@eifi1/ui-kit 0.31.0 → 0.31.1

package/README.md

@@ -382,16 +382,16 @@ columns, strings and permissions (see the note at the top of `src/feedback/feedb
 
 <!-- BEGIN GENERATED: exports — node scripts/gen-export-inventory.mjs -->
 
-**1688 names from 253 modules** — 778 values and 910 types. _Italic_ is a type-only export.
+**1690 names from 253 modules** — 779 values and 911 types. _Italic_ is a type-only export.
 
 Generated from `dist/index.d.ts` by `node scripts/gen-export-inventory.mjs`; the count
 is pinned by `src/__tests__/public-surface.test.ts`. Do not edit between the markers.
 
 | Entry point | Names |
 |---|---|
-| `@eifi1/ui-kit` | 1688 |
+| `@eifi1/ui-kit` | 1690 |
 | `@eifi1/ui-kit/chart` | 104 |
-| `@eifi1/ui-kit/shell` | 71 |
+| `@eifi1/ui-kit/shell` | 72 |
 | `@eifi1/ui-kit/data-table` | 51 |
 | `@eifi1/ui-kit/wizard` | 25 |
 | `@eifi1/ui-kit/tour` | 7 |
@@ -711,7 +711,7 @@ re-slicing of it, never a second API.
 | `settings/settings-context` | `useSettingsLayout`, _`SettingsLayoutContextValue`_ |
 | `settings/settings-heading` | `SettingsHeadingLevel`, `useSettingsHeadingLevel`, _`SettingsHeadingLevelProps`_, _`SettingsHeadingTag`_ |
 | `settings/settings-catalogue` | `settingsHref`, `settingsSearchEntries`, `visibleSettingsEntries`, `visibleSettingsGroups`, _`SettingsEntry`_, _`SettingsGroup`_, _`SettingsSearchEntriesOptions`_ |
-| `settings/settings-labels` | `DEFAULT_SETTINGS_LABELS`, _`SettingsCoreGroup`_, _`SettingsGroupLabels`_, _`SettingsLabels`_ |
+| `settings/settings-labels` | `DEFAULT_SETTINGS_LABELS`, `useSettingsLabels`, _`SettingsCoreGroup`_, _`SettingsGroupLabels`_, _`SettingsLabels`_ |
 | `settings/use-account-language` | `matchOfferedLanguage`, `resolveAccountLanguage`, `useAccountLanguage`, _`AccountLanguage`_, _`AccountLanguageSource`_, _`ResolveAccountLanguageInput`_, _`ResolvedAccountLanguage`_, _`UseAccountLanguageOptions`_ |
 
 ### landing
@@ -723,7 +723,7 @@ re-slicing of it, never a second API.
 | `landing/landing-actions` | `LandingActions`, _`LandingActionsProps`_, _`LandingSession`_ |
 | `landing/landing-sections` | `CtaBand`, `FeatureRow`, `FeatureRows`, `Hero`, `PublicFooter`, `TrustStrip`, _`CtaBandProps`_, _`FeatureRowProps`_, _`FeatureRowsProps`_, _`HeroProps`_, _`PublicFooterProps`_, _`TrustItem`_, _`TrustStripProps`_ |
 | `landing/page-seo` | `metaContent`, `seoCopyProblems`, `usePageSeo`, _`SeoCopy`_, _`SeoCopyLimits`_, _`SeoCopyProblem`_, _`SeoCopyProblemCode`_ |
-| `landing/routing` | `clearLastVisitedPage`, `DEFAULT_LAST_VISITED_EXCLUDES`, `NEXT_PARAM`, `readLastVisitedPage`, `RedirectIfAuthed`, `RootEntry`, `safeNextPath`, `useLastVisitedPage`, _`LastVisitedPageOptions`_, _`PathPattern`_, _`RedirectIfAuthedProps`_, _`RootEntryProps`_ |
+| `landing/routing` | `clearLastVisitedPage`, `DEFAULT_LAST_VISITED_EXCLUDES`, `NEXT_PARAM`, `readLastVisitedPage`, `RedirectIfAuthed`, `RootEntry`, `safeNextPath`, `useLastVisitedPage`, _`LastVisitedPageOptions`_, _`PathPattern`_, _`RedirectIfAuthedProps`_, _`RootEntryProps`_, _`RoutingSession`_ |
 | `landing/public-header` | `PublicHeader`, _`PublicHeaderBrand`_, _`PublicHeaderProps`_ |
 
 ### demo

package/dist/account/delete-account-setting.d.ts

@@ -1,5 +1,5 @@
 import 'react';
-export { cq as DEFAULT_DELETE_ACCOUNT_LABELS, cQ as DeleteAccountConsequence, cR as DeleteAccountLabels, cS as DeleteAccountSetting, cT as DeleteAccountSettingProps, cU as DeleteAccountValues, cV as DeletionMode } from '../delete-account-setting-DCFS5Vof.js';
+export { cq as DEFAULT_DELETE_ACCOUNT_LABELS, cQ as DeleteAccountConsequence, cR as DeleteAccountLabels, cS as DeleteAccountSetting, cT as DeleteAccountSettingProps, cU as DeleteAccountValues, cV as DeletionMode } from '../delete-account-setting-CpIhzxxZ.js';
 import '../components/tooltip.js';
 import '../hooks/use-anchored-rect.js';
 import '../lib/clipping.js';

package/dist/admin/admin-action-confirm.d.ts

@@ -1,5 +1,5 @@
 import 'react';
-export { bt as AdminActionConfirm, bu as AdminActionConfirmProps, bv as AdminActionConfirmValues, bw as AdminActionLabels, bx as AdminActionTarget, by as AdminConfirmLevel, cf as DEFAULT_ADMIN_ACTION_LABELS } from '../delete-account-setting-DCFS5Vof.js';
+export { bt as AdminActionConfirm, bu as AdminActionConfirmProps, bv as AdminActionConfirmValues, bw as AdminActionLabels, bx as AdminActionTarget, by as AdminConfirmLevel, cf as DEFAULT_ADMIN_ACTION_LABELS } from '../delete-account-setting-CpIhzxxZ.js';
 import './admin-parts.js';
 import '../components/tooltip.js';
 import '../hooks/use-anchored-rect.js';

package/dist/admin/admin-parts.d.ts

@@ -9,11 +9,18 @@ import { DateInput } from '../lib/format.js';
 /** A callback that may answer a promise: resolve = done, reject = stay and say why. */
 type MaybePromise<T = unknown> = void | Promise<T>;
 /** A person as the admin parts show one: the two name parts of the auth contract
- *  (§3.2), an older whole `name` as the fallback, and the address. */
+ *  (§3.2), an older whole `name` as the fallback, and the address. The name parts are
+ *  read in either spelling — the kit's `first` / `last`, or server-kit's `PersonRef`
+ *  as it serialises (`first_name` / `last_name`), so an app hands the server's object
+ *  over as it came (keksdose's and kastlan's 0.30 adoptions mapped one to the other). */
 interface AdminPerson {
     id?: string | number | null;
     first?: string | null;
     last?: string | null;
+    /** server-kit `PersonRef.first_name`; `first` wins when both are given. */
+    first_name?: string | null;
+    /** server-kit `PersonRef.last_name`; `last` wins when both are given. */
+    last_name?: string | null;
     /** A whole name, for an API that still sends `display_name` only. */
     name?: string | null;
     email?: string | null;

package/dist/admin/admin-parts.js

@@ -9,7 +9,7 @@ function hasMessage(node) {
 }
 function personLabel(person, locale) {
   if (!person) return "";
-  return formatPersonName({ first: person.first, last: person.last }, locale) || (person.name ?? "").trim() || (person.email ?? "").trim();
+  return formatPersonName({ first: person.first ?? person.first_name, last: person.last ?? person.last_name }, locale) || (person.name ?? "").trim() || (person.email ?? "").trim();
 }
 function usePersonLabel(localeProp) {
   const locale = useKitLocale(localeProp);

package/dist/admin/admin-parts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/admin/admin-parts.ts"],"sourcesContent":["import { useCallback } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { useKitDateFormatter, useKitLocale } from \"../i18n/kit-labels\";\nimport { formatDate, toDate } from \"../lib/format\";\nimport type { DateInput } from \"../lib/format\";\nimport { toLocalIso } from \"../lib/dates\";\nimport { formatPersonName } from \"../lib/person-name\";\n\n/**\n * What the admin parts share and do not export (0.30.0). Internal to `src/admin`.\n *\n * @internal\n */\n\n/** A callback that may answer a promise: resolve = done, reject = stay and say why. */\nexport type MaybePromise<T = unknown> = void | Promise<T>;\n\n/** A person as the admin parts show one: the two name parts of the auth contract\n *  (§3.2), an older whole `name` as the fallback, and the address. */\nexport interface AdminPerson {\n  id?: string | number | null;\n  first?: string | null;\n  last?: string | null;\n  /** A whole name, for an API that still sends `display_name` only. */\n  name?: string | null;\n  email?: string | null;\n}\n\n/** A label that is really there — `null`, `false` and `\"\"` are what `cond && text`\n *  evaluates to on the path where there is none. */\nexport function hasMessage(node: ReactNode): boolean {\n  return node !== undefined && node !== null && node !== false && node !== \"\";\n}\n\n/**\n * The name to say for a person, in the READER's order (auth §3.2,\n * {@link formatPersonName}), else the whole `name`, else the address, else `\"\"`.\n */\nexport function personLabel(person: AdminPerson | null | undefined, locale: string | undefined): string {\n  if (!person) return \"\";\n  return (\n    formatPersonName({ first: person.first, last: person.last }, locale) ||\n    (person.name ?? \"\").trim() ||\n    (person.email ?? \"\").trim()\n  );\n}\n\n/** {@link personLabel} in the provider's locale. */\nexport function usePersonLabel(localeProp?: string): (person: AdminPerson | null | undefined) => string {\n  const locale = useKitLocale(localeProp);\n  return useCallback((person) => personLabel(person, locale), [locale]);\n}\n\n/**\n * A day as words in a sentence (\"6 Nov 2026\"): the provider's `formatDate` when the app\n * set one (keksdose K12), asked for no weekday — a date in a sentence carries none — else\n * `Intl`'s medium date. `\"\"` for no date.\n */\nexport function useDayText(localeProp?: string): (value: DateInput) => string {\n  const locale = useKitLocale(localeProp);\n  const fromProvider = useKitDateFormatter();\n  return useCallback(\n    (value) => {\n      const date = toDate(value);\n      if (!date) return \"\";\n      const own = fromProvider\n        ? fromProvider(toLocalIso(date), { unit: \"day\", source: \"dateMark\", locale, weekday: false })\n        : \"\";\n      return own || formatDate(date, \"medium\", { locale });\n    },\n    [fromProvider, locale],\n  );\n}\n\n/** Call a callback that may throw or answer a promise, as a promise. */\nexport function settle<T>(call: () => MaybePromise<T>): Promise<T | void> {\n  try {\n    return Promise.resolve(call());\n  } catch (error) {\n    return Promise.reject(error);\n  }\n}\n"],"mappings":";AAAA,SAAS,mBAAmB;AAE5B,SAAS,qBAAqB,oBAAoB;AAClD,SAAS,YAAY,cAAc;AAEnC,SAAS,kBAAkB;AAC3B,SAAS,wBAAwB;AAwB1B,SAAS,WAAW,MAA0B;AACnD,SAAO,SAAS,UAAa,SAAS,QAAQ,SAAS,SAAS,SAAS;AAC3E;AAMO,SAAS,YAAY,QAAwC,QAAoC;AACtG,MAAI,CAAC,OAAQ,QAAO;AACpB,SACE,iBAAiB,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,KAAK,GAAG,MAAM,MAClE,OAAO,QAAQ,IAAI,KAAK,MACxB,OAAO,SAAS,IAAI,KAAK;AAE9B;AAGO,SAAS,eAAe,YAAyE;AACtG,QAAM,SAAS,aAAa,UAAU;AACtC,SAAO,YAAY,CAAC,WAAW,YAAY,QAAQ,MAAM,GAAG,CAAC,MAAM,CAAC;AACtE;AAOO,SAAS,WAAW,YAAmD;AAC5E,QAAM,SAAS,aAAa,UAAU;AACtC,QAAM,eAAe,oBAAoB;AACzC,SAAO;AAAA,IACL,CAAC,UAAU;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,UAAI,CAAC,KAAM,QAAO;AAClB,YAAM,MAAM,eACR,aAAa,WAAW,IAAI,GAAG,EAAE,MAAM,OAAO,QAAQ,YAAY,QAAQ,SAAS,MAAM,CAAC,IAC1F;AACJ,aAAO,OAAO,WAAW,MAAM,UAAU,EAAE,OAAO,CAAC;AAAA,IACrD;AAAA,IACA,CAAC,cAAc,MAAM;AAAA,EACvB;AACF;AAGO,SAAS,OAAU,MAAgD;AACxE,MAAI;AACF,WAAO,QAAQ,QAAQ,KAAK,CAAC;AAAA,EAC/B,SAAS,OAAO;AACd,WAAO,QAAQ,OAAO,KAAK;AAAA,EAC7B;AACF;","names":[]}
+{"version":3,"sources":["../../src/admin/admin-parts.ts"],"sourcesContent":["import { useCallback } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { useKitDateFormatter, useKitLocale } from \"../i18n/kit-labels\";\nimport { formatDate, toDate } from \"../lib/format\";\nimport type { DateInput } from \"../lib/format\";\nimport { toLocalIso } from \"../lib/dates\";\nimport { formatPersonName } from \"../lib/person-name\";\n\n/**\n * What the admin parts share and do not export (0.30.0). Internal to `src/admin`.\n *\n * @internal\n */\n\n/** A callback that may answer a promise: resolve = done, reject = stay and say why. */\nexport type MaybePromise<T = unknown> = void | Promise<T>;\n\n/** A person as the admin parts show one: the two name parts of the auth contract\n *  (§3.2), an older whole `name` as the fallback, and the address. The name parts are\n *  read in either spelling — the kit's `first` / `last`, or server-kit's `PersonRef`\n *  as it serialises (`first_name` / `last_name`), so an app hands the server's object\n *  over as it came (keksdose's and kastlan's 0.30 adoptions mapped one to the other). */\nexport interface AdminPerson {\n  id?: string | number | null;\n  first?: string | null;\n  last?: string | null;\n  /** server-kit `PersonRef.first_name`; `first` wins when both are given. */\n  first_name?: string | null;\n  /** server-kit `PersonRef.last_name`; `last` wins when both are given. */\n  last_name?: string | null;\n  /** A whole name, for an API that still sends `display_name` only. */\n  name?: string | null;\n  email?: string | null;\n}\n\n/** A label that is really there — `null`, `false` and `\"\"` are what `cond && text`\n *  evaluates to on the path where there is none. */\nexport function hasMessage(node: ReactNode): boolean {\n  return node !== undefined && node !== null && node !== false && node !== \"\";\n}\n\n/**\n * The name to say for a person, in the READER's order (auth §3.2,\n * {@link formatPersonName}), else the whole `name`, else the address, else `\"\"`.\n */\nexport function personLabel(person: AdminPerson | null | undefined, locale: string | undefined): string {\n  if (!person) return \"\";\n  return (\n    formatPersonName({ first: person.first ?? person.first_name, last: person.last ?? person.last_name }, locale) ||\n    (person.name ?? \"\").trim() ||\n    (person.email ?? \"\").trim()\n  );\n}\n\n/** {@link personLabel} in the provider's locale. */\nexport function usePersonLabel(localeProp?: string): (person: AdminPerson | null | undefined) => string {\n  const locale = useKitLocale(localeProp);\n  return useCallback((person) => personLabel(person, locale), [locale]);\n}\n\n/**\n * A day as words in a sentence (\"6 Nov 2026\"): the provider's `formatDate` when the app\n * set one (keksdose K12), asked for no weekday — a date in a sentence carries none — else\n * `Intl`'s medium date. `\"\"` for no date.\n */\nexport function useDayText(localeProp?: string): (value: DateInput) => string {\n  const locale = useKitLocale(localeProp);\n  const fromProvider = useKitDateFormatter();\n  return useCallback(\n    (value) => {\n      const date = toDate(value);\n      if (!date) return \"\";\n      const own = fromProvider\n        ? fromProvider(toLocalIso(date), { unit: \"day\", source: \"dateMark\", locale, weekday: false })\n        : \"\";\n      return own || formatDate(date, \"medium\", { locale });\n    },\n    [fromProvider, locale],\n  );\n}\n\n/** Call a callback that may throw or answer a promise, as a promise. */\nexport function settle<T>(call: () => MaybePromise<T>): Promise<T | void> {\n  try {\n    return Promise.resolve(call());\n  } catch (error) {\n    return Promise.reject(error);\n  }\n}\n"],"mappings":";AAAA,SAAS,mBAAmB;AAE5B,SAAS,qBAAqB,oBAAoB;AAClD,SAAS,YAAY,cAAc;AAEnC,SAAS,kBAAkB;AAC3B,SAAS,wBAAwB;AA+B1B,SAAS,WAAW,MAA0B;AACnD,SAAO,SAAS,UAAa,SAAS,QAAQ,SAAS,SAAS,SAAS;AAC3E;AAMO,SAAS,YAAY,QAAwC,QAAoC;AACtG,MAAI,CAAC,OAAQ,QAAO;AACpB,SACE,iBAAiB,EAAE,OAAO,OAAO,SAAS,OAAO,YAAY,MAAM,OAAO,QAAQ,OAAO,UAAU,GAAG,MAAM,MAC3G,OAAO,QAAQ,IAAI,KAAK,MACxB,OAAO,SAAS,IAAI,KAAK;AAE9B;AAGO,SAAS,eAAe,YAAyE;AACtG,QAAM,SAAS,aAAa,UAAU;AACtC,SAAO,YAAY,CAAC,WAAW,YAAY,QAAQ,MAAM,GAAG,CAAC,MAAM,CAAC;AACtE;AAOO,SAAS,WAAW,YAAmD;AAC5E,QAAM,SAAS,aAAa,UAAU;AACtC,QAAM,eAAe,oBAAoB;AACzC,SAAO;AAAA,IACL,CAAC,UAAU;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,UAAI,CAAC,KAAM,QAAO;AAClB,YAAM,MAAM,eACR,aAAa,WAAW,IAAI,GAAG,EAAE,MAAM,OAAO,QAAQ,YAAY,QAAQ,SAAS,MAAM,CAAC,IAC1F;AACJ,aAAO,OAAO,WAAW,MAAM,UAAU,EAAE,OAAO,CAAC;AAAA,IACrD;AAAA,IACA,CAAC,cAAc,MAAM;AAAA,EACvB;AACF;AAGO,SAAS,OAAU,MAAgD;AACxE,MAAI;AACF,WAAO,QAAQ,QAAQ,KAAK,CAAC;AAAA,EAC/B,SAAS,OAAO;AACd,WAAO,QAAQ,OAAO,KAAK;AAAA,EAC7B;AACF;","names":[]}

package/dist/admin/invitations-panel.d.ts

@@ -1,6 +1,6 @@
 import 'react';
 import '../lib/format.js';
-export { cv as DEFAULT_INVITATIONS_LABELS, dE as InvitationDraft, dF as InvitationRow, dG as InvitationScope, dH as InvitationSentAnswer, dI as InvitationStatus, dJ as InvitationsLabels, dK as InvitationsPanel, dL as InvitationsPanelProps } from '../delete-account-setting-DCFS5Vof.js';
+export { cv as DEFAULT_INVITATIONS_LABELS, dE as InvitationDraft, dF as InvitationRow, dG as InvitationScope, dH as InvitationSentAnswer, dI as InvitationStatus, dJ as InvitationsLabels, dK as InvitationsPanel, dL as InvitationsPanelProps } from '../delete-account-setting-CpIhzxxZ.js';
 import '../components/account-chips.js';
 import './admin-parts.js';
 import '../components/tooltip.js';

package/dist/admin/reviewer-scope-editor.d.ts

@@ -1,5 +1,5 @@
 import 'react';
-export { cC as DEFAULT_REVIEWER_SCOPE_LABELS, en as ReviewerScope, eo as ReviewerScopeArea, ep as ReviewerScopeEditor, eq as ReviewerScopeEditorProps, er as ReviewerScopeLabels, es as ReviewerScopeLanguage } from '../delete-account-setting-DCFS5Vof.js';
+export { cC as DEFAULT_REVIEWER_SCOPE_LABELS, en as ReviewerScope, eo as ReviewerScopeArea, ep as ReviewerScopeEditor, eq as ReviewerScopeEditorProps, er as ReviewerScopeLabels, es as ReviewerScopeLanguage } from '../delete-account-setting-CpIhzxxZ.js';
 import './admin-parts.js';
 import '../components/tooltip.js';
 import '../hooks/use-anchored-rect.js';

package/dist/admin/role-select.d.ts

@@ -1,6 +1,6 @@
 import 'react';
 import '../components/account-chips.js';
-export { cD as DEFAULT_ROLE_SELECT_LABELS, eu as RoleLock, ev as RoleLockCode, ew as RoleSelect, ex as RoleSelectLabels, ey as RoleSelectProps, ez as RolesEditor, eA as RolesEditorProps } from '../delete-account-setting-DCFS5Vof.js';
+export { cD as DEFAULT_ROLE_SELECT_LABELS, eu as RoleLock, ev as RoleLockCode, ew as RoleSelect, ex as RoleSelectLabels, ey as RoleSelectProps, ez as RolesEditor, eA as RolesEditorProps } from '../delete-account-setting-CpIhzxxZ.js';
 import 'lucide-react';
 import '../lib/format.js';
 import '../components/chip.js';

package/dist/admin/transfer-ownership-dialog.d.ts

@@ -1,5 +1,5 @@
 import 'react';
-export { cI as DEFAULT_TRANSFER_OWNERSHIP_LABELS, e_ as TransferCandidate, e$ as TransferOwnershipDialog, f0 as TransferOwnershipDialogProps, f1 as TransferOwnershipLabels, f2 as TransferUnavailable, f3 as TransferValues } from '../delete-account-setting-DCFS5Vof.js';
+export { cI as DEFAULT_TRANSFER_OWNERSHIP_LABELS, e_ as TransferCandidate, e$ as TransferOwnershipDialog, f0 as TransferOwnershipDialogProps, f1 as TransferOwnershipLabels, f2 as TransferUnavailable, f3 as TransferValues } from '../delete-account-setting-CpIhzxxZ.js';
 import './admin-parts.js';
 import '../components/tooltip.js';
 import '../hooks/use-anchored-rect.js';

package/dist/admin/user-roster.d.ts

@@ -6,7 +6,7 @@ import '../components/account-chips.js';
 import '../components/chip.js';
 import '../data-table-labels-DUELeXpa.js';
 import '../components/data-table-sort.js';
-export { bz as AdminUserStateFields, cJ as DEFAULT_USER_ROSTER_LABELS, et as RoleEditing, eB as RosterState, f8 as USER_ROSTER_SORT_KEYS, ff as UserIdentityCell, fg as UserIdentityCellProps, fh as UserRosterColumnsOptions, fi as UserRosterLabels, fj as UserRosterRow, fk as UserRosterSortKey, fl as UserRowAction, fm as UserRowActionList, fn as UserRowActions, fo as UserRowActionsProps, fp as adminUserStates, fO as useUserRosterColumns, fP as userRosterColumns, fQ as userRosterSort } from '../delete-account-setting-DCFS5Vof.js';
+export { bz as AdminUserStateFields, cJ as DEFAULT_USER_ROSTER_LABELS, et as RoleEditing, eB as RosterState, f8 as USER_ROSTER_SORT_KEYS, ff as UserIdentityCell, fg as UserIdentityCellProps, fh as UserRosterColumnsOptions, fi as UserRosterLabels, fj as UserRosterRow, fk as UserRosterSortKey, fl as UserRowAction, fm as UserRowActionList, fn as UserRowActions, fo as UserRowActionsProps, fp as adminUserStates, fO as useUserRosterColumns, fP as userRosterColumns, fQ as userRosterSort } from '../delete-account-setting-CpIhzxxZ.js';
 import '../components/swipeable-row.js';
 import '../components/tooltip.js';
 import '../hooks/use-anchored-rect.js';

package/dist/auth/register-form.d.ts

@@ -1,5 +1,5 @@
 import 'react';
-export { cB as DEFAULT_REGISTER_LABELS, ei as RegisterForm, ej as RegisterFormProps, ek as RegisterLabels, el as RegisterValues } from '../delete-account-setting-DCFS5Vof.js';
+export { cB as DEFAULT_REGISTER_LABELS, ei as RegisterForm, ej as RegisterFormProps, ek as RegisterLabels, el as RegisterValues } from '../delete-account-setting-CpIhzxxZ.js';
 import '../components/tooltip.js';
 import '../hooks/use-anchored-rect.js';
 import '../lib/clipping.js';

package/dist/auth/reset-password-form.d.ts

@@ -94,7 +94,7 @@ interface ResetPasswordFormProps extends Omit<ComponentPropsWithoutRef<"div">, "
     forgotHref?: string;
     /** The app's words for a failed save (the device offline), or `undefined` for the
      *  kit's: `rateLimited` for a bare `429` (0.30.0), else `failed`. Not asked for
-     *  `token_invalid`, which is a state. */
+     *  `token_invalid` or `token_expired`, which are a state. */
     describeError?: (error: unknown) => ReactNode | undefined;
     /** The heading. Default `labels.title`; `null` draws none, for a page that puts it
      *  in `AuthLayout`'s `title` instead. */

package/dist/auth/reset-password-form.js

@@ -124,7 +124,8 @@ function ResetPasswordForm({
       },
       (error) => {
         setPending(false);
-        if (authErrorCode(error) === "token_invalid") {
+        const code = authErrorCode(error);
+        if (code === "token_invalid" || code === "token_expired") {
           setPassword("");
           setConfirm("");
           setPhase({ token, phase: { kind: "invalid" } });

package/dist/auth/reset-password-form.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/reset-password-form.tsx"],"sourcesContent":["import { useEffect, useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, FormEvent, ReactNode } from \"react\";\nimport { CheckCircle2, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button, EmptyState } from \"../components/ui\";\nimport { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport { newPasswordProblem } from \"./form-rules\";\nimport { NewPasswordFields } from \"./new-password-fields\";\nimport {\n  FORM_HEADING_CLASS,\n  INTRO_CLASS,\n  OUTCOME_CLASS,\n  OutcomeMessage,\n  useFocusWhen,\n  useOncePerKey,\n  withQuery,\n} from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `resetPassword` namespace. keksdose's words\n *  (`auth.reset.*`), which kastlan took over. */\nexport interface ResetPasswordLabels {\n  /** The heading, on every state. */\n  title: string;\n  /** While the link is checked. */\n  checking: string;\n  /** Over the fields, given the account's address (when the check returned one). */\n  intro: (email: string) => string;\n  newPassword: string;\n  confirmPassword: string;\n  /** Under the confirmation while it differs. */\n  mismatch: string;\n  submit: string;\n  /** The new password was not saved, for a reason that is not the link. */\n  failed: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** The link is unknown, spent or expired — one sentence, as the server gives one\n   *  code (`token_invalid`). */\n  invalid: string;\n  /** Under it. */\n  invalidHint: string;\n  /** The way forward from an invalid link: back to \"Forgot password\". */\n  requestNew: string;\n  /** Done. */\n  success: string;\n  /** Under it: a reset ends every session (§6.3). */\n  sessionsEnded: string;\n  /** The button out — to sign-in, with the address filled in. */\n  signIn: string;\n  /** 0.30.0: the save was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  `Retry-After` wait in seconds, or `undefined` without one. OPTIONAL, like every key\n   *  added to a shipped interface; the provider's `resetPassword`, then English, fill\n   *  it. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_RESET_PASSWORD_LABELS: Required<ResetPasswordLabels> = {\n  title: \"Choose a new password\",\n  checking: \"Checking the link…\",\n  intro: (email) => `You’re setting a new password for ${email}.`,\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  mismatch: \"The passwords don’t match.\",\n  submit: \"Save password\",\n  failed: \"The password could not be changed.\",\n  noToken: \"This link is incomplete.\",\n  invalid: \"This link is invalid or has expired.\",\n  invalidHint: \"Links are valid for one hour and work only once. Just request a new one.\",\n  requestNew: \"Request a new link\",\n  success: \"Your password has been changed. You can sign in with it now.\",\n  sessionsEnded: \"Signed-in devices were signed out — you’ll need to sign in again there.\",\n  signIn: \"Go to sign in\",\n  rateLimited: englishRateLimited,\n};\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onCheck` may resolve with — keksdose's `/password-reset/check` answer. */\nexport interface ResetPasswordCheck {\n  /** The account's address: named over the fields (\"You're setting a new password for\n   *  …\") and handed to the password manager, which files the new password under it. */\n  email?: string;\n  /** The app's notices over the fields, shown BEFORE the password is typed — keksdose's\n   *  \"your account is end-to-end encrypted: this restores your sign-in, not your data\". */\n  notices?: ReactNode;\n}\n\n/** What `onSubmit` hands over. */\nexport interface ResetPasswordValues {\n  token: string;\n  password: string;\n}\n\n/** What `onSubmit` resolves with — keksdose's `/password-reset/confirm` answer, which\n *  carries no tokens (§6.3). */\nexport interface ResetPasswordResult {\n  /** The account's address — the sign-in it leads to is filled in with it. */\n  email: string;\n  /** The app's outcomes, shown on the done state: keksdose's recovery-code notice for an\n   *  encrypted account, \"Your 2 personal access tokens were revoked\". */\n  notices?: ReactNode;\n}\n\ntype Phase =\n  | { kind: \"form\"; check: ResetPasswordCheck }\n  | { kind: \"invalid\" }\n  | { kind: \"done\"; result: ResetPasswordResult };\n\nexport interface ResetPasswordFormProps\n  extends Omit<ComponentPropsWithoutRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=` (keksdose, kastlan: `/reset-password?token=…`).\n   *  Empty: the link was cut short, and the page says so without asking anyone. */\n  token: string;\n  /**\n   * Check the link before the form shows (`/auth/password-reset/check`) — once per\n   * token, on mount. Checking does not use it up, so a reload is free. Resolve (with\n   * the address and any notices) for a live link; reject for a dead one, and the page\n   * says \"This link is invalid or has expired\" with the way to a new one.\n   */\n  onCheck: (token: string) => Promise<ResetPasswordCheck | void | undefined>;\n  /**\n   * The new password was submitted: send `/auth/password-reset/confirm`. Resolve with\n   * the account's address (and the app's notices) — no tokens: a reset is not a sign-in\n   * (§6.3). Reject with the client's error: `token_invalid` (the link expired or was\n   * used in another tab while the form was open) goes to the invalid state; anything\n   * else stays on the form with the password kept.\n   */\n  onSubmit: (values: ResetPasswordValues) => Promise<ResetPasswordResult>;\n  /** \"Go to sign in\" calls this with the address, for an app that routes in code.\n   *  Without it, the button is a link to `signInHref`. */\n  onSignIn?: (email: string) => void;\n  /** Where \"Go to sign in\" leads, with `?email=` added — read it into `SignInForm`'s\n   *  `defaultEmail`. Default `/login`. */\n  signInHref?: string;\n  /** \"Request a new link\" — the app's \"Forgot password\" page. Default\n   *  `/forgot-password`. */\n  forgotHref?: string;\n  /** The app's words for a failed save (the device offline), or `undefined` for the\n   *  kit's: `rateLimited` for a bare `429` (0.30.0), else `failed`. Not asked for\n   *  `token_invalid`, which is a state. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<ResetPasswordLabels>;\n}\n\n/**\n * Redeem a password-reset link (`/reset-password?token=…`, docs/auth-harmonization.md\n * §6.3, §7) — keksdose's `ResetPasswordPage` (features/auth/reset-password-page.tsx),\n * which kastlan built its own on.\n *\n * **The link is checked first** (`onCheck`), and only then does the form appear: an\n * expired link should say so before someone types a new password twice, not after.\n *\n * **A reset is not a sign-in** (§6.3, §10.11). The confirm answers without tokens, so a\n * 2FA account cannot skip its second factor by way of its inbox, and the page ends on\n * \"Go to sign in\" with the address filled in — the person has just typed the new\n * password twice; signing in is one step. What else the reset did is said there:\n * every other session ended (the kit's line, true in all three apps), and the app's own\n * outcomes in `notices` — keksdose's recovery-code notice and its revoked API tokens.\n *\n * **The password** is chosen with the same fields as `RegisterForm` and `SignInForm`'s\n * set-password step ({@link NewPasswordFields}): the strength meter and its checklist as\n * advice, and only the two hard rules — at least 8 characters, at most 72 bytes (§8).\n * The submit waits for both and a matching confirmation.\n *\n * The form never sends a request itself (§8): the token and the password go to the\n * callbacks, and the page renders what they resolve with.\n */\nexport function ResetPasswordForm({\n  token,\n  onCheck,\n  onSubmit,\n  onSignIn,\n  signInHref = \"/login\",\n  forgotHref = \"/forgot-password\",\n  describeError,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ResetPasswordFormProps) {\n  const labels = useKitLabels(\"resetPassword\", DEFAULT_RESET_PASSWORD_LABELS, labelsProp);\n  // The phase belongs to the token it was reached with: a new token starts over at the\n  // check without a reset effect.\n  const [phase, setPhase] = useState<{ token: string; phase: Phase } | null>(null);\n  const current: Phase | \"checking\" =\n    token === \"\" ? { kind: \"invalid\" } : phase?.token === token ? phase.phase : \"checking\";\n\n  useOncePerKey(token === \"\" ? null : token, onCheck, (key, result) =>\n    setPhase({\n      token: key,\n      phase: result.ok ? { kind: \"form\", check: result.value ?? {} } : { kind: \"invalid\" },\n    }),\n  );\n\n  const [password, setPassword] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const headingId = useId();\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  const kind = current === \"checking\" ? \"checking\" : current.kind;\n\n  // The form arrives after the check: the field is where the person is going.\n  useEffect(() => {\n    if (kind === \"form\") passwordRef.current?.focus();\n  }, [kind]);\n  useFocusWhen(kind === \"done\", doneRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const rootClass = cn(\"space-y-3\", className);\n\n  if (current === \"checking\") {\n    return (\n      <div {...rest} data-state=\"checking\" aria-busy className={rootClass}>\n        {heading}\n        <LoadingState size=\"sm\" label={labels.checking} />\n      </div>\n    );\n  }\n\n  if (current.kind === \"invalid\") {\n    return (\n      <div {...rest} data-state=\"invalid\" className={rootClass}>\n        {heading}\n        <EmptyState\n          tone=\"danger\"\n          icon={<XCircle />}\n          title={token === \"\" ? labels.noToken : labels.invalid}\n          hint={labels.invalidHint}\n          action={\n            <Button href={forgotHref} variant=\"brand\">\n              {labels.requestNew}\n            </Button>\n          }\n          className={OUTCOME_CLASS}\n        />\n      </div>\n    );\n  }\n\n  if (current.kind === \"done\") {\n    const { email, notices } = current.result;\n    return (\n      <div {...rest} data-state=\"done\" className={rootClass}>\n        {heading}\n        <OutcomeMessage icon={<CheckCircle2 className=\"text-[var(--success)]\" />} focusRef={doneRef}>\n          <p className={INTRO_CLASS}>{labels.success}</p>\n        </OutcomeMessage>\n        {notices}\n        <p className=\"text-xs text-[var(--text-muted)]\">{labels.sessionsEnded}</p>\n        {onSignIn ? (\n          <Button type=\"button\" variant=\"brand\" className=\"w-full\" onClick={() => onSignIn(email)}>\n            {labels.signIn}\n          </Button>\n        ) : (\n          <Button href={email ? withQuery(signInHref, \"email\", email) : signInHref} variant=\"brand\" className=\"w-full\">\n            {labels.signIn}\n          </Button>\n        )}\n      </div>\n    );\n  }\n\n  const { email, notices } = current.check;\n  const problem = newPasswordProblem(password, confirm);\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    if (pending || problem !== null) return;\n    setFailure(null);\n    setPending(true);\n    Promise.resolve()\n      .then(() => onSubmit({ token, password }))\n      .then(\n        (result) => {\n          setPending(false);\n          setPassword(\"\");\n          setConfirm(\"\");\n          setPhase({ token, phase: { kind: \"done\", result } });\n        },\n        (error: unknown) => {\n          setPending(false);\n          if (authErrorCode(error) === \"token_invalid\") {\n            setPassword(\"\");\n            setConfirm(\"\");\n            setPhase({ token, phase: { kind: \"invalid\" } });\n            return;\n          }\n          // The app's words first, then the throttle's, then the kit's catch-all.\n          setFailure(\n            describeError?.(error) ??\n              (isRateLimited(error)\n                ? (labels.rateLimited ?? DEFAULT_RESET_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error))\n                : labels.failed),\n          );\n        },\n      );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={rootClass}>\n      <form className=\"space-y-3\" aria-labelledby={title === null ? undefined : headingId} onSubmit={submit}>\n        {heading}\n        {email ? <p className={INTRO_CLASS}>{labels.intro(email)}</p> : null}\n        {notices}\n        {/* Which account the new password is for, for the password manager: it files\n            the new password under this username instead of guessing (kastlan). */}\n        {email ? <input type=\"email\" name=\"username\" autoComplete=\"username\" value={email} readOnly hidden /> : null}\n        <NewPasswordFields\n          password={password}\n          confirm={confirm}\n          onPasswordChange={(next) => {\n            setPassword(next);\n            if (failure) setFailure(null);\n          }}\n          onConfirmChange={setConfirm}\n          busy={pending}\n          passwordRef={passwordRef}\n          text={{ password: labels.newPassword, confirm: labels.confirmPassword, mismatch: labels.mismatch }}\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" disabled={!pending && problem !== null} pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n    </div>\n  );\n}\n"],"mappings":";AAgOM,cAQA,YARA;AAhON,SAAS,WAAW,OAAO,QAAQ,gBAAgB;AAEnD,SAAS,cAAc,eAAe;AACtC,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,QAAQ,kBAAkB;AACnC,SAAS,eAAe,oBAAoB,eAAe,yBAAyB;AACpF,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA4CA,MAAM,gCAA+D;AAAA,EAC1E,OAAO;AAAA,EACP,UAAU;AAAA,EACV,OAAO,CAAC,UAAU,0CAAqC,KAAK;AAAA,EAC5D,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,aAAa;AACf;AAmGO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAiD,IAAI;AAC/E,QAAM,UACJ,UAAU,KAAK,EAAE,MAAM,UAAU,IAAI,OAAO,UAAU,QAAQ,MAAM,QAAQ;AAE9E;AAAA,IAAc,UAAU,KAAK,OAAO;AAAA,IAAO;AAAA,IAAS,CAAC,KAAK,WACxD,SAAS;AAAA,MACP,OAAO;AAAA,MACP,OAAO,OAAO,KAAK,EAAE,MAAM,QAAQ,OAAO,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU;AAAA,IACrF,CAAC;AAAA,EACH;AAEA,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,YAAY,MAAM;AACxB,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAC3C,QAAM,OAAO,YAAY,aAAa,aAAa,QAAQ;AAG3D,YAAU,MAAM;AACd,QAAI,SAAS,OAAQ,aAAY,SAAS,MAAM;AAAA,EAClD,GAAG,CAAC,IAAI,CAAC;AACT,eAAa,SAAS,QAAQ,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,YAAY,GAAG,aAAa,SAAS;AAE3C,MAAI,YAAY,YAAY;AAC1B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,YAAW,aAAS,MAAC,WAAW,WACvD;AAAA;AAAA,MACD,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,UAAU;AAAA,OAClD;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,WAAW;AAC9B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,WAAU,WAAW,WAC5C;AAAA;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAM,oBAAC,WAAQ;AAAA,UACf,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO;AAAA,UAC9C,MAAM,OAAO;AAAA,UACb,QACE,oBAAC,UAAO,MAAM,YAAY,SAAQ,SAC/B,iBAAO,YACV;AAAA,UAEF,WAAW;AAAA;AAAA,MACb;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,EAAE,OAAAA,QAAO,SAAAC,SAAQ,IAAI,QAAQ;AACnC,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WACzC;AAAA;AAAA,MACD,oBAAC,kBAAe,MAAM,oBAAC,gBAAa,WAAU,yBAAwB,GAAI,UAAU,SAClF,8BAAC,OAAE,WAAW,aAAc,iBAAO,SAAQ,GAC7C;AAAA,MACCA;AAAA,MACD,oBAAC,OAAE,WAAU,oCAAoC,iBAAO,eAAc;AAAA,MACrE,WACC,oBAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,WAAU,UAAS,SAAS,MAAM,SAASD,MAAK,GACnF,iBAAO,QACV,IAEA,oBAAC,UAAO,MAAMA,SAAQ,UAAU,YAAY,SAASA,MAAK,IAAI,YAAY,SAAQ,SAAQ,WAAU,UACjG,iBAAO,QACV;AAAA,OAEJ;AAAA,EAEJ;AAEA,QAAM,EAAE,OAAO,QAAQ,IAAI,QAAQ;AACnC,QAAM,UAAU,mBAAmB,UAAU,OAAO;AAEpD,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,QAAI,WAAW,YAAY,KAAM;AACjC,eAAW,IAAI;AACf,eAAW,IAAI;AACf,YAAQ,QAAQ,EACb,KAAK,MAAM,SAAS,EAAE,OAAO,SAAS,CAAC,CAAC,EACxC;AAAA,MACC,CAAC,WAAW;AACV,mBAAW,KAAK;AAChB,oBAAY,EAAE;AACd,mBAAW,EAAE;AACb,iBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,MACrD;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAChB,YAAI,cAAc,KAAK,MAAM,iBAAiB;AAC5C,sBAAY,EAAE;AACd,qBAAW,EAAE;AACb,mBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE,CAAC;AAC9C;AAAA,QACF;AAEA;AAAA,UACE,gBAAgB,KAAK,MAClB,cAAc,KAAK,KACf,OAAO,eAAe,8BAA8B,aAAa,kBAAkB,KAAK,CAAC,IAC1F,OAAO;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACJ;AAEA,SACE,oBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WAC1C,+BAAC,UAAK,WAAU,aAAY,mBAAiB,UAAU,OAAO,SAAY,WAAW,UAAU,QAC5F;AAAA;AAAA,IACA,QAAQ,oBAAC,OAAE,WAAW,aAAc,iBAAO,MAAM,KAAK,GAAE,IAAO;AAAA,IAC/D;AAAA,IAGA,QAAQ,oBAAC,WAAM,MAAK,SAAQ,MAAK,YAAW,cAAa,YAAW,OAAO,OAAO,UAAQ,MAAC,QAAM,MAAC,IAAK;AAAA,IACxG;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA,kBAAkB,CAAC,SAAS;AAC1B,sBAAY,IAAI;AAChB,cAAI,QAAS,YAAW,IAAI;AAAA,QAC9B;AAAA,QACA,iBAAiB;AAAA,QACjB,MAAM;AAAA,QACN;AAAA,QACA,MAAM,EAAE,UAAU,OAAO,aAAa,SAAS,OAAO,iBAAiB,UAAU,OAAO,SAAS;AAAA;AAAA,IACnG;AAAA,IACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,IAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,YAAY,MAAM,SAC9E,iBAAO,QACV;AAAA,KACF,GACF;AAEJ;","names":["email","notices"]}
+{"version":3,"sources":["../../src/auth/reset-password-form.tsx"],"sourcesContent":["import { useEffect, useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, FormEvent, ReactNode } from \"react\";\nimport { CheckCircle2, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button, EmptyState } from \"../components/ui\";\nimport { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport { newPasswordProblem } from \"./form-rules\";\nimport { NewPasswordFields } from \"./new-password-fields\";\nimport {\n  FORM_HEADING_CLASS,\n  INTRO_CLASS,\n  OUTCOME_CLASS,\n  OutcomeMessage,\n  useFocusWhen,\n  useOncePerKey,\n  withQuery,\n} from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `resetPassword` namespace. keksdose's words\n *  (`auth.reset.*`), which kastlan took over. */\nexport interface ResetPasswordLabels {\n  /** The heading, on every state. */\n  title: string;\n  /** While the link is checked. */\n  checking: string;\n  /** Over the fields, given the account's address (when the check returned one). */\n  intro: (email: string) => string;\n  newPassword: string;\n  confirmPassword: string;\n  /** Under the confirmation while it differs. */\n  mismatch: string;\n  submit: string;\n  /** The new password was not saved, for a reason that is not the link. */\n  failed: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** The link is unknown, spent or expired — one sentence, as the server gives one\n   *  code (`token_invalid`). */\n  invalid: string;\n  /** Under it. */\n  invalidHint: string;\n  /** The way forward from an invalid link: back to \"Forgot password\". */\n  requestNew: string;\n  /** Done. */\n  success: string;\n  /** Under it: a reset ends every session (§6.3). */\n  sessionsEnded: string;\n  /** The button out — to sign-in, with the address filled in. */\n  signIn: string;\n  /** 0.30.0: the save was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  `Retry-After` wait in seconds, or `undefined` without one. OPTIONAL, like every key\n   *  added to a shipped interface; the provider's `resetPassword`, then English, fill\n   *  it. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_RESET_PASSWORD_LABELS: Required<ResetPasswordLabels> = {\n  title: \"Choose a new password\",\n  checking: \"Checking the link…\",\n  intro: (email) => `You’re setting a new password for ${email}.`,\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  mismatch: \"The passwords don’t match.\",\n  submit: \"Save password\",\n  failed: \"The password could not be changed.\",\n  noToken: \"This link is incomplete.\",\n  invalid: \"This link is invalid or has expired.\",\n  invalidHint: \"Links are valid for one hour and work only once. Just request a new one.\",\n  requestNew: \"Request a new link\",\n  success: \"Your password has been changed. You can sign in with it now.\",\n  sessionsEnded: \"Signed-in devices were signed out — you’ll need to sign in again there.\",\n  signIn: \"Go to sign in\",\n  rateLimited: englishRateLimited,\n};\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onCheck` may resolve with — keksdose's `/password-reset/check` answer. */\nexport interface ResetPasswordCheck {\n  /** The account's address: named over the fields (\"You're setting a new password for\n   *  …\") and handed to the password manager, which files the new password under it. */\n  email?: string;\n  /** The app's notices over the fields, shown BEFORE the password is typed — keksdose's\n   *  \"your account is end-to-end encrypted: this restores your sign-in, not your data\". */\n  notices?: ReactNode;\n}\n\n/** What `onSubmit` hands over. */\nexport interface ResetPasswordValues {\n  token: string;\n  password: string;\n}\n\n/** What `onSubmit` resolves with — keksdose's `/password-reset/confirm` answer, which\n *  carries no tokens (§6.3). */\nexport interface ResetPasswordResult {\n  /** The account's address — the sign-in it leads to is filled in with it. */\n  email: string;\n  /** The app's outcomes, shown on the done state: keksdose's recovery-code notice for an\n   *  encrypted account, \"Your 2 personal access tokens were revoked\". */\n  notices?: ReactNode;\n}\n\ntype Phase =\n  | { kind: \"form\"; check: ResetPasswordCheck }\n  | { kind: \"invalid\" }\n  | { kind: \"done\"; result: ResetPasswordResult };\n\nexport interface ResetPasswordFormProps\n  extends Omit<ComponentPropsWithoutRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=` (keksdose, kastlan: `/reset-password?token=…`).\n   *  Empty: the link was cut short, and the page says so without asking anyone. */\n  token: string;\n  /**\n   * Check the link before the form shows (`/auth/password-reset/check`) — once per\n   * token, on mount. Checking does not use it up, so a reload is free. Resolve (with\n   * the address and any notices) for a live link; reject for a dead one, and the page\n   * says \"This link is invalid or has expired\" with the way to a new one.\n   */\n  onCheck: (token: string) => Promise<ResetPasswordCheck | void | undefined>;\n  /**\n   * The new password was submitted: send `/auth/password-reset/confirm`. Resolve with\n   * the account's address (and the app's notices) — no tokens: a reset is not a sign-in\n   * (§6.3). Reject with the client's error: `token_invalid` (the link expired or was\n   * used in another tab while the form was open) goes to the invalid state; anything\n   * else stays on the form with the password kept.\n   */\n  onSubmit: (values: ResetPasswordValues) => Promise<ResetPasswordResult>;\n  /** \"Go to sign in\" calls this with the address, for an app that routes in code.\n   *  Without it, the button is a link to `signInHref`. */\n  onSignIn?: (email: string) => void;\n  /** Where \"Go to sign in\" leads, with `?email=` added — read it into `SignInForm`'s\n   *  `defaultEmail`. Default `/login`. */\n  signInHref?: string;\n  /** \"Request a new link\" — the app's \"Forgot password\" page. Default\n   *  `/forgot-password`. */\n  forgotHref?: string;\n  /** The app's words for a failed save (the device offline), or `undefined` for the\n   *  kit's: `rateLimited` for a bare `429` (0.30.0), else `failed`. Not asked for\n   *  `token_invalid` or `token_expired`, which are a state. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<ResetPasswordLabels>;\n}\n\n/**\n * Redeem a password-reset link (`/reset-password?token=…`, docs/auth-harmonization.md\n * §6.3, §7) — keksdose's `ResetPasswordPage` (features/auth/reset-password-page.tsx),\n * which kastlan built its own on.\n *\n * **The link is checked first** (`onCheck`), and only then does the form appear: an\n * expired link should say so before someone types a new password twice, not after.\n *\n * **A reset is not a sign-in** (§6.3, §10.11). The confirm answers without tokens, so a\n * 2FA account cannot skip its second factor by way of its inbox, and the page ends on\n * \"Go to sign in\" with the address filled in — the person has just typed the new\n * password twice; signing in is one step. What else the reset did is said there:\n * every other session ended (the kit's line, true in all three apps), and the app's own\n * outcomes in `notices` — keksdose's recovery-code notice and its revoked API tokens.\n *\n * **The password** is chosen with the same fields as `RegisterForm` and `SignInForm`'s\n * set-password step ({@link NewPasswordFields}): the strength meter and its checklist as\n * advice, and only the two hard rules — at least 8 characters, at most 72 bytes (§8).\n * The submit waits for both and a matching confirmation.\n *\n * The form never sends a request itself (§8): the token and the password go to the\n * callbacks, and the page renders what they resolve with.\n */\nexport function ResetPasswordForm({\n  token,\n  onCheck,\n  onSubmit,\n  onSignIn,\n  signInHref = \"/login\",\n  forgotHref = \"/forgot-password\",\n  describeError,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ResetPasswordFormProps) {\n  const labels = useKitLabels(\"resetPassword\", DEFAULT_RESET_PASSWORD_LABELS, labelsProp);\n  // The phase belongs to the token it was reached with: a new token starts over at the\n  // check without a reset effect.\n  const [phase, setPhase] = useState<{ token: string; phase: Phase } | null>(null);\n  const current: Phase | \"checking\" =\n    token === \"\" ? { kind: \"invalid\" } : phase?.token === token ? phase.phase : \"checking\";\n\n  useOncePerKey(token === \"\" ? null : token, onCheck, (key, result) =>\n    setPhase({\n      token: key,\n      phase: result.ok ? { kind: \"form\", check: result.value ?? {} } : { kind: \"invalid\" },\n    }),\n  );\n\n  const [password, setPassword] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const headingId = useId();\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  const kind = current === \"checking\" ? \"checking\" : current.kind;\n\n  // The form arrives after the check: the field is where the person is going.\n  useEffect(() => {\n    if (kind === \"form\") passwordRef.current?.focus();\n  }, [kind]);\n  useFocusWhen(kind === \"done\", doneRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const rootClass = cn(\"space-y-3\", className);\n\n  if (current === \"checking\") {\n    return (\n      <div {...rest} data-state=\"checking\" aria-busy className={rootClass}>\n        {heading}\n        <LoadingState size=\"sm\" label={labels.checking} />\n      </div>\n    );\n  }\n\n  if (current.kind === \"invalid\") {\n    return (\n      <div {...rest} data-state=\"invalid\" className={rootClass}>\n        {heading}\n        <EmptyState\n          tone=\"danger\"\n          icon={<XCircle />}\n          title={token === \"\" ? labels.noToken : labels.invalid}\n          hint={labels.invalidHint}\n          action={\n            <Button href={forgotHref} variant=\"brand\">\n              {labels.requestNew}\n            </Button>\n          }\n          className={OUTCOME_CLASS}\n        />\n      </div>\n    );\n  }\n\n  if (current.kind === \"done\") {\n    const { email, notices } = current.result;\n    return (\n      <div {...rest} data-state=\"done\" className={rootClass}>\n        {heading}\n        <OutcomeMessage icon={<CheckCircle2 className=\"text-[var(--success)]\" />} focusRef={doneRef}>\n          <p className={INTRO_CLASS}>{labels.success}</p>\n        </OutcomeMessage>\n        {notices}\n        <p className=\"text-xs text-[var(--text-muted)]\">{labels.sessionsEnded}</p>\n        {onSignIn ? (\n          <Button type=\"button\" variant=\"brand\" className=\"w-full\" onClick={() => onSignIn(email)}>\n            {labels.signIn}\n          </Button>\n        ) : (\n          <Button href={email ? withQuery(signInHref, \"email\", email) : signInHref} variant=\"brand\" className=\"w-full\">\n            {labels.signIn}\n          </Button>\n        )}\n      </div>\n    );\n  }\n\n  const { email, notices } = current.check;\n  const problem = newPasswordProblem(password, confirm);\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    if (pending || problem !== null) return;\n    setFailure(null);\n    setPending(true);\n    Promise.resolve()\n      .then(() => onSubmit({ token, password }))\n      .then(\n        (result) => {\n          setPending(false);\n          setPassword(\"\");\n          setConfirm(\"\");\n          setPhase({ token, phase: { kind: \"done\", result } });\n        },\n        (error: unknown) => {\n          setPending(false);\n          // A link that died between the check and the save — used, or run out — is the\n          // dead-link state, under either code (0.31.1: keksdose mapped `token_expired`\n          // to it itself, `asDeadLink`).\n          const code = authErrorCode(error);\n          if (code === \"token_invalid\" || code === \"token_expired\") {\n            setPassword(\"\");\n            setConfirm(\"\");\n            setPhase({ token, phase: { kind: \"invalid\" } });\n            return;\n          }\n          // The app's words first, then the throttle's, then the kit's catch-all.\n          setFailure(\n            describeError?.(error) ??\n              (isRateLimited(error)\n                ? (labels.rateLimited ?? DEFAULT_RESET_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error))\n                : labels.failed),\n          );\n        },\n      );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={rootClass}>\n      <form className=\"space-y-3\" aria-labelledby={title === null ? undefined : headingId} onSubmit={submit}>\n        {heading}\n        {email ? <p className={INTRO_CLASS}>{labels.intro(email)}</p> : null}\n        {notices}\n        {/* Which account the new password is for, for the password manager: it files\n            the new password under this username instead of guessing (kastlan). */}\n        {email ? <input type=\"email\" name=\"username\" autoComplete=\"username\" value={email} readOnly hidden /> : null}\n        <NewPasswordFields\n          password={password}\n          confirm={confirm}\n          onPasswordChange={(next) => {\n            setPassword(next);\n            if (failure) setFailure(null);\n          }}\n          onConfirmChange={setConfirm}\n          busy={pending}\n          passwordRef={passwordRef}\n          text={{ password: labels.newPassword, confirm: labels.confirmPassword, mismatch: labels.mismatch }}\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" disabled={!pending && problem !== null} pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n    </div>\n  );\n}\n"],"mappings":";AAgOM,cAQA,YARA;AAhON,SAAS,WAAW,OAAO,QAAQ,gBAAgB;AAEnD,SAAS,cAAc,eAAe;AACtC,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,QAAQ,kBAAkB;AACnC,SAAS,eAAe,oBAAoB,eAAe,yBAAyB;AACpF,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA4CA,MAAM,gCAA+D;AAAA,EAC1E,OAAO;AAAA,EACP,UAAU;AAAA,EACV,OAAO,CAAC,UAAU,0CAAqC,KAAK;AAAA,EAC5D,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,aAAa;AACf;AAmGO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAiD,IAAI;AAC/E,QAAM,UACJ,UAAU,KAAK,EAAE,MAAM,UAAU,IAAI,OAAO,UAAU,QAAQ,MAAM,QAAQ;AAE9E;AAAA,IAAc,UAAU,KAAK,OAAO;AAAA,IAAO;AAAA,IAAS,CAAC,KAAK,WACxD,SAAS;AAAA,MACP,OAAO;AAAA,MACP,OAAO,OAAO,KAAK,EAAE,MAAM,QAAQ,OAAO,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU;AAAA,IACrF,CAAC;AAAA,EACH;AAEA,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,YAAY,MAAM;AACxB,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAC3C,QAAM,OAAO,YAAY,aAAa,aAAa,QAAQ;AAG3D,YAAU,MAAM;AACd,QAAI,SAAS,OAAQ,aAAY,SAAS,MAAM;AAAA,EAClD,GAAG,CAAC,IAAI,CAAC;AACT,eAAa,SAAS,QAAQ,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,YAAY,GAAG,aAAa,SAAS;AAE3C,MAAI,YAAY,YAAY;AAC1B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,YAAW,aAAS,MAAC,WAAW,WACvD;AAAA;AAAA,MACD,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,UAAU;AAAA,OAClD;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,WAAW;AAC9B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,WAAU,WAAW,WAC5C;AAAA;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAM,oBAAC,WAAQ;AAAA,UACf,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO;AAAA,UAC9C,MAAM,OAAO;AAAA,UACb,QACE,oBAAC,UAAO,MAAM,YAAY,SAAQ,SAC/B,iBAAO,YACV;AAAA,UAEF,WAAW;AAAA;AAAA,MACb;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,EAAE,OAAAA,QAAO,SAAAC,SAAQ,IAAI,QAAQ;AACnC,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WACzC;AAAA;AAAA,MACD,oBAAC,kBAAe,MAAM,oBAAC,gBAAa,WAAU,yBAAwB,GAAI,UAAU,SAClF,8BAAC,OAAE,WAAW,aAAc,iBAAO,SAAQ,GAC7C;AAAA,MACCA;AAAA,MACD,oBAAC,OAAE,WAAU,oCAAoC,iBAAO,eAAc;AAAA,MACrE,WACC,oBAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,WAAU,UAAS,SAAS,MAAM,SAASD,MAAK,GACnF,iBAAO,QACV,IAEA,oBAAC,UAAO,MAAMA,SAAQ,UAAU,YAAY,SAASA,MAAK,IAAI,YAAY,SAAQ,SAAQ,WAAU,UACjG,iBAAO,QACV;AAAA,OAEJ;AAAA,EAEJ;AAEA,QAAM,EAAE,OAAO,QAAQ,IAAI,QAAQ;AACnC,QAAM,UAAU,mBAAmB,UAAU,OAAO;AAEpD,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,QAAI,WAAW,YAAY,KAAM;AACjC,eAAW,IAAI;AACf,eAAW,IAAI;AACf,YAAQ,QAAQ,EACb,KAAK,MAAM,SAAS,EAAE,OAAO,SAAS,CAAC,CAAC,EACxC;AAAA,MACC,CAAC,WAAW;AACV,mBAAW,KAAK;AAChB,oBAAY,EAAE;AACd,mBAAW,EAAE;AACb,iBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,MACrD;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAIhB,cAAM,OAAO,cAAc,KAAK;AAChC,YAAI,SAAS,mBAAmB,SAAS,iBAAiB;AACxD,sBAAY,EAAE;AACd,qBAAW,EAAE;AACb,mBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE,CAAC;AAC9C;AAAA,QACF;AAEA;AAAA,UACE,gBAAgB,KAAK,MAClB,cAAc,KAAK,KACf,OAAO,eAAe,8BAA8B,aAAa,kBAAkB,KAAK,CAAC,IAC1F,OAAO;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACJ;AAEA,SACE,oBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WAC1C,+BAAC,UAAK,WAAU,aAAY,mBAAiB,UAAU,OAAO,SAAY,WAAW,UAAU,QAC5F;AAAA;AAAA,IACA,QAAQ,oBAAC,OAAE,WAAW,aAAc,iBAAO,MAAM,KAAK,GAAE,IAAO;AAAA,IAC/D;AAAA,IAGA,QAAQ,oBAAC,WAAM,MAAK,SAAQ,MAAK,YAAW,cAAa,YAAW,OAAO,OAAO,UAAQ,MAAC,QAAM,MAAC,IAAK;AAAA,IACxG;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA,kBAAkB,CAAC,SAAS;AAC1B,sBAAY,IAAI;AAChB,cAAI,QAAS,YAAW,IAAI;AAAA,QAC9B;AAAA,QACA,iBAAiB;AAAA,QACjB,MAAM;AAAA,QACN;AAAA,QACA,MAAM,EAAE,UAAU,OAAO,aAAa,SAAS,OAAO,iBAAiB,UAAU,OAAO,SAAS;AAAA;AAAA,IACnG;AAAA,IACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,IAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,YAAY,MAAM,SAC9E,iBAAO,QACV;AAAA,KACF,GACF;AAEJ;","names":["email","notices"]}

package/dist/auth/verify-email.d.ts

@@ -30,6 +30,10 @@ interface VerifyEmailLabels {
     resent: string;
     /** Said (and shown) after a resend failed. */
     resendError: string;
+    /** 0.31.1: a resend refused as throttled — HTTP 429 (`isRateLimited`) — given the
+     *  `Retry-After` seconds, when the app's `describeError` has no words of its own
+     *  (keksdose borrowed the sign-in namespace's). */
+    rateLimited?: (seconds?: number) => string;
     /** The banner's message. */
     banner: string;
     /** The banner's ×: it defers, it does not close anything. */

package/dist/auth/verify-email.js

@@ -9,7 +9,7 @@ import { AlertBanner } from "../components/alert-banner.js";
 import { LoadingState } from "../components/loading-state.js";
 import { Button, EmptyState } from "../components/ui.js";
 import { OUTCOME_CLASS, STATUS_HEADING_CLASS, isThenable, useOncePerKey } from "./status-parts.js";
-import { authErrorCode } from "./auth-errors.js";
+import { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from "./auth-errors.js";
 const DEFAULT_VERIFY_EMAIL_LABELS = {
   title: "Confirm your email address",
   verifying: "Confirming\u2026",
@@ -25,6 +25,7 @@ const DEFAULT_VERIFY_EMAIL_LABELS = {
   resendIn: (seconds) => `Send again in ${seconds} s`,
   resent: "Confirmation email sent",
   resendError: "Could not send the confirmation email",
+  rateLimited: englishRateLimited,
   banner: "Please confirm your email address.",
   dismiss: "Not now"
 };
@@ -90,7 +91,7 @@ function ResendStatus({
   labels,
   className
 }) {
-  const failed = phase === "failed" ? describeError?.(error) ?? labels.resendError : "";
+  const failed = phase === "failed" ? describeError?.(error) ?? (isRateLimited(error) ? (labels.rateLimited ?? englishRateLimited)(retryAfterSeconds(error)) : labels.resendError) : "";
   return /* @__PURE__ */ jsx(
     "span",
     {

package/dist/auth/verify-email.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/verify-email.tsx"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, ReactNode } from \"react\";\nimport { CheckCircle2, MailWarning, TimerOff, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { useAnnounce } from \"../hooks/use-announce\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button, EmptyState } from \"../components/ui\";\nimport { OUTCOME_CLASS, STATUS_HEADING_CLASS, isThenable, useOncePerKey } from \"./status-parts\";\nimport { authErrorCode } from \"./auth-errors\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the verification page and banner render — the `verifyEmail` namespace.\n *  keksdose's words (`verify_email.*`, and its server's \"has expired\"). */\nexport interface VerifyEmailLabels {\n  /** The page's heading. */\n  title: string;\n  /** While the link is redeemed. */\n  verifying: string;\n  verified: string;\n  /** The way on from the page — into the app, or to sign-in. */\n  continue: string;\n  invalid: string;\n  expired: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** Under `invalid`: why a link stops working. */\n  invalidHint: string;\n  /** Under a dead link, signed out: where a new one comes from. */\n  requestInApp: string;\n  /** Under a dead link, signed in, beside \"Send again\". */\n  requestHere: string;\n  /** The resend button, on the page and in the banner. */\n  resend: string;\n  /** The resend button while a just-sent mail cools down, given the seconds left. */\n  resendIn: (seconds: number) => string;\n  /** Said (and shown) after a resend went out. */\n  resent: string;\n  /** Said (and shown) after a resend failed. */\n  resendError: string;\n  /** The banner's message. */\n  banner: string;\n  /** The banner's ×: it defers, it does not close anything. */\n  dismiss: string;\n}\n\nexport const DEFAULT_VERIFY_EMAIL_LABELS: VerifyEmailLabels = {\n  title: \"Confirm your email address\",\n  verifying: \"Confirming…\",\n  verified: \"Your email address is confirmed.\",\n  continue: \"Continue\",\n  invalid: \"This confirmation link is not valid\",\n  expired: \"This confirmation link has expired\",\n  noToken: \"This link is missing its confirmation token.\",\n  invalidHint: \"The link may have expired or already been used.\",\n  requestInApp: \"You can request a new one from inside the app.\",\n  requestHere: \"You can request a new one here.\",\n  resend: \"Send again\",\n  resendIn: (seconds) => `Send again in ${seconds} s`,\n  resent: \"Confirmation email sent\",\n  resendError: \"Could not send the confirmation email\",\n  banner: \"Please confirm your email address.\",\n  dismiss: \"Not now\",\n};\n\n/** A minute: long enough that an impatient second click does not mail twice, short\n *  enough that a mail lost to a spam filter can be re-sent without leaving the page. The\n *  server's own limit is the real one (kastlan: 3 an hour per address). */\nconst DEFAULT_COOLDOWN = 60;\n\n/* ── Resend ──────────────────────────────────────────────────────────────── */\n\ntype ResendPhase = \"idle\" | \"sending\" | \"sent\" | \"failed\";\n\n/**\n * \"Send again\" with its own memory: busy while the request runs, then — after a mail\n * went out — held for `cooldown` seconds with the countdown on the button, so a second\n * click cannot mail twice and a throttled server is not asked to refuse. A failure frees\n * it at once. The outcome is a polite live region that is always rendered (a region that\n * mounts with its message is often not read), and visible.\n */\nfunction useResend(onResend: (() => Promise<unknown> | void) | undefined, cooldown: number) {\n  const [phase, setPhase] = useState<ResendPhase>(\"idle\");\n  // The refusal itself, for `describeError` (0.29.1): the server's own sentence — keksdose's\n  // per-address throttle, \"try again in N minutes\" — beats a fixed \"could not send\".\n  const [error, setError] = useState<unknown>(undefined);\n  const [remaining, setRemaining] = useState(0);\n  const counting = remaining > 0;\n  useEffect(() => {\n    if (!counting) return;\n    const id = setInterval(() => setRemaining((r) => Math.max(0, r - 1)), 1000);\n    return () => clearInterval(id);\n  }, [counting]);\n\n  const sent = () => {\n    setPhase(\"sent\");\n    setRemaining(Math.max(0, Math.round(cooldown)));\n  };\n  const send = () => {\n    if (!onResend || phase === \"sending\" || counting) return;\n    let result: unknown;\n    try {\n      result = onResend();\n    } catch (e) {\n      setError(e);\n      setPhase(\"failed\");\n      return;\n    }\n    if (!isThenable(result)) {\n      sent();\n      return;\n    }\n    setPhase(\"sending\");\n    result.then(sent, (e: unknown) => {\n      setError(e);\n      setPhase(\"failed\");\n    });\n  };\n  return { phase, remaining, send, error };\n}\n\nfunction ResendButton({\n  state,\n  labels,\n  variant,\n}: {\n  state: ReturnType<typeof useResend>;\n  labels: VerifyEmailLabels;\n  variant: \"secondary\" | \"brand\";\n}) {\n  return (\n    <Button\n      type=\"button\"\n      variant={variant}\n      size={variant === \"secondary\" ? \"sm\" : undefined}\n      onClick={state.send}\n      pending={state.phase === \"sending\"}\n      // `disabledReason`, not `disabled`: the button just pressed has the focus, and a\n      // native `disabled` would drop it to <body>. The reason is what just happened.\n      disabledReason={state.remaining > 0 ? labels.resent : undefined}\n    >\n      {state.remaining > 0 ? labels.resendIn(state.remaining) : labels.resend}\n    </Button>\n  );\n}\n\nfunction ResendStatus({\n  phase,\n  error,\n  describeError,\n  labels,\n  className,\n}: {\n  phase: ResendPhase;\n  error?: unknown;\n  describeError?: (error: unknown) => string | undefined;\n  labels: VerifyEmailLabels;\n  className?: string;\n}) {\n  const failed = phase === \"failed\" ? (describeError?.(error) ?? labels.resendError) : \"\";\n  return (\n    <span\n      role=\"status\"\n      className={cn(phase === \"failed\" ? \"text-[var(--danger)]\" : \"text-[var(--success)]\", className)}\n    >\n      {phase === \"sent\" ? labels.resent : failed}\n    </span>\n  );\n}\n\n/* ── The page ────────────────────────────────────────────────────────────── */\n\n/** What became of a confirmation link that did not verify. */\nexport type VerifyEmailFailure = \"invalid\" | \"expired\";\n\n/** The default when the app gives no `classifyError`: the coded refusal decides. */\nfunction defaultVerifyFailure(error: unknown): VerifyEmailFailure {\n  return authErrorCode(error) === \"token_expired\" ? \"expired\" : \"invalid\";\n}\n\nexport interface VerifyEmailStatusProps extends Omit<ComponentPropsWithoutRef<\"div\">, \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=`. Empty: the link was cut short, and the\n   *  page says so without asking anyone. */\n  token: string;\n  /**\n   * Redeem it — `POST /auth/verify-email {token}`, once per token, on mount. A POST and\n   * not the link's own GET (§10.10): a mail scanner that opens every link must not\n   * confirm an address nobody read. Resolve when it verified (an address that already\n   * was counts: keksdose's redeem is idempotent); reject with the client's error.\n   */\n  onVerify: (token: string) => Promise<unknown>;\n  /** Which dead end a rejection is. Default: `invalid` for everything — §5.2's servers\n   *  answer one `token_invalid`; an app whose server tells expiry apart maps it here. */\n  classifyError?: (error: unknown) => VerifyEmailFailure;\n  /** 0.29.1: the words for a refused resend — the server's own sentence (a throttle's\n   *  \"try again in N minutes\"), else the kit's `resendError`. */\n  describeError?: (error: unknown) => string | undefined;\n  /** Someone is signed in on this device: \"Continue\" goes into the app, and a dead link\n   *  offers \"Send again\" (with `onResend`). */\n  signedIn?: boolean;\n  /** Send a new confirmation mail (`POST /auth/verify-email/resend`) — offered on a dead\n   *  link while signed in. */\n  onResend?: () => Promise<unknown> | void;\n  /** Seconds \"Send again\" waits after a mail went out. Default 60; `0` never waits. */\n  cooldown?: number;\n  /** Where \"Continue\" goes. Default `/` signed in, `/login` signed out. */\n  continueHref?: string;\n  /** App content under \"confirmed\" — keksdose's \"Others can now share a budget with you\n   *  directly.\" */\n  verifiedContent?: ReactNode;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it in\n   *  `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<VerifyEmailLabels>;\n}\n\ntype VerifyOutcome = \"verified\" | VerifyEmailFailure;\n\n/**\n * Redeem an email-confirmation link (`/verify-email?token=…`, docs/auth-harmonization.md\n * §7) — keksdose's `VerifyEmailPage` (features/auth/verify-email-page.tsx), with\n * kastlan's outcome blocks and its separate \"expired\".\n *\n * Opened from an inbox, often in a browser with no session, so the token is the only\n * credential and the page renders signed-out. It redeems once per token on mount\n * (StrictMode's double effect included — the token is single-use) and shows one of:\n * confirmed; not valid; expired; or the link had no token at all. Verification gates\n * nothing (§2.8), so every outcome ends on \"Continue\". Signed in, a dead link also\n * offers \"Send again\", which waits `cooldown` seconds after a mail went out.\n *\n * The outcome replaces the spinner, which says nothing to a screen reader on its own,\n * so it is also announced.\n */\nexport function VerifyEmailStatus({\n  token,\n  onVerify,\n  classifyError,\n  describeError,\n  signedIn = false,\n  onResend,\n  cooldown = DEFAULT_COOLDOWN,\n  continueHref,\n  verifiedContent,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: VerifyEmailStatusProps) {\n  const labels = useKitLabels(\"verifyEmail\", DEFAULT_VERIFY_EMAIL_LABELS, labelsProp);\n  const [settled, setSettled] = useState<{ token: string; outcome: VerifyOutcome } | null>(null);\n  const outcome: VerifyOutcome | \"verifying\" =\n    token === \"\" ? \"invalid\" : settled?.token === token ? settled.outcome : \"verifying\";\n  const { announce, regionProps } = useAnnounce();\n  const resend = useResend(onResend, cooldown);\n\n  useOncePerKey(token === \"\" ? null : token, onVerify, (key, result) => {\n    // Without a classifier, the coded refusal decides (0.29.1): `token_expired` is\n    // \"expired\", anything else \"invalid\".\n    const next: VerifyOutcome = result.ok\n      ? \"verified\"\n      : (classifyError ?? defaultVerifyFailure)(result.error);\n    setSettled({ token: key, outcome: next });\n    announce(labels[next]);\n  });\n\n  const href = continueHref ?? (signedIn ? \"/\" : \"/login\");\n  // `replace`: the token is spent, so Back must not land on this page again (keksdose F1).\n  const continueButton = (\n    <Button href={href} replace variant={outcome === \"verified\" ? \"brand\" : \"secondary\"}>\n      {labels.continue}\n    </Button>\n  );\n  const canResend = signedIn && onResend !== undefined;\n\n  let body: ReactNode;\n  if (outcome === \"verifying\") {\n    body = <LoadingState size=\"sm\" label={labels.verifying} />;\n  } else if (outcome === \"verified\") {\n    body = (\n      <EmptyState\n        tone=\"success\"\n        icon={<CheckCircle2 />}\n        title={labels.verified}\n        hint={verifiedContent}\n        action={continueButton}\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else {\n    const hint = (\n      <>\n        {outcome === \"invalid\" && token !== \"\" ? `${labels.invalidHint} ` : \"\"}\n        {canResend ? labels.requestHere : labels.requestInApp}\n      </>\n    );\n    body = (\n      <EmptyState\n        tone=\"danger\"\n        icon={outcome === \"expired\" ? <TimerOff /> : <XCircle />}\n        title={token === \"\" ? labels.noToken : labels[outcome]}\n        hint={hint}\n        action={\n          <>\n            {canResend && <ResendButton state={resend} labels={labels} variant=\"brand\" />}\n            {continueButton}\n          </>\n        }\n        className={OUTCOME_CLASS}\n      />\n    );\n  }\n\n  return (\n    <div\n      {...rest}\n      data-state={outcome}\n      aria-busy={outcome === \"verifying\" || undefined}\n      className={cn(\"space-y-3\", className)}\n    >\n      {title === null ? null : <Heading className={STATUS_HEADING_CLASS}>{title ?? labels.title}</Heading>}\n      {body}\n      {canResend && (\n        <ResendStatus\n          phase={resend.phase}\n          error={resend.error}\n          describeError={describeError}\n          labels={labels}\n          className=\"block text-center text-xs\"\n        />\n      )}\n      {/* Rendered from the start, so the outcome is read when it arrives. */}\n      <div {...regionProps} />\n    </div>\n  );\n}\n\n/* ── The banner ──────────────────────────────────────────────────────────── */\n\nexport interface EmailVerificationBannerProps {\n  /** Send a new confirmation mail (`POST /auth/verify-email/resend`). Resolve when it\n   *  went out; reject and the banner says it could not. */\n  onResend: () => Promise<unknown> | void;\n  /** 0.29.1: the words for a refused resend — the server's own sentence, else the kit's. */\n  describeError?: (error: unknown) => string | undefined;\n  /** Seconds \"Send again\" waits after a mail went out. Default 60; `0` never waits. */\n  cooldown?: number;\n  /** The ×, \"Not now\". The banner does not hide itself: the app stops rendering it —\n   *  keksdose for the rest of the session. Left out, no ×. */\n  onDismiss?: () => void;\n  /** `strip` (default): keksdose's band across the top of the shell. `box`: kastlan's\n   *  callout inside the page. */\n  variant?: \"strip\" | \"box\";\n  /** The app's sentence after the kit's — keksdose's \"Until you do, nobody can share a\n   *  budget with you directly.\" */\n  children?: ReactNode;\n  className?: string;\n  labels?: Partial<VerifyEmailLabels>;\n}\n\n/**\n * The nudge for a signed-in account whose address is not confirmed — keksdose's\n * `VerifyEmailBanner` (features/auth/verify-email-banner.tsx), kastlan's copy of it.\n *\n * A prompt, not a wall: verification gates nothing (§2.8). The app renders it while\n * `/auth/me` says `email_verified: false`, and stops when the user dismisses it or the\n * page above confirms the address. \"Send again\" waits `cooldown` seconds after a mail\n * went out (the button says how long), and its outcome is written into the banner and\n * read out — no toast needed.\n */\nexport function EmailVerificationBanner({\n  onResend,\n  describeError,\n  cooldown = DEFAULT_COOLDOWN,\n  onDismiss,\n  variant = \"strip\",\n  children,\n  className,\n  labels: labelsProp,\n}: EmailVerificationBannerProps) {\n  const labels = useKitLabels(\"verifyEmail\", DEFAULT_VERIFY_EMAIL_LABELS, labelsProp);\n  const resend = useResend(onResend, cooldown);\n  return (\n    <AlertBanner\n      tone=\"warning\"\n      variant={variant}\n      icon={<MailWarning />}\n      action={<ResendButton state={resend} labels={labels} variant=\"secondary\" />}\n      onDismiss={onDismiss}\n      dismissLabel={onDismiss ? labels.dismiss : undefined}\n      className={className}\n    >\n      {labels.banner}\n      {children != null && children !== false && <> {children}</>}{\" \"}\n      <ResendStatus\n        phase={resend.phase}\n        error={resend.error}\n        describeError={describeError}\n        labels={labels}\n        className=\"font-medium\"\n      />\n    </AlertBanner>\n  );\n}\n"],"mappings":";AAsII,SAkKE,UAlKF,KAkKE,YAlKF;AAtIJ,SAAS,WAAW,gBAAgB;AAEpC,SAAS,cAAc,aAAa,UAAU,eAAe;AAC7D,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,QAAQ,kBAAkB;AACnC,SAAS,eAAe,sBAAsB,YAAY,qBAAqB;AAC/E,SAAS,qBAAqB;AAuCvB,MAAM,8BAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,WAAW;AAAA,EACX,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,cAAc;AAAA,EACd,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,UAAU,CAAC,YAAY,iBAAiB,OAAO;AAAA,EAC/C,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;AAKA,MAAM,mBAAmB;AAazB,SAAS,UAAU,UAAuD,UAAkB;AAC1F,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAsB,MAAM;AAGtD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAkB,MAAS;AACrD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,CAAC;AAC5C,QAAM,WAAW,YAAY;AAC7B,YAAU,MAAM;AACd,QAAI,CAAC,SAAU;AACf,UAAM,KAAK,YAAY,MAAM,aAAa,CAAC,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,GAAI;AAC1E,WAAO,MAAM,cAAc,EAAE;AAAA,EAC/B,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,OAAO,MAAM;AACjB,aAAS,MAAM;AACf,iBAAa,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EAChD;AACA,QAAM,OAAO,MAAM;AACjB,QAAI,CAAC,YAAY,UAAU,aAAa,SAAU;AAClD,QAAI;AACJ,QAAI;AACF,eAAS,SAAS;AAAA,IACpB,SAAS,GAAG;AACV,eAAS,CAAC;AACV,eAAS,QAAQ;AACjB;AAAA,IACF;AACA,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,WAAK;AACL;AAAA,IACF;AACA,aAAS,SAAS;AAClB,WAAO,KAAK,MAAM,CAAC,MAAe;AAChC,eAAS,CAAC;AACV,eAAS,QAAQ;AAAA,IACnB,CAAC;AAAA,EACH;AACA,SAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AACzC;AAEA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,MAAM,YAAY,cAAc,OAAO;AAAA,MACvC,SAAS,MAAM;AAAA,MACf,SAAS,MAAM,UAAU;AAAA,MAGzB,gBAAgB,MAAM,YAAY,IAAI,OAAO,SAAS;AAAA,MAErD,gBAAM,YAAY,IAAI,OAAO,SAAS,MAAM,SAAS,IAAI,OAAO;AAAA;AAAA,EACnE;AAEJ;AAEA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,SAAS,UAAU,WAAY,gBAAgB,KAAK,KAAK,OAAO,cAAe;AACrF,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,WAAW,GAAG,UAAU,WAAW,yBAAyB,yBAAyB,SAAS;AAAA,MAE7F,oBAAU,SAAS,OAAO,SAAS;AAAA;AAAA,EACtC;AAEJ;AAQA,SAAS,qBAAqB,OAAoC;AAChE,SAAO,cAAc,KAAK,MAAM,kBAAkB,YAAY;AAChE;AAyDO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,eAAe,6BAA6B,UAAU;AAClF,QAAM,CAAC,SAAS,UAAU,IAAI,SAA2D,IAAI;AAC7F,QAAM,UACJ,UAAU,KAAK,YAAY,SAAS,UAAU,QAAQ,QAAQ,UAAU;AAC1E,QAAM,EAAE,UAAU,YAAY,IAAI,YAAY;AAC9C,QAAM,SAAS,UAAU,UAAU,QAAQ;AAE3C,gBAAc,UAAU,KAAK,OAAO,OAAO,UAAU,CAAC,KAAK,WAAW;AAGpE,UAAM,OAAsB,OAAO,KAC/B,cACC,iBAAiB,sBAAsB,OAAO,KAAK;AACxD,eAAW,EAAE,OAAO,KAAK,SAAS,KAAK,CAAC;AACxC,aAAS,OAAO,IAAI,CAAC;AAAA,EACvB,CAAC;AAED,QAAM,OAAO,iBAAiB,WAAW,MAAM;AAE/C,QAAM,iBACJ,oBAAC,UAAO,MAAY,SAAO,MAAC,SAAS,YAAY,aAAa,UAAU,aACrE,iBAAO,UACV;AAEF,QAAM,YAAY,YAAY,aAAa;AAE3C,MAAI;AACJ,MAAI,YAAY,aAAa;AAC3B,WAAO,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,WAAW;AAAA,EAC1D,WAAW,YAAY,YAAY;AACjC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,oBAAC,gBAAa;AAAA,QACpB,OAAO,OAAO;AAAA,QACd,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,OAAO;AACL,UAAM,OACJ,iCACG;AAAA,kBAAY,aAAa,UAAU,KAAK,GAAG,OAAO,WAAW,MAAM;AAAA,MACnE,YAAY,OAAO,cAAc,OAAO;AAAA,OAC3C;AAEF,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,YAAY,YAAY,oBAAC,YAAS,IAAK,oBAAC,WAAQ;AAAA,QACtD,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO,OAAO;AAAA,QACrD;AAAA,QACA,QACE,iCACG;AAAA,uBAAa,oBAAC,gBAAa,OAAO,QAAQ,QAAgB,SAAQ,SAAQ;AAAA,UAC1E;AAAA,WACH;AAAA,QAEF,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ,cAAY;AAAA,MACZ,aAAW,YAAY,eAAe;AAAA,MACtC,WAAW,GAAG,aAAa,SAAS;AAAA,MAEnC;AAAA,kBAAU,OAAO,OAAO,oBAAC,WAAQ,WAAW,sBAAuB,mBAAS,OAAO,OAAM;AAAA,QACzF;AAAA,QACA,aACC;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,OAAO;AAAA,YACd,OAAO,OAAO;AAAA,YACd;AAAA,YACA;AAAA,YACA,WAAU;AAAA;AAAA,QACZ;AAAA,QAGF,oBAAC,SAAK,GAAG,aAAa;AAAA;AAAA;AAAA,EACxB;AAEJ;AAmCO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,UAAU;AAAA,EACV;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAAiC;AAC/B,QAAM,SAAS,aAAa,eAAe,6BAA6B,UAAU;AAClF,QAAM,SAAS,UAAU,UAAU,QAAQ;AAC3C,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,MAAM,oBAAC,eAAY;AAAA,MACnB,QAAQ,oBAAC,gBAAa,OAAO,QAAQ,QAAgB,SAAQ,aAAY;AAAA,MACzE;AAAA,MACA,cAAc,YAAY,OAAO,UAAU;AAAA,MAC3C;AAAA,MAEC;AAAA,eAAO;AAAA,QACP,YAAY,QAAQ,aAAa,SAAS,iCAAE;AAAA;AAAA,UAAE;AAAA,WAAS;AAAA,QAAK;AAAA,QAC7D;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,OAAO;AAAA,YACd,OAAO,OAAO;AAAA,YACd;AAAA,YACA;AAAA,YACA,WAAU;AAAA;AAAA,QACZ;AAAA;AAAA;AAAA,EACF;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/auth/verify-email.tsx"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, ReactNode } from \"react\";\nimport { CheckCircle2, MailWarning, TimerOff, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { useAnnounce } from \"../hooks/use-announce\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button, EmptyState } from \"../components/ui\";\nimport { OUTCOME_CLASS, STATUS_HEADING_CLASS, isThenable, useOncePerKey } from \"./status-parts\";\nimport { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the verification page and banner render — the `verifyEmail` namespace.\n *  keksdose's words (`verify_email.*`, and its server's \"has expired\"). */\nexport interface VerifyEmailLabels {\n  /** The page's heading. */\n  title: string;\n  /** While the link is redeemed. */\n  verifying: string;\n  verified: string;\n  /** The way on from the page — into the app, or to sign-in. */\n  continue: string;\n  invalid: string;\n  expired: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** Under `invalid`: why a link stops working. */\n  invalidHint: string;\n  /** Under a dead link, signed out: where a new one comes from. */\n  requestInApp: string;\n  /** Under a dead link, signed in, beside \"Send again\". */\n  requestHere: string;\n  /** The resend button, on the page and in the banner. */\n  resend: string;\n  /** The resend button while a just-sent mail cools down, given the seconds left. */\n  resendIn: (seconds: number) => string;\n  /** Said (and shown) after a resend went out. */\n  resent: string;\n  /** Said (and shown) after a resend failed. */\n  resendError: string;\n  /** 0.31.1: a resend refused as throttled — HTTP 429 (`isRateLimited`) — given the\n   *  `Retry-After` seconds, when the app's `describeError` has no words of its own\n   *  (keksdose borrowed the sign-in namespace's). */\n  rateLimited?: (seconds?: number) => string;\n  /** The banner's message. */\n  banner: string;\n  /** The banner's ×: it defers, it does not close anything. */\n  dismiss: string;\n}\n\nexport const DEFAULT_VERIFY_EMAIL_LABELS: VerifyEmailLabels = {\n  title: \"Confirm your email address\",\n  verifying: \"Confirming…\",\n  verified: \"Your email address is confirmed.\",\n  continue: \"Continue\",\n  invalid: \"This confirmation link is not valid\",\n  expired: \"This confirmation link has expired\",\n  noToken: \"This link is missing its confirmation token.\",\n  invalidHint: \"The link may have expired or already been used.\",\n  requestInApp: \"You can request a new one from inside the app.\",\n  requestHere: \"You can request a new one here.\",\n  resend: \"Send again\",\n  resendIn: (seconds) => `Send again in ${seconds} s`,\n  resent: \"Confirmation email sent\",\n  resendError: \"Could not send the confirmation email\",\n  rateLimited: englishRateLimited,\n  banner: \"Please confirm your email address.\",\n  dismiss: \"Not now\",\n};\n\n/** A minute: long enough that an impatient second click does not mail twice, short\n *  enough that a mail lost to a spam filter can be re-sent without leaving the page. The\n *  server's own limit is the real one (kastlan: 3 an hour per address). */\nconst DEFAULT_COOLDOWN = 60;\n\n/* ── Resend ──────────────────────────────────────────────────────────────── */\n\ntype ResendPhase = \"idle\" | \"sending\" | \"sent\" | \"failed\";\n\n/**\n * \"Send again\" with its own memory: busy while the request runs, then — after a mail\n * went out — held for `cooldown` seconds with the countdown on the button, so a second\n * click cannot mail twice and a throttled server is not asked to refuse. A failure frees\n * it at once. The outcome is a polite live region that is always rendered (a region that\n * mounts with its message is often not read), and visible.\n */\nfunction useResend(onResend: (() => Promise<unknown> | void) | undefined, cooldown: number) {\n  const [phase, setPhase] = useState<ResendPhase>(\"idle\");\n  // The refusal itself, for `describeError` (0.29.1): the server's own sentence — keksdose's\n  // per-address throttle, \"try again in N minutes\" — beats a fixed \"could not send\".\n  const [error, setError] = useState<unknown>(undefined);\n  const [remaining, setRemaining] = useState(0);\n  const counting = remaining > 0;\n  useEffect(() => {\n    if (!counting) return;\n    const id = setInterval(() => setRemaining((r) => Math.max(0, r - 1)), 1000);\n    return () => clearInterval(id);\n  }, [counting]);\n\n  const sent = () => {\n    setPhase(\"sent\");\n    setRemaining(Math.max(0, Math.round(cooldown)));\n  };\n  const send = () => {\n    if (!onResend || phase === \"sending\" || counting) return;\n    let result: unknown;\n    try {\n      result = onResend();\n    } catch (e) {\n      setError(e);\n      setPhase(\"failed\");\n      return;\n    }\n    if (!isThenable(result)) {\n      sent();\n      return;\n    }\n    setPhase(\"sending\");\n    result.then(sent, (e: unknown) => {\n      setError(e);\n      setPhase(\"failed\");\n    });\n  };\n  return { phase, remaining, send, error };\n}\n\nfunction ResendButton({\n  state,\n  labels,\n  variant,\n}: {\n  state: ReturnType<typeof useResend>;\n  labels: VerifyEmailLabels;\n  variant: \"secondary\" | \"brand\";\n}) {\n  return (\n    <Button\n      type=\"button\"\n      variant={variant}\n      size={variant === \"secondary\" ? \"sm\" : undefined}\n      onClick={state.send}\n      pending={state.phase === \"sending\"}\n      // `disabledReason`, not `disabled`: the button just pressed has the focus, and a\n      // native `disabled` would drop it to <body>. The reason is what just happened.\n      disabledReason={state.remaining > 0 ? labels.resent : undefined}\n    >\n      {state.remaining > 0 ? labels.resendIn(state.remaining) : labels.resend}\n    </Button>\n  );\n}\n\nfunction ResendStatus({\n  phase,\n  error,\n  describeError,\n  labels,\n  className,\n}: {\n  phase: ResendPhase;\n  error?: unknown;\n  describeError?: (error: unknown) => string | undefined;\n  labels: VerifyEmailLabels;\n  className?: string;\n}) {\n  // The app's words first, then the throttle's, then the kit's catch-all.\n  const failed =\n    phase === \"failed\"\n      ? (describeError?.(error) ??\n        (isRateLimited(error)\n          ? (labels.rateLimited ?? englishRateLimited)(retryAfterSeconds(error))\n          : labels.resendError))\n      : \"\";\n  return (\n    <span\n      role=\"status\"\n      className={cn(phase === \"failed\" ? \"text-[var(--danger)]\" : \"text-[var(--success)]\", className)}\n    >\n      {phase === \"sent\" ? labels.resent : failed}\n    </span>\n  );\n}\n\n/* ── The page ────────────────────────────────────────────────────────────── */\n\n/** What became of a confirmation link that did not verify. */\nexport type VerifyEmailFailure = \"invalid\" | \"expired\";\n\n/** The default when the app gives no `classifyError`: the coded refusal decides. */\nfunction defaultVerifyFailure(error: unknown): VerifyEmailFailure {\n  return authErrorCode(error) === \"token_expired\" ? \"expired\" : \"invalid\";\n}\n\nexport interface VerifyEmailStatusProps extends Omit<ComponentPropsWithoutRef<\"div\">, \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=`. Empty: the link was cut short, and the\n   *  page says so without asking anyone. */\n  token: string;\n  /**\n   * Redeem it — `POST /auth/verify-email {token}`, once per token, on mount. A POST and\n   * not the link's own GET (§10.10): a mail scanner that opens every link must not\n   * confirm an address nobody read. Resolve when it verified (an address that already\n   * was counts: keksdose's redeem is idempotent); reject with the client's error.\n   */\n  onVerify: (token: string) => Promise<unknown>;\n  /** Which dead end a rejection is. Default: `invalid` for everything — §5.2's servers\n   *  answer one `token_invalid`; an app whose server tells expiry apart maps it here. */\n  classifyError?: (error: unknown) => VerifyEmailFailure;\n  /** 0.29.1: the words for a refused resend — the server's own sentence (a throttle's\n   *  \"try again in N minutes\"), else the kit's `resendError`. */\n  describeError?: (error: unknown) => string | undefined;\n  /** Someone is signed in on this device: \"Continue\" goes into the app, and a dead link\n   *  offers \"Send again\" (with `onResend`). */\n  signedIn?: boolean;\n  /** Send a new confirmation mail (`POST /auth/verify-email/resend`) — offered on a dead\n   *  link while signed in. */\n  onResend?: () => Promise<unknown> | void;\n  /** Seconds \"Send again\" waits after a mail went out. Default 60; `0` never waits. */\n  cooldown?: number;\n  /** Where \"Continue\" goes. Default `/` signed in, `/login` signed out. */\n  continueHref?: string;\n  /** App content under \"confirmed\" — keksdose's \"Others can now share a budget with you\n   *  directly.\" */\n  verifiedContent?: ReactNode;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it in\n   *  `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<VerifyEmailLabels>;\n}\n\ntype VerifyOutcome = \"verified\" | VerifyEmailFailure;\n\n/**\n * Redeem an email-confirmation link (`/verify-email?token=…`, docs/auth-harmonization.md\n * §7) — keksdose's `VerifyEmailPage` (features/auth/verify-email-page.tsx), with\n * kastlan's outcome blocks and its separate \"expired\".\n *\n * Opened from an inbox, often in a browser with no session, so the token is the only\n * credential and the page renders signed-out. It redeems once per token on mount\n * (StrictMode's double effect included — the token is single-use) and shows one of:\n * confirmed; not valid; expired; or the link had no token at all. Verification gates\n * nothing (§2.8), so every outcome ends on \"Continue\". Signed in, a dead link also\n * offers \"Send again\", which waits `cooldown` seconds after a mail went out.\n *\n * The outcome replaces the spinner, which says nothing to a screen reader on its own,\n * so it is also announced.\n */\nexport function VerifyEmailStatus({\n  token,\n  onVerify,\n  classifyError,\n  describeError,\n  signedIn = false,\n  onResend,\n  cooldown = DEFAULT_COOLDOWN,\n  continueHref,\n  verifiedContent,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: VerifyEmailStatusProps) {\n  const labels = useKitLabels(\"verifyEmail\", DEFAULT_VERIFY_EMAIL_LABELS, labelsProp);\n  const [settled, setSettled] = useState<{ token: string; outcome: VerifyOutcome } | null>(null);\n  const outcome: VerifyOutcome | \"verifying\" =\n    token === \"\" ? \"invalid\" : settled?.token === token ? settled.outcome : \"verifying\";\n  const { announce, regionProps } = useAnnounce();\n  const resend = useResend(onResend, cooldown);\n\n  useOncePerKey(token === \"\" ? null : token, onVerify, (key, result) => {\n    // Without a classifier, the coded refusal decides (0.29.1): `token_expired` is\n    // \"expired\", anything else \"invalid\".\n    const next: VerifyOutcome = result.ok\n      ? \"verified\"\n      : (classifyError ?? defaultVerifyFailure)(result.error);\n    setSettled({ token: key, outcome: next });\n    announce(labels[next]);\n  });\n\n  const href = continueHref ?? (signedIn ? \"/\" : \"/login\");\n  // `replace`: the token is spent, so Back must not land on this page again (keksdose F1).\n  const continueButton = (\n    <Button href={href} replace variant={outcome === \"verified\" ? \"brand\" : \"secondary\"}>\n      {labels.continue}\n    </Button>\n  );\n  const canResend = signedIn && onResend !== undefined;\n\n  let body: ReactNode;\n  if (outcome === \"verifying\") {\n    body = <LoadingState size=\"sm\" label={labels.verifying} />;\n  } else if (outcome === \"verified\") {\n    body = (\n      <EmptyState\n        tone=\"success\"\n        icon={<CheckCircle2 />}\n        title={labels.verified}\n        hint={verifiedContent}\n        action={continueButton}\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else {\n    const hint = (\n      <>\n        {outcome === \"invalid\" && token !== \"\" ? `${labels.invalidHint} ` : \"\"}\n        {canResend ? labels.requestHere : labels.requestInApp}\n      </>\n    );\n    body = (\n      <EmptyState\n        tone=\"danger\"\n        icon={outcome === \"expired\" ? <TimerOff /> : <XCircle />}\n        title={token === \"\" ? labels.noToken : labels[outcome]}\n        hint={hint}\n        action={\n          <>\n            {canResend && <ResendButton state={resend} labels={labels} variant=\"brand\" />}\n            {continueButton}\n          </>\n        }\n        className={OUTCOME_CLASS}\n      />\n    );\n  }\n\n  return (\n    <div\n      {...rest}\n      data-state={outcome}\n      aria-busy={outcome === \"verifying\" || undefined}\n      className={cn(\"space-y-3\", className)}\n    >\n      {title === null ? null : <Heading className={STATUS_HEADING_CLASS}>{title ?? labels.title}</Heading>}\n      {body}\n      {canResend && (\n        <ResendStatus\n          phase={resend.phase}\n          error={resend.error}\n          describeError={describeError}\n          labels={labels}\n          className=\"block text-center text-xs\"\n        />\n      )}\n      {/* Rendered from the start, so the outcome is read when it arrives. */}\n      <div {...regionProps} />\n    </div>\n  );\n}\n\n/* ── The banner ──────────────────────────────────────────────────────────── */\n\nexport interface EmailVerificationBannerProps {\n  /** Send a new confirmation mail (`POST /auth/verify-email/resend`). Resolve when it\n   *  went out; reject and the banner says it could not. */\n  onResend: () => Promise<unknown> | void;\n  /** 0.29.1: the words for a refused resend — the server's own sentence, else the kit's. */\n  describeError?: (error: unknown) => string | undefined;\n  /** Seconds \"Send again\" waits after a mail went out. Default 60; `0` never waits. */\n  cooldown?: number;\n  /** The ×, \"Not now\". The banner does not hide itself: the app stops rendering it —\n   *  keksdose for the rest of the session. Left out, no ×. */\n  onDismiss?: () => void;\n  /** `strip` (default): keksdose's band across the top of the shell. `box`: kastlan's\n   *  callout inside the page. */\n  variant?: \"strip\" | \"box\";\n  /** The app's sentence after the kit's — keksdose's \"Until you do, nobody can share a\n   *  budget with you directly.\" */\n  children?: ReactNode;\n  className?: string;\n  labels?: Partial<VerifyEmailLabels>;\n}\n\n/**\n * The nudge for a signed-in account whose address is not confirmed — keksdose's\n * `VerifyEmailBanner` (features/auth/verify-email-banner.tsx), kastlan's copy of it.\n *\n * A prompt, not a wall: verification gates nothing (§2.8). The app renders it while\n * `/auth/me` says `email_verified: false`, and stops when the user dismisses it or the\n * page above confirms the address. \"Send again\" waits `cooldown` seconds after a mail\n * went out (the button says how long), and its outcome is written into the banner and\n * read out — no toast needed.\n */\nexport function EmailVerificationBanner({\n  onResend,\n  describeError,\n  cooldown = DEFAULT_COOLDOWN,\n  onDismiss,\n  variant = \"strip\",\n  children,\n  className,\n  labels: labelsProp,\n}: EmailVerificationBannerProps) {\n  const labels = useKitLabels(\"verifyEmail\", DEFAULT_VERIFY_EMAIL_LABELS, labelsProp);\n  const resend = useResend(onResend, cooldown);\n  return (\n    <AlertBanner\n      tone=\"warning\"\n      variant={variant}\n      icon={<MailWarning />}\n      action={<ResendButton state={resend} labels={labels} variant=\"secondary\" />}\n      onDismiss={onDismiss}\n      dismissLabel={onDismiss ? labels.dismiss : undefined}\n      className={className}\n    >\n      {labels.banner}\n      {children != null && children !== false && <> {children}</>}{\" \"}\n      <ResendStatus\n        phase={resend.phase}\n        error={resend.error}\n        describeError={describeError}\n        labels={labels}\n        className=\"font-medium\"\n      />\n    </AlertBanner>\n  );\n}\n"],"mappings":";AA2II,SAyKE,UAzKF,KAyKE,YAzKF;AA3IJ,SAAS,WAAW,gBAAgB;AAEpC,SAAS,cAAc,aAAa,UAAU,eAAe;AAC7D,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,QAAQ,kBAAkB;AACnC,SAAS,eAAe,sBAAsB,YAAY,qBAAqB;AAC/E,SAAS,eAAe,oBAAoB,eAAe,yBAAyB;AA2C7E,MAAM,8BAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,WAAW;AAAA,EACX,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,cAAc;AAAA,EACd,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,UAAU,CAAC,YAAY,iBAAiB,OAAO;AAAA,EAC/C,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;AAKA,MAAM,mBAAmB;AAazB,SAAS,UAAU,UAAuD,UAAkB;AAC1F,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAsB,MAAM;AAGtD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAkB,MAAS;AACrD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,CAAC;AAC5C,QAAM,WAAW,YAAY;AAC7B,YAAU,MAAM;AACd,QAAI,CAAC,SAAU;AACf,UAAM,KAAK,YAAY,MAAM,aAAa,CAAC,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,GAAI;AAC1E,WAAO,MAAM,cAAc,EAAE;AAAA,EAC/B,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,OAAO,MAAM;AACjB,aAAS,MAAM;AACf,iBAAa,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EAChD;AACA,QAAM,OAAO,MAAM;AACjB,QAAI,CAAC,YAAY,UAAU,aAAa,SAAU;AAClD,QAAI;AACJ,QAAI;AACF,eAAS,SAAS;AAAA,IACpB,SAAS,GAAG;AACV,eAAS,CAAC;AACV,eAAS,QAAQ;AACjB;AAAA,IACF;AACA,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,WAAK;AACL;AAAA,IACF;AACA,aAAS,SAAS;AAClB,WAAO,KAAK,MAAM,CAAC,MAAe;AAChC,eAAS,CAAC;AACV,eAAS,QAAQ;AAAA,IACnB,CAAC;AAAA,EACH;AACA,SAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AACzC;AAEA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,MAAM,YAAY,cAAc,OAAO;AAAA,MACvC,SAAS,MAAM;AAAA,MACf,SAAS,MAAM,UAAU;AAAA,MAGzB,gBAAgB,MAAM,YAAY,IAAI,OAAO,SAAS;AAAA,MAErD,gBAAM,YAAY,IAAI,OAAO,SAAS,MAAM,SAAS,IAAI,OAAO;AAAA;AAAA,EACnE;AAEJ;AAEA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AAED,QAAM,SACJ,UAAU,WACL,gBAAgB,KAAK,MACrB,cAAc,KAAK,KACf,OAAO,eAAe,oBAAoB,kBAAkB,KAAK,CAAC,IACnE,OAAO,eACX;AACN,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,WAAW,GAAG,UAAU,WAAW,yBAAyB,yBAAyB,SAAS;AAAA,MAE7F,oBAAU,SAAS,OAAO,SAAS;AAAA;AAAA,EACtC;AAEJ;AAQA,SAAS,qBAAqB,OAAoC;AAChE,SAAO,cAAc,KAAK,MAAM,kBAAkB,YAAY;AAChE;AAyDO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,eAAe,6BAA6B,UAAU;AAClF,QAAM,CAAC,SAAS,UAAU,IAAI,SAA2D,IAAI;AAC7F,QAAM,UACJ,UAAU,KAAK,YAAY,SAAS,UAAU,QAAQ,QAAQ,UAAU;AAC1E,QAAM,EAAE,UAAU,YAAY,IAAI,YAAY;AAC9C,QAAM,SAAS,UAAU,UAAU,QAAQ;AAE3C,gBAAc,UAAU,KAAK,OAAO,OAAO,UAAU,CAAC,KAAK,WAAW;AAGpE,UAAM,OAAsB,OAAO,KAC/B,cACC,iBAAiB,sBAAsB,OAAO,KAAK;AACxD,eAAW,EAAE,OAAO,KAAK,SAAS,KAAK,CAAC;AACxC,aAAS,OAAO,IAAI,CAAC;AAAA,EACvB,CAAC;AAED,QAAM,OAAO,iBAAiB,WAAW,MAAM;AAE/C,QAAM,iBACJ,oBAAC,UAAO,MAAY,SAAO,MAAC,SAAS,YAAY,aAAa,UAAU,aACrE,iBAAO,UACV;AAEF,QAAM,YAAY,YAAY,aAAa;AAE3C,MAAI;AACJ,MAAI,YAAY,aAAa;AAC3B,WAAO,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,WAAW;AAAA,EAC1D,WAAW,YAAY,YAAY;AACjC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,oBAAC,gBAAa;AAAA,QACpB,OAAO,OAAO;AAAA,QACd,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,OAAO;AACL,UAAM,OACJ,iCACG;AAAA,kBAAY,aAAa,UAAU,KAAK,GAAG,OAAO,WAAW,MAAM;AAAA,MACnE,YAAY,OAAO,cAAc,OAAO;AAAA,OAC3C;AAEF,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,YAAY,YAAY,oBAAC,YAAS,IAAK,oBAAC,WAAQ;AAAA,QACtD,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO,OAAO;AAAA,QACrD;AAAA,QACA,QACE,iCACG;AAAA,uBAAa,oBAAC,gBAAa,OAAO,QAAQ,QAAgB,SAAQ,SAAQ;AAAA,UAC1E;AAAA,WACH;AAAA,QAEF,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ,cAAY;AAAA,MACZ,aAAW,YAAY,eAAe;AAAA,MACtC,WAAW,GAAG,aAAa,SAAS;AAAA,MAEnC;AAAA,kBAAU,OAAO,OAAO,oBAAC,WAAQ,WAAW,sBAAuB,mBAAS,OAAO,OAAM;AAAA,QACzF;AAAA,QACA,aACC;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,OAAO;AAAA,YACd,OAAO,OAAO;AAAA,YACd;AAAA,YACA;AAAA,YACA,WAAU;AAAA;AAAA,QACZ;AAAA,QAGF,oBAAC,SAAK,GAAG,aAAa;AAAA;AAAA;AAAA,EACxB;AAEJ;AAmCO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,UAAU;AAAA,EACV;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAAiC;AAC/B,QAAM,SAAS,aAAa,eAAe,6BAA6B,UAAU;AAClF,QAAM,SAAS,UAAU,UAAU,QAAQ;AAC3C,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,MAAM,oBAAC,eAAY;AAAA,MACnB,QAAQ,oBAAC,gBAAa,OAAO,QAAQ,QAAgB,SAAQ,aAAY;AAAA,MACzE;AAAA,MACA,cAAc,YAAY,OAAO,UAAU;AAAA,MAC3C;AAAA,MAEC;AAAA,eAAO;AAAA,QACP,YAAY,QAAQ,aAAa,SAAS,iCAAE;AAAA;AAAA,UAAE;AAAA,WAAS;AAAA,QAAK;AAAA,QAC7D;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,OAAO;AAAA,YACd,OAAO,OAAO;AAAA,YACd;AAAA,YACA;AAAA,YACA,WAAU;AAAA;AAAA,QACZ;AAAA;AAAA;AAAA,EACF;AAEJ;","names":[]}

package/dist/chart.d.ts

@@ -13,7 +13,7 @@ export { TimeTickUnit } from './components/series-chart-ticks.js';
 import 'recharts';
 import 'react';
 import './lib/direction.js';
-import './delete-account-setting-DCFS5Vof.js';
+import './delete-account-setting-CpIhzxxZ.js';
 import './components/tooltip.js';
 import './hooks/use-anchored-rect.js';
 import './lib/clipping.js';

package/dist/components/amount-input.d.ts

@@ -2,7 +2,7 @@ import * as react from 'react';
 import { ReactNode } from 'react';
 import { CalculatorButtonLabels } from './calculator.js';
 import { NumberPadSheetLabels } from './numpad-sheet.js';
-import '../delete-account-setting-DCFS5Vof.js';
+import '../delete-account-setting-CpIhzxxZ.js';
 import './tooltip.js';
 import '../hooks/use-anchored-rect.js';
 import '../lib/clipping.js';

package/dist/components/button-group.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ComponentPropsWithoutRef, ReactNode, Ref, MouseEvent, ReactElement } from 'react';
-import { bH as ButtonVariant, bF as ButtonSize } from '../delete-account-setting-DCFS5Vof.js';
+import { bH as ButtonVariant, bF as ButtonSize } from '../delete-account-setting-CpIhzxxZ.js';
 import './tooltip.js';
 import '../hooks/use-anchored-rect.js';
 import '../lib/clipping.js';

package/dist/components/calculator.d.ts

@@ -1,5 +1,5 @@
 import * as react from 'react';
-import { bI as CalculatorLabels } from '../delete-account-setting-DCFS5Vof.js';
+import { bI as CalculatorLabels } from '../delete-account-setting-CpIhzxxZ.js';
 import './tooltip.js';
 import '../hooks/use-anchored-rect.js';
 import '../lib/clipping.js';

package/dist/components/confirm-dialog.d.ts

@@ -1,5 +1,5 @@
 import 'react';
-export { c2 as ConfirmDialogLabels, c3 as ConfirmFn, c4 as ConfirmOptions, c5 as ConfirmProvider, c6 as ConfirmProviderProps, c7 as ConfirmTone, cl as DEFAULT_CONFIRM_DIALOG_LABELS, fC as useConfirm } from '../delete-account-setting-DCFS5Vof.js';
+export { c2 as ConfirmDialogLabels, c3 as ConfirmFn, c4 as ConfirmOptions, c5 as ConfirmProvider, c6 as ConfirmProviderProps, c7 as ConfirmTone, cl as DEFAULT_CONFIRM_DIALOG_LABELS, fC as useConfirm } from '../delete-account-setting-CpIhzxxZ.js';
 import './tooltip.js';
 import '../hooks/use-anchored-rect.js';
 import '../lib/clipping.js';

package/dist/components/confirm-dialog.js

@@ -5,6 +5,7 @@ import { useKitLabels } from "../i18n/kit-labels.js";
 import { TypedConfirmField, typedMatches } from "./danger-confirm.js";
 import { DialogFrame } from "./dialog-frame.js";
 import { Button } from "./ui.js";
+import { useWriteLock } from "./write-lock.js";
 const DEFAULT_CONFIRM_DIALOG_LABELS = {
   confirm: "Confirm",
   cancel: "Cancel",
@@ -16,7 +17,11 @@ function useConfirm() {
   if (!confirm) {
     throw new Error("useConfirm() must be called below a <ConfirmProvider>.");
   }
-  return confirm;
+  const lock = useWriteLock();
+  return useCallback(
+    (options) => confirm(options.commit && lock.locked ? { ...options, lockReason: lock.reason } : options),
+    [confirm, lock.locked, lock.reason]
+  );
 }
 function ConfirmProvider({ children }) {
   const [queue, setQueue] = useState([]);
@@ -85,6 +90,7 @@ function ConfirmDialogView({
             type: "button",
             variant: tone === "danger" ? "danger" : "primary",
             disabled: !matches,
+            disabledReason: request.lockReason,
             onClick: () => {
               accepted.current = true;
               close();