@eifi1/ui-kit 0.33.1 → 0.34.0

package/dist/auth/reset-password-form.d.ts

@@ -1,10 +1,10 @@
-import * as react from 'react';
-import { ReactNode, ComponentPropsWithoutRef } from 'react';
-import { AuthHeadingLevel } from './status-parts.js';
-
+import type { ComponentPropsWithRef, ReactNode } from "react";
+import { type LabelOverride } from "../i18n/kit-labels.js";
+import type { AuthHeadingLevel } from "./status-parts.js";
+import { DEFAULT_RESET_PASSWORD_LABELS } from "./reset-password-form-labels.js";
 /** Every string the form renders — the `resetPassword` namespace. keksdose's words
  *  (`auth.reset.*`), which kastlan took over. */
-interface ResetPasswordLabels {
+export interface ResetPasswordLabels {
     /** The heading, on every state. */
     title: string;
     /** While the link is checked. */
@@ -39,10 +39,9 @@ interface ResetPasswordLabels {
      *  it. */
     rateLimited?: (seconds?: number) => string;
 }
-/** `Required`: every key, the 0.30 one included, has its English here. */
-declare const DEFAULT_RESET_PASSWORD_LABELS: Required<ResetPasswordLabels>;
+export { DEFAULT_RESET_PASSWORD_LABELS };
 /** What `onCheck` may resolve with — keksdose's `/password-reset/check` answer. */
-interface ResetPasswordCheck {
+export interface ResetPasswordCheck {
     /** The account's address: named over the fields ("You're setting a new password for
      *  …") and handed to the password manager, which files the new password under it. */
     email?: string;
@@ -51,20 +50,20 @@ interface ResetPasswordCheck {
     notices?: ReactNode;
 }
 /** What `onSubmit` hands over. */
-interface ResetPasswordValues {
+export interface ResetPasswordValues {
     token: string;
     password: string;
 }
 /** What `onSubmit` resolves with — keksdose's `/password-reset/confirm` answer, which
  *  carries no tokens (§6.3). */
-interface ResetPasswordResult {
+export interface ResetPasswordResult {
     /** The account's address — the sign-in it leads to is filled in with it. */
     email: string;
     /** The app's outcomes, shown on the done state: keksdose's recovery-code notice for an
      *  encrypted account, "Your 2 personal access tokens were revoked". */
     notices?: ReactNode;
 }
-interface ResetPasswordFormProps extends Omit<ComponentPropsWithoutRef<"div">, "onSubmit" | "children" | "title"> {
+export interface ResetPasswordFormProps extends Omit<ComponentPropsWithRef<"div">, "onSubmit" | "children" | "title"> {
     /** The link's token — the app's `?token=` (keksdose, kastlan: `/reset-password?token=…`).
      *  Empty: the link was cut short, and the page says so without asking anyone. */
     token: string;
@@ -101,7 +100,7 @@ interface ResetPasswordFormProps extends Omit<ComponentPropsWithoutRef<"div">, "
     title?: ReactNode;
     /** The heading's level. Default `h2`, under the page's `h1`. */
     headingAs?: AuthHeadingLevel;
-    labels?: Partial<ResetPasswordLabels>;
+    labels?: LabelOverride<ResetPasswordLabels>;
 }
 /**
  * Redeem a password-reset link (`/reset-password?token=…`, docs/auth-harmonization.md
@@ -126,6 +125,4 @@ interface ResetPasswordFormProps extends Omit<ComponentPropsWithoutRef<"div">, "
  * The form never sends a request itself (§8): the token and the password go to the
  * callbacks, and the page renders what they resolve with.
  */
-declare function ResetPasswordForm({ token, onCheck, onSubmit, onSignIn, signInHref, forgotHref, describeError, title, headingAs: Heading, labels: labelsProp, className, ...rest }: ResetPasswordFormProps): react.JSX.Element;
-
-export { DEFAULT_RESET_PASSWORD_LABELS, type ResetPasswordCheck, ResetPasswordForm, type ResetPasswordFormProps, type ResetPasswordLabels, type ResetPasswordResult, type ResetPasswordValues };
+export declare function ResetPasswordForm({ token, onCheck, onSubmit, onSignIn, signInHref, forgotHref, describeError, title, headingAs: Heading, labels: labelsProp, className, ...rest }: ResetPasswordFormProps): import("react").JSX.Element;

package/dist/auth/reset-password-form.js

@@ -6,8 +6,9 @@ import { cn } from "../lib/cn.js";
 import { useKitLabels } from "../i18n/kit-labels.js";
 import { AlertBanner } from "../components/alert-banner.js";
 import { LoadingState } from "../components/loading-state.js";
-import { Button, EmptyState } from "../components/ui.js";
-import { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from "./auth-errors.js";
+import { Button } from "../components/button.js";
+import { EmptyState } from "../components/empty-state.js";
+import { authErrorCode, isRateLimited, retryAfterSeconds } from "./auth-errors.js";
 import { newPasswordProblem } from "./form-rules.js";
 import { NewPasswordFields } from "./new-password-fields.js";
 import {
@@ -19,24 +20,7 @@ import {
   useOncePerKey,
   withQuery
 } from "./status-parts.js";
-const DEFAULT_RESET_PASSWORD_LABELS = {
-  title: "Choose a new password",
-  checking: "Checking the link\u2026",
-  intro: (email) => `You\u2019re setting a new password for ${email}.`,
-  newPassword: "New password",
-  confirmPassword: "Repeat new password",
-  mismatch: "The passwords don\u2019t match.",
-  submit: "Save password",
-  failed: "The password could not be changed.",
-  noToken: "This link is incomplete.",
-  invalid: "This link is invalid or has expired.",
-  invalidHint: "Links are valid for one hour and work only once. Just request a new one.",
-  requestNew: "Request a new link",
-  success: "Your password has been changed. You can sign in with it now.",
-  sessionsEnded: "Signed-in devices were signed out \u2014 you\u2019ll need to sign in again there.",
-  signIn: "Go to sign in",
-  rateLimited: englishRateLimited
-};
+import { DEFAULT_RESET_PASSWORD_LABELS } from "./reset-password-form-labels.js";
 function ResetPasswordForm({
   token,
   onCheck,
@@ -102,9 +86,9 @@ function ResetPasswordForm({
     const { email: email2, notices: notices2 } = current.result;
     return /* @__PURE__ */ jsxs("div", { ...rest, "data-state": "done", className: rootClass, children: [
       heading,
-      /* @__PURE__ */ jsx(OutcomeMessage, { icon: /* @__PURE__ */ jsx(CheckCircle2, { className: "text-[var(--success)]" }), focusRef: doneRef, children: /* @__PURE__ */ jsx("p", { className: INTRO_CLASS, children: labels.success }) }),
+      /* @__PURE__ */ jsx(OutcomeMessage, { icon: /* @__PURE__ */ jsx(CheckCircle2, { className: "text-success" }), focusRef: doneRef, children: /* @__PURE__ */ jsx("p", { className: INTRO_CLASS, children: labels.success }) }),
       notices2,
-      /* @__PURE__ */ jsx("p", { className: "text-xs text-[var(--text-muted)]", children: labels.sessionsEnded }),
+      /* @__PURE__ */ jsx("p", { className: "text-xs text-muted", children: labels.sessionsEnded }),
       onSignIn ? /* @__PURE__ */ jsx(Button, { type: "button", variant: "brand", className: "w-full", onClick: () => onSignIn(email2), children: labels.signIn }) : /* @__PURE__ */ jsx(Button, { href: email2 ? withQuery(signInHref, "email", email2) : signInHref, variant: "brand", className: "w-full", children: labels.signIn })
     ] });
   }

package/dist/auth/reset-password-form.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/reset-password-form.tsx"],"sourcesContent":["import { useEffect, useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithoutRef, FormEvent, ReactNode } from \"react\";\nimport { CheckCircle2, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button, EmptyState } from \"../components/ui\";\nimport { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport { newPasswordProblem } from \"./form-rules\";\nimport { NewPasswordFields } from \"./new-password-fields\";\nimport {\n  FORM_HEADING_CLASS,\n  INTRO_CLASS,\n  OUTCOME_CLASS,\n  OutcomeMessage,\n  useFocusWhen,\n  useOncePerKey,\n  withQuery,\n} from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `resetPassword` namespace. keksdose's words\n *  (`auth.reset.*`), which kastlan took over. */\nexport interface ResetPasswordLabels {\n  /** The heading, on every state. */\n  title: string;\n  /** While the link is checked. */\n  checking: string;\n  /** Over the fields, given the account's address (when the check returned one). */\n  intro: (email: string) => string;\n  newPassword: string;\n  confirmPassword: string;\n  /** Under the confirmation while it differs. */\n  mismatch: string;\n  submit: string;\n  /** The new password was not saved, for a reason that is not the link. */\n  failed: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** The link is unknown, spent or expired — one sentence, as the server gives one\n   *  code (`token_invalid`). */\n  invalid: string;\n  /** Under it. */\n  invalidHint: string;\n  /** The way forward from an invalid link: back to \"Forgot password\". */\n  requestNew: string;\n  /** Done. */\n  success: string;\n  /** Under it: a reset ends every session (§6.3). */\n  sessionsEnded: string;\n  /** The button out — to sign-in, with the address filled in. */\n  signIn: string;\n  /** 0.30.0: the save was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  `Retry-After` wait in seconds, or `undefined` without one. OPTIONAL, like every key\n   *  added to a shipped interface; the provider's `resetPassword`, then English, fill\n   *  it. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_RESET_PASSWORD_LABELS: Required<ResetPasswordLabels> = {\n  title: \"Choose a new password\",\n  checking: \"Checking the link…\",\n  intro: (email) => `You’re setting a new password for ${email}.`,\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  mismatch: \"The passwords don’t match.\",\n  submit: \"Save password\",\n  failed: \"The password could not be changed.\",\n  noToken: \"This link is incomplete.\",\n  invalid: \"This link is invalid or has expired.\",\n  invalidHint: \"Links are valid for one hour and work only once. Just request a new one.\",\n  requestNew: \"Request a new link\",\n  success: \"Your password has been changed. You can sign in with it now.\",\n  sessionsEnded: \"Signed-in devices were signed out — you’ll need to sign in again there.\",\n  signIn: \"Go to sign in\",\n  rateLimited: englishRateLimited,\n};\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onCheck` may resolve with — keksdose's `/password-reset/check` answer. */\nexport interface ResetPasswordCheck {\n  /** The account's address: named over the fields (\"You're setting a new password for\n   *  …\") and handed to the password manager, which files the new password under it. */\n  email?: string;\n  /** The app's notices over the fields, shown BEFORE the password is typed — keksdose's\n   *  \"your account is end-to-end encrypted: this restores your sign-in, not your data\". */\n  notices?: ReactNode;\n}\n\n/** What `onSubmit` hands over. */\nexport interface ResetPasswordValues {\n  token: string;\n  password: string;\n}\n\n/** What `onSubmit` resolves with — keksdose's `/password-reset/confirm` answer, which\n *  carries no tokens (§6.3). */\nexport interface ResetPasswordResult {\n  /** The account's address — the sign-in it leads to is filled in with it. */\n  email: string;\n  /** The app's outcomes, shown on the done state: keksdose's recovery-code notice for an\n   *  encrypted account, \"Your 2 personal access tokens were revoked\". */\n  notices?: ReactNode;\n}\n\ntype Phase =\n  | { kind: \"form\"; check: ResetPasswordCheck }\n  | { kind: \"invalid\" }\n  | { kind: \"done\"; result: ResetPasswordResult };\n\nexport interface ResetPasswordFormProps\n  extends Omit<ComponentPropsWithoutRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=` (keksdose, kastlan: `/reset-password?token=…`).\n   *  Empty: the link was cut short, and the page says so without asking anyone. */\n  token: string;\n  /**\n   * Check the link before the form shows (`/auth/password-reset/check`) — once per\n   * token, on mount. Checking does not use it up, so a reload is free. Resolve (with\n   * the address and any notices) for a live link; reject for a dead one, and the page\n   * says \"This link is invalid or has expired\" with the way to a new one.\n   */\n  onCheck: (token: string) => Promise<ResetPasswordCheck | void | undefined>;\n  /**\n   * The new password was submitted: send `/auth/password-reset/confirm`. Resolve with\n   * the account's address (and the app's notices) — no tokens: a reset is not a sign-in\n   * (§6.3). Reject with the client's error: `token_invalid` (the link expired or was\n   * used in another tab while the form was open) goes to the invalid state; anything\n   * else stays on the form with the password kept.\n   */\n  onSubmit: (values: ResetPasswordValues) => Promise<ResetPasswordResult>;\n  /** \"Go to sign in\" calls this with the address, for an app that routes in code.\n   *  Without it, the button is a link to `signInHref`. */\n  onSignIn?: (email: string) => void;\n  /** Where \"Go to sign in\" leads, with `?email=` added — read it into `SignInForm`'s\n   *  `defaultEmail`. Default `/login`. */\n  signInHref?: string;\n  /** \"Request a new link\" — the app's \"Forgot password\" page. Default\n   *  `/forgot-password`. */\n  forgotHref?: string;\n  /** The app's words for a failed save (the device offline), or `undefined` for the\n   *  kit's: `rateLimited` for a bare `429` (0.30.0), else `failed`. Not asked for\n   *  `token_invalid` or `token_expired`, which are a state. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: Partial<ResetPasswordLabels>;\n}\n\n/**\n * Redeem a password-reset link (`/reset-password?token=…`, docs/auth-harmonization.md\n * §6.3, §7) — keksdose's `ResetPasswordPage` (features/auth/reset-password-page.tsx),\n * which kastlan built its own on.\n *\n * **The link is checked first** (`onCheck`), and only then does the form appear: an\n * expired link should say so before someone types a new password twice, not after.\n *\n * **A reset is not a sign-in** (§6.3, §10.11). The confirm answers without tokens, so a\n * 2FA account cannot skip its second factor by way of its inbox, and the page ends on\n * \"Go to sign in\" with the address filled in — the person has just typed the new\n * password twice; signing in is one step. What else the reset did is said there:\n * every other session ended (the kit's line, true in all three apps), and the app's own\n * outcomes in `notices` — keksdose's recovery-code notice and its revoked API tokens.\n *\n * **The password** is chosen with the same fields as `RegisterForm` and `SignInForm`'s\n * set-password step ({@link NewPasswordFields}): the strength meter and its checklist as\n * advice, and only the two hard rules — at least 8 characters, at most 72 bytes (§8).\n * The submit waits for both and a matching confirmation.\n *\n * The form never sends a request itself (§8): the token and the password go to the\n * callbacks, and the page renders what they resolve with.\n */\nexport function ResetPasswordForm({\n  token,\n  onCheck,\n  onSubmit,\n  onSignIn,\n  signInHref = \"/login\",\n  forgotHref = \"/forgot-password\",\n  describeError,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ResetPasswordFormProps) {\n  const labels = useKitLabels(\"resetPassword\", DEFAULT_RESET_PASSWORD_LABELS, labelsProp);\n  // The phase belongs to the token it was reached with: a new token starts over at the\n  // check without a reset effect.\n  const [phase, setPhase] = useState<{ token: string; phase: Phase } | null>(null);\n  const current: Phase | \"checking\" =\n    token === \"\" ? { kind: \"invalid\" } : phase?.token === token ? phase.phase : \"checking\";\n\n  useOncePerKey(token === \"\" ? null : token, onCheck, (key, result) =>\n    setPhase({\n      token: key,\n      phase: result.ok ? { kind: \"form\", check: result.value ?? {} } : { kind: \"invalid\" },\n    }),\n  );\n\n  const [password, setPassword] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const headingId = useId();\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  const kind = current === \"checking\" ? \"checking\" : current.kind;\n\n  // The form arrives after the check: the field is where the person is going.\n  useEffect(() => {\n    if (kind === \"form\") passwordRef.current?.focus();\n  }, [kind]);\n  useFocusWhen(kind === \"done\", doneRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const rootClass = cn(\"space-y-3\", className);\n\n  if (current === \"checking\") {\n    return (\n      <div {...rest} data-state=\"checking\" aria-busy className={rootClass}>\n        {heading}\n        <LoadingState size=\"sm\" label={labels.checking} />\n      </div>\n    );\n  }\n\n  if (current.kind === \"invalid\") {\n    return (\n      <div {...rest} data-state=\"invalid\" className={rootClass}>\n        {heading}\n        <EmptyState\n          tone=\"danger\"\n          icon={<XCircle />}\n          title={token === \"\" ? labels.noToken : labels.invalid}\n          hint={labels.invalidHint}\n          action={\n            <Button href={forgotHref} variant=\"brand\">\n              {labels.requestNew}\n            </Button>\n          }\n          className={OUTCOME_CLASS}\n        />\n      </div>\n    );\n  }\n\n  if (current.kind === \"done\") {\n    const { email, notices } = current.result;\n    return (\n      <div {...rest} data-state=\"done\" className={rootClass}>\n        {heading}\n        <OutcomeMessage icon={<CheckCircle2 className=\"text-[var(--success)]\" />} focusRef={doneRef}>\n          <p className={INTRO_CLASS}>{labels.success}</p>\n        </OutcomeMessage>\n        {notices}\n        <p className=\"text-xs text-[var(--text-muted)]\">{labels.sessionsEnded}</p>\n        {onSignIn ? (\n          <Button type=\"button\" variant=\"brand\" className=\"w-full\" onClick={() => onSignIn(email)}>\n            {labels.signIn}\n          </Button>\n        ) : (\n          <Button href={email ? withQuery(signInHref, \"email\", email) : signInHref} variant=\"brand\" className=\"w-full\">\n            {labels.signIn}\n          </Button>\n        )}\n      </div>\n    );\n  }\n\n  const { email, notices } = current.check;\n  const problem = newPasswordProblem(password, confirm);\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    if (pending || problem !== null) return;\n    setFailure(null);\n    setPending(true);\n    Promise.resolve()\n      .then(() => onSubmit({ token, password }))\n      .then(\n        (result) => {\n          setPending(false);\n          setPassword(\"\");\n          setConfirm(\"\");\n          setPhase({ token, phase: { kind: \"done\", result } });\n        },\n        (error: unknown) => {\n          setPending(false);\n          // A link that died between the check and the save — used, or run out — is the\n          // dead-link state, under either code (0.31.1: keksdose mapped `token_expired`\n          // to it itself, `asDeadLink`).\n          const code = authErrorCode(error);\n          if (code === \"token_invalid\" || code === \"token_expired\") {\n            setPassword(\"\");\n            setConfirm(\"\");\n            setPhase({ token, phase: { kind: \"invalid\" } });\n            return;\n          }\n          // The app's words first, then the throttle's, then the kit's catch-all.\n          setFailure(\n            describeError?.(error) ??\n              (isRateLimited(error)\n                ? (labels.rateLimited ?? DEFAULT_RESET_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error))\n                : labels.failed),\n          );\n        },\n      );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={rootClass}>\n      <form className=\"space-y-3\" aria-labelledby={title === null ? undefined : headingId} onSubmit={submit}>\n        {heading}\n        {email ? <p className={INTRO_CLASS}>{labels.intro(email)}</p> : null}\n        {notices}\n        {/* Which account the new password is for, for the password manager: it files\n            the new password under this username instead of guessing (kastlan). */}\n        {email ? <input type=\"email\" name=\"username\" autoComplete=\"username\" value={email} readOnly hidden /> : null}\n        <NewPasswordFields\n          password={password}\n          confirm={confirm}\n          onPasswordChange={(next) => {\n            setPassword(next);\n            if (failure) setFailure(null);\n          }}\n          onConfirmChange={setConfirm}\n          busy={pending}\n          passwordRef={passwordRef}\n          text={{ password: labels.newPassword, confirm: labels.confirmPassword, mismatch: labels.mismatch }}\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" disabled={!pending && problem !== null} pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n    </div>\n  );\n}\n"],"mappings":";AAgOM,cAQA,YARA;AAhON,SAAS,WAAW,OAAO,QAAQ,gBAAgB;AAEnD,SAAS,cAAc,eAAe;AACtC,SAAS,UAAU;AACnB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,QAAQ,kBAAkB;AACnC,SAAS,eAAe,oBAAoB,eAAe,yBAAyB;AACpF,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA4CA,MAAM,gCAA+D;AAAA,EAC1E,OAAO;AAAA,EACP,UAAU;AAAA,EACV,OAAO,CAAC,UAAU,0CAAqC,KAAK;AAAA,EAC5D,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,aAAa;AACf;AAmGO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAiD,IAAI;AAC/E,QAAM,UACJ,UAAU,KAAK,EAAE,MAAM,UAAU,IAAI,OAAO,UAAU,QAAQ,MAAM,QAAQ;AAE9E;AAAA,IAAc,UAAU,KAAK,OAAO;AAAA,IAAO;AAAA,IAAS,CAAC,KAAK,WACxD,SAAS;AAAA,MACP,OAAO;AAAA,MACP,OAAO,OAAO,KAAK,EAAE,MAAM,QAAQ,OAAO,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU;AAAA,IACrF,CAAC;AAAA,EACH;AAEA,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,YAAY,MAAM;AACxB,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAC3C,QAAM,OAAO,YAAY,aAAa,aAAa,QAAQ;AAG3D,YAAU,MAAM;AACd,QAAI,SAAS,OAAQ,aAAY,SAAS,MAAM;AAAA,EAClD,GAAG,CAAC,IAAI,CAAC;AACT,eAAa,SAAS,QAAQ,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,YAAY,GAAG,aAAa,SAAS;AAE3C,MAAI,YAAY,YAAY;AAC1B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,YAAW,aAAS,MAAC,WAAW,WACvD;AAAA;AAAA,MACD,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,UAAU;AAAA,OAClD;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,WAAW;AAC9B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,WAAU,WAAW,WAC5C;AAAA;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAM,oBAAC,WAAQ;AAAA,UACf,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO;AAAA,UAC9C,MAAM,OAAO;AAAA,UACb,QACE,oBAAC,UAAO,MAAM,YAAY,SAAQ,SAC/B,iBAAO,YACV;AAAA,UAEF,WAAW;AAAA;AAAA,MACb;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,EAAE,OAAAA,QAAO,SAAAC,SAAQ,IAAI,QAAQ;AACnC,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WACzC;AAAA;AAAA,MACD,oBAAC,kBAAe,MAAM,oBAAC,gBAAa,WAAU,yBAAwB,GAAI,UAAU,SAClF,8BAAC,OAAE,WAAW,aAAc,iBAAO,SAAQ,GAC7C;AAAA,MACCA;AAAA,MACD,oBAAC,OAAE,WAAU,oCAAoC,iBAAO,eAAc;AAAA,MACrE,WACC,oBAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,WAAU,UAAS,SAAS,MAAM,SAASD,MAAK,GACnF,iBAAO,QACV,IAEA,oBAAC,UAAO,MAAMA,SAAQ,UAAU,YAAY,SAASA,MAAK,IAAI,YAAY,SAAQ,SAAQ,WAAU,UACjG,iBAAO,QACV;AAAA,OAEJ;AAAA,EAEJ;AAEA,QAAM,EAAE,OAAO,QAAQ,IAAI,QAAQ;AACnC,QAAM,UAAU,mBAAmB,UAAU,OAAO;AAEpD,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,QAAI,WAAW,YAAY,KAAM;AACjC,eAAW,IAAI;AACf,eAAW,IAAI;AACf,YAAQ,QAAQ,EACb,KAAK,MAAM,SAAS,EAAE,OAAO,SAAS,CAAC,CAAC,EACxC;AAAA,MACC,CAAC,WAAW;AACV,mBAAW,KAAK;AAChB,oBAAY,EAAE;AACd,mBAAW,EAAE;AACb,iBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,MACrD;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAIhB,cAAM,OAAO,cAAc,KAAK;AAChC,YAAI,SAAS,mBAAmB,SAAS,iBAAiB;AACxD,sBAAY,EAAE;AACd,qBAAW,EAAE;AACb,mBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE,CAAC;AAC9C;AAAA,QACF;AAEA;AAAA,UACE,gBAAgB,KAAK,MAClB,cAAc,KAAK,KACf,OAAO,eAAe,8BAA8B,aAAa,kBAAkB,KAAK,CAAC,IAC1F,OAAO;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACJ;AAEA,SACE,oBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WAC1C,+BAAC,UAAK,WAAU,aAAY,mBAAiB,UAAU,OAAO,SAAY,WAAW,UAAU,QAC5F;AAAA;AAAA,IACA,QAAQ,oBAAC,OAAE,WAAW,aAAc,iBAAO,MAAM,KAAK,GAAE,IAAO;AAAA,IAC/D;AAAA,IAGA,QAAQ,oBAAC,WAAM,MAAK,SAAQ,MAAK,YAAW,cAAa,YAAW,OAAO,OAAO,UAAQ,MAAC,QAAM,MAAC,IAAK;AAAA,IACxG;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA,kBAAkB,CAAC,SAAS;AAC1B,sBAAY,IAAI;AAChB,cAAI,QAAS,YAAW,IAAI;AAAA,QAC9B;AAAA,QACA,iBAAiB;AAAA,QACjB,MAAM;AAAA,QACN;AAAA,QACA,MAAM,EAAE,UAAU,OAAO,aAAa,SAAS,OAAO,iBAAiB,UAAU,OAAO,SAAS;AAAA;AAAA,IACnG;AAAA,IACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,IAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,YAAY,MAAM,SAC9E,iBAAO,QACV;AAAA,KACF,GACF;AAEJ;","names":["email","notices"]}
+{"version":3,"sources":["../../src/auth/reset-password-form.tsx"],"sourcesContent":["import { useEffect, useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, FormEvent, ReactNode } from \"react\";\nimport { CheckCircle2, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button } from \"../components/button\";\nimport { EmptyState } from \"../components/empty-state\";\nimport { authErrorCode, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport { newPasswordProblem } from \"./form-rules\";\nimport { NewPasswordFields } from \"./new-password-fields\";\nimport {\n  FORM_HEADING_CLASS,\n  INTRO_CLASS,\n  OUTCOME_CLASS,\n  OutcomeMessage,\n  useFocusWhen,\n  useOncePerKey,\n  withQuery,\n} from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\nimport { DEFAULT_RESET_PASSWORD_LABELS } from \"./reset-password-form-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `resetPassword` namespace. keksdose's words\n *  (`auth.reset.*`), which kastlan took over. */\nexport interface ResetPasswordLabels {\n  /** The heading, on every state. */\n  title: string;\n  /** While the link is checked. */\n  checking: string;\n  /** Over the fields, given the account's address (when the check returned one). */\n  intro: (email: string) => string;\n  newPassword: string;\n  confirmPassword: string;\n  /** Under the confirmation while it differs. */\n  mismatch: string;\n  submit: string;\n  /** The new password was not saved, for a reason that is not the link. */\n  failed: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** The link is unknown, spent or expired — one sentence, as the server gives one\n   *  code (`token_invalid`). */\n  invalid: string;\n  /** Under it. */\n  invalidHint: string;\n  /** The way forward from an invalid link: back to \"Forgot password\". */\n  requestNew: string;\n  /** Done. */\n  success: string;\n  /** Under it: a reset ends every session (§6.3). */\n  sessionsEnded: string;\n  /** The button out — to sign-in, with the address filled in. */\n  signIn: string;\n  /** 0.30.0: the save was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  `Retry-After` wait in seconds, or `undefined` without one. OPTIONAL, like every key\n   *  added to a shipped interface; the provider's `resetPassword`, then English, fill\n   *  it. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n// Defined in ./reset-password-form-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_RESET_PASSWORD_LABELS };\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onCheck` may resolve with — keksdose's `/password-reset/check` answer. */\nexport interface ResetPasswordCheck {\n  /** The account's address: named over the fields (\"You're setting a new password for\n   *  …\") and handed to the password manager, which files the new password under it. */\n  email?: string;\n  /** The app's notices over the fields, shown BEFORE the password is typed — keksdose's\n   *  \"your account is end-to-end encrypted: this restores your sign-in, not your data\". */\n  notices?: ReactNode;\n}\n\n/** What `onSubmit` hands over. */\nexport interface ResetPasswordValues {\n  token: string;\n  password: string;\n}\n\n/** What `onSubmit` resolves with — keksdose's `/password-reset/confirm` answer, which\n *  carries no tokens (§6.3). */\nexport interface ResetPasswordResult {\n  /** The account's address — the sign-in it leads to is filled in with it. */\n  email: string;\n  /** The app's outcomes, shown on the done state: keksdose's recovery-code notice for an\n   *  encrypted account, \"Your 2 personal access tokens were revoked\". */\n  notices?: ReactNode;\n}\n\ntype Phase =\n  | { kind: \"form\"; check: ResetPasswordCheck }\n  | { kind: \"invalid\" }\n  | { kind: \"done\"; result: ResetPasswordResult };\n\nexport interface ResetPasswordFormProps\n  extends Omit<ComponentPropsWithRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=` (keksdose, kastlan: `/reset-password?token=…`).\n   *  Empty: the link was cut short, and the page says so without asking anyone. */\n  token: string;\n  /**\n   * Check the link before the form shows (`/auth/password-reset/check`) — once per\n   * token, on mount. Checking does not use it up, so a reload is free. Resolve (with\n   * the address and any notices) for a live link; reject for a dead one, and the page\n   * says \"This link is invalid or has expired\" with the way to a new one.\n   */\n  onCheck: (token: string) => Promise<ResetPasswordCheck | void | undefined>;\n  /**\n   * The new password was submitted: send `/auth/password-reset/confirm`. Resolve with\n   * the account's address (and the app's notices) — no tokens: a reset is not a sign-in\n   * (§6.3). Reject with the client's error: `token_invalid` (the link expired or was\n   * used in another tab while the form was open) goes to the invalid state; anything\n   * else stays on the form with the password kept.\n   */\n  onSubmit: (values: ResetPasswordValues) => Promise<ResetPasswordResult>;\n  /** \"Go to sign in\" calls this with the address, for an app that routes in code.\n   *  Without it, the button is a link to `signInHref`. */\n  onSignIn?: (email: string) => void;\n  /** Where \"Go to sign in\" leads, with `?email=` added — read it into `SignInForm`'s\n   *  `defaultEmail`. Default `/login`. */\n  signInHref?: string;\n  /** \"Request a new link\" — the app's \"Forgot password\" page. Default\n   *  `/forgot-password`. */\n  forgotHref?: string;\n  /** The app's words for a failed save (the device offline), or `undefined` for the\n   *  kit's: `rateLimited` for a bare `429` (0.30.0), else `failed`. Not asked for\n   *  `token_invalid` or `token_expired`, which are a state. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: LabelOverride<ResetPasswordLabels>;\n}\n\n/**\n * Redeem a password-reset link (`/reset-password?token=…`, docs/auth-harmonization.md\n * §6.3, §7) — keksdose's `ResetPasswordPage` (features/auth/reset-password-page.tsx),\n * which kastlan built its own on.\n *\n * **The link is checked first** (`onCheck`), and only then does the form appear: an\n * expired link should say so before someone types a new password twice, not after.\n *\n * **A reset is not a sign-in** (§6.3, §10.11). The confirm answers without tokens, so a\n * 2FA account cannot skip its second factor by way of its inbox, and the page ends on\n * \"Go to sign in\" with the address filled in — the person has just typed the new\n * password twice; signing in is one step. What else the reset did is said there:\n * every other session ended (the kit's line, true in all three apps), and the app's own\n * outcomes in `notices` — keksdose's recovery-code notice and its revoked API tokens.\n *\n * **The password** is chosen with the same fields as `RegisterForm` and `SignInForm`'s\n * set-password step ({@link NewPasswordFields}): the strength meter and its checklist as\n * advice, and only the two hard rules — at least 8 characters, at most 72 bytes (§8).\n * The submit waits for both and a matching confirmation.\n *\n * The form never sends a request itself (§8): the token and the password go to the\n * callbacks, and the page renders what they resolve with.\n */\nexport function ResetPasswordForm({\n  token,\n  onCheck,\n  onSubmit,\n  onSignIn,\n  signInHref = \"/login\",\n  forgotHref = \"/forgot-password\",\n  describeError,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ResetPasswordFormProps) {\n  const labels = useKitLabels(\"resetPassword\", DEFAULT_RESET_PASSWORD_LABELS, labelsProp);\n  // The phase belongs to the token it was reached with: a new token starts over at the\n  // check without a reset effect.\n  const [phase, setPhase] = useState<{ token: string; phase: Phase } | null>(null);\n  const current: Phase | \"checking\" =\n    token === \"\" ? { kind: \"invalid\" } : phase?.token === token ? phase.phase : \"checking\";\n\n  useOncePerKey(token === \"\" ? null : token, onCheck, (key, result) =>\n    setPhase({\n      token: key,\n      phase: result.ok ? { kind: \"form\", check: result.value ?? {} } : { kind: \"invalid\" },\n    }),\n  );\n\n  const [password, setPassword] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const headingId = useId();\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  const kind = current === \"checking\" ? \"checking\" : current.kind;\n\n  // The form arrives after the check: the field is where the person is going.\n  useEffect(() => {\n    if (kind === \"form\") passwordRef.current?.focus();\n  }, [kind]);\n  useFocusWhen(kind === \"done\", doneRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const rootClass = cn(\"space-y-3\", className);\n\n  if (current === \"checking\") {\n    return (\n      <div {...rest} data-state=\"checking\" aria-busy className={rootClass}>\n        {heading}\n        <LoadingState size=\"sm\" label={labels.checking} />\n      </div>\n    );\n  }\n\n  if (current.kind === \"invalid\") {\n    return (\n      <div {...rest} data-state=\"invalid\" className={rootClass}>\n        {heading}\n        <EmptyState\n          tone=\"danger\"\n          icon={<XCircle />}\n          title={token === \"\" ? labels.noToken : labels.invalid}\n          hint={labels.invalidHint}\n          action={\n            <Button href={forgotHref} variant=\"brand\">\n              {labels.requestNew}\n            </Button>\n          }\n          className={OUTCOME_CLASS}\n        />\n      </div>\n    );\n  }\n\n  if (current.kind === \"done\") {\n    const { email, notices } = current.result;\n    return (\n      <div {...rest} data-state=\"done\" className={rootClass}>\n        {heading}\n        <OutcomeMessage icon={<CheckCircle2 className=\"text-success\" />} focusRef={doneRef}>\n          <p className={INTRO_CLASS}>{labels.success}</p>\n        </OutcomeMessage>\n        {notices}\n        <p className=\"text-xs text-muted\">{labels.sessionsEnded}</p>\n        {onSignIn ? (\n          <Button type=\"button\" variant=\"brand\" className=\"w-full\" onClick={() => onSignIn(email)}>\n            {labels.signIn}\n          </Button>\n        ) : (\n          <Button href={email ? withQuery(signInHref, \"email\", email) : signInHref} variant=\"brand\" className=\"w-full\">\n            {labels.signIn}\n          </Button>\n        )}\n      </div>\n    );\n  }\n\n  const { email, notices } = current.check;\n  const problem = newPasswordProblem(password, confirm);\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    if (pending || problem !== null) return;\n    setFailure(null);\n    setPending(true);\n    Promise.resolve()\n      .then(() => onSubmit({ token, password }))\n      .then(\n        (result) => {\n          setPending(false);\n          setPassword(\"\");\n          setConfirm(\"\");\n          setPhase({ token, phase: { kind: \"done\", result } });\n        },\n        (error: unknown) => {\n          setPending(false);\n          // A link that died between the check and the save — used, or run out — is the\n          // dead-link state, under either code (0.31.1: keksdose mapped `token_expired`\n          // to it itself, `asDeadLink`).\n          const code = authErrorCode(error);\n          if (code === \"token_invalid\" || code === \"token_expired\") {\n            setPassword(\"\");\n            setConfirm(\"\");\n            setPhase({ token, phase: { kind: \"invalid\" } });\n            return;\n          }\n          // The app's words first, then the throttle's, then the kit's catch-all.\n          setFailure(\n            describeError?.(error) ??\n              (isRateLimited(error)\n                ? (labels.rateLimited ?? DEFAULT_RESET_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error))\n                : labels.failed),\n          );\n        },\n      );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={rootClass}>\n      <form className=\"space-y-3\" aria-labelledby={title === null ? undefined : headingId} onSubmit={submit}>\n        {heading}\n        {email ? <p className={INTRO_CLASS}>{labels.intro(email)}</p> : null}\n        {notices}\n        {/* Which account the new password is for, for the password manager: it files\n            the new password under this username instead of guessing (kastlan). */}\n        {email ? <input type=\"email\" name=\"username\" autoComplete=\"username\" value={email} readOnly hidden /> : null}\n        <NewPasswordFields\n          password={password}\n          confirm={confirm}\n          onPasswordChange={(next) => {\n            setPassword(next);\n            if (failure) setFailure(null);\n          }}\n          onConfirmChange={setConfirm}\n          busy={pending}\n          passwordRef={passwordRef}\n          text={{ password: labels.newPassword, confirm: labels.confirmPassword, mismatch: labels.mismatch }}\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" disabled={!pending && problem !== null} pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n    </div>\n  );\n}\n"],"mappings":";AAiNM,cAQA,YARA;AAjNN,SAAS,WAAW,OAAO,QAAQ,gBAAgB;AAEnD,SAAS,cAAc,eAAe;AACtC,SAAS,UAAU;AACnB,SAAS,oBAAwC;AACjD,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,eAAe,eAAe,yBAAyB;AAChE,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,qCAAqC;AA8IvC,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAiD,IAAI;AAC/E,QAAM,UACJ,UAAU,KAAK,EAAE,MAAM,UAAU,IAAI,OAAO,UAAU,QAAQ,MAAM,QAAQ;AAE9E;AAAA,IAAc,UAAU,KAAK,OAAO;AAAA,IAAO;AAAA,IAAS,CAAC,KAAK,WACxD,SAAS;AAAA,MACP,OAAO;AAAA,MACP,OAAO,OAAO,KAAK,EAAE,MAAM,QAAQ,OAAO,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU;AAAA,IACrF,CAAC;AAAA,EACH;AAEA,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,YAAY,MAAM;AACxB,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAC3C,QAAM,OAAO,YAAY,aAAa,aAAa,QAAQ;AAG3D,YAAU,MAAM;AACd,QAAI,SAAS,OAAQ,aAAY,SAAS,MAAM;AAAA,EAClD,GAAG,CAAC,IAAI,CAAC;AACT,eAAa,SAAS,QAAQ,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,YAAY,GAAG,aAAa,SAAS;AAE3C,MAAI,YAAY,YAAY;AAC1B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,YAAW,aAAS,MAAC,WAAW,WACvD;AAAA;AAAA,MACD,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,UAAU;AAAA,OAClD;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,WAAW;AAC9B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,WAAU,WAAW,WAC5C;AAAA;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAM,oBAAC,WAAQ;AAAA,UACf,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO;AAAA,UAC9C,MAAM,OAAO;AAAA,UACb,QACE,oBAAC,UAAO,MAAM,YAAY,SAAQ,SAC/B,iBAAO,YACV;AAAA,UAEF,WAAW;AAAA;AAAA,MACb;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,EAAE,OAAAA,QAAO,SAAAC,SAAQ,IAAI,QAAQ;AACnC,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WACzC;AAAA;AAAA,MACD,oBAAC,kBAAe,MAAM,oBAAC,gBAAa,WAAU,gBAAe,GAAI,UAAU,SACzE,8BAAC,OAAE,WAAW,aAAc,iBAAO,SAAQ,GAC7C;AAAA,MACCA;AAAA,MACD,oBAAC,OAAE,WAAU,sBAAsB,iBAAO,eAAc;AAAA,MACvD,WACC,oBAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,WAAU,UAAS,SAAS,MAAM,SAASD,MAAK,GACnF,iBAAO,QACV,IAEA,oBAAC,UAAO,MAAMA,SAAQ,UAAU,YAAY,SAASA,MAAK,IAAI,YAAY,SAAQ,SAAQ,WAAU,UACjG,iBAAO,QACV;AAAA,OAEJ;AAAA,EAEJ;AAEA,QAAM,EAAE,OAAO,QAAQ,IAAI,QAAQ;AACnC,QAAM,UAAU,mBAAmB,UAAU,OAAO;AAEpD,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,QAAI,WAAW,YAAY,KAAM;AACjC,eAAW,IAAI;AACf,eAAW,IAAI;AACf,YAAQ,QAAQ,EACb,KAAK,MAAM,SAAS,EAAE,OAAO,SAAS,CAAC,CAAC,EACxC;AAAA,MACC,CAAC,WAAW;AACV,mBAAW,KAAK;AAChB,oBAAY,EAAE;AACd,mBAAW,EAAE;AACb,iBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,MACrD;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAIhB,cAAM,OAAO,cAAc,KAAK;AAChC,YAAI,SAAS,mBAAmB,SAAS,iBAAiB;AACxD,sBAAY,EAAE;AACd,qBAAW,EAAE;AACb,mBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE,CAAC;AAC9C;AAAA,QACF;AAEA;AAAA,UACE,gBAAgB,KAAK,MAClB,cAAc,KAAK,KACf,OAAO,eAAe,8BAA8B,aAAa,kBAAkB,KAAK,CAAC,IAC1F,OAAO;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACJ;AAEA,SACE,oBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WAC1C,+BAAC,UAAK,WAAU,aAAY,mBAAiB,UAAU,OAAO,SAAY,WAAW,UAAU,QAC5F;AAAA;AAAA,IACA,QAAQ,oBAAC,OAAE,WAAW,aAAc,iBAAO,MAAM,KAAK,GAAE,IAAO;AAAA,IAC/D;AAAA,IAGA,QAAQ,oBAAC,WAAM,MAAK,SAAQ,MAAK,YAAW,cAAa,YAAW,OAAO,OAAO,UAAQ,MAAC,QAAM,MAAC,IAAK;AAAA,IACxG;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA,kBAAkB,CAAC,SAAS;AAC1B,sBAAY,IAAI;AAChB,cAAI,QAAS,YAAW,IAAI;AAAA,QAC9B;AAAA,QACA,iBAAiB;AAAA,QACjB,MAAM;AAAA,QACN;AAAA,QACA,MAAM,EAAE,UAAU,OAAO,aAAa,SAAS,OAAO,iBAAiB,UAAU,OAAO,SAAS;AAAA;AAAA,IACnG;AAAA,IACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,IAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,YAAY,MAAM,SAC9E,iBAAO,QACV;AAAA,KACF,GACF;AAEJ;","names":["email","notices"]}

package/dist/auth/sign-in-form-labels.d.ts

@@ -0,0 +1,3 @@
+import type { SignInLabels } from "./sign-in-form.js";
+/** `Required`: every key, the 0.30 ones included, has its English here. */
+export declare const DEFAULT_SIGN_IN_LABELS: Required<SignInLabels>;

package/dist/auth/sign-in-form-labels.js

@@ -0,0 +1,42 @@
+"use client";
+import { englishRateLimited } from "./auth-errors.js";
+const DEFAULT_SIGN_IN_LABELS = {
+  email: "Email",
+  password: "Password",
+  submit: "Sign in",
+  passkey: "Sign in with a passkey",
+  forgotPassword: "Forgot your password?",
+  noAccount: "No account yet?",
+  register: "Create account",
+  invalidCredentials: "The email or password is incorrect.",
+  failed: "Sign-in failed. Please try again.",
+  passkeyFailed: "Passkey sign-in failed.",
+  deactivatedHint: "Account deactivated? Write to {contact}.",
+  tagHint: (taggedAddress) => `Signed up with ${taggedAddress}? Use that address.`,
+  twoFactorTitle: "Two-factor authentication",
+  twoFactorIntro: "Enter the code your authenticator app shows.",
+  code: "2FA code",
+  verify: "Verify",
+  codeInvalid: "Invalid 2FA code.",
+  setPasswordTitle: "Choose a new password",
+  setPasswordIntro: "A new password was requested for this account. Choose one and you are straight back in.",
+  newPassword: "New password",
+  confirmPassword: "Repeat new password",
+  passwordMismatch: "The passwords don't match.",
+  setPasswordSubmit: "Set password and sign in",
+  setPasswordFailed: "The password could not be set.",
+  expired: "This sign-in has expired. Please sign in again.",
+  backToSignIn: "Back to sign in",
+  useRecoveryCode: "Use a backup code",
+  useAuthenticatorCode: "Use your authenticator app",
+  recoveryCode: "Backup code",
+  recoveryIntro: "Enter one of the backup codes you saved when you turned on two-factor authentication.",
+  recoveryCodeHint: (length) => `${length} letters and digits. Dashes and spaces don\u2019t matter.`,
+  recoveryCodeInvalid: "This backup code is not valid, or it has been used already.",
+  rateLimited: englishRateLimited,
+  requestAccess: "Request access"
+};
+export {
+  DEFAULT_SIGN_IN_LABELS
+};
+//# sourceMappingURL=sign-in-form-labels.js.map

package/dist/auth/sign-in-form-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/sign-in-form-labels.ts"],"sourcesContent":["// The English words of ./sign-in-form, in a module with no component code: the English\n// catalogue (src/i18n/defaults.ts) imports them without the component, so `en` loads as one\n// chunk like the other languages (0.34, KS U8). ./sign-in-form re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors\";\nimport type { SignInLabels } from \"./sign-in-form\";\n\n/** `Required`: every key, the 0.30 ones included, has its English here. */\nexport const DEFAULT_SIGN_IN_LABELS: Required<SignInLabels> = {\n  email: \"Email\",\n  password: \"Password\",\n  submit: \"Sign in\",\n  passkey: \"Sign in with a passkey\",\n  forgotPassword: \"Forgot your password?\",\n  noAccount: \"No account yet?\",\n  register: \"Create account\",\n  invalidCredentials: \"The email or password is incorrect.\",\n  failed: \"Sign-in failed. Please try again.\",\n  passkeyFailed: \"Passkey sign-in failed.\",\n  deactivatedHint: \"Account deactivated? Write to {contact}.\",\n  tagHint: (taggedAddress) => `Signed up with ${taggedAddress}? Use that address.`,\n  twoFactorTitle: \"Two-factor authentication\",\n  twoFactorIntro: \"Enter the code your authenticator app shows.\",\n  code: \"2FA code\",\n  verify: \"Verify\",\n  codeInvalid: \"Invalid 2FA code.\",\n  setPasswordTitle: \"Choose a new password\",\n  setPasswordIntro: \"A new password was requested for this account. Choose one and you are straight back in.\",\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  passwordMismatch: \"The passwords don't match.\",\n  setPasswordSubmit: \"Set password and sign in\",\n  setPasswordFailed: \"The password could not be set.\",\n  expired: \"This sign-in has expired. Please sign in again.\",\n  backToSignIn: \"Back to sign in\",\n  useRecoveryCode: \"Use a backup code\",\n  useAuthenticatorCode: \"Use your authenticator app\",\n  recoveryCode: \"Backup code\",\n  recoveryIntro: \"Enter one of the backup codes you saved when you turned on two-factor authentication.\",\n  recoveryCodeHint: (length) => `${length} letters and digits. Dashes and spaces don’t matter.`,\n  recoveryCodeInvalid: \"This backup code is not valid, or it has been used already.\",\n  rateLimited: englishRateLimited,\n  requestAccess: \"Request access\",\n};\n"],"mappings":";AAIA,SAAS,0BAA0B;AAI5B,MAAM,yBAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,SAAS,CAAC,kBAAkB,kBAAkB,aAAa;AAAA,EAC3D,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,kBAAkB,CAAC,WAAW,GAAG,MAAM;AAAA,EACvC,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,eAAe;AACjB;","names":[]}

package/dist/auth/sign-in-form.d.ts

@@ -1,8 +1,7 @@
-import * as react from 'react';
-import { ComponentPropsWithoutRef, ReactNode } from 'react';
-import { AccessChoice } from '../landing/access.js';
-import '../landing/landing-labels.js';
-
+import type { ComponentPropsWithRef, ReactNode } from "react";
+import { type LabelOverride } from "../i18n/kit-labels.js";
+import type { AccessChoice } from "../landing/access.js";
+import { DEFAULT_SIGN_IN_LABELS } from "./sign-in-form-labels.js";
 /**
  * What a sign-in call answers, in the kit's words — docs/auth-harmonization.md §5.1,
  * keksdose's three shapes. The app maps its own HTTP answer to one of these and resolves
@@ -30,7 +29,7 @@ import '../landing/landing-labels.js';
  * The same mapping serves `/auth/login/2fa`, `/auth/login/set-password` and the passkey
  * finish, which answer the same union.
  */
-type SignInAnswer = {
+export type SignInAnswer = {
     kind: "signed-in";
 } | {
     kind: "2fa";
@@ -43,17 +42,17 @@ type SignInAnswer = {
     extra?: Readonly<Record<string, unknown>>;
 };
 /** The step on screen: the credentials, the second factor, or a new password. */
-type SignInStep = "credentials" | "2fa" | "password-change";
+export type SignInStep = "credentials" | "2fa" | "password-change";
 /** What the person did when a call failed — {@link SignInFormProps.describeError}'s
  *  second argument. */
-type SignInAction = "password" | "passkey" | "code" | "set-password";
-interface SignInCredentials {
+export type SignInAction = "password" | "passkey" | "code" | "set-password";
+export interface SignInCredentials {
     /** Trimmed. Lower-casing is the server's (§3.1). */
     email: string;
     /** As typed, never trimmed. */
     password: string;
 }
-interface SignInCodeValues {
+export interface SignInCodeValues {
     challengeToken: string;
     /** Digits only — {@link OneTimeCodeInput} drops the spaces of "123 456". A backup code
      *  (`kind: "recovery"`) is trimmed and otherwise as typed: its dashes and case are the
@@ -67,7 +66,7 @@ interface SignInCodeValues {
      */
     kind?: "recovery";
 }
-interface SignInNewPasswordValues {
+export interface SignInNewPasswordValues {
     challengeToken: string;
     password: string;
 }
@@ -76,7 +75,7 @@ interface SignInNewPasswordValues {
  * labels>`, overridable per instance through `labels`. keksdose's words where it has
  * them (`auth.*` in its catalogue).
  */
-interface SignInLabels {
+export interface SignInLabels {
     email: string;
     password: string;
     /** The submit button. */
@@ -148,9 +147,8 @@ interface SignInLabels {
      *  `request`) — a mail to support, in place of `register`. */
     requestAccess?: string;
 }
-/** `Required`: every key, the 0.30 ones included, has its English here. */
-declare const DEFAULT_SIGN_IN_LABELS: Required<SignInLabels>;
-interface SignInFormProps extends Omit<ComponentPropsWithoutRef<"div">, "onSubmit" | "children"> {
+export { DEFAULT_SIGN_IN_LABELS };
+export interface SignInFormProps extends Omit<ComponentPropsWithRef<"div">, "onSubmit" | "children"> {
     /**
      * The credentials step was submitted. Send them, and resolve with the answer
      * ({@link SignInAnswer}) or reject with the client's error. The form never sends a
@@ -256,7 +254,7 @@ interface SignInFormProps extends Omit<ComponentPropsWithoutRef<"div">, "onSubmi
     /** The level of the second and third step's heading. Default `h2`, under the page's
      *  `h1`; one level under `AuthLayout`'s `headingAs` where that is embedded lower. */
     headingAs?: "h2" | "h3" | "h4" | "h5" | "h6";
-    labels?: Partial<SignInLabels>;
+    labels?: LabelOverride<SignInLabels>;
 }
 /**
  * Sign-in for every app (docs/auth-harmonization.md §5, §8): email and password, or a
@@ -304,6 +302,4 @@ interface SignInFormProps extends Omit<ComponentPropsWithoutRef<"div">, "onSubmi
  * The password is dropped from state once the credentials are answered; "Back to sign in"
  * returns to an empty password field.
  */
-declare function SignInForm({ onSubmit, onCode, onSetPassword, onPasskey, passkeyAutofill, forgotHref, registerHref, access, defaultEmail, emailTag, deactivatedContact, codeLength, recoveryCode, credentialsContent, twoFactorContent, passwordChangeContent, describeError, onStepChange, headingAs: Heading, labels: labelsProp, className, ...rest }: SignInFormProps): react.JSX.Element;
-
-export { DEFAULT_SIGN_IN_LABELS, type SignInAction, type SignInAnswer, type SignInCodeValues, type SignInCredentials, SignInForm, type SignInFormProps, type SignInLabels, type SignInNewPasswordValues, type SignInStep };
+export declare function SignInForm({ onSubmit, onCode, onSetPassword, onPasskey, passkeyAutofill, forgotHref, registerHref, access, defaultEmail, emailTag, deactivatedContact, codeLength, recoveryCode, credentialsContent, twoFactorContent, passwordChangeContent, describeError, onStepChange, headingAs: Heading, labels: labelsProp, className, ...rest }: SignInFormProps): import("react").JSX.Element;

package/dist/auth/sign-in-form.js

@@ -5,64 +5,30 @@ import { KeyRound } from "lucide-react";
 import { useKitLabels } from "../i18n/kit-labels.js";
 import { cn } from "../lib/cn.js";
 import { AlertBanner } from "../components/alert-banner.js";
-import { hasMessage } from "../components/choice-parts.js";
+import { hasContent } from "../lib/presence.js";
 import { CurrentPasswordInput } from "../components/danger-confirm.js";
 import { OneTimeCodeInput } from "../components/one-time-code-input.js";
 import { TextLink } from "../components/text-link.js";
-import { Button, Input } from "../components/ui.js";
+import { Button } from "../components/button.js";
+import { Input } from "../components/input.js";
 import { accessAction } from "../landing/access.js";
 import { useLandingLabels } from "../landing/landing-labels.js";
-import { authErrorCode, englishRateLimited, isRateLimited, retryAfterSeconds } from "./auth-errors.js";
+import { authErrorCode, isRateLimited, retryAfterSeconds } from "./auth-errors.js";
 import { taggedEmail } from "./email-tag.js";
 import { newPasswordProblem } from "./form-rules.js";
 import { NewPasswordFields } from "./new-password-fields.js";
-const DEFAULT_SIGN_IN_LABELS = {
-  email: "Email",
-  password: "Password",
-  submit: "Sign in",
-  passkey: "Sign in with a passkey",
-  forgotPassword: "Forgot your password?",
-  noAccount: "No account yet?",
-  register: "Create account",
-  invalidCredentials: "The email or password is incorrect.",
-  failed: "Sign-in failed. Please try again.",
-  passkeyFailed: "Passkey sign-in failed.",
-  deactivatedHint: "Account deactivated? Write to {contact}.",
-  tagHint: (taggedAddress) => `Signed up with ${taggedAddress}? Use that address.`,
-  twoFactorTitle: "Two-factor authentication",
-  twoFactorIntro: "Enter the code your authenticator app shows.",
-  code: "2FA code",
-  verify: "Verify",
-  codeInvalid: "Invalid 2FA code.",
-  setPasswordTitle: "Choose a new password",
-  setPasswordIntro: "A new password was requested for this account. Choose one and you are straight back in.",
-  newPassword: "New password",
-  confirmPassword: "Repeat new password",
-  passwordMismatch: "The passwords don't match.",
-  setPasswordSubmit: "Set password and sign in",
-  setPasswordFailed: "The password could not be set.",
-  expired: "This sign-in has expired. Please sign in again.",
-  backToSignIn: "Back to sign in",
-  useRecoveryCode: "Use a backup code",
-  useAuthenticatorCode: "Use your authenticator app",
-  recoveryCode: "Backup code",
-  recoveryIntro: "Enter one of the backup codes you saved when you turned on two-factor authentication.",
-  recoveryCodeHint: (length) => `${length} letters and digits. Dashes and spaces don\u2019t matter.`,
-  recoveryCodeInvalid: "This backup code is not valid, or it has been used already.",
-  rateLimited: englishRateLimited,
-  requestAccess: "Request access"
-};
+import { DEFAULT_SIGN_IN_LABELS } from "./sign-in-form-labels.js";
 function withContact(template, contact) {
   const node = typeof contact === "string" && contact.includes("@") ? /* @__PURE__ */ jsx(TextLink, { href: `mailto:${contact}`, tone: "secondary", children: contact }, "contact") : /* @__PURE__ */ jsx("span", { children: contact }, "contact");
   if (!template.includes("{contact}")) return [template, " ", node];
   return template.split(/(\{contact\})/).filter((part) => part !== "").map((part) => part === "{contact}" ? node : part);
 }
-const HINT_CLASS = "text-xs text-[var(--text-secondary)]";
+const HINT_CLASS = "text-xs text-secondary";
 const RECOVERY_CODE_LENGTH = 16;
 function recoveryCharacters(value) {
   return value.replace(/[^\p{L}\p{N}]/gu, "").length;
 }
-const INTRO_CLASS = "text-sm text-[var(--text-secondary)]";
+const INTRO_CLASS = "text-sm text-secondary";
 function SignInForm({
   onSubmit,
   onCode,
@@ -146,7 +112,7 @@ function SignInForm({
   };
   const messageFor = (error, action, code2, recoveryUsed) => {
     const own = describeError?.(error, action);
-    if (hasMessage(own)) return own;
+    if (hasContent(own)) return own;
     if (isRateLimited(error)) return (labels.rateLimited ?? DEFAULT_SIGN_IN_LABELS.rateLimited)(retryAfterSeconds(error));
     if (action === "password") return code2 === "invalid_credentials" ? labels.invalidCredentials : labels.failed;
     if (action === "passkey") return labels.passkeyFailed;
@@ -272,7 +238,7 @@ function SignInForm({
     const content = typeof twoFactorContent === "function" ? twoFactorContent(challenge.token) : twoFactorContent;
     return /* @__PURE__ */ jsxs("div", { ...rest, "data-step": "2fa", className: rootClass, children: [
       /* @__PURE__ */ jsxs("form", { className: "space-y-3", "aria-labelledby": headingId, onSubmit: submitCode, children: [
-        /* @__PURE__ */ jsx(Heading, { id: headingId, className: "text-base font-semibold text-[var(--text-primary)]", children: labels.twoFactorTitle }),
+        /* @__PURE__ */ jsx(Heading, { id: headingId, className: "text-base font-semibold text-primary", children: labels.twoFactorTitle }),
         /* @__PURE__ */ jsx("p", { className: INTRO_CLASS, children: asRecovery ? labels.recoveryIntro ?? DEFAULT_SIGN_IN_LABELS.recoveryIntro : labels.twoFactorIntro }),
         content,
         asRecovery ? (
@@ -334,7 +300,7 @@ function SignInForm({
     const content = typeof passwordChangeContent === "function" ? passwordChangeContent(challenge.extra) : passwordChangeContent;
     return /* @__PURE__ */ jsxs("div", { ...rest, "data-step": "password-change", className: rootClass, children: [
       /* @__PURE__ */ jsxs("form", { className: "space-y-3", "aria-labelledby": headingId, onSubmit: submitPassword, children: [
-        /* @__PURE__ */ jsx(Heading, { id: headingId, className: "text-base font-semibold text-[var(--text-primary)]", children: labels.setPasswordTitle }),
+        /* @__PURE__ */ jsx(Heading, { id: headingId, className: "text-base font-semibold text-primary", children: labels.setPasswordTitle }),
         /* @__PURE__ */ jsx("p", { className: INTRO_CLASS, children: labels.setPasswordIntro }),
         content,
         email !== "" && /* @__PURE__ */ jsx("input", { type: "email", name: "username", autoComplete: "username", value: email, readOnly: true, hidden: true }),
@@ -364,7 +330,7 @@ function SignInForm({
   };
   const refused = failure?.code === "invalid_credentials";
   const tagged = refused && failure?.action === "password" && emailTag && failure.email ? taggedEmail(failure.email, emailTag) : null;
-  const showDeactivated = refused && hasMessage(deactivatedContact);
+  const showDeactivated = refused && hasContent(deactivatedContact);
   return /* @__PURE__ */ jsxs("div", { ...rest, "data-step": "credentials", className: rootClass, children: [
     /* @__PURE__ */ jsxs("form", { className: "space-y-3", onSubmit: submitCredentials, children: [
       credentialsContent,
@@ -418,7 +384,7 @@ function SignInForm({
       )
     ] }),
     forgotHref !== void 0 && /* @__PURE__ */ jsx("p", { className: "text-center text-sm", children: /* @__PURE__ */ jsx(TextLink, { href: forgotHref, tone: "secondary", children: labels.forgotPassword }) }),
-    accountLink !== null && /* @__PURE__ */ jsxs("p", { className: "text-center text-sm text-[var(--text-secondary)]", children: [
+    accountLink !== null && /* @__PURE__ */ jsxs("p", { className: "text-center text-sm text-secondary", children: [
       labels.noAccount,
       " ",
       /* @__PURE__ */ jsx(TextLink, { href: accountLink.href, tone: "primary", children: accountLink.label })