@eifi1/ui-kit 0.51.3 → 0.51.5

package/README.md

@@ -568,16 +568,16 @@ columns, strings and permissions (see the note at the top of `src/feedback/feedb
 
 <!-- BEGIN GENERATED: exports — node scripts/gen-export-inventory.mjs -->
 
-**2193 names from 363 modules** — 1014 values and 1179 types. _Italic_ is a type-only export.
+**2197 names from 363 modules** — 1017 values and 1180 types. _Italic_ is a type-only export.
 
 Generated from `dist/index.d.ts` by `node scripts/gen-export-inventory.mjs`; the count
 is pinned by `src/__tests__/public-surface.test.ts`. Do not edit between the markers.
 
 | Entry point | Names |
 |---|---|
-| `@eifi1/ui-kit` | 2193 |
+| `@eifi1/ui-kit` | 2197 |
 | `@eifi1/ui-kit/chart` | 100 |
-| `@eifi1/ui-kit/shell` | 119 |
+| `@eifi1/ui-kit/shell` | 120 |
 | `@eifi1/ui-kit/data-table` | 56 |
 | `@eifi1/ui-kit/wizard` | 25 |
 | `@eifi1/ui-kit/tour` | 49 |
@@ -608,7 +608,7 @@ re-slicing of it, never a second API.
 | `lib/format` | `currencyMinorDigits`, `EMPTY_FORMATTED_VALUE`, `formatDate`, `formatMoney`, `formatNumber`, `formatPercent`, `formatRelativeTime`, `roundToCurrency`, `toDate`, `useKitFormat`, _`DateInput`_, _`FormatDateOptions`_, _`FormatDateStyle`_, _`FormatDigits`_, _`FormatMoneyOptions`_, _`FormatNumberBaseOptions`_, _`FormatNumberOptions`_, _`FormatPercentOptions`_, _`FormatRelativeTimeOptions`_, _`FormattableNumber`_, _`KitFormat`_, _`RoundToCurrencyOptions`_ |
 | `lib/safe-storage` | `readStored`, `writeStored` |
 | `lib/download` | `filenameFromDisposition`, `saveBlob` |
-| `lib/text-match` | `foldForSearch`, `rankMatch`, _`MatchRank`_ |
+| `lib/text-match` | `foldForSearch`, `matchesSearch`, `rankMatch`, `searchWords`, _`MatchRank`_ |
 | `lib/qr-encode` | `encodeQr`, _`QrEncodeOptions`_, _`QrErrorCorrection`_, _`QrMatrix`_ |
 | `lib/server-wake` | `attachServerWake`, `createServerWake`, `serverWake`, `watchReadsAnd`, `wrapFetch`, _`AxiosLikeInstance`_, _`ServerWakeAxiosConfig`_, _`ServerWakeFilter`_, _`ServerWakeOptions`_, _`ServerWakeRequest`_, _`ServerWakeStage`_, _`ServerWakeWatcher`_ |
 | `lib/session-refresh` | `attachSessionRefresh`, `createSessionRefresh`, `isSignedOutStep`, `isTransientRefreshFailure`, _`SessionRefresh`_, _`SessionRefreshOptions`_, _`SessionRefreshOutcome`_, _`SessionRenewal`_ |
@@ -797,7 +797,7 @@ re-slicing of it, never a second API.
 | `components/text-link` | `TextLink`, _`TextLinkCurrent`_, _`TextLinkProps`_, _`TextLinkRenderProps`_, _`TextLinkTone`_, _`TextLinkUnderline`_ |
 | `components/toast` | `DEFAULT_TOAST_LABELS`, `toast`, `TOAST_ACTION_DURATION`, `Toaster`, `TOASTER_OFFSET_BOTTOM`, `TOASTER_OFFSET_TOP`, _`ToastAction`_, _`ToasterOffset`_, _`ToasterProps`_, _`ToastId`_, _`ToastLabels`_, _`ToastOptions`_, _`ToastPosition`_, _`ToastPromiseOptions`_, _`ToastRedoOptions`_, _`ToastSwipeDirection`_, _`ToastUndoOptions`_ |
 | `components/translation-review` | `TranslationReviewPanel`, _`TranslationReviewGroupBy`_, _`TranslationReviewOrigin`_, _`TranslationReviewPanelProps`_, _`TranslationReviewSaveInfo`_ |
-| `components/legal` | `DEFAULT_LEGAL_LABELS`, `LEGAL_HREFS`, `LegalFooter`, `LegalLayout`, `LegalLinks`, `legalOperatorText`, `LegalSection`, `useLegalLabels`, _`LegalDisclaimerSectionLabels`_, _`LegalFooterProps`_, _`LegalFramedSectionLabels`_, _`LegalLabels`_, _`LegalLayoutProps`_, _`LegalLink`_, _`LegalLinksProps`_, _`LegalOperator`_, _`LegalOperatorSectionLabels`_, _`LegalOperatorText`_, _`LegalPageKey`_, _`LegalSectionProps`_, _`LegalTextSectionLabels`_ |
+| `components/legal` | `DEFAULT_LEGAL_LABELS`, `LEGAL_HREFS`, `LegalFooter`, `LegalLayout`, `LegalLinks`, `legalOperatorText`, `LegalSection`, `useLegalLabels`, _`LegalDisclaimerSectionLabels`_, _`LegalFooterProps`_, _`LegalFramedSectionLabels`_, _`LegalInfoPageKey`_, _`LegalLabels`_, _`LegalLayoutProps`_, _`LegalLink`_, _`LegalLinksProps`_, _`LegalOperator`_, _`LegalOperatorSectionLabels`_, _`LegalOperatorText`_, _`LegalPageKey`_, _`LegalSectionProps`_, _`LegalTextSectionLabels`_ |
 | `components/legal-page` | `LEGAL_SKELETON`, `LegalAcceptCheckbox`, `LegalKitSection`, `LegalPage`, _`LegalAcceptCheckboxProps`_, _`LegalDisclaimerVariant`_, _`LegalKitSectionKey`_, _`LegalKitSectionProps`_, _`LegalPageProps`_, _`LegalSectionOwner`_, _`LegalSkeletonEntry`_, _`LegalSkeletonPage`_ |
 | `components/appearance-labels` | `DEFAULT_APPEARANCE_LABELS`, `useAppearanceLabels`, _`AppearanceLabels`_ |
 | `components/date-format-setting` | `DateFormatSetting`, _`DateFormatSettingProps`_ |
@@ -865,7 +865,7 @@ re-slicing of it, never a second API.
 |---|---|
 | `settings/settings-layout` | `SETTINGS_SEARCH_THRESHOLD`, `SettingsLayout`, _`SettingsDocumentTitleParts`_, _`SettingsLayoutProps`_, _`SettingsLayoutWidth`_ |
 | `settings/use-settings-route` | `resolveSettingsLocation`, `SETTINGS_FROM_LIST_STATE`, `settingsFromListState`, `useSettingsRoute`, _`SettingsLayoutMode`_, _`SettingsLocation`_, _`SettingsLocationResult`_, _`SettingsLocationRules`_, _`SettingsRoute`_, _`UseSettingsRouteOptions`_ |
-| `settings/use-settings-focus` | `SETTINGS_FOCUS_MS`, `SETTINGS_FOCUS_RING`, `useSettingsFocus` |
+| `settings/use-settings-focus` | `SETTINGS_FOCUS_MS`, `SETTINGS_FOCUS_RING`, `useFocusParam`, `useSettingsFocus` |
 | `settings/settings-section` | `SettingsSection`, _`SettingsSectionProps`_ |
 | `settings/settings-context` | `useSettingsLayout`, _`SettingsLayoutContextValue`_ |
 | `settings/settings-heading` | `SettingsHeadingLevel`, `useSettingsHeadingLevel`, _`SettingsHeadingLevelProps`_, _`SettingsHeadingTag`_ |

package/dist/account/account-settings-labels.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/account/account-settings-labels.ts"],"sourcesContent":["import { useMemo } from \"react\";\nimport { useKitLabelOverrides } from \"../i18n/kit-labels\";\n\n/**\n * The `accountSettings` namespace of `<UiKitProvider labels>`: one record per section —\n * `profile`, `password`, `twoFactor`, `passkeys` — each merged key by key, so an app\n * can translate `accountSettings.twoFactor.scanHint` alone.\n *\n * Before 0.12.0 every section took a REQUIRED `labels` prop and had no English of its\n * own, so each app spelled out 30-odd keys at the call site and still hard-coded some\n * (kastlan's profile page passed `email: \"Email\"` in English to a German page). The\n * prop stays, now partial, and wins over the provider as everywhere else in the kit.\n *\n * Its own module, beside the components rather than in them, so `PasskeysSetting`\n * (its own file) and the older three read one tree without importing each other.\n */\n\nexport interface ProfileSettingLabels {\n  title: string;\n  email: string;\n  role: string;\n  memberSince: string;\n  /** The single name field — the card without `firstName` / `lastName`. */\n  displayName: string;\n  save: string;\n  /**\n   * 0.30.0 (docs/user-admin-harmonization.md §6.1): the two fields that replace\n   * `displayName` once the card is given `firstName` / `lastName`. OPTIONAL, like\n   * `TwoFactorSettingLabels.qrAlt` and for its reason — this interface is annotated at\n   * call sites — and filled from the provider's `accountSettings.profile`, then English.\n   */\n  firstName?: string;\n  lastName?: string;\n  /** Why Save is held while a name is blank: both are required (§3.1). */\n  nameRequired?: string;\n}\n\nexport interface PasswordSettingLabels {\n  title: string;\n  current: string;\n  next: string;\n  confirm: string;\n  submit: string;\n  tooShort: string;\n  mismatch: string;\n  /**\n   * 0.34 (KS U3): `password_incorrect` — server-kit's `400` for a wrong current\n   * password — under the current-password field, in the words `EmailChangeSetting`\n   * and `DeleteAccountSetting` say it with. OPTIONAL, like\n   * `TwoFactorSettingLabels.qrAlt` and for its reason — this interface is annotated at\n   * call sites — and filled from the provider's `accountSettings.password`, then English.\n   */\n  wrongPassword?: string;\n}\n\nexport interface TwoFactorSettingLabels {\n  /**\n   * Before 0.31 the card's one line, \"<status>: On\". Since 0.31 the setting's name is the\n   * card's {@link title} and the state stands beside it, so this is read only where no\n   * `title` is given at the same level — an app that translated `status` keeps its word\n   * as the title.\n   */\n  status: string;\n  enabledText: string;\n  disabledText: string;\n  enable: string;\n  scanHint: string;\n  codeLabel: string;\n  verify: string;\n  disableSection: string;\n  password: string;\n  disable: string;\n  /**\n   * Alt text for the setup QR code, which shipped as a hardcoded `alt=\"QR\"`.\n   *\n   * OPTIONAL, like the two keys below, and not because it matters less: this interface\n   * is annotated at consumer call sites (`const LABELS: TwoFactorSettingLabels = {…}`),\n   * so a new REQUIRED key is a compile error in every app on the next `npm update` —\n   * the additive-API rule in the README. Each falls back to the provider's\n   * `accountSettings.twoFactor`, then English.\n   */\n  qrAlt?: string;\n  /** The line over the manual-entry key, for a phone that cannot scan its own screen. */\n  secretHint?: string;\n  /** The copy button beside that key. */\n  copySecret?: string;\n  /**\n   * 0.31.0 (docs/settings-harmonization.md §3.7): the card's title, a heading inside a\n   * `SettingsLayout`. OPTIONAL for the reason `qrAlt` is. Unset, the same source's\n   * `status` stands in for it, then English.\n   */\n  title?: string;\n}\n\nexport interface PasskeysSettingLabels {\n  title: string;\n  /** The line under the title saying what a passkey is for — `mode=\"instead\"` (the\n   *  default): the passkey stands in for the password. */\n  description: string;\n  /**\n   * The same line for `mode=\"alongside\"` (0.18.0): the password keeps working and the\n   * passkey is a second way in. OPTIONAL for the reason `TwoFactorSettingLabels.qrAlt`\n   * is — this interface is annotated at call sites — and filled from the provider's\n   * `accountSettings.passkeys`, then English.\n   */\n  descriptionAlongside?: string;\n  empty: string;\n  loading: string;\n  /** Accessible name of the list. */\n  list: string;\n  nameLabel: string;\n  namePlaceholder: string;\n  add: string;\n  /** The add button while the app's WebAuthn ceremony runs — the OS prompt is open. */\n  adding: string;\n  rename: string;\n  /** The row's rename button, named for its passkey — it starts with `rename`, the\n   *  visible text, so voice control finds it by what it says. */\n  renameItem: (name: string) => string;\n  /** Accessible name of the inline rename field. */\n  renameField: (name: string) => string;\n  save: string;\n  cancel: string;\n  delete: string;\n  /** The row's delete button, named for its passkey (see `renameItem`). */\n  deleteItem: (name: string) => string;\n  /** The inline question a delete asks first. */\n  deleteConfirm: (name: string) => string;\n  /** The destructive button that answers it. */\n  confirmDelete: string;\n  /** `date` arrives formatted in the provider's locale. */\n  created: (date: string) => string;\n  lastUsed: (date: string) => string;\n  neverUsed: string;\n}\n\nexport interface AccountSettingsLabels {\n  profile: Required<ProfileSettingLabels>;\n  password: Required<PasswordSettingLabels>;\n  // `Required` here, optional on the section interfaces: the namespace is what a full\n  // catalogue (`@eifi1/ui-kit/i18n/<code>`, `missingKitLabels`) is written against, so\n  // it must name the late keys; the section interfaces are annotated at call sites.\n  twoFactor: Required<TwoFactorSettingLabels>;\n  passkeys: Required<PasskeysSettingLabels>;\n}\n\nexport const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels = {\n  profile: {\n    title: \"Profile\",\n    email: \"Email\",\n    role: \"Role\",\n    memberSince: \"Member since\",\n    displayName: \"Display name\",\n    save: \"Save\",\n    firstName: \"First name\",\n    lastName: \"Last name\",\n    nameRequired: \"Enter both a first and a last name.\",\n  },\n  password: {\n    title: \"Change password\",\n    current: \"Current password\",\n    next: \"New password\",\n    confirm: \"Confirm new password\",\n    submit: \"Change password\",\n    tooShort: \"The new password is too short.\",\n    mismatch: \"The passwords don’t match.\",\n    // The siblings' sentence (emailChange, deleteAccount), under the current password.\n    wrongPassword: \"The password is incorrect.\",\n  },\n  twoFactor: {\n    status: \"Two-factor authentication\",\n    enabledText: \"On\",\n    disabledText: \"Off\",\n    enable: \"Set up two-factor authentication\",\n    scanHint: \"Scan this code with your authenticator app, then enter the code it shows.\",\n    codeLabel: \"Verification code\",\n    verify: \"Verify and turn on\",\n    disableSection: \"Turn off two-factor authentication\",\n    password: \"Current password\",\n    disable: \"Turn off\",\n    // Unchanged from the fallback it had before the namespace (i18n-labels.test pins it).\n    qrAlt: \"QR code\",\n    secretHint: \"Can’t scan it? Enter this key in the app instead:\",\n    copySecret: \"Copy key\",\n    title: \"Two-factor authentication\",\n  },\n  passkeys: {\n    title: \"Passkeys\",\n    description: \"Sign in with your fingerprint, face or device PIN instead of a password.\",\n    // Kurvenschmiede overrode `description` because \"instead of\" is false where the\n    // password stays; this is the sentence for those apps, picked by `mode`.\n    descriptionAlongside: \"Sign in with your fingerprint, face or device PIN. Your password keeps working too.\",\n    empty: \"No passkeys yet\",\n    loading: \"Loading passkeys…\",\n    list: \"Your passkeys\",\n    nameLabel: \"Name (optional)\",\n    namePlaceholder: \"e.g. Laptop, Phone\",\n    add: \"Add passkey\",\n    adding: \"Waiting for your device…\",\n    rename: \"Rename\",\n    renameItem: (name) => `Rename ${name}`,\n    renameField: (name) => `New name for ${name}`,\n    save: \"Save\",\n    cancel: \"Cancel\",\n    delete: \"Delete\",\n    deleteItem: (name) => `Delete ${name}`,\n    deleteConfirm: (name) => `Delete “${name}”? It can no longer be used to sign in.`,\n    confirmDelete: \"Delete passkey\",\n    created: (date) => `Added ${date}`,\n    lastUsed: (date) => `Last used ${date}`,\n    neverUsed: \"Never used\",\n  },\n};\n\n/**\n * One section of the namespace, resolved: English, then the provider's\n * `accountSettings.<section>`, then the component's own `labels` prop. An `undefined`\n * in either source is skipped, so a prop object built from optional values cannot\n * blank out a default.\n */\nexport function useAccountSettingsLabels<K extends keyof AccountSettingsLabels>(\n  section: K,\n  prop?: Partial<AccountSettingsLabels[K]>,\n): AccountSettingsLabels[K] {\n  const fromProvider = useKitLabelOverrides(\"accountSettings\")?.[section] as\n    | Partial<AccountSettingsLabels[K]>\n    | undefined;\n  return useMemo(\n    () => ({\n      ...DEFAULT_ACCOUNT_SETTINGS_LABELS[section],\n      ...definedOnly(fromProvider),\n      ...definedOnly(prop),\n    }),\n    [section, fromProvider, prop],\n  );\n}\n\nfunction definedOnly<T extends object>(value: T | undefined): Partial<T> {\n  if (!value) return {};\n  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined)) as Partial<T>;\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,4BAA4B;AAiJ9B,MAAM,kCAAyD;AAAA,EACpE,SAAS;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,MAAM;AAAA,IACN,aAAa;AAAA,IACb,aAAa;AAAA,IACb,MAAM;AAAA,IACN,WAAW;AAAA,IACX,UAAU;AAAA,IACV,cAAc;AAAA,EAChB;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,UAAU;AAAA;AAAA,IAEV,eAAe;AAAA,EACjB;AAAA,EACA,WAAW;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,IAET,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,OAAO;AAAA,EACT;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,aAAa;AAAA;AAAA;AAAA,IAGb,sBAAsB;AAAA,IACtB,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,iBAAiB;AAAA,IACjB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,YAAY,CAAC,SAAS,UAAU,IAAI;AAAA,IACpC,aAAa,CAAC,SAAS,gBAAgB,IAAI;AAAA,IAC3C,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,YAAY,CAAC,SAAS,UAAU,IAAI;AAAA,IACpC,eAAe,CAAC,SAAS,gBAAW,IAAI;AAAA,IACxC,eAAe;AAAA,IACf,SAAS,CAAC,SAAS,SAAS,IAAI;AAAA,IAChC,UAAU,CAAC,SAAS,aAAa,IAAI;AAAA,IACrC,WAAW;AAAA,EACb;AACF;AAQO,SAAS,yBACd,SACA,MAC0B;AAC1B,QAAM,eAAe,qBAAqB,iBAAiB,IAAI,OAAO;AAGtE,SAAO;AAAA,IACL,OAAO;AAAA,MACL,GAAG,gCAAgC,OAAO;AAAA,MAC1C,GAAG,YAAY,YAAY;AAAA,MAC3B,GAAG,YAAY,IAAI;AAAA,IACrB;AAAA,IACA,CAAC,SAAS,cAAc,IAAI;AAAA,EAC9B;AACF;AAEA,SAAS,YAA8B,OAAkC;AACvE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,MAAM,MAAS,CAAC;AACpF;","names":[]}
+{"version":3,"sources":["../../src/account/account-settings-labels.ts"],"sourcesContent":["import { useMemo } from \"react\";\nimport { useKitLabelOverrides } from \"../i18n/kit-labels\";\n\n/**\n * The `accountSettings` namespace of `<UiKitProvider labels>`: one record per section —\n * `profile`, `password`, `twoFactor`, `passkeys` — each merged key by key, so an app\n * can translate `accountSettings.twoFactor.scanHint` alone.\n *\n * Before 0.12.0 every section took a REQUIRED `labels` prop and had no English of its\n * own, so each app spelled out 30-odd keys at the call site and still hard-coded some\n * (kastlan's profile page passed `email: \"Email\"` in English to a German page). The\n * prop stays, now partial, and wins over the provider as everywhere else in the kit.\n *\n * Its own module, beside the components rather than in them, so `PasskeysSetting`\n * (its own file) and the older three read one tree without importing each other.\n */\n\nexport interface ProfileSettingLabels {\n  title: string;\n  email: string;\n  role: string;\n  memberSince: string;\n  /** The single name field — the card without `firstName` / `lastName`. */\n  displayName: string;\n  save: string;\n  /**\n   * 0.30.0 (docs/user-admin-harmonization.md §6.1): the two fields that replace\n   * `displayName` once the card is given `firstName` / `lastName`. OPTIONAL, like\n   * `TwoFactorSettingLabels.qrAlt` and for its reason — this interface is annotated at\n   * call sites — and filled from the provider's `accountSettings.profile`, then English.\n   */\n  firstName?: string;\n  lastName?: string;\n  /** Why Save is held while a name is blank: both are required (§3.1). */\n  nameRequired?: string;\n}\n\nexport interface PasswordSettingLabels {\n  title: string;\n  current: string;\n  next: string;\n  confirm: string;\n  submit: string;\n  tooShort: string;\n  mismatch: string;\n  /**\n   * 0.34 (KS U3): `password_incorrect` — server-kit's `400` for a wrong current\n   * password — under the current-password field, in the words `EmailChangeSetting`\n   * and `DeleteAccountSetting` say it with. OPTIONAL, like\n   * `TwoFactorSettingLabels.qrAlt` and for its reason — this interface is annotated at\n   * call sites — and filled from the provider's `accountSettings.password`, then English.\n   */\n  wrongPassword?: string;\n}\n\nexport interface TwoFactorSettingLabels {\n  /**\n   * Before 0.31 the card's one line, \"<status>: On\". Since 0.31 the setting's name is the\n   * card's {@link title} and the state stands beside it, so this is read only where no\n   * `title` is given at the same level — an app that translated `status` keeps its word\n   * as the title.\n   */\n  status: string;\n  enabledText: string;\n  disabledText: string;\n  enable: string;\n  scanHint: string;\n  codeLabel: string;\n  verify: string;\n  disableSection: string;\n  password: string;\n  disable: string;\n  /**\n   * Alt text for the setup QR code, which shipped as a hardcoded `alt=\"QR\"`.\n   *\n   * OPTIONAL, like the two keys below, and not because it matters less: this interface\n   * is annotated at consumer call sites (`const LABELS: TwoFactorSettingLabels = {…}`),\n   * so a new REQUIRED key is a compile error in every app on the next `npm update` —\n   * the additive-API rule in the README. Each falls back to the provider's\n   * `accountSettings.twoFactor`, then English.\n   */\n  qrAlt?: string;\n  /** The line over the manual-entry key, for a phone that cannot scan its own screen. */\n  secretHint?: string;\n  /** The copy button beside that key. */\n  copySecret?: string;\n  /**\n   * 0.31.0 (docs/settings-harmonization.md §3.7): the card's title, a heading inside a\n   * `SettingsLayout`. OPTIONAL for the reason `qrAlt` is. Unset, the same source's\n   * `status` stands in for it, then English.\n   */\n  title?: string;\n}\n\nexport interface PasskeysSettingLabels {\n  title: string;\n  /** The line under the title saying what a passkey is for — `mode=\"instead\"` (the\n   *  default): the passkey stands in for the password. */\n  description: string;\n  /**\n   * The same line for `mode=\"alongside\"` (0.18.0): the password keeps working and the\n   * passkey is a second way in. OPTIONAL for the reason `TwoFactorSettingLabels.qrAlt`\n   * is — this interface is annotated at call sites — and filled from the provider's\n   * `accountSettings.passkeys`, then English.\n   */\n  descriptionAlongside?: string;\n  empty: string;\n  loading: string;\n  /** Accessible name of the list. */\n  list: string;\n  nameLabel: string;\n  namePlaceholder: string;\n  add: string;\n  /** The add button while the app's WebAuthn ceremony runs — the OS prompt is open. */\n  adding: string;\n  rename: string;\n  /** The row's rename button, named for its passkey — it starts with `rename`, the\n   *  visible text, so voice control finds it by what it says. */\n  renameItem: (name: string) => string;\n  /** Accessible name of the inline rename field. */\n  renameField: (name: string) => string;\n  save: string;\n  cancel: string;\n  delete: string;\n  /** The row's delete button, named for its passkey (see `renameItem`). */\n  deleteItem: (name: string) => string;\n  /** The inline question a delete asks first. */\n  deleteConfirm: (name: string) => string;\n  /** The destructive button that answers it. */\n  confirmDelete: string;\n  /** `date` arrives formatted in the provider's locale. */\n  created: (date: string) => string;\n  lastUsed: (date: string) => string;\n  neverUsed: string;\n}\n\nexport interface AccountSettingsLabels {\n  profile: Required<ProfileSettingLabels>;\n  password: Required<PasswordSettingLabels>;\n  // `Required` here, optional on the section interfaces: the namespace is what a full\n  // catalogue (`@eifi1/ui-kit/i18n/<code>`, `missingKitLabels`) is written against, so\n  // it must name the late keys; the section interfaces are annotated at call sites.\n  twoFactor: Required<TwoFactorSettingLabels>;\n  passkeys: Required<PasskeysSettingLabels>;\n}\n\nexport const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels = {\n  profile: {\n    title: \"Profile\",\n    email: \"Email\",\n    role: \"Role\",\n    memberSince: \"Member since\",\n    displayName: \"Display name\",\n    save: \"Save\",\n    firstName: \"First name\",\n    lastName: \"Last name\",\n    nameRequired: \"Enter both a first and a last name.\",\n  },\n  password: {\n    title: \"Change password\",\n    current: \"Current password\",\n    next: \"New password\",\n    confirm: \"Confirm new password\",\n    submit: \"Change password\",\n    tooShort: \"The new password is too short.\",\n    mismatch: \"The passwords don’t match.\",\n    // The siblings' sentence (emailChange, deleteAccount), under the current password.\n    wrongPassword: \"The password is incorrect.\",\n  },\n  twoFactor: {\n    status: \"Two-factor authentication\",\n    enabledText: \"On\",\n    disabledText: \"Off\",\n    enable: \"Set up two-factor authentication\",\n    scanHint: \"Scan this code with your authenticator app, then enter the code it shows.\",\n    codeLabel: \"Verification code\",\n    verify: \"Verify and turn on\",\n    disableSection: \"Turn off two-factor authentication\",\n    password: \"Current password\",\n    disable: \"Turn off\",\n    // Unchanged from the fallback it had before the namespace (i18n-labels.test pins it).\n    qrAlt: \"QR code\",\n    secretHint: \"Can’t scan it? Enter this key in the app instead:\",\n    copySecret: \"Copy key\",\n    title: \"Two-factor authentication\",\n  },\n  passkeys: {\n    title: \"Passkeys\",\n    description: \"Sign in with your fingerprint, face or device PIN instead of a password.\",\n    // Kurvenschmiede overrode `description` because \"instead of\" is false where the\n    // password stays; this is the sentence for those apps, picked by `mode`.\n    descriptionAlongside: \"Sign in with your fingerprint, face or device PIN. Your password keeps working too.\",\n    empty: \"No passkeys yet\",\n    loading: \"Loading passkeys…\",\n    list: \"Your passkeys\",\n    nameLabel: \"Name (optional)\",\n    namePlaceholder: \"e.g. Laptop, Phone\",\n    add: \"Add passkey\",\n    adding: \"Waiting for your device…\",\n    rename: \"Rename\",\n    renameItem: (name) => `Rename ${name}`,\n    renameField: (name) => `New name for ${name}`,\n    save: \"Save\",\n    cancel: \"Cancel\",\n    delete: \"Delete\",\n    deleteItem: (name) => `Delete ${name}`,\n    deleteConfirm: (name) => `Delete “${name}”? It can no longer be used to sign in.`,\n    confirmDelete: \"Delete passkey\",\n    created: (date) => `Added ${date}`,\n    lastUsed: (date) => `Last used ${date}`,\n    neverUsed: \"Never used\",\n  },\n};\n\n/**\n * One section of the namespace, resolved: English, then the provider's\n * `accountSettings.<section>`, then the component's own `labels` prop. An `undefined`\n * in either source is skipped, so a prop object built from optional values cannot\n * blank out a default.\n */\nexport function useAccountSettingsLabels<K extends keyof AccountSettingsLabels>(\n  section: K,\n  prop?: Partial<AccountSettingsLabels[K]>,\n): AccountSettingsLabels[K] {\n  const fromProvider = useKitLabelOverrides(\"accountSettings\")?.[section] as\n    Partial<AccountSettingsLabels[K]> | undefined;\n  return useMemo(\n    () => ({\n      ...DEFAULT_ACCOUNT_SETTINGS_LABELS[section],\n      ...definedOnly(fromProvider),\n      ...definedOnly(prop),\n    }),\n    [section, fromProvider, prop],\n  );\n}\n\nfunction definedOnly<T extends object>(value: T | undefined): Partial<T> {\n  if (!value) return {};\n  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined)) as Partial<T>;\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,4BAA4B;AAiJ9B,MAAM,kCAAyD;AAAA,EACpE,SAAS;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,MAAM;AAAA,IACN,aAAa;AAAA,IACb,aAAa;AAAA,IACb,MAAM;AAAA,IACN,WAAW;AAAA,IACX,UAAU;AAAA,IACV,cAAc;AAAA,EAChB;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,UAAU;AAAA;AAAA,IAEV,eAAe;AAAA,EACjB;AAAA,EACA,WAAW;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,IAET,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,OAAO;AAAA,EACT;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,aAAa;AAAA;AAAA;AAAA,IAGb,sBAAsB;AAAA,IACtB,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,iBAAiB;AAAA,IACjB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,YAAY,CAAC,SAAS,UAAU,IAAI;AAAA,IACpC,aAAa,CAAC,SAAS,gBAAgB,IAAI;AAAA,IAC3C,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,YAAY,CAAC,SAAS,UAAU,IAAI;AAAA,IACpC,eAAe,CAAC,SAAS,gBAAW,IAAI;AAAA,IACxC,eAAe;AAAA,IACf,SAAS,CAAC,SAAS,SAAS,IAAI;AAAA,IAChC,UAAU,CAAC,SAAS,aAAa,IAAI;AAAA,IACrC,WAAW;AAAA,EACb;AACF;AAQO,SAAS,yBACd,SACA,MAC0B;AAC1B,QAAM,eAAe,qBAAqB,iBAAiB,IAAI,OAAO;AAEtE,SAAO;AAAA,IACL,OAAO;AAAA,MACL,GAAG,gCAAgC,OAAO;AAAA,MAC1C,GAAG,YAAY,YAAY;AAAA,MAC3B,GAAG,YAAY,IAAI;AAAA,IACrB;AAAA,IACA,CAAC,SAAS,cAAc,IAAI;AAAA,EAC9B;AACF;AAEA,SAAS,YAA8B,OAAkC;AACvE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,MAAM,MAAS,CAAC;AACpF;","names":[]}

package/dist/account/account-settings.js

@@ -340,14 +340,7 @@ function TwoFactorSetting({
       "otpauthUri" in setup ? (
         // No backing of its own: QrCode draws its quiet zone white inside the SVG.
         /* @__PURE__ */ jsx("div", { "data-private": true, className: "inline-block overflow-hidden rounded-md", children: renderQr ? renderQr(setup.otpauthUri) : /* @__PURE__ */ jsx(QrCode, { value: setup.otpauthUri, label: labels.qrAlt, className: "size-48" }) })
-      ) : /* @__PURE__ */ jsx("div", { "data-private": true, className: "inline-block rounded-md bg-white p-2", children: /* @__PURE__ */ jsx(
-        "img",
-        {
-          alt: labels.qrAlt,
-          src: `data:image/svg+xml;base64,${setup.qrSvg}`,
-          className: "h-48 w-48"
-        }
-      ) }),
+      ) : /* @__PURE__ */ jsx("div", { "data-private": true, className: "inline-block rounded-md bg-white p-2", children: /* @__PURE__ */ jsx("img", { alt: labels.qrAlt, src: `data:image/svg+xml;base64,${setup.qrSvg}`, className: "h-48 w-48" }) }),
       secret && /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
         /* @__PURE__ */ jsx("div", { className: "text-xs text-secondary", children: labels.secretHint }),
         /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-1", children: [
@@ -375,7 +368,16 @@ function TwoFactorSetting({
     ] }),
     enabled && /* @__PURE__ */ jsxs("div", { className: "space-y-3 border-t border-subtle pt-3", children: [
       /* @__PURE__ */ jsx("div", { className: "text-sm font-medium", children: labels.disableSection }),
-      /* @__PURE__ */ jsx(Input, { type: "password", autoComplete: "current-password", label: labels.password, value: password, onChange: (e) => setPassword(e.target.value) }),
+      /* @__PURE__ */ jsx(
+        Input,
+        {
+          type: "password",
+          autoComplete: "current-password",
+          label: labels.password,
+          value: password,
+          onChange: (e) => setPassword(e.target.value)
+        }
+      ),
       /* @__PURE__ */ jsx(
         OneTimeCodeInput,
         {

package/dist/account/account-settings.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/account/account-settings.tsx"],"sourcesContent":["import { useId, useRef, useState } from \"react\";\nimport type { ChangeEvent, FormEvent, KeyboardEvent, ReactNode, RefObject } from \"react\";\nimport { Button } from \"../components/button\";\nimport { Card } from \"../components/card\";\nimport { Input } from \"../components/input\";\nimport { UserAvatar } from \"../components/user-avatar\";\nimport { CopyButton } from \"../components/copy-button\";\nimport { QrCode } from \"../components/qr-code\";\nimport { OneTimeCodeInput } from \"../components/one-time-code-input\";\nimport { usePromisePending } from \"../components/danger-confirm\";\nimport { personNameOk, PERSON_NAME_MAX_LENGTH } from \"../auth/form-rules\";\nimport {\n  DEFAULT_PASSWORD_STRENGTH_LABELS,\n  passwordByteLength,\n  PasswordStrengthMeter,\n} from \"../components/password-strength\";\nimport type { PasswordStrengthMeterProps } from \"../components/password-strength\";\nimport { useKitLabelOverrides, useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { Chip } from \"../components/chip\";\nimport { useAccountSettingsLabels } from \"./account-settings-labels\";\nimport { SettingsCardTitle } from \"../settings/settings-heading\";\nimport type {\n  PasswordSettingLabels,\n  ProfileSettingLabels,\n  TwoFactorSettingLabels,\n} from \"./account-settings-labels\";\nimport { COMMIT_EXCEPT_BILLING } from \"../components/write-lock\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { hasContent } from \"../lib/presence\";\nimport { authErrorCode } from \"../auth/auth-errors\";\n\n// The label types moved beside the namespace's defaults (0.12.0); re-exported here so\n// every existing `import type { ProfileSettingLabels }` keeps resolving.\nexport type {\n  AccountSettingsLabels,\n  PasskeysSettingLabels,\n  PasswordSettingLabels,\n  ProfileSettingLabels,\n  TwoFactorSettingLabels,\n} from \"./account-settings-labels\";\nexport { DEFAULT_ACCOUNT_SETTINGS_LABELS } from \"./account-settings-labels\";\n\n/**\n * App-agnostic account-settings SECTIONS (feedback #333). The presentation lives\n * in @hb/ui; each app injects its own auth-API handlers + translated labels and\n * arranges these next to its own app-specific cards (appearance, budgets, …).\n * Every section is a self-contained <Card> owning its transient form state.\n *\n * Every `labels` prop is optional since 0.12.0: the strings come from the provider's\n * `accountSettings` namespace, then English (see account-settings-labels.ts).\n */\n\n/** What {@link ProfileSetting} hands `onSave` in its two-field form (0.30.0): both\n *  trimmed, 1–120 characters each — the `PATCH /auth/me` body's `first_name` /\n *  `last_name` (docs/user-admin-harmonization.md §6.1). */\nexport interface ProfileNameValues {\n  firstName: string;\n  lastName: string;\n}\n\n/** What both forms of {@link ProfileSetting} take. */\ninterface ProfileSettingCommonProps {\n  name?: string | null;\n  email?: string | null;\n  role?: ReactNode;\n  memberSince?: ReactNode;\n  saving?: boolean;\n  /** Prop > `<UiKitProvider labels={{ accountSettings: { profile } }}>` > English. */\n  labels?: LabelOverride<ProfileSettingLabels>;\n  /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */\n  id?: string;\n}\n\n/**\n * The single display name, as before 0.30.0 — controlled through `value` / `onChange`,\n * saved by `onSave()`. Kept unchanged for an app that has not moved to first and last\n * name yet.\n */\nexport interface ProfileSettingDisplayNameProps extends ProfileSettingCommonProps {\n  value: string;\n  onChange: (value: string) => void;\n  onSave: () => void;\n  firstName?: undefined;\n  lastName?: undefined;\n}\n\n/**\n * First and last name (0.30.0, docs/user-admin-harmonization.md §6.1): the saved\n * values in, the edited ones out through `onSave`. The card keeps the drafts itself.\n */\nexport interface ProfileSettingNamesProps extends ProfileSettingCommonProps {\n  /** The saved given name — `first_name`. `null` reads as empty. */\n  firstName: string | null;\n  /** The saved family name — `last_name`. `null` (a migrated account, §3.3) reads as\n   *  empty, and Save then waits for one. */\n  lastName: string | null;\n  /**\n   * Save the two names (`PATCH /auth/me`, which also clears `name_incomplete`). Return\n   * a promise and Save is busy until it settles. Refresh `firstName` / `lastName` from\n   * the answer: the card compares its drafts with them, so Save turns off once the new\n   * names come back. A rejection keeps what was typed — the app says why (a toast), as\n   * for `PasswordSetting`.\n   */\n  onSave: (values: ProfileNameValues) => void | Promise<unknown>;\n  value?: undefined;\n  onChange?: undefined;\n}\n\nexport type ProfileSettingProps = ProfileSettingDisplayNameProps | ProfileSettingNamesProps;\n\n/**\n * The profile section: avatar, address, role, member since, and the name.\n *\n * **Two forms.** Given `firstName` / `lastName` (0.30.0, §6.1) it edits first and last\n * name in two fields, side by side where the card is wide enough — the order and the\n * 1–120-character rule of `RegisterForm` (auth §3.1), so the name a person signed up\n * with is edited the way it was typed. Without them it is the single `displayName`\n * field it always was, `value` / `onChange` / `onSave()` unchanged, for an app that has\n * not moved yet (kastlan split the one name at its first space on save; Kurvenschmiede\n * built its own card instead).\n *\n * The two-field form owns its drafts, starting from the saved names and following them\n * when they change; Save waits for a change, holds — saying why — while a name is\n * blank, and is a `commit` (a {@link WriteLockProvider} locks it, keksdose's demo) —\n * every lock but a lapsed plan's (`COMMIT_EXCEPT_BILLING`, 0.33): a profile is the\n * account's own settings, which billing never locks (docs/billing-harmonization.md §3.3,\n * §12.36).\n */\nexport function ProfileSetting(props: ProfileSettingProps) {\n  const { name, email, role, memberSince, labels: labelsProp, id } = props;\n  const labels = useAccountSettingsLabels(\"profile\", labelsProp);\n  const names = props.firstName !== undefined || props.lastName !== undefined;\n  return (\n    <Card id={id} className=\"p-4 space-y-3\">\n      <div className=\"flex items-center gap-3\">\n        <UserAvatar\n          name={name}\n          email={email}\n          person={names ? { first: props.firstName, last: props.lastName } : undefined}\n          size=\"lg\"\n        />\n        <div className=\"min-w-0\">\n          {/* A heading inside a SettingsLayout (0.31, docs/settings-harmonization.md\n              §3.7), the plain div it always was outside one. */}\n          <SettingsCardTitle>{labels.title}</SettingsCardTitle>\n          <div className=\"truncate-until-large font-mono text-xs text-muted\">\n            {/* `email` was a required key that nothing rendered; it names the address\n                for a screen reader, which otherwise hears a bare string under a title. */}\n            <span className=\"sr-only\">{labels.email}: </span>\n            {email ?? \"—\"}\n          </div>\n        </div>\n      </div>\n      <div className=\"grid grid-cols-[max-content_1fr] gap-x-3 gap-y-1 text-sm\">\n        <span className=\"text-muted\">{labels.role}</span>\n        <span>{role ?? \"—\"}</span>\n        <span className=\"text-muted\">{labels.memberSince}</span>\n        <span>{memberSince ?? \"—\"}</span>\n      </div>\n      {names ? (\n        <PersonNameFields\n          firstName={props.firstName ?? \"\"}\n          lastName={props.lastName ?? \"\"}\n          onSave={(props as ProfileSettingNamesProps).onSave}\n          saving={props.saving}\n          labels={labels}\n        />\n      ) : (\n        <DisplayNameField\n          name={name}\n          value={(props as ProfileSettingDisplayNameProps).value}\n          onChange={(props as ProfileSettingDisplayNameProps).onChange}\n          onSave={(props as ProfileSettingDisplayNameProps).onSave}\n          saving={props.saving}\n          labels={labels}\n        />\n      )}\n    </Card>\n  );\n}\n\n/** The single-name form — exactly the 0.29 card's field and button. */\nfunction DisplayNameField({\n  name,\n  value,\n  onChange,\n  onSave,\n  saving,\n  labels,\n}: {\n  name?: string | null;\n  value: string;\n  onChange: (value: string) => void;\n  onSave: () => void;\n  saving?: boolean;\n  labels: Required<ProfileSettingLabels>;\n}) {\n  const dirty = value.trim().length > 0 && value.trim() !== (name ?? \"\");\n  // Generated, not the literal \"display-name\" it was: two of these on one page (an\n  // admin editing someone else's profile beside their own) shared an id, and the\n  // second label pointed at the first field.\n  const inputId = useId();\n  return (\n    <>\n      <Input\n        id={inputId}\n        label={labels.displayName}\n        value={value}\n        onChange={(e) => onChange(e.target.value)}\n        maxLength={120}\n      />\n      <Button onClick={onSave} disabled={!dirty || saving}>\n        {labels.save}\n      </Button>\n    </>\n  );\n}\n\n/** The first-and-last form (0.30.0, §6.1). */\nfunction PersonNameFields({\n  firstName,\n  lastName,\n  onSave,\n  saving,\n  labels,\n}: {\n  firstName: string;\n  lastName: string;\n  onSave: (values: ProfileNameValues) => void | Promise<unknown>;\n  saving?: boolean;\n  labels: Required<ProfileSettingLabels>;\n}) {\n  const [first, setFirst] = useState(firstName);\n  const [last, setLast] = useState(lastName);\n  // The saved names moved (the save came back, another tab renamed): the drafts follow\n  // them. During render, as DangerConfirm resets its fields, so no frame shows the old\n  // draft beside the new name.\n  const [saved, setSaved] = useState({ firstName, lastName });\n  if (saved.firstName !== firstName || saved.lastName !== lastName) {\n    setSaved({ firstName, lastName });\n    setFirst(firstName);\n    setLast(lastName);\n  }\n  const { pending, run } = usePromisePending();\n  const busy = Boolean(saving) || pending;\n  const valid = personNameOk(first) && personNameOk(last);\n  const dirty = first.trim() !== firstName.trim() || last.trim() !== lastName.trim();\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    if (!valid || !dirty || busy) return;\n    // A rejection keeps the drafts; the app reports it, as PasswordSetting's does.\n    run(onSave({ firstName: first.trim(), lastName: last.trim() }), () => {});\n  };\n\n  return (\n    <form className=\"@container space-y-3\" onSubmit={submit} noValidate>\n      {/* The order and the rule of RegisterForm's two fields (auth §3.1). */}\n      <div className=\"grid gap-3 @xs:grid-cols-2\">\n        <Input\n          name=\"given-name\"\n          autoComplete=\"given-name\"\n          label={labels.firstName}\n          value={first}\n          onChange={(e) => setFirst(e.target.value)}\n          maxLength={PERSON_NAME_MAX_LENGTH}\n          readOnly={busy}\n          required\n        />\n        <Input\n          name=\"family-name\"\n          autoComplete=\"family-name\"\n          label={labels.lastName}\n          value={last}\n          onChange={(e) => setLast(e.target.value)}\n          maxLength={PERSON_NAME_MAX_LENGTH}\n          readOnly={busy}\n          required\n        />\n      </div>\n      <Button\n        type=\"submit\"\n        commit={COMMIT_EXCEPT_BILLING}\n        pending={busy}\n        // A blank name is a reason the person can act on; an unchanged one is not —\n        // there is nothing to save, and the button is simply off.\n        disabled={valid && !dirty}\n        disabledReason={valid ? undefined : labels.nameRequired}\n      >\n        {labels.save}\n      </Button>\n    </form>\n  );\n}\n\n/**\n * What {@link PasswordSetting}'s `strength` takes besides `true`: the meter's own options,\n * minus the ones the card owns — `value` (the new password), `minLength` (the card's, so\n * the checklist's length rule and the submit's check are one number) and `maxBytes`\n * (the card's own prop, which the submit enforces as well).\n */\nexport type PasswordSettingStrength = Pick<PasswordStrengthMeterProps, \"score\" | \"showRequirements\" | \"labels\">;\n\n/**\n * Changing the account's password: the current one, the new one twice, then the app's\n * `onSubmit`.\n *\n * **Refusals under their fields** (0.34, KS U3). The card's own checks say why under the\n * field they are about — too short or too long under the new password, a mismatch under\n * the confirmation — and a server's `password_incorrect` (server-kit's `400` for a wrong\n * current password; an older `invalid_credentials` too) is read from `onSubmit`'s\n * rejection by code ({@link authErrorCode}) and said under the current password, in\n * `EmailChangeSetting`'s and `DeleteAccountSetting`'s words. The field in error takes\n * the focus, so its message is read with it. Until 0.34 the card swallowed every\n * rejection and each app toasted the wrong password itself, in three spellings.\n *\n * **Anything else** is the app's: `describeError` puts its words in the card (a banner\n * over the button), and without it the card shows nothing — the app's own toast, as\n * before. The fields keep what was typed for a retry; a resolved `onSubmit` empties\n * them.\n */\nexport function PasswordSetting({\n  onSubmit,\n  pending,\n  minLength = 8,\n  strength,\n  maxBytes,\n  describeError,\n  labels: labelsProp,\n  id,\n}: {\n  /**\n   * Called with the validated (current, new) pair; return a promise to auto-clear on\n   * success. Reject with the client's error: `password_incorrect` is said under the\n   * current password; anything else goes through `describeError`, else stays the app's\n   * to say (a toast).\n   */\n  onSubmit: (currentPassword: string, newPassword: string) => void | Promise<unknown>;\n  pending?: boolean;\n  /** The shortest new password the card submits, in characters as a person counts them\n   *  (an emoji is one). Keep it in step with the server's own minimum. Default 8. */\n  minLength?: number;\n  /**\n   * Show the {@link PasswordStrengthMeter} under the new-password field (0.22.0,\n   * kastlan's input audit): the bar, the level in words and the checklist, with the\n   * length rule drawn from `minLength`. `true` for the meter as it comes; an object for\n   * its `score` (zxcvbn's, say), `showRequirements` or `labels`.\n   *\n   * Off by default, so a card that never asked for it does not grow one. The meter is\n   * advisory, as everywhere in the kit: it blocks nothing — the card's own checks do\n   * (`minLength`, the confirmation, `maxBytes`).\n   */\n  strength?: boolean | PasswordSettingStrength;\n  /**\n   * A byte ceiling on the new password — bcrypt reads at most 72 BYTES and ignores the\n   * rest, which is kastlan's case: `maxBytes={72}`. A new password over it is refused\n   * on submit with the meter's own \"too long\" sentence (the `passwordStrength`\n   * namespace's `tooLong`), and the meter, when shown, warns while it is typed.\n   *\n   * Unset by default, and leave it unset for a secret with no ceiling: an invented one\n   * talks people out of the long passphrase they chose.\n   */\n  maxBytes?: number;\n  /**\n   * The app's own words for a failure of `onSubmit`, said IN the card (a banner over the\n   * button), or `undefined` for the kit's handling. Asked first, for every failure — as\n   * `EmailChangeSetting`'s and `DeleteAccountSetting`'s are (0.34, KS U3): a demo's\n   * refusal, the device offline, a `422` whose sentence the app has. Without it, or when\n   * it answers `undefined`, the card says `password_incorrect` under the current password\n   * and nothing else: the rest stays the app's own toast.\n   */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** Prop > `<UiKitProvider labels={{ accountSettings: { password } }}>` > English. */\n  labels?: LabelOverride<PasswordSettingLabels>;\n  /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */\n  id?: string;\n}) {\n  const labels = useAccountSettingsLabels(\"password\", labelsProp);\n  const strengthOptions = typeof strength === \"object\" ? strength : undefined;\n  // Only for `tooLong`: the sentence the meter shows is the one the refusal says.\n  const strengthLabels = useKitLabels(\"passwordStrength\", DEFAULT_PASSWORD_STRENGTH_LABELS, strengthOptions?.labels);\n  const [current, setCurrent] = useState(\"\");\n  const [next, setNext] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  // One refusal at a time, under the field it is about; the app's words in the banner.\n  const [fieldError, setFieldError] = useState<{ field: PasswordField; message: string } | null>(null);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const currentRef = useRef<HTMLInputElement>(null);\n  const nextRef = useRef<HTMLInputElement>(null);\n  const confirmRef = useRef<HTMLInputElement>(null);\n  const refs: Record<PasswordField, RefObject<HTMLInputElement | null>> = {\n    current: currentRef,\n    next: nextRef,\n    confirm: confirmRef,\n  };\n\n  // The field in error takes the focus, so its message (its description) is read with it.\n  const refuse = (field: PasswordField, message: string) => {\n    setFieldError({ field, message });\n    refs[field].current?.focus();\n  };\n  const errorOf = (field: PasswordField) => (fieldError?.field === field ? fieldError.message : undefined);\n  // Typing in a field answers its refusal, and the banner's: both go.\n  const edit = (field: PasswordField, set: (value: string) => void) => (e: ChangeEvent<HTMLInputElement>) => {\n    set(e.target.value);\n    if (fieldError?.field === field) setFieldError(null);\n    if (failure !== null) setFailure(null);\n  };\n\n  const present = (error: unknown) => {\n    const own = describeError?.(error);\n    if (hasContent(own)) {\n      setFailure(own);\n      return;\n    }\n    const code = authErrorCode(error);\n    // `invalid_credentials` too, for a server that answered a wrong password so before\n    // server-kit 0.4.0 named `password_incorrect` — the siblings' rule.\n    if (code === \"password_incorrect\" || code === \"invalid_credentials\") {\n      refuse(\"current\", labels.wrongPassword);\n    }\n    // Anything else is the app's to say (a toast), as before 0.34.\n  };\n\n  const submit = async () => {\n    setFailure(null);\n    // Code points, not UTF-16 units — the count the meter's checklist and a server's\n    // `len()` use. `next.length` counted an emoji as two, so four of them passed a\n    // minimum of eight that the meter beside the field said they missed.\n    if ([...next].length < minLength) {\n      refuse(\"next\", labels.tooShort);\n      return;\n    }\n    if (maxBytes !== undefined && passwordByteLength(next) > maxBytes) {\n      refuse(\"next\", strengthLabels.tooLong(maxBytes));\n      return;\n    }\n    if (next !== confirm) {\n      refuse(\"confirm\", labels.mismatch);\n      return;\n    }\n    setFieldError(null);\n    try {\n      await onSubmit(current, next);\n      setCurrent(\"\");\n      setNext(\"\");\n      setConfirm(\"\");\n    } catch (error) {\n      // Keep the fields for a retry, and say what the card can.\n      present(error);\n    }\n  };\n\n  // `error` passed on all three from the first render, so a message coming and going\n  // never remounts a field and takes the caret with it (Input's `FieldGroup`).\n  const nextField = (\n    <Input\n      ref={nextRef}\n      type=\"password\"\n      autoComplete=\"new-password\"\n      label={labels.next}\n      value={next}\n      onChange={edit(\"next\", setNext)}\n      error={errorOf(\"next\")}\n    />\n  );\n\n  return (\n    <Card id={id} className=\"p-4 space-y-3\">\n      <SettingsCardTitle>{labels.title}</SettingsCardTitle>\n      <Input\n        ref={currentRef}\n        type=\"password\"\n        autoComplete=\"current-password\"\n        label={labels.current}\n        value={current}\n        onChange={edit(\"current\", setCurrent)}\n        error={errorOf(\"current\")}\n      />\n      {strength ? (\n        // One box for the field and its meter, so the card's `space-y-3` spaces the pair\n        // from its neighbours and the meter keeps its own small gap under the field.\n        <div>\n          {nextField}\n          <PasswordStrengthMeter\n            value={next}\n            minLength={minLength}\n            maxBytes={maxBytes}\n            score={strengthOptions?.score}\n            showRequirements={strengthOptions?.showRequirements}\n            labels={strengthOptions?.labels}\n          />\n        </div>\n      ) : (\n        nextField\n      )}\n      <Input\n        ref={confirmRef}\n        type=\"password\"\n        autoComplete=\"new-password\"\n        label={labels.confirm}\n        value={confirm}\n        onChange={edit(\"confirm\", setConfirm)}\n        error={errorOf(\"confirm\")}\n      />\n      {hasContent(failure) && (\n        <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n          {failure}\n        </AlertBanner>\n      )}\n      <Button onClick={() => void submit()} disabled={!current || !next || !confirm || pending}>\n        {labels.submit}\n      </Button>\n    </Card>\n  );\n}\n\n/** The three fields of {@link PasswordSetting}, for the refusal that names one. */\ntype PasswordField = \"current\" | \"next\" | \"confirm\";\n\n/**\n * What the app's setup call returned.\n *\n * `otpauthUri` (0.12.0) is what an authenticator backend actually hands out; the kit\n * draws the QR code itself ({@link QrCode}) and reads the manual-entry key out of the\n * URI's `secret` parameter when `secret` is not given. The `qrSvg` shape — a\n * base64-encoded SVG image — is what the section took before, which made every app\n * render a QR library to a static string and base64 it only for the kit to draw it back.\n */\nexport type TwoFactorSetupData =\n  | { qrSvg: string; secret: string }\n  | { otpauthUri: string; secret?: string };\n\n/** The `secret` parameter of an `otpauth://` URI, or null. */\nfunction otpauthSecret(uri: string): string | null {\n  const match = /[?&]secret=([^&#]*)/i.exec(uri);\n  if (!match) return null;\n  try {\n    return decodeURIComponent(match[1]) || null;\n  } catch {\n    return match[1] || null;\n  }\n}\n\n/** \"JBSW Y3DP EHPK 3PXP\": the key in groups of four, which is how an authenticator's\n *  manual-entry screen shows it and how a person copies it by eye. */\nfunction groupSecret(secret: string): string {\n  return secret.replace(/\\s+/g, \"\").replace(/(.{4})(?=.)/g, \"$1 \");\n}\n\nexport function TwoFactorSetting({\n  enabled,\n  setup,\n  onStartSetup,\n  onEnable,\n  onDisable,\n  busy,\n  renderQr,\n  labels: labelsProp,\n  id,\n}: {\n  enabled: boolean;\n  /** What the app's setup call returned; null before setup starts. */\n  setup: TwoFactorSetupData | null;\n  onStartSetup: () => void;\n  onEnable: (code: string) => void;\n  onDisable: (password: string, code: string) => void;\n  busy?: boolean;\n  /** Draw the code yourself (a branded QR, a library you already ship). Given the\n   *  `otpauthUri`; the kit's own {@link QrCode} otherwise. Unused with `qrSvg`. */\n  renderQr?: (otpauthUri: string) => ReactNode;\n  /** Prop > `<UiKitProvider labels={{ accountSettings: { twoFactor } }}>` > English. */\n  labels?: LabelOverride<TwoFactorSettingLabels>;\n  /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */\n  id?: string;\n}) {\n  const labels = useAccountSettingsLabels(\"twoFactor\", labelsProp);\n  // The title (0.31, docs/settings-harmonization.md §3.7) is new, and an app that\n  // translated this card before it named the setting in `status` — \"2FA\",\n  // \"Zwei-Faktor-Authentifizierung\". Each source's `title` first, then its `status`, so\n  // that app keeps its own word instead of meeting the English title.\n  const overrides = useKitLabelOverrides(\"accountSettings\")?.twoFactor;\n  const title = labelsProp?.title ?? overrides?.title ?? labelsProp?.status ?? overrides?.status ?? labels.title;\n  const [code, setCode] = useState(\"\");\n  const [password, setPassword] = useState(\"\");\n  // Both code fields are a OneTimeCodeInput (0.22.0) — the field this card wrote by hand\n  // twice — and keep what they did:\n  //  - `readOnlyUntilFocus`: browsers autofill a one-time-code field with the saved\n  //    username (the disable form has a current-password field right above it), and a\n  //    read-only field is never autofilled. The guard drops on focus, and the field\n  //    keeps the look of an editable one meanwhile (FIELD_WRITABLE_LOOK) — see the prop.\n  //  - `length={8}`: the `maxLength={8}` they had, so an authenticator issuing eight\n  //    digits still fits. What changed is that they now take digits only: \"123 456\"\n  //    pasted from an authenticator that groups its digits used to reach `onEnable`\n  //    with the space in it.\n  //  - one `code` state for both, as before.\n  const secret = setup\n    ? (setup.secret ?? (\"otpauthUri\" in setup ? otpauthSecret(setup.otpauthUri) : null))\n    : null;\n\n  return (\n    <Card id={id} className=\"p-4 space-y-3\">\n      {/* The card had only \"Two-factor authentication: Off\". A settings page outlines its\n          cards by their titles (§3.7), so the setting's name is the title now, and the\n          state stands beside it as a chip instead of repeating the name. */}\n      <div className=\"flex flex-wrap items-center justify-between gap-2\">\n        <SettingsCardTitle>{title}</SettingsCardTitle>\n        <Chip size=\"sm\" tone={enabled ? \"success\" : \"neutral\"}>\n          {enabled ? labels.enabledText : labels.disabledText}\n        </Chip>\n      </div>\n\n      {!enabled && !setup && (\n        <Button onClick={onStartSetup} disabled={busy}>\n          {labels.enable}\n        </Button>\n      )}\n\n      {setup && (\n        <div className=\"space-y-2\">\n          <div className=\"text-xs text-secondary\">{labels.scanHint}</div>\n          {/* `bg-white`, NOT `--bg-surface`, and it must stay that way: a QR code is\n              read by a camera looking for maximum contrast between the modules and\n              their quiet zone. On the dark theme a surface-coloured backing makes it\n              slow to acquire, and on a warm light preset it lowers the contrast ratio\n              the spec is written against. This is the one place in the kit where a\n              literal colour is the correct answer. `data-private`: the code IS the\n              second factor, and demo mode blurs it like any other secret. */}\n          {\"otpauthUri\" in setup ? (\n            // No backing of its own: QrCode draws its quiet zone white inside the SVG.\n            <div data-private className=\"inline-block overflow-hidden rounded-md\">\n              {renderQr ? (\n                renderQr(setup.otpauthUri)\n              ) : (\n                <QrCode value={setup.otpauthUri} label={labels.qrAlt} className=\"size-48\" />\n              )}\n            </div>\n          ) : (\n            <div data-private className=\"inline-block rounded-md bg-white p-2\">\n              <img\n                alt={labels.qrAlt}\n                src={`data:image/svg+xml;base64,${setup.qrSvg}`}\n                className=\"h-48 w-48\"\n              />\n            </div>\n          )}\n          {secret && (\n            <div className=\"space-y-1\">\n              <div className=\"text-xs text-secondary\">{labels.secretHint}</div>\n              <div className=\"flex items-center gap-1\">\n                {/* `dir=\"ltr\"`: a base32 key is Latin letters and digits in a fixed\n                    order, and in an RTL page the groups would otherwise be laid out\n                    right to left. */}\n                <code data-private dir=\"ltr\" className=\"break-all font-mono text-xs select-all\">\n                  {groupSecret(secret)}\n                </code>\n                <CopyButton text={secret} label={labels.copySecret} size=\"xs\" tone=\"muted\" />\n              </div>\n            </div>\n          )}\n          <OneTimeCodeInput\n            readOnlyUntilFocus\n            length={8}\n            label={labels.codeLabel}\n            value={code}\n            onChange={setCode}\n            onKeyDown={(e: KeyboardEvent<HTMLInputElement>) => {\n              if (e.key === \"Enter\" && code && !busy) {\n                e.preventDefault();\n                onEnable(code);\n              }\n            }}\n          />\n          <Button onClick={() => onEnable(code)} disabled={!code || busy}>\n            {labels.verify}\n          </Button>\n        </div>\n      )}\n\n      {enabled && (\n        <div className=\"space-y-3 border-t border-subtle pt-3\">\n          <div className=\"text-sm font-medium\">{labels.disableSection}</div>\n          <Input type=\"password\" autoComplete=\"current-password\" label={labels.password} value={password} onChange={(e) => setPassword(e.target.value)} />\n          <OneTimeCodeInput\n            readOnlyUntilFocus\n            length={8}\n            label={labels.codeLabel}\n            value={code}\n            onChange={setCode}\n            onKeyDown={(e: KeyboardEvent<HTMLInputElement>) => {\n              if (e.key === \"Enter\" && password && code && !busy) {\n                e.preventDefault();\n                onDisable(password, code);\n              }\n            }}\n          />\n          <Button variant=\"danger\" onClick={() => onDisable(password, code)} disabled={!password || !code || busy}>\n            {labels.disable}\n          </Button>\n        </div>\n      )}\n    </Card>\n  );\n}\n"],"mappings":";AAuIQ,SAoEJ,UApEI,KAaI,YAbJ;AAvIR,SAAS,OAAO,QAAQ,gBAAgB;AAExC,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,cAAc,8BAA8B;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,sBAAsB,oBAAwC;AACvE,SAAS,YAAY;AACrB,SAAS,gCAAgC;AACzC,SAAS,yBAAyB;AAMlC,SAAS,6BAA6B;AACtC,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAW9B,SAAS,uCAAuC;AAwFzC,SAAS,eAAe,OAA4B;AACzD,QAAM,EAAE,MAAM,OAAO,MAAM,aAAa,QAAQ,YAAY,GAAG,IAAI;AACnE,QAAM,SAAS,yBAAyB,WAAW,UAAU;AAC7D,QAAM,QAAQ,MAAM,cAAc,UAAa,MAAM,aAAa;AAClE,SACE,qBAAC,QAAK,IAAQ,WAAU,iBACtB;AAAA,yBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA;AAAA,UACA,QAAQ,QAAQ,EAAE,OAAO,MAAM,WAAW,MAAM,MAAM,SAAS,IAAI;AAAA,UACnE,MAAK;AAAA;AAAA,MACP;AAAA,MACA,qBAAC,SAAI,WAAU,WAGb;AAAA,4BAAC,qBAAmB,iBAAO,OAAM;AAAA,QACjC,qBAAC,SAAI,WAAU,qDAGb;AAAA,+BAAC,UAAK,WAAU,WAAW;AAAA,mBAAO;AAAA,YAAM;AAAA,aAAE;AAAA,UACzC,SAAS;AAAA,WACZ;AAAA,SACF;AAAA,OACF;AAAA,IACA,qBAAC,SAAI,WAAU,4DACb;AAAA,0BAAC,UAAK,WAAU,cAAc,iBAAO,MAAK;AAAA,MAC1C,oBAAC,UAAM,kBAAQ,UAAI;AAAA,MACnB,oBAAC,UAAK,WAAU,cAAc,iBAAO,aAAY;AAAA,MACjD,oBAAC,UAAM,yBAAe,UAAI;AAAA,OAC5B;AAAA,IACC,QACC;AAAA,MAAC;AAAA;AAAA,QACC,WAAW,MAAM,aAAa;AAAA,QAC9B,UAAU,MAAM,YAAY;AAAA,QAC5B,QAAS,MAAmC;AAAA,QAC5C,QAAQ,MAAM;AAAA,QACd;AAAA;AAAA,IACF,IAEA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,OAAQ,MAAyC;AAAA,QACjD,UAAW,MAAyC;AAAA,QACpD,QAAS,MAAyC;AAAA,QAClD,QAAQ,MAAM;AAAA,QACd;AAAA;AAAA,IACF;AAAA,KAEJ;AAEJ;AAGA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOG;AACD,QAAM,QAAQ,MAAM,KAAK,EAAE,SAAS,KAAK,MAAM,KAAK,OAAO,QAAQ;AAInE,QAAM,UAAU,MAAM;AACtB,SACE,iCACE;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,IAAI;AAAA,QACJ,OAAO,OAAO;AAAA,QACd;AAAA,QACA,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,QACxC,WAAW;AAAA;AAAA,IACb;AAAA,IACA,oBAAC,UAAO,SAAS,QAAQ,UAAU,CAAC,SAAS,QAC1C,iBAAO,MACV;AAAA,KACF;AAEJ;AAGA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,SAAS;AAC5C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,QAAQ;AAIzC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE,WAAW,SAAS,CAAC;AAC1D,MAAI,MAAM,cAAc,aAAa,MAAM,aAAa,UAAU;AAChE,aAAS,EAAE,WAAW,SAAS,CAAC;AAChC,aAAS,SAAS;AAClB,YAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,EAAE,SAAS,IAAI,IAAI,kBAAkB;AAC3C,QAAM,OAAO,QAAQ,MAAM,KAAK;AAChC,QAAM,QAAQ,aAAa,KAAK,KAAK,aAAa,IAAI;AACtD,QAAM,QAAQ,MAAM,KAAK,MAAM,UAAU,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS,KAAK;AAEjF,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,QAAI,CAAC,SAAS,CAAC,SAAS,KAAM;AAE9B,QAAI,OAAO,EAAE,WAAW,MAAM,KAAK,GAAG,UAAU,KAAK,KAAK,EAAE,CAAC,GAAG,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1E;AAEA,SACE,qBAAC,UAAK,WAAU,wBAAuB,UAAU,QAAQ,YAAU,MAEjE;AAAA,yBAAC,SAAI,WAAU,8BACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,UACxC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK;AAAA,UACvC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,OACF;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,QAAQ;AAAA,QACR,SAAS;AAAA,QAGT,UAAU,SAAS,CAAC;AAAA,QACpB,gBAAgB,QAAQ,SAAY,OAAO;AAAA,QAE1C,iBAAO;AAAA;AAAA,IACV;AAAA,KACF;AAEJ;AA4BO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AACF,GA8CG;AACD,QAAM,SAAS,yBAAyB,YAAY,UAAU;AAC9D,QAAM,kBAAkB,OAAO,aAAa,WAAW,WAAW;AAElE,QAAM,iBAAiB,aAAa,oBAAoB,kCAAkC,iBAAiB,MAAM;AACjH,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,EAAE;AACnC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AAEzC,QAAM,CAAC,YAAY,aAAa,IAAI,SAA2D,IAAI;AACnG,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,aAAa,OAAyB,IAAI;AAChD,QAAM,UAAU,OAAyB,IAAI;AAC7C,QAAM,aAAa,OAAyB,IAAI;AAChD,QAAM,OAAkE;AAAA,IACtE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAGA,QAAM,SAAS,CAAC,OAAsB,YAAoB;AACxD,kBAAc,EAAE,OAAO,QAAQ,CAAC;AAChC,SAAK,KAAK,EAAE,SAAS,MAAM;AAAA,EAC7B;AACA,QAAM,UAAU,CAAC,UAA0B,YAAY,UAAU,QAAQ,WAAW,UAAU;AAE9F,QAAM,OAAO,CAAC,OAAsB,QAAiC,CAAC,MAAqC;AACzG,QAAI,EAAE,OAAO,KAAK;AAClB,QAAI,YAAY,UAAU,MAAO,eAAc,IAAI;AACnD,QAAI,YAAY,KAAM,YAAW,IAAI;AAAA,EACvC;AAEA,QAAM,UAAU,CAAC,UAAmB;AAClC,UAAM,MAAM,gBAAgB,KAAK;AACjC,QAAI,WAAW,GAAG,GAAG;AACnB,iBAAW,GAAG;AACd;AAAA,IACF;AACA,UAAM,OAAO,cAAc,KAAK;AAGhC,QAAI,SAAS,wBAAwB,SAAS,uBAAuB;AACnE,aAAO,WAAW,OAAO,aAAa;AAAA,IACxC;AAAA,EAEF;AAEA,QAAM,SAAS,YAAY;AACzB,eAAW,IAAI;AAIf,QAAI,CAAC,GAAG,IAAI,EAAE,SAAS,WAAW;AAChC,aAAO,QAAQ,OAAO,QAAQ;AAC9B;AAAA,IACF;AACA,QAAI,aAAa,UAAa,mBAAmB,IAAI,IAAI,UAAU;AACjE,aAAO,QAAQ,eAAe,QAAQ,QAAQ,CAAC;AAC/C;AAAA,IACF;AACA,QAAI,SAAS,SAAS;AACpB,aAAO,WAAW,OAAO,QAAQ;AACjC;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,SAAS,SAAS,IAAI;AAC5B,iBAAW,EAAE;AACb,cAAQ,EAAE;AACV,iBAAW,EAAE;AAAA,IACf,SAAS,OAAO;AAEd,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAIA,QAAM,YACJ;AAAA,IAAC;AAAA;AAAA,MACC,KAAK;AAAA,MACL,MAAK;AAAA,MACL,cAAa;AAAA,MACb,OAAO,OAAO;AAAA,MACd,OAAO;AAAA,MACP,UAAU,KAAK,QAAQ,OAAO;AAAA,MAC9B,OAAO,QAAQ,MAAM;AAAA;AAAA,EACvB;AAGF,SACE,qBAAC,QAAK,IAAQ,WAAU,iBACtB;AAAA,wBAAC,qBAAmB,iBAAO,OAAM;AAAA,IACjC;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,MAAK;AAAA,QACL,cAAa;AAAA,QACb,OAAO,OAAO;AAAA,QACd,OAAO;AAAA,QACP,UAAU,KAAK,WAAW,UAAU;AAAA,QACpC,OAAO,QAAQ,SAAS;AAAA;AAAA,IAC1B;AAAA,IACC;AAAA;AAAA;AAAA,MAGC,qBAAC,SACE;AAAA;AAAA,QACD;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,YACP;AAAA,YACA;AAAA,YACA,OAAO,iBAAiB;AAAA,YACxB,kBAAkB,iBAAiB;AAAA,YACnC,QAAQ,iBAAiB;AAAA;AAAA,QAC3B;AAAA,SACF;AAAA,QAEA;AAAA,IAEF;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,MAAK;AAAA,QACL,cAAa;AAAA,QACb,OAAO,OAAO;AAAA,QACd,OAAO;AAAA,QACP,UAAU,KAAK,WAAW,UAAU;AAAA,QACpC,OAAO,QAAQ,SAAS;AAAA;AAAA,IAC1B;AAAA,IACC,WAAW,OAAO,KACjB,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,IAEF,oBAAC,UAAO,SAAS,MAAM,KAAK,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,SAC9E,iBAAO,QACV;AAAA,KACF;AAEJ;AAmBA,SAAS,cAAc,KAA4B;AACjD,QAAM,QAAQ,uBAAuB,KAAK,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,WAAO,mBAAmB,MAAM,CAAC,CAAC,KAAK;AAAA,EACzC,QAAQ;AACN,WAAO,MAAM,CAAC,KAAK;AAAA,EACrB;AACF;AAIA,SAAS,YAAY,QAAwB;AAC3C,SAAO,OAAO,QAAQ,QAAQ,EAAE,EAAE,QAAQ,gBAAgB,KAAK;AACjE;AAEO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AACF,GAeG;AACD,QAAM,SAAS,yBAAyB,aAAa,UAAU;AAK/D,QAAM,YAAY,qBAAqB,iBAAiB,GAAG;AAC3D,QAAM,QAAQ,YAAY,SAAS,WAAW,SAAS,YAAY,UAAU,WAAW,UAAU,OAAO;AACzG,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,EAAE;AACnC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAY3C,QAAM,SAAS,QACV,MAAM,WAAW,gBAAgB,QAAQ,cAAc,MAAM,UAAU,IAAI,QAC5E;AAEJ,SACE,qBAAC,QAAK,IAAQ,WAAU,iBAItB;AAAA,yBAAC,SAAI,WAAU,qDACb;AAAA,0BAAC,qBAAmB,iBAAM;AAAA,MAC1B,oBAAC,QAAK,MAAK,MAAK,MAAM,UAAU,YAAY,WACzC,oBAAU,OAAO,cAAc,OAAO,cACzC;AAAA,OACF;AAAA,IAEC,CAAC,WAAW,CAAC,SACZ,oBAAC,UAAO,SAAS,cAAc,UAAU,MACtC,iBAAO,QACV;AAAA,IAGD,SACC,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,SAAI,WAAU,0BAA0B,iBAAO,UAAS;AAAA,MAQxD,gBAAgB;AAAA;AAAA,QAEf,oBAAC,SAAI,gBAAY,MAAC,WAAU,2CACzB,qBACC,SAAS,MAAM,UAAU,IAEzB,oBAAC,UAAO,OAAO,MAAM,YAAY,OAAO,OAAO,OAAO,WAAU,WAAU,GAE9E;AAAA,UAEA,oBAAC,SAAI,gBAAY,MAAC,WAAU,wCAC1B;AAAA,QAAC;AAAA;AAAA,UACC,KAAK,OAAO;AAAA,UACZ,KAAK,6BAA6B,MAAM,KAAK;AAAA,UAC7C,WAAU;AAAA;AAAA,MACZ,GACF;AAAA,MAED,UACC,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAI,WAAU,0BAA0B,iBAAO,YAAW;AAAA,QAC3D,qBAAC,SAAI,WAAU,2BAIb;AAAA,8BAAC,UAAK,gBAAY,MAAC,KAAI,OAAM,WAAU,0CACpC,sBAAY,MAAM,GACrB;AAAA,UACA,oBAAC,cAAW,MAAM,QAAQ,OAAO,OAAO,YAAY,MAAK,MAAK,MAAK,SAAQ;AAAA,WAC7E;AAAA,SACF;AAAA,MAEF;AAAA,QAAC;AAAA;AAAA,UACC,oBAAkB;AAAA,UAClB,QAAQ;AAAA,UACR,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU;AAAA,UACV,WAAW,CAAC,MAAuC;AACjD,gBAAI,EAAE,QAAQ,WAAW,QAAQ,CAAC,MAAM;AACtC,gBAAE,eAAe;AACjB,uBAAS,IAAI;AAAA,YACf;AAAA,UACF;AAAA;AAAA,MACF;AAAA,MACA,oBAAC,UAAO,SAAS,MAAM,SAAS,IAAI,GAAG,UAAU,CAAC,QAAQ,MACvD,iBAAO,QACV;AAAA,OACF;AAAA,IAGD,WACC,qBAAC,SAAI,WAAU,yCACb;AAAA,0BAAC,SAAI,WAAU,uBAAuB,iBAAO,gBAAe;AAAA,MAC5D,oBAAC,SAAM,MAAK,YAAW,cAAa,oBAAmB,OAAO,OAAO,UAAU,OAAO,UAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK,GAAG;AAAA,MAC9I;AAAA,QAAC;AAAA;AAAA,UACC,oBAAkB;AAAA,UAClB,QAAQ;AAAA,UACR,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU;AAAA,UACV,WAAW,CAAC,MAAuC;AACjD,gBAAI,EAAE,QAAQ,WAAW,YAAY,QAAQ,CAAC,MAAM;AAClD,gBAAE,eAAe;AACjB,wBAAU,UAAU,IAAI;AAAA,YAC1B;AAAA,UACF;AAAA;AAAA,MACF;AAAA,MACA,oBAAC,UAAO,SAAQ,UAAS,SAAS,MAAM,UAAU,UAAU,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,QAAQ,MAChG,iBAAO,SACV;AAAA,OACF;AAAA,KAEJ;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/account/account-settings.tsx"],"sourcesContent":["import { useId, useRef, useState } from \"react\";\nimport type { ChangeEvent, FormEvent, KeyboardEvent, ReactNode, RefObject } from \"react\";\nimport { Button } from \"../components/button\";\nimport { Card } from \"../components/card\";\nimport { Input } from \"../components/input\";\nimport { UserAvatar } from \"../components/user-avatar\";\nimport { CopyButton } from \"../components/copy-button\";\nimport { QrCode } from \"../components/qr-code\";\nimport { OneTimeCodeInput } from \"../components/one-time-code-input\";\nimport { usePromisePending } from \"../components/danger-confirm\";\nimport { personNameOk, PERSON_NAME_MAX_LENGTH } from \"../auth/form-rules\";\nimport {\n  DEFAULT_PASSWORD_STRENGTH_LABELS,\n  passwordByteLength,\n  PasswordStrengthMeter,\n} from \"../components/password-strength\";\nimport type { PasswordStrengthMeterProps } from \"../components/password-strength\";\nimport { useKitLabelOverrides, useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { Chip } from \"../components/chip\";\nimport { useAccountSettingsLabels } from \"./account-settings-labels\";\nimport { SettingsCardTitle } from \"../settings/settings-heading\";\nimport type { PasswordSettingLabels, ProfileSettingLabels, TwoFactorSettingLabels } from \"./account-settings-labels\";\nimport { COMMIT_EXCEPT_BILLING } from \"../components/write-lock\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { hasContent } from \"../lib/presence\";\nimport { authErrorCode } from \"../auth/auth-errors\";\n\n// The label types moved beside the namespace's defaults (0.12.0); re-exported here so\n// every existing `import type { ProfileSettingLabels }` keeps resolving.\nexport type {\n  AccountSettingsLabels,\n  PasskeysSettingLabels,\n  PasswordSettingLabels,\n  ProfileSettingLabels,\n  TwoFactorSettingLabels,\n} from \"./account-settings-labels\";\nexport { DEFAULT_ACCOUNT_SETTINGS_LABELS } from \"./account-settings-labels\";\n\n/**\n * App-agnostic account-settings SECTIONS (feedback #333). The presentation lives\n * in @hb/ui; each app injects its own auth-API handlers + translated labels and\n * arranges these next to its own app-specific cards (appearance, budgets, …).\n * Every section is a self-contained <Card> owning its transient form state.\n *\n * Every `labels` prop is optional since 0.12.0: the strings come from the provider's\n * `accountSettings` namespace, then English (see account-settings-labels.ts).\n */\n\n/** What {@link ProfileSetting} hands `onSave` in its two-field form (0.30.0): both\n *  trimmed, 1–120 characters each — the `PATCH /auth/me` body's `first_name` /\n *  `last_name` (docs/user-admin-harmonization.md §6.1). */\nexport interface ProfileNameValues {\n  firstName: string;\n  lastName: string;\n}\n\n/** What both forms of {@link ProfileSetting} take. */\ninterface ProfileSettingCommonProps {\n  name?: string | null;\n  email?: string | null;\n  role?: ReactNode;\n  memberSince?: ReactNode;\n  saving?: boolean;\n  /** Prop > `<UiKitProvider labels={{ accountSettings: { profile } }}>` > English. */\n  labels?: LabelOverride<ProfileSettingLabels>;\n  /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */\n  id?: string;\n}\n\n/**\n * The single display name, as before 0.30.0 — controlled through `value` / `onChange`,\n * saved by `onSave()`. Kept unchanged for an app that has not moved to first and last\n * name yet.\n */\nexport interface ProfileSettingDisplayNameProps extends ProfileSettingCommonProps {\n  value: string;\n  onChange: (value: string) => void;\n  onSave: () => void;\n  firstName?: undefined;\n  lastName?: undefined;\n}\n\n/**\n * First and last name (0.30.0, docs/user-admin-harmonization.md §6.1): the saved\n * values in, the edited ones out through `onSave`. The card keeps the drafts itself.\n */\nexport interface ProfileSettingNamesProps extends ProfileSettingCommonProps {\n  /** The saved given name — `first_name`. `null` reads as empty. */\n  firstName: string | null;\n  /** The saved family name — `last_name`. `null` (a migrated account, §3.3) reads as\n   *  empty, and Save then waits for one. */\n  lastName: string | null;\n  /**\n   * Save the two names (`PATCH /auth/me`, which also clears `name_incomplete`). Return\n   * a promise and Save is busy until it settles. Refresh `firstName` / `lastName` from\n   * the answer: the card compares its drafts with them, so Save turns off once the new\n   * names come back. A rejection keeps what was typed — the app says why (a toast), as\n   * for `PasswordSetting`.\n   */\n  onSave: (values: ProfileNameValues) => void | Promise<unknown>;\n  value?: undefined;\n  onChange?: undefined;\n}\n\nexport type ProfileSettingProps = ProfileSettingDisplayNameProps | ProfileSettingNamesProps;\n\n/**\n * The profile section: avatar, address, role, member since, and the name.\n *\n * **Two forms.** Given `firstName` / `lastName` (0.30.0, §6.1) it edits first and last\n * name in two fields, side by side where the card is wide enough — the order and the\n * 1–120-character rule of `RegisterForm` (auth §3.1), so the name a person signed up\n * with is edited the way it was typed. Without them it is the single `displayName`\n * field it always was, `value` / `onChange` / `onSave()` unchanged, for an app that has\n * not moved yet (kastlan split the one name at its first space on save; Kurvenschmiede\n * built its own card instead).\n *\n * The two-field form owns its drafts, starting from the saved names and following them\n * when they change; Save waits for a change, holds — saying why — while a name is\n * blank, and is a `commit` (a {@link WriteLockProvider} locks it, keksdose's demo) —\n * every lock but a lapsed plan's (`COMMIT_EXCEPT_BILLING`, 0.33): a profile is the\n * account's own settings, which billing never locks (docs/billing-harmonization.md §3.3,\n * §12.36).\n */\nexport function ProfileSetting(props: ProfileSettingProps) {\n  const { name, email, role, memberSince, labels: labelsProp, id } = props;\n  const labels = useAccountSettingsLabels(\"profile\", labelsProp);\n  const names = props.firstName !== undefined || props.lastName !== undefined;\n  return (\n    <Card id={id} className=\"p-4 space-y-3\">\n      <div className=\"flex items-center gap-3\">\n        <UserAvatar\n          name={name}\n          email={email}\n          person={names ? { first: props.firstName, last: props.lastName } : undefined}\n          size=\"lg\"\n        />\n        <div className=\"min-w-0\">\n          {/* A heading inside a SettingsLayout (0.31, docs/settings-harmonization.md\n              §3.7), the plain div it always was outside one. */}\n          <SettingsCardTitle>{labels.title}</SettingsCardTitle>\n          <div className=\"truncate-until-large font-mono text-xs text-muted\">\n            {/* `email` was a required key that nothing rendered; it names the address\n                for a screen reader, which otherwise hears a bare string under a title. */}\n            <span className=\"sr-only\">{labels.email}: </span>\n            {email ?? \"—\"}\n          </div>\n        </div>\n      </div>\n      <div className=\"grid grid-cols-[max-content_1fr] gap-x-3 gap-y-1 text-sm\">\n        <span className=\"text-muted\">{labels.role}</span>\n        <span>{role ?? \"—\"}</span>\n        <span className=\"text-muted\">{labels.memberSince}</span>\n        <span>{memberSince ?? \"—\"}</span>\n      </div>\n      {names ? (\n        <PersonNameFields\n          firstName={props.firstName ?? \"\"}\n          lastName={props.lastName ?? \"\"}\n          onSave={(props as ProfileSettingNamesProps).onSave}\n          saving={props.saving}\n          labels={labels}\n        />\n      ) : (\n        <DisplayNameField\n          name={name}\n          value={(props as ProfileSettingDisplayNameProps).value}\n          onChange={(props as ProfileSettingDisplayNameProps).onChange}\n          onSave={(props as ProfileSettingDisplayNameProps).onSave}\n          saving={props.saving}\n          labels={labels}\n        />\n      )}\n    </Card>\n  );\n}\n\n/** The single-name form — exactly the 0.29 card's field and button. */\nfunction DisplayNameField({\n  name,\n  value,\n  onChange,\n  onSave,\n  saving,\n  labels,\n}: {\n  name?: string | null;\n  value: string;\n  onChange: (value: string) => void;\n  onSave: () => void;\n  saving?: boolean;\n  labels: Required<ProfileSettingLabels>;\n}) {\n  const dirty = value.trim().length > 0 && value.trim() !== (name ?? \"\");\n  // Generated, not the literal \"display-name\" it was: two of these on one page (an\n  // admin editing someone else's profile beside their own) shared an id, and the\n  // second label pointed at the first field.\n  const inputId = useId();\n  return (\n    <>\n      <Input\n        id={inputId}\n        label={labels.displayName}\n        value={value}\n        onChange={(e) => onChange(e.target.value)}\n        maxLength={120}\n      />\n      <Button onClick={onSave} disabled={!dirty || saving}>\n        {labels.save}\n      </Button>\n    </>\n  );\n}\n\n/** The first-and-last form (0.30.0, §6.1). */\nfunction PersonNameFields({\n  firstName,\n  lastName,\n  onSave,\n  saving,\n  labels,\n}: {\n  firstName: string;\n  lastName: string;\n  onSave: (values: ProfileNameValues) => void | Promise<unknown>;\n  saving?: boolean;\n  labels: Required<ProfileSettingLabels>;\n}) {\n  const [first, setFirst] = useState(firstName);\n  const [last, setLast] = useState(lastName);\n  // The saved names moved (the save came back, another tab renamed): the drafts follow\n  // them. During render, as DangerConfirm resets its fields, so no frame shows the old\n  // draft beside the new name.\n  const [saved, setSaved] = useState({ firstName, lastName });\n  if (saved.firstName !== firstName || saved.lastName !== lastName) {\n    setSaved({ firstName, lastName });\n    setFirst(firstName);\n    setLast(lastName);\n  }\n  const { pending, run } = usePromisePending();\n  const busy = Boolean(saving) || pending;\n  const valid = personNameOk(first) && personNameOk(last);\n  const dirty = first.trim() !== firstName.trim() || last.trim() !== lastName.trim();\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    if (!valid || !dirty || busy) return;\n    // A rejection keeps the drafts; the app reports it, as PasswordSetting's does.\n    run(onSave({ firstName: first.trim(), lastName: last.trim() }), () => {});\n  };\n\n  return (\n    <form className=\"@container space-y-3\" onSubmit={submit} noValidate>\n      {/* The order and the rule of RegisterForm's two fields (auth §3.1). */}\n      <div className=\"grid gap-3 @xs:grid-cols-2\">\n        <Input\n          name=\"given-name\"\n          autoComplete=\"given-name\"\n          label={labels.firstName}\n          value={first}\n          onChange={(e) => setFirst(e.target.value)}\n          maxLength={PERSON_NAME_MAX_LENGTH}\n          readOnly={busy}\n          required\n        />\n        <Input\n          name=\"family-name\"\n          autoComplete=\"family-name\"\n          label={labels.lastName}\n          value={last}\n          onChange={(e) => setLast(e.target.value)}\n          maxLength={PERSON_NAME_MAX_LENGTH}\n          readOnly={busy}\n          required\n        />\n      </div>\n      <Button\n        type=\"submit\"\n        commit={COMMIT_EXCEPT_BILLING}\n        pending={busy}\n        // A blank name is a reason the person can act on; an unchanged one is not —\n        // there is nothing to save, and the button is simply off.\n        disabled={valid && !dirty}\n        disabledReason={valid ? undefined : labels.nameRequired}\n      >\n        {labels.save}\n      </Button>\n    </form>\n  );\n}\n\n/**\n * What {@link PasswordSetting}'s `strength` takes besides `true`: the meter's own options,\n * minus the ones the card owns — `value` (the new password), `minLength` (the card's, so\n * the checklist's length rule and the submit's check are one number) and `maxBytes`\n * (the card's own prop, which the submit enforces as well).\n */\nexport type PasswordSettingStrength = Pick<PasswordStrengthMeterProps, \"score\" | \"showRequirements\" | \"labels\">;\n\n/**\n * Changing the account's password: the current one, the new one twice, then the app's\n * `onSubmit`.\n *\n * **Refusals under their fields** (0.34, KS U3). The card's own checks say why under the\n * field they are about — too short or too long under the new password, a mismatch under\n * the confirmation — and a server's `password_incorrect` (server-kit's `400` for a wrong\n * current password; an older `invalid_credentials` too) is read from `onSubmit`'s\n * rejection by code ({@link authErrorCode}) and said under the current password, in\n * `EmailChangeSetting`'s and `DeleteAccountSetting`'s words. The field in error takes\n * the focus, so its message is read with it. Until 0.34 the card swallowed every\n * rejection and each app toasted the wrong password itself, in three spellings.\n *\n * **Anything else** is the app's: `describeError` puts its words in the card (a banner\n * over the button), and without it the card shows nothing — the app's own toast, as\n * before. The fields keep what was typed for a retry; a resolved `onSubmit` empties\n * them.\n */\nexport function PasswordSetting({\n  onSubmit,\n  pending,\n  minLength = 8,\n  strength,\n  maxBytes,\n  describeError,\n  labels: labelsProp,\n  id,\n}: {\n  /**\n   * Called with the validated (current, new) pair; return a promise to auto-clear on\n   * success. Reject with the client's error: `password_incorrect` is said under the\n   * current password; anything else goes through `describeError`, else stays the app's\n   * to say (a toast).\n   */\n  onSubmit: (currentPassword: string, newPassword: string) => void | Promise<unknown>;\n  pending?: boolean;\n  /** The shortest new password the card submits, in characters as a person counts them\n   *  (an emoji is one). Keep it in step with the server's own minimum. Default 8. */\n  minLength?: number;\n  /**\n   * Show the {@link PasswordStrengthMeter} under the new-password field (0.22.0,\n   * kastlan's input audit): the bar, the level in words and the checklist, with the\n   * length rule drawn from `minLength`. `true` for the meter as it comes; an object for\n   * its `score` (zxcvbn's, say), `showRequirements` or `labels`.\n   *\n   * Off by default, so a card that never asked for it does not grow one. The meter is\n   * advisory, as everywhere in the kit: it blocks nothing — the card's own checks do\n   * (`minLength`, the confirmation, `maxBytes`).\n   */\n  strength?: boolean | PasswordSettingStrength;\n  /**\n   * A byte ceiling on the new password — bcrypt reads at most 72 BYTES and ignores the\n   * rest, which is kastlan's case: `maxBytes={72}`. A new password over it is refused\n   * on submit with the meter's own \"too long\" sentence (the `passwordStrength`\n   * namespace's `tooLong`), and the meter, when shown, warns while it is typed.\n   *\n   * Unset by default, and leave it unset for a secret with no ceiling: an invented one\n   * talks people out of the long passphrase they chose.\n   */\n  maxBytes?: number;\n  /**\n   * The app's own words for a failure of `onSubmit`, said IN the card (a banner over the\n   * button), or `undefined` for the kit's handling. Asked first, for every failure — as\n   * `EmailChangeSetting`'s and `DeleteAccountSetting`'s are (0.34, KS U3): a demo's\n   * refusal, the device offline, a `422` whose sentence the app has. Without it, or when\n   * it answers `undefined`, the card says `password_incorrect` under the current password\n   * and nothing else: the rest stays the app's own toast.\n   */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** Prop > `<UiKitProvider labels={{ accountSettings: { password } }}>` > English. */\n  labels?: LabelOverride<PasswordSettingLabels>;\n  /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */\n  id?: string;\n}) {\n  const labels = useAccountSettingsLabels(\"password\", labelsProp);\n  const strengthOptions = typeof strength === \"object\" ? strength : undefined;\n  // Only for `tooLong`: the sentence the meter shows is the one the refusal says.\n  const strengthLabels = useKitLabels(\"passwordStrength\", DEFAULT_PASSWORD_STRENGTH_LABELS, strengthOptions?.labels);\n  const [current, setCurrent] = useState(\"\");\n  const [next, setNext] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  // One refusal at a time, under the field it is about; the app's words in the banner.\n  const [fieldError, setFieldError] = useState<{ field: PasswordField; message: string } | null>(null);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const currentRef = useRef<HTMLInputElement>(null);\n  const nextRef = useRef<HTMLInputElement>(null);\n  const confirmRef = useRef<HTMLInputElement>(null);\n  const refs: Record<PasswordField, RefObject<HTMLInputElement | null>> = {\n    current: currentRef,\n    next: nextRef,\n    confirm: confirmRef,\n  };\n\n  // The field in error takes the focus, so its message (its description) is read with it.\n  const refuse = (field: PasswordField, message: string) => {\n    setFieldError({ field, message });\n    refs[field].current?.focus();\n  };\n  const errorOf = (field: PasswordField) => (fieldError?.field === field ? fieldError.message : undefined);\n  // Typing in a field answers its refusal, and the banner's: both go.\n  const edit = (field: PasswordField, set: (value: string) => void) => (e: ChangeEvent<HTMLInputElement>) => {\n    set(e.target.value);\n    if (fieldError?.field === field) setFieldError(null);\n    if (failure !== null) setFailure(null);\n  };\n\n  const present = (error: unknown) => {\n    const own = describeError?.(error);\n    if (hasContent(own)) {\n      setFailure(own);\n      return;\n    }\n    const code = authErrorCode(error);\n    // `invalid_credentials` too, for a server that answered a wrong password so before\n    // server-kit 0.4.0 named `password_incorrect` — the siblings' rule.\n    if (code === \"password_incorrect\" || code === \"invalid_credentials\") {\n      refuse(\"current\", labels.wrongPassword);\n    }\n    // Anything else is the app's to say (a toast), as before 0.34.\n  };\n\n  const submit = async () => {\n    setFailure(null);\n    // Code points, not UTF-16 units — the count the meter's checklist and a server's\n    // `len()` use. `next.length` counted an emoji as two, so four of them passed a\n    // minimum of eight that the meter beside the field said they missed.\n    if ([...next].length < minLength) {\n      refuse(\"next\", labels.tooShort);\n      return;\n    }\n    if (maxBytes !== undefined && passwordByteLength(next) > maxBytes) {\n      refuse(\"next\", strengthLabels.tooLong(maxBytes));\n      return;\n    }\n    if (next !== confirm) {\n      refuse(\"confirm\", labels.mismatch);\n      return;\n    }\n    setFieldError(null);\n    try {\n      await onSubmit(current, next);\n      setCurrent(\"\");\n      setNext(\"\");\n      setConfirm(\"\");\n    } catch (error) {\n      // Keep the fields for a retry, and say what the card can.\n      present(error);\n    }\n  };\n\n  // `error` passed on all three from the first render, so a message coming and going\n  // never remounts a field and takes the caret with it (Input's `FieldGroup`).\n  const nextField = (\n    <Input\n      ref={nextRef}\n      type=\"password\"\n      autoComplete=\"new-password\"\n      label={labels.next}\n      value={next}\n      onChange={edit(\"next\", setNext)}\n      error={errorOf(\"next\")}\n    />\n  );\n\n  return (\n    <Card id={id} className=\"p-4 space-y-3\">\n      <SettingsCardTitle>{labels.title}</SettingsCardTitle>\n      <Input\n        ref={currentRef}\n        type=\"password\"\n        autoComplete=\"current-password\"\n        label={labels.current}\n        value={current}\n        onChange={edit(\"current\", setCurrent)}\n        error={errorOf(\"current\")}\n      />\n      {strength ? (\n        // One box for the field and its meter, so the card's `space-y-3` spaces the pair\n        // from its neighbours and the meter keeps its own small gap under the field.\n        <div>\n          {nextField}\n          <PasswordStrengthMeter\n            value={next}\n            minLength={minLength}\n            maxBytes={maxBytes}\n            score={strengthOptions?.score}\n            showRequirements={strengthOptions?.showRequirements}\n            labels={strengthOptions?.labels}\n          />\n        </div>\n      ) : (\n        nextField\n      )}\n      <Input\n        ref={confirmRef}\n        type=\"password\"\n        autoComplete=\"new-password\"\n        label={labels.confirm}\n        value={confirm}\n        onChange={edit(\"confirm\", setConfirm)}\n        error={errorOf(\"confirm\")}\n      />\n      {hasContent(failure) && (\n        <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n          {failure}\n        </AlertBanner>\n      )}\n      <Button onClick={() => void submit()} disabled={!current || !next || !confirm || pending}>\n        {labels.submit}\n      </Button>\n    </Card>\n  );\n}\n\n/** The three fields of {@link PasswordSetting}, for the refusal that names one. */\ntype PasswordField = \"current\" | \"next\" | \"confirm\";\n\n/**\n * What the app's setup call returned.\n *\n * `otpauthUri` (0.12.0) is what an authenticator backend actually hands out; the kit\n * draws the QR code itself ({@link QrCode}) and reads the manual-entry key out of the\n * URI's `secret` parameter when `secret` is not given. The `qrSvg` shape — a\n * base64-encoded SVG image — is what the section took before, which made every app\n * render a QR library to a static string and base64 it only for the kit to draw it back.\n */\nexport type TwoFactorSetupData = { qrSvg: string; secret: string } | { otpauthUri: string; secret?: string };\n\n/** The `secret` parameter of an `otpauth://` URI, or null. */\nfunction otpauthSecret(uri: string): string | null {\n  const match = /[?&]secret=([^&#]*)/i.exec(uri);\n  if (!match) return null;\n  try {\n    return decodeURIComponent(match[1]) || null;\n  } catch {\n    return match[1] || null;\n  }\n}\n\n/** \"JBSW Y3DP EHPK 3PXP\": the key in groups of four, which is how an authenticator's\n *  manual-entry screen shows it and how a person copies it by eye. */\nfunction groupSecret(secret: string): string {\n  return secret.replace(/\\s+/g, \"\").replace(/(.{4})(?=.)/g, \"$1 \");\n}\n\nexport function TwoFactorSetting({\n  enabled,\n  setup,\n  onStartSetup,\n  onEnable,\n  onDisable,\n  busy,\n  renderQr,\n  labels: labelsProp,\n  id,\n}: {\n  enabled: boolean;\n  /** What the app's setup call returned; null before setup starts. */\n  setup: TwoFactorSetupData | null;\n  onStartSetup: () => void;\n  onEnable: (code: string) => void;\n  onDisable: (password: string, code: string) => void;\n  busy?: boolean;\n  /** Draw the code yourself (a branded QR, a library you already ship). Given the\n   *  `otpauthUri`; the kit's own {@link QrCode} otherwise. Unused with `qrSvg`. */\n  renderQr?: (otpauthUri: string) => ReactNode;\n  /** Prop > `<UiKitProvider labels={{ accountSettings: { twoFactor } }}>` > English. */\n  labels?: LabelOverride<TwoFactorSettingLabels>;\n  /** The card's DOM id — a settings catalogue `anchor`, so `?focus=` can ring it (0.31). */\n  id?: string;\n}) {\n  const labels = useAccountSettingsLabels(\"twoFactor\", labelsProp);\n  // The title (0.31, docs/settings-harmonization.md §3.7) is new, and an app that\n  // translated this card before it named the setting in `status` — \"2FA\",\n  // \"Zwei-Faktor-Authentifizierung\". Each source's `title` first, then its `status`, so\n  // that app keeps its own word instead of meeting the English title.\n  const overrides = useKitLabelOverrides(\"accountSettings\")?.twoFactor;\n  const title = labelsProp?.title ?? overrides?.title ?? labelsProp?.status ?? overrides?.status ?? labels.title;\n  const [code, setCode] = useState(\"\");\n  const [password, setPassword] = useState(\"\");\n  // Both code fields are a OneTimeCodeInput (0.22.0) — the field this card wrote by hand\n  // twice — and keep what they did:\n  //  - `readOnlyUntilFocus`: browsers autofill a one-time-code field with the saved\n  //    username (the disable form has a current-password field right above it), and a\n  //    read-only field is never autofilled. The guard drops on focus, and the field\n  //    keeps the look of an editable one meanwhile (FIELD_WRITABLE_LOOK) — see the prop.\n  //  - `length={8}`: the `maxLength={8}` they had, so an authenticator issuing eight\n  //    digits still fits. What changed is that they now take digits only: \"123 456\"\n  //    pasted from an authenticator that groups its digits used to reach `onEnable`\n  //    with the space in it.\n  //  - one `code` state for both, as before.\n  const secret = setup ? (setup.secret ?? (\"otpauthUri\" in setup ? otpauthSecret(setup.otpauthUri) : null)) : null;\n\n  return (\n    <Card id={id} className=\"p-4 space-y-3\">\n      {/* The card had only \"Two-factor authentication: Off\". A settings page outlines its\n          cards by their titles (§3.7), so the setting's name is the title now, and the\n          state stands beside it as a chip instead of repeating the name. */}\n      <div className=\"flex flex-wrap items-center justify-between gap-2\">\n        <SettingsCardTitle>{title}</SettingsCardTitle>\n        <Chip size=\"sm\" tone={enabled ? \"success\" : \"neutral\"}>\n          {enabled ? labels.enabledText : labels.disabledText}\n        </Chip>\n      </div>\n\n      {!enabled && !setup && (\n        <Button onClick={onStartSetup} disabled={busy}>\n          {labels.enable}\n        </Button>\n      )}\n\n      {setup && (\n        <div className=\"space-y-2\">\n          <div className=\"text-xs text-secondary\">{labels.scanHint}</div>\n          {/* `bg-white`, NOT `--bg-surface`, and it must stay that way: a QR code is\n              read by a camera looking for maximum contrast between the modules and\n              their quiet zone. On the dark theme a surface-coloured backing makes it\n              slow to acquire, and on a warm light preset it lowers the contrast ratio\n              the spec is written against. This is the one place in the kit where a\n              literal colour is the correct answer. `data-private`: the code IS the\n              second factor, and demo mode blurs it like any other secret. */}\n          {\"otpauthUri\" in setup ? (\n            // No backing of its own: QrCode draws its quiet zone white inside the SVG.\n            <div data-private className=\"inline-block overflow-hidden rounded-md\">\n              {renderQr ? (\n                renderQr(setup.otpauthUri)\n              ) : (\n                <QrCode value={setup.otpauthUri} label={labels.qrAlt} className=\"size-48\" />\n              )}\n            </div>\n          ) : (\n            <div data-private className=\"inline-block rounded-md bg-white p-2\">\n              <img alt={labels.qrAlt} src={`data:image/svg+xml;base64,${setup.qrSvg}`} className=\"h-48 w-48\" />\n            </div>\n          )}\n          {secret && (\n            <div className=\"space-y-1\">\n              <div className=\"text-xs text-secondary\">{labels.secretHint}</div>\n              <div className=\"flex items-center gap-1\">\n                {/* `dir=\"ltr\"`: a base32 key is Latin letters and digits in a fixed\n                    order, and in an RTL page the groups would otherwise be laid out\n                    right to left. */}\n                <code data-private dir=\"ltr\" className=\"break-all font-mono text-xs select-all\">\n                  {groupSecret(secret)}\n                </code>\n                <CopyButton text={secret} label={labels.copySecret} size=\"xs\" tone=\"muted\" />\n              </div>\n            </div>\n          )}\n          <OneTimeCodeInput\n            readOnlyUntilFocus\n            length={8}\n            label={labels.codeLabel}\n            value={code}\n            onChange={setCode}\n            onKeyDown={(e: KeyboardEvent<HTMLInputElement>) => {\n              if (e.key === \"Enter\" && code && !busy) {\n                e.preventDefault();\n                onEnable(code);\n              }\n            }}\n          />\n          <Button onClick={() => onEnable(code)} disabled={!code || busy}>\n            {labels.verify}\n          </Button>\n        </div>\n      )}\n\n      {enabled && (\n        <div className=\"space-y-3 border-t border-subtle pt-3\">\n          <div className=\"text-sm font-medium\">{labels.disableSection}</div>\n          <Input\n            type=\"password\"\n            autoComplete=\"current-password\"\n            label={labels.password}\n            value={password}\n            onChange={(e) => setPassword(e.target.value)}\n          />\n          <OneTimeCodeInput\n            readOnlyUntilFocus\n            length={8}\n            label={labels.codeLabel}\n            value={code}\n            onChange={setCode}\n            onKeyDown={(e: KeyboardEvent<HTMLInputElement>) => {\n              if (e.key === \"Enter\" && password && code && !busy) {\n                e.preventDefault();\n                onDisable(password, code);\n              }\n            }}\n          />\n          <Button variant=\"danger\" onClick={() => onDisable(password, code)} disabled={!password || !code || busy}>\n            {labels.disable}\n          </Button>\n        </div>\n      )}\n    </Card>\n  );\n}\n"],"mappings":";AAmIQ,SAoEJ,UApEI,KAaI,YAbJ;AAnIR,SAAS,OAAO,QAAQ,gBAAgB;AAExC,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,cAAc,8BAA8B;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,sBAAsB,oBAAwC;AACvE,SAAS,YAAY;AACrB,SAAS,gCAAgC;AACzC,SAAS,yBAAyB;AAElC,SAAS,6BAA6B;AACtC,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAW9B,SAAS,uCAAuC;AAwFzC,SAAS,eAAe,OAA4B;AACzD,QAAM,EAAE,MAAM,OAAO,MAAM,aAAa,QAAQ,YAAY,GAAG,IAAI;AACnE,QAAM,SAAS,yBAAyB,WAAW,UAAU;AAC7D,QAAM,QAAQ,MAAM,cAAc,UAAa,MAAM,aAAa;AAClE,SACE,qBAAC,QAAK,IAAQ,WAAU,iBACtB;AAAA,yBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA;AAAA,UACA,QAAQ,QAAQ,EAAE,OAAO,MAAM,WAAW,MAAM,MAAM,SAAS,IAAI;AAAA,UACnE,MAAK;AAAA;AAAA,MACP;AAAA,MACA,qBAAC,SAAI,WAAU,WAGb;AAAA,4BAAC,qBAAmB,iBAAO,OAAM;AAAA,QACjC,qBAAC,SAAI,WAAU,qDAGb;AAAA,+BAAC,UAAK,WAAU,WAAW;AAAA,mBAAO;AAAA,YAAM;AAAA,aAAE;AAAA,UACzC,SAAS;AAAA,WACZ;AAAA,SACF;AAAA,OACF;AAAA,IACA,qBAAC,SAAI,WAAU,4DACb;AAAA,0BAAC,UAAK,WAAU,cAAc,iBAAO,MAAK;AAAA,MAC1C,oBAAC,UAAM,kBAAQ,UAAI;AAAA,MACnB,oBAAC,UAAK,WAAU,cAAc,iBAAO,aAAY;AAAA,MACjD,oBAAC,UAAM,yBAAe,UAAI;AAAA,OAC5B;AAAA,IACC,QACC;AAAA,MAAC;AAAA;AAAA,QACC,WAAW,MAAM,aAAa;AAAA,QAC9B,UAAU,MAAM,YAAY;AAAA,QAC5B,QAAS,MAAmC;AAAA,QAC5C,QAAQ,MAAM;AAAA,QACd;AAAA;AAAA,IACF,IAEA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,OAAQ,MAAyC;AAAA,QACjD,UAAW,MAAyC;AAAA,QACpD,QAAS,MAAyC;AAAA,QAClD,QAAQ,MAAM;AAAA,QACd;AAAA;AAAA,IACF;AAAA,KAEJ;AAEJ;AAGA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOG;AACD,QAAM,QAAQ,MAAM,KAAK,EAAE,SAAS,KAAK,MAAM,KAAK,OAAO,QAAQ;AAInE,QAAM,UAAU,MAAM;AACtB,SACE,iCACE;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,IAAI;AAAA,QACJ,OAAO,OAAO;AAAA,QACd;AAAA,QACA,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,QACxC,WAAW;AAAA;AAAA,IACb;AAAA,IACA,oBAAC,UAAO,SAAS,QAAQ,UAAU,CAAC,SAAS,QAC1C,iBAAO,MACV;AAAA,KACF;AAEJ;AAGA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,SAAS;AAC5C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,QAAQ;AAIzC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE,WAAW,SAAS,CAAC;AAC1D,MAAI,MAAM,cAAc,aAAa,MAAM,aAAa,UAAU;AAChE,aAAS,EAAE,WAAW,SAAS,CAAC;AAChC,aAAS,SAAS;AAClB,YAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,EAAE,SAAS,IAAI,IAAI,kBAAkB;AAC3C,QAAM,OAAO,QAAQ,MAAM,KAAK;AAChC,QAAM,QAAQ,aAAa,KAAK,KAAK,aAAa,IAAI;AACtD,QAAM,QAAQ,MAAM,KAAK,MAAM,UAAU,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS,KAAK;AAEjF,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,QAAI,CAAC,SAAS,CAAC,SAAS,KAAM;AAE9B,QAAI,OAAO,EAAE,WAAW,MAAM,KAAK,GAAG,UAAU,KAAK,KAAK,EAAE,CAAC,GAAG,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1E;AAEA,SACE,qBAAC,UAAK,WAAU,wBAAuB,UAAU,QAAQ,YAAU,MAEjE;AAAA,yBAAC,SAAI,WAAU,8BACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,UACxC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK;AAAA,UACvC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,OACF;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,QAAQ;AAAA,QACR,SAAS;AAAA,QAGT,UAAU,SAAS,CAAC;AAAA,QACpB,gBAAgB,QAAQ,SAAY,OAAO;AAAA,QAE1C,iBAAO;AAAA;AAAA,IACV;AAAA,KACF;AAEJ;AA4BO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AACF,GA8CG;AACD,QAAM,SAAS,yBAAyB,YAAY,UAAU;AAC9D,QAAM,kBAAkB,OAAO,aAAa,WAAW,WAAW;AAElE,QAAM,iBAAiB,aAAa,oBAAoB,kCAAkC,iBAAiB,MAAM;AACjH,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,EAAE;AACnC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AAEzC,QAAM,CAAC,YAAY,aAAa,IAAI,SAA2D,IAAI;AACnG,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,aAAa,OAAyB,IAAI;AAChD,QAAM,UAAU,OAAyB,IAAI;AAC7C,QAAM,aAAa,OAAyB,IAAI;AAChD,QAAM,OAAkE;AAAA,IACtE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAGA,QAAM,SAAS,CAAC,OAAsB,YAAoB;AACxD,kBAAc,EAAE,OAAO,QAAQ,CAAC;AAChC,SAAK,KAAK,EAAE,SAAS,MAAM;AAAA,EAC7B;AACA,QAAM,UAAU,CAAC,UAA0B,YAAY,UAAU,QAAQ,WAAW,UAAU;AAE9F,QAAM,OAAO,CAAC,OAAsB,QAAiC,CAAC,MAAqC;AACzG,QAAI,EAAE,OAAO,KAAK;AAClB,QAAI,YAAY,UAAU,MAAO,eAAc,IAAI;AACnD,QAAI,YAAY,KAAM,YAAW,IAAI;AAAA,EACvC;AAEA,QAAM,UAAU,CAAC,UAAmB;AAClC,UAAM,MAAM,gBAAgB,KAAK;AACjC,QAAI,WAAW,GAAG,GAAG;AACnB,iBAAW,GAAG;AACd;AAAA,IACF;AACA,UAAM,OAAO,cAAc,KAAK;AAGhC,QAAI,SAAS,wBAAwB,SAAS,uBAAuB;AACnE,aAAO,WAAW,OAAO,aAAa;AAAA,IACxC;AAAA,EAEF;AAEA,QAAM,SAAS,YAAY;AACzB,eAAW,IAAI;AAIf,QAAI,CAAC,GAAG,IAAI,EAAE,SAAS,WAAW;AAChC,aAAO,QAAQ,OAAO,QAAQ;AAC9B;AAAA,IACF;AACA,QAAI,aAAa,UAAa,mBAAmB,IAAI,IAAI,UAAU;AACjE,aAAO,QAAQ,eAAe,QAAQ,QAAQ,CAAC;AAC/C;AAAA,IACF;AACA,QAAI,SAAS,SAAS;AACpB,aAAO,WAAW,OAAO,QAAQ;AACjC;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,SAAS,SAAS,IAAI;AAC5B,iBAAW,EAAE;AACb,cAAQ,EAAE;AACV,iBAAW,EAAE;AAAA,IACf,SAAS,OAAO;AAEd,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAIA,QAAM,YACJ;AAAA,IAAC;AAAA;AAAA,MACC,KAAK;AAAA,MACL,MAAK;AAAA,MACL,cAAa;AAAA,MACb,OAAO,OAAO;AAAA,MACd,OAAO;AAAA,MACP,UAAU,KAAK,QAAQ,OAAO;AAAA,MAC9B,OAAO,QAAQ,MAAM;AAAA;AAAA,EACvB;AAGF,SACE,qBAAC,QAAK,IAAQ,WAAU,iBACtB;AAAA,wBAAC,qBAAmB,iBAAO,OAAM;AAAA,IACjC;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,MAAK;AAAA,QACL,cAAa;AAAA,QACb,OAAO,OAAO;AAAA,QACd,OAAO;AAAA,QACP,UAAU,KAAK,WAAW,UAAU;AAAA,QACpC,OAAO,QAAQ,SAAS;AAAA;AAAA,IAC1B;AAAA,IACC;AAAA;AAAA;AAAA,MAGC,qBAAC,SACE;AAAA;AAAA,QACD;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,YACP;AAAA,YACA;AAAA,YACA,OAAO,iBAAiB;AAAA,YACxB,kBAAkB,iBAAiB;AAAA,YACnC,QAAQ,iBAAiB;AAAA;AAAA,QAC3B;AAAA,SACF;AAAA,QAEA;AAAA,IAEF;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,MAAK;AAAA,QACL,cAAa;AAAA,QACb,OAAO,OAAO;AAAA,QACd,OAAO;AAAA,QACP,UAAU,KAAK,WAAW,UAAU;AAAA,QACpC,OAAO,QAAQ,SAAS;AAAA;AAAA,IAC1B;AAAA,IACC,WAAW,OAAO,KACjB,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,IAEF,oBAAC,UAAO,SAAS,MAAM,KAAK,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,SAC9E,iBAAO,QACV;AAAA,KACF;AAEJ;AAiBA,SAAS,cAAc,KAA4B;AACjD,QAAM,QAAQ,uBAAuB,KAAK,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,WAAO,mBAAmB,MAAM,CAAC,CAAC,KAAK;AAAA,EACzC,QAAQ;AACN,WAAO,MAAM,CAAC,KAAK;AAAA,EACrB;AACF;AAIA,SAAS,YAAY,QAAwB;AAC3C,SAAO,OAAO,QAAQ,QAAQ,EAAE,EAAE,QAAQ,gBAAgB,KAAK;AACjE;AAEO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AACF,GAeG;AACD,QAAM,SAAS,yBAAyB,aAAa,UAAU;AAK/D,QAAM,YAAY,qBAAqB,iBAAiB,GAAG;AAC3D,QAAM,QAAQ,YAAY,SAAS,WAAW,SAAS,YAAY,UAAU,WAAW,UAAU,OAAO;AACzG,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,EAAE;AACnC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAY3C,QAAM,SAAS,QAAS,MAAM,WAAW,gBAAgB,QAAQ,cAAc,MAAM,UAAU,IAAI,QAAS;AAE5G,SACE,qBAAC,QAAK,IAAQ,WAAU,iBAItB;AAAA,yBAAC,SAAI,WAAU,qDACb;AAAA,0BAAC,qBAAmB,iBAAM;AAAA,MAC1B,oBAAC,QAAK,MAAK,MAAK,MAAM,UAAU,YAAY,WACzC,oBAAU,OAAO,cAAc,OAAO,cACzC;AAAA,OACF;AAAA,IAEC,CAAC,WAAW,CAAC,SACZ,oBAAC,UAAO,SAAS,cAAc,UAAU,MACtC,iBAAO,QACV;AAAA,IAGD,SACC,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,SAAI,WAAU,0BAA0B,iBAAO,UAAS;AAAA,MAQxD,gBAAgB;AAAA;AAAA,QAEf,oBAAC,SAAI,gBAAY,MAAC,WAAU,2CACzB,qBACC,SAAS,MAAM,UAAU,IAEzB,oBAAC,UAAO,OAAO,MAAM,YAAY,OAAO,OAAO,OAAO,WAAU,WAAU,GAE9E;AAAA,UAEA,oBAAC,SAAI,gBAAY,MAAC,WAAU,wCAC1B,8BAAC,SAAI,KAAK,OAAO,OAAO,KAAK,6BAA6B,MAAM,KAAK,IAAI,WAAU,aAAY,GACjG;AAAA,MAED,UACC,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAI,WAAU,0BAA0B,iBAAO,YAAW;AAAA,QAC3D,qBAAC,SAAI,WAAU,2BAIb;AAAA,8BAAC,UAAK,gBAAY,MAAC,KAAI,OAAM,WAAU,0CACpC,sBAAY,MAAM,GACrB;AAAA,UACA,oBAAC,cAAW,MAAM,QAAQ,OAAO,OAAO,YAAY,MAAK,MAAK,MAAK,SAAQ;AAAA,WAC7E;AAAA,SACF;AAAA,MAEF;AAAA,QAAC;AAAA;AAAA,UACC,oBAAkB;AAAA,UAClB,QAAQ;AAAA,UACR,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU;AAAA,UACV,WAAW,CAAC,MAAuC;AACjD,gBAAI,EAAE,QAAQ,WAAW,QAAQ,CAAC,MAAM;AACtC,gBAAE,eAAe;AACjB,uBAAS,IAAI;AAAA,YACf;AAAA,UACF;AAAA;AAAA,MACF;AAAA,MACA,oBAAC,UAAO,SAAS,MAAM,SAAS,IAAI,GAAG,UAAU,CAAC,QAAQ,MACvD,iBAAO,QACV;AAAA,OACF;AAAA,IAGD,WACC,qBAAC,SAAI,WAAU,yCACb;AAAA,0BAAC,SAAI,WAAU,uBAAuB,iBAAO,gBAAe;AAAA,MAC5D;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA;AAAA,MAC7C;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,oBAAkB;AAAA,UAClB,QAAQ;AAAA,UACR,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU;AAAA,UACV,WAAW,CAAC,MAAuC;AACjD,gBAAI,EAAE,QAAQ,WAAW,YAAY,QAAQ,CAAC,MAAM;AAClD,gBAAE,eAAe;AACjB,wBAAU,UAAU,IAAI;AAAA,YAC1B;AAAA,UACF;AAAA;AAAA,MACF;AAAA,MACA,oBAAC,UAAO,SAAQ,UAAS,SAAS,MAAM,UAAU,UAAU,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,QAAQ,MAChG,iBAAO,SACV;AAAA,OACF;AAAA,KAEJ;AAEJ;","names":[]}

package/dist/account/delete-account-setting.js

@@ -112,71 +112,62 @@ function DeleteAccountSetting({
     setFieldError(null);
     setFailure(null);
   };
-  return /* @__PURE__ */ jsxs(
-    Card,
-    {
-      ...rest,
-      "data-state": done ? "done" : "form",
-      tone: "danger",
-      className: cn("p-4 space-y-3", className),
-      children: [
-        /* @__PURE__ */ jsxs("div", { children: [
-          /* @__PURE__ */ jsx(SettingsCardTitle, { children: labels.title }),
-          /* @__PURE__ */ jsx("div", { className: CARD_DESCRIPTION_CLASS, children: modeSentence })
-        ] }),
-        done ? /* @__PURE__ */ jsxs("div", { ref: doneRef, tabIndex: -1, role: "status", className: "flex items-start gap-2 text-sm outline-none", children: [
-          /* @__PURE__ */ jsx(UserX, { "aria-hidden": true, className: "mt-0.5 size-4 shrink-0 text-muted" }),
-          /* @__PURE__ */ jsx("span", { children: labels.done })
-        ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-          /* @__PURE__ */ jsxs(
-            DangerConfirm,
-            {
-              commit: COMMIT_EXCEPT_BILLING,
-              armLabel: labels.arm,
-              prompt: labels.prompt,
-              consequences: lines,
-              confirmLabel: labels.confirm,
-              confirmDisabledReason: held,
-              busy,
-              onArmedChange: disarmed,
-              onConfirm: confirm,
-              children: [
-                /* @__PURE__ */ jsx(
-                  TypedConfirmField,
-                  {
-                    ref: typedRef,
-                    target: email,
-                    match: "caseless",
-                    value: typed,
-                    onValueChange: (next) => {
-                      setTyped(next);
-                      if (fieldError === "email") setFieldError(null);
-                    },
-                    error: fieldError === "email" ? labels.confirmationMismatch : void 0,
-                    busy
-                  }
-                ),
-                /* @__PURE__ */ jsx(
-                  CurrentPasswordInput,
-                  {
-                    ref: passwordRef,
-                    value: password,
-                    onValueChange: (next) => {
-                      setPassword(next);
-                      if (fieldError === "password") setFieldError(null);
-                    },
-                    error: fieldError === "password" ? labels.wrongPassword : void 0,
-                    busy
-                  }
-                )
-              ]
-            }
-          ),
-          hasContent(failure) && /* @__PURE__ */ jsx(AlertBanner, { tone: "danger", size: "sm", role: "alert", children: failure })
-        ] })
-      ]
-    }
-  );
+  return /* @__PURE__ */ jsxs(Card, { ...rest, "data-state": done ? "done" : "form", tone: "danger", className: cn("p-4 space-y-3", className), children: [
+    /* @__PURE__ */ jsxs("div", { children: [
+      /* @__PURE__ */ jsx(SettingsCardTitle, { children: labels.title }),
+      /* @__PURE__ */ jsx("div", { className: CARD_DESCRIPTION_CLASS, children: modeSentence })
+    ] }),
+    done ? /* @__PURE__ */ jsxs("div", { ref: doneRef, tabIndex: -1, role: "status", className: "flex items-start gap-2 text-sm outline-none", children: [
+      /* @__PURE__ */ jsx(UserX, { "aria-hidden": true, className: "mt-0.5 size-4 shrink-0 text-muted" }),
+      /* @__PURE__ */ jsx("span", { children: labels.done })
+    ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsxs(
+        DangerConfirm,
+        {
+          commit: COMMIT_EXCEPT_BILLING,
+          armLabel: labels.arm,
+          prompt: labels.prompt,
+          consequences: lines,
+          confirmLabel: labels.confirm,
+          confirmDisabledReason: held,
+          busy,
+          onArmedChange: disarmed,
+          onConfirm: confirm,
+          children: [
+            /* @__PURE__ */ jsx(
+              TypedConfirmField,
+              {
+                ref: typedRef,
+                target: email,
+                match: "caseless",
+                value: typed,
+                onValueChange: (next) => {
+                  setTyped(next);
+                  if (fieldError === "email") setFieldError(null);
+                },
+                error: fieldError === "email" ? labels.confirmationMismatch : void 0,
+                busy
+              }
+            ),
+            /* @__PURE__ */ jsx(
+              CurrentPasswordInput,
+              {
+                ref: passwordRef,
+                value: password,
+                onValueChange: (next) => {
+                  setPassword(next);
+                  if (fieldError === "password") setFieldError(null);
+                },
+                error: fieldError === "password" ? labels.wrongPassword : void 0,
+                busy
+              }
+            )
+          ]
+        }
+      ),
+      hasContent(failure) && /* @__PURE__ */ jsx(AlertBanner, { tone: "danger", size: "sm", role: "alert", children: failure })
+    ] })
+  ] });
 }
 export {
   DEFAULT_DELETE_ACCOUNT_LABELS,

package/dist/account/delete-account-setting.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/account/delete-account-setting.tsx"],"sourcesContent":["import { isValidElement, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, ReactNode } from \"react\";\nimport { UserX } from \"lucide-react\";\n\nimport { useKitLabels, useKitLocale, type LabelOverride } from \"../i18n/kit-labels\";\nimport { cn } from \"../lib/cn\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { hasContent } from \"../lib/presence\";\nimport {\n  CurrentPasswordInput,\n  DangerConfirm,\n  DEFAULT_DANGER_CONFIRM_LABELS,\n  TypedConfirmField,\n  typedMatches,\n} from \"../components/danger-confirm\";\nimport type { DangerConsequence } from \"../components/danger-confirm\";\nimport { Card } from \"../components/card\";\nimport { authErrorCode, isRateLimited, retryAfterSeconds } from \"../auth/auth-errors\";\nimport { useFocusWhen } from \"../auth/status-parts\";\nimport { CARD_DESCRIPTION_CLASS, refusalCompanies, settle, useMounted } from \"./account-parts\";\nimport { SettingsCardTitle } from \"../settings/settings-heading\";\nimport { COMMIT_EXCEPT_BILLING } from \"../components/write-lock\";\nimport { DEFAULT_DELETE_ACCOUNT_LABELS } from \"./delete-account-setting-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/**\n * Every string {@link DeleteAccountSetting} renders — the `deleteAccount` namespace of\n * `<UiKitProvider labels>`, overridable per instance through `labels`. The confirm's\n * Cancel, \"Password\" and \"Type … to confirm\" are `dangerConfirm`'s.\n */\nexport interface DeleteAccountLabels {\n  /** The card's title. */\n  title: string;\n  /** Mode `after_days`, given the days: what happens and when. */\n  afterDays: (days: number) => string;\n  /** Mode `operator`: what happens, and who erases it. */\n  operator: string;\n  /** The button that opens the confirm. */\n  arm: string;\n  /** The confirm's warning, over the consequences. */\n  prompt: string;\n  /** The line in the consequences when `handOverCount` is given (Kurvenschmiede, §2.7),\n   *  given the count. */\n  handOver: (count: number) => string;\n  /** The button that sends it. */\n  confirm: string;\n  /** Said once the request is accepted — the app signs out next. */\n  done: string;\n  /** `password_incorrect` (server-kit's `400` for a wrong current password), under the\n   *  password field. */\n  wrongPassword: string;\n  /** `confirmation_mismatch` — the server did not take the typed address as the\n   *  account's — under the address field. */\n  confirmationMismatch: string;\n  /** `last_admin` — the account is the last active admin. */\n  lastAdmin: string;\n  /** `last_admin` naming the companies (kastlan checks per company), given them as one\n   *  list in the reader's language (\"Example AG and Sample GmbH\"). */\n  lastAdminOf: (companies: string) => string;\n  /** `household_has_members` — keksdose's guard (§6.4). */\n  householdHasMembers: string;\n  /** A request was throttled — HTTP 429 — given its `Retry-After` wait in seconds, or\n   *  `undefined` without one. */\n  rateLimited: (seconds?: number) => string;\n  /** Any other failure. */\n  failed: string;\n}\n\n// Defined in ./delete-account-setting-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_DELETE_ACCOUNT_LABELS };\n\n/* ── Props ───────────────────────────────────────────────────────────────── */\n\n/** What happens after the deactivation (§2.1, §6.4) — the app's setting. */\nexport type DeletionMode = \"after_days\" | \"operator\";\n\n/** What {@link DeleteAccountSettingProps.onRequest} gets: the `POST /auth/me/deletion`\n *  body. */\nexport interface DeleteAccountValues {\n  /** As typed. */\n  password: string;\n  /** The address as TYPED, trimmed — the server re-checks it against the account\n   *  (server-kit's `confirm_email_matches`), as keksdose's admin actions do. */\n  confirmEmail: string;\n}\n\n/** One line of the consequences: a node of the app's, or a {@link DangerConsequence}\n *  for a key of its own and the `severe` mark. */\nexport type DeleteAccountConsequence = ReactNode | DangerConsequence;\n\nexport interface DeleteAccountSettingProps extends Omit<ComponentPropsWithRef<\"div\">, \"children\"> {\n  /** The account's address — the text to type. */\n  email: string;\n  /** `\"after_days\"` (keksdose, Kurvenschmiede: erased by a scheduled job) or\n   *  `\"operator\"` (kastlan: company data is involved, an operator erases it). */\n  mode: DeletionMode;\n  /** With `after_days`: how many. Default 30 (§2.1). */\n  days?: number;\n  /**\n   * What goes, in the app's words (§6.4: \"the app's own list\") — derived from the\n   * account's own facts where it can be: keksdose's \"Budget X will be deleted; its 2\n   * guests are told\", rather than the worst case for everybody.\n   */\n  consequences?: readonly DeleteAccountConsequence[];\n  /** Kurvenschmiede (§2.7): how many owned items others can see — they pass to the\n   *  first active admin at erasure. A line of its own in the consequences; 0 or left\n   *  out, none. */\n  handOverCount?: number;\n  /**\n   * The confirm was answered: send `POST /auth/me/deletion {password, confirm_email}`.\n   * Resolve once it is accepted — the card says \"You are being signed out\" — and then\n   * sign the user out: the server ended every session with the deactivation. Reject\n   * with the client's error: `password_incorrect` under the password,\n   * `confirmation_mismatch` under the address, `last_admin` (with kastlan's\n   * `companies`) and `household_has_members` above the buttons, a 429 as\n   * `rateLimited`, anything else (a demo account's 403, an app's own code) through\n   * `describeError`, else `failed`. The confirm stays open with what was typed, for a\n   * retry.\n   */\n  onRequest: (values: DeleteAccountValues) => Promise<unknown> | void;\n  /** The app's own words for a failure, or `undefined` for the kit's. Asked first, for\n   *  every failure — kastlan's `last_admin` names the companies. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  labels?: LabelOverride<DeleteAccountLabels>;\n}\n\n/** Whether an item is a `{ text }` line rather than a node — a React element is an\n *  object too, and so would a `{ text }` lookalike be, so the element test comes first. */\nfunction isConsequence(item: DeleteAccountConsequence): item is DangerConsequence {\n  return typeof item === \"object\" && item !== null && !isValidElement(item) && \"text\" in item;\n}\n\n/**\n * Deleting one's own account (docs/user-admin-harmonization.md §6.4, §2.1): what it does,\n * the password, the typed address — then the app signs out.\n *\n * **Two stages, said before the button.** The request DEACTIVATES the account at once\n * (no sign-in, every session ended, marked for deletion); the erasure follows per the\n * app's `mode` — \"erased for good 30 days later\" (`after_days`, a scheduled job) or \"an\n * operator will erase it\" (`operator`, kastlan, where company records are involved).\n * The sentence is under the title, so it is read before anything is pressed.\n *\n * **The confirm is a {@link DangerConfirm}** with the two guards of every \"type the\n * address\" rule in the apps: the address typed (compared caseless, as in all of them)\n * and the password. They are the tile's own {@link TypedConfirmField} and\n * {@link CurrentPasswordInput}, drawn in its fields slot and held by\n * `confirmDisabledReason` with the tile's own sentences, rather than its built-in\n * `phrase` / `requirePassword` — those have no error of their own, and a wrong password\n * belongs under the password. Its consequences are the app's list, plus\n * Kurvenschmiede's hand-over line (`handOverCount`, §2.7: shared work goes to an\n * administrator, never a refusal). The typed address goes to `onRequest` as typed, so\n * the server re-checks it (`confirm_email_matches`).\n *\n * **Refusals** (§6.4) are read by code ({@link authErrorCode}): `password_incorrect` (a\n * `400`, so an app's 401 handling never signs the person out over a typo) under the\n * password, `confirmation_mismatch` under the address, `last_admin` — naming kastlan's\n * companies when the answer lists them — and keksdose's `household_has_members` guard\n * above the buttons; a 429; and the rest in the app's words. The confirm stays open with\n * what was typed, for a retry; Cancel wipes it.\n *\n * **After success** the card says the account is deactivated and the person is being\n * signed out — the app's to do, since the kit sends nothing (auth §8).\n *\n * **Under a write lock** the confirm is a `commit` exempt from billing\n * (`COMMIT_EXCEPT_BILLING`, 0.33): leaving never depends on paying\n * (docs/billing-harmonization.md decision 14, §12.36); a demo's lock still holds it.\n */\nexport function DeleteAccountSetting({\n  email,\n  mode,\n  days = 30,\n  consequences,\n  handOverCount,\n  onRequest,\n  describeError,\n  labels: labelsProp,\n  className,\n  ...rest\n}: DeleteAccountSettingProps) {\n  const labels = useKitLabels(\"deleteAccount\", DEFAULT_DELETE_ACCOUNT_LABELS, labelsProp);\n  // The guards speak the tile's words, so \"Type “…” to confirm\" and \"Enter your password\n  // to confirm\" are translated once, in `dangerConfirm`.\n  const guardLabels = useKitLabels(\"dangerConfirm\", DEFAULT_DANGER_CONFIRM_LABELS);\n  const locale = useKitLocale();\n  const [typed, setTyped] = useState(\"\");\n  const [password, setPassword] = useState(\"\");\n  const [busy, setBusy] = useState(false);\n  const [fieldError, setFieldError] = useState<\"email\" | \"password\" | null>(null);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const [done, setDone] = useState(false);\n  const mounted = useMounted();\n  const typedRef = useRef<HTMLInputElement>(null);\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  // The tile went with the press; the answer takes the focus, so it is read out.\n  useFocusWhen(done, doneRef);\n\n  const modeSentence = mode === \"operator\" ? labels.operator : labels.afterDays(days);\n\n  const lines: (string | DangerConsequence)[] = (consequences ?? [])\n    // `{cond && \"…\"}` lines that came out empty are no lines.\n    .filter((item) => item !== null && item !== undefined && item !== false && item !== \"\")\n    .map((item, index) => (isConsequence(item) ? item : { key: `app-${index}`, text: item }));\n  if (handOverCount !== undefined && handOverCount > 0) {\n    lines.push({ key: \"hand-over\", text: labels.handOver(handOverCount) });\n  }\n\n  // The first guard still open, in the order the fields are drawn — DangerConfirm's rule.\n  const held = !typedMatches(typed, email, \"caseless\")\n    ? typeof guardLabels.needsPhrase === \"function\"\n      ? guardLabels.needsPhrase(email)\n      : guardLabels.needsPhrase\n    : password === \"\"\n      ? guardLabels.needsPassword\n      : undefined;\n\n  const present = (error: unknown) => {\n    const own = describeError?.(error);\n    if (hasContent(own)) {\n      setFailure(own);\n      return;\n    }\n    if (isRateLimited(error)) {\n      setFailure(labels.rateLimited(retryAfterSeconds(error)));\n      return;\n    }\n    const code = authErrorCode(error);\n    // `invalid_credentials` too, for a server that answered a wrong password so before\n    // server-kit 0.4.0 named `password_incorrect`.\n    if (code === \"password_incorrect\" || code === \"invalid_credentials\") {\n      setFieldError(\"password\");\n      passwordRef.current?.focus();\n      return;\n    }\n    if (code === \"confirmation_mismatch\" || code === \"confirmation_required\") {\n      setFieldError(\"email\");\n      typedRef.current?.focus();\n      return;\n    }\n    if (code === \"last_admin\") {\n      const companies = refusalCompanies(error);\n      setFailure(\n        companies\n          ? labels.lastAdminOf(new Intl.ListFormat(locale, { type: \"conjunction\" }).format(companies))\n          : labels.lastAdmin,\n      );\n      return;\n    }\n    setFailure(code === \"household_has_members\" ? labels.householdHasMembers : labels.failed);\n  };\n\n  const confirm = () => {\n    setFailure(null);\n    setFieldError(null);\n    setBusy(true);\n    const values: DeleteAccountValues = { password, confirmEmail: typed.trim() };\n    return settle(() => onRequest(values)).then(\n      () => {\n        if (!mounted.current) return;\n        setBusy(false);\n        setDone(true);\n      },\n      (error: unknown) => {\n        if (mounted.current) {\n          setBusy(false);\n          present(error);\n        }\n        // Rejected again, so DangerConfirm stays armed with what was typed.\n        throw error;\n      },\n    );\n  };\n\n  // A disarmed tile holds no password — DangerConfirm's own rule, for the fields it\n  // does not own here.\n  const disarmed = (armed: boolean) => {\n    if (armed) return;\n    setTyped(\"\");\n    setPassword(\"\");\n    setFieldError(null);\n    setFailure(null);\n  };\n\n  return (\n    <Card\n      {...rest}\n      data-state={done ? \"done\" : \"form\"}\n      tone=\"danger\"\n      className={cn(\"p-4 space-y-3\", className)}\n    >\n      <div>\n        <SettingsCardTitle>{labels.title}</SettingsCardTitle>\n        <div className={CARD_DESCRIPTION_CLASS}>{modeSentence}</div>\n      </div>\n      {done ? (\n        <div ref={doneRef} tabIndex={-1} role=\"status\" className=\"flex items-start gap-2 text-sm outline-none\">\n          <UserX aria-hidden className=\"mt-0.5 size-4 shrink-0 text-muted\" />\n          <span>{labels.done}</span>\n        </div>\n      ) : (\n        <>\n          <DangerConfirm\n            commit={COMMIT_EXCEPT_BILLING}\n            armLabel={labels.arm}\n            prompt={labels.prompt}\n            consequences={lines}\n            confirmLabel={labels.confirm}\n            confirmDisabledReason={held}\n            busy={busy}\n            onArmedChange={disarmed}\n            onConfirm={confirm}\n          >\n            <TypedConfirmField\n              ref={typedRef}\n              target={email}\n              match=\"caseless\"\n              value={typed}\n              onValueChange={(next) => {\n                setTyped(next);\n                if (fieldError === \"email\") setFieldError(null);\n              }}\n              error={fieldError === \"email\" ? labels.confirmationMismatch : undefined}\n              busy={busy}\n            />\n            <CurrentPasswordInput\n              ref={passwordRef}\n              value={password}\n              onValueChange={(next) => {\n                setPassword(next);\n                if (fieldError === \"password\") setFieldError(null);\n              }}\n              error={fieldError === \"password\" ? labels.wrongPassword : undefined}\n              busy={busy}\n            />\n          </DangerConfirm>\n          {hasContent(failure) && (\n            <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n              {failure}\n            </AlertBanner>\n          )}\n        </>\n      )}\n    </Card>\n  );\n}\n"],"mappings":";AAmSM,SAUE,UATA,KADF;AAnSN,SAAS,gBAAgB,QAAQ,gBAAgB;AAEjD,SAAS,aAAa;AAEtB,SAAS,cAAc,oBAAwC;AAC/D,SAAS,UAAU;AACnB,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,YAAY;AACrB,SAAS,eAAe,eAAe,yBAAyB;AAChE,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,kBAAkB,QAAQ,kBAAkB;AAC7E,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,qCAAqC;AA2G9C,SAAS,cAAc,MAA2D;AAChF,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,eAAe,IAAI,KAAK,UAAU;AACzF;AAqCO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA8B;AAC5B,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,cAAc,aAAa,iBAAiB,6BAA6B;AAC/E,QAAM,SAAS,aAAa;AAC5B,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,CAAC,YAAY,aAAa,IAAI,SAAsC,IAAI;AAC9E,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,WAAW;AAC3B,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAE3C,eAAa,MAAM,OAAO;AAE1B,QAAM,eAAe,SAAS,aAAa,OAAO,WAAW,OAAO,UAAU,IAAI;AAElF,QAAM,SAAyC,gBAAgB,CAAC,GAE7D,OAAO,CAAC,SAAS,SAAS,QAAQ,SAAS,UAAa,SAAS,SAAS,SAAS,EAAE,EACrF,IAAI,CAAC,MAAM,UAAW,cAAc,IAAI,IAAI,OAAO,EAAE,KAAK,OAAO,KAAK,IAAI,MAAM,KAAK,CAAE;AAC1F,MAAI,kBAAkB,UAAa,gBAAgB,GAAG;AACpD,UAAM,KAAK,EAAE,KAAK,aAAa,MAAM,OAAO,SAAS,aAAa,EAAE,CAAC;AAAA,EACvE;AAGA,QAAM,OAAO,CAAC,aAAa,OAAO,OAAO,UAAU,IAC/C,OAAO,YAAY,gBAAgB,aACjC,YAAY,YAAY,KAAK,IAC7B,YAAY,cACd,aAAa,KACX,YAAY,gBACZ;AAEN,QAAM,UAAU,CAAC,UAAmB;AAClC,UAAM,MAAM,gBAAgB,KAAK;AACjC,QAAI,WAAW,GAAG,GAAG;AACnB,iBAAW,GAAG;AACd;AAAA,IACF;AACA,QAAI,cAAc,KAAK,GAAG;AACxB,iBAAW,OAAO,YAAY,kBAAkB,KAAK,CAAC,CAAC;AACvD;AAAA,IACF;AACA,UAAM,OAAO,cAAc,KAAK;AAGhC,QAAI,SAAS,wBAAwB,SAAS,uBAAuB;AACnE,oBAAc,UAAU;AACxB,kBAAY,SAAS,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,SAAS,2BAA2B,SAAS,yBAAyB;AACxE,oBAAc,OAAO;AACrB,eAAS,SAAS,MAAM;AACxB;AAAA,IACF;AACA,QAAI,SAAS,cAAc;AACzB,YAAM,YAAY,iBAAiB,KAAK;AACxC;AAAA,QACE,YACI,OAAO,YAAY,IAAI,KAAK,WAAW,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,OAAO,SAAS,CAAC,IACzF,OAAO;AAAA,MACb;AACA;AAAA,IACF;AACA,eAAW,SAAS,0BAA0B,OAAO,sBAAsB,OAAO,MAAM;AAAA,EAC1F;AAEA,QAAM,UAAU,MAAM;AACpB,eAAW,IAAI;AACf,kBAAc,IAAI;AAClB,YAAQ,IAAI;AACZ,UAAM,SAA8B,EAAE,UAAU,cAAc,MAAM,KAAK,EAAE;AAC3E,WAAO,OAAO,MAAM,UAAU,MAAM,CAAC,EAAE;AAAA,MACrC,MAAM;AACJ,YAAI,CAAC,QAAQ,QAAS;AACtB,gBAAQ,KAAK;AACb,gBAAQ,IAAI;AAAA,MACd;AAAA,MACA,CAAC,UAAmB;AAClB,YAAI,QAAQ,SAAS;AACnB,kBAAQ,KAAK;AACb,kBAAQ,KAAK;AAAA,QACf;AAEA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,QAAM,WAAW,CAAC,UAAmB;AACnC,QAAI,MAAO;AACX,aAAS,EAAE;AACX,gBAAY,EAAE;AACd,kBAAc,IAAI;AAClB,eAAW,IAAI;AAAA,EACjB;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ,cAAY,OAAO,SAAS;AAAA,MAC5B,MAAK;AAAA,MACL,WAAW,GAAG,iBAAiB,SAAS;AAAA,MAExC;AAAA,6BAAC,SACC;AAAA,8BAAC,qBAAmB,iBAAO,OAAM;AAAA,UACjC,oBAAC,SAAI,WAAW,wBAAyB,wBAAa;AAAA,WACxD;AAAA,QACC,OACC,qBAAC,SAAI,KAAK,SAAS,UAAU,IAAI,MAAK,UAAS,WAAU,+CACvD;AAAA,8BAAC,SAAM,eAAW,MAAC,WAAU,qCAAoC;AAAA,UACjE,oBAAC,UAAM,iBAAO,MAAK;AAAA,WACrB,IAEA,iCACE;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,QAAQ;AAAA,cACR,UAAU,OAAO;AAAA,cACjB,QAAQ,OAAO;AAAA,cACf,cAAc;AAAA,cACd,cAAc,OAAO;AAAA,cACrB,uBAAuB;AAAA,cACvB;AAAA,cACA,eAAe;AAAA,cACf,WAAW;AAAA,cAEX;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,KAAK;AAAA,oBACL,QAAQ;AAAA,oBACR,OAAM;AAAA,oBACN,OAAO;AAAA,oBACP,eAAe,CAAC,SAAS;AACvB,+BAAS,IAAI;AACb,0BAAI,eAAe,QAAS,eAAc,IAAI;AAAA,oBAChD;AAAA,oBACA,OAAO,eAAe,UAAU,OAAO,uBAAuB;AAAA,oBAC9D;AAAA;AAAA,gBACF;AAAA,gBACA;AAAA,kBAAC;AAAA;AAAA,oBACC,KAAK;AAAA,oBACL,OAAO;AAAA,oBACP,eAAe,CAAC,SAAS;AACvB,kCAAY,IAAI;AAChB,0BAAI,eAAe,WAAY,eAAc,IAAI;AAAA,oBACnD;AAAA,oBACA,OAAO,eAAe,aAAa,OAAO,gBAAgB;AAAA,oBAC1D;AAAA;AAAA,gBACF;AAAA;AAAA;AAAA,UACF;AAAA,UACC,WAAW,OAAO,KACjB,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,WAEJ;AAAA;AAAA;AAAA,EAEJ;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/account/delete-account-setting.tsx"],"sourcesContent":["import { isValidElement, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, ReactNode } from \"react\";\nimport { UserX } from \"lucide-react\";\n\nimport { useKitLabels, useKitLocale, type LabelOverride } from \"../i18n/kit-labels\";\nimport { cn } from \"../lib/cn\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { hasContent } from \"../lib/presence\";\nimport {\n  CurrentPasswordInput,\n  DangerConfirm,\n  DEFAULT_DANGER_CONFIRM_LABELS,\n  TypedConfirmField,\n  typedMatches,\n} from \"../components/danger-confirm\";\nimport type { DangerConsequence } from \"../components/danger-confirm\";\nimport { Card } from \"../components/card\";\nimport { authErrorCode, isRateLimited, retryAfterSeconds } from \"../auth/auth-errors\";\nimport { useFocusWhen } from \"../auth/status-parts\";\nimport { CARD_DESCRIPTION_CLASS, refusalCompanies, settle, useMounted } from \"./account-parts\";\nimport { SettingsCardTitle } from \"../settings/settings-heading\";\nimport { COMMIT_EXCEPT_BILLING } from \"../components/write-lock\";\nimport { DEFAULT_DELETE_ACCOUNT_LABELS } from \"./delete-account-setting-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/**\n * Every string {@link DeleteAccountSetting} renders — the `deleteAccount` namespace of\n * `<UiKitProvider labels>`, overridable per instance through `labels`. The confirm's\n * Cancel, \"Password\" and \"Type … to confirm\" are `dangerConfirm`'s.\n */\nexport interface DeleteAccountLabels {\n  /** The card's title. */\n  title: string;\n  /** Mode `after_days`, given the days: what happens and when. */\n  afterDays: (days: number) => string;\n  /** Mode `operator`: what happens, and who erases it. */\n  operator: string;\n  /** The button that opens the confirm. */\n  arm: string;\n  /** The confirm's warning, over the consequences. */\n  prompt: string;\n  /** The line in the consequences when `handOverCount` is given (Kurvenschmiede, §2.7),\n   *  given the count. */\n  handOver: (count: number) => string;\n  /** The button that sends it. */\n  confirm: string;\n  /** Said once the request is accepted — the app signs out next. */\n  done: string;\n  /** `password_incorrect` (server-kit's `400` for a wrong current password), under the\n   *  password field. */\n  wrongPassword: string;\n  /** `confirmation_mismatch` — the server did not take the typed address as the\n   *  account's — under the address field. */\n  confirmationMismatch: string;\n  /** `last_admin` — the account is the last active admin. */\n  lastAdmin: string;\n  /** `last_admin` naming the companies (kastlan checks per company), given them as one\n   *  list in the reader's language (\"Example AG and Sample GmbH\"). */\n  lastAdminOf: (companies: string) => string;\n  /** `household_has_members` — keksdose's guard (§6.4). */\n  householdHasMembers: string;\n  /** A request was throttled — HTTP 429 — given its `Retry-After` wait in seconds, or\n   *  `undefined` without one. */\n  rateLimited: (seconds?: number) => string;\n  /** Any other failure. */\n  failed: string;\n}\n\n// Defined in ./delete-account-setting-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_DELETE_ACCOUNT_LABELS };\n\n/* ── Props ───────────────────────────────────────────────────────────────── */\n\n/** What happens after the deactivation (§2.1, §6.4) — the app's setting. */\nexport type DeletionMode = \"after_days\" | \"operator\";\n\n/** What {@link DeleteAccountSettingProps.onRequest} gets: the `POST /auth/me/deletion`\n *  body. */\nexport interface DeleteAccountValues {\n  /** As typed. */\n  password: string;\n  /** The address as TYPED, trimmed — the server re-checks it against the account\n   *  (server-kit's `confirm_email_matches`), as keksdose's admin actions do. */\n  confirmEmail: string;\n}\n\n/** One line of the consequences: a node of the app's, or a {@link DangerConsequence}\n *  for a key of its own and the `severe` mark. */\nexport type DeleteAccountConsequence = ReactNode | DangerConsequence;\n\nexport interface DeleteAccountSettingProps extends Omit<ComponentPropsWithRef<\"div\">, \"children\"> {\n  /** The account's address — the text to type. */\n  email: string;\n  /** `\"after_days\"` (keksdose, Kurvenschmiede: erased by a scheduled job) or\n   *  `\"operator\"` (kastlan: company data is involved, an operator erases it). */\n  mode: DeletionMode;\n  /** With `after_days`: how many. Default 30 (§2.1). */\n  days?: number;\n  /**\n   * What goes, in the app's words (§6.4: \"the app's own list\") — derived from the\n   * account's own facts where it can be: keksdose's \"Budget X will be deleted; its 2\n   * guests are told\", rather than the worst case for everybody.\n   */\n  consequences?: readonly DeleteAccountConsequence[];\n  /** Kurvenschmiede (§2.7): how many owned items others can see — they pass to the\n   *  first active admin at erasure. A line of its own in the consequences; 0 or left\n   *  out, none. */\n  handOverCount?: number;\n  /**\n   * The confirm was answered: send `POST /auth/me/deletion {password, confirm_email}`.\n   * Resolve once it is accepted — the card says \"You are being signed out\" — and then\n   * sign the user out: the server ended every session with the deactivation. Reject\n   * with the client's error: `password_incorrect` under the password,\n   * `confirmation_mismatch` under the address, `last_admin` (with kastlan's\n   * `companies`) and `household_has_members` above the buttons, a 429 as\n   * `rateLimited`, anything else (a demo account's 403, an app's own code) through\n   * `describeError`, else `failed`. The confirm stays open with what was typed, for a\n   * retry.\n   */\n  onRequest: (values: DeleteAccountValues) => Promise<unknown> | void;\n  /** The app's own words for a failure, or `undefined` for the kit's. Asked first, for\n   *  every failure — kastlan's `last_admin` names the companies. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  labels?: LabelOverride<DeleteAccountLabels>;\n}\n\n/** Whether an item is a `{ text }` line rather than a node — a React element is an\n *  object too, and so would a `{ text }` lookalike be, so the element test comes first. */\nfunction isConsequence(item: DeleteAccountConsequence): item is DangerConsequence {\n  return typeof item === \"object\" && item !== null && !isValidElement(item) && \"text\" in item;\n}\n\n/**\n * Deleting one's own account (docs/user-admin-harmonization.md §6.4, §2.1): what it does,\n * the password, the typed address — then the app signs out.\n *\n * **Two stages, said before the button.** The request DEACTIVATES the account at once\n * (no sign-in, every session ended, marked for deletion); the erasure follows per the\n * app's `mode` — \"erased for good 30 days later\" (`after_days`, a scheduled job) or \"an\n * operator will erase it\" (`operator`, kastlan, where company records are involved).\n * The sentence is under the title, so it is read before anything is pressed.\n *\n * **The confirm is a {@link DangerConfirm}** with the two guards of every \"type the\n * address\" rule in the apps: the address typed (compared caseless, as in all of them)\n * and the password. They are the tile's own {@link TypedConfirmField} and\n * {@link CurrentPasswordInput}, drawn in its fields slot and held by\n * `confirmDisabledReason` with the tile's own sentences, rather than its built-in\n * `phrase` / `requirePassword` — those have no error of their own, and a wrong password\n * belongs under the password. Its consequences are the app's list, plus\n * Kurvenschmiede's hand-over line (`handOverCount`, §2.7: shared work goes to an\n * administrator, never a refusal). The typed address goes to `onRequest` as typed, so\n * the server re-checks it (`confirm_email_matches`).\n *\n * **Refusals** (§6.4) are read by code ({@link authErrorCode}): `password_incorrect` (a\n * `400`, so an app's 401 handling never signs the person out over a typo) under the\n * password, `confirmation_mismatch` under the address, `last_admin` — naming kastlan's\n * companies when the answer lists them — and keksdose's `household_has_members` guard\n * above the buttons; a 429; and the rest in the app's words. The confirm stays open with\n * what was typed, for a retry; Cancel wipes it.\n *\n * **After success** the card says the account is deactivated and the person is being\n * signed out — the app's to do, since the kit sends nothing (auth §8).\n *\n * **Under a write lock** the confirm is a `commit` exempt from billing\n * (`COMMIT_EXCEPT_BILLING`, 0.33): leaving never depends on paying\n * (docs/billing-harmonization.md decision 14, §12.36); a demo's lock still holds it.\n */\nexport function DeleteAccountSetting({\n  email,\n  mode,\n  days = 30,\n  consequences,\n  handOverCount,\n  onRequest,\n  describeError,\n  labels: labelsProp,\n  className,\n  ...rest\n}: DeleteAccountSettingProps) {\n  const labels = useKitLabels(\"deleteAccount\", DEFAULT_DELETE_ACCOUNT_LABELS, labelsProp);\n  // The guards speak the tile's words, so \"Type “…” to confirm\" and \"Enter your password\n  // to confirm\" are translated once, in `dangerConfirm`.\n  const guardLabels = useKitLabels(\"dangerConfirm\", DEFAULT_DANGER_CONFIRM_LABELS);\n  const locale = useKitLocale();\n  const [typed, setTyped] = useState(\"\");\n  const [password, setPassword] = useState(\"\");\n  const [busy, setBusy] = useState(false);\n  const [fieldError, setFieldError] = useState<\"email\" | \"password\" | null>(null);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const [done, setDone] = useState(false);\n  const mounted = useMounted();\n  const typedRef = useRef<HTMLInputElement>(null);\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  // The tile went with the press; the answer takes the focus, so it is read out.\n  useFocusWhen(done, doneRef);\n\n  const modeSentence = mode === \"operator\" ? labels.operator : labels.afterDays(days);\n\n  const lines: (string | DangerConsequence)[] = (consequences ?? [])\n    // `{cond && \"…\"}` lines that came out empty are no lines.\n    .filter((item) => item !== null && item !== undefined && item !== false && item !== \"\")\n    .map((item, index) => (isConsequence(item) ? item : { key: `app-${index}`, text: item }));\n  if (handOverCount !== undefined && handOverCount > 0) {\n    lines.push({ key: \"hand-over\", text: labels.handOver(handOverCount) });\n  }\n\n  // The first guard still open, in the order the fields are drawn — DangerConfirm's rule.\n  const held = !typedMatches(typed, email, \"caseless\")\n    ? typeof guardLabels.needsPhrase === \"function\"\n      ? guardLabels.needsPhrase(email)\n      : guardLabels.needsPhrase\n    : password === \"\"\n      ? guardLabels.needsPassword\n      : undefined;\n\n  const present = (error: unknown) => {\n    const own = describeError?.(error);\n    if (hasContent(own)) {\n      setFailure(own);\n      return;\n    }\n    if (isRateLimited(error)) {\n      setFailure(labels.rateLimited(retryAfterSeconds(error)));\n      return;\n    }\n    const code = authErrorCode(error);\n    // `invalid_credentials` too, for a server that answered a wrong password so before\n    // server-kit 0.4.0 named `password_incorrect`.\n    if (code === \"password_incorrect\" || code === \"invalid_credentials\") {\n      setFieldError(\"password\");\n      passwordRef.current?.focus();\n      return;\n    }\n    if (code === \"confirmation_mismatch\" || code === \"confirmation_required\") {\n      setFieldError(\"email\");\n      typedRef.current?.focus();\n      return;\n    }\n    if (code === \"last_admin\") {\n      const companies = refusalCompanies(error);\n      setFailure(\n        companies\n          ? labels.lastAdminOf(new Intl.ListFormat(locale, { type: \"conjunction\" }).format(companies))\n          : labels.lastAdmin,\n      );\n      return;\n    }\n    setFailure(code === \"household_has_members\" ? labels.householdHasMembers : labels.failed);\n  };\n\n  const confirm = () => {\n    setFailure(null);\n    setFieldError(null);\n    setBusy(true);\n    const values: DeleteAccountValues = { password, confirmEmail: typed.trim() };\n    return settle(() => onRequest(values)).then(\n      () => {\n        if (!mounted.current) return;\n        setBusy(false);\n        setDone(true);\n      },\n      (error: unknown) => {\n        if (mounted.current) {\n          setBusy(false);\n          present(error);\n        }\n        // Rejected again, so DangerConfirm stays armed with what was typed.\n        throw error;\n      },\n    );\n  };\n\n  // A disarmed tile holds no password — DangerConfirm's own rule, for the fields it\n  // does not own here.\n  const disarmed = (armed: boolean) => {\n    if (armed) return;\n    setTyped(\"\");\n    setPassword(\"\");\n    setFieldError(null);\n    setFailure(null);\n  };\n\n  return (\n    <Card {...rest} data-state={done ? \"done\" : \"form\"} tone=\"danger\" className={cn(\"p-4 space-y-3\", className)}>\n      <div>\n        <SettingsCardTitle>{labels.title}</SettingsCardTitle>\n        <div className={CARD_DESCRIPTION_CLASS}>{modeSentence}</div>\n      </div>\n      {done ? (\n        <div ref={doneRef} tabIndex={-1} role=\"status\" className=\"flex items-start gap-2 text-sm outline-none\">\n          <UserX aria-hidden className=\"mt-0.5 size-4 shrink-0 text-muted\" />\n          <span>{labels.done}</span>\n        </div>\n      ) : (\n        <>\n          <DangerConfirm\n            commit={COMMIT_EXCEPT_BILLING}\n            armLabel={labels.arm}\n            prompt={labels.prompt}\n            consequences={lines}\n            confirmLabel={labels.confirm}\n            confirmDisabledReason={held}\n            busy={busy}\n            onArmedChange={disarmed}\n            onConfirm={confirm}\n          >\n            <TypedConfirmField\n              ref={typedRef}\n              target={email}\n              match=\"caseless\"\n              value={typed}\n              onValueChange={(next) => {\n                setTyped(next);\n                if (fieldError === \"email\") setFieldError(null);\n              }}\n              error={fieldError === \"email\" ? labels.confirmationMismatch : undefined}\n              busy={busy}\n            />\n            <CurrentPasswordInput\n              ref={passwordRef}\n              value={password}\n              onValueChange={(next) => {\n                setPassword(next);\n                if (fieldError === \"password\") setFieldError(null);\n              }}\n              error={fieldError === \"password\" ? labels.wrongPassword : undefined}\n              busy={busy}\n            />\n          </DangerConfirm>\n          {hasContent(failure) && (\n            <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n              {failure}\n            </AlertBanner>\n          )}\n        </>\n      )}\n    </Card>\n  );\n}\n"],"mappings":";AA8RM,SAUE,UATA,KADF;AA9RN,SAAS,gBAAgB,QAAQ,gBAAgB;AAEjD,SAAS,aAAa;AAEtB,SAAS,cAAc,oBAAwC;AAC/D,SAAS,UAAU;AACnB,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,YAAY;AACrB,SAAS,eAAe,eAAe,yBAAyB;AAChE,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,kBAAkB,QAAQ,kBAAkB;AAC7E,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,qCAAqC;AA2G9C,SAAS,cAAc,MAA2D;AAChF,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,eAAe,IAAI,KAAK,UAAU;AACzF;AAqCO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA8B;AAC5B,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,cAAc,aAAa,iBAAiB,6BAA6B;AAC/E,QAAM,SAAS,aAAa;AAC5B,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,CAAC,YAAY,aAAa,IAAI,SAAsC,IAAI;AAC9E,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,WAAW;AAC3B,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAE3C,eAAa,MAAM,OAAO;AAE1B,QAAM,eAAe,SAAS,aAAa,OAAO,WAAW,OAAO,UAAU,IAAI;AAElF,QAAM,SAAyC,gBAAgB,CAAC,GAE7D,OAAO,CAAC,SAAS,SAAS,QAAQ,SAAS,UAAa,SAAS,SAAS,SAAS,EAAE,EACrF,IAAI,CAAC,MAAM,UAAW,cAAc,IAAI,IAAI,OAAO,EAAE,KAAK,OAAO,KAAK,IAAI,MAAM,KAAK,CAAE;AAC1F,MAAI,kBAAkB,UAAa,gBAAgB,GAAG;AACpD,UAAM,KAAK,EAAE,KAAK,aAAa,MAAM,OAAO,SAAS,aAAa,EAAE,CAAC;AAAA,EACvE;AAGA,QAAM,OAAO,CAAC,aAAa,OAAO,OAAO,UAAU,IAC/C,OAAO,YAAY,gBAAgB,aACjC,YAAY,YAAY,KAAK,IAC7B,YAAY,cACd,aAAa,KACX,YAAY,gBACZ;AAEN,QAAM,UAAU,CAAC,UAAmB;AAClC,UAAM,MAAM,gBAAgB,KAAK;AACjC,QAAI,WAAW,GAAG,GAAG;AACnB,iBAAW,GAAG;AACd;AAAA,IACF;AACA,QAAI,cAAc,KAAK,GAAG;AACxB,iBAAW,OAAO,YAAY,kBAAkB,KAAK,CAAC,CAAC;AACvD;AAAA,IACF;AACA,UAAM,OAAO,cAAc,KAAK;AAGhC,QAAI,SAAS,wBAAwB,SAAS,uBAAuB;AACnE,oBAAc,UAAU;AACxB,kBAAY,SAAS,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,SAAS,2BAA2B,SAAS,yBAAyB;AACxE,oBAAc,OAAO;AACrB,eAAS,SAAS,MAAM;AACxB;AAAA,IACF;AACA,QAAI,SAAS,cAAc;AACzB,YAAM,YAAY,iBAAiB,KAAK;AACxC;AAAA,QACE,YACI,OAAO,YAAY,IAAI,KAAK,WAAW,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,OAAO,SAAS,CAAC,IACzF,OAAO;AAAA,MACb;AACA;AAAA,IACF;AACA,eAAW,SAAS,0BAA0B,OAAO,sBAAsB,OAAO,MAAM;AAAA,EAC1F;AAEA,QAAM,UAAU,MAAM;AACpB,eAAW,IAAI;AACf,kBAAc,IAAI;AAClB,YAAQ,IAAI;AACZ,UAAM,SAA8B,EAAE,UAAU,cAAc,MAAM,KAAK,EAAE;AAC3E,WAAO,OAAO,MAAM,UAAU,MAAM,CAAC,EAAE;AAAA,MACrC,MAAM;AACJ,YAAI,CAAC,QAAQ,QAAS;AACtB,gBAAQ,KAAK;AACb,gBAAQ,IAAI;AAAA,MACd;AAAA,MACA,CAAC,UAAmB;AAClB,YAAI,QAAQ,SAAS;AACnB,kBAAQ,KAAK;AACb,kBAAQ,KAAK;AAAA,QACf;AAEA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,QAAM,WAAW,CAAC,UAAmB;AACnC,QAAI,MAAO;AACX,aAAS,EAAE;AACX,gBAAY,EAAE;AACd,kBAAc,IAAI;AAClB,eAAW,IAAI;AAAA,EACjB;AAEA,SACE,qBAAC,QAAM,GAAG,MAAM,cAAY,OAAO,SAAS,QAAQ,MAAK,UAAS,WAAW,GAAG,iBAAiB,SAAS,GACxG;AAAA,yBAAC,SACC;AAAA,0BAAC,qBAAmB,iBAAO,OAAM;AAAA,MACjC,oBAAC,SAAI,WAAW,wBAAyB,wBAAa;AAAA,OACxD;AAAA,IACC,OACC,qBAAC,SAAI,KAAK,SAAS,UAAU,IAAI,MAAK,UAAS,WAAU,+CACvD;AAAA,0BAAC,SAAM,eAAW,MAAC,WAAU,qCAAoC;AAAA,MACjE,oBAAC,UAAM,iBAAO,MAAK;AAAA,OACrB,IAEA,iCACE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,QAAQ;AAAA,UACR,UAAU,OAAO;AAAA,UACjB,QAAQ,OAAO;AAAA,UACf,cAAc;AAAA,UACd,cAAc,OAAO;AAAA,UACrB,uBAAuB;AAAA,UACvB;AAAA,UACA,eAAe;AAAA,UACf,WAAW;AAAA,UAEX;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,QAAQ;AAAA,gBACR,OAAM;AAAA,gBACN,OAAO;AAAA,gBACP,eAAe,CAAC,SAAS;AACvB,2BAAS,IAAI;AACb,sBAAI,eAAe,QAAS,eAAc,IAAI;AAAA,gBAChD;AAAA,gBACA,OAAO,eAAe,UAAU,OAAO,uBAAuB;AAAA,gBAC9D;AAAA;AAAA,YACF;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,OAAO;AAAA,gBACP,eAAe,CAAC,SAAS;AACvB,8BAAY,IAAI;AAChB,sBAAI,eAAe,WAAY,eAAc,IAAI;AAAA,gBACnD;AAAA,gBACA,OAAO,eAAe,aAAa,OAAO,gBAAgB;AAAA,gBAC1D;AAAA;AAAA,YACF;AAAA;AAAA;AAAA,MACF;AAAA,MACC,WAAW,OAAO,KACjB,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,OAEJ;AAAA,KAEJ;AAEJ;","names":[]}

package/dist/account/email-change-setting-labels.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/account/email-change-setting-labels.ts"],"sourcesContent":["// The English words of ./email-change-setting, in a module with no component code: the\n// English catalogue (src/i18n/defaults.ts) imports them without the component, so `en`\n// loads as one chunk like the other languages (0.34, KS U8). ./email-change-setting\n// re-exports them.\n\nimport { englishRateLimited } from \"../auth/auth-errors\";\nimport type { EmailChangeLabels } from \"./email-change-setting\";\n\nexport const DEFAULT_EMAIL_CHANGE_LABELS: EmailChangeLabels = {\n  title: \"Email address\",\n  current: \"Current address\",\n  newEmail: \"New email address\",\n  password: \"Current password\",\n  passwordHint: \"Your address is how you sign in, so changing it takes your password.\",\n  emailTagUse: (address) => `Use ${address}`,\n  emailTagHint:\n    \"Many providers deliver name+tag@… to the same inbox, so mail from this app is easy to filter and trace. Check yours does before you rely on it: you would sign in with the tagged address.\",\n  submit: \"Change email address\",\n  sameAsCurrent: \"This is already your address.\",\n  emailTaken: \"An account with this email address already exists.\",\n  wrongPassword: \"The password is incorrect.\",\n  pending: (newEmail) => `Confirm the link we sent to ${newEmail}.`,\n  pendingHint: (currentEmail) =>\n    `Until you do, you keep signing in with ${currentEmail}. Check your spam folder too.`,\n  resend: \"Send the link again\",\n  resent: \"We sent the link again.\",\n  cancel: \"Cancel the change\",\n  confirmed: (email) => `Your email address is now ${email}.`,\n  passkeyNote: \"Your passkeys keep working. Your device may still list them under your old address.\",\n  rateLimited: englishRateLimited,\n  failed: \"That didn’t work. Please try again.\",\n};\n"],"mappings":";AAKA,SAAS,0BAA0B;AAG5B,MAAM,8BAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,cAAc;AAAA,EACd,aAAa,CAAC,YAAY,OAAO,OAAO;AAAA,EACxC,cACE;AAAA,EACF,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,SAAS,CAAC,aAAa,+BAA+B,QAAQ;AAAA,EAC9D,aAAa,CAAC,iBACZ,0CAA0C,YAAY;AAAA,EACxD,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,WAAW,CAAC,UAAU,6BAA6B,KAAK;AAAA,EACxD,aAAa;AAAA,EACb,aAAa;AAAA,EACb,QAAQ;AACV;","names":[]}
+{"version":3,"sources":["../../src/account/email-change-setting-labels.ts"],"sourcesContent":["// The English words of ./email-change-setting, in a module with no component code: the\n// English catalogue (src/i18n/defaults.ts) imports them without the component, so `en`\n// loads as one chunk like the other languages (0.34, KS U8). ./email-change-setting\n// re-exports them.\n\nimport { englishRateLimited } from \"../auth/auth-errors\";\nimport type { EmailChangeLabels } from \"./email-change-setting\";\n\nexport const DEFAULT_EMAIL_CHANGE_LABELS: EmailChangeLabels = {\n  title: \"Email address\",\n  current: \"Current address\",\n  newEmail: \"New email address\",\n  password: \"Current password\",\n  passwordHint: \"Your address is how you sign in, so changing it takes your password.\",\n  emailTagUse: (address) => `Use ${address}`,\n  emailTagHint:\n    \"Many providers deliver name+tag@… to the same inbox, so mail from this app is easy to filter and trace. Check yours does before you rely on it: you would sign in with the tagged address.\",\n  submit: \"Change email address\",\n  sameAsCurrent: \"This is already your address.\",\n  emailTaken: \"An account with this email address already exists.\",\n  wrongPassword: \"The password is incorrect.\",\n  pending: (newEmail) => `Confirm the link we sent to ${newEmail}.`,\n  pendingHint: (currentEmail) => `Until you do, you keep signing in with ${currentEmail}. Check your spam folder too.`,\n  resend: \"Send the link again\",\n  resent: \"We sent the link again.\",\n  cancel: \"Cancel the change\",\n  confirmed: (email) => `Your email address is now ${email}.`,\n  passkeyNote: \"Your passkeys keep working. Your device may still list them under your old address.\",\n  rateLimited: englishRateLimited,\n  failed: \"That didn’t work. Please try again.\",\n};\n"],"mappings":";AAKA,SAAS,0BAA0B;AAG5B,MAAM,8BAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,cAAc;AAAA,EACd,aAAa,CAAC,YAAY,OAAO,OAAO;AAAA,EACxC,cACE;AAAA,EACF,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,SAAS,CAAC,aAAa,+BAA+B,QAAQ;AAAA,EAC9D,aAAa,CAAC,iBAAiB,0CAA0C,YAAY;AAAA,EACrF,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,WAAW,CAAC,UAAU,6BAA6B,KAAK;AAAA,EACxD,aAAa;AAAA,EACb,aAAa;AAAA,EACb,QAAQ;AACV;","names":[]}