@eifi1/ui-kit 0.33.1 → 0.35.0

package/dist/components/danger-confirm.d.ts

@@ -1,101 +1,448 @@
-import 'react';
-export { cj as CurrentPasswordInput, ck as CurrentPasswordInputLabels, cl as CurrentPasswordInputProps, cx as DEFAULT_DANGER_CONFIRM_LABELS, cW as DangerConfirm, cX as DangerConfirmLabels, cY as DangerConfirmProps, cZ as DangerConfirmValues, c_ as DangerConsequence, fD as TypedConfirmField, fE as TypedConfirmFieldLabels, fF as TypedConfirmFieldProps, fG as TypedMatch, gb as typedMatches, gI as usePromisePending } from '../delete-account-setting-DAgGBrbn.js';
-import './write-lock.js';
-import './tooltip.js';
-import '../hooks/use-anchored-rect.js';
-import '../lib/clipping.js';
-import '../data-table-labels-BJ5JE_X2.js';
-import './data-table-sort.js';
-import './swipeable-row.js';
-import './status-dot.js';
-import './progress-bar.js';
-import './signed-amount.js';
-import './stat-tile.js';
-import './chip.js';
-import 'lucide-react';
-import './field-parts.js';
-import './mini-calendar.js';
-import './calendar-heatmap.js';
-import './popover.js';
-import '../hooks/use-breakpoint.js';
-import './field-sync.js';
-import '../wizard/types.js';
-import '../tour/tour.js';
-import '../search/command-palette.js';
-import '../search/global-search.js';
-import '../search/search-index.js';
-import './month-picker.js';
-import './page-contents.js';
-import './series-chart-labels.js';
-import './pie-chart-labels.js';
-import './sparkline.js';
-import './signature-pad.js';
-import './password-strength.js';
-import './swatch-picker.js';
-import './tile-radio.js';
-import './icon-picker.js';
-import './dialog-frame.js';
-import './modal.js';
-import '../hooks/use-search-param-state.js';
-import './measured-grid.js';
-import './user-avatar.js';
-import '../lib/person-name.js';
-import '../shell/topbar-action-menu.js';
-import './menu-item.js';
-import './floating-panel.js';
-import '../hooks/use-authed-src.js';
-import './account-settings-labels.js';
-import './bulk-action-bar.js';
-import './list.js';
-import './breadcrumbs.js';
-import './toast.js';
-import './description-list.js';
-import './line-items.js';
-import './error-boundary.js';
-import './authed-image.js';
-import './image-grid.js';
-import './lightbox.js';
-import '../auth/sign-in-form.js';
-import '../landing/access.js';
-import '../landing/landing-labels.js';
-import '../shell/topbar-controls.js';
-import '../theme/palette-presets.js';
-import '../theme/chart-palette.js';
-import '../theme/theme-store.js';
-import 'zustand/middleware';
-import 'zustand';
-import '../auth/complete-name-dialog.js';
-import '../auth/forgot-password-form.js';
-import '../auth/status-parts.js';
-import '../auth/reset-password-form.js';
-import '../auth/verify-email.js';
-import '../auth/not-found-page.js';
-import '../auth/accept-invitation.js';
-import '../shell/company-switcher.js';
-import '../account/email-change-setting.js';
-import '../account/sessions-setting.js';
-import '../lib/format.js';
-import '../account/data-export-setting.js';
-import './account-chips.js';
-import '../admin/admin-parts.js';
-import '../admin/admin-action-log.js';
-import '../settings/settings-labels.js';
-import '../demo/demo-labels.js';
-import '../i18n/plurals.js';
-import './appearance-labels.js';
-import '../theme/contrast.js';
-import '../theme/text-size.js';
-import './reauth-dialog.js';
-import './server-wake.js';
-import '../lib/server-wake.js';
-import './translation-review-labels.js';
-import '../lib/translation-review.js';
-import './country-select.js';
-import './inline-edit-field.js';
-import '../lib/iban.js';
-import '../lib/phone.js';
-import './sign-chip.js';
-import './column-mapper.js';
-import '../lib/column-mapping.js';
-import '../lib/table-text.js';
-import './focus-ring.js';
+import type { ComponentPropsWithRef, ReactNode } from "react";
+import { type LabelOverride } from "../i18n/kit-labels.js";
+import type { ButtonVariant } from "./button-look.js";
+import type { InputProps } from "./input.js";
+import { type CommitScope } from "./write-lock.js";
+import { DEFAULT_DANGER_CONFIRM_LABELS } from "./danger-confirm-labels.js";
+/**
+ * How typed text is compared with the text it has to repeat — shared by
+ * `DangerConfirm`'s `phraseMatch` and `useConfirm`'s `typedMatch`.
+ *
+ * - `"trim"` ignores spaces around the typed text — a phone keyboard's autocomplete
+ *   likes to add one. Case counts: "delete" is not "DELETE".
+ * - `"exact"` compares character for character, spaces included.
+ * - `"caseless"` trims AND ignores case: for an e-mail address, whose domain is
+ *   case-insensitive and whose local part every real mail server treats so. Both apps'
+ *   "type the account's address" rules (keksdose's `TYPE_EMAIL`, Kurvenschmiede's
+ *   `TypedConfirm`) compared `trim().toLowerCase()`, and a capital the user's keyboard
+ *   put at the start must not make the right row look like the wrong one.
+ */
+export type TypedMatch = "trim" | "exact" | "caseless";
+/** Whether `typed` repeats `target` under `mode` — see {@link TypedMatch}. Exported for
+ *  a caller that draws its own field (a dialog that also picks a recipient) and wants
+ *  the same rule as the kit's. */
+export declare function typedMatches(typed: string, target: string, mode?: TypedMatch): boolean;
+/**
+ * Busy-while-a-promise-runs, for an action that MAY return one: `run(result, onResolved)`
+ * marks the caller pending until `result` settles, calls `onResolved` if it fulfilled,
+ * and only clears the flag if it rejected — the caller shows why and the user retries.
+ * Nothing runs after unmount. Shared by `DangerConfirm` and `ReauthDialog`, whose
+ * contract is the same: resolve = done, reject = stay put.
+ *
+ * @internal
+ */
+export declare function usePromisePending(): {
+    pending: boolean;
+    run: (result: unknown, onResolved: () => void) => boolean;
+};
+/** The one word {@link CurrentPasswordInput} says on its own behalf — the
+ *  `dangerConfirm.password` label, shared with DangerConfirm's password field, so an
+ *  app translates "Password" once. */
+export type CurrentPasswordInputLabels = Pick<DangerConfirmLabels, "password">;
+/**
+ * Everything {@link Input} takes except what makes this field what it is: `type` is
+ * always `"password"` and `autoComplete` always `"current-password"`.
+ */
+export interface CurrentPasswordInputProps extends Omit<InputProps, "type" | "autoComplete" | "label"> {
+    /**
+     * The visible label. Default `dangerConfirm.password` ("Password") — unless the field
+     * is named another way (`aria-label` / `aria-labelledby`), which then stays the only
+     * name. Pass the app's own word on a sign-in form ("Password", "Your password"), or
+     * `null` for a field whose `<label htmlFor>` is drawn elsewhere (a form library's
+     * label), which would otherwise be labelled twice.
+     */
+    label?: ReactNode;
+    /** The value as a string — the `(next) => …` shape, so a caller holding it in
+     *  `useState` need not unwrap `event.target.value`. Fires alongside `onChange`,
+     *  never instead of it, so a form library's `onChange` keeps working. */
+    onValueChange?: (value: string) => void;
+    /**
+     * A check is running (the sign-in request, the re-auth). The field turns `readOnly`,
+     * NOT `disabled`: the field being submitted is usually the focused one (Enter was
+     * pressed in it), and disabling a focused field drops focus to `<body>` — the user
+     * lands nowhere when the "wrong password" answer comes back.
+     */
+    busy?: boolean;
+    /** Per-instance override of `dangerConfirm.password`. */
+    labels?: LabelOverride<CurrentPasswordInputLabels>;
+}
+/**
+ * The "prove it is you" field: a password input that a password manager fills with
+ * the CURRENT password and never offers to generate a new one for.
+ *
+ * It is the field of a sign-in form, a re-auth step ({@link ReauthDialog} draws the same
+ * field), and {@link DangerConfirm}'s `requirePassword`. Public since 0.22 for kastlan's
+ * sign-in and re-auth (kastlan 1), which wrote `type="password"` +
+ * `autoComplete="current-password"` by hand — and a sign-in field that forgets the
+ * second half gets the browser's "suggest a strong password" offer on the one form where
+ * a NEW password is never what is wanted. The reverse matters as much: a field that sets
+ * a NEW password (a passphrase, a sign-up) must NOT be this one — keksdose #170 keeps
+ * its passphrase doors on `new-password` / `off` for that reason.
+ *
+ * Everything else is {@link Input}: the reveal toggle, `error` (under the field,
+ * `aria-describedby`, `aria-invalid`), `invalid`, `name`, `id`, `autoFocus`, `required`.
+ * The ref is the `<input>`, so it works with `@eifi1/ui-kit/rhf`'s `RhfField` / a
+ * `register()` spread, and controlled or uncontrolled.
+ *
+ * ```tsx
+ * <CurrentPasswordInput name="password" label={t("password")} error={errors.password?.message}
+ *   busy={isSubmitting} {...register("password")} />
+ * ```
+ */
+export declare function CurrentPasswordInput({ label, onValueChange, onChange, busy, readOnly, labels: labelsProp, ...rest }: CurrentPasswordInputProps): import("react").JSX.Element;
+/** The words {@link TypedConfirmField} says on its own behalf — the `dangerConfirm`
+ *  namespace's `phrase` and `phrasePlaceholder`, shared with DangerConfirm's own field,
+ *  so the sentence "Type “X” to confirm" is translated once. */
+export type TypedConfirmFieldLabels = Pick<DangerConfirmLabels, "phrase" | "phrasePlaceholder">;
+export interface TypedConfirmFieldProps extends Omit<InputProps, "type" | "value" | "defaultValue" | "label" | "placeholder"> {
+    /** The text to repeat — a word ("DELETE"), a name, an e-mail address. */
+    target: string;
+    /** How the typed text is compared with `target` — {@link TypedMatch}. Default
+     *  `"trim"`, as {@link typedMatches}; `"caseless"` for an address or an
+     *  acknowledgement word a user may type in any case. */
+    match?: TypedMatch;
+    /** Controlled value. Left out, the field keeps its own (start: `defaultValue`). */
+    value?: string;
+    defaultValue?: string;
+    /** The typed text as a string, on every keystroke. Fires alongside `onChange`. */
+    onValueChange?: (value: string) => void;
+    /**
+     * The typed text started or stopped matching `target` — fired from the keystroke
+     * that flipped it, so an uncontrolled field can still drive the button it guards. A
+     * controlled caller that resets the value itself (on a close) knows the answer
+     * already, and gets no call for that; it can also compute it with {@link typedMatches}.
+     */
+    onMatchedChange?: (matched: boolean) => void;
+    /** The label. Default `dangerConfirm.phrase(target)` — "Type “DELETE” to confirm". */
+    label?: ReactNode;
+    /** Text inside the empty field. Default `dangerConfirm.phrasePlaceholder` (unset).
+     *  Given, the label moves ABOVE the field: a floating label occupies the empty
+     *  field, which is exactly where a placeholder shows. `""` means none. */
+    placeholder?: string;
+    /** The guarded action is running: the field turns `readOnly` (not `disabled`, which
+     *  would drop the focus Enter left in it). */
+    busy?: boolean;
+    labels?: LabelOverride<TypedConfirmFieldLabels>;
+}
+/**
+ * The "type this to confirm" field — {@link DangerConfirm}'s `phrase` field and
+ * `useConfirm({ requireTyped })`'s, on its own (keksdose K7).
+ *
+ * keksdose writes it by hand four times: the privacy enrol, upgrade and sweep dialogs
+ * (type the acknowledgement word, then the key doors appear) and the admin's "type the
+ * user's address" (`UserActionConfirm`), each an `Input` plus its own
+ * `trim().toUpperCase()` / `toLowerCase()` comparison. None of those places is an
+ * arm → confirm tile or a modal confirm — what is guarded is a whole form, or the
+ * next step of a dialog — so the field had to stand alone. What it brings over a plain
+ * `Input`: one match rule ({@link typedMatches}, which lower-cases locale-independently
+ * on purpose), the label worded from the target in the app's language, and the
+ * attributes a phone keyboard needs to leave the text alone (no autocomplete, no
+ * auto-capital, no autocorrect, no spellcheck — a keyboard that "corrects" an e-mail
+ * address makes the guard unpassable).
+ *
+ * The field reports whether it matches (`onMatchedChange`, and `data-matched` on the
+ * `<input>` for styling); what the match unlocks is the caller's. The ref is the
+ * `<input>`.
+ *
+ * ```tsx
+ * const [ok, setOk] = useState(false);
+ * <TypedConfirmField target={t("privacy.enroll_ack_word")} match="caseless" onMatchedChange={setOk} />
+ * {ok && <KeyDoorsForm … />}
+ * ```
+ */
+export declare function TypedConfirmField({ ref, target, match, value: valueProp, defaultValue, onValueChange, onMatchedChange, onChange, label: labelProp, placeholder: placeholderProp, busy, readOnly, labels: labelsProp, id, className, ...rest }: TypedConfirmFieldProps): import("react").JSX.Element;
+/**
+ * Every string the tile renders — the `dangerConfirm` namespace of
+ * `<UiKitProvider labels>`, overridable per instance through `labels`. The arm and
+ * confirm buttons are usually worded per action ("Delete budget"), which is what the
+ * `armLabel` / `confirmLabel` props are for; these are the fallbacks.
+ */
+export interface DangerConfirmLabels {
+    /** The button that arms the tile. */
+    arm: string;
+    /** The button that runs the action once the guards are satisfied. */
+    confirm: string;
+    cancel: string;
+    /** The warning above the fields, when no `prompt` is given. */
+    prompt: string;
+    /** Label of the password field (`requirePassword`). */
+    password: string;
+    /** Label of the type-to-confirm field. A FUNCTION of the phrase by default, like
+     *  every message that carries a value: where the phrase sits in the sentence moves
+     *  with the language. A plain STRING is taken as the finished label — for an app
+     *  whose catalogue already words it ("Type DELETE to confirm") and would otherwise
+     *  wrap it as `() => label`. */
+    phrase: string | ((phrase: string) => string);
+    /** Placeholder of the type-to-confirm field — a string, or a function of the
+     *  phrase (`(p) => p` echoes it). Optional and unset by default: the field keeps its
+     *  floating label, as before. Given, the label moves ABOVE the field (a floating
+     *  label occupies the empty field, which is exactly where a placeholder shows) and
+     *  the placeholder fills the field. An empty string means none. */
+    phrasePlaceholder?: string | ((phrase: string) => string);
+    /** 0.22: the checkbox `requireAcknowledge={true}` shows — "I have read what this does
+     *  and want to continue" (keksdose's `admin.users.confirm_ack`). */
+    acknowledge: string;
+    /**
+     * 0.23: why the armed confirm is held while the typed phrase does not match yet — in
+     * the confirm's tooltip and its description (keksdose G4a). A FUNCTION of the phrase
+     * by default ("Type “DELETE” to confirm"), or a finished STRING, as `phrase`.
+     */
+    needsPhrase: string | ((phrase: string) => string);
+    /** 0.23: why the armed confirm is held while the `requireAcknowledge` box is unticked
+     *  — "Tick the box to confirm". */
+    needsAcknowledge: string;
+    /** 0.23: why the armed confirm is held while the `requirePassword` field is empty —
+     *  "Enter your password to confirm". */
+    needsPassword: string;
+}
+export { DEFAULT_DANGER_CONFIRM_LABELS };
+/**
+ * What the guards were answered with — the second argument of
+ * {@link DangerConfirmProps.onConfirm} (0.23, keksdose G4b). A key is there only when its
+ * guard was asked for, so the object can go into a request body as it is.
+ */
+export interface DangerConfirmValues {
+    /**
+     * The text typed into the `phrase` field — as the match rule compared it: trimmed
+     * under `phraseMatch` `"trim"` and `"caseless"` (the spaces a phone keyboard adds are
+     * not part of it), exactly as typed under `"exact"`. The case is the user's, even
+     * under `"caseless"`: a server that re-checks applies its own rule to it. Absent
+     * without a `phrase`.
+     */
+    typed?: string;
+    /** The entered password — the same value as the first argument. Absent without
+     *  `requirePassword`. */
+    password?: string;
+    /** `true` when the `requireAcknowledge` box was shown — it was ticked, since the
+     *  confirm is held until it is. Absent without one. */
+    acknowledged?: true;
+}
+/**
+ * One line of {@link DangerConfirmProps.consequences}: what the action will do. A plain
+ * string, or this, for a key of its own and the `severe` mark.
+ */
+export interface DangerConsequence {
+    /** React key — keksdose keys its lines by what they say ("api_tokens", "only_door").
+     *  Default: the text when it is a string, else the position. */
+    key?: string;
+    text: ReactNode;
+    /** "There is no way back" — painted in the danger colour rather than the list's
+     *  muted one. keksdose reserves it for the one line that loses something for good. */
+    severe?: boolean;
+}
+export interface DangerConfirmProps extends Omit<ComponentPropsWithRef<"div">, "onChange"> {
+    /**
+     * Runs the action, with the entered password when `requirePassword` is on.
+     *
+     * Return a promise and the tile manages itself: busy until it settles, disarmed
+     * (fields wiped) when it resolves, still armed when it rejects — so the user can
+     * correct a wrong password and retry. The rejection is not swallowed for you to
+     * miss: handle it (and show why) in the caller, as with any mutation.
+     *
+     * 0.23: the second argument is what every guard was answered with — the typed phrase,
+     * the password, the tick ({@link DangerConfirmValues}). keksdose G4b: its admin
+     * actions send the address the admin TYPED, and the server re-checks it against the
+     * account (`assert_confirmed`), so a client that put the wrong row's id in the request
+     * is refused rather than obeyed; the tile kept the text to itself.
+     *
+     *     onConfirm={(_password, { typed }) =>
+     *       reset.mutateAsync({ id, confirm: { acknowledged: true, confirm_email: typed ?? null } })}
+     *
+     * A second argument rather than one object in place of the password: every
+     * `(password) => …` and `() => …` handler, and a `mutation.mutate` passed as it is,
+     * keeps working unchanged, and a handler that needs one guard's answer names it.
+     */
+    onConfirm: (password: string | undefined, values: DangerConfirmValues) => void | Promise<unknown>;
+    /** Show a password field; confirm is held until it is filled. */
+    requirePassword?: boolean;
+    /**
+     * Show an "I understand" checkbox; confirm is held until it is ticked
+     * (keksdose K7). `true` words it with `labels.acknowledge`; any other node IS the
+     * checkbox's label ("I understand Anna will be signed out everywhere").
+     *
+     * The guard for an action whose risk is MIS-TARGETING less than carelessness:
+     * keksdose's admin password reset asks for a typed address when the account has an
+     * encrypted door to lose, and a tick otherwise (`UserActionConfirm`), and its plan
+     * editor asks for the tick alone (`UserPlanEditor`). Both were hand-built beside this
+     * tile because it had no tick. It combines with `phrase` and `requirePassword`: every
+     * guard given must be satisfied.
+     */
+    requireAcknowledge?: ReactNode;
+    /**
+     * What the action will do, said before it happens — a list under the prompt, shown
+     * once armed (keksdose K7, `UserActionConfirm`'s consequences). Strings, or
+     * {@link DangerConsequence}s for a `severe` line in the danger colour.
+     *
+     * Derive them from the row's own facts rather than reciting the worst case: an admin
+     * who reads the same paragraph on every row stops reading it (keksdose dev#488).
+     */
+    consequences?: readonly (string | DangerConsequence)[];
+    /** Show a "type <phrase> to confirm" field; confirm is held until the field matches
+     *  (case-sensitive; surrounding spaces ignored unless `phraseMatch="exact"`). */
+    phrase?: string;
+    /**
+     * How the typed text is compared with `phrase`. `"trim"` (default) ignores spaces
+     * around it — a phone keyboard's autocomplete likes to add one. `"exact"` compares
+     * character for character, spaces included, for an app whose contract is "type
+     * exactly this". `"caseless"` (0.18) also ignores case — for a phrase that is an
+     * e-mail address (keksdose's "type the user's address" admin rule). See
+     * {@link TypedMatch}.
+     */
+    phraseMatch?: TypedMatch;
+    /** The warning above the fields. Defaults to `labels.prompt`. */
+    prompt?: ReactNode;
+    /** `"danger"` (default) for what cannot be undone; `"warning"` for what can, at a
+     *  cost (loading demo data over your own). Colours the prompt, and picks the arm
+     *  button's variant and — unless {@link DangerConfirmProps.confirmVariant} is
+     *  given — the confirm's. */
+    tone?: "danger" | "warning";
+    /**
+     * The confirm button's variant, apart from `tone` (0.24, keksdose). Default: what
+     * `tone` picks, as before — `"danger"` for `"danger"`, `"primary"` for `"warning"`.
+     *
+     * `tone` says how bad the outcome is; this says how loud the last press is, and the two
+     * need not agree. keksdose's `UserActionConfirm` (an admin resets somebody else's
+     * password) asks an AMBER question — what it guards against is mis-targeting, not data
+     * loss, so the danger colour stays its one `severe` consequence's — and ends in a RED
+     * Go, as its hand-built panel did before it moved onto this tile in 0.23; with only
+     * `tone`, the amber question made Go the neutral primary fill. `tone="warning"
+     * confirmVariant="danger"` is that panel again.
+     */
+    confirmVariant?: ButtonVariant;
+    /**
+     * Hold the armed confirm for a reason of the CALLER's own (0.24, keksdose) — the
+     * tile's counterpart of FormActions' `submitDisabledReason`. While it has content the
+     * confirm is held exactly as by the built-in guards: `aria-disabled` but focusable,
+     * the reason in the kit {@link Tooltip} and its description, a press — or Enter in a
+     * field — does nothing. Nothing else changes: the arm button stays usable, and no
+     * line is printed under the buttons.
+     *
+     * keksdose's `UserPlanEditor` ("move this account onto another plan") must not confirm
+     * the plan the account already holds — the request would only write FREE → FREE into
+     * the audit trail. With no guard of its own to give, it passed "Pick a different plan"
+     * as `lockedReason`, which is a LOCK: documented as "the action is not available",
+     * spelled out under the buttons as well as in the tooltip, and meant for a write the
+     * user cannot make land. A guard the user lifts by changing a field is this prop.
+     *
+     * Which reason the held confirm names: a write lock's first (`lockedReason`, `commit`
+     * — nothing in the tile lifts it), then this one, then the built-in guards in the
+     * order they are drawn (the tick, the phrase, the password). This one before the
+     * built-ins because it is usually about a field in
+     * {@link DangerConfirmProps.children}, which is drawn ABOVE them — the rule since 0.23
+     * is "the first open guard in the order the user meets it" — and because it is about
+     * WHAT is being confirmed (which plan), which has to be settled before acknowledging
+     * it means anything. It is also the order keksdose's plan editor had, its
+     * `lockedReason` winning over the tick.
+     */
+    confirmDisabledReason?: ReactNode;
+    /**
+     * Fields of the caller's own, drawn INSIDE the armed tile (0.24, keksdose): after the
+     * prompt and the consequences, before the tick, the typed phrase and the password —
+     * the order is "what this does, what to do it with, then prove you mean it". Nothing
+     * is drawn for them while the tile is disarmed, and nothing at all without them, so a
+     * tile without children is laid out exactly as before.
+     *
+     * keksdose's `UserPlanEditor` asks WHICH plan before it asks for the tick; with no
+     * place inside the tile for the picker, the `Select` sat above it, and the tile's
+     * prompt — the panel's title by rights — became the "FREE → PRO" line under the
+     * picker. With the picker here, the prompt is the title again.
+     *
+     * The fields are the caller's: their values are not wiped on disarm (an uncontrolled
+     * field starts over anyway — the slot unmounts), not passed to `onConfirm`, and a
+     * guard on them is {@link DangerConfirmProps.confirmDisabledReason}. Arming moves
+     * focus to their first form field (an input, a select, a combobox, a radio…), else to
+     * the tile's own first field as before; Tab then goes on through the tick, the phrase
+     * and the password to Cancel and the confirm. They sit inside the tile's `<form>`:
+     * Enter in a text field confirms once every guard allows, and a {@link Button} among
+     * them needs `type="button"` — without one it SUBMITS the form, as a native button
+     * does.
+     */
+    children?: ReactNode;
+    /** Visible text of the arm button; defaults to `labels.arm`. */
+    armLabel?: ReactNode;
+    /** Visible text of the confirm button; defaults to `labels.confirm`. */
+    confirmLabel?: ReactNode;
+    /**
+     * The action is running: confirm shows a spinner and nothing can be pressed — Cancel
+     * included. For a caller that tracks the mutation itself (a `useMutation`'s
+     * `isPending`); a promise returned from `onConfirm` does the same on its own.
+     *
+     * Cancel stays disabled ON PURPOSE, unlike FormActions' (keksdose asked in 0.24 why the
+     * two differ). Once the request has left, nothing on the client can call it back —
+     * not even an `AbortSignal`, which only stops the waiting, not the server — so a usable
+     * Cancel could only collapse the tile while the action went on: "Cancel" pressed, and
+     * the account reset anyway. Every way of settling what comes back is wrong somewhere: a
+     * resolve after the Cancel did what the user called off; a reject finds the fields
+     * wiped (a collapsed tile holds no password), so the 0.23 "stay armed and retry" is
+     * gone; and re-arming while the first request runs is either a busy tile with empty
+     * fields or — if the busy state went with the Cancel — a second destructive request
+     * beside the first. FormActions' Cancel leaves an editor whose save is the user's own
+     * edit landing, and a form can be edited again; the tile's action is the one that
+     * cannot be undone, so it says nothing it cannot keep and waits — the wait is one
+     * request long.
+     *
+     * When the action settles still armed (it failed) and the press on the confirm had
+     * dropped the focus — a natively disabled button loses it — focus comes back to the
+     * confirm, so a keyboard user can retry or Shift+Tab to the field to correct (0.24).
+     */
+    busy?: boolean;
+    /** The arm button is disabled. */
+    disabled?: boolean;
+    /**
+     * Why the action is not available — a read-only demo, a write lock, a missing
+     * permission. Disables the arm button like `disabled`, and SAYS so: the sentence is
+     * shown under the button and attached to it with `aria-describedby`, and the button
+     * stays focusable (`aria-disabled`) so a keyboard user can land on it and hear why.
+     *
+     * On the ARM button rather than the confirm: arming asks for a password, and asking
+     * for a password for a write that can never land is the worse of the two. A tile that
+     * is ALREADY armed when the reason arrives (controlled `armed`, or a lock that landed
+     * while it was open) keeps its fields but its confirm takes the reason the same way
+     * — focusable, `aria-disabled`, the reason in its tooltip — and Enter does nothing.
+     */
+    lockedReason?: ReactNode;
+    /**
+     * This tile COMMITS — the 0.18 write-lock opt-in that {@link Button} has (keksdose
+     * K3). Under a locked {@link WriteLockProvider} the lock's reason becomes
+     * `lockedReason` (and wins over one of the tile's own), so a page that mounts the
+     * provider no longer threads `lockedReason={lock.locked ? lock.reason : undefined}`
+     * into every tile. No provider, or an unlocked one: no effect.
+     */
+    commit?: CommitScope;
+    /** Controlled armed state. The parent can then collapse the tile from a mutation's
+     *  own `onSuccess` without returning a promise. */
+    armed?: boolean;
+    /** Called with the next armed state — on arm, cancel, and a resolved `onConfirm`. */
+    onArmedChange?: (armed: boolean) => void;
+    /** User-facing strings; see {@link DangerConfirmLabels}. */
+    labels?: LabelOverride<DangerConfirmLabels>;
+}
+/**
+ * An "arm → confirm" tile for destructive actions: one button, which expands into a
+ * warning, an optional list of consequences, optional fields of the caller's own
+ * (`children`, 0.24), an optional "I understand" tick, an optional type-to-confirm
+ * field, an optional password field and a confirm that is held until every guard is
+ * satisfied — the built-in ones, and the caller's `confirmDisabledReason` (0.24).
+ *
+ * A held confirm SAYS which guard is still open (0.23, keksdose G4a): it is
+ * `aria-disabled` rather than `disabled` — still focusable, so a keyboard user can land
+ * on it — with the reason in the kit {@link Tooltip} and its description ("Type
+ * “DELETE” to confirm", "Tick the box to confirm", "Enter your password to confirm";
+ * `labels.needs*`), the first open guard in the order they are drawn. FormActions'
+ * `submitDisabledReason` does the same for a form's Save. Pressing it, or Enter in a
+ * field, does nothing. A lock's reason wins over a guard's, the caller's guard over the
+ * built-in ones; while the action runs the confirm is plainly disabled, its spinner
+ * saying why — and so is Cancel, which cannot call back a request that has left (see
+ * `busy`).
+ *
+ * Keksdose hand-rolled it three times (load demo data, wipe everything, reset a
+ * budget) and then as `shared/components/danger-confirm.tsx`; the only app-specific
+ * part was its write-lock hook, which is `lockedReason` here.
+ *
+ * The fields are a `<form>`, so Enter confirms once the guards allow it. They are
+ * wiped every time the tile disarms — a password must not sit in a collapsed tile.
+ * Arming moves focus to the first field (or Cancel, when there is none — never to the
+ * destructive button itself), and disarming moves it back to the arm button, so the
+ * keyboard user is never left on an element that just vanished.
+ */
+export declare function DangerConfirm({ onConfirm, requirePassword, requireAcknowledge, consequences, phrase, phraseMatch, prompt, tone, confirmVariant, confirmDisabledReason, children, armLabel, confirmLabel, busy: busyProp, disabled, lockedReason: ownLockedReason, commit, armed: armedProp, onArmedChange, labels: labelsProp, className, ...rest }: DangerConfirmProps): import("react").JSX.Element;