@eifi1/ui-kit 0.30.0 → 0.31.1

package/dist/landing/page-seo.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/landing/page-seo.ts"],"sourcesContent":["import { useEffect } from \"react\";\n\n/**\n * Search-engine helpers for the public landing page (docs/landing-demo-harmonization.md\n * §4.3): the hook that declares a page's canonical URL, title, description and JSON-LD,\n * and the two pure helpers each app's SEO test is built from.\n */\n\n/**\n * Declares the current page's canonical URL — and optionally its title and meta\n * description — while the calling component is mounted (feedback #129).\n *\n * Client-side because there is nowhere else to put it: the SPA is served by\n * Caddy's `try_files … /index.html`, so every route shares one static head.\n * Googlebot renders JS and reads the canonical from the RENDERED DOM, which is\n * what makes this work; non-rendering scrapers (WhatsApp, Slack) only ever see\n * index.html's static tags, which is why those stay in place as the fallback.\n *\n * The href is resolved against `window.location.origin` rather than hardcoded, so\n * a preview deployment or the VPS host stays self-referential instead of pointing\n * every copy of the app at production.\n *\n * The cleanup matters for the same reason as in {@link useNoIndex}: an SPA\n * navigation from the landing page into the app must not leave the landing's\n * canonical (or title) behind on an app page.\n *\n * 0.31 (§4.3): keksdose's `usePageSeo` (shared/hooks/use-page-seo.ts), verbatim. The\n * landing calls it with `canonicalPath: \"/\"` on both `/` and `/welcome`, so the two URLs\n * of one page are one result; there are no per-language URLs and no hreflang.\n */\nexport function usePageSeo({\n  canonicalPath,\n  title,\n  description,\n  jsonLd,\n}: {\n  canonicalPath: string;\n  title?: string;\n  description?: string;\n  /** Structured data for this page, as the object (not a string). Injected as an\n   *  `application/ld+json` DATA BLOCK — a script element the browser never executes,\n   *  which is also why it can be added here rather than in `index.html`: the CSP\n   *  carries a HASH of the one inline script that file is allowed to have, and\n   *  `csp-inline-script.test.ts` fails the build on a second one (live #250). */\n  jsonLd?: Record<string, unknown>;\n}): void {\n  useEffect(() => {\n    const link = document.createElement(\"link\");\n    link.rel = \"canonical\";\n    link.href = new URL(canonicalPath, window.location.origin).toString();\n    document.head.appendChild(link);\n\n    const previousTitle = document.title;\n    if (title) document.title = title;\n\n    // The description tag ships in index.html, so upsert rather than append —\n    // two `meta[name=description]` tags would be a coin flip for the scraper.\n    const meta = description\n      ? document.head.querySelector<HTMLMetaElement>('meta[name=\"description\"]')\n      : null;\n    const previousDescription = meta?.content;\n    if (meta && description) meta.content = description;\n\n    let ld: HTMLScriptElement | null = null;\n    if (jsonLd) {\n      ld = document.createElement(\"script\");\n      ld.type = \"application/ld+json\";\n      ld.textContent = JSON.stringify(jsonLd);\n      document.head.appendChild(ld);\n    }\n\n    return () => {\n      link.remove();\n      ld?.remove();\n      if (title) document.title = previousTitle;\n      if (meta && previousDescription !== undefined) meta.content = previousDescription;\n    };\n    // `jsonLd` is built inline by the caller, so it is a new object every render and\n    // cannot be a dependency — it is derived from `title`/`description`, which are.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [canonicalPath, title, description]);\n}\n\n/* ── The SEO test's helpers ──────────────────────────────────────────────── */\n\n/** What a search result shows of the landing, in one language. */\nexport interface SeoCopy {\n  /** The page title (`landing.seo.title`): \"Keksdose — envelope budgeting\". */\n  title: string;\n  /** The meta description. */\n  description: string;\n  /** The product name the title carries, before or after its tagline. */\n  brand: string;\n}\n\n/** The width budgets, as characters. */\nexport interface SeoCopyLimits {\n  /** Default 60: a result's title is cut around 580px. */\n  maxTitle?: number;\n  /** Default 155: a snippet is cut around 920px. */\n  maxDescription?: number;\n}\n\nexport type SeoCopyProblemCode =\n  | \"title-empty\"\n  | \"description-empty\"\n  | \"title-too-long\"\n  | \"description-too-long\"\n  | \"title-without-brand\"\n  | \"description-repeats-title\";\n\n/** One thing wrong with a language's copy. `message` is for the test's failure output. */\nexport interface SeoCopyProblem {\n  code: SeoCopyProblemCode;\n  message: string;\n}\n\n/** Characters as a reader counts them: code points, so an emoji or a rare CJK character\n *  is one, not two UTF-16 units. */\nconst length = (text: string) => Array.from(text).length;\n\nconst escapeRegExp = (text: string) => text.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\n/** The separators a title puts between the brand and its tagline. */\nconst SEPARATOR = \"\\\\s*[—–\\\\-|:·•]\\\\s*\";\n\n/** The title without the brand and its separator, or `null` when the brand is in\n *  neither place. */\nfunction taglineOf(title: string, brand: string): string | null {\n  const name = escapeRegExp(brand.trim());\n  const leading = new RegExp(`^${name}${SEPARATOR}`, \"i\");\n  if (leading.test(title)) return title.replace(leading, \"\").trim();\n  const trailing = new RegExp(`${SEPARATOR}${name}$`, \"i\");\n  if (trailing.test(title)) return title.replace(trailing, \"\").trim();\n  return null;\n}\n\n/**\n * What is wrong with one language's search-result copy (§4.3) — an empty list when\n * nothing is. keksdose's landing-seo.test.ts (live #305), made reusable:\n *\n * - the title fits `maxTitle` characters (60) and the description `maxDescription`\n *   (155) — conservative stand-ins for Google's pixel budgets; German is the language\n *   most likely to blow through them, and what gets cut is always the end;\n * - the title carries the brand, before or after its tagline (\"Keksdose — …\");\n * - the description does not open with the title's tagline again — a snippet that\n *   repeats the line above it spends its first forty characters saying nothing new.\n *\n * ```ts\n * for (const [locale, bundle] of Object.entries(LOCALES)) {\n *   it(`fits ${locale} into a search result`, () => {\n *     expect(seoCopyProblems({ ...bundle.landing.seo, brand: \"Keksdose\" })).toEqual([]);\n *   });\n * }\n * ```\n */\nexport function seoCopyProblems(copy: SeoCopy, limits: SeoCopyLimits = {}): SeoCopyProblem[] {\n  const { maxTitle = 60, maxDescription = 155 } = limits;\n  const title = copy.title.replace(/\\s+/g, \" \").trim();\n  const description = copy.description.replace(/\\s+/g, \" \").trim();\n  const problems: SeoCopyProblem[] = [];\n  if (!title) problems.push({ code: \"title-empty\", message: \"the title is empty\" });\n  if (!description) problems.push({ code: \"description-empty\", message: \"the description is empty\" });\n  if (length(title) > maxTitle) {\n    problems.push({\n      code: \"title-too-long\",\n      message: `the title is ${length(title)} characters, over ${maxTitle}: \"${title}\"`,\n    });\n  }\n  if (length(description) > maxDescription) {\n    problems.push({\n      code: \"description-too-long\",\n      message: `the description is ${length(description)} characters, over ${maxDescription}: \"${description}\"`,\n    });\n  }\n  if (!title) return problems;\n  const tagline = taglineOf(title, copy.brand);\n  if (tagline === null) {\n    problems.push({\n      code: \"title-without-brand\",\n      message: `the title does not start or end with \"${copy.brand}\" and a separator: \"${title}\"`,\n    });\n  }\n  const repeated = (tagline ?? title).toLowerCase();\n  if (repeated && description.toLowerCase().startsWith(repeated)) {\n    problems.push({\n      code: \"description-repeats-title\",\n      message: `the description opens with the title's tagline \"${tagline ?? title}\"`,\n    });\n  }\n  return problems;\n}\n\n/** The five named references and the numeric ones — enough for a meta tag's text. */\nfunction decodeEntities(text: string): string {\n  const named: Record<string, string> = { amp: \"&\", lt: \"<\", gt: \">\", quot: '\"', apos: \"'\", nbsp: \" \" };\n  return text.replace(/&(#x[\\da-f]+|#\\d+|[a-z]+);/gi, (whole, ref: string) => {\n    if (ref[0] === \"#\") {\n      const code = ref[1] === \"x\" || ref[1] === \"X\" ? parseInt(ref.slice(2), 16) : parseInt(ref.slice(1), 10);\n      return Number.isFinite(code) ? String.fromCodePoint(code) : whole;\n    }\n    return named[ref.toLowerCase()] ?? whole;\n  });\n}\n\n/** A tag's attributes, names lower-cased; values double-, single- or un-quoted. */\nfunction attributesOf(tag: string): Map<string, string> {\n  const found = new Map<string, string>();\n  for (const m of tag.matchAll(/([^\\s=/<>\"']+)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s\"'=<>`]+))/g)) {\n    found.set(m[1]!.toLowerCase(), m[2] ?? m[3] ?? m[4] ?? \"\");\n  }\n  return found;\n}\n\n/**\n * The `content` of the first `<meta>` in `html` that `selector` picks, whitespace\n * collapsed and entities decoded — or `undefined` when there is none. For each app's\n * parity test (§4.3): `index.html`'s static description and `og:` tags must equal the\n * default language's strings, because a scraper that runs no script (WhatsApp, Slack)\n * sees only those.\n *\n * `selector` names attributes, as in CSS — `meta[name=\"description\"]`,\n * `[property=\"og:title\"]` or just `property=\"og:description\"` — and every one named must\n * match. A `RegExp` is matched against the tag's source instead (keksdose's form).\n * String parsing, not a DOM: the test runs under `@vitest-environment node`.\n *\n * ```ts\n * expect(metaContent(html, 'meta[name=\"description\"]')).toBe(de.landing.seo.description);\n * ```\n */\nexport function metaContent(html: string, selector: string | RegExp): string | undefined {\n  const wanted =\n    typeof selector === \"string\"\n      ? Array.from(selector.matchAll(/([\\w:.-]+)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)')/g), (m) => [\n          m[1]!.toLowerCase(),\n          m[2] ?? m[3] ?? \"\",\n        ])\n      : null;\n  if (wanted !== null && wanted.length === 0) {\n    throw new Error(`metaContent: the selector names no attribute: ${selector as string}`);\n  }\n  const pattern = selector instanceof RegExp ? new RegExp(selector.source, selector.flags.replace(\"g\", \"\")) : null;\n  for (const tag of html.match(/<meta\\b[^>]*>/gi) ?? []) {\n    const attrs = attributesOf(tag);\n    const matches = pattern ? pattern.test(tag) : wanted!.every(([name, value]) => attrs.get(name!) === value);\n    if (!matches) continue;\n    const content = attrs.get(\"content\");\n    return content === undefined ? undefined : decodeEntities(content).replace(/\\s+/g, \" \").trim();\n  }\n  return undefined;\n}\n"],"mappings":";AAAA,SAAS,iBAAiB;AA8BnB,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAUS;AACP,YAAU,MAAM;AACd,UAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,SAAK,MAAM;AACX,SAAK,OAAO,IAAI,IAAI,eAAe,OAAO,SAAS,MAAM,EAAE,SAAS;AACpE,aAAS,KAAK,YAAY,IAAI;AAE9B,UAAM,gBAAgB,SAAS;AAC/B,QAAI,MAAO,UAAS,QAAQ;AAI5B,UAAM,OAAO,cACT,SAAS,KAAK,cAA+B,0BAA0B,IACvE;AACJ,UAAM,sBAAsB,MAAM;AAClC,QAAI,QAAQ,YAAa,MAAK,UAAU;AAExC,QAAI,KAA+B;AACnC,QAAI,QAAQ;AACV,WAAK,SAAS,cAAc,QAAQ;AACpC,SAAG,OAAO;AACV,SAAG,cAAc,KAAK,UAAU,MAAM;AACtC,eAAS,KAAK,YAAY,EAAE;AAAA,IAC9B;AAEA,WAAO,MAAM;AACX,WAAK,OAAO;AACZ,UAAI,OAAO;AACX,UAAI,MAAO,UAAS,QAAQ;AAC5B,UAAI,QAAQ,wBAAwB,OAAW,MAAK,UAAU;AAAA,IAChE;AAAA,EAIF,GAAG,CAAC,eAAe,OAAO,WAAW,CAAC;AACxC;AAsCA,MAAM,SAAS,CAAC,SAAiB,MAAM,KAAK,IAAI,EAAE;AAElD,MAAM,eAAe,CAAC,SAAiB,KAAK,QAAQ,uBAAuB,MAAM;AAGjF,MAAM,YAAY;AAIlB,SAAS,UAAU,OAAe,OAA8B;AAC9D,QAAM,OAAO,aAAa,MAAM,KAAK,CAAC;AACtC,QAAM,UAAU,IAAI,OAAO,IAAI,IAAI,GAAG,SAAS,IAAI,GAAG;AACtD,MAAI,QAAQ,KAAK,KAAK,EAAG,QAAO,MAAM,QAAQ,SAAS,EAAE,EAAE,KAAK;AAChE,QAAM,WAAW,IAAI,OAAO,GAAG,SAAS,GAAG,IAAI,KAAK,GAAG;AACvD,MAAI,SAAS,KAAK,KAAK,EAAG,QAAO,MAAM,QAAQ,UAAU,EAAE,EAAE,KAAK;AAClE,SAAO;AACT;AAqBO,SAAS,gBAAgB,MAAe,SAAwB,CAAC,GAAqB;AAC3F,QAAM,EAAE,WAAW,IAAI,iBAAiB,IAAI,IAAI;AAChD,QAAM,QAAQ,KAAK,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACnD,QAAM,cAAc,KAAK,YAAY,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAC/D,QAAM,WAA6B,CAAC;AACpC,MAAI,CAAC,MAAO,UAAS,KAAK,EAAE,MAAM,eAAe,SAAS,qBAAqB,CAAC;AAChF,MAAI,CAAC,YAAa,UAAS,KAAK,EAAE,MAAM,qBAAqB,SAAS,2BAA2B,CAAC;AAClG,MAAI,OAAO,KAAK,IAAI,UAAU;AAC5B,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,gBAAgB,OAAO,KAAK,CAAC,qBAAqB,QAAQ,MAAM,KAAK;AAAA,IAChF,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,IAAI,gBAAgB;AACxC,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,sBAAsB,OAAO,WAAW,CAAC,qBAAqB,cAAc,MAAM,WAAW;AAAA,IACxG,CAAC;AAAA,EACH;AACA,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,UAAU,OAAO,KAAK,KAAK;AAC3C,MAAI,YAAY,MAAM;AACpB,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,yCAAyC,KAAK,KAAK,uBAAuB,KAAK;AAAA,IAC1F,CAAC;AAAA,EACH;AACA,QAAM,YAAY,WAAW,OAAO,YAAY;AAChD,MAAI,YAAY,YAAY,YAAY,EAAE,WAAW,QAAQ,GAAG;AAC9D,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,mDAAmD,WAAW,KAAK;AAAA,IAC9E,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGA,SAAS,eAAe,MAAsB;AAC5C,QAAM,QAAgC,EAAE,KAAK,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,OAAI;AACpG,SAAO,KAAK,QAAQ,gCAAgC,CAAC,OAAO,QAAgB;AAC1E,QAAI,IAAI,CAAC,MAAM,KAAK;AAClB,YAAM,OAAO,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,MAAM,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE;AACtG,aAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,IAC9D;AACA,WAAO,MAAM,IAAI,YAAY,CAAC,KAAK;AAAA,EACrC,CAAC;AACH;AAGA,SAAS,aAAa,KAAkC;AACtD,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,KAAK,IAAI,SAAS,8DAA8D,GAAG;AAC5F,UAAM,IAAI,EAAE,CAAC,EAAG,YAAY,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE;AAAA,EAC3D;AACA,SAAO;AACT;AAkBO,SAAS,YAAY,MAAc,UAA+C;AACvF,QAAM,SACJ,OAAO,aAAa,WAChB,MAAM,KAAK,SAAS,SAAS,2CAA2C,GAAG,CAAC,MAAM;AAAA,IAChF,EAAE,CAAC,EAAG,YAAY;AAAA,IAClB,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK;AAAA,EAClB,CAAC,IACD;AACN,MAAI,WAAW,QAAQ,OAAO,WAAW,GAAG;AAC1C,UAAM,IAAI,MAAM,iDAAiD,QAAkB,EAAE;AAAA,EACvF;AACA,QAAM,UAAU,oBAAoB,SAAS,IAAI,OAAO,SAAS,QAAQ,SAAS,MAAM,QAAQ,KAAK,EAAE,CAAC,IAAI;AAC5G,aAAW,OAAO,KAAK,MAAM,iBAAiB,KAAK,CAAC,GAAG;AACrD,UAAM,QAAQ,aAAa,GAAG;AAC9B,UAAM,UAAU,UAAU,QAAQ,KAAK,GAAG,IAAI,OAAQ,MAAM,CAAC,CAAC,MAAM,KAAK,MAAM,MAAM,IAAI,IAAK,MAAM,KAAK;AACzG,QAAI,CAAC,QAAS;AACd,UAAM,UAAU,MAAM,IAAI,SAAS;AACnC,WAAO,YAAY,SAAY,SAAY,eAAe,OAAO,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,EAC/F;AACA,SAAO;AACT;","names":[]}

package/dist/landing/public-header.d.ts

@@ -0,0 +1,148 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+import { TopBarProps } from '../shell/top-bar.js';
+import { AccessChoice } from './access.js';
+import { LandingLabels } from './landing-labels.js';
+import { LandingSession } from './landing-actions.js';
+import '../delete-account-setting-CpIhzxxZ.js';
+import '../components/tooltip.js';
+import '../hooks/use-anchored-rect.js';
+import '../lib/clipping.js';
+import '../data-table-labels-DUELeXpa.js';
+import '../components/data-table-sort.js';
+import '../components/swipeable-row.js';
+import '../components/mini-calendar.js';
+import '../components/calendar-heatmap.js';
+import '../components/popover.js';
+import '../components/chip.js';
+import 'lucide-react';
+import '../components/field-sync.js';
+import '../wizard/types.js';
+import '../tour/tour.js';
+import '../search/command-palette.js';
+import '../search/global-search.js';
+import '../search/search-index.js';
+import '../components/month-picker.js';
+import '../components/page-contents.js';
+import '../components/series-chart-labels.js';
+import '../components/pie-chart-labels.js';
+import '../components/sparkline.js';
+import '../components/stat-tile.js';
+import '../components/signature-pad.js';
+import '../components/password-strength.js';
+import '../components/swatch-picker.js';
+import '../components/tile-radio.js';
+import '../components/icon-picker.js';
+import '../components/dialog-frame.js';
+import '../components/modal.js';
+import '../hooks/use-search-param-state.js';
+import '../components/measured-grid.js';
+import '../components/user-avatar.js';
+import '../lib/person-name.js';
+import '../components/status-dot.js';
+import '../components/progress-bar.js';
+import '../components/signed-amount.js';
+import '../shell/topbar-action-menu.js';
+import '../components/menu-item.js';
+import '../components/floating-panel.js';
+import '../hooks/use-authed-src.js';
+import '../components/account-settings-labels.js';
+import '../components/bulk-action-bar.js';
+import '../components/list.js';
+import '../components/breadcrumbs.js';
+import '../components/toast.js';
+import '../components/description-list.js';
+import '../components/line-items.js';
+import '../components/error-boundary.js';
+import '../components/authed-image.js';
+import '../components/image-grid.js';
+import '../components/lightbox.js';
+import '../components/write-lock.js';
+import '../auth/sign-in-form.js';
+import '../shell/topbar-controls.js';
+import '../theme/palette-presets.js';
+import '../theme/chart-palette.js';
+import '../theme/theme-store.js';
+import 'zustand/middleware';
+import 'zustand';
+import '../auth/complete-name-dialog.js';
+import '../auth/forgot-password-form.js';
+import '../auth/status-parts.js';
+import '../auth/reset-password-form.js';
+import '../auth/verify-email.js';
+import '../auth/not-found-page.js';
+import '../auth/accept-invitation.js';
+import '../shell/company-switcher.js';
+import '../account/email-change-setting.js';
+import '../account/sessions-setting.js';
+import '../lib/format.js';
+import '../account/data-export-setting.js';
+import '../components/account-chips.js';
+import '../admin/admin-parts.js';
+import '../admin/admin-action-log.js';
+import '../settings/settings-labels.js';
+import '../demo/demo-labels.js';
+import '../components/reauth-dialog.js';
+import '../components/server-wake.js';
+import '../lib/server-wake.js';
+import '../components/translation-review-labels.js';
+import '../lib/translation-review.js';
+import '../components/country-select.js';
+import '../components/inline-edit-field.js';
+import '../lib/iban.js';
+import '../lib/phone.js';
+import '../components/sign-chip.js';
+import '../components/column-mapper.js';
+import '../lib/column-mapping.js';
+import '../lib/table-text.js';
+import '../components/field-parts.js';
+
+/** The header's brand: what `TopBarBrand` draws. */
+interface PublicHeaderBrand {
+    /** The brand mark — an SVG or an `<img alt="">`. */
+    logo: ReactNode;
+    /** The product name beside it, and the link's accessible name. */
+    name: ReactNode;
+    /** See `TopBarBrand`. Default `sm`: the logo alone on a phone. */
+    collapseBelow?: "sm" | "md" | false;
+}
+interface PublicHeaderProps extends Omit<TopBarProps, "brand" | "actions" | "children"> {
+    brand: PublicHeaderBrand;
+    /** Where the brand links. Default `/` without a session and `/welcome` with one —
+     *  `/` would resume into the app, `/welcome` is always the landing (§3.1). */
+    homeHref?: string;
+    session: LandingSession;
+    access: AccessChoice;
+    /** "Sign in". Default `/login`. */
+    signInHref?: string;
+    /** "Open app" for a real session — the resume target. Default `/`, which resumes
+     *  through `RootEntry`. */
+    openAppHref?: string;
+    /** "Continue the demo" for a demo session. Default `/demo`, which continues a live
+     *  demo (§3.1). */
+    demoHref?: string;
+    /** The app's `LanguageMenu`, before the actions. */
+    languageMenu?: ReactNode;
+    /** The app's `ThemeToggle`, before the language menu. */
+    themeToggle?: ReactNode;
+    labels?: Partial<LandingLabels>;
+}
+/**
+ * The header of every public page (docs/landing-demo-harmonization.md §4.1): the
+ * landing, the auth pages, the legal pages and the 404 — keksdose's `LandingHeader`, on
+ * the kit's `TopBar` and `TopBarBrand`, with its hard-coded teal turned into `--brand`.
+ *
+ * | session | actions |
+ * |---|---|
+ * | none | Sign in (secondary, hidden below `sm`), **Request access** (primary) |
+ * | demo | Continue the demo (secondary), **Request access** (primary) |
+ * | user | **Open app** (primary) |
+ *
+ * A demo session is not "signed in" here: it is still offered access, which is the point
+ * of the demo (§5.6). On a phone (`PHONE_QUERY`) the actions take the kit's `sm` size, so
+ * the brand mark, the two controls and two actions fit 390px; "Sign in" gives way below
+ * `sm` as in keksdose — the sign-in page is one tap away from "Request access" anyway.
+ */
+declare function PublicHeader({ brand, homeHref, session, access, signInHref, openAppHref, demoHref, languageMenu, themeToggle, labels: labelsProp, className, ...rest }: PublicHeaderProps): react.JSX.Element;
+
+export { PublicHeader, type PublicHeaderBrand, type PublicHeaderProps };

package/dist/landing/public-header.js

@@ -0,0 +1,49 @@
+"use client";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { Button, PHONE_QUERY } from "../components/ui.js";
+import { useMediaQuery } from "../hooks/use-media-query.js";
+import { TopBar } from "../shell/top-bar.js";
+import { TopBarBrand } from "../shell/top-bar-brand.js";
+import { useAccessAction } from "./access.js";
+import { useLandingLabels } from "./landing-labels.js";
+function PublicHeader({
+  brand,
+  homeHref,
+  session,
+  access,
+  signInHref = "/login",
+  openAppHref = "/",
+  demoHref = "/demo",
+  languageMenu,
+  themeToggle,
+  labels: labelsProp,
+  className,
+  ...rest
+}) {
+  const labels = useLandingLabels(labelsProp);
+  const accessLink = useAccessAction(access, labelsProp);
+  const phone = useMediaQuery(PHONE_QUERY, false);
+  const size = phone ? "sm" : "md";
+  const home = homeHref ?? (session === "none" ? "/" : "/welcome");
+  const actions = session === "user" ? /* @__PURE__ */ jsx(Button, { href: openAppHref, variant: "brand", size, children: labels.openApp }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+    session === "demo" ? /* @__PURE__ */ jsx(Button, { href: demoHref, variant: "secondary", size, children: labels.continueDemo }) : /* @__PURE__ */ jsx(Button, { href: signInHref, variant: "secondary", size, className: "max-sm:hidden", children: labels.signIn }),
+    /* @__PURE__ */ jsx(Button, { href: accessLink.href, variant: "brand", size, children: accessLink.label })
+  ] });
+  return /* @__PURE__ */ jsx(
+    TopBar,
+    {
+      ...rest,
+      className,
+      brand: /* @__PURE__ */ jsx(TopBarBrand, { logo: brand.logo, name: brand.name, to: home, collapseBelow: brand.collapseBelow }),
+      actions: /* @__PURE__ */ jsxs(Fragment, { children: [
+        themeToggle,
+        languageMenu,
+        /* @__PURE__ */ jsx("span", { "data-slot": "public-header-actions", className: "ms-1 flex items-center gap-1.5 sm:gap-2", children: actions })
+      ] })
+    }
+  );
+}
+export {
+  PublicHeader
+};
+//# sourceMappingURL=public-header.js.map

package/dist/landing/public-header.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/landing/public-header.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\n\nimport { Button, PHONE_QUERY } from \"../components/ui\";\nimport { useMediaQuery } from \"../hooks/use-media-query\";\nimport { TopBar } from \"../shell/top-bar\";\nimport type { TopBarProps } from \"../shell/top-bar\";\nimport { TopBarBrand } from \"../shell/top-bar-brand\";\nimport { useAccessAction } from \"./access\";\nimport type { AccessChoice } from \"./access\";\nimport { useLandingLabels } from \"./landing-labels\";\nimport type { LandingLabels } from \"./landing-labels\";\nimport type { LandingSession } from \"./landing-actions\";\n\n/** The header's brand: what `TopBarBrand` draws. */\nexport interface PublicHeaderBrand {\n  /** The brand mark — an SVG or an `<img alt=\"\">`. */\n  logo: ReactNode;\n  /** The product name beside it, and the link's accessible name. */\n  name: ReactNode;\n  /** See `TopBarBrand`. Default `sm`: the logo alone on a phone. */\n  collapseBelow?: \"sm\" | \"md\" | false;\n}\n\nexport interface PublicHeaderProps extends Omit<TopBarProps, \"brand\" | \"actions\" | \"children\"> {\n  brand: PublicHeaderBrand;\n  /** Where the brand links. Default `/` without a session and `/welcome` with one —\n   *  `/` would resume into the app, `/welcome` is always the landing (§3.1). */\n  homeHref?: string;\n  session: LandingSession;\n  access: AccessChoice;\n  /** \"Sign in\". Default `/login`. */\n  signInHref?: string;\n  /** \"Open app\" for a real session — the resume target. Default `/`, which resumes\n   *  through `RootEntry`. */\n  openAppHref?: string;\n  /** \"Continue the demo\" for a demo session. Default `/demo`, which continues a live\n   *  demo (§3.1). */\n  demoHref?: string;\n  /** The app's `LanguageMenu`, before the actions. */\n  languageMenu?: ReactNode;\n  /** The app's `ThemeToggle`, before the language menu. */\n  themeToggle?: ReactNode;\n  labels?: Partial<LandingLabels>;\n}\n\n/**\n * The header of every public page (docs/landing-demo-harmonization.md §4.1): the\n * landing, the auth pages, the legal pages and the 404 — keksdose's `LandingHeader`, on\n * the kit's `TopBar` and `TopBarBrand`, with its hard-coded teal turned into `--brand`.\n *\n * | session | actions |\n * |---|---|\n * | none | Sign in (secondary, hidden below `sm`), **Request access** (primary) |\n * | demo | Continue the demo (secondary), **Request access** (primary) |\n * | user | **Open app** (primary) |\n *\n * A demo session is not \"signed in\" here: it is still offered access, which is the point\n * of the demo (§5.6). On a phone (`PHONE_QUERY`) the actions take the kit's `sm` size, so\n * the brand mark, the two controls and two actions fit 390px; \"Sign in\" gives way below\n * `sm` as in keksdose — the sign-in page is one tap away from \"Request access\" anyway.\n */\nexport function PublicHeader({\n  brand,\n  homeHref,\n  session,\n  access,\n  signInHref = \"/login\",\n  openAppHref = \"/\",\n  demoHref = \"/demo\",\n  languageMenu,\n  themeToggle,\n  labels: labelsProp,\n  className,\n  ...rest\n}: PublicHeaderProps) {\n  const labels = useLandingLabels(labelsProp);\n  const accessLink = useAccessAction(access, labelsProp);\n  const phone = useMediaQuery(PHONE_QUERY, false);\n  const size = phone ? \"sm\" : \"md\";\n  const home = homeHref ?? (session === \"none\" ? \"/\" : \"/welcome\");\n\n  const actions =\n    session === \"user\" ? (\n      <Button href={openAppHref} variant=\"brand\" size={size}>\n        {labels.openApp}\n      </Button>\n    ) : (\n      <>\n        {session === \"demo\" ? (\n          <Button href={demoHref} variant=\"secondary\" size={size}>\n            {labels.continueDemo}\n          </Button>\n        ) : (\n          <Button href={signInHref} variant=\"secondary\" size={size} className=\"max-sm:hidden\">\n            {labels.signIn}\n          </Button>\n        )}\n        <Button href={accessLink.href} variant=\"brand\" size={size}>\n          {accessLink.label}\n        </Button>\n      </>\n    );\n\n  return (\n    <TopBar\n      {...rest}\n      className={className}\n      brand={<TopBarBrand logo={brand.logo} name={brand.name} to={home} collapseBelow={brand.collapseBelow} />}\n      actions={\n        <>\n          {themeToggle}\n          {languageMenu}\n          <span data-slot=\"public-header-actions\" className=\"ms-1 flex items-center gap-1.5 sm:gap-2\">\n            {actions}\n          </span>\n        </>\n      }\n    />\n  );\n}\n"],"mappings":";AAmFM,SAIA,UAJA,KAIA,YAJA;AAjFN,SAAS,QAAQ,mBAAmB;AACpC,SAAS,qBAAqB;AAC9B,SAAS,cAAc;AAEvB,SAAS,mBAAmB;AAC5B,SAAS,uBAAuB;AAEhC,SAAS,wBAAwB;AAoD1B,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAAsB;AACpB,QAAM,SAAS,iBAAiB,UAAU;AAC1C,QAAM,aAAa,gBAAgB,QAAQ,UAAU;AACrD,QAAM,QAAQ,cAAc,aAAa,KAAK;AAC9C,QAAM,OAAO,QAAQ,OAAO;AAC5B,QAAM,OAAO,aAAa,YAAY,SAAS,MAAM;AAErD,QAAM,UACJ,YAAY,SACV,oBAAC,UAAO,MAAM,aAAa,SAAQ,SAAQ,MACxC,iBAAO,SACV,IAEA,iCACG;AAAA,gBAAY,SACX,oBAAC,UAAO,MAAM,UAAU,SAAQ,aAAY,MACzC,iBAAO,cACV,IAEA,oBAAC,UAAO,MAAM,YAAY,SAAQ,aAAY,MAAY,WAAU,iBACjE,iBAAO,QACV;AAAA,IAEF,oBAAC,UAAO,MAAM,WAAW,MAAM,SAAQ,SAAQ,MAC5C,qBAAW,OACd;AAAA,KACF;AAGJ,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ;AAAA,MACA,OAAO,oBAAC,eAAY,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,IAAI,MAAM,eAAe,MAAM,eAAe;AAAA,MACtG,SACE,iCACG;AAAA;AAAA,QACA;AAAA,QACD,oBAAC,UAAK,aAAU,yBAAwB,WAAU,2CAC/C,mBACH;AAAA,SACF;AAAA;AAAA,EAEJ;AAEJ;","names":[]}

package/dist/landing/routing.d.ts

@@ -0,0 +1,231 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+import { LandingSession } from './landing-actions.js';
+import '../delete-account-setting-CpIhzxxZ.js';
+import '../components/tooltip.js';
+import '../hooks/use-anchored-rect.js';
+import '../lib/clipping.js';
+import '../data-table-labels-DUELeXpa.js';
+import '../components/data-table-sort.js';
+import '../components/swipeable-row.js';
+import '../components/mini-calendar.js';
+import '../components/calendar-heatmap.js';
+import '../components/popover.js';
+import '../components/chip.js';
+import 'lucide-react';
+import '../components/field-sync.js';
+import '../wizard/types.js';
+import '../tour/tour.js';
+import '../search/command-palette.js';
+import '../search/global-search.js';
+import '../search/search-index.js';
+import '../components/month-picker.js';
+import '../components/page-contents.js';
+import '../components/series-chart-labels.js';
+import '../components/pie-chart-labels.js';
+import '../components/sparkline.js';
+import '../components/stat-tile.js';
+import '../components/signature-pad.js';
+import '../components/password-strength.js';
+import '../components/swatch-picker.js';
+import '../components/tile-radio.js';
+import '../components/icon-picker.js';
+import '../components/dialog-frame.js';
+import '../components/modal.js';
+import '../hooks/use-search-param-state.js';
+import '../components/measured-grid.js';
+import '../components/user-avatar.js';
+import '../lib/person-name.js';
+import '../components/status-dot.js';
+import '../components/progress-bar.js';
+import '../components/signed-amount.js';
+import '../shell/topbar-action-menu.js';
+import '../components/menu-item.js';
+import '../components/floating-panel.js';
+import '../hooks/use-authed-src.js';
+import '../components/account-settings-labels.js';
+import '../components/bulk-action-bar.js';
+import '../components/list.js';
+import '../components/breadcrumbs.js';
+import '../components/toast.js';
+import '../components/description-list.js';
+import '../components/line-items.js';
+import '../components/error-boundary.js';
+import '../components/authed-image.js';
+import '../components/image-grid.js';
+import '../components/lightbox.js';
+import '../components/write-lock.js';
+import '../auth/sign-in-form.js';
+import './access.js';
+import './landing-labels.js';
+import '../shell/topbar-controls.js';
+import '../theme/palette-presets.js';
+import '../theme/chart-palette.js';
+import '../theme/theme-store.js';
+import 'zustand/middleware';
+import 'zustand';
+import '../auth/complete-name-dialog.js';
+import '../auth/forgot-password-form.js';
+import '../auth/status-parts.js';
+import '../auth/reset-password-form.js';
+import '../auth/verify-email.js';
+import '../auth/not-found-page.js';
+import '../auth/accept-invitation.js';
+import '../shell/company-switcher.js';
+import '../account/email-change-setting.js';
+import '../account/sessions-setting.js';
+import '../lib/format.js';
+import '../account/data-export-setting.js';
+import '../components/account-chips.js';
+import '../admin/admin-parts.js';
+import '../admin/admin-action-log.js';
+import '../settings/settings-labels.js';
+import '../demo/demo-labels.js';
+import '../components/reauth-dialog.js';
+import '../components/server-wake.js';
+import '../lib/server-wake.js';
+import '../components/translation-review-labels.js';
+import '../lib/translation-review.js';
+import '../components/country-select.js';
+import '../components/inline-edit-field.js';
+import '../lib/iban.js';
+import '../lib/phone.js';
+import '../components/sign-chip.js';
+import '../components/column-mapper.js';
+import '../lib/column-mapping.js';
+import '../lib/table-text.js';
+import '../components/field-parts.js';
+
+/**
+ * 0.31.1: a session that is still being restored — an app whose access token lives in
+ * memory reads it back from its refresh token first (kastlan's 0.31 adoption). Until
+ * then `/` neither shows the landing nor resumes, and a public page neither shows nor
+ * redirects: both render `loading` instead.
+ */
+type RoutingSession = LandingSession | "loading";
+/**
+ * The public routes' logic (docs/landing-demo-harmonization.md §3): what `/` shows,
+ * which pages a session skips, and the page a session resumes on — keksdose's
+ * `RootEntry`, `RedirectIfAuthed` and use-last-visited-page.ts, for every app.
+ * Router-aware (react-router), so they belong to the `./shell` entry.
+ */
+/** The query parameter that carries "where I was actually trying to go" through the
+ *  sign-in bounce (keksdose's `NEXT_PARAM`). */
+declare const NEXT_PARAM = "next";
+/**
+ * A `?next=` value that is safe to navigate to, or null.
+ *
+ * Same-origin PATHS only, decided by the URL PARSER rather than by string prefix —
+ * this is the open-redirect check, and it is the reason this lives in one place
+ * instead of at each call site.
+ *
+ * The prefix version ("starts with `/`, does not start with `//`") let two shapes
+ * through that the browser resolves cross-origin, because the WHATWG parser does not
+ * read them as text: a backslash after the leading slash counts as a second slash for
+ * a special scheme, so `/\evil.example` resolves to `https://evil.example/`; and tab,
+ * LF and CR are STRIPPED anywhere in the input before parsing, so `/<TAB>/evil.example`
+ * becomes `//evil.example`. Asking the same parser the browser will use closes every
+ * such shape at once, including ones nobody has thought of yet, and it normalises what
+ * comes back instead of echoing the caller's spelling.
+ *
+ * keksdose's (shared/hooks/use-last-visited-page.ts), verbatim but for the fallback
+ * origin.
+ */
+declare function safeNextPath(raw: string | null | undefined): string | null;
+/** A path to leave out: a string is the path and everything under it (`/demo` is
+ *  `/demo` and `/demo/ended`; `/` is only `/`), a RegExp is tested on the pathname. */
+type PathPattern = string | RegExp;
+/**
+ * The pages never recorded as a resume target (§3.2): the landing (`/`, `/welcome`), the
+ * auth pages, the demo's own (`/demo*`) and the legal pages. The 404 has no path of its
+ * own — call {@link useLastVisitedPage} inside the signed-in layout, as keksdose does,
+ * and it never sees one. The app adds its own one-shot routes (keksdose:
+ * `/banks/callback`, `/join`, `/share-target`) through `exclude`.
+ */
+declare const DEFAULT_LAST_VISITED_EXCLUDES: readonly PathPattern[];
+interface LastVisitedPageOptions {
+    /** The device key: `<app>.lastVisitedPage` (§3.2), one per app on the origin. */
+    key: string;
+    /** The app's own paths to leave out, ON TOP of {@link DEFAULT_LAST_VISITED_EXCLUDES}. */
+    exclude?: readonly PathPattern[];
+    /** `false` records nothing — while the session is still being restored, say. */
+    enabled?: boolean;
+}
+/**
+ * Remember the page a session is on (path and query), on every navigation, so `/` — a
+ * revisit, a fresh sign-in, the installed PWA, whose `start_url` is `/` — resumes there
+ * (§3.2, keksdose feedback #59). Device-local, in `localStorage` under `key`; a blocked
+ * storage records nothing.
+ *
+ * Call it once in the signed-in layout. The excluded paths are never written, so a
+ * one-shot page (a bank callback, an invitation link) never becomes the place the next
+ * launch opens on.
+ */
+declare function useLastVisitedPage({ key, exclude, enabled }: LastVisitedPageOptions): void;
+/**
+ * The page {@link useLastVisitedPage} remembered under `key` — checked by
+ * {@link safeNextPath}, so a value someone planted in storage cannot leave the origin —
+ * or `fallback` (default `null`) when there is none or storage is blocked. A string
+ * fallback narrows the answer to a string, for react-router's `to`.
+ */
+declare function readLastVisitedPage(key: string, fallback: string): string;
+declare function readLastVisitedPage(key: string, fallback?: null): string | null;
+/** Forget the remembered page — on an explicit sign-out, so the next account does not
+ *  resume on the previous one's page. */
+declare function clearLastVisitedPage(key: string): void;
+interface RootEntryProps {
+    /** Without a session `/` is the landing; with one (real or demo) it resumes;
+     *  `"loading"` while the app restores one. */
+    session: RoutingSession;
+    /** What shows while `session` is `"loading"`. Default: the kit's `LoadingState`. */
+    loading?: ReactNode;
+    /** The remembered page — `readLastVisitedPage(key)`. */
+    resumePath?: string | null;
+    /** The landing page element. */
+    landing: ReactNode;
+    /** The app's home: where a session goes with nothing to resume (keksdose `/budget`,
+     *  kastlan and Kurvenschmiede `/dashboard`). */
+    home: string;
+}
+/**
+ * The `/` route (§3.1): the landing for a visitor, and for a session — real or demo —
+ * the last visited page, else the app's home. Indexed and canonical `/` for the visitor;
+ * a crawler never has a session, so for it `/` is stable.
+ *
+ * keksdose showed a session with nothing remembered the landing; the contract sends it
+ * home instead, because a session at `/` came to use the app. The landing stays one tap
+ * away at `/welcome`, where the signed-in brand link points.
+ */
+declare function RootEntry({ session, resumePath, landing, home, loading }: RootEntryProps): react.JSX.Element;
+interface RedirectIfAuthedProps {
+    /** `"loading"` while the app restores a session: neither the page nor a redirect. */
+    session: RoutingSession;
+    /** What shows while `session` is `"loading"`. Default: the kit's `LoadingState`. */
+    loading?: ReactNode;
+    /**
+     * Let a DEMO session through (§5.6): on `/login`, `/register` and the app's invitation
+     * pages, so a demo visitor can sign in or accept an invitation — a successful one
+     * replaces the demo session. Default `false`: on `/demo` a live demo continues instead
+     * of starting a second one (§5.2), and on `/forgot-password` a demo has no password.
+     */
+    allowDemo?: boolean;
+    /** Where a redirected session goes: the resume target —
+     *  `readLastVisitedPage(key, home)`. A safe `?next=` goes first. */
+    fallback: string;
+    /** The page. Left out, an `<Outlet />`: the component is a layout route around the
+     *  public pages, as in keksdose. */
+    children?: ReactNode;
+}
+/**
+ * Public pages a session skips (§3.1): a signed-in visitor at `/login` goes back into
+ * the app, to a safe `?next=` when the URL carries one (a share invitation or a push
+ * deep link opened with a live session in another tab — keksdose) and else to
+ * `fallback`.
+ *
+ * A demo session passes where `allowDemo` says so (§5.6). Mount one wrapper with
+ * `allowDemo` around `/login`, `/register` and the invitation pages, and one without
+ * around `/demo` (and `/forgot-password`).
+ */
+declare function RedirectIfAuthed({ session, allowDemo, fallback, children, loading }: RedirectIfAuthedProps): react.JSX.Element;
+
+export { DEFAULT_LAST_VISITED_EXCLUDES, type LastVisitedPageOptions, NEXT_PARAM, type PathPattern, RedirectIfAuthed, type RedirectIfAuthedProps, RootEntry, type RootEntryProps, type RoutingSession, clearLastVisitedPage, readLastVisitedPage, safeNextPath, useLastVisitedPage };

package/dist/landing/routing.js

@@ -0,0 +1,84 @@
+"use client";
+import { Fragment, jsx } from "react/jsx-runtime";
+import { useEffect } from "react";
+import { Navigate, Outlet, useLocation } from "react-router";
+import { readStored, writeStored } from "../lib/safe-storage.js";
+import { LoadingState } from "../components/loading-state.js";
+const NEXT_PARAM = "next";
+function safeNextPath(raw) {
+  if (!raw) return null;
+  const base = typeof window !== "undefined" ? window.location.origin : "https://kit.invalid";
+  try {
+    const url = new URL(raw, base);
+    if (url.origin !== base) return null;
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return null;
+  }
+}
+const DEFAULT_LAST_VISITED_EXCLUDES = Object.freeze([
+  "/",
+  "/welcome",
+  "/login",
+  "/register",
+  "/forgot-password",
+  "/reset-password",
+  "/verify-email",
+  "/demo",
+  "/impressum",
+  "/privacy",
+  "/terms"
+]);
+function matchesPath(pathname, pattern) {
+  if (typeof pattern !== "string") return new RegExp(pattern.source, pattern.flags.replace("g", "")).test(pathname);
+  if (pattern === "/") return pathname === "/";
+  const base = pattern.endsWith("/") ? pattern.slice(0, -1) : pattern;
+  return pathname === base || pathname.startsWith(`${base}/`);
+}
+function isExcluded(pathname, exclude) {
+  return [...DEFAULT_LAST_VISITED_EXCLUDES, ...exclude].some((pattern) => matchesPath(pathname, pattern));
+}
+function useLastVisitedPage({ key, exclude = [], enabled = true }) {
+  const { pathname, search } = useLocation();
+  const skip = !enabled || isExcluded(pathname, exclude);
+  useEffect(() => {
+    if (skip) return;
+    writeStored(key, pathname + search);
+  }, [key, pathname, search, skip]);
+}
+function readLastVisitedPage(key, fallback = null) {
+  return safeNextPath(readStored(key)) ?? fallback;
+}
+function clearLastVisitedPage(key) {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.removeItem(key);
+  } catch {
+  }
+}
+function RootEntry({ session, resumePath, landing, home, loading }) {
+  if (session === "loading") return /* @__PURE__ */ jsx(Fragment, { children: loading ?? /* @__PURE__ */ jsx(LoadingState, {}) });
+  if (session === "none") return /* @__PURE__ */ jsx(Fragment, { children: landing });
+  const resume = safeNextPath(resumePath);
+  return /* @__PURE__ */ jsx(Navigate, { to: resume && resume !== "/" ? resume : home, replace: true });
+}
+function RedirectIfAuthed({ session, allowDemo = false, fallback, children, loading }) {
+  const { search } = useLocation();
+  if (session === "loading") return /* @__PURE__ */ jsx(Fragment, { children: loading ?? /* @__PURE__ */ jsx(LoadingState, {}) });
+  if (session === "none" || session === "demo" && allowDemo) {
+    return children === void 0 ? /* @__PURE__ */ jsx(Outlet, {}) : /* @__PURE__ */ jsx(Fragment, { children });
+  }
+  const next = safeNextPath(new URLSearchParams(search).get(NEXT_PARAM));
+  return /* @__PURE__ */ jsx(Navigate, { to: next ?? fallback, replace: true });
+}
+export {
+  DEFAULT_LAST_VISITED_EXCLUDES,
+  NEXT_PARAM,
+  RedirectIfAuthed,
+  RootEntry,
+  clearLastVisitedPage,
+  readLastVisitedPage,
+  safeNextPath,
+  useLastVisitedPage
+};
+//# sourceMappingURL=routing.js.map

package/dist/landing/routing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/landing/routing.tsx"],"sourcesContent":["import { useEffect } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { Navigate, Outlet, useLocation } from \"react-router\";\n\nimport { readStored, writeStored } from \"../lib/safe-storage\";\nimport type { LandingSession } from \"./landing-actions\";\nimport { LoadingState } from \"../components/loading-state\";\n\n/**\n * 0.31.1: a session that is still being restored — an app whose access token lives in\n * memory reads it back from its refresh token first (kastlan's 0.31 adoption). Until\n * then `/` neither shows the landing nor resumes, and a public page neither shows nor\n * redirects: both render `loading` instead.\n */\nexport type RoutingSession = LandingSession | \"loading\";\n\n/**\n * The public routes' logic (docs/landing-demo-harmonization.md §3): what `/` shows,\n * which pages a session skips, and the page a session resumes on — keksdose's\n * `RootEntry`, `RedirectIfAuthed` and use-last-visited-page.ts, for every app.\n * Router-aware (react-router), so they belong to the `./shell` entry.\n */\n\n/* ── ?next= ──────────────────────────────────────────────────────────────── */\n\n/** The query parameter that carries \"where I was actually trying to go\" through the\n *  sign-in bounce (keksdose's `NEXT_PARAM`). */\nexport const NEXT_PARAM = \"next\";\n\n/**\n * A `?next=` value that is safe to navigate to, or null.\n *\n * Same-origin PATHS only, decided by the URL PARSER rather than by string prefix —\n * this is the open-redirect check, and it is the reason this lives in one place\n * instead of at each call site.\n *\n * The prefix version (\"starts with `/`, does not start with `//`\") let two shapes\n * through that the browser resolves cross-origin, because the WHATWG parser does not\n * read them as text: a backslash after the leading slash counts as a second slash for\n * a special scheme, so `/\\evil.example` resolves to `https://evil.example/`; and tab,\n * LF and CR are STRIPPED anywhere in the input before parsing, so `/<TAB>/evil.example`\n * becomes `//evil.example`. Asking the same parser the browser will use closes every\n * such shape at once, including ones nobody has thought of yet, and it normalises what\n * comes back instead of echoing the caller's spelling.\n *\n * keksdose's (shared/hooks/use-last-visited-page.ts), verbatim but for the fallback\n * origin.\n */\nexport function safeNextPath(raw: string | null | undefined): string | null {\n  if (!raw) return null;\n  const base = typeof window !== \"undefined\" ? window.location.origin : \"https://kit.invalid\";\n  try {\n    const url = new URL(raw, base);\n    if (url.origin !== base) return null;\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return null;\n  }\n}\n\n/* ── The last visited page (§3.2) ────────────────────────────────────────── */\n\n/** A path to leave out: a string is the path and everything under it (`/demo` is\n *  `/demo` and `/demo/ended`; `/` is only `/`), a RegExp is tested on the pathname. */\nexport type PathPattern = string | RegExp;\n\n/**\n * The pages never recorded as a resume target (§3.2): the landing (`/`, `/welcome`), the\n * auth pages, the demo's own (`/demo*`) and the legal pages. The 404 has no path of its\n * own — call {@link useLastVisitedPage} inside the signed-in layout, as keksdose does,\n * and it never sees one. The app adds its own one-shot routes (keksdose:\n * `/banks/callback`, `/join`, `/share-target`) through `exclude`.\n */\nexport const DEFAULT_LAST_VISITED_EXCLUDES: readonly PathPattern[] = Object.freeze([\n  \"/\",\n  \"/welcome\",\n  \"/login\",\n  \"/register\",\n  \"/forgot-password\",\n  \"/reset-password\",\n  \"/verify-email\",\n  \"/demo\",\n  \"/impressum\",\n  \"/privacy\",\n  \"/terms\",\n]);\n\nfunction matchesPath(pathname: string, pattern: PathPattern): boolean {\n  if (typeof pattern !== \"string\") return new RegExp(pattern.source, pattern.flags.replace(\"g\", \"\")).test(pathname);\n  if (pattern === \"/\") return pathname === \"/\";\n  const base = pattern.endsWith(\"/\") ? pattern.slice(0, -1) : pattern;\n  return pathname === base || pathname.startsWith(`${base}/`);\n}\n\n/** Whether `pathname` is one of the defaults or the app's `exclude`. */\nfunction isExcluded(pathname: string, exclude: readonly PathPattern[]): boolean {\n  return [...DEFAULT_LAST_VISITED_EXCLUDES, ...exclude].some((pattern) => matchesPath(pathname, pattern));\n}\n\nexport interface LastVisitedPageOptions {\n  /** The device key: `<app>.lastVisitedPage` (§3.2), one per app on the origin. */\n  key: string;\n  /** The app's own paths to leave out, ON TOP of {@link DEFAULT_LAST_VISITED_EXCLUDES}. */\n  exclude?: readonly PathPattern[];\n  /** `false` records nothing — while the session is still being restored, say. */\n  enabled?: boolean;\n}\n\n/**\n * Remember the page a session is on (path and query), on every navigation, so `/` — a\n * revisit, a fresh sign-in, the installed PWA, whose `start_url` is `/` — resumes there\n * (§3.2, keksdose feedback #59). Device-local, in `localStorage` under `key`; a blocked\n * storage records nothing.\n *\n * Call it once in the signed-in layout. The excluded paths are never written, so a\n * one-shot page (a bank callback, an invitation link) never becomes the place the next\n * launch opens on.\n */\nexport function useLastVisitedPage({ key, exclude = [], enabled = true }: LastVisitedPageOptions): void {\n  const { pathname, search } = useLocation();\n  // Decided here, so the effect depends on the answer and not on an `exclude` array the\n  // caller likely builds inline.\n  const skip = !enabled || isExcluded(pathname, exclude);\n  useEffect(() => {\n    if (skip) return;\n    writeStored(key, pathname + search);\n  }, [key, pathname, search, skip]);\n}\n\n/**\n * The page {@link useLastVisitedPage} remembered under `key` — checked by\n * {@link safeNextPath}, so a value someone planted in storage cannot leave the origin —\n * or `fallback` (default `null`) when there is none or storage is blocked. A string\n * fallback narrows the answer to a string, for react-router's `to`.\n */\nexport function readLastVisitedPage(key: string, fallback: string): string;\nexport function readLastVisitedPage(key: string, fallback?: null): string | null;\nexport function readLastVisitedPage(key: string, fallback: string | null = null): string | null {\n  return safeNextPath(readStored(key)) ?? fallback;\n}\n\n/** Forget the remembered page — on an explicit sign-out, so the next account does not\n *  resume on the previous one's page. */\nexport function clearLastVisitedPage(key: string): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    window.localStorage.removeItem(key);\n  } catch {\n    // storage blocked: there is nothing to forget\n  }\n}\n\n/* ── RootEntry ───────────────────────────────────────────────────────────── */\n\nexport interface RootEntryProps {\n  /** Without a session `/` is the landing; with one (real or demo) it resumes;\n   *  `\"loading\"` while the app restores one. */\n  session: RoutingSession;\n  /** What shows while `session` is `\"loading\"`. Default: the kit's `LoadingState`. */\n  loading?: ReactNode;\n  /** The remembered page — `readLastVisitedPage(key)`. */\n  resumePath?: string | null;\n  /** The landing page element. */\n  landing: ReactNode;\n  /** The app's home: where a session goes with nothing to resume (keksdose `/budget`,\n   *  kastlan and Kurvenschmiede `/dashboard`). */\n  home: string;\n}\n\n/**\n * The `/` route (§3.1): the landing for a visitor, and for a session — real or demo —\n * the last visited page, else the app's home. Indexed and canonical `/` for the visitor;\n * a crawler never has a session, so for it `/` is stable.\n *\n * keksdose showed a session with nothing remembered the landing; the contract sends it\n * home instead, because a session at `/` came to use the app. The landing stays one tap\n * away at `/welcome`, where the signed-in brand link points.\n */\nexport function RootEntry({ session, resumePath, landing, home, loading }: RootEntryProps) {\n  if (session === \"loading\") return <>{loading ?? <LoadingState />}</>;\n  if (session === \"none\") return <>{landing}</>;\n  const resume = safeNextPath(resumePath);\n  return <Navigate to={resume && resume !== \"/\" ? resume : home} replace />;\n}\n\n/* ── RedirectIfAuthed ────────────────────────────────────────────────────── */\n\nexport interface RedirectIfAuthedProps {\n  /** `\"loading\"` while the app restores a session: neither the page nor a redirect. */\n  session: RoutingSession;\n  /** What shows while `session` is `\"loading\"`. Default: the kit's `LoadingState`. */\n  loading?: ReactNode;\n  /**\n   * Let a DEMO session through (§5.6): on `/login`, `/register` and the app's invitation\n   * pages, so a demo visitor can sign in or accept an invitation — a successful one\n   * replaces the demo session. Default `false`: on `/demo` a live demo continues instead\n   * of starting a second one (§5.2), and on `/forgot-password` a demo has no password.\n   */\n  allowDemo?: boolean;\n  /** Where a redirected session goes: the resume target —\n   *  `readLastVisitedPage(key, home)`. A safe `?next=` goes first. */\n  fallback: string;\n  /** The page. Left out, an `<Outlet />`: the component is a layout route around the\n   *  public pages, as in keksdose. */\n  children?: ReactNode;\n}\n\n/**\n * Public pages a session skips (§3.1): a signed-in visitor at `/login` goes back into\n * the app, to a safe `?next=` when the URL carries one (a share invitation or a push\n * deep link opened with a live session in another tab — keksdose) and else to\n * `fallback`.\n *\n * A demo session passes where `allowDemo` says so (§5.6). Mount one wrapper with\n * `allowDemo` around `/login`, `/register` and the invitation pages, and one without\n * around `/demo` (and `/forgot-password`).\n */\nexport function RedirectIfAuthed({ session, allowDemo = false, fallback, children, loading }: RedirectIfAuthedProps) {\n  const { search } = useLocation();\n  if (session === \"loading\") return <>{loading ?? <LoadingState />}</>;\n  if (session === \"none\" || (session === \"demo\" && allowDemo)) {\n    return children === undefined ? <Outlet /> : <>{children}</>;\n  }\n  const next = safeNextPath(new URLSearchParams(search).get(NEXT_PARAM));\n  return <Navigate to={next ?? fallback} replace />;\n}\n"],"mappings":";AAmLoC,mBAAc,WAAd;AAnLpC,SAAS,iBAAiB;AAE1B,SAAS,UAAU,QAAQ,mBAAmB;AAE9C,SAAS,YAAY,mBAAmB;AAExC,SAAS,oBAAoB;AAqBtB,MAAM,aAAa;AAqBnB,SAAS,aAAa,KAA+C;AAC1E,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,OAAO,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS;AACtE,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK,IAAI;AAC7B,QAAI,IAAI,WAAW,KAAM,QAAO;AAChC,WAAO,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeO,MAAM,gCAAwD,OAAO,OAAO;AAAA,EACjF;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,YAAY,UAAkB,SAA+B;AACpE,MAAI,OAAO,YAAY,SAAU,QAAO,IAAI,OAAO,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,KAAK,EAAE,CAAC,EAAE,KAAK,QAAQ;AAChH,MAAI,YAAY,IAAK,QAAO,aAAa;AACzC,QAAM,OAAO,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI;AAC5D,SAAO,aAAa,QAAQ,SAAS,WAAW,GAAG,IAAI,GAAG;AAC5D;AAGA,SAAS,WAAW,UAAkB,SAA0C;AAC9E,SAAO,CAAC,GAAG,+BAA+B,GAAG,OAAO,EAAE,KAAK,CAAC,YAAY,YAAY,UAAU,OAAO,CAAC;AACxG;AAqBO,SAAS,mBAAmB,EAAE,KAAK,UAAU,CAAC,GAAG,UAAU,KAAK,GAAiC;AACtG,QAAM,EAAE,UAAU,OAAO,IAAI,YAAY;AAGzC,QAAM,OAAO,CAAC,WAAW,WAAW,UAAU,OAAO;AACrD,YAAU,MAAM;AACd,QAAI,KAAM;AACV,gBAAY,KAAK,WAAW,MAAM;AAAA,EACpC,GAAG,CAAC,KAAK,UAAU,QAAQ,IAAI,CAAC;AAClC;AAUO,SAAS,oBAAoB,KAAa,WAA0B,MAAqB;AAC9F,SAAO,aAAa,WAAW,GAAG,CAAC,KAAK;AAC1C;AAIO,SAAS,qBAAqB,KAAmB;AACtD,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,WAAO,aAAa,WAAW,GAAG;AAAA,EACpC,QAAQ;AAAA,EAER;AACF;AA4BO,SAAS,UAAU,EAAE,SAAS,YAAY,SAAS,MAAM,QAAQ,GAAmB;AACzF,MAAI,YAAY,UAAW,QAAO,gCAAG,qBAAW,oBAAC,gBAAa,GAAG;AACjE,MAAI,YAAY,OAAQ,QAAO,gCAAG,mBAAQ;AAC1C,QAAM,SAAS,aAAa,UAAU;AACtC,SAAO,oBAAC,YAAS,IAAI,UAAU,WAAW,MAAM,SAAS,MAAM,SAAO,MAAC;AACzE;AAkCO,SAAS,iBAAiB,EAAE,SAAS,YAAY,OAAO,UAAU,UAAU,QAAQ,GAA0B;AACnH,QAAM,EAAE,OAAO,IAAI,YAAY;AAC/B,MAAI,YAAY,UAAW,QAAO,gCAAG,qBAAW,oBAAC,gBAAa,GAAG;AACjE,MAAI,YAAY,UAAW,YAAY,UAAU,WAAY;AAC3D,WAAO,aAAa,SAAY,oBAAC,UAAO,IAAK,gCAAG,UAAS;AAAA,EAC3D;AACA,QAAM,OAAO,aAAa,IAAI,gBAAgB,MAAM,EAAE,IAAI,UAAU,CAAC;AACrE,SAAO,oBAAC,YAAS,IAAI,QAAQ,UAAU,SAAO,MAAC;AACjD;","names":[]}

package/dist/rhf/fields.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode, ReactElement } from 'react';
 import { FieldValues, FieldPath, ControllerProps, ControllerRenderProps, ControllerFieldState } from 'react-hook-form';
-import { dt as IbanInputProps, eg as PhoneInputProps, eD as SelectProps, dD as InputProps, eY as TextareaProps } from '../delete-account-setting-CGVMckMw.js';
+import { dt as IbanInputProps, eg as PhoneInputProps, eD as SelectProps, dD as InputProps, eY as TextareaProps } from '../delete-account-setting-CpIhzxxZ.js';
 import { NumberFieldProps } from '../components/number-field.js';
 import { DatePickerProps, DateRangePickerProps } from '../components/date-picker.js';
 import { TimeInputProps } from '../components/time-input.js';
@@ -65,6 +65,8 @@ import '../components/image-grid.js';
 import '../components/lightbox.js';
 import '../components/write-lock.js';
 import '../auth/sign-in-form.js';
+import '../landing/access.js';
+import '../landing/landing-labels.js';
 import '../shell/topbar-controls.js';
 import '../theme/palette-presets.js';
 import '../theme/chart-palette.js';
@@ -86,6 +88,8 @@ import '../account/data-export-setting.js';
 import '../components/account-chips.js';
 import '../admin/admin-parts.js';
 import '../admin/admin-action-log.js';
+import '../settings/settings-labels.js';
+import '../demo/demo-labels.js';
 import '../components/reauth-dialog.js';
 import '../components/server-wake.js';
 import '../lib/server-wake.js';