@eifi1/ui-kit 0.51.4 → 0.51.6

package/dist/admin/mail-test-card.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/admin/mail-test-card.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { Send } from \"lucide-react\";\n\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { isRateLimited, retryAfterSeconds } from \"../auth/auth-errors\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { Button } from \"../components/button\";\nimport { Chip } from \"../components/chip\";\nimport { SettingsSection, type SettingsSectionProps } from \"../settings/settings-section\";\nimport { DEFAULT_MAIL_TEST_CARD_LABELS } from \"./mail-test-card-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string {@link MailTestCard} renders — the `mailTestCard` namespace of\n *  `<UiKitProvider labels>`, overridable per instance through `labels`\n *  (docs/admin-harmonization.md §9.2.4). */\nexport interface MailTestCardLabels {\n  /** The card's title, and the app's catalogue entry's. */\n  title: string;\n  /** The sentence under it. */\n  description: string;\n  /** The transport's chip: \"Transport: resend\". `backend` is the server's `mail_backend`. */\n  transport: (backend: string) => string;\n  /** The button. */\n  action: string;\n  /** The answer said \"sent\" through a real transport. `address` is masked (\"a…@example.com\"). */\n  sent: (address: string) => string;\n  /** `mail_backend` is `console`: said whatever `sent` is — a console answers `true`. */\n  console: string;\n  /** Not sent, or the request failed. The provider's error stays in the server log. */\n  failed: string;\n  /** HTTP 429 — the app's limiter (server-kit's `MAIL_TEST_LIMIT`, 3 per 10 minutes);\n   *  `seconds` from `Retry-After` when the response has one. */\n  rateLimited: (seconds?: number) => string;\n  /** For the app's catalogue entry (`keywords`); the card never reads it. */\n  keywords: string;\n}\n\n// Defined in ./mail-test-card-labels, which holds no component code.\nexport { DEFAULT_MAIL_TEST_CARD_LABELS };\n\n/* ── The card ────────────────────────────────────────────────────────────── */\n\n/** The answer of `POST /admin/mail/test` — server-kit 0.15's `MailTestResult`. */\nexport interface MailTestAnswer {\n  sent: boolean;\n  /** The transport that took it: `console`, `resend`, `smtp`, … */\n  mail_backend: string;\n}\n\n/** The card's default DOM id: its catalogue entry's `anchor`, the `?focus=` target. */\nexport const MAIL_TEST_ANCHOR = \"admin-mail-test\";\n\nexport interface MailTestCardProps\n  extends Omit<SettingsSectionProps, \"anchor\" | \"title\" | \"description\" | \"children\"> {\n  /** The installation's transport, as the admin page has it (`mail_backend`): the chip\n   *  before a send. After one, the answer's. Optional (0.46): without it the chip shows\n   *  from the first answer on, and an app needs no query only for the chip. */\n  mailBackend?: string;\n  /** The app's `POST /admin/mail/test` (kastlan `/platform/mail/test`), no body: it\n   *  awaits the app's own send and answers `{sent, mail_backend}`. A rejection is read\n   *  for a 429 (the limiter); anything else is \"could not send\". */\n  send: () => Promise<MailTestAnswer>;\n  /** The signed-in admin's own address — where the mail goes. Shown masked. */\n  address: string;\n  /** Default {@link MAIL_TEST_ANCHOR}; the app's catalogue entry names the same. */\n  anchor?: string;\n  /** The app's sentence after the kit's description. */\n  description?: ReactNode;\n  labels?: LabelOverride<MailTestCardLabels>;\n}\n\n/**\n * An address with its local part masked to its first character: \"ada@example.com\" →\n * \"a…@example.com\". The domain stays, so the admin sees which mailbox to open.\n */\nexport function maskMailAddress(address: string): string {\n  const text = address.trim();\n  const at = text.lastIndexOf(\"@\");\n  if (at <= 0) return text === \"\" ? \"\" : `${Array.from(text)[0]}…`;\n  return `${Array.from(text.slice(0, at))[0]}…${text.slice(at)}`;\n}\n\ntype Outcome =\n  | { kind: \"sent\"; backend: string }\n  | { kind: \"console\"; backend: string }\n  | { kind: \"failed\"; backend?: string }\n  | { kind: \"limited\"; seconds?: number };\n\n/**\n * \"Send a test mail to me\" (docs/admin-harmonization.md §9.2): a `SettingsSection` with a\n * sentence, the transport as a chip, the button and the result line. One mail goes to the\n * signed-in admin's own address, never another, through the app's own send.\n *\n * **The result line reads `mail_backend` first**: with `console` it says \"nothing was sent\"\n * whatever `sent` is, since every console path answers `true` (§9.2 Today). Otherwise\n * `sent` says \"Sent to a…@example.com. Check the inbox.\" or \"Could not send.\" — the\n * provider's error stays in the server log (§9.2.7). A 429 says the limiter's line. The\n * button is busy while the request runs; the line is a live region.\n *\n * Not a commit: the test writes nothing, so it is not under the write lock (a demo never\n * reaches the admin area, and the server refuses it anyway). The app adds the catalogue\n * entry `{ id, anchor: MAIL_TEST_ANCHOR, title, keywords }` from these labels.\n */\nexport function MailTestCard({\n  mailBackend,\n  send,\n  address,\n  anchor = MAIL_TEST_ANCHOR,\n  description,\n  labels: labelsProp,\n  ...rest\n}: MailTestCardProps) {\n  const labels = useKitLabels(\"mailTestCard\", DEFAULT_MAIL_TEST_CARD_LABELS, labelsProp);\n  const [busy, setBusy] = useState(false);\n  const [outcome, setOutcome] = useState<Outcome | null>(null);\n  // The last transport an answer named: a later send with no answer (429, network) keeps it.\n  const [answered, setAnswered] = useState<string | undefined>(undefined);\n\n  const run = async () => {\n    if (busy) return;\n    setBusy(true);\n    setOutcome(null);\n    try {\n      const answer = await send();\n      const backend = answer.mail_backend;\n      if (backend) setAnswered(backend);\n      if (backend === \"console\") setOutcome({ kind: \"console\", backend });\n      else setOutcome(answer.sent ? { kind: \"sent\", backend } : { kind: \"failed\", backend });\n    } catch (error) {\n      setOutcome(isRateLimited(error) ? { kind: \"limited\", seconds: retryAfterSeconds(error) } : { kind: \"failed\" });\n    } finally {\n      setBusy(false);\n    }\n  };\n\n  const backend = answered ?? mailBackend;\n\n  return (\n    <SettingsSection\n      {...rest}\n      anchor={anchor}\n      title={labels.title}\n      description={\n        description != null ? (\n          <>\n            {labels.description} {description}\n          </>\n        ) : (\n          labels.description\n        )\n      }\n    >\n      <div className=\"space-y-2\">\n        <div className=\"flex flex-wrap items-center gap-2\">\n          <Button variant=\"secondary\" pending={busy} onClick={() => void run()}>\n            <Send className=\"size-4\" aria-hidden />\n            {labels.action}\n          </Button>\n          {backend && (\n            <Chip size=\"sm\" data-slot=\"mail-backend\">\n              {labels.transport(backend)}\n            </Chip>\n          )}\n        </div>\n        {outcome?.kind === \"sent\" && (\n          <AlertBanner variant=\"inline\" block tone=\"success\">\n            <span data-private>{labels.sent(maskMailAddress(address))}</span>\n          </AlertBanner>\n        )}\n        {outcome?.kind === \"console\" && (\n          <AlertBanner variant=\"inline\" block tone=\"info\">\n            {labels.console}\n          </AlertBanner>\n        )}\n        {outcome?.kind === \"failed\" && (\n          <AlertBanner variant=\"inline\" block tone=\"danger\">\n            {labels.failed}\n          </AlertBanner>\n        )}\n        {outcome?.kind === \"limited\" && (\n          <AlertBanner variant=\"inline\" block tone=\"warning\">\n            {labels.rateLimited(outcome.seconds)}\n          </AlertBanner>\n        )}\n      </div>\n    </SettingsSection>\n  );\n}\n"],"mappings":";AAkJU,mBAWE,KAXF;AAlJV,SAAS,gBAAgB;AAEzB,SAAS,YAAY;AAErB,SAAS,oBAAwC;AACjD,SAAS,eAAe,yBAAyB;AACjD,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,uBAAkD;AAC3D,SAAS,qCAAqC;AA0CvC,MAAM,mBAAmB;AAyBzB,SAAS,gBAAgB,SAAyB;AACvD,QAAM,OAAO,QAAQ,KAAK;AAC1B,QAAM,KAAK,KAAK,YAAY,GAAG;AAC/B,MAAI,MAAM,EAAG,QAAO,SAAS,KAAK,KAAK,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;AAC7D,SAAO,GAAG,MAAM,KAAK,KAAK,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,SAAI,KAAK,MAAM,EAAE,CAAC;AAC9D;AAuBO,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA,SAAS;AAAA,EACT;AAAA,EACA,QAAQ;AAAA,EACR,GAAG;AACL,GAAsB;AACpB,QAAM,SAAS,aAAa,gBAAgB,+BAA+B,UAAU;AACrF,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAyB,IAAI;AAE3D,QAAM,CAAC,UAAU,WAAW,IAAI,SAA6B,MAAS;AAEtE,QAAM,MAAM,YAAY;AACtB,QAAI,KAAM;AACV,YAAQ,IAAI;AACZ,eAAW,IAAI;AACf,QAAI;AACF,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAMA,WAAU,OAAO;AACvB,UAAIA,SAAS,aAAYA,QAAO;AAChC,UAAIA,aAAY,UAAW,YAAW,EAAE,MAAM,WAAW,SAAAA,SAAQ,CAAC;AAAA,UAC7D,YAAW,OAAO,OAAO,EAAE,MAAM,QAAQ,SAAAA,SAAQ,IAAI,EAAE,MAAM,UAAU,SAAAA,SAAQ,CAAC;AAAA,IACvF,SAAS,OAAO;AACd,iBAAW,cAAc,KAAK,IAAI,EAAE,MAAM,WAAW,SAAS,kBAAkB,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAAA,IAC/G,UAAE;AACA,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAEA,QAAM,UAAU,YAAY;AAE5B,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ;AAAA,MACA,OAAO,OAAO;AAAA,MACd,aACE,eAAe,OACb,iCACG;AAAA,eAAO;AAAA,QAAY;AAAA,QAAE;AAAA,SACxB,IAEA,OAAO;AAAA,MAIX,+BAAC,SAAI,WAAU,aACb;AAAA,6BAAC,SAAI,WAAU,qCACb;AAAA,+BAAC,UAAO,SAAQ,aAAY,SAAS,MAAM,SAAS,MAAM,KAAK,IAAI,GACjE;AAAA,gCAAC,QAAK,WAAU,UAAS,eAAW,MAAC;AAAA,YACpC,OAAO;AAAA,aACV;AAAA,UACC,WACC,oBAAC,QAAK,MAAK,MAAK,aAAU,gBACvB,iBAAO,UAAU,OAAO,GAC3B;AAAA,WAEJ;AAAA,QACC,SAAS,SAAS,UACjB,oBAAC,eAAY,SAAQ,UAAS,OAAK,MAAC,MAAK,WACvC,8BAAC,UAAK,gBAAY,MAAE,iBAAO,KAAK,gBAAgB,OAAO,CAAC,GAAE,GAC5D;AAAA,QAED,SAAS,SAAS,aACjB,oBAAC,eAAY,SAAQ,UAAS,OAAK,MAAC,MAAK,QACtC,iBAAO,SACV;AAAA,QAED,SAAS,SAAS,YACjB,oBAAC,eAAY,SAAQ,UAAS,OAAK,MAAC,MAAK,UACtC,iBAAO,QACV;AAAA,QAED,SAAS,SAAS,aACjB,oBAAC,eAAY,SAAQ,UAAS,OAAK,MAAC,MAAK,WACtC,iBAAO,YAAY,QAAQ,OAAO,GACrC;AAAA,SAEJ;AAAA;AAAA,EACF;AAEJ;","names":["backend"]}
+{"version":3,"sources":["../../src/admin/mail-test-card.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { Send } from \"lucide-react\";\n\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { isRateLimited, retryAfterSeconds } from \"../auth/auth-errors\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { Button } from \"../components/button\";\nimport { Chip } from \"../components/chip\";\nimport { SettingsSection, type SettingsSectionProps } from \"../settings/settings-section\";\nimport { DEFAULT_MAIL_TEST_CARD_LABELS } from \"./mail-test-card-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string {@link MailTestCard} renders — the `mailTestCard` namespace of\n *  `<UiKitProvider labels>`, overridable per instance through `labels`\n *  (docs/admin-harmonization.md §9.2.4). */\nexport interface MailTestCardLabels {\n  /** The card's title, and the app's catalogue entry's. */\n  title: string;\n  /** The sentence under it. */\n  description: string;\n  /** The transport's chip: \"Transport: resend\". `backend` is the server's `mail_backend`. */\n  transport: (backend: string) => string;\n  /** The button. */\n  action: string;\n  /** The answer said \"sent\" through a real transport. `address` is masked (\"a…@example.com\"). */\n  sent: (address: string) => string;\n  /** `mail_backend` is `console`: said whatever `sent` is — a console answers `true`. */\n  console: string;\n  /** Not sent, or the request failed. The provider's error stays in the server log. */\n  failed: string;\n  /** HTTP 429 — the app's limiter (server-kit's `MAIL_TEST_LIMIT`, 3 per 10 minutes);\n   *  `seconds` from `Retry-After` when the response has one. */\n  rateLimited: (seconds?: number) => string;\n  /** For the app's catalogue entry (`keywords`); the card never reads it. */\n  keywords: string;\n}\n\n// Defined in ./mail-test-card-labels, which holds no component code.\nexport { DEFAULT_MAIL_TEST_CARD_LABELS };\n\n/* ── The card ────────────────────────────────────────────────────────────── */\n\n/** The answer of `POST /admin/mail/test` — server-kit 0.15's `MailTestResult`. */\nexport interface MailTestAnswer {\n  sent: boolean;\n  /** The transport that took it: `console`, `resend`, `smtp`, … */\n  mail_backend: string;\n}\n\n/** The card's default DOM id: its catalogue entry's `anchor`, the `?focus=` target. */\nexport const MAIL_TEST_ANCHOR = \"admin-mail-test\";\n\nexport interface MailTestCardProps extends Omit<SettingsSectionProps, \"anchor\" | \"title\" | \"description\" | \"children\"> {\n  /** The installation's transport, as the admin page has it (`mail_backend`): the chip\n   *  before a send. After one, the answer's. Optional (0.46): without it the chip shows\n   *  from the first answer on, and an app needs no query only for the chip. */\n  mailBackend?: string;\n  /** The app's `POST /admin/mail/test` (kastlan `/platform/mail/test`), no body: it\n   *  awaits the app's own send and answers `{sent, mail_backend}`. A rejection is read\n   *  for a 429 (the limiter); anything else is \"could not send\". */\n  send: () => Promise<MailTestAnswer>;\n  /** The signed-in admin's own address — where the mail goes. Shown masked. */\n  address: string;\n  /** Default {@link MAIL_TEST_ANCHOR}; the app's catalogue entry names the same. */\n  anchor?: string;\n  /** The app's sentence after the kit's description. */\n  description?: ReactNode;\n  labels?: LabelOverride<MailTestCardLabels>;\n}\n\n/**\n * An address with its local part masked to its first character: \"ada@example.com\" →\n * \"a…@example.com\". The domain stays, so the admin sees which mailbox to open.\n */\nexport function maskMailAddress(address: string): string {\n  const text = address.trim();\n  const at = text.lastIndexOf(\"@\");\n  if (at <= 0) return text === \"\" ? \"\" : `${Array.from(text)[0]}…`;\n  return `${Array.from(text.slice(0, at))[0]}…${text.slice(at)}`;\n}\n\ntype Outcome =\n  | { kind: \"sent\"; backend: string }\n  | { kind: \"console\"; backend: string }\n  | { kind: \"failed\"; backend?: string }\n  | { kind: \"limited\"; seconds?: number };\n\n/**\n * \"Send a test mail to me\" (docs/admin-harmonization.md §9.2): a `SettingsSection` with a\n * sentence, the transport as a chip, the button and the result line. One mail goes to the\n * signed-in admin's own address, never another, through the app's own send.\n *\n * **The result line reads `mail_backend` first**: with `console` it says \"nothing was sent\"\n * whatever `sent` is, since every console path answers `true` (§9.2 Today). Otherwise\n * `sent` says \"Sent to a…@example.com. Check the inbox.\" or \"Could not send.\" — the\n * provider's error stays in the server log (§9.2.7). A 429 says the limiter's line. The\n * button is busy while the request runs; the line is a live region.\n *\n * Not a commit: the test writes nothing, so it is not under the write lock (a demo never\n * reaches the admin area, and the server refuses it anyway). The app adds the catalogue\n * entry `{ id, anchor: MAIL_TEST_ANCHOR, title, keywords }` from these labels.\n */\nexport function MailTestCard({\n  mailBackend,\n  send,\n  address,\n  anchor = MAIL_TEST_ANCHOR,\n  description,\n  labels: labelsProp,\n  ...rest\n}: MailTestCardProps) {\n  const labels = useKitLabels(\"mailTestCard\", DEFAULT_MAIL_TEST_CARD_LABELS, labelsProp);\n  const [busy, setBusy] = useState(false);\n  const [outcome, setOutcome] = useState<Outcome | null>(null);\n  // The last transport an answer named: a later send with no answer (429, network) keeps it.\n  const [answered, setAnswered] = useState<string | undefined>(undefined);\n\n  const run = async () => {\n    if (busy) return;\n    setBusy(true);\n    setOutcome(null);\n    try {\n      const answer = await send();\n      const backend = answer.mail_backend;\n      if (backend) setAnswered(backend);\n      if (backend === \"console\") setOutcome({ kind: \"console\", backend });\n      else setOutcome(answer.sent ? { kind: \"sent\", backend } : { kind: \"failed\", backend });\n    } catch (error) {\n      setOutcome(isRateLimited(error) ? { kind: \"limited\", seconds: retryAfterSeconds(error) } : { kind: \"failed\" });\n    } finally {\n      setBusy(false);\n    }\n  };\n\n  const backend = answered ?? mailBackend;\n\n  return (\n    <SettingsSection\n      {...rest}\n      anchor={anchor}\n      title={labels.title}\n      description={\n        description != null ? (\n          <>\n            {labels.description} {description}\n          </>\n        ) : (\n          labels.description\n        )\n      }\n    >\n      <div className=\"space-y-2\">\n        <div className=\"flex flex-wrap items-center gap-2\">\n          <Button variant=\"secondary\" pending={busy} onClick={() => void run()}>\n            <Send className=\"size-4\" aria-hidden />\n            {labels.action}\n          </Button>\n          {backend && (\n            <Chip size=\"sm\" data-slot=\"mail-backend\">\n              {labels.transport(backend)}\n            </Chip>\n          )}\n        </div>\n        {outcome?.kind === \"sent\" && (\n          <AlertBanner variant=\"inline\" block tone=\"success\">\n            <span data-private>{labels.sent(maskMailAddress(address))}</span>\n          </AlertBanner>\n        )}\n        {outcome?.kind === \"console\" && (\n          <AlertBanner variant=\"inline\" block tone=\"info\">\n            {labels.console}\n          </AlertBanner>\n        )}\n        {outcome?.kind === \"failed\" && (\n          <AlertBanner variant=\"inline\" block tone=\"danger\">\n            {labels.failed}\n          </AlertBanner>\n        )}\n        {outcome?.kind === \"limited\" && (\n          <AlertBanner variant=\"inline\" block tone=\"warning\">\n            {labels.rateLimited(outcome.seconds)}\n          </AlertBanner>\n        )}\n      </div>\n    </SettingsSection>\n  );\n}\n"],"mappings":";AAiJU,mBAWE,KAXF;AAjJV,SAAS,gBAAgB;AAEzB,SAAS,YAAY;AAErB,SAAS,oBAAwC;AACjD,SAAS,eAAe,yBAAyB;AACjD,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,uBAAkD;AAC3D,SAAS,qCAAqC;AA0CvC,MAAM,mBAAmB;AAwBzB,SAAS,gBAAgB,SAAyB;AACvD,QAAM,OAAO,QAAQ,KAAK;AAC1B,QAAM,KAAK,KAAK,YAAY,GAAG;AAC/B,MAAI,MAAM,EAAG,QAAO,SAAS,KAAK,KAAK,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;AAC7D,SAAO,GAAG,MAAM,KAAK,KAAK,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,SAAI,KAAK,MAAM,EAAE,CAAC;AAC9D;AAuBO,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA,SAAS;AAAA,EACT;AAAA,EACA,QAAQ;AAAA,EACR,GAAG;AACL,GAAsB;AACpB,QAAM,SAAS,aAAa,gBAAgB,+BAA+B,UAAU;AACrF,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAyB,IAAI;AAE3D,QAAM,CAAC,UAAU,WAAW,IAAI,SAA6B,MAAS;AAEtE,QAAM,MAAM,YAAY;AACtB,QAAI,KAAM;AACV,YAAQ,IAAI;AACZ,eAAW,IAAI;AACf,QAAI;AACF,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAMA,WAAU,OAAO;AACvB,UAAIA,SAAS,aAAYA,QAAO;AAChC,UAAIA,aAAY,UAAW,YAAW,EAAE,MAAM,WAAW,SAAAA,SAAQ,CAAC;AAAA,UAC7D,YAAW,OAAO,OAAO,EAAE,MAAM,QAAQ,SAAAA,SAAQ,IAAI,EAAE,MAAM,UAAU,SAAAA,SAAQ,CAAC;AAAA,IACvF,SAAS,OAAO;AACd,iBAAW,cAAc,KAAK,IAAI,EAAE,MAAM,WAAW,SAAS,kBAAkB,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAAA,IAC/G,UAAE;AACA,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAEA,QAAM,UAAU,YAAY;AAE5B,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ;AAAA,MACA,OAAO,OAAO;AAAA,MACd,aACE,eAAe,OACb,iCACG;AAAA,eAAO;AAAA,QAAY;AAAA,QAAE;AAAA,SACxB,IAEA,OAAO;AAAA,MAIX,+BAAC,SAAI,WAAU,aACb;AAAA,6BAAC,SAAI,WAAU,qCACb;AAAA,+BAAC,UAAO,SAAQ,aAAY,SAAS,MAAM,SAAS,MAAM,KAAK,IAAI,GACjE;AAAA,gCAAC,QAAK,WAAU,UAAS,eAAW,MAAC;AAAA,YACpC,OAAO;AAAA,aACV;AAAA,UACC,WACC,oBAAC,QAAK,MAAK,MAAK,aAAU,gBACvB,iBAAO,UAAU,OAAO,GAC3B;AAAA,WAEJ;AAAA,QACC,SAAS,SAAS,UACjB,oBAAC,eAAY,SAAQ,UAAS,OAAK,MAAC,MAAK,WACvC,8BAAC,UAAK,gBAAY,MAAE,iBAAO,KAAK,gBAAgB,OAAO,CAAC,GAAE,GAC5D;AAAA,QAED,SAAS,SAAS,aACjB,oBAAC,eAAY,SAAQ,UAAS,OAAK,MAAC,MAAK,QACtC,iBAAO,SACV;AAAA,QAED,SAAS,SAAS,YACjB,oBAAC,eAAY,SAAQ,UAAS,OAAK,MAAC,MAAK,UACtC,iBAAO,QACV;AAAA,QAED,SAAS,SAAS,aACjB,oBAAC,eAAY,SAAQ,UAAS,OAAK,MAAC,MAAK,WACtC,iBAAO,YAAY,QAAQ,OAAO,GACrC;AAAA,SAEJ;AAAA;AAAA,EACF;AAEJ;","names":["backend"]}

package/dist/admin/reviewer-scope-editor.js

@@ -40,7 +40,9 @@ function ReviewerScopeEditor({
   labels: labelsProp
 }) {
   const labels = useKitLabels("reviewerScope", DEFAULT_REVIEWER_SCOPE_LABELS, labelsProp);
-  const areaOptions = areasProp ?? [{ value: "legal", label: labels.legalOnly, hint: labels.legalOnlyHint }];
+  const areaOptions = areasProp ?? [
+    { value: "legal", label: labels.legalOnly, hint: labels.legalOnlyHint }
+  ];
   const savedLocales = [...value.locales ?? []];
   const savedAreas = [...value.areas ?? []];
   const [locales, setLocales] = useState(savedLocales);
@@ -107,16 +109,7 @@ function ReviewerScopeEditor({
       }
     ),
     failure && /* @__PURE__ */ jsx(AlertBanner, { tone: "danger", size: "sm", children: failure }),
-    locked ? /* @__PURE__ */ jsx(Caption, { children: disabledReason }) : /* @__PURE__ */ jsx(
-      FormActions,
-      {
-        onSubmit: save,
-        onCancel,
-        pending,
-        submitDisabled: !dirty,
-        commit
-      }
-    )
+    locked ? /* @__PURE__ */ jsx(Caption, { children: disabledReason }) : /* @__PURE__ */ jsx(FormActions, { onSubmit: save, onCancel, pending, submitDisabled: !dirty, commit })
   ] });
 }
 export {

package/dist/admin/reviewer-scope-editor.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/admin/reviewer-scope-editor.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { KIT_LANGUAGES } from \"../i18n/languages\";\nimport type { KitLanguageCode } from \"../i18n/languages\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { CheckboxGroup } from \"../components/checkbox-group\";\nimport type { CheckboxGroupOption } from \"../components/checkbox-group\";\nimport { FormActions } from \"../components/form-actions\";\nimport { Caption } from \"../components/text\";\nimport { hasContent } from \"../lib/presence\";\nimport type { MaybePromise } from \"./admin-parts\";\nimport type { CommitScope } from \"../components/write-lock\";\nimport { DEFAULT_REVIEWER_SCOPE_LABELS } from \"./reviewer-scope-editor-labels\";\n\n/**\n * Who may review which translations: the REVIEWER role and its scope, in one editor\n * (docs/user-admin-harmonization.md §4.1 `PUT /admin/users/{id}/reviewer {locales, areas}`,\n * §7). It replaces three: keksdose's `user-reviewer-role.tsx` (a checkbox per language,\n * saved on each click), Kurvenschmiede's `reviewer-dialog.tsx` (a `CheckboxGroup` in a\n * dialog with Save) and kastlan's platform column.\n *\n * - **Languages** are the scope. Ticking none takes the role away — that is how both\n *   apps remove a reviewer — and the editor says so under the boxes.\n * - **Areas** narrow it: \"Only the legal pages\" (Imprint, Privacy Policy, Terms) for a\n *   lawyer, who reads law, not French. An area only means something beside at least one\n *   language, so the areas wait for one. Saved as `areas: null` when none is ticked —\n *   server-kit's \"every area\" — never `[]`, which would be \"no area at all\".\n *\n * A draft with Save, not a save per click: keksdose saved every tick, and two quick ticks\n * could land as a set nobody chose; one Save sends the whole scope, in the languages'\n * order (CheckboxGroup's), so the answer equals the request and the row does not\n * reshuffle on refetch. The server keeps its rules (an admin reviews everything already,\n * a customer is not given the role): `disabledReason` says them here.\n */\n\n/** A reviewer's scope — the request body of `PUT …/reviewer`. */\nexport interface ReviewerScope {\n  /** Language codes, in the editor's order. Empty: not a reviewer. */\n  locales: string[];\n  /** The areas the scope is narrowed to; `null` = every area (server-kit's rule). */\n  areas: string[] | null;\n}\n\n/** One area the scope can be narrowed to. */\nexport interface ReviewerScopeArea {\n  value: string;\n  label: ReactNode;\n  hint?: ReactNode;\n}\n\n/** One language the editor offers, when the app's list is not the kit's codes. */\nexport interface ReviewerScopeLanguage {\n  value: string;\n  label: ReactNode;\n}\n\n/** The `reviewerScope` namespace. */\nexport interface ReviewerScopeLabels {\n  /** The language group's legend. */\n  languages: string;\n  /** Under the languages. */\n  hint: string;\n  /** Under the languages while none is ticked. */\n  none: string;\n  /** The area group's legend. */\n  areas: string;\n  /** The default area, `legal`. */\n  legalOnly: string;\n  legalOnlyHint: string;\n  /** A rejected save, unless `describeError` says better. */\n  failed: string;\n}\n\n// Defined in ./reviewer-scope-editor-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_REVIEWER_SCOPE_LABELS };\n\nexport interface ReviewerScopeEditorProps {\n  /** The scope the server has — the draft starts from it. Key the editor by the\n   *  account (`key={user.id}`) so another account starts a fresh draft. */\n  value: { locales?: readonly string[] | null; areas?: readonly string[] | null };\n  /** Sends the scope. A promise keeps the editor busy, and a rejection keeps the draft\n   *  and shows why. */\n  onSave: (scope: ReviewerScope) => MaybePromise;\n  /** A Cancel beside Save — a dialog's way out. */\n  onCancel?: () => void;\n  /**\n   * The languages offered: kit codes (named by the kit's registry, each in its own\n   * language — \"Deutsch\", \"Français\") or the app's own `{ value, label }` rows. Default:\n   * all seven of the kit's.\n   */\n  languages?: readonly KitLanguageCode[] | readonly ReviewerScopeLanguage[];\n  /** The areas the scope can be narrowed to. Default: `legal` alone. `[]` for none. */\n  areas?: readonly ReviewerScopeArea[];\n  /** Why the scope cannot be changed for this account (\"Administrators review every\n   *  language already\"). Every box says it; there is no Save. */\n  disabledReason?: ReactNode;\n  /** The app's words for a failed save. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** Over the languages: what the role is, in the app's words. */\n  intro?: ReactNode;\n  /** Columns for the languages from `sm` up. Default 2 (Kurvenschmiede's dialog). */\n  columns?: 1 | 2 | 3 | 4;\n  /** Save COMMITS: under a locked `WriteLockProvider` it is held with the lock's reason. */\n  commit?: CommitScope;\n  labels?: LabelOverride<ReviewerScopeLabels>;\n}\n\nfunction languageOptions(languages: ReviewerScopeEditorProps[\"languages\"]): CheckboxGroupOption[] {\n  const rows = languages ?? KIT_LANGUAGES.map((language) => language.code);\n  return rows.map((row) => {\n    if (typeof row !== \"string\") return { value: row.value, label: row.label };\n    const language = KIT_LANGUAGES.find((entry) => entry.code === row);\n    return {\n      value: row,\n      // Each name in its own language, marked so a screen reader says it so.\n      label: language ? <span lang={language.formatLocale}>{language.nativeName}</span> : row,\n    };\n  });\n}\n\n/** The same set, regardless of order. */\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false;\n  const seen = new Set(a);\n  return b.every((x) => seen.has(x));\n}\n\nexport function ReviewerScopeEditor({\n  value,\n  onSave,\n  onCancel,\n  languages,\n  areas: areasProp,\n  disabledReason,\n  describeError,\n  intro,\n  columns = 2,\n  commit,\n  labels: labelsProp,\n}: ReviewerScopeEditorProps) {\n  const labels = useKitLabels(\"reviewerScope\", DEFAULT_REVIEWER_SCOPE_LABELS, labelsProp);\n  const areaOptions: readonly ReviewerScopeArea[] =\n    areasProp ?? [{ value: \"legal\", label: labels.legalOnly, hint: labels.legalOnlyHint }];\n  const savedLocales = [...(value.locales ?? [])];\n  const savedAreas = [...(value.areas ?? [])];\n  const [locales, setLocales] = useState<string[]>(savedLocales);\n  const [areas, setAreas] = useState<string[]>(savedAreas);\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const locked = hasContent(disabledReason);\n\n  const nextAreas = locales.length === 0 ? [] : areas;\n  const dirty = !sameSet(locales, savedLocales) || !sameSet(nextAreas, locales.length === 0 ? [] : savedAreas);\n\n  const save = () => {\n    if (pending || locked || !dirty) return;\n    const scope: ReviewerScope = {\n      locales,\n      areas: locales.length > 0 && areas.length > 0 ? areas : null,\n    };\n    setFailure(null);\n    let result: MaybePromise;\n    try {\n      result = onSave(scope);\n    } catch (error) {\n      setFailure(describeError?.(error) ?? labels.failed);\n      return;\n    }\n    if (!result || typeof result.then !== \"function\") return;\n    setPending(true);\n    result.then(\n      () => setPending(false),\n      (error: unknown) => {\n        setPending(false);\n        const own = describeError?.(error);\n        setFailure(hasContent(own) ? own : labels.failed);\n      },\n    );\n  };\n\n  return (\n    <div className=\"space-y-3\">\n      {intro && <div className=\"text-sm text-secondary\">{intro}</div>}\n      <CheckboxGroup\n        legend={labels.languages}\n        options={languageOptions(languages)}\n        value={locales}\n        onChange={(next) => {\n          setFailure(null);\n          setLocales(next);\n        }}\n        columns={columns}\n        hint={locked ? undefined : locales.length === 0 ? labels.none : labels.hint}\n        disabledReason={disabledReason}\n      />\n      {areaOptions.length > 0 && (\n        <CheckboxGroup\n          legend={labels.areas}\n          options={areaOptions.map((area) => ({ value: area.value, label: area.label, hint: area.hint }))}\n          value={nextAreas}\n          onChange={(next) => {\n            setFailure(null);\n            setAreas(next);\n          }}\n          // An area narrows a language scope; with no language there is none to narrow.\n          disabled={locales.length === 0}\n          disabledReason={disabledReason}\n        />\n      )}\n      {failure && (\n        <AlertBanner tone=\"danger\" size=\"sm\">\n          {failure}\n        </AlertBanner>\n      )}\n      {locked ? (\n        <Caption>{disabledReason}</Caption>\n      ) : (\n        <FormActions\n          onSubmit={save}\n          onCancel={onCancel}\n          pending={pending}\n          submitDisabled={!dirty}\n          commit={commit}\n        />\n      )}\n    </div>\n  );\n}\n"],"mappings":";AAoHwB,cAkEpB,YAlEoB;AApHxB,SAAS,gBAAgB;AAEzB,SAAS,oBAAwC;AACjD,SAAS,qBAAqB;AAE9B,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAE9B,SAAS,mBAAmB;AAC5B,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAG3B,SAAS,qCAAqC;AA+F9C,SAAS,gBAAgB,WAAyE;AAChG,QAAM,OAAO,aAAa,cAAc,IAAI,CAAC,aAAa,SAAS,IAAI;AACvE,SAAO,KAAK,IAAI,CAAC,QAAQ;AACvB,QAAI,OAAO,QAAQ,SAAU,QAAO,EAAE,OAAO,IAAI,OAAO,OAAO,IAAI,MAAM;AACzE,UAAM,WAAW,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG;AACjE,WAAO;AAAA,MACL,OAAO;AAAA;AAAA,MAEP,OAAO,WAAW,oBAAC,UAAK,MAAM,SAAS,cAAe,mBAAS,YAAW,IAAU;AAAA,IACtF;AAAA,EACF,CAAC;AACH;AAGA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,OAAO,IAAI,IAAI,CAAC;AACtB,SAAO,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AACnC;AAEO,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV;AAAA,EACA,QAAQ;AACV,GAA6B;AAC3B,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AACtF,QAAM,cACJ,aAAa,CAAC,EAAE,OAAO,SAAS,OAAO,OAAO,WAAW,MAAM,OAAO,cAAc,CAAC;AACvF,QAAM,eAAe,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE;AAC9C,QAAM,aAAa,CAAC,GAAI,MAAM,SAAS,CAAC,CAAE;AAC1C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAmB,YAAY;AAC7D,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAmB,UAAU;AACvD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,SAAS,WAAW,cAAc;AAExC,QAAM,YAAY,QAAQ,WAAW,IAAI,CAAC,IAAI;AAC9C,QAAM,QAAQ,CAAC,QAAQ,SAAS,YAAY,KAAK,CAAC,QAAQ,WAAW,QAAQ,WAAW,IAAI,CAAC,IAAI,UAAU;AAE3G,QAAM,OAAO,MAAM;AACjB,QAAI,WAAW,UAAU,CAAC,MAAO;AACjC,UAAM,QAAuB;AAAA,MAC3B;AAAA,MACA,OAAO,QAAQ,SAAS,KAAK,MAAM,SAAS,IAAI,QAAQ;AAAA,IAC1D;AACA,eAAW,IAAI;AACf,QAAI;AACJ,QAAI;AACF,eAAS,OAAO,KAAK;AAAA,IACvB,SAAS,OAAO;AACd,iBAAW,gBAAgB,KAAK,KAAK,OAAO,MAAM;AAClD;AAAA,IACF;AACA,QAAI,CAAC,UAAU,OAAO,OAAO,SAAS,WAAY;AAClD,eAAW,IAAI;AACf,WAAO;AAAA,MACL,MAAM,WAAW,KAAK;AAAA,MACtB,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAChB,cAAM,MAAM,gBAAgB,KAAK;AACjC,mBAAW,WAAW,GAAG,IAAI,MAAM,OAAO,MAAM;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAEA,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,aAAS,oBAAC,SAAI,WAAU,0BAA0B,iBAAM;AAAA,IACzD;AAAA,MAAC;AAAA;AAAA,QACC,QAAQ,OAAO;AAAA,QACf,SAAS,gBAAgB,SAAS;AAAA,QAClC,OAAO;AAAA,QACP,UAAU,CAAC,SAAS;AAClB,qBAAW,IAAI;AACf,qBAAW,IAAI;AAAA,QACjB;AAAA,QACA;AAAA,QACA,MAAM,SAAS,SAAY,QAAQ,WAAW,IAAI,OAAO,OAAO,OAAO;AAAA,QACvE;AAAA;AAAA,IACF;AAAA,IACC,YAAY,SAAS,KACpB;AAAA,MAAC;AAAA;AAAA,QACC,QAAQ,OAAO;AAAA,QACf,SAAS,YAAY,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,OAAO,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,EAAE;AAAA,QAC9F,OAAO;AAAA,QACP,UAAU,CAAC,SAAS;AAClB,qBAAW,IAAI;AACf,mBAAS,IAAI;AAAA,QACf;AAAA,QAEA,UAAU,QAAQ,WAAW;AAAA,QAC7B;AAAA;AAAA,IACF;AAAA,IAED,WACC,oBAAC,eAAY,MAAK,UAAS,MAAK,MAC7B,mBACH;AAAA,IAED,SACC,oBAAC,WAAS,0BAAe,IAEzB;AAAA,MAAC;AAAA;AAAA,QACC,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA,gBAAgB,CAAC;AAAA,QACjB;AAAA;AAAA,IACF;AAAA,KAEJ;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/admin/reviewer-scope-editor.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { KIT_LANGUAGES } from \"../i18n/languages\";\nimport type { KitLanguageCode } from \"../i18n/languages\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { CheckboxGroup } from \"../components/checkbox-group\";\nimport type { CheckboxGroupOption } from \"../components/checkbox-group\";\nimport { FormActions } from \"../components/form-actions\";\nimport { Caption } from \"../components/text\";\nimport { hasContent } from \"../lib/presence\";\nimport type { MaybePromise } from \"./admin-parts\";\nimport type { CommitScope } from \"../components/write-lock\";\nimport { DEFAULT_REVIEWER_SCOPE_LABELS } from \"./reviewer-scope-editor-labels\";\n\n/**\n * Who may review which translations: the REVIEWER role and its scope, in one editor\n * (docs/user-admin-harmonization.md §4.1 `PUT /admin/users/{id}/reviewer {locales, areas}`,\n * §7). It replaces three: keksdose's `user-reviewer-role.tsx` (a checkbox per language,\n * saved on each click), Kurvenschmiede's `reviewer-dialog.tsx` (a `CheckboxGroup` in a\n * dialog with Save) and kastlan's platform column.\n *\n * - **Languages** are the scope. Ticking none takes the role away — that is how both\n *   apps remove a reviewer — and the editor says so under the boxes.\n * - **Areas** narrow it: \"Only the legal pages\" (Imprint, Privacy Policy, Terms) for a\n *   lawyer, who reads law, not French. An area only means something beside at least one\n *   language, so the areas wait for one. Saved as `areas: null` when none is ticked —\n *   server-kit's \"every area\" — never `[]`, which would be \"no area at all\".\n *\n * A draft with Save, not a save per click: keksdose saved every tick, and two quick ticks\n * could land as a set nobody chose; one Save sends the whole scope, in the languages'\n * order (CheckboxGroup's), so the answer equals the request and the row does not\n * reshuffle on refetch. The server keeps its rules (an admin reviews everything already,\n * a customer is not given the role): `disabledReason` says them here.\n */\n\n/** A reviewer's scope — the request body of `PUT …/reviewer`. */\nexport interface ReviewerScope {\n  /** Language codes, in the editor's order. Empty: not a reviewer. */\n  locales: string[];\n  /** The areas the scope is narrowed to; `null` = every area (server-kit's rule). */\n  areas: string[] | null;\n}\n\n/** One area the scope can be narrowed to. */\nexport interface ReviewerScopeArea {\n  value: string;\n  label: ReactNode;\n  hint?: ReactNode;\n}\n\n/** One language the editor offers, when the app's list is not the kit's codes. */\nexport interface ReviewerScopeLanguage {\n  value: string;\n  label: ReactNode;\n}\n\n/** The `reviewerScope` namespace. */\nexport interface ReviewerScopeLabels {\n  /** The language group's legend. */\n  languages: string;\n  /** Under the languages. */\n  hint: string;\n  /** Under the languages while none is ticked. */\n  none: string;\n  /** The area group's legend. */\n  areas: string;\n  /** The default area, `legal`. */\n  legalOnly: string;\n  legalOnlyHint: string;\n  /** A rejected save, unless `describeError` says better. */\n  failed: string;\n}\n\n// Defined in ./reviewer-scope-editor-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_REVIEWER_SCOPE_LABELS };\n\nexport interface ReviewerScopeEditorProps {\n  /** The scope the server has — the draft starts from it. Key the editor by the\n   *  account (`key={user.id}`) so another account starts a fresh draft. */\n  value: { locales?: readonly string[] | null; areas?: readonly string[] | null };\n  /** Sends the scope. A promise keeps the editor busy, and a rejection keeps the draft\n   *  and shows why. */\n  onSave: (scope: ReviewerScope) => MaybePromise;\n  /** A Cancel beside Save — a dialog's way out. */\n  onCancel?: () => void;\n  /**\n   * The languages offered: kit codes (named by the kit's registry, each in its own\n   * language — \"Deutsch\", \"Français\") or the app's own `{ value, label }` rows. Default:\n   * all seven of the kit's.\n   */\n  languages?: readonly KitLanguageCode[] | readonly ReviewerScopeLanguage[];\n  /** The areas the scope can be narrowed to. Default: `legal` alone. `[]` for none. */\n  areas?: readonly ReviewerScopeArea[];\n  /** Why the scope cannot be changed for this account (\"Administrators review every\n   *  language already\"). Every box says it; there is no Save. */\n  disabledReason?: ReactNode;\n  /** The app's words for a failed save. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** Over the languages: what the role is, in the app's words. */\n  intro?: ReactNode;\n  /** Columns for the languages from `sm` up. Default 2 (Kurvenschmiede's dialog). */\n  columns?: 1 | 2 | 3 | 4;\n  /** Save COMMITS: under a locked `WriteLockProvider` it is held with the lock's reason. */\n  commit?: CommitScope;\n  labels?: LabelOverride<ReviewerScopeLabels>;\n}\n\nfunction languageOptions(languages: ReviewerScopeEditorProps[\"languages\"]): CheckboxGroupOption[] {\n  const rows = languages ?? KIT_LANGUAGES.map((language) => language.code);\n  return rows.map((row) => {\n    if (typeof row !== \"string\") return { value: row.value, label: row.label };\n    const language = KIT_LANGUAGES.find((entry) => entry.code === row);\n    return {\n      value: row,\n      // Each name in its own language, marked so a screen reader says it so.\n      label: language ? <span lang={language.formatLocale}>{language.nativeName}</span> : row,\n    };\n  });\n}\n\n/** The same set, regardless of order. */\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false;\n  const seen = new Set(a);\n  return b.every((x) => seen.has(x));\n}\n\nexport function ReviewerScopeEditor({\n  value,\n  onSave,\n  onCancel,\n  languages,\n  areas: areasProp,\n  disabledReason,\n  describeError,\n  intro,\n  columns = 2,\n  commit,\n  labels: labelsProp,\n}: ReviewerScopeEditorProps) {\n  const labels = useKitLabels(\"reviewerScope\", DEFAULT_REVIEWER_SCOPE_LABELS, labelsProp);\n  const areaOptions: readonly ReviewerScopeArea[] = areasProp ?? [\n    { value: \"legal\", label: labels.legalOnly, hint: labels.legalOnlyHint },\n  ];\n  const savedLocales = [...(value.locales ?? [])];\n  const savedAreas = [...(value.areas ?? [])];\n  const [locales, setLocales] = useState<string[]>(savedLocales);\n  const [areas, setAreas] = useState<string[]>(savedAreas);\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const locked = hasContent(disabledReason);\n\n  const nextAreas = locales.length === 0 ? [] : areas;\n  const dirty = !sameSet(locales, savedLocales) || !sameSet(nextAreas, locales.length === 0 ? [] : savedAreas);\n\n  const save = () => {\n    if (pending || locked || !dirty) return;\n    const scope: ReviewerScope = {\n      locales,\n      areas: locales.length > 0 && areas.length > 0 ? areas : null,\n    };\n    setFailure(null);\n    let result: MaybePromise;\n    try {\n      result = onSave(scope);\n    } catch (error) {\n      setFailure(describeError?.(error) ?? labels.failed);\n      return;\n    }\n    if (!result || typeof result.then !== \"function\") return;\n    setPending(true);\n    result.then(\n      () => setPending(false),\n      (error: unknown) => {\n        setPending(false);\n        const own = describeError?.(error);\n        setFailure(hasContent(own) ? own : labels.failed);\n      },\n    );\n  };\n\n  return (\n    <div className=\"space-y-3\">\n      {intro && <div className=\"text-sm text-secondary\">{intro}</div>}\n      <CheckboxGroup\n        legend={labels.languages}\n        options={languageOptions(languages)}\n        value={locales}\n        onChange={(next) => {\n          setFailure(null);\n          setLocales(next);\n        }}\n        columns={columns}\n        hint={locked ? undefined : locales.length === 0 ? labels.none : labels.hint}\n        disabledReason={disabledReason}\n      />\n      {areaOptions.length > 0 && (\n        <CheckboxGroup\n          legend={labels.areas}\n          options={areaOptions.map((area) => ({ value: area.value, label: area.label, hint: area.hint }))}\n          value={nextAreas}\n          onChange={(next) => {\n            setFailure(null);\n            setAreas(next);\n          }}\n          // An area narrows a language scope; with no language there is none to narrow.\n          disabled={locales.length === 0}\n          disabledReason={disabledReason}\n        />\n      )}\n      {failure && (\n        <AlertBanner tone=\"danger\" size=\"sm\">\n          {failure}\n        </AlertBanner>\n      )}\n      {locked ? (\n        <Caption>{disabledReason}</Caption>\n      ) : (\n        <FormActions onSubmit={save} onCancel={onCancel} pending={pending} submitDisabled={!dirty} commit={commit} />\n      )}\n    </div>\n  );\n}\n"],"mappings":";AAoHwB,cAmEpB,YAnEoB;AApHxB,SAAS,gBAAgB;AAEzB,SAAS,oBAAwC;AACjD,SAAS,qBAAqB;AAE9B,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAE9B,SAAS,mBAAmB;AAC5B,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAG3B,SAAS,qCAAqC;AA+F9C,SAAS,gBAAgB,WAAyE;AAChG,QAAM,OAAO,aAAa,cAAc,IAAI,CAAC,aAAa,SAAS,IAAI;AACvE,SAAO,KAAK,IAAI,CAAC,QAAQ;AACvB,QAAI,OAAO,QAAQ,SAAU,QAAO,EAAE,OAAO,IAAI,OAAO,OAAO,IAAI,MAAM;AACzE,UAAM,WAAW,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG;AACjE,WAAO;AAAA,MACL,OAAO;AAAA;AAAA,MAEP,OAAO,WAAW,oBAAC,UAAK,MAAM,SAAS,cAAe,mBAAS,YAAW,IAAU;AAAA,IACtF;AAAA,EACF,CAAC;AACH;AAGA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,OAAO,IAAI,IAAI,CAAC;AACtB,SAAO,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AACnC;AAEO,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV;AAAA,EACA,QAAQ;AACV,GAA6B;AAC3B,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AACtF,QAAM,cAA4C,aAAa;AAAA,IAC7D,EAAE,OAAO,SAAS,OAAO,OAAO,WAAW,MAAM,OAAO,cAAc;AAAA,EACxE;AACA,QAAM,eAAe,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE;AAC9C,QAAM,aAAa,CAAC,GAAI,MAAM,SAAS,CAAC,CAAE;AAC1C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAmB,YAAY;AAC7D,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAmB,UAAU;AACvD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,SAAS,WAAW,cAAc;AAExC,QAAM,YAAY,QAAQ,WAAW,IAAI,CAAC,IAAI;AAC9C,QAAM,QAAQ,CAAC,QAAQ,SAAS,YAAY,KAAK,CAAC,QAAQ,WAAW,QAAQ,WAAW,IAAI,CAAC,IAAI,UAAU;AAE3G,QAAM,OAAO,MAAM;AACjB,QAAI,WAAW,UAAU,CAAC,MAAO;AACjC,UAAM,QAAuB;AAAA,MAC3B;AAAA,MACA,OAAO,QAAQ,SAAS,KAAK,MAAM,SAAS,IAAI,QAAQ;AAAA,IAC1D;AACA,eAAW,IAAI;AACf,QAAI;AACJ,QAAI;AACF,eAAS,OAAO,KAAK;AAAA,IACvB,SAAS,OAAO;AACd,iBAAW,gBAAgB,KAAK,KAAK,OAAO,MAAM;AAClD;AAAA,IACF;AACA,QAAI,CAAC,UAAU,OAAO,OAAO,SAAS,WAAY;AAClD,eAAW,IAAI;AACf,WAAO;AAAA,MACL,MAAM,WAAW,KAAK;AAAA,MACtB,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAChB,cAAM,MAAM,gBAAgB,KAAK;AACjC,mBAAW,WAAW,GAAG,IAAI,MAAM,OAAO,MAAM;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAEA,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,aAAS,oBAAC,SAAI,WAAU,0BAA0B,iBAAM;AAAA,IACzD;AAAA,MAAC;AAAA;AAAA,QACC,QAAQ,OAAO;AAAA,QACf,SAAS,gBAAgB,SAAS;AAAA,QAClC,OAAO;AAAA,QACP,UAAU,CAAC,SAAS;AAClB,qBAAW,IAAI;AACf,qBAAW,IAAI;AAAA,QACjB;AAAA,QACA;AAAA,QACA,MAAM,SAAS,SAAY,QAAQ,WAAW,IAAI,OAAO,OAAO,OAAO;AAAA,QACvE;AAAA;AAAA,IACF;AAAA,IACC,YAAY,SAAS,KACpB;AAAA,MAAC;AAAA;AAAA,QACC,QAAQ,OAAO;AAAA,QACf,SAAS,YAAY,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,OAAO,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,EAAE;AAAA,QAC9F,OAAO;AAAA,QACP,UAAU,CAAC,SAAS;AAClB,qBAAW,IAAI;AACf,mBAAS,IAAI;AAAA,QACf;AAAA,QAEA,UAAU,QAAQ,WAAW;AAAA,QAC7B;AAAA;AAAA,IACF;AAAA,IAED,WACC,oBAAC,eAAY,MAAK,UAAS,MAAK,MAC7B,mBACH;AAAA,IAED,SACC,oBAAC,WAAS,0BAAe,IAEzB,oBAAC,eAAY,UAAU,MAAM,UAAoB,SAAkB,gBAAgB,CAAC,OAAO,QAAgB;AAAA,KAE/G;AAEJ;","names":[]}

package/dist/admin/role-select.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/admin/role-select.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { hasContent } from \"../lib/presence\";\nimport type { RoleVocabulary } from \"../components/account-chips\";\nimport { CheckboxGroup } from \"../components/checkbox-group\";\nimport type { CheckboxGroupOption } from \"../components/checkbox-group\";\nimport { Select } from \"../components/select\";\nimport type { SelectProps } from \"../components/select\";\nimport type { CommitScope } from \"../components/write-lock\";\nimport type { FieldHelpProps } from \"../components/field-parts\";\nimport { DEFAULT_ROLE_SELECT_LABELS } from \"./role-select-labels\";\n\n/**\n * The role of an account, chosen by an admin (docs/user-admin-harmonization.md §3.3,\n * §4.1, §7): {@link RoleSelect} for the apps where an account has ONE role (keksdose,\n * Kurvenschmiede) and {@link RolesEditor} for kastlan, where an account has several per\n * company.\n *\n * Both take the app's {@link RoleVocabulary} — the one `RoleChip` reads — so a role is\n * called the same in the chip, the select and the editor. Neither sends a request: a role\n * change is an `acknowledge` action (§4.2), so the app opens `AdminActionConfirm` from\n * `onChange` and the value stays where the server has it until the server says otherwise.\n *\n * WHY THE REASONS. The server refuses the last active admin's demotion (`last_admin`),\n * your own admin role (`self`), Kurvenschmiede's CUSTOMER for an account that owns work,\n * kastlan's TENANT until a tenant portal exists (§4.1, §9.6). A choice the server will\n * refuse is shown as unavailable, with why, rather than offered and answered with an\n * error after a confirmation dialog — the 0.18 write-lock rule: a control that cannot\n * act says so where it is. `\"last_admin\"` and `\"self\"` are the kit's words in every\n * language; anything else is the app's own sentence.\n */\n\n/** A reason the kit words itself. `self_action` is the server's code for `self` (the\n *  account error codes), so a refusal's code can be handed on as it came. */\nexport type RoleLockCode = \"last_admin\" | \"self\" | \"self_action\";\n\n/**\n * Why a role (or the whole control) cannot be changed: one of the kit's\n * {@link RoleLockCode}s, or the app's own words.\n */\nexport type RoleLock = RoleLockCode | (string & {}) | ReactNode;\n\n/** The `roleSelect` namespace — RoleSelect's and RolesEditor's words. */\nexport interface RoleSelectLabels {\n  /** The select's name where no `label` is drawn, and RolesEditor's legend. \"Role\". */\n  label: string;\n  /** RolesEditor's legend. \"Roles\". */\n  rolesLegend: string;\n  /** The select's accessible name in a roster row — \"Role of Ada Example\". */\n  roleOf: (name: string) => string;\n  /** The whole control is locked: the account is the last active administrator. */\n  lockedLastAdmin: string;\n  /** The whole control is locked: it is the admin's own account. */\n  lockedSelf: string;\n  /** One option is unavailable for the last active administrator — said after the\n   *  role's name, inside the option. */\n  notForLastAdmin: string;\n  /** One option is unavailable on the admin's own account. */\n  notForSelf: string;\n  /** An unavailable option's text: the role's name and why. */\n  unavailable: (role: string, reason: string) => string;\n}\n\n// Defined in ./role-select-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_ROLE_SELECT_LABELS };\n\n/** The whole-control reason, the kit's codes in the kit's words. */\nfunction lockText(reason: RoleLock, labels: RoleSelectLabels): ReactNode {\n  if (reason === \"last_admin\") return labels.lockedLastAdmin;\n  if (reason === \"self\" || reason === \"self_action\") return labels.lockedSelf;\n  return reason;\n}\n\n/** An option's reason as the text a native `<option>` can hold. */\nfunction optionReasonText(reason: string, labels: RoleSelectLabels): string {\n  if (reason === \"last_admin\") return labels.notForLastAdmin;\n  if (reason === \"self\" || reason === \"self_action\") return labels.notForSelf;\n  return reason;\n}\n\n/** The vocabulary's keys, in its own order. */\nfunction keysOf<R extends string>(roles: RoleVocabulary<R>): R[] {\n  return Object.keys(roles) as R[];\n}\n\n/* ── RoleSelect ─────────────────────────────────────────────────────────────── */\n\nexport interface RoleSelectProps<R extends string = string>\n  extends Omit<SelectProps, \"value\" | \"defaultValue\" | \"onChange\" | \"children\" | \"multiple\" | \"disabledReason\"> {\n  /** The role the server has. Controlled: a pick does not move the select until the\n   *  app's request lands and the row comes back with the new role. */\n  value: R | null | undefined;\n  /** The app's roles — what `RoleChip` reads. Their order is the list's. */\n  roles: RoleVocabulary<R>;\n  /** A role other than `value` was picked. The app asks `AdminActionConfirm` (an\n   *  `acknowledge` action, §4.2) and sends the change. */\n  onChange: (role: R) => void;\n  /**\n   * The roles that may be CHOSEN here, in the vocabulary's order whatever order this is\n   * in. Default: all of them. A role the account holds that is not offered (Kurvenschmiede's\n   * REVIEWER, given only through the reviewer scope, §9.6) is still shown, unavailable:\n   * a select that dropped it would show the account as something it is not.\n   */\n  offered?: readonly R[];\n  /**\n   * Why the whole choice is locked for this account: `\"last_admin\"`, `\"self\"`, or the\n   * app's own words. The select stays focusable and says so (Select's `disabledReason`).\n   */\n  disabledReason?: RoleLock;\n  /**\n   * Why ONE role cannot be chosen for this account: `\"last_admin\"`, `\"self\"`, or the\n   * app's own words (Kurvenschmiede: \"owns work\", for CUSTOMER) — a STRING, because a\n   * native option holds text only. The option is disabled and reads \"Member (not for the\n   * last administrator)\". `undefined` for an available role.\n   */\n  optionDisabledReason?: (role: R) => string | undefined;\n  /** The account's name, for the select's accessible name in a roster row (\"Role of\n   *  Ada Example\") where no `label` is drawn. */\n  name?: string;\n  labels?: LabelOverride<RoleSelectLabels>;\n}\n\n/**\n * One role, picked from the app's vocabulary — Kurvenschmiede's roster `Select`\n * (users-panel.tsx), with the reasons it left to the server's toast drawn in place.\n *\n * Unlabelled by default, for a table cell: named \"Role of Ada Example\" (`name`) or\n * \"Role\". Pass `label` for a form field. Every {@link Select} prop passes through\n * (`size`, `commit`, `hint`, `error`, `data-*`).\n */\nexport function RoleSelect<R extends string = string>({\n  value,\n  roles,\n  onChange,\n  offered,\n  disabledReason,\n  optionDisabledReason,\n  name,\n  labels: labelsProp,\n  label,\n  ...rest\n}: RoleSelectProps<R>) {\n  const labels = useKitLabels(\"roleSelect\", DEFAULT_ROLE_SELECT_LABELS, labelsProp);\n  const all = keysOf(roles);\n  const choosable = new Set<R>(offered ?? all);\n  const held = value ?? null;\n  // A cell has no room for a visible label: the select is named for the account it\n  // belongs to, so fifty of them in a roster are not fifty \"Role\"s.\n  const ariaLabel =\n    label === undefined ? (rest[\"aria-label\"] ?? (name ? labels.roleOf(name) : labels.label)) : rest[\"aria-label\"];\n  return (\n    <Select\n      {...rest}\n      label={label}\n      aria-label={ariaLabel}\n      value={held ?? \"\"}\n      disabledReason={hasContent(disabledReason) ? lockText(disabledReason, labels) : undefined}\n      onChange={(event) => {\n        const next = event.target.value as R;\n        if (next && next !== held) onChange(next);\n      }}\n    >\n      {held === null && <option value=\"\" disabled />}\n      {all\n        .filter((role) => choosable.has(role) || role === held)\n        .map((role) => {\n          const word = roles[role].label;\n          const reason = role === held ? undefined : optionDisabledReason?.(role);\n          const unavailable = !choosable.has(role) || hasContent(reason);\n          return (\n            <option key={role} value={role} disabled={unavailable && role !== held}>\n              {reason ? labels.unavailable(word, optionReasonText(reason, labels)) : word}\n            </option>\n          );\n        })}\n      {/* A role the vocabulary does not know (an older client against a newer API) is\n          still the account's role: shown as its key, as RoleChip shows it. */}\n      {held !== null && !all.includes(held) && (\n        <option value={held} disabled>\n          {held}\n        </option>\n      )}\n    </Select>\n  );\n}\n\n/* ── RolesEditor ────────────────────────────────────────────────────────────── */\n\nexport interface RolesEditorProps<R extends string = string> extends FieldHelpProps {\n  /** The roles ticked — the draft the app holds while its dialog is open. */\n  value: readonly R[];\n  roles: RoleVocabulary<R>;\n  /** The new set, in the vocabulary's order (a role the editor does not offer, but the\n   *  account holds, is kept after the rest — CheckboxGroup's rule). */\n  onChange: (roles: R[]) => void;\n  /** The roles that may be ticked or unticked here. Default: all. kastlan leaves TENANT\n   *  out until a tenant portal exists (§4.1). */\n  offered?: readonly R[];\n  /** Why nothing can be changed: `\"last_admin\"`, `\"self\"` or the app's words. */\n  disabledReason?: RoleLock;\n  /** Why one role cannot be changed — shown under it, and the box keeps its state:\n   *  `\"last_admin\"` on the last administrator's ADMIN, say. */\n  optionDisabledReason?: (role: R) => RoleLock | undefined;\n  /** Default `roleSelect.rolesLegend` — \"Roles\". kastlan names the company: \"Roles in\n   *  Example Ltd\". */\n  legend?: ReactNode;\n  legendVisibility?: \"visible\" | \"sr-only\";\n  /** At least one role (kastlan's dialog saves none). Draws the required star. */\n  required?: boolean;\n  hint?: ReactNode;\n  error?: ReactNode;\n  columns?: 1 | 2 | 3 | 4;\n  /** The editor SAVES on change — the write lock's opt-in (CheckboxGroup's `commit`). */\n  commit?: CommitScope;\n  className?: string;\n  labels?: LabelOverride<RoleSelectLabels>;\n}\n\n/**\n * Several roles at once — kastlan's manage-roles dialog (`ChoiceCardGroup multiple`),\n * which holds an account's roles in the CURRENT company (§4.1: `PUT /admin/users/{id}/roles`).\n * A kit {@link CheckboxGroup} of the vocabulary, with the reasons of {@link RoleSelect}:\n * a role that cannot change keeps its box as it is and says why under it.\n *\n * A field, not a form: the app's dialog holds the draft, and its Save goes through\n * `AdminActionConfirm` (`acknowledge`, §4.2) — which can draw this editor as its\n * `children`, so the roles and the tick are one dialog.\n */\nexport function RolesEditor<R extends string = string>({\n  value,\n  roles,\n  onChange,\n  offered,\n  disabledReason,\n  optionDisabledReason,\n  legend,\n  legendVisibility,\n  required,\n  hint,\n  help,\n  error,\n  columns,\n  commit,\n  className,\n  labels: labelsProp,\n}: RolesEditorProps<R>) {\n  const labels = useKitLabels(\"roleSelect\", DEFAULT_ROLE_SELECT_LABELS, labelsProp);\n  const all = keysOf(roles);\n  const choosable = new Set<R>(offered ?? all);\n  const held = new Set<R>(value);\n  const options: CheckboxGroupOption<R>[] = all\n    .filter((role) => choosable.has(role) || held.has(role))\n    .map((role) => {\n      const reason = optionDisabledReason?.(role);\n      const locked = hasContent(reason);\n      return {\n        value: role,\n        label: roles[role].label,\n        hint: locked ? lockText(reason, labels) : undefined,\n        disabled: locked || !choosable.has(role),\n      };\n    });\n  return (\n    <CheckboxGroup<R>\n      legend={legend ?? labels.rolesLegend}\n      legendVisibility={legendVisibility}\n      options={options}\n      value={[...value]}\n      onChange={onChange}\n      required={required}\n      hint={hint}\n      help={help}\n      error={error}\n      columns={columns}\n      commit={commit}\n      disabledReason={hasContent(disabledReason) ? lockText(disabledReason, labels) : undefined}\n      className={className}\n    />\n  );\n}\n"],"mappings":";AAuJI,SAWoB,KAXpB;AAtJJ,SAAS,oBAAwC;AACjD,SAAS,kBAAkB;AAE3B,SAAS,qBAAqB;AAE9B,SAAS,cAAc;AAIvB,SAAS,kCAAkC;AAyD3C,SAAS,SAAS,QAAkB,QAAqC;AACvE,MAAI,WAAW,aAAc,QAAO,OAAO;AAC3C,MAAI,WAAW,UAAU,WAAW,cAAe,QAAO,OAAO;AACjE,SAAO;AACT;AAGA,SAAS,iBAAiB,QAAgB,QAAkC;AAC1E,MAAI,WAAW,aAAc,QAAO,OAAO;AAC3C,MAAI,WAAW,UAAU,WAAW,cAAe,QAAO,OAAO;AACjE,SAAO;AACT;AAGA,SAAS,OAAyB,OAA+B;AAC/D,SAAO,OAAO,KAAK,KAAK;AAC1B;AA+CO,SAAS,WAAsC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAAuB;AACrB,QAAM,SAAS,aAAa,cAAc,4BAA4B,UAAU;AAChF,QAAM,MAAM,OAAO,KAAK;AACxB,QAAM,YAAY,IAAI,IAAO,WAAW,GAAG;AAC3C,QAAM,OAAO,SAAS;AAGtB,QAAM,YACJ,UAAU,SAAa,KAAK,YAAY,MAAM,OAAO,OAAO,OAAO,IAAI,IAAI,OAAO,SAAU,KAAK,YAAY;AAC/G,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ;AAAA,MACA,cAAY;AAAA,MACZ,OAAO,QAAQ;AAAA,MACf,gBAAgB,WAAW,cAAc,IAAI,SAAS,gBAAgB,MAAM,IAAI;AAAA,MAChF,UAAU,CAAC,UAAU;AACnB,cAAM,OAAO,MAAM,OAAO;AAC1B,YAAI,QAAQ,SAAS,KAAM,UAAS,IAAI;AAAA,MAC1C;AAAA,MAEC;AAAA,iBAAS,QAAQ,oBAAC,YAAO,OAAM,IAAG,UAAQ,MAAC;AAAA,QAC3C,IACE,OAAO,CAAC,SAAS,UAAU,IAAI,IAAI,KAAK,SAAS,IAAI,EACrD,IAAI,CAAC,SAAS;AACb,gBAAM,OAAO,MAAM,IAAI,EAAE;AACzB,gBAAM,SAAS,SAAS,OAAO,SAAY,uBAAuB,IAAI;AACtE,gBAAM,cAAc,CAAC,UAAU,IAAI,IAAI,KAAK,WAAW,MAAM;AAC7D,iBACE,oBAAC,YAAkB,OAAO,MAAM,UAAU,eAAe,SAAS,MAC/D,mBAAS,OAAO,YAAY,MAAM,iBAAiB,QAAQ,MAAM,CAAC,IAAI,QAD5D,IAEb;AAAA,QAEJ,CAAC;AAAA,QAGF,SAAS,QAAQ,CAAC,IAAI,SAAS,IAAI,KAClC,oBAAC,YAAO,OAAO,MAAM,UAAQ,MAC1B,gBACH;AAAA;AAAA;AAAA,EAEJ;AAEJ;AA4CO,SAAS,YAAuC;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAAwB;AACtB,QAAM,SAAS,aAAa,cAAc,4BAA4B,UAAU;AAChF,QAAM,MAAM,OAAO,KAAK;AACxB,QAAM,YAAY,IAAI,IAAO,WAAW,GAAG;AAC3C,QAAM,OAAO,IAAI,IAAO,KAAK;AAC7B,QAAM,UAAoC,IACvC,OAAO,CAAC,SAAS,UAAU,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,EACtD,IAAI,CAAC,SAAS;AACb,UAAM,SAAS,uBAAuB,IAAI;AAC1C,UAAM,SAAS,WAAW,MAAM;AAChC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO,MAAM,IAAI,EAAE;AAAA,MACnB,MAAM,SAAS,SAAS,QAAQ,MAAM,IAAI;AAAA,MAC1C,UAAU,UAAU,CAAC,UAAU,IAAI,IAAI;AAAA,IACzC;AAAA,EACF,CAAC;AACH,SACE;AAAA,IAAC;AAAA;AAAA,MACC,QAAQ,UAAU,OAAO;AAAA,MACzB;AAAA,MACA;AAAA,MACA,OAAO,CAAC,GAAG,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,WAAW,cAAc,IAAI,SAAS,gBAAgB,MAAM,IAAI;AAAA,MAChF;AAAA;AAAA,EACF;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/admin/role-select.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { hasContent } from \"../lib/presence\";\nimport type { RoleVocabulary } from \"../components/account-chips\";\nimport { CheckboxGroup } from \"../components/checkbox-group\";\nimport type { CheckboxGroupOption } from \"../components/checkbox-group\";\nimport { Select } from \"../components/select\";\nimport type { SelectProps } from \"../components/select\";\nimport type { CommitScope } from \"../components/write-lock\";\nimport type { FieldHelpProps } from \"../components/field-parts\";\nimport { DEFAULT_ROLE_SELECT_LABELS } from \"./role-select-labels\";\n\n/**\n * The role of an account, chosen by an admin (docs/user-admin-harmonization.md §3.3,\n * §4.1, §7): {@link RoleSelect} for the apps where an account has ONE role (keksdose,\n * Kurvenschmiede) and {@link RolesEditor} for kastlan, where an account has several per\n * company.\n *\n * Both take the app's {@link RoleVocabulary} — the one `RoleChip` reads — so a role is\n * called the same in the chip, the select and the editor. Neither sends a request: a role\n * change is an `acknowledge` action (§4.2), so the app opens `AdminActionConfirm` from\n * `onChange` and the value stays where the server has it until the server says otherwise.\n *\n * WHY THE REASONS. The server refuses the last active admin's demotion (`last_admin`),\n * your own admin role (`self`), Kurvenschmiede's CUSTOMER for an account that owns work,\n * kastlan's TENANT until a tenant portal exists (§4.1, §9.6). A choice the server will\n * refuse is shown as unavailable, with why, rather than offered and answered with an\n * error after a confirmation dialog — the 0.18 write-lock rule: a control that cannot\n * act says so where it is. `\"last_admin\"` and `\"self\"` are the kit's words in every\n * language; anything else is the app's own sentence.\n */\n\n/** A reason the kit words itself. `self_action` is the server's code for `self` (the\n *  account error codes), so a refusal's code can be handed on as it came. */\nexport type RoleLockCode = \"last_admin\" | \"self\" | \"self_action\";\n\n/**\n * Why a role (or the whole control) cannot be changed: one of the kit's\n * {@link RoleLockCode}s, or the app's own words.\n */\nexport type RoleLock = RoleLockCode | (string & {}) | ReactNode;\n\n/** The `roleSelect` namespace — RoleSelect's and RolesEditor's words. */\nexport interface RoleSelectLabels {\n  /** The select's name where no `label` is drawn, and RolesEditor's legend. \"Role\". */\n  label: string;\n  /** RolesEditor's legend. \"Roles\". */\n  rolesLegend: string;\n  /** The select's accessible name in a roster row — \"Role of Ada Example\". */\n  roleOf: (name: string) => string;\n  /** The whole control is locked: the account is the last active administrator. */\n  lockedLastAdmin: string;\n  /** The whole control is locked: it is the admin's own account. */\n  lockedSelf: string;\n  /** One option is unavailable for the last active administrator — said after the\n   *  role's name, inside the option. */\n  notForLastAdmin: string;\n  /** One option is unavailable on the admin's own account. */\n  notForSelf: string;\n  /** An unavailable option's text: the role's name and why. */\n  unavailable: (role: string, reason: string) => string;\n}\n\n// Defined in ./role-select-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_ROLE_SELECT_LABELS };\n\n/** The whole-control reason, the kit's codes in the kit's words. */\nfunction lockText(reason: RoleLock, labels: RoleSelectLabels): ReactNode {\n  if (reason === \"last_admin\") return labels.lockedLastAdmin;\n  if (reason === \"self\" || reason === \"self_action\") return labels.lockedSelf;\n  return reason;\n}\n\n/** An option's reason as the text a native `<option>` can hold. */\nfunction optionReasonText(reason: string, labels: RoleSelectLabels): string {\n  if (reason === \"last_admin\") return labels.notForLastAdmin;\n  if (reason === \"self\" || reason === \"self_action\") return labels.notForSelf;\n  return reason;\n}\n\n/** The vocabulary's keys, in its own order. */\nfunction keysOf<R extends string>(roles: RoleVocabulary<R>): R[] {\n  return Object.keys(roles) as R[];\n}\n\n/* ── RoleSelect ─────────────────────────────────────────────────────────────── */\n\nexport interface RoleSelectProps<R extends string = string> extends Omit<\n  SelectProps,\n  \"value\" | \"defaultValue\" | \"onChange\" | \"children\" | \"multiple\" | \"disabledReason\"\n> {\n  /** The role the server has. Controlled: a pick does not move the select until the\n   *  app's request lands and the row comes back with the new role. */\n  value: R | null | undefined;\n  /** The app's roles — what `RoleChip` reads. Their order is the list's. */\n  roles: RoleVocabulary<R>;\n  /** A role other than `value` was picked. The app asks `AdminActionConfirm` (an\n   *  `acknowledge` action, §4.2) and sends the change. */\n  onChange: (role: R) => void;\n  /**\n   * The roles that may be CHOSEN here, in the vocabulary's order whatever order this is\n   * in. Default: all of them. A role the account holds that is not offered (Kurvenschmiede's\n   * REVIEWER, given only through the reviewer scope, §9.6) is still shown, unavailable:\n   * a select that dropped it would show the account as something it is not.\n   */\n  offered?: readonly R[];\n  /**\n   * Why the whole choice is locked for this account: `\"last_admin\"`, `\"self\"`, or the\n   * app's own words. The select stays focusable and says so (Select's `disabledReason`).\n   */\n  disabledReason?: RoleLock;\n  /**\n   * Why ONE role cannot be chosen for this account: `\"last_admin\"`, `\"self\"`, or the\n   * app's own words (Kurvenschmiede: \"owns work\", for CUSTOMER) — a STRING, because a\n   * native option holds text only. The option is disabled and reads \"Member (not for the\n   * last administrator)\". `undefined` for an available role.\n   */\n  optionDisabledReason?: (role: R) => string | undefined;\n  /** The account's name, for the select's accessible name in a roster row (\"Role of\n   *  Ada Example\") where no `label` is drawn. */\n  name?: string;\n  labels?: LabelOverride<RoleSelectLabels>;\n}\n\n/**\n * One role, picked from the app's vocabulary — Kurvenschmiede's roster `Select`\n * (users-panel.tsx), with the reasons it left to the server's toast drawn in place.\n *\n * Unlabelled by default, for a table cell: named \"Role of Ada Example\" (`name`) or\n * \"Role\". Pass `label` for a form field. Every {@link Select} prop passes through\n * (`size`, `commit`, `hint`, `error`, `data-*`).\n */\nexport function RoleSelect<R extends string = string>({\n  value,\n  roles,\n  onChange,\n  offered,\n  disabledReason,\n  optionDisabledReason,\n  name,\n  labels: labelsProp,\n  label,\n  ...rest\n}: RoleSelectProps<R>) {\n  const labels = useKitLabels(\"roleSelect\", DEFAULT_ROLE_SELECT_LABELS, labelsProp);\n  const all = keysOf(roles);\n  const choosable = new Set<R>(offered ?? all);\n  const held = value ?? null;\n  // A cell has no room for a visible label: the select is named for the account it\n  // belongs to, so fifty of them in a roster are not fifty \"Role\"s.\n  const ariaLabel =\n    label === undefined ? (rest[\"aria-label\"] ?? (name ? labels.roleOf(name) : labels.label)) : rest[\"aria-label\"];\n  return (\n    <Select\n      {...rest}\n      label={label}\n      aria-label={ariaLabel}\n      value={held ?? \"\"}\n      disabledReason={hasContent(disabledReason) ? lockText(disabledReason, labels) : undefined}\n      onChange={(event) => {\n        const next = event.target.value as R;\n        if (next && next !== held) onChange(next);\n      }}\n    >\n      {held === null && <option value=\"\" disabled />}\n      {all\n        .filter((role) => choosable.has(role) || role === held)\n        .map((role) => {\n          const word = roles[role].label;\n          const reason = role === held ? undefined : optionDisabledReason?.(role);\n          const unavailable = !choosable.has(role) || hasContent(reason);\n          return (\n            <option key={role} value={role} disabled={unavailable && role !== held}>\n              {reason ? labels.unavailable(word, optionReasonText(reason, labels)) : word}\n            </option>\n          );\n        })}\n      {/* A role the vocabulary does not know (an older client against a newer API) is\n          still the account's role: shown as its key, as RoleChip shows it. */}\n      {held !== null && !all.includes(held) && (\n        <option value={held} disabled>\n          {held}\n        </option>\n      )}\n    </Select>\n  );\n}\n\n/* ── RolesEditor ────────────────────────────────────────────────────────────── */\n\nexport interface RolesEditorProps<R extends string = string> extends FieldHelpProps {\n  /** The roles ticked — the draft the app holds while its dialog is open. */\n  value: readonly R[];\n  roles: RoleVocabulary<R>;\n  /** The new set, in the vocabulary's order (a role the editor does not offer, but the\n   *  account holds, is kept after the rest — CheckboxGroup's rule). */\n  onChange: (roles: R[]) => void;\n  /** The roles that may be ticked or unticked here. Default: all. kastlan leaves TENANT\n   *  out until a tenant portal exists (§4.1). */\n  offered?: readonly R[];\n  /** Why nothing can be changed: `\"last_admin\"`, `\"self\"` or the app's words. */\n  disabledReason?: RoleLock;\n  /** Why one role cannot be changed — shown under it, and the box keeps its state:\n   *  `\"last_admin\"` on the last administrator's ADMIN, say. */\n  optionDisabledReason?: (role: R) => RoleLock | undefined;\n  /** Default `roleSelect.rolesLegend` — \"Roles\". kastlan names the company: \"Roles in\n   *  Example Ltd\". */\n  legend?: ReactNode;\n  legendVisibility?: \"visible\" | \"sr-only\";\n  /** At least one role (kastlan's dialog saves none). Draws the required star. */\n  required?: boolean;\n  hint?: ReactNode;\n  error?: ReactNode;\n  columns?: 1 | 2 | 3 | 4;\n  /** The editor SAVES on change — the write lock's opt-in (CheckboxGroup's `commit`). */\n  commit?: CommitScope;\n  className?: string;\n  labels?: LabelOverride<RoleSelectLabels>;\n}\n\n/**\n * Several roles at once — kastlan's manage-roles dialog (`ChoiceCardGroup multiple`),\n * which holds an account's roles in the CURRENT company (§4.1: `PUT /admin/users/{id}/roles`).\n * A kit {@link CheckboxGroup} of the vocabulary, with the reasons of {@link RoleSelect}:\n * a role that cannot change keeps its box as it is and says why under it.\n *\n * A field, not a form: the app's dialog holds the draft, and its Save goes through\n * `AdminActionConfirm` (`acknowledge`, §4.2) — which can draw this editor as its\n * `children`, so the roles and the tick are one dialog.\n */\nexport function RolesEditor<R extends string = string>({\n  value,\n  roles,\n  onChange,\n  offered,\n  disabledReason,\n  optionDisabledReason,\n  legend,\n  legendVisibility,\n  required,\n  hint,\n  help,\n  error,\n  columns,\n  commit,\n  className,\n  labels: labelsProp,\n}: RolesEditorProps<R>) {\n  const labels = useKitLabels(\"roleSelect\", DEFAULT_ROLE_SELECT_LABELS, labelsProp);\n  const all = keysOf(roles);\n  const choosable = new Set<R>(offered ?? all);\n  const held = new Set<R>(value);\n  const options: CheckboxGroupOption<R>[] = all\n    .filter((role) => choosable.has(role) || held.has(role))\n    .map((role) => {\n      const reason = optionDisabledReason?.(role);\n      const locked = hasContent(reason);\n      return {\n        value: role,\n        label: roles[role].label,\n        hint: locked ? lockText(reason, labels) : undefined,\n        disabled: locked || !choosable.has(role),\n      };\n    });\n  return (\n    <CheckboxGroup<R>\n      legend={legend ?? labels.rolesLegend}\n      legendVisibility={legendVisibility}\n      options={options}\n      value={[...value]}\n      onChange={onChange}\n      required={required}\n      hint={hint}\n      help={help}\n      error={error}\n      columns={columns}\n      commit={commit}\n      disabledReason={hasContent(disabledReason) ? lockText(disabledReason, labels) : undefined}\n      className={className}\n    />\n  );\n}\n"],"mappings":";AAyJI,SAWoB,KAXpB;AAxJJ,SAAS,oBAAwC;AACjD,SAAS,kBAAkB;AAE3B,SAAS,qBAAqB;AAE9B,SAAS,cAAc;AAIvB,SAAS,kCAAkC;AAyD3C,SAAS,SAAS,QAAkB,QAAqC;AACvE,MAAI,WAAW,aAAc,QAAO,OAAO;AAC3C,MAAI,WAAW,UAAU,WAAW,cAAe,QAAO,OAAO;AACjE,SAAO;AACT;AAGA,SAAS,iBAAiB,QAAgB,QAAkC;AAC1E,MAAI,WAAW,aAAc,QAAO,OAAO;AAC3C,MAAI,WAAW,UAAU,WAAW,cAAe,QAAO,OAAO;AACjE,SAAO;AACT;AAGA,SAAS,OAAyB,OAA+B;AAC/D,SAAO,OAAO,KAAK,KAAK;AAC1B;AAiDO,SAAS,WAAsC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAAuB;AACrB,QAAM,SAAS,aAAa,cAAc,4BAA4B,UAAU;AAChF,QAAM,MAAM,OAAO,KAAK;AACxB,QAAM,YAAY,IAAI,IAAO,WAAW,GAAG;AAC3C,QAAM,OAAO,SAAS;AAGtB,QAAM,YACJ,UAAU,SAAa,KAAK,YAAY,MAAM,OAAO,OAAO,OAAO,IAAI,IAAI,OAAO,SAAU,KAAK,YAAY;AAC/G,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ;AAAA,MACA,cAAY;AAAA,MACZ,OAAO,QAAQ;AAAA,MACf,gBAAgB,WAAW,cAAc,IAAI,SAAS,gBAAgB,MAAM,IAAI;AAAA,MAChF,UAAU,CAAC,UAAU;AACnB,cAAM,OAAO,MAAM,OAAO;AAC1B,YAAI,QAAQ,SAAS,KAAM,UAAS,IAAI;AAAA,MAC1C;AAAA,MAEC;AAAA,iBAAS,QAAQ,oBAAC,YAAO,OAAM,IAAG,UAAQ,MAAC;AAAA,QAC3C,IACE,OAAO,CAAC,SAAS,UAAU,IAAI,IAAI,KAAK,SAAS,IAAI,EACrD,IAAI,CAAC,SAAS;AACb,gBAAM,OAAO,MAAM,IAAI,EAAE;AACzB,gBAAM,SAAS,SAAS,OAAO,SAAY,uBAAuB,IAAI;AACtE,gBAAM,cAAc,CAAC,UAAU,IAAI,IAAI,KAAK,WAAW,MAAM;AAC7D,iBACE,oBAAC,YAAkB,OAAO,MAAM,UAAU,eAAe,SAAS,MAC/D,mBAAS,OAAO,YAAY,MAAM,iBAAiB,QAAQ,MAAM,CAAC,IAAI,QAD5D,IAEb;AAAA,QAEJ,CAAC;AAAA,QAGF,SAAS,QAAQ,CAAC,IAAI,SAAS,IAAI,KAClC,oBAAC,YAAO,OAAO,MAAM,UAAQ,MAC1B,gBACH;AAAA;AAAA;AAAA,EAEJ;AAEJ;AA4CO,SAAS,YAAuC;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAAwB;AACtB,QAAM,SAAS,aAAa,cAAc,4BAA4B,UAAU;AAChF,QAAM,MAAM,OAAO,KAAK;AACxB,QAAM,YAAY,IAAI,IAAO,WAAW,GAAG;AAC3C,QAAM,OAAO,IAAI,IAAO,KAAK;AAC7B,QAAM,UAAoC,IACvC,OAAO,CAAC,SAAS,UAAU,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,EACtD,IAAI,CAAC,SAAS;AACb,UAAM,SAAS,uBAAuB,IAAI;AAC1C,UAAM,SAAS,WAAW,MAAM;AAChC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO,MAAM,IAAI,EAAE;AAAA,MACnB,MAAM,SAAS,SAAS,QAAQ,MAAM,IAAI;AAAA,MAC1C,UAAU,UAAU,CAAC,UAAU,IAAI,IAAI;AAAA,IACzC;AAAA,EACF,CAAC;AACH,SACE;AAAA,IAAC;AAAA;AAAA,MACC,QAAQ,UAAU,OAAO;AAAA,MACzB;AAAA,MACA;AAAA,MACA,OAAO,CAAC,GAAG,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,WAAW,cAAc,IAAI,SAAS,gBAAgB,MAAM,IAAI;AAAA,MAChF;AAAA;AAAA,EACF;AAEJ;","names":[]}

package/dist/admin/user-roster.js

@@ -52,15 +52,7 @@ function UserIdentityCell({
 }
 function UserRowActions({ actions, name, labels: labelsProp }) {
   const labels = useKitLabels("userRoster", DEFAULT_USER_ROSTER_LABELS, labelsProp);
-  return /* @__PURE__ */ jsx(
-    RowActions,
-    {
-      actions,
-      name,
-      collapse: "menu",
-      labels: { actionsFor: labels.actionsFor }
-    }
-  );
+  return /* @__PURE__ */ jsx(RowActions, { actions, name, collapse: "menu", labels: { actionsFor: labels.actionsFor } });
 }
 function rolesOf(row, roleOf) {
   const raw = roleOf ? roleOf(row) : row.roles ?? row.role;

package/dist/admin/user-roster.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/admin/user-roster.tsx"],"sourcesContent":["import { useMemo } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { cn } from \"../lib/cn\";\nimport type { DateInput } from \"../lib/format\";\nimport type { PersonName } from \"../lib/person-name\";\nimport { useKitLabels, useKitLocale, type LabelOverride } from \"../i18n/kit-labels\";\nimport { AccountStateChip, RoleChip, dateColumn } from \"../components/account-chips\";\nimport type { AccountState, RoleVocabulary } from \"../components/account-chips\";\nimport type { ChipTone } from \"../components/chip\";\nimport type { DataTableColumn } from \"../components/data-table\";\nimport { SelectWidthFloor } from \"../components/field-base\";\nimport { encodeSorts } from \"../components/data-table-sort\";\nimport type { SortState } from \"../components/data-table-sort\";\nimport { RowActions } from \"../components/row-actions\";\nimport type { RowAction, RowActionList } from \"../components/row-actions\";\nimport { UserAvatar } from \"../components/user-avatar\";\nimport { personLabel } from \"./admin-parts\";\nimport { RoleSelect } from \"./role-select\";\nimport type { RoleLock } from \"./role-select\";\nimport { DEFAULT_USER_ROSTER_LABELS } from \"./user-roster-labels\";\n\n/**\n * The admin's user list (docs/user-admin-harmonization.md §3): a column preset for the\n * kit's `DataTable`, not a table of its own.\n *\n * keksdose built its roster by hand (1150 lines, its own Badge), Kurvenschmiede on the\n * kit `DataTable` with the 0.18 chips, kastlan as a settings page. What the three share\n * is the row — name over address, a role, the account's states, created, last login, the\n * app's own columns, and a handful of actions — so that is what the kit draws, and the\n * table, its paging, its sort and its filters stay the app's `DataTable` wiring:\n *\n * ```tsx\n * const columns = useUserRosterColumns<AdminUserRow, Role>({ roles: ROLES, actions, extra });\n * <DataTable rows={page.users} columns={columns} rowKey={(r) => r.id}\n *   serverPagination={{ page, pageSize, total: page.total, onPageChange }}\n *   sorts={sorts} onSortsChange={setSorts} />\n * // GET /admin/users?sort=${userRosterSort(sorts)}&…\n * ```\n *\n * The column keys ARE the server's sort keys (§3.1): `name`, `email`, `role`, `created`,\n * `last_login` — so {@link userRosterSort} turns the table's sort state into the query\n * as it is. Phone cards come from the same columns: the identity is the card's headline\n * with the account's states as chips beside it, the role, last login and the actions are\n * its three fields, created is left off.\n */\n\n/* ── Rows and states ────────────────────────────────────────────────────────── */\n\n/**\n * The fields of the contract's `AdminUserRow` the preset reads (§3.2, the auth\n * contract's `UserResponse` core). An app's row has more — its `extra` — and the\n * preset passes the whole row to every callback.\n */\nexport interface UserRosterRow extends AdminUserStateFields {\n  id: string | number;\n  email: string;\n  first_name?: string | null;\n  last_name?: string | null;\n  /** The derived whole name — only the fallback when both parts are blank. */\n  display_name?: string | null;\n  /** keksdose, Kurvenschmiede: one role. */\n  role?: string | null;\n  /** kastlan: the account's roles in the current company. Wins over `role`. */\n  roles?: readonly string[] | null;\n  created_at?: DateInput;\n  /** Account-wide; kastlan's comes from its session rows (§3.2). */\n  last_login_at?: DateInput;\n}\n\n/** The state fields of the contract's row that {@link adminUserStates} maps (§3.2). */\nexport interface AdminUserStateFields {\n  is_active?: boolean;\n  email_verified?: boolean;\n  password_change_required_at?: string | null;\n  /** `after_days` mode: the day the account is erased (§6.4). */\n  deletion_scheduled_at?: string | null;\n  /** When the user asked. The only deletion field in kastlan's `operator` mode, where\n   *  nothing is scheduled. */\n  deletion_requested_at?: string | null;\n}\n\n/** One state chip of a row: an {@link AccountState}, or one with its `date` (the\n *  `deletion` day), a `tone` or the app's own words. */\nexport type RosterState =\n  | AccountState\n  | { state: AccountState; date?: DateInput; tone?: ChipTone; label?: ReactNode };\n\n/**\n * The contract's row as state chips (§3.2: \"map 1:1 to the kit's AccountStateChip\"):\n *\n * - marked for deletion → `deletion` with the scheduled day (none in `operator` mode),\n *   IN PLACE of `inactive` — such an account is always deactivated (§2.1);\n * - else `active` / `inactive` from `is_active`;\n * - `unverified` when `email_verified` is `false` (not when it is missing);\n * - `passwordChange` while `password_change_required_at` is set.\n */\nexport function adminUserStates(row: AdminUserStateFields): RosterState[] {\n  const out: RosterState[] = [];\n  if (row.deletion_scheduled_at || row.deletion_requested_at) {\n    out.push({ state: \"deletion\", date: row.deletion_scheduled_at ?? null });\n  } else if (row.is_active !== undefined) {\n    out.push(row.is_active ? \"active\" : \"inactive\");\n  }\n  if (row.email_verified === false) out.push(\"unverified\");\n  if (row.password_change_required_at) out.push(\"passwordChange\");\n  return out;\n}\n\n/** The server's sort keys, which are the preset's column keys (§3.1). */\nexport const USER_ROSTER_SORT_KEYS = [\"name\", \"email\", \"role\", \"created\", \"last_login\"] as const;\nexport type UserRosterSortKey = (typeof USER_ROSTER_SORT_KEYS)[number];\n\n/**\n * The table's sort state as the `sort` query parameter of `GET /admin/users` (§3.1), in\n * the DataTable's own encoding ({@link encodeSorts}: `\"last_login.desc\"`), which\n * server-kit 0.4 reads beside the `-key` form. Only the first criterion on one of the\n * server's keys: an app's own column (`owned`) is the client's to sort, and the query\n * takes one key — a shift-clicked second criterion is not sent. `undefined` when nothing\n * the server knows is sorted, so its default order applies.\n */\nexport function userRosterSort(sorts: readonly SortState[]): string | undefined {\n  const first = sorts.find((s) => (USER_ROSTER_SORT_KEYS as readonly string[]).includes(s.key));\n  return first ? (encodeSorts([first]) ?? undefined) : undefined;\n}\n\n/* ── Labels ─────────────────────────────────────────────────────────────────── */\n\n/** The `userRoster` namespace: the preset's headers and the action menu's words. */\nexport interface UserRosterLabels {\n  /** The identity column — the name with the address under it. */\n  name: string;\n  /** The separate address column (`emailColumn`). */\n  email: string;\n  role: string;\n  state: string;\n  created: string;\n  lastLogin: string;\n  /** A last login that never happened. */\n  never: string;\n  /** The actions column's (hidden) header. */\n  actions: string;\n  /** The action menu's button and panel — \"Actions for Ada Example\". */\n  actionsFor: (name: string) => string;\n}\n\n// Defined in ./user-roster-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_USER_ROSTER_LABELS };\n\n/* ── UserIdentityCell ───────────────────────────────────────────────────────── */\n\nexport interface UserIdentityCellProps {\n  /** First and last name (auth §3.2), shown in the READER's order. */\n  person?: PersonName | null;\n  /** A whole name, for an API that still sends `display_name` only. */\n  name?: string | null;\n  email?: string | null;\n  /** The initials avatar before the name. Default true. */\n  avatar?: boolean;\n  /** After the name, on its line — a \"You\" chip, a demo mark. */\n  badge?: ReactNode;\n  /** Over the provider's locale. */\n  locale?: string;\n  className?: string;\n}\n\n/**\n * Who an account is, in one cell (§3.3): the initials avatar, the name in the reader's\n * order ({@link formatPersonName} — \"Example Ada\" in Hungarian) and the address under it\n * — the cell both rosters drew by hand. An account with no name yet (a migrated row\n * before `CompleteNameDialog`, an invitee) shows its address once, as the name.\n *\n * Both lines carry `data-private`, so keksdose's demo blur reaches them, and both end\n * in \"…\" at Normal only: from Large up they wrap (`truncate-until-large`, 0.33,\n * docs/text-size-harmonization.md §10.17), since a cut name or address is a finding there.\n */\nexport function UserIdentityCell({\n  person,\n  name,\n  email,\n  avatar = true,\n  badge,\n  locale: localeProp,\n  className,\n}: UserIdentityCellProps) {\n  const locale = useKitLocale(localeProp);\n  const named = personLabel({ first: person?.first, last: person?.last, name }, locale);\n  const address = (email ?? \"\").trim();\n  return (\n    <div className={cn(\"flex min-w-0 items-center gap-2.5\", className)}>\n      {avatar && <UserAvatar person={person} name={name} email={email} size=\"sm\" />}\n      <div className=\"min-w-0\">\n        <div className=\"flex min-w-0 items-center gap-1.5\">\n          <span data-private className=\"truncate-until-large font-medium text-primary\">\n            {named || address}\n          </span>\n          {badge}\n        </div>\n        {named && address && (\n          <div data-private className=\"truncate-until-large text-xs text-muted\">\n            {address}\n          </div>\n        )}\n      </div>\n    </div>\n  );\n}\n\n/* ── The row's actions ──────────────────────────────────────────────────────── */\n\n/** One entry of a row's action menu (§4) — the kit's {@link RowAction} since 0.32,\n *  which generalised it for every dense row (docs/text-size-harmonization.md §10.8). */\nexport type UserRowAction = RowAction;\n\n/** What `actions(row)` may return: entries, and `false` / `null` for the ones a\n *  condition left out (`row.is_active && {…}`). */\nexport type UserRowActionList = RowActionList;\n\nexport interface UserRowActionsProps {\n  actions: UserRowActionList;\n  /** The account's name, for the menu's name — \"Actions for Ada Example\". */\n  name: string;\n  labels?: LabelOverride<UserRosterLabels>;\n}\n\n/**\n * A row's actions as one \"…\" button and a menu of them: keksdose had a strip of icon\n * buttons in the expanded row, Kurvenschmiede five text buttons in a cell — neither fits\n * a phone card, and both grow with every action §2.4 adds. The menu is portalled, so a\n * table's scroller cannot clip it; Escape and an outside press close it, and focus goes\n * back to the button, which is where a confirmation dialog then returns it.\n *\n * Since 0.32 this is {@link RowActions} with `collapse=\"menu\"` — the menu at every size —\n * named by the roster's own `actionsFor`.\n */\nexport function UserRowActions({ actions, name, labels: labelsProp }: UserRowActionsProps) {\n  const labels = useKitLabels(\"userRoster\", DEFAULT_USER_ROSTER_LABELS, labelsProp);\n  return (\n    <RowActions\n      actions={actions}\n      name={name}\n      collapse=\"menu\"\n      labels={{ actionsFor: labels.actionsFor }}\n    />\n  );\n}\n\n/* ── The preset ─────────────────────────────────────────────────────────────── */\n\n/** How a row's role may be changed inline: `true`, or with reasons. */\nexport interface RoleEditing<R extends string> {\n  /** Why the whole select is locked for this row — `\"self\"`, `\"last_admin\"`, or words. */\n  disabledReason?: RoleLock;\n  /** Why one role cannot be chosen for this row (a string: it goes inside an option). */\n  optionDisabledReason?: (role: R) => string | undefined;\n  /** The roles that may be chosen. Default: the whole vocabulary. */\n  offered?: readonly R[];\n}\n\nexport interface UserRosterColumnsOptions<T extends UserRosterRow, R extends string = string> {\n  /** The app's roles, as `RoleChip` reads them. */\n  roles: RoleVocabulary<R>;\n  /** The row's state chips. Default {@link adminUserStates}, which reads the contract's\n   *  fields (`is_active`, `email_verified`, `password_change_required_at`,\n   *  `deletion_scheduled_at`, `deletion_requested_at`). */\n  stateOf?: (row: T) => readonly RosterState[];\n  /** The app's own columns — keksdose's plan and key custody, Kurvenschmiede's owned\n   *  counts — after the dates, before the actions. */\n  extra?: readonly DataTableColumn<T>[];\n  /** The row's action menu (§4). Left out: no actions column. */\n  actions?: (row: T) => UserRowActionList;\n  /** The actions column's heading (0.46.1, keksdose dev#598 rework — a VISIBLE \"Actions\"\n   *  on every table with an actions column). Default: `labels.actions`, shown. A node\n   *  replaces it; `false` keeps the pre-0.46.1 heading, a screen reader's name only. */\n  actionsHeader?: ReactNode | false;\n  /**\n   * Whether this row's role is a select rather than a chip, and with which reasons.\n   * Left out, or `false`: a chip. kastlan's several roles are never a select here — they\n   * are a \"Manage roles\" action that opens `RolesEditor`.\n   */\n  editableRole?: (row: T) => boolean | RoleEditing<R>;\n  /** A role was picked in a row's select. The app confirms (`acknowledge`) and sends it. */\n  onRoleChange?: (row: T, role: R) => void;\n  /** The row's role(s). Default `row.roles ?? row.role`. */\n  roleOf?: (row: T) => R | readonly R[] | null | undefined;\n  /** A separate, sortable \"Email\" column (the server's `email` sort key) beside the\n   *  identity. Default false: the address is under the name already. */\n  emailColumn?: boolean;\n  /** The words, already resolved. Default English; {@link useUserRosterColumns} reads\n   *  the provider's `userRoster` namespace. */\n  labels?: LabelOverride<UserRosterLabels>;\n}\n\nfunction rolesOf<T extends UserRosterRow, R extends string>(\n  row: T,\n  roleOf: UserRosterColumnsOptions<T, R>[\"roleOf\"],\n): R[] {\n  const raw = roleOf ? roleOf(row) : ((row.roles ?? row.role) as R | readonly R[] | null | undefined);\n  if (raw === null || raw === undefined || raw === \"\") return [];\n  return typeof raw === \"string\" ? [raw as R] : [...(raw as readonly R[])];\n}\n\n/** What a row's role select can show as its value: every role's word, and a held key\n *  the vocabulary does not know (RoleSelect shows it as the key). */\nfunction roleWordsOf<R extends string>(roles: RoleVocabulary<R>, held: R | undefined): string[] {\n  const words = (Object.keys(roles) as R[]).map((role) => roles[role].label);\n  return held !== undefined && !(held in roles) ? [...words, held] : words;\n}\n\n/** The row's name in the reader's order — a component, because the order is the\n *  READER's and the locale comes from the provider. */\nfunction RowName<T extends UserRosterRow>({ row, children }: { row: T; children: (name: string) => ReactNode }) {\n  const locale = useKitLocale();\n  const name = personLabel(\n    { first: row.first_name, last: row.last_name, name: row.display_name, email: row.email },\n    locale,\n  );\n  return <>{children(name)}</>;\n}\n\nfunction StateChips({ states }: { states: readonly RosterState[] }) {\n  if (states.length === 0) return null;\n  return (\n    <div className=\"flex flex-wrap gap-1\">\n      {states.map((entry) => {\n        const spec = typeof entry === \"string\" ? { state: entry } : entry;\n        return (\n          <AccountStateChip key={spec.state} state={spec.state} date={spec.date} tone={spec.tone} size=\"xs\">\n            {spec.label}\n          </AccountStateChip>\n        );\n      })}\n    </div>\n  );\n}\n\n/**\n * The roster's columns, in the contract's order (§3.3):\n *\n * | key | cell | sort | phone | fit (0.50) |\n * |---|---|---|---|---|\n * | `name` | {@link UserIdentityCell} | last, first | the card's headline | `grow` |\n * | `email` | the address (`emailColumn` only) | address | hidden | — |\n * | `role` | `RoleChip`(s), or {@link RoleSelect} where `editableRole` | role | field | — |\n * | `state` | `AccountStateChip`s from `stateOf` | — | chips beside the headline | — |\n * | `created` | `dateColumn` | instant | hidden | `fitPriority: 1` |\n * | `last_login` | `dateColumn`, relative, \"Never\" | instant | field | `fitPriority: 2` |\n * | …`extra` | the app's | the app's | off the card unless marked `mobile: \"secondary\"` | the app's |\n * | `actions` | {@link UserRowActions} | — | the card's actions row (`role: \"actions\"`) | — |\n *\n * The fit (0.50, kastlan K2): Name takes the rest of the row, and a table narrower than\n * its columns leaves out Created, then Last login (DataTable's `grow` / `fitPriority`).\n * The role and state chips still wrap in their cells (0.48), and the other cells keep one\n * line at Normal. `{ ...col, grow: undefined, fitPriority: undefined }` restores the 0.49\n * layout; an `extra` column takes a `fitPriority` of its own to leave too.\n *\n * The card holds three fields — `role`, `last_login` and one more: an `extra` column marked\n * `mobile: \"secondary\"` takes that place. The actions are `role: \"actions\"` (0.49), drawn\n * after the fields and never one of the three. Drop them from the card with\n * `mobile: \"hidden\"`, or draw a `mobileCard`.\n *\n * Pure: hand it resolved words, or use {@link useUserRosterColumns}. The keys are stable,\n * so an app may drop or move a column (`columns.filter((c) => c.key !== \"created\")`).\n * Under `serverPagination` the `sortBy`s only make the headers clickable; the app sends\n * the sort ({@link userRosterSort}).\n */\nexport function userRosterColumns<T extends UserRosterRow, R extends string = string>({\n  roles,\n  stateOf = adminUserStates,\n  extra = [],\n  actions,\n  actionsHeader,\n  editableRole,\n  onRoleChange,\n  roleOf,\n  emailColumn = false,\n  labels: labelsProp,\n}: UserRosterColumnsOptions<T, R>): DataTableColumn<T>[] {\n  const labels: UserRosterLabels = { ...DEFAULT_USER_ROSTER_LABELS, ...labelsProp };\n  const roleWords = (row: T) =>\n    rolesOf(row, roleOf)\n      .map((role) => roles[role]?.label ?? role)\n      .join(\", \");\n  const columns: DataTableColumn<T>[] = [\n    {\n      key: \"name\",\n      header: labels.name,\n      cell: (row) => (\n        <UserIdentityCell\n          person={{ first: row.first_name, last: row.last_name }}\n          name={row.display_name}\n          email={row.email}\n        />\n      ),\n      // By last name, then first (auth §3.2), as the server sorts `name`.\n      sortBy: (row) => `${row.last_name ?? \"\"} ${row.first_name ?? \"\"}`.trim().toLocaleLowerCase() || row.email,\n      // Either part, in either order, or the address (auth §10.6).\n      filterBy: (row) =>\n        [row.first_name, row.last_name, row.last_name, row.first_name, row.display_name, row.email]\n          .filter(Boolean)\n          .join(\" \"),\n      mobilePrimary: true,\n      // Takes the rest of the row and ellipsises (0.50, kastlan K2): the roster fits its\n      // pane — a settings column, an admin page — instead of scrolling sideways.\n      grow: true,\n    },\n  ];\n  if (emailColumn) {\n    columns.push({\n      key: \"email\",\n      header: labels.email,\n      className: \"whitespace-nowrap\",\n      cell: (row) => (\n        <span data-private className=\"text-secondary\">\n          {row.email}\n        </span>\n      ),\n      sortBy: (row) => row.email.toLowerCase(),\n      filterBy: (row) => row.email,\n      mobileHidden: true,\n    });\n  }\n  columns.push(\n    {\n      key: \"role\",\n      header: labels.role,\n      cell: (row) => {\n        const held = rolesOf(row, roleOf);\n        const editing = held.length <= 1 ? editableRole?.(row) : false;\n        if (editing && onRoleChange) {\n          const rules: RoleEditing<R> = editing === true ? {} : editing;\n          return (\n            <RowName row={row}>\n              {(name) => (\n                // The column keeps room for the select's longest ROLE word in the app's\n                // language (0.51, Kurvenschmiede N5): beside the `grow` Name every other\n                // column is squeezed to its min-content, which a `w-full` select does not\n                // have, so the role select was the header's ~92px and read \"Meml…\",\n                // \"Admi…\". Every word of the vocabulary, not only the row's offered\n                // ones: the column is as wide as its widest row, so the rows line up, and\n                // a role held but not offered (KS's Reviewer) is still a selected value.\n                // Not the options' reasons (\"Customer (owns work)\"): they are never the\n                // selected value, and the open list is as wide as it needs anyway.\n                <div>\n                  <RoleSelect<R>\n                    size=\"sm\"\n                    name={name}\n                    value={held[0] ?? null}\n                    roles={roles}\n                    offered={rules.offered}\n                    disabledReason={rules.disabledReason}\n                    optionDisabledReason={rules.optionDisabledReason}\n                    onChange={(role) => onRoleChange(row, role)}\n                  />\n                  <SelectWidthFloor size=\"sm\" values={roleWordsOf(roles, held[0])} />\n                </div>\n              )}\n            </RowName>\n          );\n        }\n        if (held.length === 0) return null;\n        return (\n          <div className=\"flex flex-wrap gap-1\">\n            {held.map((role) => (\n              <RoleChip<R> key={role} value={role} roles={roles} size=\"xs\" />\n            ))}\n          </div>\n        );\n      },\n      sortBy: roleWords,\n      filter: {\n        type: \"select\",\n        getValue: (row) => rolesOf(row, roleOf)[0] ?? \"\",\n        options: (Object.keys(roles) as R[]).map((value) => ({ value, label: roles[value].label })),\n      },\n      mobile: \"secondary\",\n    },\n    {\n      key: \"state\",\n      header: labels.state,\n      // No states, no cell: the phone card then shows no chip beside the name.\n      cell: (row) => {\n        const states = stateOf(row);\n        return states.length === 0 ? null : <StateChips states={states} />;\n      },\n      // Beside the name on the phone card, so the role, last login and the actions keep\n      // the card's three fields.\n      role: \"status\",\n    },\n    dateColumn<T>({\n      key: \"created\",\n      header: labels.created,\n      value: (row) => row.created_at ?? null,\n      // The first to leave a narrow table (0.50, kastlan K2), then last login.\n      column: { mobileHidden: true, fitPriority: 1 },\n    }),\n    // How long ago rather than a date — the question is \"recently?\" — with the exact\n    // time beside it (keksdose's last-seen column, Kurvenschmiede's; 0.32 §4: never only\n    // in a tooltip).\n    dateColumn<T>({\n      key: \"last_login\",\n      header: labels.lastLogin,\n      value: (row) => row.last_login_at ?? null,\n      display: \"relative\",\n      empty: labels.never,\n      column: { mobile: \"secondary\", fitPriority: 2 },\n    }),\n    ...extra,\n  );\n  if (actions) {\n    columns.push({\n      key: \"actions\",\n      // On screen, as every actions column's heading is (0.46.1, keksdose dev#598 rework).\n      header:\n        actionsHeader === false ? <span className=\"sr-only\">{labels.actions}</span> : (actionsHeader ?? labels.actions),\n      headerText: labels.actions,\n      // The caller's own words only: the menu reads the provider's itself, and the\n      // English defaults merged in above must not shadow them.\n      cell: (row) => (\n        <RowName row={row}>\n          {(name) => <UserRowActions actions={actions(row)} name={name} labels={labelsProp} />}\n        </RowName>\n      ),\n      className: \"w-px whitespace-nowrap text-end\",\n      headClassName: \"w-px text-end\",\n      // The menu button keeps its own click: a row link must not wrap it.\n      noRowLink: true,\n      // Always on the phone card, after the fields and never one of the three (0.49).\n      role: \"actions\",\n    });\n  }\n  return columns;\n}\n\n/**\n * {@link userRosterColumns} with the `userRoster` words from the provider, memoised on\n * the options — pass stable callbacks (`useCallback`) and a module-level vocabulary, or\n * the columns are rebuilt on every render.\n */\nexport function useUserRosterColumns<T extends UserRosterRow, R extends string = string>({\n  roles,\n  stateOf,\n  extra,\n  actions,\n  actionsHeader,\n  editableRole,\n  onRoleChange,\n  roleOf,\n  emailColumn,\n  labels: labelsProp,\n}: UserRosterColumnsOptions<T, R>): DataTableColumn<T>[] {\n  const labels = useKitLabels(\"userRoster\", DEFAULT_USER_ROSTER_LABELS, labelsProp);\n  return useMemo(\n    () =>\n      userRosterColumns<T, R>({\n        roles,\n        stateOf,\n        extra,\n        actions,\n        actionsHeader,\n        editableRole,\n        onRoleChange,\n        roleOf,\n        emailColumn,\n        labels,\n      }),\n    [roles, stateOf, extra, actions, actionsHeader, editableRole, onRoleChange, roleOf, emailColumn, labels],\n  );\n}\n"],"mappings":";AA6LiB,SA+HR,UA/HQ,KAET,YAFS;AA7LjB,SAAS,eAAe;AAExB,SAAS,UAAU;AAGnB,SAAS,cAAc,oBAAwC;AAC/D,SAAS,kBAAkB,UAAU,kBAAkB;AAIvD,SAAS,wBAAwB;AACjC,SAAS,mBAAmB;AAE5B,SAAS,kBAAkB;AAE3B,SAAS,kBAAkB;AAC3B,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAE3B,SAAS,kCAAkC;AA6EpC,SAAS,gBAAgB,KAA0C;AACxE,QAAM,MAAqB,CAAC;AAC5B,MAAI,IAAI,yBAAyB,IAAI,uBAAuB;AAC1D,QAAI,KAAK,EAAE,OAAO,YAAY,MAAM,IAAI,yBAAyB,KAAK,CAAC;AAAA,EACzE,WAAW,IAAI,cAAc,QAAW;AACtC,QAAI,KAAK,IAAI,YAAY,WAAW,UAAU;AAAA,EAChD;AACA,MAAI,IAAI,mBAAmB,MAAO,KAAI,KAAK,YAAY;AACvD,MAAI,IAAI,4BAA6B,KAAI,KAAK,gBAAgB;AAC9D,SAAO;AACT;AAGO,MAAM,wBAAwB,CAAC,QAAQ,SAAS,QAAQ,WAAW,YAAY;AAW/E,SAAS,eAAe,OAAiD;AAC9E,QAAM,QAAQ,MAAM,KAAK,CAAC,MAAO,sBAA4C,SAAS,EAAE,GAAG,CAAC;AAC5F,SAAO,QAAS,YAAY,CAAC,KAAK,CAAC,KAAK,SAAa;AACvD;AAoDO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA,SAAS;AAAA,EACT;AAAA,EACA,QAAQ;AAAA,EACR;AACF,GAA0B;AACxB,QAAM,SAAS,aAAa,UAAU;AACtC,QAAM,QAAQ,YAAY,EAAE,OAAO,QAAQ,OAAO,MAAM,QAAQ,MAAM,KAAK,GAAG,MAAM;AACpF,QAAM,WAAW,SAAS,IAAI,KAAK;AACnC,SACE,qBAAC,SAAI,WAAW,GAAG,qCAAqC,SAAS,GAC9D;AAAA,cAAU,oBAAC,cAAW,QAAgB,MAAY,OAAc,MAAK,MAAK;AAAA,IAC3E,qBAAC,SAAI,WAAU,WACb;AAAA,2BAAC,SAAI,WAAU,qCACb;AAAA,4BAAC,UAAK,gBAAY,MAAC,WAAU,iDAC1B,mBAAS,SACZ;AAAA,QACC;AAAA,SACH;AAAA,MACC,SAAS,WACR,oBAAC,SAAI,gBAAY,MAAC,WAAU,2CACzB,mBACH;AAAA,OAEJ;AAAA,KACF;AAEJ;AA6BO,SAAS,eAAe,EAAE,SAAS,MAAM,QAAQ,WAAW,GAAwB;AACzF,QAAM,SAAS,aAAa,cAAc,4BAA4B,UAAU;AAChF,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA;AAAA,MACA,UAAS;AAAA,MACT,QAAQ,EAAE,YAAY,OAAO,WAAW;AAAA;AAAA,EAC1C;AAEJ;AAgDA,SAAS,QACP,KACA,QACK;AACL,QAAM,MAAM,SAAS,OAAO,GAAG,IAAM,IAAI,SAAS,IAAI;AACtD,MAAI,QAAQ,QAAQ,QAAQ,UAAa,QAAQ,GAAI,QAAO,CAAC;AAC7D,SAAO,OAAO,QAAQ,WAAW,CAAC,GAAQ,IAAI,CAAC,GAAI,GAAoB;AACzE;AAIA,SAAS,YAA8B,OAA0B,MAA+B;AAC9F,QAAM,QAAS,OAAO,KAAK,KAAK,EAAU,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,KAAK;AACzE,SAAO,SAAS,UAAa,EAAE,QAAQ,SAAS,CAAC,GAAG,OAAO,IAAI,IAAI;AACrE;AAIA,SAAS,QAAiC,EAAE,KAAK,SAAS,GAAsD;AAC9G,QAAM,SAAS,aAAa;AAC5B,QAAM,OAAO;AAAA,IACX,EAAE,OAAO,IAAI,YAAY,MAAM,IAAI,WAAW,MAAM,IAAI,cAAc,OAAO,IAAI,MAAM;AAAA,IACvF;AAAA,EACF;AACA,SAAO,gCAAG,mBAAS,IAAI,GAAE;AAC3B;AAEA,SAAS,WAAW,EAAE,OAAO,GAAuC;AAClE,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SACE,oBAAC,SAAI,WAAU,wBACZ,iBAAO,IAAI,CAAC,UAAU;AACrB,UAAM,OAAO,OAAO,UAAU,WAAW,EAAE,OAAO,MAAM,IAAI;AAC5D,WACE,oBAAC,oBAAkC,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,MAAM,KAAK,MAAM,MAAK,MAC1F,eAAK,SADe,KAAK,KAE5B;AAAA,EAEJ,CAAC,GACH;AAEJ;AAgCO,SAAS,kBAAsE;AAAA,EACpF;AAAA,EACA,UAAU;AAAA,EACV,QAAQ,CAAC;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EACd,QAAQ;AACV,GAAyD;AACvD,QAAM,SAA2B,EAAE,GAAG,4BAA4B,GAAG,WAAW;AAChF,QAAM,YAAY,CAAC,QACjB,QAAQ,KAAK,MAAM,EAChB,IAAI,CAAC,SAAS,MAAM,IAAI,GAAG,SAAS,IAAI,EACxC,KAAK,IAAI;AACd,QAAM,UAAgC;AAAA,IACpC;AAAA,MACE,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,MAAM,CAAC,QACL;AAAA,QAAC;AAAA;AAAA,UACC,QAAQ,EAAE,OAAO,IAAI,YAAY,MAAM,IAAI,UAAU;AAAA,UACrD,MAAM,IAAI;AAAA,UACV,OAAO,IAAI;AAAA;AAAA,MACb;AAAA;AAAA,MAGF,QAAQ,CAAC,QAAQ,GAAG,IAAI,aAAa,EAAE,IAAI,IAAI,cAAc,EAAE,GAAG,KAAK,EAAE,kBAAkB,KAAK,IAAI;AAAA;AAAA,MAEpG,UAAU,CAAC,QACT,CAAC,IAAI,YAAY,IAAI,WAAW,IAAI,WAAW,IAAI,YAAY,IAAI,cAAc,IAAI,KAAK,EACvF,OAAO,OAAO,EACd,KAAK,GAAG;AAAA,MACb,eAAe;AAAA;AAAA;AAAA,MAGf,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,aAAa;AACf,YAAQ,KAAK;AAAA,MACX,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,WAAW;AAAA,MACX,MAAM,CAAC,QACL,oBAAC,UAAK,gBAAY,MAAC,WAAU,kBAC1B,cAAI,OACP;AAAA,MAEF,QAAQ,CAAC,QAAQ,IAAI,MAAM,YAAY;AAAA,MACvC,UAAU,CAAC,QAAQ,IAAI;AAAA,MACvB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AACA,UAAQ;AAAA,IACN;AAAA,MACE,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,MAAM,CAAC,QAAQ;AACb,cAAM,OAAO,QAAQ,KAAK,MAAM;AAChC,cAAM,UAAU,KAAK,UAAU,IAAI,eAAe,GAAG,IAAI;AACzD,YAAI,WAAW,cAAc;AAC3B,gBAAM,QAAwB,YAAY,OAAO,CAAC,IAAI;AACtD,iBACE,oBAAC,WAAQ,KACN,WAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAUA,qBAAC,SACC;AAAA;AAAA,gBAAC;AAAA;AAAA,kBACC,MAAK;AAAA,kBACL;AAAA,kBACA,OAAO,KAAK,CAAC,KAAK;AAAA,kBAClB;AAAA,kBACA,SAAS,MAAM;AAAA,kBACf,gBAAgB,MAAM;AAAA,kBACtB,sBAAsB,MAAM;AAAA,kBAC5B,UAAU,CAAC,SAAS,aAAa,KAAK,IAAI;AAAA;AAAA,cAC5C;AAAA,cACA,oBAAC,oBAAiB,MAAK,MAAK,QAAQ,YAAY,OAAO,KAAK,CAAC,CAAC,GAAG;AAAA,eACnE;AAAA,aAEJ;AAAA,QAEJ;AACA,YAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,eACE,oBAAC,SAAI,WAAU,wBACZ,eAAK,IAAI,CAAC,SACT,oBAAC,YAAuB,OAAO,MAAM,OAAc,MAAK,QAAtC,IAA2C,CAC9D,GACH;AAAA,MAEJ;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,UAAU,CAAC,QAAQ,QAAQ,KAAK,MAAM,EAAE,CAAC,KAAK;AAAA,QAC9C,SAAU,OAAO,KAAK,KAAK,EAAU,IAAI,CAAC,WAAW,EAAE,OAAO,OAAO,MAAM,KAAK,EAAE,MAAM,EAAE;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA;AAAA,MAEf,MAAM,CAAC,QAAQ;AACb,cAAM,SAAS,QAAQ,GAAG;AAC1B,eAAO,OAAO,WAAW,IAAI,OAAO,oBAAC,cAAW,QAAgB;AAAA,MAClE;AAAA;AAAA;AAAA,MAGA,MAAM;AAAA,IACR;AAAA,IACA,WAAc;AAAA,MACZ,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,OAAO,CAAC,QAAQ,IAAI,cAAc;AAAA;AAAA,MAElC,QAAQ,EAAE,cAAc,MAAM,aAAa,EAAE;AAAA,IAC/C,CAAC;AAAA;AAAA;AAAA;AAAA,IAID,WAAc;AAAA,MACZ,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,OAAO,CAAC,QAAQ,IAAI,iBAAiB;AAAA,MACrC,SAAS;AAAA,MACT,OAAO,OAAO;AAAA,MACd,QAAQ,EAAE,QAAQ,aAAa,aAAa,EAAE;AAAA,IAChD,CAAC;AAAA,IACD,GAAG;AAAA,EACL;AACA,MAAI,SAAS;AACX,YAAQ,KAAK;AAAA,MACX,KAAK;AAAA;AAAA,MAEL,QACE,kBAAkB,QAAQ,oBAAC,UAAK,WAAU,WAAW,iBAAO,SAAQ,IAAW,iBAAiB,OAAO;AAAA,MACzG,YAAY,OAAO;AAAA;AAAA;AAAA,MAGnB,MAAM,CAAC,QACL,oBAAC,WAAQ,KACN,WAAC,SAAS,oBAAC,kBAAe,SAAS,QAAQ,GAAG,GAAG,MAAY,QAAQ,YAAY,GACpF;AAAA,MAEF,WAAW;AAAA,MACX,eAAe;AAAA;AAAA,MAEf,WAAW;AAAA;AAAA,MAEX,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOO,SAAS,qBAAyE;AAAA,EACvF;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAAyD;AACvD,QAAM,SAAS,aAAa,cAAc,4BAA4B,UAAU;AAChF,SAAO;AAAA,IACL,MACE,kBAAwB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACH,CAAC,OAAO,SAAS,OAAO,SAAS,eAAe,cAAc,cAAc,QAAQ,aAAa,MAAM;AAAA,EACzG;AACF;","names":[]}
+{"version":3,"sources":["../../src/admin/user-roster.tsx"],"sourcesContent":["import { useMemo } from \"react\";\nimport type { ReactNode } from \"react\";\nimport { cn } from \"../lib/cn\";\nimport type { DateInput } from \"../lib/format\";\nimport type { PersonName } from \"../lib/person-name\";\nimport { useKitLabels, useKitLocale, type LabelOverride } from \"../i18n/kit-labels\";\nimport { AccountStateChip, RoleChip, dateColumn } from \"../components/account-chips\";\nimport type { AccountState, RoleVocabulary } from \"../components/account-chips\";\nimport type { ChipTone } from \"../components/chip\";\nimport type { DataTableColumn } from \"../components/data-table\";\nimport { SelectWidthFloor } from \"../components/field-base\";\nimport { encodeSorts } from \"../components/data-table-sort\";\nimport type { SortState } from \"../components/data-table-sort\";\nimport { RowActions } from \"../components/row-actions\";\nimport type { RowAction, RowActionList } from \"../components/row-actions\";\nimport { UserAvatar } from \"../components/user-avatar\";\nimport { personLabel } from \"./admin-parts\";\nimport { RoleSelect } from \"./role-select\";\nimport type { RoleLock } from \"./role-select\";\nimport { DEFAULT_USER_ROSTER_LABELS } from \"./user-roster-labels\";\n\n/**\n * The admin's user list (docs/user-admin-harmonization.md §3): a column preset for the\n * kit's `DataTable`, not a table of its own.\n *\n * keksdose built its roster by hand (1150 lines, its own Badge), Kurvenschmiede on the\n * kit `DataTable` with the 0.18 chips, kastlan as a settings page. What the three share\n * is the row — name over address, a role, the account's states, created, last login, the\n * app's own columns, and a handful of actions — so that is what the kit draws, and the\n * table, its paging, its sort and its filters stay the app's `DataTable` wiring:\n *\n * ```tsx\n * const columns = useUserRosterColumns<AdminUserRow, Role>({ roles: ROLES, actions, extra });\n * <DataTable rows={page.users} columns={columns} rowKey={(r) => r.id}\n *   serverPagination={{ page, pageSize, total: page.total, onPageChange }}\n *   sorts={sorts} onSortsChange={setSorts} />\n * // GET /admin/users?sort=${userRosterSort(sorts)}&…\n * ```\n *\n * The column keys ARE the server's sort keys (§3.1): `name`, `email`, `role`, `created`,\n * `last_login` — so {@link userRosterSort} turns the table's sort state into the query\n * as it is. Phone cards come from the same columns: the identity is the card's headline\n * with the account's states as chips beside it, the role, last login and the actions are\n * its three fields, created is left off.\n */\n\n/* ── Rows and states ────────────────────────────────────────────────────────── */\n\n/**\n * The fields of the contract's `AdminUserRow` the preset reads (§3.2, the auth\n * contract's `UserResponse` core). An app's row has more — its `extra` — and the\n * preset passes the whole row to every callback.\n */\nexport interface UserRosterRow extends AdminUserStateFields {\n  id: string | number;\n  email: string;\n  first_name?: string | null;\n  last_name?: string | null;\n  /** The derived whole name — only the fallback when both parts are blank. */\n  display_name?: string | null;\n  /** keksdose, Kurvenschmiede: one role. */\n  role?: string | null;\n  /** kastlan: the account's roles in the current company. Wins over `role`. */\n  roles?: readonly string[] | null;\n  created_at?: DateInput;\n  /** Account-wide; kastlan's comes from its session rows (§3.2). */\n  last_login_at?: DateInput;\n}\n\n/** The state fields of the contract's row that {@link adminUserStates} maps (§3.2). */\nexport interface AdminUserStateFields {\n  is_active?: boolean;\n  email_verified?: boolean;\n  password_change_required_at?: string | null;\n  /** `after_days` mode: the day the account is erased (§6.4). */\n  deletion_scheduled_at?: string | null;\n  /** When the user asked. The only deletion field in kastlan's `operator` mode, where\n   *  nothing is scheduled. */\n  deletion_requested_at?: string | null;\n}\n\n/** One state chip of a row: an {@link AccountState}, or one with its `date` (the\n *  `deletion` day), a `tone` or the app's own words. */\nexport type RosterState = AccountState | { state: AccountState; date?: DateInput; tone?: ChipTone; label?: ReactNode };\n\n/**\n * The contract's row as state chips (§3.2: \"map 1:1 to the kit's AccountStateChip\"):\n *\n * - marked for deletion → `deletion` with the scheduled day (none in `operator` mode),\n *   IN PLACE of `inactive` — such an account is always deactivated (§2.1);\n * - else `active` / `inactive` from `is_active`;\n * - `unverified` when `email_verified` is `false` (not when it is missing);\n * - `passwordChange` while `password_change_required_at` is set.\n */\nexport function adminUserStates(row: AdminUserStateFields): RosterState[] {\n  const out: RosterState[] = [];\n  if (row.deletion_scheduled_at || row.deletion_requested_at) {\n    out.push({ state: \"deletion\", date: row.deletion_scheduled_at ?? null });\n  } else if (row.is_active !== undefined) {\n    out.push(row.is_active ? \"active\" : \"inactive\");\n  }\n  if (row.email_verified === false) out.push(\"unverified\");\n  if (row.password_change_required_at) out.push(\"passwordChange\");\n  return out;\n}\n\n/** The server's sort keys, which are the preset's column keys (§3.1). */\nexport const USER_ROSTER_SORT_KEYS = [\"name\", \"email\", \"role\", \"created\", \"last_login\"] as const;\nexport type UserRosterSortKey = (typeof USER_ROSTER_SORT_KEYS)[number];\n\n/**\n * The table's sort state as the `sort` query parameter of `GET /admin/users` (§3.1), in\n * the DataTable's own encoding ({@link encodeSorts}: `\"last_login.desc\"`), which\n * server-kit 0.4 reads beside the `-key` form. Only the first criterion on one of the\n * server's keys: an app's own column (`owned`) is the client's to sort, and the query\n * takes one key — a shift-clicked second criterion is not sent. `undefined` when nothing\n * the server knows is sorted, so its default order applies.\n */\nexport function userRosterSort(sorts: readonly SortState[]): string | undefined {\n  const first = sorts.find((s) => (USER_ROSTER_SORT_KEYS as readonly string[]).includes(s.key));\n  return first ? (encodeSorts([first]) ?? undefined) : undefined;\n}\n\n/* ── Labels ─────────────────────────────────────────────────────────────────── */\n\n/** The `userRoster` namespace: the preset's headers and the action menu's words. */\nexport interface UserRosterLabels {\n  /** The identity column — the name with the address under it. */\n  name: string;\n  /** The separate address column (`emailColumn`). */\n  email: string;\n  role: string;\n  state: string;\n  created: string;\n  lastLogin: string;\n  /** A last login that never happened. */\n  never: string;\n  /** The actions column's (hidden) header. */\n  actions: string;\n  /** The action menu's button and panel — \"Actions for Ada Example\". */\n  actionsFor: (name: string) => string;\n}\n\n// Defined in ./user-roster-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_USER_ROSTER_LABELS };\n\n/* ── UserIdentityCell ───────────────────────────────────────────────────────── */\n\nexport interface UserIdentityCellProps {\n  /** First and last name (auth §3.2), shown in the READER's order. */\n  person?: PersonName | null;\n  /** A whole name, for an API that still sends `display_name` only. */\n  name?: string | null;\n  email?: string | null;\n  /** The initials avatar before the name. Default true. */\n  avatar?: boolean;\n  /** After the name, on its line — a \"You\" chip, a demo mark. */\n  badge?: ReactNode;\n  /** Over the provider's locale. */\n  locale?: string;\n  className?: string;\n}\n\n/**\n * Who an account is, in one cell (§3.3): the initials avatar, the name in the reader's\n * order ({@link formatPersonName} — \"Example Ada\" in Hungarian) and the address under it\n * — the cell both rosters drew by hand. An account with no name yet (a migrated row\n * before `CompleteNameDialog`, an invitee) shows its address once, as the name.\n *\n * Both lines carry `data-private`, so keksdose's demo blur reaches them, and both end\n * in \"…\" at Normal only: from Large up they wrap (`truncate-until-large`, 0.33,\n * docs/text-size-harmonization.md §10.17), since a cut name or address is a finding there.\n */\nexport function UserIdentityCell({\n  person,\n  name,\n  email,\n  avatar = true,\n  badge,\n  locale: localeProp,\n  className,\n}: UserIdentityCellProps) {\n  const locale = useKitLocale(localeProp);\n  const named = personLabel({ first: person?.first, last: person?.last, name }, locale);\n  const address = (email ?? \"\").trim();\n  return (\n    <div className={cn(\"flex min-w-0 items-center gap-2.5\", className)}>\n      {avatar && <UserAvatar person={person} name={name} email={email} size=\"sm\" />}\n      <div className=\"min-w-0\">\n        <div className=\"flex min-w-0 items-center gap-1.5\">\n          <span data-private className=\"truncate-until-large font-medium text-primary\">\n            {named || address}\n          </span>\n          {badge}\n        </div>\n        {named && address && (\n          <div data-private className=\"truncate-until-large text-xs text-muted\">\n            {address}\n          </div>\n        )}\n      </div>\n    </div>\n  );\n}\n\n/* ── The row's actions ──────────────────────────────────────────────────────── */\n\n/** One entry of a row's action menu (§4) — the kit's {@link RowAction} since 0.32,\n *  which generalised it for every dense row (docs/text-size-harmonization.md §10.8). */\nexport type UserRowAction = RowAction;\n\n/** What `actions(row)` may return: entries, and `false` / `null` for the ones a\n *  condition left out (`row.is_active && {…}`). */\nexport type UserRowActionList = RowActionList;\n\nexport interface UserRowActionsProps {\n  actions: UserRowActionList;\n  /** The account's name, for the menu's name — \"Actions for Ada Example\". */\n  name: string;\n  labels?: LabelOverride<UserRosterLabels>;\n}\n\n/**\n * A row's actions as one \"…\" button and a menu of them: keksdose had a strip of icon\n * buttons in the expanded row, Kurvenschmiede five text buttons in a cell — neither fits\n * a phone card, and both grow with every action §2.4 adds. The menu is portalled, so a\n * table's scroller cannot clip it; Escape and an outside press close it, and focus goes\n * back to the button, which is where a confirmation dialog then returns it.\n *\n * Since 0.32 this is {@link RowActions} with `collapse=\"menu\"` — the menu at every size —\n * named by the roster's own `actionsFor`.\n */\nexport function UserRowActions({ actions, name, labels: labelsProp }: UserRowActionsProps) {\n  const labels = useKitLabels(\"userRoster\", DEFAULT_USER_ROSTER_LABELS, labelsProp);\n  return <RowActions actions={actions} name={name} collapse=\"menu\" labels={{ actionsFor: labels.actionsFor }} />;\n}\n\n/* ── The preset ─────────────────────────────────────────────────────────────── */\n\n/** How a row's role may be changed inline: `true`, or with reasons. */\nexport interface RoleEditing<R extends string> {\n  /** Why the whole select is locked for this row — `\"self\"`, `\"last_admin\"`, or words. */\n  disabledReason?: RoleLock;\n  /** Why one role cannot be chosen for this row (a string: it goes inside an option). */\n  optionDisabledReason?: (role: R) => string | undefined;\n  /** The roles that may be chosen. Default: the whole vocabulary. */\n  offered?: readonly R[];\n}\n\nexport interface UserRosterColumnsOptions<T extends UserRosterRow, R extends string = string> {\n  /** The app's roles, as `RoleChip` reads them. */\n  roles: RoleVocabulary<R>;\n  /** The row's state chips. Default {@link adminUserStates}, which reads the contract's\n   *  fields (`is_active`, `email_verified`, `password_change_required_at`,\n   *  `deletion_scheduled_at`, `deletion_requested_at`). */\n  stateOf?: (row: T) => readonly RosterState[];\n  /** The app's own columns — keksdose's plan and key custody, Kurvenschmiede's owned\n   *  counts — after the dates, before the actions. */\n  extra?: readonly DataTableColumn<T>[];\n  /** The row's action menu (§4). Left out: no actions column. */\n  actions?: (row: T) => UserRowActionList;\n  /** The actions column's heading (0.46.1, keksdose dev#598 rework — a VISIBLE \"Actions\"\n   *  on every table with an actions column). Default: `labels.actions`, shown. A node\n   *  replaces it; `false` keeps the pre-0.46.1 heading, a screen reader's name only. */\n  actionsHeader?: ReactNode | false;\n  /**\n   * Whether this row's role is a select rather than a chip, and with which reasons.\n   * Left out, or `false`: a chip. kastlan's several roles are never a select here — they\n   * are a \"Manage roles\" action that opens `RolesEditor`.\n   */\n  editableRole?: (row: T) => boolean | RoleEditing<R>;\n  /** A role was picked in a row's select. The app confirms (`acknowledge`) and sends it. */\n  onRoleChange?: (row: T, role: R) => void;\n  /** The row's role(s). Default `row.roles ?? row.role`. */\n  roleOf?: (row: T) => R | readonly R[] | null | undefined;\n  /** A separate, sortable \"Email\" column (the server's `email` sort key) beside the\n   *  identity. Default false: the address is under the name already. */\n  emailColumn?: boolean;\n  /** The words, already resolved. Default English; {@link useUserRosterColumns} reads\n   *  the provider's `userRoster` namespace. */\n  labels?: LabelOverride<UserRosterLabels>;\n}\n\nfunction rolesOf<T extends UserRosterRow, R extends string>(\n  row: T,\n  roleOf: UserRosterColumnsOptions<T, R>[\"roleOf\"],\n): R[] {\n  const raw = roleOf ? roleOf(row) : ((row.roles ?? row.role) as R | readonly R[] | null | undefined);\n  if (raw === null || raw === undefined || raw === \"\") return [];\n  return typeof raw === \"string\" ? [raw as R] : [...(raw as readonly R[])];\n}\n\n/** What a row's role select can show as its value: every role's word, and a held key\n *  the vocabulary does not know (RoleSelect shows it as the key). */\nfunction roleWordsOf<R extends string>(roles: RoleVocabulary<R>, held: R | undefined): string[] {\n  const words = (Object.keys(roles) as R[]).map((role) => roles[role].label);\n  return held !== undefined && !(held in roles) ? [...words, held] : words;\n}\n\n/** The row's name in the reader's order — a component, because the order is the\n *  READER's and the locale comes from the provider. */\nfunction RowName<T extends UserRosterRow>({ row, children }: { row: T; children: (name: string) => ReactNode }) {\n  const locale = useKitLocale();\n  const name = personLabel(\n    { first: row.first_name, last: row.last_name, name: row.display_name, email: row.email },\n    locale,\n  );\n  return <>{children(name)}</>;\n}\n\nfunction StateChips({ states }: { states: readonly RosterState[] }) {\n  if (states.length === 0) return null;\n  return (\n    <div className=\"flex flex-wrap gap-1\">\n      {states.map((entry) => {\n        const spec = typeof entry === \"string\" ? { state: entry } : entry;\n        return (\n          <AccountStateChip key={spec.state} state={spec.state} date={spec.date} tone={spec.tone} size=\"xs\">\n            {spec.label}\n          </AccountStateChip>\n        );\n      })}\n    </div>\n  );\n}\n\n/**\n * The roster's columns, in the contract's order (§3.3):\n *\n * | key | cell | sort | phone | fit (0.50) |\n * |---|---|---|---|---|\n * | `name` | {@link UserIdentityCell} | last, first | the card's headline | `grow` |\n * | `email` | the address (`emailColumn` only) | address | hidden | — |\n * | `role` | `RoleChip`(s), or {@link RoleSelect} where `editableRole` | role | field | — |\n * | `state` | `AccountStateChip`s from `stateOf` | — | chips beside the headline | — |\n * | `created` | `dateColumn` | instant | hidden | `fitPriority: 1` |\n * | `last_login` | `dateColumn`, relative, \"Never\" | instant | field | `fitPriority: 2` |\n * | …`extra` | the app's | the app's | off the card unless marked `mobile: \"secondary\"` | the app's |\n * | `actions` | {@link UserRowActions} | — | the card's actions row (`role: \"actions\"`) | — |\n *\n * The fit (0.50, kastlan K2): Name takes the rest of the row, and a table narrower than\n * its columns leaves out Created, then Last login (DataTable's `grow` / `fitPriority`).\n * The role and state chips still wrap in their cells (0.48), and the other cells keep one\n * line at Normal. `{ ...col, grow: undefined, fitPriority: undefined }` restores the 0.49\n * layout; an `extra` column takes a `fitPriority` of its own to leave too.\n *\n * The card holds three fields — `role`, `last_login` and one more: an `extra` column marked\n * `mobile: \"secondary\"` takes that place. The actions are `role: \"actions\"` (0.49), drawn\n * after the fields and never one of the three. Drop them from the card with\n * `mobile: \"hidden\"`, or draw a `mobileCard`.\n *\n * Pure: hand it resolved words, or use {@link useUserRosterColumns}. The keys are stable,\n * so an app may drop or move a column (`columns.filter((c) => c.key !== \"created\")`).\n * Under `serverPagination` the `sortBy`s only make the headers clickable; the app sends\n * the sort ({@link userRosterSort}).\n */\nexport function userRosterColumns<T extends UserRosterRow, R extends string = string>({\n  roles,\n  stateOf = adminUserStates,\n  extra = [],\n  actions,\n  actionsHeader,\n  editableRole,\n  onRoleChange,\n  roleOf,\n  emailColumn = false,\n  labels: labelsProp,\n}: UserRosterColumnsOptions<T, R>): DataTableColumn<T>[] {\n  const labels: UserRosterLabels = { ...DEFAULT_USER_ROSTER_LABELS, ...labelsProp };\n  const roleWords = (row: T) =>\n    rolesOf(row, roleOf)\n      .map((role) => roles[role]?.label ?? role)\n      .join(\", \");\n  const columns: DataTableColumn<T>[] = [\n    {\n      key: \"name\",\n      header: labels.name,\n      cell: (row) => (\n        <UserIdentityCell\n          person={{ first: row.first_name, last: row.last_name }}\n          name={row.display_name}\n          email={row.email}\n        />\n      ),\n      // By last name, then first (auth §3.2), as the server sorts `name`.\n      sortBy: (row) => `${row.last_name ?? \"\"} ${row.first_name ?? \"\"}`.trim().toLocaleLowerCase() || row.email,\n      // Either part, in either order, or the address (auth §10.6).\n      filterBy: (row) =>\n        [row.first_name, row.last_name, row.last_name, row.first_name, row.display_name, row.email]\n          .filter(Boolean)\n          .join(\" \"),\n      mobilePrimary: true,\n      // Takes the rest of the row and ellipsises (0.50, kastlan K2): the roster fits its\n      // pane — a settings column, an admin page — instead of scrolling sideways.\n      grow: true,\n    },\n  ];\n  if (emailColumn) {\n    columns.push({\n      key: \"email\",\n      header: labels.email,\n      className: \"whitespace-nowrap\",\n      cell: (row) => (\n        <span data-private className=\"text-secondary\">\n          {row.email}\n        </span>\n      ),\n      sortBy: (row) => row.email.toLowerCase(),\n      filterBy: (row) => row.email,\n      mobileHidden: true,\n    });\n  }\n  columns.push(\n    {\n      key: \"role\",\n      header: labels.role,\n      cell: (row) => {\n        const held = rolesOf(row, roleOf);\n        const editing = held.length <= 1 ? editableRole?.(row) : false;\n        if (editing && onRoleChange) {\n          const rules: RoleEditing<R> = editing === true ? {} : editing;\n          return (\n            <RowName row={row}>\n              {(name) => (\n                // The column keeps room for the select's longest ROLE word in the app's\n                // language (0.51, Kurvenschmiede N5): beside the `grow` Name every other\n                // column is squeezed to its min-content, which a `w-full` select does not\n                // have, so the role select was the header's ~92px and read \"Meml…\",\n                // \"Admi…\". Every word of the vocabulary, not only the row's offered\n                // ones: the column is as wide as its widest row, so the rows line up, and\n                // a role held but not offered (KS's Reviewer) is still a selected value.\n                // Not the options' reasons (\"Customer (owns work)\"): they are never the\n                // selected value, and the open list is as wide as it needs anyway.\n                <div>\n                  <RoleSelect<R>\n                    size=\"sm\"\n                    name={name}\n                    value={held[0] ?? null}\n                    roles={roles}\n                    offered={rules.offered}\n                    disabledReason={rules.disabledReason}\n                    optionDisabledReason={rules.optionDisabledReason}\n                    onChange={(role) => onRoleChange(row, role)}\n                  />\n                  <SelectWidthFloor size=\"sm\" values={roleWordsOf(roles, held[0])} />\n                </div>\n              )}\n            </RowName>\n          );\n        }\n        if (held.length === 0) return null;\n        return (\n          <div className=\"flex flex-wrap gap-1\">\n            {held.map((role) => (\n              <RoleChip<R> key={role} value={role} roles={roles} size=\"xs\" />\n            ))}\n          </div>\n        );\n      },\n      sortBy: roleWords,\n      filter: {\n        type: \"select\",\n        getValue: (row) => rolesOf(row, roleOf)[0] ?? \"\",\n        options: (Object.keys(roles) as R[]).map((value) => ({ value, label: roles[value].label })),\n      },\n      mobile: \"secondary\",\n    },\n    {\n      key: \"state\",\n      header: labels.state,\n      // No states, no cell: the phone card then shows no chip beside the name.\n      cell: (row) => {\n        const states = stateOf(row);\n        return states.length === 0 ? null : <StateChips states={states} />;\n      },\n      // Beside the name on the phone card, so the role, last login and the actions keep\n      // the card's three fields.\n      role: \"status\",\n    },\n    dateColumn<T>({\n      key: \"created\",\n      header: labels.created,\n      value: (row) => row.created_at ?? null,\n      // The first to leave a narrow table (0.50, kastlan K2), then last login.\n      column: { mobileHidden: true, fitPriority: 1 },\n    }),\n    // How long ago rather than a date — the question is \"recently?\" — with the exact\n    // time beside it (keksdose's last-seen column, Kurvenschmiede's; 0.32 §4: never only\n    // in a tooltip).\n    dateColumn<T>({\n      key: \"last_login\",\n      header: labels.lastLogin,\n      value: (row) => row.last_login_at ?? null,\n      display: \"relative\",\n      empty: labels.never,\n      column: { mobile: \"secondary\", fitPriority: 2 },\n    }),\n    ...extra,\n  );\n  if (actions) {\n    columns.push({\n      key: \"actions\",\n      // On screen, as every actions column's heading is (0.46.1, keksdose dev#598 rework).\n      header:\n        actionsHeader === false ? <span className=\"sr-only\">{labels.actions}</span> : (actionsHeader ?? labels.actions),\n      headerText: labels.actions,\n      // The caller's own words only: the menu reads the provider's itself, and the\n      // English defaults merged in above must not shadow them.\n      cell: (row) => (\n        <RowName row={row}>\n          {(name) => <UserRowActions actions={actions(row)} name={name} labels={labelsProp} />}\n        </RowName>\n      ),\n      className: \"w-px whitespace-nowrap text-end\",\n      headClassName: \"w-px text-end\",\n      // The menu button keeps its own click: a row link must not wrap it.\n      noRowLink: true,\n      // Always on the phone card, after the fields and never one of the three (0.49).\n      role: \"actions\",\n    });\n  }\n  return columns;\n}\n\n/**\n * {@link userRosterColumns} with the `userRoster` words from the provider, memoised on\n * the options — pass stable callbacks (`useCallback`) and a module-level vocabulary, or\n * the columns are rebuilt on every render.\n */\nexport function useUserRosterColumns<T extends UserRosterRow, R extends string = string>({\n  roles,\n  stateOf,\n  extra,\n  actions,\n  actionsHeader,\n  editableRole,\n  onRoleChange,\n  roleOf,\n  emailColumn,\n  labels: labelsProp,\n}: UserRosterColumnsOptions<T, R>): DataTableColumn<T>[] {\n  const labels = useKitLabels(\"userRoster\", DEFAULT_USER_ROSTER_LABELS, labelsProp);\n  return useMemo(\n    () =>\n      userRosterColumns<T, R>({\n        roles,\n        stateOf,\n        extra,\n        actions,\n        actionsHeader,\n        editableRole,\n        onRoleChange,\n        roleOf,\n        emailColumn,\n        labels,\n      }),\n    [roles, stateOf, extra, actions, actionsHeader, editableRole, onRoleChange, roleOf, emailColumn, labels],\n  );\n}\n"],"mappings":";AA2LiB,SAwHR,UAxHQ,KAET,YAFS;AA3LjB,SAAS,eAAe;AAExB,SAAS,UAAU;AAGnB,SAAS,cAAc,oBAAwC;AAC/D,SAAS,kBAAkB,UAAU,kBAAkB;AAIvD,SAAS,wBAAwB;AACjC,SAAS,mBAAmB;AAE5B,SAAS,kBAAkB;AAE3B,SAAS,kBAAkB;AAC3B,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAE3B,SAAS,kCAAkC;AA2EpC,SAAS,gBAAgB,KAA0C;AACxE,QAAM,MAAqB,CAAC;AAC5B,MAAI,IAAI,yBAAyB,IAAI,uBAAuB;AAC1D,QAAI,KAAK,EAAE,OAAO,YAAY,MAAM,IAAI,yBAAyB,KAAK,CAAC;AAAA,EACzE,WAAW,IAAI,cAAc,QAAW;AACtC,QAAI,KAAK,IAAI,YAAY,WAAW,UAAU;AAAA,EAChD;AACA,MAAI,IAAI,mBAAmB,MAAO,KAAI,KAAK,YAAY;AACvD,MAAI,IAAI,4BAA6B,KAAI,KAAK,gBAAgB;AAC9D,SAAO;AACT;AAGO,MAAM,wBAAwB,CAAC,QAAQ,SAAS,QAAQ,WAAW,YAAY;AAW/E,SAAS,eAAe,OAAiD;AAC9E,QAAM,QAAQ,MAAM,KAAK,CAAC,MAAO,sBAA4C,SAAS,EAAE,GAAG,CAAC;AAC5F,SAAO,QAAS,YAAY,CAAC,KAAK,CAAC,KAAK,SAAa;AACvD;AAoDO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA,SAAS;AAAA,EACT;AAAA,EACA,QAAQ;AAAA,EACR;AACF,GAA0B;AACxB,QAAM,SAAS,aAAa,UAAU;AACtC,QAAM,QAAQ,YAAY,EAAE,OAAO,QAAQ,OAAO,MAAM,QAAQ,MAAM,KAAK,GAAG,MAAM;AACpF,QAAM,WAAW,SAAS,IAAI,KAAK;AACnC,SACE,qBAAC,SAAI,WAAW,GAAG,qCAAqC,SAAS,GAC9D;AAAA,cAAU,oBAAC,cAAW,QAAgB,MAAY,OAAc,MAAK,MAAK;AAAA,IAC3E,qBAAC,SAAI,WAAU,WACb;AAAA,2BAAC,SAAI,WAAU,qCACb;AAAA,4BAAC,UAAK,gBAAY,MAAC,WAAU,iDAC1B,mBAAS,SACZ;AAAA,QACC;AAAA,SACH;AAAA,MACC,SAAS,WACR,oBAAC,SAAI,gBAAY,MAAC,WAAU,2CACzB,mBACH;AAAA,OAEJ;AAAA,KACF;AAEJ;AA6BO,SAAS,eAAe,EAAE,SAAS,MAAM,QAAQ,WAAW,GAAwB;AACzF,QAAM,SAAS,aAAa,cAAc,4BAA4B,UAAU;AAChF,SAAO,oBAAC,cAAW,SAAkB,MAAY,UAAS,QAAO,QAAQ,EAAE,YAAY,OAAO,WAAW,GAAG;AAC9G;AAgDA,SAAS,QACP,KACA,QACK;AACL,QAAM,MAAM,SAAS,OAAO,GAAG,IAAM,IAAI,SAAS,IAAI;AACtD,MAAI,QAAQ,QAAQ,QAAQ,UAAa,QAAQ,GAAI,QAAO,CAAC;AAC7D,SAAO,OAAO,QAAQ,WAAW,CAAC,GAAQ,IAAI,CAAC,GAAI,GAAoB;AACzE;AAIA,SAAS,YAA8B,OAA0B,MAA+B;AAC9F,QAAM,QAAS,OAAO,KAAK,KAAK,EAAU,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,KAAK;AACzE,SAAO,SAAS,UAAa,EAAE,QAAQ,SAAS,CAAC,GAAG,OAAO,IAAI,IAAI;AACrE;AAIA,SAAS,QAAiC,EAAE,KAAK,SAAS,GAAsD;AAC9G,QAAM,SAAS,aAAa;AAC5B,QAAM,OAAO;AAAA,IACX,EAAE,OAAO,IAAI,YAAY,MAAM,IAAI,WAAW,MAAM,IAAI,cAAc,OAAO,IAAI,MAAM;AAAA,IACvF;AAAA,EACF;AACA,SAAO,gCAAG,mBAAS,IAAI,GAAE;AAC3B;AAEA,SAAS,WAAW,EAAE,OAAO,GAAuC;AAClE,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SACE,oBAAC,SAAI,WAAU,wBACZ,iBAAO,IAAI,CAAC,UAAU;AACrB,UAAM,OAAO,OAAO,UAAU,WAAW,EAAE,OAAO,MAAM,IAAI;AAC5D,WACE,oBAAC,oBAAkC,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,MAAM,KAAK,MAAM,MAAK,MAC1F,eAAK,SADe,KAAK,KAE5B;AAAA,EAEJ,CAAC,GACH;AAEJ;AAgCO,SAAS,kBAAsE;AAAA,EACpF;AAAA,EACA,UAAU;AAAA,EACV,QAAQ,CAAC;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EACd,QAAQ;AACV,GAAyD;AACvD,QAAM,SAA2B,EAAE,GAAG,4BAA4B,GAAG,WAAW;AAChF,QAAM,YAAY,CAAC,QACjB,QAAQ,KAAK,MAAM,EAChB,IAAI,CAAC,SAAS,MAAM,IAAI,GAAG,SAAS,IAAI,EACxC,KAAK,IAAI;AACd,QAAM,UAAgC;AAAA,IACpC;AAAA,MACE,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,MAAM,CAAC,QACL;AAAA,QAAC;AAAA;AAAA,UACC,QAAQ,EAAE,OAAO,IAAI,YAAY,MAAM,IAAI,UAAU;AAAA,UACrD,MAAM,IAAI;AAAA,UACV,OAAO,IAAI;AAAA;AAAA,MACb;AAAA;AAAA,MAGF,QAAQ,CAAC,QAAQ,GAAG,IAAI,aAAa,EAAE,IAAI,IAAI,cAAc,EAAE,GAAG,KAAK,EAAE,kBAAkB,KAAK,IAAI;AAAA;AAAA,MAEpG,UAAU,CAAC,QACT,CAAC,IAAI,YAAY,IAAI,WAAW,IAAI,WAAW,IAAI,YAAY,IAAI,cAAc,IAAI,KAAK,EACvF,OAAO,OAAO,EACd,KAAK,GAAG;AAAA,MACb,eAAe;AAAA;AAAA;AAAA,MAGf,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,aAAa;AACf,YAAQ,KAAK;AAAA,MACX,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,WAAW;AAAA,MACX,MAAM,CAAC,QACL,oBAAC,UAAK,gBAAY,MAAC,WAAU,kBAC1B,cAAI,OACP;AAAA,MAEF,QAAQ,CAAC,QAAQ,IAAI,MAAM,YAAY;AAAA,MACvC,UAAU,CAAC,QAAQ,IAAI;AAAA,MACvB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AACA,UAAQ;AAAA,IACN;AAAA,MACE,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,MAAM,CAAC,QAAQ;AACb,cAAM,OAAO,QAAQ,KAAK,MAAM;AAChC,cAAM,UAAU,KAAK,UAAU,IAAI,eAAe,GAAG,IAAI;AACzD,YAAI,WAAW,cAAc;AAC3B,gBAAM,QAAwB,YAAY,OAAO,CAAC,IAAI;AACtD,iBACE,oBAAC,WAAQ,KACN,WAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAUA,qBAAC,SACC;AAAA;AAAA,gBAAC;AAAA;AAAA,kBACC,MAAK;AAAA,kBACL;AAAA,kBACA,OAAO,KAAK,CAAC,KAAK;AAAA,kBAClB;AAAA,kBACA,SAAS,MAAM;AAAA,kBACf,gBAAgB,MAAM;AAAA,kBACtB,sBAAsB,MAAM;AAAA,kBAC5B,UAAU,CAAC,SAAS,aAAa,KAAK,IAAI;AAAA;AAAA,cAC5C;AAAA,cACA,oBAAC,oBAAiB,MAAK,MAAK,QAAQ,YAAY,OAAO,KAAK,CAAC,CAAC,GAAG;AAAA,eACnE;AAAA,aAEJ;AAAA,QAEJ;AACA,YAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,eACE,oBAAC,SAAI,WAAU,wBACZ,eAAK,IAAI,CAAC,SACT,oBAAC,YAAuB,OAAO,MAAM,OAAc,MAAK,QAAtC,IAA2C,CAC9D,GACH;AAAA,MAEJ;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,UAAU,CAAC,QAAQ,QAAQ,KAAK,MAAM,EAAE,CAAC,KAAK;AAAA,QAC9C,SAAU,OAAO,KAAK,KAAK,EAAU,IAAI,CAAC,WAAW,EAAE,OAAO,OAAO,MAAM,KAAK,EAAE,MAAM,EAAE;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA;AAAA,MAEf,MAAM,CAAC,QAAQ;AACb,cAAM,SAAS,QAAQ,GAAG;AAC1B,eAAO,OAAO,WAAW,IAAI,OAAO,oBAAC,cAAW,QAAgB;AAAA,MAClE;AAAA;AAAA;AAAA,MAGA,MAAM;AAAA,IACR;AAAA,IACA,WAAc;AAAA,MACZ,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,OAAO,CAAC,QAAQ,IAAI,cAAc;AAAA;AAAA,MAElC,QAAQ,EAAE,cAAc,MAAM,aAAa,EAAE;AAAA,IAC/C,CAAC;AAAA;AAAA;AAAA;AAAA,IAID,WAAc;AAAA,MACZ,KAAK;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,OAAO,CAAC,QAAQ,IAAI,iBAAiB;AAAA,MACrC,SAAS;AAAA,MACT,OAAO,OAAO;AAAA,MACd,QAAQ,EAAE,QAAQ,aAAa,aAAa,EAAE;AAAA,IAChD,CAAC;AAAA,IACD,GAAG;AAAA,EACL;AACA,MAAI,SAAS;AACX,YAAQ,KAAK;AAAA,MACX,KAAK;AAAA;AAAA,MAEL,QACE,kBAAkB,QAAQ,oBAAC,UAAK,WAAU,WAAW,iBAAO,SAAQ,IAAW,iBAAiB,OAAO;AAAA,MACzG,YAAY,OAAO;AAAA;AAAA;AAAA,MAGnB,MAAM,CAAC,QACL,oBAAC,WAAQ,KACN,WAAC,SAAS,oBAAC,kBAAe,SAAS,QAAQ,GAAG,GAAG,MAAY,QAAQ,YAAY,GACpF;AAAA,MAEF,WAAW;AAAA,MACX,eAAe;AAAA;AAAA,MAEf,WAAW;AAAA;AAAA,MAEX,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOO,SAAS,qBAAyE;AAAA,EACvF;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAAyD;AACvD,QAAM,SAAS,aAAa,cAAc,4BAA4B,UAAU;AAChF,SAAO;AAAA,IACL,MACE,kBAAwB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACH,CAAC,OAAO,SAAS,OAAO,SAAS,eAAe,cAAc,cAAc,QAAQ,aAAa,MAAM;AAAA,EACzG;AACF;","names":[]}

package/dist/auth/accept-invitation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/accept-invitation.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport type { ComponentPropsWithRef, ReactNode } from \"react\";\nimport { CheckCircle2, LogIn, TimerOff, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { useAnnounce } from \"../hooks/use-announce\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button } from \"../components/button\";\nimport { EmptyState } from \"../components/empty-state\";\nimport { authErrorCode } from \"./auth-errors\";\nimport { OUTCOME_CLASS, STATUS_HEADING_CLASS, useOncePerKey } from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\nimport { DEFAULT_ACCEPT_INVITATION_LABELS } from \"./accept-invitation-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the page renders — the `acceptInvitation` namespace. keksdose's words\n *  where its `/join` page has them (`budget_share.join*`). */\nexport interface AcceptInvitationLabels {\n  /** The heading. */\n  title: string;\n  /** While the invitation is accepted. */\n  accepting: string;\n  /** Accepted, when the app did not say into what. */\n  accepted: string;\n  /** Accepted, given what it attached the account to — a company, a team, a budget. */\n  joined: (name: string) => string;\n  /** Into the app, from every outcome but \"sign in first\". */\n  continue: string;\n  /** The token is unknown, spent, or for another address. */\n  invalid: string;\n  expired: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** Under `invalid` and `expired`: an invitation is re-sent as a new one (§4.4). */\n  askAgain: string;\n  /** Nobody is signed in: an existing account accepts after sign-in (§4.4). */\n  signInFirst: string;\n  /** Under it. */\n  signInHint: string;\n  signIn: string;\n  /** Beside \"Sign in\", with `registerHref`. */\n  register: string;\n}\n\n// Defined in ./accept-invitation-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_ACCEPT_INVITATION_LABELS };\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onAccept` may resolve with. */\nexport interface AcceptInvitationResult {\n  /** What the invitation attached the account to, by name — \"Example Property Ltd\",\n   *  \"Team North\", a budget. Said in the confirmation. */\n  name?: string;\n}\n\n/** What became of an invitation that was not accepted. `signIn`: the server wants a\n *  session first (a `401`), which `signedIn` did not know about. */\nexport type AcceptInvitationFailure = \"invalid\" | \"expired\" | \"signIn\";\n\ntype Outcome = \"accepted\" | AcceptInvitationFailure;\n\nexport interface AcceptInvitationProps extends Omit<ComponentPropsWithRef<\"div\">, \"children\" | \"title\"> {\n  /** The invitation's token — the app's `?invite=` / `?token=`. Empty: the link was cut\n   *  short, and the page says so without asking anyone. */\n  token: string;\n  /** Someone is signed in on this device. Until then the page asks for a sign-in and\n   *  sends nothing: accepting attaches the invitation to the SIGNED-IN account. */\n  signedIn: boolean;\n  /**\n   * Accept it — `POST /auth/invitations/accept {token}`, once per token, as soon as\n   * someone is signed in. Resolve (with what it attached the account to, if the app\n   * knows); reject with the client's error.\n   */\n  onAccept: (token: string) => Promise<AcceptInvitationResult | void | undefined>;\n  /** Which dead end a rejection is. Default: `invitation_expired` is `expired`,\n   *  anything else `invalid` (§5.2's codes). Map a `401` to `signIn` here. */\n  classifyError?: (error: unknown) => AcceptInvitationFailure;\n  /** \"Continue\" — into the app. Default `/`. */\n  continueHref?: string;\n  /** \"Sign in\" — the app's `/login`, with a way back here (`?next=…`). Default\n   *  `/login`. */\n  signInHref?: string;\n  /** \"Create account\" beside \"Sign in\", for an invitation that may lead to a new\n   *  account — the app's `/register?invite=…`. Left out, none. */\n  registerHref?: string;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it in\n   *  `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: LabelOverride<AcceptInvitationLabels>;\n}\n\n/**\n * Accept an invitation with an EXISTING account (docs/auth-harmonization.md §4.4): the\n * link leads here, the person signs in if they are not, and the app attaches the\n * invitation — a kastlan user joining a second company, a Kurvenschmiede member a team,\n * a keksdose user a shared budget. A new address never needs this page: its link opens\n * the sign-up form, which spends the invitation itself.\n *\n * keksdose's `JoinSharePage` (features/budgets/join-page.tsx) is the model: it accepts\n * on load, once (the token is single-use, and StrictMode's double effect would send it\n * twice), and shows the outcome where its spinner was. The outcomes: accepted, with the\n * way into the app; not valid; expired (both say to ask for a new invitation, since\n * \"resend\" mints a new token); or \"sign in first\", with nothing sent. \"Continue\" REPLACES\n * this page in the history: the token is spent, so Back must not land here again.\n */\nexport function AcceptInvitation({\n  token,\n  signedIn,\n  onAccept,\n  classifyError,\n  continueHref = \"/\",\n  signInHref = \"/login\",\n  registerHref,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: AcceptInvitationProps) {\n  const labels = useKitLabels(\"acceptInvitation\", DEFAULT_ACCEPT_INVITATION_LABELS, labelsProp);\n  const [settled, setSettled] = useState<{ token: string; outcome: Outcome; name?: string } | null>(null);\n  const { announce, regionProps } = useAnnounce();\n\n  useOncePerKey(token !== \"\" && signedIn ? token : null, onAccept, (key, result) => {\n    if (result.ok) {\n      const name = result.value?.name?.trim() || undefined;\n      setSettled({ token: key, outcome: \"accepted\", name });\n      announce(name ? labels.joined(name) : labels.accepted);\n      return;\n    }\n    const failure: AcceptInvitationFailure =\n      classifyError?.(result.error) ?? (authErrorCode(result.error) === \"invitation_expired\" ? \"expired\" : \"invalid\");\n    setSettled({ token: key, outcome: failure });\n    announce(failure === \"signIn\" ? labels.signInFirst : labels[failure]);\n  });\n\n  const outcome: Outcome | \"accepting\" =\n    token === \"\"\n      ? \"invalid\"\n      : settled?.token === token\n        ? settled.outcome\n        : signedIn\n          ? \"accepting\"\n          : \"signIn\";\n\n  const continueButton = (variant: \"accent\" | \"secondary\") => (\n    <Button href={continueHref} replace variant={variant}>\n      {labels.continue}\n    </Button>\n  );\n\n  let body: ReactNode;\n  if (outcome === \"accepting\") {\n    body = <LoadingState size=\"sm\" label={labels.accepting} />;\n  } else if (outcome === \"accepted\") {\n    body = (\n      <EmptyState\n        tone=\"success\"\n        icon={<CheckCircle2 />}\n        title={settled?.name ? labels.joined(settled.name) : labels.accepted}\n        action={continueButton(\"accent\")}\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else if (outcome === \"signIn\") {\n    body = (\n      <EmptyState\n        icon={<LogIn />}\n        title={labels.signInFirst}\n        hint={labels.signInHint}\n        action={\n          <>\n            <Button href={signInHref} variant=\"accent\">\n              {labels.signIn}\n            </Button>\n            {registerHref !== undefined && (\n              <Button href={registerHref} variant=\"secondary\">\n                {labels.register}\n              </Button>\n            )}\n          </>\n        }\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else {\n    body = (\n      <EmptyState\n        tone=\"danger\"\n        icon={outcome === \"expired\" ? <TimerOff /> : <XCircle />}\n        title={token === \"\" ? labels.noToken : labels[outcome]}\n        hint={labels.askAgain}\n        action={signedIn ? continueButton(\"secondary\") : undefined}\n        className={OUTCOME_CLASS}\n      />\n    );\n  }\n\n  return (\n    <div\n      {...rest}\n      data-state={outcome}\n      aria-busy={outcome === \"accepting\" || undefined}\n      className={cn(\"space-y-3\", className)}\n    >\n      {title === null ? null : <Heading className={STATUS_HEADING_CLASS}>{title ?? labels.title}</Heading>}\n      {body}\n      {/* Rendered from the start, so the outcome is read when it arrives. */}\n      <div {...regionProps} />\n    </div>\n  );\n}\n"],"mappings":";AAsJI,SAyBM,UAzBN,KAyBM,YAzBN;AAtJJ,SAAS,gBAAgB;AAEzB,SAAS,cAAc,OAAO,UAAU,eAAe;AACvD,SAAS,UAAU;AACnB,SAAS,oBAAwC;AACjD,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,eAAe,sBAAsB,qBAAqB;AAEnE,SAAS,wCAAwC;AAiG1C,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA0B;AACxB,QAAM,SAAS,aAAa,oBAAoB,kCAAkC,UAAU;AAC5F,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoE,IAAI;AACtG,QAAM,EAAE,UAAU,YAAY,IAAI,YAAY;AAE9C,gBAAc,UAAU,MAAM,WAAW,QAAQ,MAAM,UAAU,CAAC,KAAK,WAAW;AAChF,QAAI,OAAO,IAAI;AACb,YAAM,OAAO,OAAO,OAAO,MAAM,KAAK,KAAK;AAC3C,iBAAW,EAAE,OAAO,KAAK,SAAS,YAAY,KAAK,CAAC;AACpD,eAAS,OAAO,OAAO,OAAO,IAAI,IAAI,OAAO,QAAQ;AACrD;AAAA,IACF;AACA,UAAM,UACJ,gBAAgB,OAAO,KAAK,MAAM,cAAc,OAAO,KAAK,MAAM,uBAAuB,YAAY;AACvG,eAAW,EAAE,OAAO,KAAK,SAAS,QAAQ,CAAC;AAC3C,aAAS,YAAY,WAAW,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,EACtE,CAAC;AAED,QAAM,UACJ,UAAU,KACN,YACA,SAAS,UAAU,QACjB,QAAQ,UACR,WACE,cACA;AAEV,QAAM,iBAAiB,CAAC,YACtB,oBAAC,UAAO,MAAM,cAAc,SAAO,MAAC,SACjC,iBAAO,UACV;AAGF,MAAI;AACJ,MAAI,YAAY,aAAa;AAC3B,WAAO,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,WAAW;AAAA,EAC1D,WAAW,YAAY,YAAY;AACjC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,oBAAC,gBAAa;AAAA,QACpB,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAO;AAAA,QAC5D,QAAQ,eAAe,QAAQ;AAAA,QAC/B,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,WAAW,YAAY,UAAU;AAC/B,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAM,oBAAC,SAAM;AAAA,QACb,OAAO,OAAO;AAAA,QACd,MAAM,OAAO;AAAA,QACb,QACE,iCACE;AAAA,8BAAC,UAAO,MAAM,YAAY,SAAQ,UAC/B,iBAAO,QACV;AAAA,UACC,iBAAiB,UAChB,oBAAC,UAAO,MAAM,cAAc,SAAQ,aACjC,iBAAO,UACV;AAAA,WAEJ;AAAA,QAEF,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,OAAO;AACL,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,YAAY,YAAY,oBAAC,YAAS,IAAK,oBAAC,WAAQ;AAAA,QACtD,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO,OAAO;AAAA,QACrD,MAAM,OAAO;AAAA,QACb,QAAQ,WAAW,eAAe,WAAW,IAAI;AAAA,QACjD,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ,cAAY;AAAA,MACZ,aAAW,YAAY,eAAe;AAAA,MACtC,WAAW,GAAG,aAAa,SAAS;AAAA,MAEnC;AAAA,kBAAU,OAAO,OAAO,oBAAC,WAAQ,WAAW,sBAAuB,mBAAS,OAAO,OAAM;AAAA,QACzF;AAAA,QAED,oBAAC,SAAK,GAAG,aAAa;AAAA;AAAA;AAAA,EACxB;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/auth/accept-invitation.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport type { ComponentPropsWithRef, ReactNode } from \"react\";\nimport { CheckCircle2, LogIn, TimerOff, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { useAnnounce } from \"../hooks/use-announce\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button } from \"../components/button\";\nimport { EmptyState } from \"../components/empty-state\";\nimport { authErrorCode } from \"./auth-errors\";\nimport { OUTCOME_CLASS, STATUS_HEADING_CLASS, useOncePerKey } from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\nimport { DEFAULT_ACCEPT_INVITATION_LABELS } from \"./accept-invitation-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the page renders — the `acceptInvitation` namespace. keksdose's words\n *  where its `/join` page has them (`budget_share.join*`). */\nexport interface AcceptInvitationLabels {\n  /** The heading. */\n  title: string;\n  /** While the invitation is accepted. */\n  accepting: string;\n  /** Accepted, when the app did not say into what. */\n  accepted: string;\n  /** Accepted, given what it attached the account to — a company, a team, a budget. */\n  joined: (name: string) => string;\n  /** Into the app, from every outcome but \"sign in first\". */\n  continue: string;\n  /** The token is unknown, spent, or for another address. */\n  invalid: string;\n  expired: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** Under `invalid` and `expired`: an invitation is re-sent as a new one (§4.4). */\n  askAgain: string;\n  /** Nobody is signed in: an existing account accepts after sign-in (§4.4). */\n  signInFirst: string;\n  /** Under it. */\n  signInHint: string;\n  signIn: string;\n  /** Beside \"Sign in\", with `registerHref`. */\n  register: string;\n}\n\n// Defined in ./accept-invitation-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_ACCEPT_INVITATION_LABELS };\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onAccept` may resolve with. */\nexport interface AcceptInvitationResult {\n  /** What the invitation attached the account to, by name — \"Example Property Ltd\",\n   *  \"Team North\", a budget. Said in the confirmation. */\n  name?: string;\n}\n\n/** What became of an invitation that was not accepted. `signIn`: the server wants a\n *  session first (a `401`), which `signedIn` did not know about. */\nexport type AcceptInvitationFailure = \"invalid\" | \"expired\" | \"signIn\";\n\ntype Outcome = \"accepted\" | AcceptInvitationFailure;\n\nexport interface AcceptInvitationProps extends Omit<ComponentPropsWithRef<\"div\">, \"children\" | \"title\"> {\n  /** The invitation's token — the app's `?invite=` / `?token=`. Empty: the link was cut\n   *  short, and the page says so without asking anyone. */\n  token: string;\n  /** Someone is signed in on this device. Until then the page asks for a sign-in and\n   *  sends nothing: accepting attaches the invitation to the SIGNED-IN account. */\n  signedIn: boolean;\n  /**\n   * Accept it — `POST /auth/invitations/accept {token}`, once per token, as soon as\n   * someone is signed in. Resolve (with what it attached the account to, if the app\n   * knows); reject with the client's error.\n   */\n  onAccept: (token: string) => Promise<AcceptInvitationResult | void | undefined>;\n  /** Which dead end a rejection is. Default: `invitation_expired` is `expired`,\n   *  anything else `invalid` (§5.2's codes). Map a `401` to `signIn` here. */\n  classifyError?: (error: unknown) => AcceptInvitationFailure;\n  /** \"Continue\" — into the app. Default `/`. */\n  continueHref?: string;\n  /** \"Sign in\" — the app's `/login`, with a way back here (`?next=…`). Default\n   *  `/login`. */\n  signInHref?: string;\n  /** \"Create account\" beside \"Sign in\", for an invitation that may lead to a new\n   *  account — the app's `/register?invite=…`. Left out, none. */\n  registerHref?: string;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it in\n   *  `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: LabelOverride<AcceptInvitationLabels>;\n}\n\n/**\n * Accept an invitation with an EXISTING account (docs/auth-harmonization.md §4.4): the\n * link leads here, the person signs in if they are not, and the app attaches the\n * invitation — a kastlan user joining a second company, a Kurvenschmiede member a team,\n * a keksdose user a shared budget. A new address never needs this page: its link opens\n * the sign-up form, which spends the invitation itself.\n *\n * keksdose's `JoinSharePage` (features/budgets/join-page.tsx) is the model: it accepts\n * on load, once (the token is single-use, and StrictMode's double effect would send it\n * twice), and shows the outcome where its spinner was. The outcomes: accepted, with the\n * way into the app; not valid; expired (both say to ask for a new invitation, since\n * \"resend\" mints a new token); or \"sign in first\", with nothing sent. \"Continue\" REPLACES\n * this page in the history: the token is spent, so Back must not land here again.\n */\nexport function AcceptInvitation({\n  token,\n  signedIn,\n  onAccept,\n  classifyError,\n  continueHref = \"/\",\n  signInHref = \"/login\",\n  registerHref,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: AcceptInvitationProps) {\n  const labels = useKitLabels(\"acceptInvitation\", DEFAULT_ACCEPT_INVITATION_LABELS, labelsProp);\n  const [settled, setSettled] = useState<{ token: string; outcome: Outcome; name?: string } | null>(null);\n  const { announce, regionProps } = useAnnounce();\n\n  useOncePerKey(token !== \"\" && signedIn ? token : null, onAccept, (key, result) => {\n    if (result.ok) {\n      const name = result.value?.name?.trim() || undefined;\n      setSettled({ token: key, outcome: \"accepted\", name });\n      announce(name ? labels.joined(name) : labels.accepted);\n      return;\n    }\n    const failure: AcceptInvitationFailure =\n      classifyError?.(result.error) ?? (authErrorCode(result.error) === \"invitation_expired\" ? \"expired\" : \"invalid\");\n    setSettled({ token: key, outcome: failure });\n    announce(failure === \"signIn\" ? labels.signInFirst : labels[failure]);\n  });\n\n  const outcome: Outcome | \"accepting\" =\n    token === \"\" ? \"invalid\" : settled?.token === token ? settled.outcome : signedIn ? \"accepting\" : \"signIn\";\n\n  const continueButton = (variant: \"accent\" | \"secondary\") => (\n    <Button href={continueHref} replace variant={variant}>\n      {labels.continue}\n    </Button>\n  );\n\n  let body: ReactNode;\n  if (outcome === \"accepting\") {\n    body = <LoadingState size=\"sm\" label={labels.accepting} />;\n  } else if (outcome === \"accepted\") {\n    body = (\n      <EmptyState\n        tone=\"success\"\n        icon={<CheckCircle2 />}\n        title={settled?.name ? labels.joined(settled.name) : labels.accepted}\n        action={continueButton(\"accent\")}\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else if (outcome === \"signIn\") {\n    body = (\n      <EmptyState\n        icon={<LogIn />}\n        title={labels.signInFirst}\n        hint={labels.signInHint}\n        action={\n          <>\n            <Button href={signInHref} variant=\"accent\">\n              {labels.signIn}\n            </Button>\n            {registerHref !== undefined && (\n              <Button href={registerHref} variant=\"secondary\">\n                {labels.register}\n              </Button>\n            )}\n          </>\n        }\n        className={OUTCOME_CLASS}\n      />\n    );\n  } else {\n    body = (\n      <EmptyState\n        tone=\"danger\"\n        icon={outcome === \"expired\" ? <TimerOff /> : <XCircle />}\n        title={token === \"\" ? labels.noToken : labels[outcome]}\n        hint={labels.askAgain}\n        action={signedIn ? continueButton(\"secondary\") : undefined}\n        className={OUTCOME_CLASS}\n      />\n    );\n  }\n\n  return (\n    <div\n      {...rest}\n      data-state={outcome}\n      aria-busy={outcome === \"accepting\" || undefined}\n      className={cn(\"space-y-3\", className)}\n    >\n      {title === null ? null : <Heading className={STATUS_HEADING_CLASS}>{title ?? labels.title}</Heading>}\n      {body}\n      {/* Rendered from the start, so the outcome is read when it arrives. */}\n      <div {...regionProps} />\n    </div>\n  );\n}\n"],"mappings":";AAgJI,SAyBM,UAzBN,KAyBM,YAzBN;AAhJJ,SAAS,gBAAgB;AAEzB,SAAS,cAAc,OAAO,UAAU,eAAe;AACvD,SAAS,UAAU;AACnB,SAAS,oBAAwC;AACjD,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,eAAe,sBAAsB,qBAAqB;AAEnE,SAAS,wCAAwC;AAiG1C,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA0B;AACxB,QAAM,SAAS,aAAa,oBAAoB,kCAAkC,UAAU;AAC5F,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoE,IAAI;AACtG,QAAM,EAAE,UAAU,YAAY,IAAI,YAAY;AAE9C,gBAAc,UAAU,MAAM,WAAW,QAAQ,MAAM,UAAU,CAAC,KAAK,WAAW;AAChF,QAAI,OAAO,IAAI;AACb,YAAM,OAAO,OAAO,OAAO,MAAM,KAAK,KAAK;AAC3C,iBAAW,EAAE,OAAO,KAAK,SAAS,YAAY,KAAK,CAAC;AACpD,eAAS,OAAO,OAAO,OAAO,IAAI,IAAI,OAAO,QAAQ;AACrD;AAAA,IACF;AACA,UAAM,UACJ,gBAAgB,OAAO,KAAK,MAAM,cAAc,OAAO,KAAK,MAAM,uBAAuB,YAAY;AACvG,eAAW,EAAE,OAAO,KAAK,SAAS,QAAQ,CAAC;AAC3C,aAAS,YAAY,WAAW,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,EACtE,CAAC;AAED,QAAM,UACJ,UAAU,KAAK,YAAY,SAAS,UAAU,QAAQ,QAAQ,UAAU,WAAW,cAAc;AAEnG,QAAM,iBAAiB,CAAC,YACtB,oBAAC,UAAO,MAAM,cAAc,SAAO,MAAC,SACjC,iBAAO,UACV;AAGF,MAAI;AACJ,MAAI,YAAY,aAAa;AAC3B,WAAO,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,WAAW;AAAA,EAC1D,WAAW,YAAY,YAAY;AACjC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,oBAAC,gBAAa;AAAA,QACpB,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAO;AAAA,QAC5D,QAAQ,eAAe,QAAQ;AAAA,QAC/B,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,WAAW,YAAY,UAAU;AAC/B,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAM,oBAAC,SAAM;AAAA,QACb,OAAO,OAAO;AAAA,QACd,MAAM,OAAO;AAAA,QACb,QACE,iCACE;AAAA,8BAAC,UAAO,MAAM,YAAY,SAAQ,UAC/B,iBAAO,QACV;AAAA,UACC,iBAAiB,UAChB,oBAAC,UAAO,MAAM,cAAc,SAAQ,aACjC,iBAAO,UACV;AAAA,WAEJ;AAAA,QAEF,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ,OAAO;AACL,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAM,YAAY,YAAY,oBAAC,YAAS,IAAK,oBAAC,WAAQ;AAAA,QACtD,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO,OAAO;AAAA,QACrD,MAAM,OAAO;AAAA,QACb,QAAQ,WAAW,eAAe,WAAW,IAAI;AAAA,QACjD,WAAW;AAAA;AAAA,IACb;AAAA,EAEJ;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACE,GAAG;AAAA,MACJ,cAAY;AAAA,MACZ,aAAW,YAAY,eAAe;AAAA,MACtC,WAAW,GAAG,aAAa,SAAS;AAAA,MAEnC;AAAA,kBAAU,OAAO,OAAO,oBAAC,WAAQ,WAAW,sBAAuB,mBAAS,OAAO,OAAM;AAAA,QACzF;AAAA,QAED,oBAAC,SAAK,GAAG,aAAa;AAAA;AAAA;AAAA,EACxB;AAEJ;","names":[]}

package/dist/auth/auth-errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/auth-errors.ts"],"sourcesContent":["/**\n * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every\n * refusal the auth routes answer carries a machine-readable `code`, and the pages\n * recognise the CODE, never the server's sentence.\n *\n * Today each app's pages print the server's `detail` string (keksdose's\n * `extractApiErrorMessage`), which is English on every locale and, on a credential\n * check, would be an account-enumeration oracle if it ever said more than one thing.\n * keksdose already keys one refusal on a code (`features/budgets/plan-limit.ts`,\n * `402 {detail, code: \"plan_budget_limit\"}`); §5.2 makes that the rule for auth. Each\n * app switches its server and its pages together (§9).\n *\n * - `invalid_credentials` — unknown address, wrong password AND deactivated account:\n *   one answer, in the same time (§2.10). `401`.\n * - `registration_closed` — the sign-up gate refused the address. `403`.\n * - `email_taken` — an account with this address exists. `409`.\n * - `invitation_invalid`, `invitation_expired` — the `invite` token of a sign-up or an\n *   accept (§4.4).\n * - `token_invalid` — a one-time token (reset, verification, a sign-in challenge) is\n *   unknown, spent or expired.\n * - `account_inactive` — **no server answers it.** §2.10 decided that a deactivated\n *   account gets `invalid_credentials`, because a separate answer after a correct\n *   password would confirm a leaked one. It stays in the union only for a future server\n *   step that is past the password (an admin view, a signed-in refresh) and may say so.\n * - `session_ended` — 0.34.0 (§11.2, decision 7; server-kit 0.8): every definitive\n *   refusal of `POST /auth/refresh`, a `401`. No form shows it, so it has no label: the\n *   kit's `attachSessionRefresh` decides by the STATUS, so an app whose server has not\n *   switched yet keeps working.\n */\nexport type AuthErrorCode =\n  | \"invalid_credentials\"\n  | \"registration_closed\"\n  | \"email_taken\"\n  | \"invitation_invalid\"\n  | \"invitation_expired\"\n  | \"token_invalid\"\n  /** 0.30.0: a link that WAS valid and ran out (verification, reset) — keksdose's step-3\n   *  refusals tell it from `token_invalid`, so a page can say \"expired, ask for a new one\". */\n  | \"token_expired\"\n  | \"account_inactive\"\n  | \"session_ended\";\n\n/**\n * 0.30.0: the coded refusals of user administration and the account's own settings\n * (docs/user-admin-harmonization.md §4, §6) — server-kit 0.4.0's `AccountErrorCode`,\n * value for value. The same family of answer as the sign-in codes (`{detail, code}`,\n * plus `companies` on kastlan's `last_admin`), read by the same {@link authErrorCode}.\n *\n * - `last_admin` — the action would leave no active admin: deactivating, demoting or\n *   deleting the last one (in kastlan, of a company; the answer names the `companies`).\n * - `self_action` — an admin acting on their own account where that is never allowed.\n * - `other_companies` — kastlan: the account belongs to other companies too, so a\n *   company admin may not deactivate it; \"Remove from company\" instead (§9.6).\n * - `household_has_members` — keksdose's guard on a deletion request (§6.4).\n * - `confirmation_required`, `confirmation_mismatch` — the action's confirmation level\n *   asked for a typed address (or a tick), and the request carried none, or another\n *   address (§4.2).\n * - `password_incorrect` — the CURRENT password is wrong on a signed-in route (the email\n *   change, the deletion request). `400`, not `401`: an app's client reads a 401 as an\n *   ended session and signs the user out, the wrong answer to a typo. Every other one\n *   is a `409`.\n */\nexport type AccountErrorCode =\n  | \"last_admin\"\n  | \"self_action\"\n  | \"other_companies\"\n  | \"household_has_members\"\n  | \"confirmation_required\"\n  | \"confirmation_mismatch\"\n  | \"password_incorrect\";\n\n/**\n * 0.31.0: the demo's coded refusals (docs/landing-demo-harmonization.md §6.2) —\n * server-kit 0.5's `DemoErrorCode`, value for value, answered as `{detail, code}` like\n * the others and read by the same {@link authErrorCode}.\n *\n * - `demo_disabled` — `404`: the demo switch is off (it is \"not there\", not forbidden).\n * - `demo_rate_limited` — `429` with `Retry-After`: the per-IP window of demo starts.\n * - `demo_capacity` — `429`, no `Retry-After`: the cap of live demo users.\n * - `demo_not_ready` — `503`: the demo data has not been seeded yet.\n * - `demo_read_only` — `403`, model R: any write by a demo user. The app's write lock\n *   already explains it, so it shows no toast (§5.4).\n * - `demo_refused` — `403`, both models: an action a demo never may — a way in or out,\n *   mail, uploads, the account export (§6.4).\n */\nexport type DemoErrorCode =\n  | \"demo_disabled\"\n  | \"demo_rate_limited\"\n  | \"demo_capacity\"\n  | \"demo_not_ready\"\n  | \"demo_read_only\"\n  | \"demo_refused\";\n\n/**\n * 0.32.0: billing's coded refusals (docs/billing-harmonization.md §3.3, §3.4, §4, §12.3) —\n * server-kit 0.6's `BillingError` and `PlanLimitError`, value for value, answered as\n * `{detail, code}` like the others and read by the same {@link authErrorCode}.\n *\n * - `billing_disabled` — `404`: the billing switch is off (§2.9), so every billing route\n *   but `GET /billing/status` is \"not there\", as a switched-off demo is.\n * - `billing_read_only` — `402`: a write by (or into the data of) a payer out of good\n *   standing (§3.3, §12.1). Inside a sync reply it marks the changes that were refused\n *   and not applied (§12.5). The app's write lock and banner already say why, so — like\n *   `demo_read_only` — it needs no toast of its own.\n * - `plan_limit` — `402`: a create past the plan's limit (§3.4), with the extra fields\n *   `dimension`, `plan`, `limit` and `used` — read them with `isPlanLimit`. A lapsed payer\n *   creating gets `billing_read_only` instead, never this (§12.3).\n * - `billing_not_configured` — billing is switched on but the provider's settings are\n *   missing (the secrets, a price id): the operator's mistake, not the payer's.\n *\n * 0.33.0 (server-kit 0.7, §14.2): the provider's refusals, with the `billing_` prefix of\n * the others (decision 22).\n * - `billing_provider_unavailable` — `502`: Paddle didn't answer, or refused the request.\n *   Try again.\n * - `billing_not_at_provider` — `409`: a portal request before the payer reached the\n *   provider (§14.5) — a stale page; the overview's `at_provider` says it first.\n * - `billing_already_subscribed` — `409`: a checkout while a provider subscription runs\n *   (§14.6). Since 0.39 plan changes go through the plan switch (§15.2.10).\n * - `billing_plan_not_sold` — `422`: a checkout for a plan, currency or interval the\n *   catalogue doesn't sell — or (0.39) a switch to one.\n *\n * 0.39.0 (server-kit 0.12, §15.2.10): the plan switch's refusals.\n * - `billing_not_subscribed` — `409`: a switch with no running provider subscription;\n *   the page offers the checkout instead.\n * - `billing_plan_unchanged` — `409`: a switch to the price the payer pays now.\n */\nexport type BillingErrorCode =\n  | \"billing_disabled\"\n  | \"billing_read_only\"\n  | \"plan_limit\"\n  | \"billing_not_configured\"\n  | \"billing_provider_unavailable\"\n  | \"billing_not_at_provider\"\n  | \"billing_already_subscribed\"\n  | \"billing_plan_not_sold\"\n  | \"billing_not_subscribed\"\n  | \"billing_plan_unchanged\";\n\n/** Every code the kit reads: the sign-in refusals, the account ones (0.30.0), the demo's\n *  (0.31.0) and billing's (0.32.0). */\nexport type KitErrorCode = AuthErrorCode | AccountErrorCode | DemoErrorCode | BillingErrorCode;\n\nconst BILLING_CODES: ReadonlySet<BillingErrorCode> = new Set<BillingErrorCode>([\n  \"billing_disabled\",\n  \"billing_read_only\",\n  \"plan_limit\",\n  \"billing_not_configured\",\n  \"billing_provider_unavailable\",\n  \"billing_not_at_provider\",\n  \"billing_already_subscribed\",\n  \"billing_plan_not_sold\",\n  \"billing_not_subscribed\",\n  \"billing_plan_unchanged\",\n]);\n\nconst CODES: ReadonlySet<string> = new Set<KitErrorCode>([\n  \"invalid_credentials\",\n  \"registration_closed\",\n  \"email_taken\",\n  \"invitation_invalid\",\n  \"invitation_expired\",\n  \"token_invalid\",\n  \"token_expired\",\n  \"account_inactive\",\n  \"session_ended\",\n  \"last_admin\",\n  \"self_action\",\n  \"other_companies\",\n  \"household_has_members\",\n  \"confirmation_required\",\n  \"confirmation_mismatch\",\n  \"password_incorrect\",\n  \"demo_disabled\",\n  \"demo_rate_limited\",\n  \"demo_capacity\",\n  \"demo_not_ready\",\n  \"demo_read_only\",\n  \"demo_refused\",\n  ...BILLING_CODES,\n]);\n\ntype Bag = Record<string, unknown>;\n\nconst isBag = (value: unknown): value is Bag => typeof value === \"object\" && value !== null;\n\n/** A known code, or undefined. */\nfunction known(value: unknown): KitErrorCode | undefined {\n  return typeof value === \"string\" && CODES.has(value) ? (value as KitErrorCode) : undefined;\n}\n\n/** `{code}` on a parsed body, or FastAPI's `{detail: {code}}` — what an\n *  `HTTPException(detail={\"code\": …})` serialises to. */\nfunction codeOfBody(body: unknown): KitErrorCode | undefined {\n  if (!isBag(body)) return undefined;\n  return known(body.code) ?? (isBag(body.detail) ? known(body.detail.code) : undefined);\n}\n\n/**\n * The code an error carries — an {@link AuthErrorCode}, since 0.30.0 an\n * {@link AccountErrorCode}, since 0.31.0 a {@link DemoErrorCode}, since 0.32.0 a\n * {@link BillingErrorCode} — or `undefined` when it carries none.\n *\n * Reads the parsed response body wherever the apps' HTTP clients put it, without\n * depending on any of them:\n *\n *  1. `err.response.data` — axios (keksdose's, kastlan's and Kurvenschmiede's clients;\n *     keksdose's `isPlanBudgetLimitRefusal` reads the same path);\n *  2. `err.data` — ofetch's `FetchError`, and most `fetch` wrappers that parse the body;\n *  3. `err.body` — the generated OpenAPI clients' `ApiError`;\n *  4. `err` itself — a body thrown as it came (`throw await res.json()`).\n *\n * In each, `code` or FastAPI's nested `detail.code`. Last, `err.code` — but only when\n * it is one of the codes above: axios writes its OWN codes there (`ERR_NETWORK`,\n * `ECONNABORTED`, `ERR_BAD_REQUEST`), and so does Node, so an unknown value is never\n * read as a refusal. The HTTP status is not checked: the code is the contract, and the\n * status differs per refusal (401, 402, 403, 404, 409, 410).\n */\nexport function authErrorCode(err: unknown): KitErrorCode | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (\n    (isBag(response) ? codeOfBody(response.data) : undefined) ??\n    codeOfBody(err.data) ??\n    codeOfBody(err.body) ??\n    codeOfBody(err)\n  );\n}\n\n/**\n * Whether `err` is a coded auth refusal — any of them, or the one named:\n *\n * ```ts\n * try { await api.register(values) }\n * catch (err) { if (isAuthError(err, \"email_taken\")) … }\n * ```\n *\n * The kit's `SignInForm` and `RegisterForm` call it on what their callbacks reject\n * with, so an app's `onSubmit` can simply let its client's error through. See\n * {@link authErrorCode} for the shapes it reads. Since 0.30.0 it knows the account codes\n * too: `isAuthError(err, \"last_admin\")`; since 0.31.0 the demo's:\n * `isAuthError(err, \"demo_read_only\")`; since 0.32.0 billing's:\n * `isAuthError(err, \"billing_read_only\")` (or {@link isBillingError}).\n */\nexport function isAuthError(err: unknown, code?: KitErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && (code === undefined || found === code);\n}\n\n/**\n * Whether `err` is one of billing's coded refusals (0.32.0, docs/billing-harmonization.md\n * §10, §14.2) — any of them, or the one named. {@link isAuthError} answers the same for a\n * named code; this one also answers \"is it billing's at all\", which an app's error\n * handler asks before it decides between the write lock, a `PlanLimitNotice` and a toast.\n */\nexport function isBillingError(err: unknown, code?: BillingErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && BILLING_CODES.has(found as BillingErrorCode) && (code === undefined || found === code);\n}\n\n/**\n * The parsed body that carries a code, wherever {@link authErrorCode} would find it (in\n * the same order) — the object with the `code`, so FastAPI's nested `detail` when the code\n * is there. For a reader of a refusal's EXTRA fields (`isPlanLimit`: `dimension`, `limit`,\n * `used` sit beside the code). `accept` decides which codes count; default, the known ones.\n *\n * @internal Not part of the barrel.\n */\nexport function errorBodyWithCode(\n  err: unknown,\n  accept: (code: unknown) => boolean = (code) => known(code) !== undefined,\n): Record<string, unknown> | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  for (const body of [isBag(response) ? response.data : undefined, err.data, err.body, err]) {\n    if (!isBag(body)) continue;\n    if (accept(body.code)) return body;\n    if (isBag(body.detail) && accept(body.detail.code)) return body.detail;\n  }\n  return undefined;\n}\n\n/** An HTTP status as a number, or undefined. */\nfunction statusOf(value: unknown): number | undefined {\n  return typeof value === \"number\" && Number.isInteger(value) ? value : undefined;\n}\n\n/**\n * The HTTP status a thrown error carries, wherever the apps' HTTP clients put it —\n * without depending on any of them:\n *\n *  1. `err.response.status` — axios (all three apps' clients);\n *  2. `err.status` — ofetch's `FetchError`, the generated OpenAPI clients' `ApiError`, and\n *     a `Response` thrown as it came;\n *  3. `err.statusCode` — ofetch's alias, and Node-style errors.\n *\n * `undefined` when none is a whole number. Package-private — not re-exported from the\n * barrel; {@link isRateLimited} and the session refresh's classifier read it (DUP-11,\n * refactor audit 2026-10: the refresh carried its own copy of this probe).\n */\nexport function httpStatusOf(err: unknown): number | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (isBag(response) ? statusOf(response.status) : undefined) ?? statusOf(err.status) ?? statusOf(err.statusCode);\n}\n\n/**\n * Whether `err` is a throttled request — HTTP `429 Too Many Requests` (0.30.0, from the\n * apps' 0.29 adoption: every app answered a throttled sign-in, sign-up or reset through\n * its own `describeError`, with three wordings of one sentence).\n *\n * A throttle carries no `code` in the contract — the STATUS is the answer, set by the\n * apps' limiters (server-kit's `AuthLimiters`, keksdose's per-IP limit) — so this reads\n * the status, wherever the apps' HTTP clients put it ({@link httpStatusOf}).\n *\n * There is no `rate_limited` code: keksdose answers its 429s uncoded, with a\n * `Retry-After` header, and the status is the one signal every limiter gives.\n *\n * The kit's `SignInForm`, `RegisterForm`, `ForgotPasswordForm` and `ResetPasswordForm`\n * call it AFTER the app's `describeError` — an app with words of its own keeps them —\n * and before their generic failure, so \"Too many attempts. Try again in 30 s.\" (with\n * {@link retryAfterSeconds}) or \"… Wait a moment and try again.\" needs no app code.\n */\nexport function isRateLimited(err: unknown): boolean {\n  return httpStatusOf(err) === 429;\n}\n\n/** A header's value from a `Headers` (fetch, ofetch's `response`), axios' `AxiosHeaders`\n *  or a plain record — whose keys may come in any case. */\nfunction headerOf(headers: unknown, name: string): unknown {\n  if (!isBag(headers)) return undefined;\n  if (typeof headers.get === \"function\") {\n    try {\n      const value: unknown = (headers.get as (key: string) => unknown).call(headers, name);\n      if (value !== undefined && value !== null) return value;\n    } catch {\n      // A `get` that is not a header lookup; the record below is.\n    }\n  }\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === name) return value;\n  }\n  return undefined;\n}\n\n/** `Retry-After` as seconds from `now`: delta-seconds (\"30\"), or an HTTP date\n *  (\"Wed, 07 Oct 2026 10:00:00 GMT\") counted from now, never below 0 (RFC 9110 §10.2.3). */\nfunction parseRetryAfter(value: unknown, now: number): number | undefined {\n  const raw = Array.isArray(value) ? (value as unknown[])[0] : value;\n  if (typeof raw === \"number\") return Number.isFinite(raw) && raw >= 0 ? Math.ceil(raw) : undefined;\n  if (typeof raw !== \"string\") return undefined;\n  const text = raw.trim();\n  if (/^\\d+$/.test(text)) return Number(text);\n  // An HTTP date names its day and month (\"Wed, 07 Oct 2026 …\"). Without a letter it is\n  // a malformed number (\"-5\", \"1.5\"), which `Date.parse` would happily read as a year.\n  if (!/[a-z]/i.test(text)) return undefined;\n  const at = Date.parse(text);\n  if (Number.isNaN(at)) return undefined;\n  return Math.max(0, Math.ceil((at - now) / 1000));\n}\n\n/**\n * How long a throttled request asks to wait, in whole seconds — its `Retry-After`\n * header (0.30.0, keksdose: its 429s carry no code, only the header) — or `undefined`\n * when there is none, or none that parses.\n *\n * Read where the apps' clients keep the response headers, without depending on any of\n * them: `err.response.headers` (axios' `AxiosHeaders` or a plain record; ofetch's\n * `FetchError.response`, a fetch `Headers`), then `err.headers` (a `Response` thrown as\n * it came). The value is delta-seconds, or an HTTP date turned into seconds from `now`\n * (default: the present moment) — never below 0.\n *\n * The forms hand it to their `rateLimited` label when {@link isRateLimited} is true:\n * \"Too many attempts. Try again in 30 s.\" — and, without one, \"… Wait a moment and try\n * again.\" A browser only exposes `Retry-After` to a cross-origin page when the server\n * lists it in `Access-Control-Expose-Headers`.\n */\nexport function retryAfterSeconds(err: unknown, now: number | Date = Date.now()): number | undefined {\n  if (!isBag(err)) return undefined;\n  const at = typeof now === \"number\" ? now : now.getTime();\n  const response = err.response;\n  const value =\n    (isBag(response) ? headerOf(response.headers, \"retry-after\") : undefined) ?? headerOf(err.headers, \"retry-after\");\n  return value === undefined ? undefined : parseRetryAfter(value, at);\n}\n\n/**\n * The English of every `rateLimited` label (0.30.0): \"Too many attempts. Try again in\n * 30 s.\" with a wait under a minute, in whole minutes from one minute up (keksdose's\n * reset throttle answers in hours, and \"3600 s\" is a number nobody reads), and \"Wait a\n * moment and try again.\" without one — or with a `0`.\n *\n * @internal The namespaces' English; not part of the barrel.\n */\nexport function englishRateLimited(seconds?: number): string {\n  if (!seconds || seconds <= 0) return \"Too many attempts. Wait a moment and try again.\";\n  return `Too many attempts. Try again in ${englishWait(seconds)}.`;\n}\n\n/** \"30 s\", \"2 min\" — a wait in English, rounded up. @internal */\nexport function englishWait(seconds: number): string {\n  return seconds < 60 ? `${Math.ceil(seconds)} s` : `${Math.ceil(seconds / 60)} min`;\n}\n"],"mappings":";AA8IA,MAAM,gBAA+C,oBAAI,IAAsB;AAAA,EAC7E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,QAA6B,oBAAI,IAAkB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,CAAC;AAID,MAAM,QAAQ,CAAC,UAAiC,OAAO,UAAU,YAAY,UAAU;AAGvF,SAAS,MAAM,OAA0C;AACvD,SAAO,OAAO,UAAU,YAAY,MAAM,IAAI,KAAK,IAAK,QAAyB;AACnF;AAIA,SAAS,WAAW,MAAyC;AAC3D,MAAI,CAAC,MAAM,IAAI,EAAG,QAAO;AACzB,SAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI;AAC7E;AAsBO,SAAS,cAAc,KAAwC;AACpE,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UACG,MAAM,QAAQ,IAAI,WAAW,SAAS,IAAI,IAAI,WAC/C,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,KACnB,WAAW,GAAG;AAElB;AAiBO,SAAS,YAAY,KAAc,MAA8B;AACtE,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,WAAc,SAAS,UAAa,UAAU;AACjE;AAQO,SAAS,eAAe,KAAc,MAAkC;AAC7E,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,UAAa,cAAc,IAAI,KAAyB,MAAM,SAAS,UAAa,UAAU;AACjH;AAUO,SAAS,kBACd,KACA,SAAqC,CAAC,SAAS,MAAM,IAAI,MAAM,QAC1B;AACrC,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,aAAW,QAAQ,CAAC,MAAM,QAAQ,IAAI,SAAS,OAAO,QAAW,IAAI,MAAM,IAAI,MAAM,GAAG,GAAG;AACzF,QAAI,CAAC,MAAM,IAAI,EAAG;AAClB,QAAI,OAAO,KAAK,IAAI,EAAG,QAAO;AAC9B,QAAI,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,IAAI,EAAG,QAAO,KAAK;AAAA,EAClE;AACA,SAAO;AACT;AAGA,SAAS,SAAS,OAAoC;AACpD,SAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,IAAI,QAAQ;AACxE;AAeO,SAAS,aAAa,KAAkC;AAC7D,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UAAQ,MAAM,QAAQ,IAAI,SAAS,SAAS,MAAM,IAAI,WAAc,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU;AACrH;AAmBO,SAAS,cAAc,KAAuB;AACnD,SAAO,aAAa,GAAG,MAAM;AAC/B;AAIA,SAAS,SAAS,SAAkB,MAAuB;AACzD,MAAI,CAAC,MAAM,OAAO,EAAG,QAAO;AAC5B,MAAI,OAAO,QAAQ,QAAQ,YAAY;AACrC,QAAI;AACF,YAAM,QAAkB,QAAQ,IAAiC,KAAK,SAAS,IAAI;AACnF,UAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,KAAM,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,gBAAgB,OAAgB,KAAiC;AACxE,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAK,MAAoB,CAAC,IAAI;AAC7D,MAAI,OAAO,QAAQ,SAAU,QAAO,OAAO,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,IAAI;AACxF,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,OAAO,IAAI,KAAK;AACtB,MAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,OAAO,IAAI;AAG1C,MAAI,CAAC,SAAS,KAAK,IAAI,EAAG,QAAO;AACjC,QAAM,KAAK,KAAK,MAAM,IAAI;AAC1B,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,GAAI,CAAC;AACjD;AAkBO,SAAS,kBAAkB,KAAc,MAAqB,KAAK,IAAI,GAAuB;AACnG,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,KAAK,OAAO,QAAQ,WAAW,MAAM,IAAI,QAAQ;AACvD,QAAM,WAAW,IAAI;AACrB,QAAM,SACH,MAAM,QAAQ,IAAI,SAAS,SAAS,SAAS,aAAa,IAAI,WAAc,SAAS,IAAI,SAAS,aAAa;AAClH,SAAO,UAAU,SAAY,SAAY,gBAAgB,OAAO,EAAE;AACpE;AAUO,SAAS,mBAAmB,SAA0B;AAC3D,MAAI,CAAC,WAAW,WAAW,EAAG,QAAO;AACrC,SAAO,mCAAmC,YAAY,OAAO,CAAC;AAChE;AAGO,SAAS,YAAY,SAAyB;AACnD,SAAO,UAAU,KAAK,GAAG,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,KAAK,KAAK,UAAU,EAAE,CAAC;AAC9E;","names":[]}
+{"version":3,"sources":["../../src/auth/auth-errors.ts"],"sourcesContent":["/**\n * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every\n * refusal the auth routes answer carries a machine-readable `code`, and the pages\n * recognise the CODE, never the server's sentence.\n *\n * Today each app's pages print the server's `detail` string (keksdose's\n * `extractApiErrorMessage`), which is English on every locale and, on a credential\n * check, would be an account-enumeration oracle if it ever said more than one thing.\n * keksdose already keys one refusal on a code (`features/budgets/plan-limit.ts`,\n * `402 {detail, code: \"plan_budget_limit\"}`); §5.2 makes that the rule for auth. Each\n * app switches its server and its pages together (§9).\n *\n * - `invalid_credentials` — unknown address, wrong password AND deactivated account:\n *   one answer, in the same time (§2.10). `401`.\n * - `registration_closed` — the sign-up gate refused the address. `403`.\n * - `email_taken` — an account with this address exists. `409`.\n * - `invitation_invalid`, `invitation_expired` — the `invite` token of a sign-up or an\n *   accept (§4.4).\n * - `token_invalid` — a one-time token (reset, verification, a sign-in challenge) is\n *   unknown, spent or expired.\n * - `account_inactive` — **no server answers it.** §2.10 decided that a deactivated\n *   account gets `invalid_credentials`, because a separate answer after a correct\n *   password would confirm a leaked one. It stays in the union only for a future server\n *   step that is past the password (an admin view, a signed-in refresh) and may say so.\n * - `session_ended` — 0.34.0 (§11.2, decision 7; server-kit 0.8): every definitive\n *   refusal of `POST /auth/refresh`, a `401`. No form shows it, so it has no label: the\n *   kit's `attachSessionRefresh` decides by the STATUS, so an app whose server has not\n *   switched yet keeps working.\n */\nexport type AuthErrorCode =\n  | \"invalid_credentials\"\n  | \"registration_closed\"\n  | \"email_taken\"\n  | \"invitation_invalid\"\n  | \"invitation_expired\"\n  | \"token_invalid\"\n  /** 0.30.0: a link that WAS valid and ran out (verification, reset) — keksdose's step-3\n   *  refusals tell it from `token_invalid`, so a page can say \"expired, ask for a new one\". */\n  | \"token_expired\"\n  | \"account_inactive\"\n  | \"session_ended\";\n\n/**\n * 0.30.0: the coded refusals of user administration and the account's own settings\n * (docs/user-admin-harmonization.md §4, §6) — server-kit 0.4.0's `AccountErrorCode`,\n * value for value. The same family of answer as the sign-in codes (`{detail, code}`,\n * plus `companies` on kastlan's `last_admin`), read by the same {@link authErrorCode}.\n *\n * - `last_admin` — the action would leave no active admin: deactivating, demoting or\n *   deleting the last one (in kastlan, of a company; the answer names the `companies`).\n * - `self_action` — an admin acting on their own account where that is never allowed.\n * - `other_companies` — kastlan: the account belongs to other companies too, so a\n *   company admin may not deactivate it; \"Remove from company\" instead (§9.6).\n * - `household_has_members` — keksdose's guard on a deletion request (§6.4).\n * - `confirmation_required`, `confirmation_mismatch` — the action's confirmation level\n *   asked for a typed address (or a tick), and the request carried none, or another\n *   address (§4.2).\n * - `password_incorrect` — the CURRENT password is wrong on a signed-in route (the email\n *   change, the deletion request). `400`, not `401`: an app's client reads a 401 as an\n *   ended session and signs the user out, the wrong answer to a typo. Every other one\n *   is a `409`.\n */\nexport type AccountErrorCode =\n  | \"last_admin\"\n  | \"self_action\"\n  | \"other_companies\"\n  | \"household_has_members\"\n  | \"confirmation_required\"\n  | \"confirmation_mismatch\"\n  | \"password_incorrect\";\n\n/**\n * 0.31.0: the demo's coded refusals (docs/landing-demo-harmonization.md §6.2) —\n * server-kit 0.5's `DemoErrorCode`, value for value, answered as `{detail, code}` like\n * the others and read by the same {@link authErrorCode}.\n *\n * - `demo_disabled` — `404`: the demo switch is off (it is \"not there\", not forbidden).\n * - `demo_rate_limited` — `429` with `Retry-After`: the per-IP window of demo starts.\n * - `demo_capacity` — `429`, no `Retry-After`: the cap of live demo users.\n * - `demo_not_ready` — `503`: the demo data has not been seeded yet.\n * - `demo_read_only` — `403`, model R: any write by a demo user. The app's write lock\n *   already explains it, so it shows no toast (§5.4).\n * - `demo_refused` — `403`, both models: an action a demo never may — a way in or out,\n *   mail, uploads, the account export (§6.4).\n */\nexport type DemoErrorCode =\n  \"demo_disabled\" | \"demo_rate_limited\" | \"demo_capacity\" | \"demo_not_ready\" | \"demo_read_only\" | \"demo_refused\";\n\n/**\n * 0.32.0: billing's coded refusals (docs/billing-harmonization.md §3.3, §3.4, §4, §12.3) —\n * server-kit 0.6's `BillingError` and `PlanLimitError`, value for value, answered as\n * `{detail, code}` like the others and read by the same {@link authErrorCode}.\n *\n * - `billing_disabled` — `404`: the billing switch is off (§2.9), so every billing route\n *   but `GET /billing/status` is \"not there\", as a switched-off demo is.\n * - `billing_read_only` — `402`: a write by (or into the data of) a payer out of good\n *   standing (§3.3, §12.1). Inside a sync reply it marks the changes that were refused\n *   and not applied (§12.5). The app's write lock and banner already say why, so — like\n *   `demo_read_only` — it needs no toast of its own.\n * - `plan_limit` — `402`: a create past the plan's limit (§3.4), with the extra fields\n *   `dimension`, `plan`, `limit` and `used` — read them with `isPlanLimit`. A lapsed payer\n *   creating gets `billing_read_only` instead, never this (§12.3).\n * - `billing_not_configured` — billing is switched on but the provider's settings are\n *   missing (the secrets, a price id): the operator's mistake, not the payer's.\n *\n * 0.33.0 (server-kit 0.7, §14.2): the provider's refusals, with the `billing_` prefix of\n * the others (decision 22).\n * - `billing_provider_unavailable` — `502`: Paddle didn't answer, or refused the request.\n *   Try again.\n * - `billing_not_at_provider` — `409`: a portal request before the payer reached the\n *   provider (§14.5) — a stale page; the overview's `at_provider` says it first.\n * - `billing_already_subscribed` — `409`: a checkout while a provider subscription runs\n *   (§14.6). Since 0.39 plan changes go through the plan switch (§15.2.10).\n * - `billing_plan_not_sold` — `422`: a checkout for a plan, currency or interval the\n *   catalogue doesn't sell — or (0.39) a switch to one.\n *\n * 0.39.0 (server-kit 0.12, §15.2.10): the plan switch's refusals.\n * - `billing_not_subscribed` — `409`: a switch with no running provider subscription;\n *   the page offers the checkout instead.\n * - `billing_plan_unchanged` — `409`: a switch to the price the payer pays now.\n */\nexport type BillingErrorCode =\n  | \"billing_disabled\"\n  | \"billing_read_only\"\n  | \"plan_limit\"\n  | \"billing_not_configured\"\n  | \"billing_provider_unavailable\"\n  | \"billing_not_at_provider\"\n  | \"billing_already_subscribed\"\n  | \"billing_plan_not_sold\"\n  | \"billing_not_subscribed\"\n  | \"billing_plan_unchanged\";\n\n/** Every code the kit reads: the sign-in refusals, the account ones (0.30.0), the demo's\n *  (0.31.0) and billing's (0.32.0). */\nexport type KitErrorCode = AuthErrorCode | AccountErrorCode | DemoErrorCode | BillingErrorCode;\n\nconst BILLING_CODES: ReadonlySet<BillingErrorCode> = new Set<BillingErrorCode>([\n  \"billing_disabled\",\n  \"billing_read_only\",\n  \"plan_limit\",\n  \"billing_not_configured\",\n  \"billing_provider_unavailable\",\n  \"billing_not_at_provider\",\n  \"billing_already_subscribed\",\n  \"billing_plan_not_sold\",\n  \"billing_not_subscribed\",\n  \"billing_plan_unchanged\",\n]);\n\nconst CODES: ReadonlySet<string> = new Set<KitErrorCode>([\n  \"invalid_credentials\",\n  \"registration_closed\",\n  \"email_taken\",\n  \"invitation_invalid\",\n  \"invitation_expired\",\n  \"token_invalid\",\n  \"token_expired\",\n  \"account_inactive\",\n  \"session_ended\",\n  \"last_admin\",\n  \"self_action\",\n  \"other_companies\",\n  \"household_has_members\",\n  \"confirmation_required\",\n  \"confirmation_mismatch\",\n  \"password_incorrect\",\n  \"demo_disabled\",\n  \"demo_rate_limited\",\n  \"demo_capacity\",\n  \"demo_not_ready\",\n  \"demo_read_only\",\n  \"demo_refused\",\n  ...BILLING_CODES,\n]);\n\ntype Bag = Record<string, unknown>;\n\nconst isBag = (value: unknown): value is Bag => typeof value === \"object\" && value !== null;\n\n/** A known code, or undefined. */\nfunction known(value: unknown): KitErrorCode | undefined {\n  return typeof value === \"string\" && CODES.has(value) ? (value as KitErrorCode) : undefined;\n}\n\n/** `{code}` on a parsed body, or FastAPI's `{detail: {code}}` — what an\n *  `HTTPException(detail={\"code\": …})` serialises to. */\nfunction codeOfBody(body: unknown): KitErrorCode | undefined {\n  if (!isBag(body)) return undefined;\n  return known(body.code) ?? (isBag(body.detail) ? known(body.detail.code) : undefined);\n}\n\n/**\n * The code an error carries — an {@link AuthErrorCode}, since 0.30.0 an\n * {@link AccountErrorCode}, since 0.31.0 a {@link DemoErrorCode}, since 0.32.0 a\n * {@link BillingErrorCode} — or `undefined` when it carries none.\n *\n * Reads the parsed response body wherever the apps' HTTP clients put it, without\n * depending on any of them:\n *\n *  1. `err.response.data` — axios (keksdose's, kastlan's and Kurvenschmiede's clients;\n *     keksdose's `isPlanBudgetLimitRefusal` reads the same path);\n *  2. `err.data` — ofetch's `FetchError`, and most `fetch` wrappers that parse the body;\n *  3. `err.body` — the generated OpenAPI clients' `ApiError`;\n *  4. `err` itself — a body thrown as it came (`throw await res.json()`).\n *\n * In each, `code` or FastAPI's nested `detail.code`. Last, `err.code` — but only when\n * it is one of the codes above: axios writes its OWN codes there (`ERR_NETWORK`,\n * `ECONNABORTED`, `ERR_BAD_REQUEST`), and so does Node, so an unknown value is never\n * read as a refusal. The HTTP status is not checked: the code is the contract, and the\n * status differs per refusal (401, 402, 403, 404, 409, 410).\n */\nexport function authErrorCode(err: unknown): KitErrorCode | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (\n    (isBag(response) ? codeOfBody(response.data) : undefined) ??\n    codeOfBody(err.data) ??\n    codeOfBody(err.body) ??\n    codeOfBody(err)\n  );\n}\n\n/**\n * Whether `err` is a coded auth refusal — any of them, or the one named:\n *\n * ```ts\n * try { await api.register(values) }\n * catch (err) { if (isAuthError(err, \"email_taken\")) … }\n * ```\n *\n * The kit's `SignInForm` and `RegisterForm` call it on what their callbacks reject\n * with, so an app's `onSubmit` can simply let its client's error through. See\n * {@link authErrorCode} for the shapes it reads. Since 0.30.0 it knows the account codes\n * too: `isAuthError(err, \"last_admin\")`; since 0.31.0 the demo's:\n * `isAuthError(err, \"demo_read_only\")`; since 0.32.0 billing's:\n * `isAuthError(err, \"billing_read_only\")` (or {@link isBillingError}).\n */\nexport function isAuthError(err: unknown, code?: KitErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && (code === undefined || found === code);\n}\n\n/**\n * Whether `err` is one of billing's coded refusals (0.32.0, docs/billing-harmonization.md\n * §10, §14.2) — any of them, or the one named. {@link isAuthError} answers the same for a\n * named code; this one also answers \"is it billing's at all\", which an app's error\n * handler asks before it decides between the write lock, a `PlanLimitNotice` and a toast.\n */\nexport function isBillingError(err: unknown, code?: BillingErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && BILLING_CODES.has(found as BillingErrorCode) && (code === undefined || found === code);\n}\n\n/**\n * The parsed body that carries a code, wherever {@link authErrorCode} would find it (in\n * the same order) — the object with the `code`, so FastAPI's nested `detail` when the code\n * is there. For a reader of a refusal's EXTRA fields (`isPlanLimit`: `dimension`, `limit`,\n * `used` sit beside the code). `accept` decides which codes count; default, the known ones.\n *\n * @internal Not part of the barrel.\n */\nexport function errorBodyWithCode(\n  err: unknown,\n  accept: (code: unknown) => boolean = (code) => known(code) !== undefined,\n): Record<string, unknown> | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  for (const body of [isBag(response) ? response.data : undefined, err.data, err.body, err]) {\n    if (!isBag(body)) continue;\n    if (accept(body.code)) return body;\n    if (isBag(body.detail) && accept(body.detail.code)) return body.detail;\n  }\n  return undefined;\n}\n\n/** An HTTP status as a number, or undefined. */\nfunction statusOf(value: unknown): number | undefined {\n  return typeof value === \"number\" && Number.isInteger(value) ? value : undefined;\n}\n\n/**\n * The HTTP status a thrown error carries, wherever the apps' HTTP clients put it —\n * without depending on any of them:\n *\n *  1. `err.response.status` — axios (all three apps' clients);\n *  2. `err.status` — ofetch's `FetchError`, the generated OpenAPI clients' `ApiError`, and\n *     a `Response` thrown as it came;\n *  3. `err.statusCode` — ofetch's alias, and Node-style errors.\n *\n * `undefined` when none is a whole number. Package-private — not re-exported from the\n * barrel; {@link isRateLimited} and the session refresh's classifier read it (DUP-11,\n * refactor audit 2026-10: the refresh carried its own copy of this probe).\n */\nexport function httpStatusOf(err: unknown): number | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (isBag(response) ? statusOf(response.status) : undefined) ?? statusOf(err.status) ?? statusOf(err.statusCode);\n}\n\n/**\n * Whether `err` is a throttled request — HTTP `429 Too Many Requests` (0.30.0, from the\n * apps' 0.29 adoption: every app answered a throttled sign-in, sign-up or reset through\n * its own `describeError`, with three wordings of one sentence).\n *\n * A throttle carries no `code` in the contract — the STATUS is the answer, set by the\n * apps' limiters (server-kit's `AuthLimiters`, keksdose's per-IP limit) — so this reads\n * the status, wherever the apps' HTTP clients put it ({@link httpStatusOf}).\n *\n * There is no `rate_limited` code: keksdose answers its 429s uncoded, with a\n * `Retry-After` header, and the status is the one signal every limiter gives.\n *\n * The kit's `SignInForm`, `RegisterForm`, `ForgotPasswordForm` and `ResetPasswordForm`\n * call it AFTER the app's `describeError` — an app with words of its own keeps them —\n * and before their generic failure, so \"Too many attempts. Try again in 30 s.\" (with\n * {@link retryAfterSeconds}) or \"… Wait a moment and try again.\" needs no app code.\n */\nexport function isRateLimited(err: unknown): boolean {\n  return httpStatusOf(err) === 429;\n}\n\n/** A header's value from a `Headers` (fetch, ofetch's `response`), axios' `AxiosHeaders`\n *  or a plain record — whose keys may come in any case. */\nfunction headerOf(headers: unknown, name: string): unknown {\n  if (!isBag(headers)) return undefined;\n  if (typeof headers.get === \"function\") {\n    try {\n      const value: unknown = (headers.get as (key: string) => unknown).call(headers, name);\n      if (value !== undefined && value !== null) return value;\n    } catch {\n      // A `get` that is not a header lookup; the record below is.\n    }\n  }\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === name) return value;\n  }\n  return undefined;\n}\n\n/** `Retry-After` as seconds from `now`: delta-seconds (\"30\"), or an HTTP date\n *  (\"Wed, 07 Oct 2026 10:00:00 GMT\") counted from now, never below 0 (RFC 9110 §10.2.3). */\nfunction parseRetryAfter(value: unknown, now: number): number | undefined {\n  const raw = Array.isArray(value) ? (value as unknown[])[0] : value;\n  if (typeof raw === \"number\") return Number.isFinite(raw) && raw >= 0 ? Math.ceil(raw) : undefined;\n  if (typeof raw !== \"string\") return undefined;\n  const text = raw.trim();\n  if (/^\\d+$/.test(text)) return Number(text);\n  // An HTTP date names its day and month (\"Wed, 07 Oct 2026 …\"). Without a letter it is\n  // a malformed number (\"-5\", \"1.5\"), which `Date.parse` would happily read as a year.\n  if (!/[a-z]/i.test(text)) return undefined;\n  const at = Date.parse(text);\n  if (Number.isNaN(at)) return undefined;\n  return Math.max(0, Math.ceil((at - now) / 1000));\n}\n\n/**\n * How long a throttled request asks to wait, in whole seconds — its `Retry-After`\n * header (0.30.0, keksdose: its 429s carry no code, only the header) — or `undefined`\n * when there is none, or none that parses.\n *\n * Read where the apps' clients keep the response headers, without depending on any of\n * them: `err.response.headers` (axios' `AxiosHeaders` or a plain record; ofetch's\n * `FetchError.response`, a fetch `Headers`), then `err.headers` (a `Response` thrown as\n * it came). The value is delta-seconds, or an HTTP date turned into seconds from `now`\n * (default: the present moment) — never below 0.\n *\n * The forms hand it to their `rateLimited` label when {@link isRateLimited} is true:\n * \"Too many attempts. Try again in 30 s.\" — and, without one, \"… Wait a moment and try\n * again.\" A browser only exposes `Retry-After` to a cross-origin page when the server\n * lists it in `Access-Control-Expose-Headers`.\n */\nexport function retryAfterSeconds(err: unknown, now: number | Date = Date.now()): number | undefined {\n  if (!isBag(err)) return undefined;\n  const at = typeof now === \"number\" ? now : now.getTime();\n  const response = err.response;\n  const value =\n    (isBag(response) ? headerOf(response.headers, \"retry-after\") : undefined) ?? headerOf(err.headers, \"retry-after\");\n  return value === undefined ? undefined : parseRetryAfter(value, at);\n}\n\n/**\n * The English of every `rateLimited` label (0.30.0): \"Too many attempts. Try again in\n * 30 s.\" with a wait under a minute, in whole minutes from one minute up (keksdose's\n * reset throttle answers in hours, and \"3600 s\" is a number nobody reads), and \"Wait a\n * moment and try again.\" without one — or with a `0`.\n *\n * @internal The namespaces' English; not part of the barrel.\n */\nexport function englishRateLimited(seconds?: number): string {\n  if (!seconds || seconds <= 0) return \"Too many attempts. Wait a moment and try again.\";\n  return `Too many attempts. Try again in ${englishWait(seconds)}.`;\n}\n\n/** \"30 s\", \"2 min\" — a wait in English, rounded up. @internal */\nexport function englishWait(seconds: number): string {\n  return seconds < 60 ? `${Math.ceil(seconds)} s` : `${Math.ceil(seconds / 60)} min`;\n}\n"],"mappings":";AAyIA,MAAM,gBAA+C,oBAAI,IAAsB;AAAA,EAC7E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,QAA6B,oBAAI,IAAkB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,CAAC;AAID,MAAM,QAAQ,CAAC,UAAiC,OAAO,UAAU,YAAY,UAAU;AAGvF,SAAS,MAAM,OAA0C;AACvD,SAAO,OAAO,UAAU,YAAY,MAAM,IAAI,KAAK,IAAK,QAAyB;AACnF;AAIA,SAAS,WAAW,MAAyC;AAC3D,MAAI,CAAC,MAAM,IAAI,EAAG,QAAO;AACzB,SAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI;AAC7E;AAsBO,SAAS,cAAc,KAAwC;AACpE,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UACG,MAAM,QAAQ,IAAI,WAAW,SAAS,IAAI,IAAI,WAC/C,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,KACnB,WAAW,GAAG;AAElB;AAiBO,SAAS,YAAY,KAAc,MAA8B;AACtE,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,WAAc,SAAS,UAAa,UAAU;AACjE;AAQO,SAAS,eAAe,KAAc,MAAkC;AAC7E,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,UAAa,cAAc,IAAI,KAAyB,MAAM,SAAS,UAAa,UAAU;AACjH;AAUO,SAAS,kBACd,KACA,SAAqC,CAAC,SAAS,MAAM,IAAI,MAAM,QAC1B;AACrC,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,aAAW,QAAQ,CAAC,MAAM,QAAQ,IAAI,SAAS,OAAO,QAAW,IAAI,MAAM,IAAI,MAAM,GAAG,GAAG;AACzF,QAAI,CAAC,MAAM,IAAI,EAAG;AAClB,QAAI,OAAO,KAAK,IAAI,EAAG,QAAO;AAC9B,QAAI,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,IAAI,EAAG,QAAO,KAAK;AAAA,EAClE;AACA,SAAO;AACT;AAGA,SAAS,SAAS,OAAoC;AACpD,SAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,IAAI,QAAQ;AACxE;AAeO,SAAS,aAAa,KAAkC;AAC7D,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UAAQ,MAAM,QAAQ,IAAI,SAAS,SAAS,MAAM,IAAI,WAAc,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU;AACrH;AAmBO,SAAS,cAAc,KAAuB;AACnD,SAAO,aAAa,GAAG,MAAM;AAC/B;AAIA,SAAS,SAAS,SAAkB,MAAuB;AACzD,MAAI,CAAC,MAAM,OAAO,EAAG,QAAO;AAC5B,MAAI,OAAO,QAAQ,QAAQ,YAAY;AACrC,QAAI;AACF,YAAM,QAAkB,QAAQ,IAAiC,KAAK,SAAS,IAAI;AACnF,UAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,KAAM,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,gBAAgB,OAAgB,KAAiC;AACxE,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAK,MAAoB,CAAC,IAAI;AAC7D,MAAI,OAAO,QAAQ,SAAU,QAAO,OAAO,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,IAAI;AACxF,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,OAAO,IAAI,KAAK;AACtB,MAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,OAAO,IAAI;AAG1C,MAAI,CAAC,SAAS,KAAK,IAAI,EAAG,QAAO;AACjC,QAAM,KAAK,KAAK,MAAM,IAAI;AAC1B,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,GAAI,CAAC;AACjD;AAkBO,SAAS,kBAAkB,KAAc,MAAqB,KAAK,IAAI,GAAuB;AACnG,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,KAAK,OAAO,QAAQ,WAAW,MAAM,IAAI,QAAQ;AACvD,QAAM,WAAW,IAAI;AACrB,QAAM,SACH,MAAM,QAAQ,IAAI,SAAS,SAAS,SAAS,aAAa,IAAI,WAAc,SAAS,IAAI,SAAS,aAAa;AAClH,SAAO,UAAU,SAAY,SAAY,gBAAgB,OAAO,EAAE;AACpE;AAUO,SAAS,mBAAmB,SAA0B;AAC3D,MAAI,CAAC,WAAW,WAAW,EAAG,QAAO;AACrC,SAAO,mCAAmC,YAAY,OAAO,CAAC;AAChE;AAGO,SAAS,YAAY,SAAyB;AACnD,SAAO,UAAU,KAAK,GAAG,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,KAAK,KAAK,UAAU,EAAE,CAAC;AAC9E;","names":[]}