  });\n  useEffect(() => {\n    const controller = new AbortController();\n    let pending: Promise<SignInAnswer | null | undefined>;\n    try {\n      pending = Promise.resolve(armAutofill(controller.signal));\n    } catch (error) {\n      pending = Promise.reject(error);\n    }\n    pending.then(\n      (answer) => {\n        if (answer && !controller.signal.aborted && mounted.current) autofillAnswered(answer);\n      },\n      () => {\n        /* silent — unsupported, declined or aborted; the button stays the way in */\n      },\n    );\n    return () => controller.abort();\n  }, []);\n\n  // Focus follows the step — not on mount (where it would pop a phone's keyboard over\n  // the page), only once the person moved to another step.\n  const shownStep = useRef(step);\n  useEffect(() => {\n    if (shownStep.current === step) return;\n    shownStep.current = step;\n    if (step === \"2fa\") codeRef.current?.focus();\n    else if (step === \"password-change\") newPasswordRef.current?.focus();\n    else if (emailRef.current?.value) passwordRef.current?.focus();\n    else emailRef.current?.focus();\n  }, [step]);\n  // The backup-code switch swaps one field for the other under the focus that pressed\n  // it; the field that came in is where the person is going. Only after a switch on\n  // this step — arriving on it is the effect above.\n  const shownRecovery = useRef(useRecovery);\n  useEffect(() => {\n    if (shownRecovery.current === useRecovery) return;\n    shownRecovery.current = useRecovery;\n    if (step !== \"2fa\") return;\n    (useRecovery ? recoveryRef : codeRef).current?.focus();\n  }, [useRecovery, step]);\n\n  const backToCredentials = () => {\n    if (busy) return;\n    setChallenge(null);\n    setFailure(null);\n    setCode(\"\");\n    setRecovery(\"\");\n    setUseRecovery(false);\n    setNewPassword(\"\");\n    setConfirm(\"\");\n    goTo(\"credentials\");\n  };\n\n  const working = busy !== null;\n  const rootClass = cn(\"space-y-3\", className);\n\n  /* ── Step 2: the second factor ── */\n  if (step === \"2fa\" && challenge) {\n    const recoveryOn = recoveryCode !== undefined && recoveryCode !== false;\n    const recoveryLength = (typeof recoveryCode === \"object\" ? recoveryCode.length : undefined) ?? RECOVERY_CODE_LENGTH;\n    const asRecovery = recoveryOn && useRecovery;\n    const recoveryReady = recoveryCharacters(recovery) === recoveryLength;\n    const ready = asRecovery ? recoveryReady : code.length === codeLength;\n    const submitCode = (e: FormEvent) => {\n      e.preventDefault();\n      if (!ready) return;\n      if (asRecovery) {\n        attempt(\n          \"code\",\n          () => onCode({ challengeToken: challenge.token, code: recovery.trim(), kind: \"recovery\" }),\n          undefined,\n          true,\n        );\n        return;\n      }\n      attempt(\"code\", () => onCode({ challengeToken: challenge.token, code }));\n    };\n    const switchCode = () => {\n      if (working) return;\n      setFailure(null);\n      setCode(\"\");\n      setRecovery(\"\");\n      setUseRecovery((on) => !on);\n    };\n    const codeError = failure?.action === \"code\" ? failure.message : undefined;\n    const content =\n      typeof twoFactorContent === \"function\" ? twoFactorContent(challenge.token) : twoFactorContent;\n    return (\n      <div {...rest} data-step=\"2fa\" className={rootClass}>\n        <form className=\"space-y-3\" aria-labelledby={headingId} onSubmit={submitCode}>\n          <Heading id={headingId} className=\"text-base font-semibold text-[var(--text-primary)]\">\n            {labels.twoFactorTitle}\n          </Heading>\n          <p className={INTRO_CLASS}>\n            {asRecovery ? (labels.recoveryIntro ?? DEFAULT_SIGN_IN_LABELS.recoveryIntro) : labels.twoFactorIntro}\n          </p>\n          {content}\n          {asRecovery ? (\n            // A plain text field, not the digits-only one: a backup code is letters and\n            // digits in printed groups. Nothing a phone keyboard would \"correct\", and no\n            // autofill — the browser's suggestion for an unknown field is the username.\n            <Input\n              ref={recoveryRef}\n              label={labels.recoveryCode ?? DEFAULT_SIGN_IN_LABELS.recoveryCode}\n              name=\"recovery-code\"\n              value={recovery}\n              onChange={(e) => {\n                setRecovery(e.target.value);\n                if (failure) setFailure(null);\n              }}\n              autoComplete=\"off\"\n              autoCapitalize=\"characters\"\n              autoCorrect=\"off\"\n              spellCheck={false}\n              inputClassName=\"font-mono\"\n              hint={(labels.recoveryCodeHint ?? DEFAULT_SIGN_IN_LABELS.recoveryCodeHint)(recoveryLength)}\n              readOnly={working}\n              error={codeError}\n              required\n            />\n          ) : (\n            <OneTimeCodeInput\n              ref={codeRef}\n              label={labels.code}\n              name=\"code\"\n              value={code}\n              length={codeLength}\n              onChange={(next) => {\n                setCode(next);\n                if (failure) setFailure(null);\n              }}\n              readOnly={working}\n              error={codeError}\n              required\n            />\n          )}\n          {recoveryOn && (\n            <p className=\"text-sm\">\n              <Button type=\"button\" variant=\"link\" size=\"sm\" disabled={working} onClick={switchCode}>\n                {asRecovery\n                  ? (labels.useAuthenticatorCode ?? DEFAULT_SIGN_IN_LABELS.useAuthenticatorCode)\n                  : (labels.useRecoveryCode ?? DEFAULT_SIGN_IN_LABELS.useRecoveryCode)}\n              </Button>\n            </p>\n          )}\n          <Button type=\"submit\" className=\"w-full\" disabled={!working && !ready} pending={working}>\n            {labels.verify}\n          </Button>\n        </form>\n        <BackLink label={labels.backToSignIn} onClick={backToCredentials} disabled={working} />\n      </div>\n    );\n  }\n\n  /* ── Step 3: a new password ── */\n  if (step === \"password-change\" && challenge) {\n    const problem = newPasswordProblem(newPassword, confirm);\n    const submitPassword = (e: FormEvent) => {\n      e.preventDefault();\n      if (problem) return;\n      attempt(\"set-password\", () => onSetPassword({ challengeToken: challenge.token, password: newPassword }));\n    };\n    const content =\n      typeof passwordChangeContent === \"function\" ? passwordChangeContent(challenge.extra) : passwordChangeContent;\n    return (\n      <div {...rest} data-step=\"password-change\" className={rootClass}>\n        <form className=\"space-y-3\" aria-labelledby={headingId} onSubmit={submitPassword}>\n          <Heading id={headingId} className=\"text-base font-semibold text-[var(--text-primary)]\">\n            {labels.setPasswordTitle}\n          </Heading>\n          <p className={INTRO_CLASS}>{labels.setPasswordIntro}</p>\n          {content}\n          {/* Which account the new password is for, for the password manager: it files\n              the new password under this username instead of guessing. */}\n          {email !== \"\" && (\n            <input type=\"email\" name=\"username\" autoComplete=\"username\" value={email} readOnly hidden />\n          )}\n          <NewPasswordFields\n            password={newPassword}\n            confirm={confirm}\n            onPasswordChange={setNewPassword}\n            onConfirmChange={setConfirm}\n            busy={working}\n            passwordRef={newPasswordRef}\n            text={{ password: labels.newPassword, confirm: labels.confirmPassword, mismatch: labels.passwordMismatch }}\n          />\n          {failure?.action === \"set-password\" && (\n            <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n              {failure.message}\n            </AlertBanner>\n          )}\n          <Button type=\"submit\" className=\"w-full\" disabled={!working && problem !== null} pending={working}>\n            {labels.setPasswordSubmit}\n          </Button>\n        </form>\n        <BackLink label={labels.backToSignIn} onClick={backToCredentials} disabled={working} />\n      </div>\n    );\n  }\n\n  /* ── Step 1: the credentials ── */\n  const submitCredentials = (e: FormEvent) => {\n    e.preventDefault();\n    const sent = email.trim();\n    if (sent === \"\" || password === \"\") return;\n    attempt(\"password\", () => onSubmit({ email: sent, password }), sent);\n  };\n\n  const refused = failure?.code === \"invalid_credentials\";\n  const tagged =\n    refused && failure?.action === \"password\" && emailTag && failure.email ? taggedEmail(failure.email, emailTag) : null;\n  const showDeactivated = refused && hasMessage(deactivatedContact);\n\n  return (\n    <div {...rest} data-step=\"credentials\" className={rootClass}>\n      <form className=\"space-y-3\" onSubmit={submitCredentials}>\n        {credentialsContent}\n        <Input\n          ref={emailRef}\n          type=\"email\"\n          name=\"email\"\n          // \"webauthn\" lets the browser list passkeys in this field's dropdown, paired\n          // with the conditional request `passkeyAutofill` arms.\n          autoComplete=\"username webauthn\"\n          label={labels.email}\n          value={email}\n          onChange={(e) => setEmail(e.target.value)}\n          readOnly={working}\n          required\n        />\n        <CurrentPasswordInput\n          ref={passwordRef}\n          name=\"password\"\n          label={labels.password}\n          value={password}\n          onValueChange={setPassword}\n          busy={working}\n          required\n        />\n        {failure && (\n          // One live region for the sentence and its hints: they are one answer.\n          <div role=\"alert\" className=\"space-y-1.5\">\n            <AlertBanner tone=\"danger\" size=\"sm\">\n              {failure.message}\n            </AlertBanner>\n            {showDeactivated && (\n              <p className={HINT_CLASS}>{withContact(labels.deactivatedHint, deactivatedContact)}</p>\n            )}\n            {tagged && <p className={HINT_CLASS}>{labels.tagHint(tagged)}</p>}\n          </div>\n        )}\n        <Button type=\"submit\" className=\"w-full\" pending={busy === \"password\" || busy === \"done\"} disabled={busy === \"passkey\"}>\n          {labels.submit}\n        </Button>\n        {onPasskey && (\n          <Button\n            type=\"button\"\n            variant=\"secondary\"\n            className=\"w-full\"\n            pending={busy === \"passkey\"}\n            disabled={busy === \"password\" || busy === \"done\"}\n            onClick={() => attempt(\"passkey\", onPasskey)}\n          >\n            <KeyRound aria-hidden className=\"size-4\" />\n            {labels.passkey}\n          </Button>\n        )}\n      </form>\n      {forgotHref !== undefined && (\n        <p className=\"text-center text-sm\">\n          <TextLink href={forgotHref} tone=\"secondary\">\n            {labels.forgotPassword}\n          </TextLink>\n        </p>\n      )}\n      {accountLink !== null && (\n        <p className=\"text-center text-sm text-[var(--text-secondary)]\">\n          {labels.noAccount}{\" \"}\n          <TextLink href={accountLink.href} tone=\"primary\">\n            {accountLink.label}\n          </TextLink>\n        </p>\n      )}\n    </div>\n  );\n}\n\n/** \"Back to sign in\" under the second and third step: a button, since it changes the\n *  step in place rather than going anywhere. */\nfunction BackLink({ label, onClick, disabled }: { label: string; onClick: () => void; disabled: boolean }) {\n  return (\n    <p className=\"text-center text-sm\">\n      <Button type=\"button\" variant=\"link\" tone=\"muted\" size=\"sm\" disabled={disabled} onClick={onClick}>\n        {label}\n      </Button>\n    </p>\n  );\n}\n"],"mappings":";AAwVM,cAiVE,YAjVF;AAxVN,SAAS,WAAW,gBAAgB,OAAO,QAAQ,gBAAgB;AAEnE,SAAS,gBAAgB;AAEzB,SAAS,oBAAoB;AAC7B,SAAS,UAAU;AACnB,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,gBAAgB;AACzB,SAAS,QAAQ,aAAa;AAC9B,SAAS,oBAAoB;AAE7B,SAAS,wBAAwB;AACjC,SAAS,eAAe,oBAAoB,eAAe,yBAAyB;AAEpF,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAmK3B,MAAM,yBAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,SAAS,CAAC,kBAAkB,kBAAkB,aAAa;AAAA,EAC3D,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,kBAAkB,CAAC,WAAW,GAAG,MAAM;AAAA,EACvC,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,eAAe;AACjB;AA4HA,SAAS,YAAY,UAAkB,SAAiC;AACtE,QAAM,OACJ,OAAO,YAAY,YAAY,QAAQ,SAAS,GAAG,IACjD,oBAAC,YAAuB,MAAM,UAAU,OAAO,IAAI,MAAK,aACrD,qBADW,SAEd,IAEA,oBAAC,UAAoB,qBAAX,SAAmB;AAEjC,MAAI,CAAC,SAAS,SAAS,WAAW,EAAG,QAAO,CAAC,UAAU,KAAK,IAAI;AAChE,SAAO,SACJ,MAAM,eAAe,EACrB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAAU,SAAS,cAAc,OAAO,IAAK;AACvD;AAEA,MAAM,aAAa;AAGnB,MAAM,uBAAuB;AAK7B,SAAS,mBAAmB,OAAuB;AACjD,SAAO,MAAM,QAAQ,mBAAmB,EAAE,EAAE;AAC9C;AACA,MAAM,cAAc;AAkDb,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAAoB;AAClB,QAAM,SAAS,aAAa,UAAU,wBAAwB,UAAU;AAGxE,QAAM,UAAU,iBAAiB;AACjC,QAAM,cACJ,WAAW,SACP,iBAAiB,SACf,OACA,EAAE,MAAM,cAAc,OAAO,OAAO,SAAS,IAC/C,OAAO,SAAS,aACd,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,SAAS,IAC5C;AAAA,IACE,MAAM,aAAa,QAAQ,OAAO,EAAE;AAAA,IACpC,OAAO,OAAO,iBAAiB,uBAAuB;AAAA,EACxD;AACR,QAAM,CAAC,MAAM,OAAO,IAAI,SAAqB,aAAa;AAC1D,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,YAAY;AAC/C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,EAAE;AAEnC,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,EAAE;AACjD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,WAAW,YAAY,IAAI;AAAA,IAChC;AAAA,EACF;AAGA,QAAM,CAAC,MAAM,OAAO,IAAI,SAAuC,IAAI;AACnE,QAAM,CAAC,SAAS,UAAU,IAAI,SAAyB,IAAI;AAC3D,QAAM,YAAY,MAAM;AAExB,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAyB,IAAI;AAC7C,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,iBAAiB,OAAyB,IAAI;AAGpD,QAAM,UAAU,OAAO,IAAI;AAC3B,YAAU,MAAM;AACd,YAAQ,UAAU;AAClB,WAAO,MAAM;AACX,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,OAAO,CAAC,SAAqB;AACjC,YAAQ,IAAI;AACZ,mBAAe,IAAI;AAAA,EACrB;AAEA,QAAM,UAAU,CAAC,WAAyB;AACxC,eAAW,IAAI;AACf,QAAI,OAAO,SAAS,aAAa;AAC/B,cAAQ,MAAM;AACd;AAAA,IACF;AACA,YAAQ,IAAI;AAEZ,gBAAY,EAAE;AACd,YAAQ,EAAE;AACV,gBAAY,EAAE;AACd,mBAAe,KAAK;AACpB,mBAAe,EAAE;AACjB,eAAW,EAAE;AACb,QAAI,OAAO,SAAS,OAAO;AACzB,mBAAa,EAAE,OAAO,OAAO,eAAe,CAAC;AAC7C,WAAK,KAAK;AAAA,IACZ,WAAW,OAAO,SAAS,mBAAmB;AAC5C,mBAAa,EAAE,OAAO,OAAO,gBAAgB,OAAO,OAAO,MAAM,CAAC;AAClE,WAAK,iBAAiB;AAAA,IACxB;AAAA,EACF;AAEA,QAAM,aAAa,CACjB,OACA,QACAA,OACA,iBACc;AACd,UAAM,MAAM,gBAAgB,OAAO,MAAM;AACzC,QAAI,WAAW,GAAG,EAAG,QAAO;AAI5B,QAAI,cAAc,KAAK,EAAG,SAAQ,OAAO,eAAe,uBAAuB,aAAa,kBAAkB,KAAK,CAAC;AACpH,QAAI,WAAW,WAAY,QAAOA,UAAS,wBAAwB,OAAO,qBAAqB,OAAO;AACtG,QAAI,WAAW,UAAW,QAAO,OAAO;AACxC,QAAI,WAAW,QAAQ;AACrB,UAAIA,UAAS,gBAAiB,QAAO,OAAO;AAC5C,aAAO,eACF,OAAO,uBAAuB,uBAAuB,sBACtD,OAAO;AAAA,IACb;AACA,WAAOA,UAAS,kBAAkB,OAAO,UAAU,OAAO;AAAA,EAC5D;AAEA,QAAM,OAAO,CAAC,OAAgB,QAAsB,WAAoB,eAAe,UAAU;AAC/F,YAAQ,IAAI;AAEZ,QAAK,OAAqC,SAAS,aAAc;AACjE,UAAMA,QAAO,cAAc,KAAK;AAChC,UAAM,UAAU,WAAW,OAAO,QAAQA,OAAM,YAAY;AAE5D,SAAK,WAAW,UAAU,WAAW,mBAAmBA,UAAS,iBAAiB;AAChF,mBAAa,IAAI;AACjB,cAAQ,EAAE;AACV,kBAAY,EAAE;AACd,qBAAe,KAAK;AACpB,qBAAe,EAAE;AACjB,iBAAW,EAAE;AACb,WAAK,aAAa;AAAA,IACpB;AACA,eAAW,EAAE,QAAQ,MAAAA,OAAM,SAAS,OAAO,UAAU,CAAC;AAAA,EACxD;AAEA,QAAM,UAAU,CACd,QACA,MACA,WACA,eAAe,UACZ;AACH,QAAI,KAAM;AACV,YAAQ,MAAM;AACd,eAAW,IAAI;AACf,QAAI;AACJ,QAAI;AACF,eAAS,QAAQ,QAAQ,KAAK,CAAC;AAAA,IACjC,SAAS,OAAO;AACd,eAAS,QAAQ,OAAO,KAAK;AAAA,IAC/B;AACA,WAAO;AAAA,MACL,CAAC,WAAW;AACV,YAAI,QAAQ,QAAS,SAAQ,MAAM;AAAA,MACrC;AAAA,MACA,CAAC,UAAmB;AAClB,YAAI,QAAQ,QAAS,MAAK,OAAO,QAAQ,WAAW,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AAKA,QAAM,cAAc,eAAe,CAAC,WAAwB,kBAAkB,MAAM,CAAC;AACrF,QAAM,mBAAmB,eAAe,CAAC,WAAyB;AAChE,QAAI,SAAS,KAAM,SAAQ,MAAM;AAAA,EACnC,CAAC;AACD,YAAU,MAAM;AACd,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI;AACJ,QAAI;AACF,gBAAU,QAAQ,QAAQ,YAAY,WAAW,MAAM,CAAC;AAAA,IAC1D,SAAS,OAAO;AACd,gBAAU,QAAQ,OAAO,KAAK;AAAA,IAChC;AACA,YAAQ;AAAA,MACN,CAAC,WAAW;AACV,YAAI,UAAU,CAAC,WAAW,OAAO,WAAW,QAAQ,QAAS,kBAAiB,MAAM;AAAA,MACtF;AAAA,MACA,MAAM;AAAA,MAEN;AAAA,IACF;AACA,WAAO,MAAM,WAAW,MAAM;AAAA,EAChC,GAAG,CAAC,CAAC;AAIL,QAAM,YAAY,OAAO,IAAI;AAC7B,YAAU,MAAM;AACd,QAAI,UAAU,YAAY,KAAM;AAChC,cAAU,UAAU;AACpB,QAAI,SAAS,MAAO,SAAQ,SAAS,MAAM;AAAA,aAClC,SAAS,kBAAmB,gBAAe,SAAS,MAAM;AAAA,aAC1D,SAAS,SAAS,MAAO,aAAY,SAAS,MAAM;AAAA,QACxD,UAAS,SAAS,MAAM;AAAA,EAC/B,GAAG,CAAC,IAAI,CAAC;AAIT,QAAM,gBAAgB,OAAO,WAAW;AACxC,YAAU,MAAM;AACd,QAAI,cAAc,YAAY,YAAa;AAC3C,kBAAc,UAAU;AACxB,QAAI,SAAS,MAAO;AACpB,KAAC,cAAc,cAAc,SAAS,SAAS,MAAM;AAAA,EACvD,GAAG,CAAC,aAAa,IAAI,CAAC;AAEtB,QAAM,oBAAoB,MAAM;AAC9B,QAAI,KAAM;AACV,iBAAa,IAAI;AACjB,eAAW,IAAI;AACf,YAAQ,EAAE;AACV,gBAAY,EAAE;AACd,mBAAe,KAAK;AACpB,mBAAe,EAAE;AACjB,eAAW,EAAE;AACb,SAAK,aAAa;AAAA,EACpB;AAEA,QAAM,UAAU,SAAS;AACzB,QAAM,YAAY,GAAG,aAAa,SAAS;AAG3C,MAAI,SAAS,SAAS,WAAW;AAC/B,UAAM,aAAa,iBAAiB,UAAa,iBAAiB;AAClE,UAAM,kBAAkB,OAAO,iBAAiB,WAAW,aAAa,SAAS,WAAc;AAC/F,UAAM,aAAa,cAAc;AACjC,UAAM,gBAAgB,mBAAmB,QAAQ,MAAM;AACvD,UAAM,QAAQ,aAAa,gBAAgB,KAAK,WAAW;AAC3D,UAAM,aAAa,CAAC,MAAiB;AACnC,QAAE,eAAe;AACjB,UAAI,CAAC,MAAO;AACZ,UAAI,YAAY;AACd;AAAA,UACE;AAAA,UACA,MAAM,OAAO,EAAE,gBAAgB,UAAU,OAAO,MAAM,SAAS,KAAK,GAAG,MAAM,WAAW,CAAC;AAAA,UACzF;AAAA,UACA;AAAA,QACF;AACA;AAAA,MACF;AACA,cAAQ,QAAQ,MAAM,OAAO,EAAE,gBAAgB,UAAU,OAAO,KAAK,CAAC,CAAC;AAAA,IACzE;AACA,UAAM,aAAa,MAAM;AACvB,UAAI,QAAS;AACb,iBAAW,IAAI;AACf,cAAQ,EAAE;AACV,kBAAY,EAAE;AACd,qBAAe,CAAC,OAAO,CAAC,EAAE;AAAA,IAC5B;AACA,UAAM,YAAY,SAAS,WAAW,SAAS,QAAQ,UAAU;AACjE,UAAM,UACJ,OAAO,qBAAqB,aAAa,iBAAiB,UAAU,KAAK,IAAI;AAC/E,WACE,qBAAC,SAAK,GAAG,MAAM,aAAU,OAAM,WAAW,WACxC;AAAA,2BAAC,UAAK,WAAU,aAAY,mBAAiB,WAAW,UAAU,YAChE;AAAA,4BAAC,WAAQ,IAAI,WAAW,WAAU,sDAC/B,iBAAO,gBACV;AAAA,QACA,oBAAC,OAAE,WAAW,aACX,uBAAc,OAAO,iBAAiB,uBAAuB,gBAAiB,OAAO,gBACxF;AAAA,QACC;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,UAIC;AAAA,YAAC;AAAA;AAAA,cACC,KAAK;AAAA,cACL,OAAO,OAAO,gBAAgB,uBAAuB;AAAA,cACrD,MAAK;AAAA,cACL,OAAO;AAAA,cACP,UAAU,CAAC,MAAM;AACf,4BAAY,EAAE,OAAO,KAAK;AAC1B,oBAAI,QAAS,YAAW,IAAI;AAAA,cAC9B;AAAA,cACA,cAAa;AAAA,cACb,gBAAe;AAAA,cACf,aAAY;AAAA,cACZ,YAAY;AAAA,cACZ,gBAAe;AAAA,cACf,OAAO,OAAO,oBAAoB,uBAAuB,kBAAkB,cAAc;AAAA,cACzF,UAAU;AAAA,cACV,OAAO;AAAA,cACP,UAAQ;AAAA;AAAA,UACV;AAAA,YAEA;AAAA,UAAC;AAAA;AAAA,YACC,KAAK;AAAA,YACL,OAAO,OAAO;AAAA,YACd,MAAK;AAAA,YACL,OAAO;AAAA,YACP,QAAQ;AAAA,YACR,UAAU,CAAC,SAAS;AAClB,sBAAQ,IAAI;AACZ,kBAAI,QAAS,YAAW,IAAI;AAAA,YAC9B;AAAA,YACA,UAAU;AAAA,YACV,OAAO;AAAA,YACP,UAAQ;AAAA;AAAA,QACV;AAAA,QAED,cACC,oBAAC,OAAE,WAAU,WACX,8BAAC,UAAO,MAAK,UAAS,SAAQ,QAAO,MAAK,MAAK,UAAU,SAAS,SAAS,YACxE,uBACI,OAAO,wBAAwB,uBAAuB,uBACtD,OAAO,mBAAmB,uBAAuB,iBACxD,GACF;AAAA,QAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,CAAC,OAAO,SAAS,SAC7E,iBAAO,QACV;AAAA,SACF;AAAA,MACA,oBAAC,YAAS,OAAO,OAAO,cAAc,SAAS,mBAAmB,UAAU,SAAS;AAAA,OACvF;AAAA,EAEJ;AAGA,MAAI,SAAS,qBAAqB,WAAW;AAC3C,UAAM,UAAU,mBAAmB,aAAa,OAAO;AACvD,UAAM,iBAAiB,CAAC,MAAiB;AACvC,QAAE,eAAe;AACjB,UAAI,QAAS;AACb,cAAQ,gBAAgB,MAAM,cAAc,EAAE,gBAAgB,UAAU,OAAO,UAAU,YAAY,CAAC,CAAC;AAAA,IACzG;AACA,UAAM,UACJ,OAAO,0BAA0B,aAAa,sBAAsB,UAAU,KAAK,IAAI;AACzF,WACE,qBAAC,SAAK,GAAG,MAAM,aAAU,mBAAkB,WAAW,WACpD;AAAA,2BAAC,UAAK,WAAU,aAAY,mBAAiB,WAAW,UAAU,gBAChE;AAAA,4BAAC,WAAQ,IAAI,WAAW,WAAU,sDAC/B,iBAAO,kBACV;AAAA,QACA,oBAAC,OAAE,WAAW,aAAc,iBAAO,kBAAiB;AAAA,QACnD;AAAA,QAGA,UAAU,MACT,oBAAC,WAAM,MAAK,SAAQ,MAAK,YAAW,cAAa,YAAW,OAAO,OAAO,UAAQ,MAAC,QAAM,MAAC;AAAA,QAE5F;AAAA,UAAC;AAAA;AAAA,YACC,UAAU;AAAA,YACV;AAAA,YACA,kBAAkB;AAAA,YAClB,iBAAiB;AAAA,YACjB,MAAM;AAAA,YACN,aAAa;AAAA,YACb,MAAM,EAAE,UAAU,OAAO,aAAa,SAAS,OAAO,iBAAiB,UAAU,OAAO,iBAAiB;AAAA;AAAA,QAC3G;AAAA,QACC,SAAS,WAAW,kBACnB,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,kBAAQ,SACX;AAAA,QAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,YAAY,MAAM,SAAS,SACvF,iBAAO,mBACV;AAAA,SACF;AAAA,MACA,oBAAC,YAAS,OAAO,OAAO,cAAc,SAAS,mBAAmB,UAAU,SAAS;AAAA,OACvF;AAAA,EAEJ;AAGA,QAAM,oBAAoB,CAAC,MAAiB;AAC1C,MAAE,eAAe;AACjB,UAAM,OAAO,MAAM,KAAK;AACxB,QAAI,SAAS,MAAM,aAAa,GAAI;AACpC,YAAQ,YAAY,MAAM,SAAS,EAAE,OAAO,MAAM,SAAS,CAAC,GAAG,IAAI;AAAA,EACrE;AAEA,QAAM,UAAU,SAAS,SAAS;AAClC,QAAM,SACJ,WAAW,SAAS,WAAW,cAAc,YAAY,QAAQ,QAAQ,YAAY,QAAQ,OAAO,QAAQ,IAAI;AAClH,QAAM,kBAAkB,WAAW,WAAW,kBAAkB;AAEhE,SACE,qBAAC,SAAK,GAAG,MAAM,aAAU,eAAc,WAAW,WAChD;AAAA,yBAAC,UAAK,WAAU,aAAY,UAAU,mBACnC;AAAA;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,KAAK;AAAA,UACL,MAAK;AAAA,UACL,MAAK;AAAA,UAGL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,UACxC,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,KAAK;AAAA,UACL,MAAK;AAAA,UACL,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,eAAe;AAAA,UACf,MAAM;AAAA,UACN,UAAQ;AAAA;AAAA,MACV;AAAA,MACC;AAAA,MAEC,qBAAC,SAAI,MAAK,SAAQ,WAAU,eAC1B;AAAA,4BAAC,eAAY,MAAK,UAAS,MAAK,MAC7B,kBAAQ,SACX;AAAA,QACC,mBACC,oBAAC,OAAE,WAAW,YAAa,sBAAY,OAAO,iBAAiB,kBAAkB,GAAE;AAAA,QAEpF,UAAU,oBAAC,OAAE,WAAW,YAAa,iBAAO,QAAQ,MAAM,GAAE;AAAA,SAC/D;AAAA,MAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,SAAS,SAAS,cAAc,SAAS,QAAQ,UAAU,SAAS,WAC1G,iBAAO,QACV;AAAA,MACC,aACC;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,WAAU;AAAA,UACV,SAAS,SAAS;AAAA,UAClB,UAAU,SAAS,cAAc,SAAS;AAAA,UAC1C,SAAS,MAAM,QAAQ,WAAW,SAAS;AAAA,UAE3C;AAAA,gCAAC,YAAS,eAAW,MAAC,WAAU,UAAS;AAAA,YACxC,OAAO;AAAA;AAAA;AAAA,MACV;AAAA,OAEJ;AAAA,IACC,eAAe,UACd,oBAAC,OAAE,WAAU,uBACX,8BAAC,YAAS,MAAM,YAAY,MAAK,aAC9B,iBAAO,gBACV,GACF;AAAA,IAED,gBAAgB,QACf,qBAAC,OAAE,WAAU,oDACV;AAAA,aAAO;AAAA,MAAW;AAAA,MACnB,oBAAC,YAAS,MAAM,YAAY,MAAM,MAAK,WACpC,sBAAY,OACf;AAAA,OACF;AAAA,KAEJ;AAEJ;AAIA,SAAS,SAAS,EAAE,OAAO,SAAS,SAAS,GAA8D;AACzG,SACE,oBAAC,OAAE,WAAU,uBACX,8BAAC,UAAO,MAAK,UAAS,SAAQ,QAAO,MAAK,SAAQ,MAAK,MAAK,UAAoB,SAC7E,iBACH,GACF;AAEJ;","names":["code"]}

package/dist/chart.d.ts

@@ -13,7 +13,7 @@ export { TimeTickUnit } from './components/series-chart-ticks.js';
 import 'recharts';
 import 'react';
 import './lib/direction.js';
-import './delete-account-setting-CGVMckMw.js';
+import './delete-account-setting-DCFS5Vof.js';
 import './components/tooltip.js';
 import './hooks/use-anchored-rect.js';
 import './lib/clipping.js';
@@ -66,6 +66,8 @@ import './components/image-grid.js';
 import './components/lightbox.js';
 import './components/write-lock.js';
 import './auth/sign-in-form.js';
+import './landing/access.js';
+import './landing/landing-labels.js';
 import './shell/topbar-controls.js';
 import './theme/palette-presets.js';
 import './theme/theme-store.js';
@@ -86,6 +88,8 @@ import './account/data-export-setting.js';
 import './components/account-chips.js';
 import './admin/admin-parts.js';
 import './admin/admin-action-log.js';
+import './settings/settings-labels.js';
+import './demo/demo-labels.js';
 import './components/reauth-dialog.js';
 import './components/server-wake.js';
 import './lib/server-wake.js';

package/dist/components/account-settings-labels.d.ts

@@ -40,6 +40,12 @@ interface PasswordSettingLabels {
     mismatch: string;
 }
 interface TwoFactorSettingLabels {
+    /**
+     * Before 0.31 the card's one line, "<status>: On". Since 0.31 the setting's name is the
+     * card's {@link title} and the state stands beside it, so this is read only where no
+     * `title` is given at the same level — an app that translated `status` keeps its word
+     * as the title.
+     */
     status: string;
     enabledText: string;
     disabledText: string;
@@ -64,6 +70,12 @@ interface TwoFactorSettingLabels {
     secretHint?: string;
     /** The copy button beside that key. */
     copySecret?: string;
+    /**
+     * 0.31.0 (docs/settings-harmonization.md §3.7): the card's title, a heading inside a
+     * `SettingsLayout`. OPTIONAL for the reason `qrAlt` is. Unset, the same source's
+     * `status` stands in for it, then English.
+     */
+    title?: string;
 }
 interface PasskeysSettingLabels {
     title: string;

package/dist/components/account-settings-labels.js

@@ -36,7 +36,8 @@ const DEFAULT_ACCOUNT_SETTINGS_LABELS = {
     // Unchanged from the fallback it had before the namespace (i18n-labels.test pins it).
     qrAlt: "QR code",
     secretHint: "Can\u2019t scan it? Enter this key in the app instead:",
-    copySecret: "Copy key"
+    copySecret: "Copy key",
+    title: "Two-factor authentication"
   },
   passkeys: {
     title: "Passkeys",

package/dist/components/account-settings-labels.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/account-settings-labels.ts"],"sourcesContent":["import { useMemo } from \"react\";\nimport { useKitLabelOverrides } from \"../i18n/kit-labels\";\n\n/**\n * The `accountSettings` namespace of `<UiKitProvider labels>`: one record per section —\n * `profile`, `password`, `twoFactor`, `passkeys` — each merged key by key, so an app\n * can translate `accountSettings.twoFactor.scanHint` alone.\n *\n * Before 0.12.0 every section took a REQUIRED `labels` prop and had no English of its\n * own, so each app spelled out 30-odd keys at the call site and still hard-coded some\n * (kastlan's profile page passed `email: \"Email\"` in English to a German page). The\n * prop stays, now partial, and wins over the provider as everywhere else in the kit.\n *\n * Its own module, beside the components rather than in them, so `PasskeysSetting`\n * (its own file) and the older three read one tree without importing each other.\n */\n\nexport interface ProfileSettingLabels {\n  title: string;\n  email: string;\n  role: string;\n  memberSince: string;\n  /** The single name field — the card without `firstName` / `lastName`. */\n  displayName: string;\n  save: string;\n  /**\n   * 0.30.0 (docs/user-admin-harmonization.md §6.1): the two fields that replace\n   * `displayName` once the card is given `firstName` / `lastName`. OPTIONAL, like\n   * `TwoFactorSettingLabels.qrAlt` and for its reason — this interface is annotated at\n   * call sites — and filled from the provider's `accountSettings.profile`, then English.\n   */\n  firstName?: string;\n  lastName?: string;\n  /** Why Save is held while a name is blank: both are required (§3.1). */\n  nameRequired?: string;\n}\n\nexport interface PasswordSettingLabels {\n  title: string;\n  current: string;\n  next: string;\n  confirm: string;\n  submit: string;\n  tooShort: string;\n  mismatch: string;\n}\n\nexport interface TwoFactorSettingLabels {\n  status: string;\n  enabledText: string;\n  disabledText: string;\n  enable: string;\n  scanHint: string;\n  codeLabel: string;\n  verify: string;\n  disableSection: string;\n  password: string;\n  disable: string;\n  /**\n   * Alt text for the setup QR code, which shipped as a hardcoded `alt=\"QR\"`.\n   *\n   * OPTIONAL, like the two keys below, and not because it matters less: this interface\n   * is annotated at consumer call sites (`const LABELS: TwoFactorSettingLabels = {…}`),\n   * so a new REQUIRED key is a compile error in every app on the next `npm update` —\n   * the additive-API rule in the README. Each falls back to the provider's\n   * `accountSettings.twoFactor`, then English.\n   */\n  qrAlt?: string;\n  /** The line over the manual-entry key, for a phone that cannot scan its own screen. */\n  secretHint?: string;\n  /** The copy button beside that key. */\n  copySecret?: string;\n}\n\nexport interface PasskeysSettingLabels {\n  title: string;\n  /** The line under the title saying what a passkey is for — `mode=\"instead\"` (the\n   *  default): the passkey stands in for the password. */\n  description: string;\n  /**\n   * The same line for `mode=\"alongside\"` (0.18.0): the password keeps working and the\n   * passkey is a second way in. OPTIONAL for the reason `TwoFactorSettingLabels.qrAlt`\n   * is — this interface is annotated at call sites — and filled from the provider's\n   * `accountSettings.passkeys`, then English.\n   */\n  descriptionAlongside?: string;\n  empty: string;\n  loading: string;\n  /** Accessible name of the list. */\n  list: string;\n  nameLabel: string;\n  namePlaceholder: string;\n  add: string;\n  /** The add button while the app's WebAuthn ceremony runs — the OS prompt is open. */\n  adding: string;\n  rename: string;\n  /** The row's rename button, named for its passkey — it starts with `rename`, the\n   *  visible text, so voice control finds it by what it says. */\n  renameItem: (name: string) => string;\n  /** Accessible name of the inline rename field. */\n  renameField: (name: string) => string;\n  save: string;\n  cancel: string;\n  delete: string;\n  /** The row's delete button, named for its passkey (see `renameItem`). */\n  deleteItem: (name: string) => string;\n  /** The inline question a delete asks first. */\n  deleteConfirm: (name: string) => string;\n  /** The destructive button that answers it. */\n  confirmDelete: string;\n  /** `date` arrives formatted in the provider's locale. */\n  created: (date: string) => string;\n  lastUsed: (date: string) => string;\n  neverUsed: string;\n}\n\nexport interface AccountSettingsLabels {\n  profile: Required<ProfileSettingLabels>;\n  password: PasswordSettingLabels;\n  // `Required` here, optional on the section interfaces: the namespace is what a full\n  // catalogue (`@eifi1/ui-kit/i18n/<code>`, `missingKitLabels`) is written against, so\n  // it must name the late keys; the section interfaces are annotated at call sites.\n  twoFactor: Required<TwoFactorSettingLabels>;\n  passkeys: Required<PasskeysSettingLabels>;\n}\n\nexport const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels = {\n  profile: {\n    title: \"Profile\",\n    email: \"Email\",\n    role: \"Role\",\n    memberSince: \"Member since\",\n    displayName: \"Display name\",\n    save: \"Save\",\n    firstName: \"First name\",\n    lastName: \"Last name\",\n    nameRequired: \"Enter both a first and a last name.\",\n  },\n  password: {\n    title: \"Change password\",\n    current: \"Current password\",\n    next: \"New password\",\n    confirm: \"Confirm new password\",\n    submit: \"Change password\",\n    tooShort: \"The new password is too short.\",\n    mismatch: \"The passwords don’t match.\",\n  },\n  twoFactor: {\n    status: \"Two-factor authentication\",\n    enabledText: \"On\",\n    disabledText: \"Off\",\n    enable: \"Set up two-factor authentication\",\n    scanHint: \"Scan this code with your authenticator app, then enter the code it shows.\",\n    codeLabel: \"Verification code\",\n    verify: \"Verify and turn on\",\n    disableSection: \"Turn off two-factor authentication\",\n    password: \"Current password\",\n    disable: \"Turn off\",\n    // Unchanged from the fallback it had before the namespace (i18n-labels.test pins it).\n    qrAlt: \"QR code\",\n    secretHint: \"Can’t scan it? Enter this key in the app instead:\",\n    copySecret: \"Copy key\",\n  },\n  passkeys: {\n    title: \"Passkeys\",\n    description: \"Sign in with your fingerprint, face or device PIN instead of a password.\",\n    // Kurvenschmiede overrode `description` because \"instead of\" is false where the\n    // password stays; this is the sentence for those apps, picked by `mode`.\n    descriptionAlongside: \"Sign in with your fingerprint, face or device PIN. Your password keeps working too.\",\n    empty: \"No passkeys yet\",\n    loading: \"Loading passkeys…\",\n    list: \"Your passkeys\",\n    nameLabel: \"Name (optional)\",\n    namePlaceholder: \"e.g. Laptop, Phone\",\n    add: \"Add passkey\",\n    adding: \"Waiting for your device…\",\n    rename: \"Rename\",\n    renameItem: (name) => `Rename ${name}`,\n    renameField: (name) => `New name for ${name}`,\n    save: \"Save\",\n    cancel: \"Cancel\",\n    delete: \"Delete\",\n    deleteItem: (name) => `Delete ${name}`,\n    deleteConfirm: (name) => `Delete “${name}”? It can no longer be used to sign in.`,\n    confirmDelete: \"Delete passkey\",\n    created: (date) => `Added ${date}`,\n    lastUsed: (date) => `Last used ${date}`,\n    neverUsed: \"Never used\",\n  },\n};\n\n/**\n * One section of the namespace, resolved: English, then the provider's\n * `accountSettings.<section>`, then the component's own `labels` prop. An `undefined`\n * in either source is skipped, so a prop object built from optional values cannot\n * blank out a default.\n */\nexport function useAccountSettingsLabels<K extends keyof AccountSettingsLabels>(\n  section: K,\n  prop?: Partial<AccountSettingsLabels[K]>,\n): AccountSettingsLabels[K] {\n  const fromProvider = useKitLabelOverrides(\"accountSettings\")?.[section] as\n    | Partial<AccountSettingsLabels[K]>\n    | undefined;\n  return useMemo(\n    () => ({\n      ...DEFAULT_ACCOUNT_SETTINGS_LABELS[section],\n      ...definedOnly(fromProvider),\n      ...definedOnly(prop),\n    }),\n    [section, fromProvider, prop],\n  );\n}\n\nfunction definedOnly<T extends object>(value: T | undefined): Partial<T> {\n  if (!value) return {};\n  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined)) as Partial<T>;\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,4BAA4B;AA6H9B,MAAM,kCAAyD;AAAA,EACpE,SAAS;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,MAAM;AAAA,IACN,aAAa;AAAA,IACb,aAAa;AAAA,IACb,MAAM;AAAA,IACN,WAAW;AAAA,IACX,UAAU;AAAA,IACV,cAAc;AAAA,EAChB;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA,WAAW;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,IAET,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,aAAa;AAAA;AAAA;AAAA,IAGb,sBAAsB;AAAA,IACtB,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,iBAAiB;AAAA,IACjB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,YAAY,CAAC,SAAS,UAAU,IAAI;AAAA,IACpC,aAAa,CAAC,SAAS,gBAAgB,IAAI;AAAA,IAC3C,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,YAAY,CAAC,SAAS,UAAU,IAAI;AAAA,IACpC,eAAe,CAAC,SAAS,gBAAW,IAAI;AAAA,IACxC,eAAe;AAAA,IACf,SAAS,CAAC,SAAS,SAAS,IAAI;AAAA,IAChC,UAAU,CAAC,SAAS,aAAa,IAAI;AAAA,IACrC,WAAW;AAAA,EACb;AACF;AAQO,SAAS,yBACd,SACA,MAC0B;AAC1B,QAAM,eAAe,qBAAqB,iBAAiB,IAAI,OAAO;AAGtE,SAAO;AAAA,IACL,OAAO;AAAA,MACL,GAAG,gCAAgC,OAAO;AAAA,MAC1C,GAAG,YAAY,YAAY;AAAA,MAC3B,GAAG,YAAY,IAAI;AAAA,IACrB;AAAA,IACA,CAAC,SAAS,cAAc,IAAI;AAAA,EAC9B;AACF;AAEA,SAAS,YAA8B,OAAkC;AACvE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,MAAM,MAAS,CAAC;AACpF;","names":[]}
+{"version":3,"sources":["../../src/components/account-settings-labels.ts"],"sourcesContent":["import { useMemo } from \"react\";\nimport { useKitLabelOverrides } from \"../i18n/kit-labels\";\n\n/**\n * The `accountSettings` namespace of `<UiKitProvider labels>`: one record per section —\n * `profile`, `password`, `twoFactor`, `passkeys` — each merged key by key, so an app\n * can translate `accountSettings.twoFactor.scanHint` alone.\n *\n * Before 0.12.0 every section took a REQUIRED `labels` prop and had no English of its\n * own, so each app spelled out 30-odd keys at the call site and still hard-coded some\n * (kastlan's profile page passed `email: \"Email\"` in English to a German page). The\n * prop stays, now partial, and wins over the provider as everywhere else in the kit.\n *\n * Its own module, beside the components rather than in them, so `PasskeysSetting`\n * (its own file) and the older three read one tree without importing each other.\n */\n\nexport interface ProfileSettingLabels {\n  title: string;\n  email: string;\n  role: string;\n  memberSince: string;\n  /** The single name field — the card without `firstName` / `lastName`. */\n  displayName: string;\n  save: string;\n  /**\n   * 0.30.0 (docs/user-admin-harmonization.md §6.1): the two fields that replace\n   * `displayName` once the card is given `firstName` / `lastName`. OPTIONAL, like\n   * `TwoFactorSettingLabels.qrAlt` and for its reason — this interface is annotated at\n   * call sites — and filled from the provider's `accountSettings.profile`, then English.\n   */\n  firstName?: string;\n  lastName?: string;\n  /** Why Save is held while a name is blank: both are required (§3.1). */\n  nameRequired?: string;\n}\n\nexport interface PasswordSettingLabels {\n  title: string;\n  current: string;\n  next: string;\n  confirm: string;\n  submit: string;\n  tooShort: string;\n  mismatch: string;\n}\n\nexport interface TwoFactorSettingLabels {\n  /**\n   * Before 0.31 the card's one line, \"<status>: On\". Since 0.31 the setting's name is the\n   * card's {@link title} and the state stands beside it, so this is read only where no\n   * `title` is given at the same level — an app that translated `status` keeps its word\n   * as the title.\n   */\n  status: string;\n  enabledText: string;\n  disabledText: string;\n  enable: string;\n  scanHint: string;\n  codeLabel: string;\n  verify: string;\n  disableSection: string;\n  password: string;\n  disable: string;\n  /**\n   * Alt text for the setup QR code, which shipped as a hardcoded `alt=\"QR\"`.\n   *\n   * OPTIONAL, like the two keys below, and not because it matters less: this interface\n   * is annotated at consumer call sites (`const LABELS: TwoFactorSettingLabels = {…}`),\n   * so a new REQUIRED key is a compile error in every app on the next `npm update` —\n   * the additive-API rule in the README. Each falls back to the provider's\n   * `accountSettings.twoFactor`, then English.\n   */\n  qrAlt?: string;\n  /** The line over the manual-entry key, for a phone that cannot scan its own screen. */\n  secretHint?: string;\n  /** The copy button beside that key. */\n  copySecret?: string;\n  /**\n   * 0.31.0 (docs/settings-harmonization.md §3.7): the card's title, a heading inside a\n   * `SettingsLayout`. OPTIONAL for the reason `qrAlt` is. Unset, the same source's\n   * `status` stands in for it, then English.\n   */\n  title?: string;\n}\n\nexport interface PasskeysSettingLabels {\n  title: string;\n  /** The line under the title saying what a passkey is for — `mode=\"instead\"` (the\n   *  default): the passkey stands in for the password. */\n  description: string;\n  /**\n   * The same line for `mode=\"alongside\"` (0.18.0): the password keeps working and the\n   * passkey is a second way in. OPTIONAL for the reason `TwoFactorSettingLabels.qrAlt`\n   * is — this interface is annotated at call sites — and filled from the provider's\n   * `accountSettings.passkeys`, then English.\n   */\n  descriptionAlongside?: string;\n  empty: string;\n  loading: string;\n  /** Accessible name of the list. */\n  list: string;\n  nameLabel: string;\n  namePlaceholder: string;\n  add: string;\n  /** The add button while the app's WebAuthn ceremony runs — the OS prompt is open. */\n  adding: string;\n  rename: string;\n  /** The row's rename button, named for its passkey — it starts with `rename`, the\n   *  visible text, so voice control finds it by what it says. */\n  renameItem: (name: string) => string;\n  /** Accessible name of the inline rename field. */\n  renameField: (name: string) => string;\n  save: string;\n  cancel: string;\n  delete: string;\n  /** The row's delete button, named for its passkey (see `renameItem`). */\n  deleteItem: (name: string) => string;\n  /** The inline question a delete asks first. */\n  deleteConfirm: (name: string) => string;\n  /** The destructive button that answers it. */\n  confirmDelete: string;\n  /** `date` arrives formatted in the provider's locale. */\n  created: (date: string) => string;\n  lastUsed: (date: string) => string;\n  neverUsed: string;\n}\n\nexport interface AccountSettingsLabels {\n  profile: Required<ProfileSettingLabels>;\n  password: PasswordSettingLabels;\n  // `Required` here, optional on the section interfaces: the namespace is what a full\n  // catalogue (`@eifi1/ui-kit/i18n/<code>`, `missingKitLabels`) is written against, so\n  // it must name the late keys; the section interfaces are annotated at call sites.\n  twoFactor: Required<TwoFactorSettingLabels>;\n  passkeys: Required<PasskeysSettingLabels>;\n}\n\nexport const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels = {\n  profile: {\n    title: \"Profile\",\n    email: \"Email\",\n    role: \"Role\",\n    memberSince: \"Member since\",\n    displayName: \"Display name\",\n    save: \"Save\",\n    firstName: \"First name\",\n    lastName: \"Last name\",\n    nameRequired: \"Enter both a first and a last name.\",\n  },\n  password: {\n    title: \"Change password\",\n    current: \"Current password\",\n    next: \"New password\",\n    confirm: \"Confirm new password\",\n    submit: \"Change password\",\n    tooShort: \"The new password is too short.\",\n    mismatch: \"The passwords don’t match.\",\n  },\n  twoFactor: {\n    status: \"Two-factor authentication\",\n    enabledText: \"On\",\n    disabledText: \"Off\",\n    enable: \"Set up two-factor authentication\",\n    scanHint: \"Scan this code with your authenticator app, then enter the code it shows.\",\n    codeLabel: \"Verification code\",\n    verify: \"Verify and turn on\",\n    disableSection: \"Turn off two-factor authentication\",\n    password: \"Current password\",\n    disable: \"Turn off\",\n    // Unchanged from the fallback it had before the namespace (i18n-labels.test pins it).\n    qrAlt: \"QR code\",\n    secretHint: \"Can’t scan it? Enter this key in the app instead:\",\n    copySecret: \"Copy key\",\n    title: \"Two-factor authentication\",\n  },\n  passkeys: {\n    title: \"Passkeys\",\n    description: \"Sign in with your fingerprint, face or device PIN instead of a password.\",\n    // Kurvenschmiede overrode `description` because \"instead of\" is false where the\n    // password stays; this is the sentence for those apps, picked by `mode`.\n    descriptionAlongside: \"Sign in with your fingerprint, face or device PIN. Your password keeps working too.\",\n    empty: \"No passkeys yet\",\n    loading: \"Loading passkeys…\",\n    list: \"Your passkeys\",\n    nameLabel: \"Name (optional)\",\n    namePlaceholder: \"e.g. Laptop, Phone\",\n    add: \"Add passkey\",\n    adding: \"Waiting for your device…\",\n    rename: \"Rename\",\n    renameItem: (name) => `Rename ${name}`,\n    renameField: (name) => `New name for ${name}`,\n    save: \"Save\",\n    cancel: \"Cancel\",\n    delete: \"Delete\",\n    deleteItem: (name) => `Delete ${name}`,\n    deleteConfirm: (name) => `Delete “${name}”? It can no longer be used to sign in.`,\n    confirmDelete: \"Delete passkey\",\n    created: (date) => `Added ${date}`,\n    lastUsed: (date) => `Last used ${date}`,\n    neverUsed: \"Never used\",\n  },\n};\n\n/**\n * One section of the namespace, resolved: English, then the provider's\n * `accountSettings.<section>`, then the component's own `labels` prop. An `undefined`\n * in either source is skipped, so a prop object built from optional values cannot\n * blank out a default.\n */\nexport function useAccountSettingsLabels<K extends keyof AccountSettingsLabels>(\n  section: K,\n  prop?: Partial<AccountSettingsLabels[K]>,\n): AccountSettingsLabels[K] {\n  const fromProvider = useKitLabelOverrides(\"accountSettings\")?.[section] as\n    | Partial<AccountSettingsLabels[K]>\n    | undefined;\n  return useMemo(\n    () => ({\n      ...DEFAULT_ACCOUNT_SETTINGS_LABELS[section],\n      ...definedOnly(fromProvider),\n      ...definedOnly(prop),\n    }),\n    [section, fromProvider, prop],\n  );\n}\n\nfunction definedOnly<T extends object>(value: T | undefined): Partial<T> {\n  if (!value) return {};\n  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined)) as Partial<T>;\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,4BAA4B;AAyI9B,MAAM,kCAAyD;AAAA,EACpE,SAAS;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,MAAM;AAAA,IACN,aAAa;AAAA,IACb,aAAa;AAAA,IACb,MAAM;AAAA,IACN,WAAW;AAAA,IACX,UAAU;AAAA,IACV,cAAc;AAAA,EAChB;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA,WAAW;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,IAET,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,OAAO;AAAA,EACT;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,aAAa;AAAA;AAAA;AAAA,IAGb,sBAAsB;AAAA,IACtB,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,iBAAiB;AAAA,IACjB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,YAAY,CAAC,SAAS,UAAU,IAAI;AAAA,IACpC,aAAa,CAAC,SAAS,gBAAgB,IAAI;AAAA,IAC3C,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,YAAY,CAAC,SAAS,UAAU,IAAI;AAAA,IACpC,eAAe,CAAC,SAAS,gBAAW,IAAI;AAAA,IACxC,eAAe;AAAA,IACf,SAAS,CAAC,SAAS,SAAS,IAAI;AAAA,IAChC,UAAU,CAAC,SAAS,aAAa,IAAI;AAAA,IACrC,WAAW;AAAA,EACb;AACF;AAQO,SAAS,yBACd,SACA,MAC0B;AAC1B,QAAM,eAAe,qBAAqB,iBAAiB,IAAI,OAAO;AAGtE,SAAO;AAAA,IACL,OAAO;AAAA,MACL,GAAG,gCAAgC,OAAO;AAAA,MAC1C,GAAG,YAAY,YAAY;AAAA,MAC3B,GAAG,YAAY,IAAI;AAAA,IACrB;AAAA,IACA,CAAC,SAAS,cAAc,IAAI;AAAA,EAC9B;AACF;AAEA,SAAS,YAA8B,OAAkC;AACvE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,MAAM,MAAS,CAAC;AACpF;","names":[]}

package/dist/components/account-settings.d.ts

@@ -29,6 +29,8 @@ interface ProfileSettingCommonProps {
     saving?: boolean;
     /** Prop > `<UiKitProvider labels={{ accountSettings: { profile } }}>` > English. */
     labels?: Partial<ProfileSettingLabels>;
+    /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */
+    id?: string;
 }
 /**
  * The single display name, as before 0.30.0 — controlled through `value` / `onChange`,
@@ -87,7 +89,7 @@ declare function ProfileSetting(props: ProfileSettingProps): react.JSX.Element;
  * (the card's own prop, which the submit enforces as well).
  */
 type PasswordSettingStrength = Pick<PasswordStrengthMeterProps, "score" | "showRequirements" | "labels">;
-declare function PasswordSetting({ onSubmit, pending, minLength, strength, maxBytes, labels: labelsProp, }: {
+declare function PasswordSetting({ onSubmit, pending, minLength, strength, maxBytes, labels: labelsProp, id, }: {
     /** Called with the validated (current, new) pair; return a promise to auto-clear on success. */
     onSubmit: (currentPassword: string, newPassword: string) => void | Promise<unknown>;
     pending?: boolean;
@@ -117,6 +119,8 @@ declare function PasswordSetting({ onSubmit, pending, minLength, strength, maxBy
     maxBytes?: number;
     /** Prop > `<UiKitProvider labels={{ accountSettings: { password } }}>` > English. */
     labels?: Partial<PasswordSettingLabels>;
+    /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */
+    id?: string;
 }): react.JSX.Element;
 /**
  * What the app's setup call returned.
@@ -134,7 +138,7 @@ type TwoFactorSetupData = {
     otpauthUri: string;
     secret?: string;
 };
-declare function TwoFactorSetting({ enabled, setup, onStartSetup, onEnable, onDisable, busy, renderQr, labels: labelsProp, }: {
+declare function TwoFactorSetting({ enabled, setup, onStartSetup, onEnable, onDisable, busy, renderQr, labels: labelsProp, id, }: {
     enabled: boolean;
     /** What the app's setup call returned; null before setup starts. */
     setup: TwoFactorSetupData | null;
@@ -147,6 +151,8 @@ declare function TwoFactorSetting({ enabled, setup, onStartSetup, onEnable, onDi
     renderQr?: (otpauthUri: string) => ReactNode;
     /** Prop > `<UiKitProvider labels={{ accountSettings: { twoFactor } }}>` > English. */
     labels?: Partial<TwoFactorSettingLabels>;
+    /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */
+    id?: string;
 }): react.JSX.Element;
 
 export { PasswordSetting, PasswordSettingLabels, type PasswordSettingStrength, type ProfileNameValues, ProfileSetting, type ProfileSettingDisplayNameProps, ProfileSettingLabels, type ProfileSettingNamesProps, type ProfileSettingProps, TwoFactorSetting, TwoFactorSettingLabels, type TwoFactorSetupData };

package/dist/components/account-settings.js

@@ -13,14 +13,16 @@ import {
   passwordByteLength,
   PasswordStrengthMeter
 } from "./password-strength.js";
-import { DEFAULT_COMMON_LABELS, useKitLabels } from "../i18n/kit-labels.js";
+import { useKitLabelOverrides, useKitLabels } from "../i18n/kit-labels.js";
+import { Chip } from "./chip.js";
 import { useAccountSettingsLabels } from "./account-settings-labels.js";
+import { SettingsCardTitle } from "../settings/settings-heading.js";
 import { DEFAULT_ACCOUNT_SETTINGS_LABELS } from "./account-settings-labels.js";
 function ProfileSetting(props) {
-  const { name, email, role, memberSince, labels: labelsProp } = props;
+  const { name, email, role, memberSince, labels: labelsProp, id } = props;
   const labels = useAccountSettingsLabels("profile", labelsProp);
   const names = props.firstName !== void 0 || props.lastName !== void 0;
-  return /* @__PURE__ */ jsxs(Card, { className: "p-4 space-y-3", children: [
+  return /* @__PURE__ */ jsxs(Card, { id, className: "p-4 space-y-3", children: [
     /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3", children: [
       /* @__PURE__ */ jsx(
         UserAvatar,
@@ -32,7 +34,7 @@ function ProfileSetting(props) {
         }
       ),
       /* @__PURE__ */ jsxs("div", { className: "min-w-0", children: [
-        /* @__PURE__ */ jsx("div", { className: "text-sm font-medium", children: labels.title }),
+        /* @__PURE__ */ jsx(SettingsCardTitle, { children: labels.title }),
         /* @__PURE__ */ jsxs("div", { className: "truncate font-mono text-xs text-[var(--text-muted)]", children: [
           /* @__PURE__ */ jsxs("span", { className: "sr-only", children: [
             labels.email,
@@ -167,7 +169,8 @@ function PasswordSetting({
   minLength = 8,
   strength,
   maxBytes,
-  labels: labelsProp
+  labels: labelsProp,
+  id
 }) {
   const labels = useAccountSettingsLabels("password", labelsProp);
   const strengthOptions = typeof strength === "object" ? strength : void 0;
@@ -199,8 +202,8 @@ function PasswordSetting({
     }
   };
   const nextField = /* @__PURE__ */ jsx(Input, { type: "password", autoComplete: "new-password", label: labels.next, value: next, onChange: (e) => setNext(e.target.value) });
-  return /* @__PURE__ */ jsxs(Card, { className: "p-4 space-y-3", children: [
-    /* @__PURE__ */ jsx("div", { className: "text-sm font-medium", children: labels.title }),
+  return /* @__PURE__ */ jsxs(Card, { id, className: "p-4 space-y-3", children: [
+    /* @__PURE__ */ jsx(SettingsCardTitle, { children: labels.title }),
     /* @__PURE__ */ jsx(Input, { type: "password", autoComplete: "current-password", label: labels.current, value: current, onChange: (e) => setCurrent(e.target.value) }),
     strength ? (
       // One box for the field and its meter, so the card's `space-y-3` spaces the pair
@@ -245,15 +248,20 @@ function TwoFactorSetting({
   onDisable,
   busy,
   renderQr,
-  labels: labelsProp
+  labels: labelsProp,
+  id
 }) {
   const labels = useAccountSettingsLabels("twoFactor", labelsProp);
+  const overrides = useKitLabelOverrides("accountSettings")?.twoFactor;
+  const title = labelsProp?.title ?? overrides?.title ?? labelsProp?.status ?? overrides?.status ?? labels.title;
   const [code, setCode] = useState("");
   const [password, setPassword] = useState("");
-  const common = useKitLabels("common", DEFAULT_COMMON_LABELS);
   const secret = setup ? setup.secret ?? ("otpauthUri" in setup ? otpauthSecret(setup.otpauthUri) : null) : null;
-  return /* @__PURE__ */ jsxs(Card, { className: "p-4 space-y-3", children: [
-    /* @__PURE__ */ jsx("div", { className: "text-sm", children: common.fieldValue(labels.status, enabled ? labels.enabledText : labels.disabledText) }),
+  return /* @__PURE__ */ jsxs(Card, { id, className: "p-4 space-y-3", children: [
+    /* @__PURE__ */ jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2", children: [
+      /* @__PURE__ */ jsx(SettingsCardTitle, { children: title }),
+      /* @__PURE__ */ jsx(Chip, { size: "sm", tone: enabled ? "success" : "neutral", children: enabled ? labels.enabledText : labels.disabledText })
+    ] }),
     !enabled && !setup && /* @__PURE__ */ jsx(Button, { onClick: onStartSetup, disabled: busy, children: labels.enable }),
     setup && /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
       /* @__PURE__ */ jsx("div", { className: "text-xs text-[var(--text-secondary)]", children: labels.scanHint }),