@eifi1/ui-kit 0.51.6 → 0.52.0

package/dist/lib/lazy-with-fallback.d.ts

@@ -0,0 +1,31 @@
+import type { ComponentType } from "react";
+/** What a {@link lazyWithFallback} fallback is given besides the component's own props. */
+export interface LazyFallbackProps {
+    /** What the import rejected with. Already on `console.error`. */
+    error: unknown;
+    /** Fetch the module again and draw it here if it comes (back online, the deploy's
+     *  new chunk). Call it on the person's next attempt, never at once: offline, a retry
+     *  on mount would fetch in a loop. */
+    retry: () => void;
+}
+/**
+ * `React.lazy` for a module the kit loads late (refactor audit 2026-10, MOD-1: the tour
+ * overlay, the search palette, the feedback dialog), where an import that fails — a tab
+ * left open across a deploy, a local-first app offline — draws `Fallback` instead of
+ * throwing.
+ *
+ * `React.lazy` keeps what its import settled to, so one failed fetch threw on every render
+ * for as long as the component stayed mounted, to the nearest error boundary. All three
+ * sit above the routes — in the provider every app mounts, in the top bar — where that
+ * boundary is the whole app's: a white page because somebody pressed ⌘K or "Take the
+ * tour" (0.52 code review, tour.tsx: the tour's own fix, written by hand with a module-level
+ * `let`, made shared here).
+ *
+ * A failure is logged and the next mount (or the fallback's `retry`) fetches again; a
+ * re-render of a mounted fallback does not. `load` resolves to the component itself,
+ * through a LITERAL relative dynamic import of its module (as feedback-submit's), so an
+ * app's bundler can split it off. Render the result under a `Suspense`, as a lazy
+ * component. (No import call is spelled out here: the build's fix-esm-extensions step
+ * reads specifiers in the .d.ts comments too, and would try to resolve an example.)
+ */
+export declare function lazyWithFallback<P extends object>(load: () => Promise<ComponentType<P>>, Fallback: ComponentType<P & LazyFallbackProps>): ComponentType<P>;

package/dist/lib/lazy-with-fallback.js

@@ -0,0 +1,40 @@
+"use client";
+import { createContext, createElement, lazy, useCallback, useContext, useLayoutEffect, useState } from "react";
+const RetryContext = createContext(() => {
+});
+function lazyWithFallback(load, Fallback) {
+  const attempt = () => {
+    const made = {
+      spent: false,
+      Component: lazy(
+        () => load().then(
+          (Loaded) => ({ default: Loaded }),
+          (error) => {
+            console.error(error);
+            function Failed(props) {
+              const retry = useContext(RetryContext);
+              useLayoutEffect(() => {
+                made.spent = true;
+              }, []);
+              return createElement(Fallback, { ...props, error, retry });
+            }
+            return { default: Failed };
+          }
+        )
+      )
+    };
+    return made;
+  };
+  let latest = attempt();
+  const take = () => latest.spent ? latest = attempt() : latest;
+  function LazyWithFallback(props) {
+    const [current, setCurrent] = useState(take);
+    const retry = useCallback(() => setCurrent(take), []);
+    return createElement(RetryContext.Provider, { value: retry }, createElement(current.Component, props));
+  }
+  return LazyWithFallback;
+}
+export {
+  lazyWithFallback
+};
+//# sourceMappingURL=lazy-with-fallback.js.map

package/dist/lib/lazy-with-fallback.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/lazy-with-fallback.ts"],"sourcesContent":["import { createContext, createElement, lazy, useCallback, useContext, useLayoutEffect, useState } from \"react\";\nimport type { ComponentType, LazyExoticComponent } from \"react\";\n\n/** What a {@link lazyWithFallback} fallback is given besides the component's own props. */\nexport interface LazyFallbackProps {\n  /** What the import rejected with. Already on `console.error`. */\n  error: unknown;\n  /** Fetch the module again and draw it here if it comes (back online, the deploy's\n   *  new chunk). Call it on the person's next attempt, never at once: offline, a retry\n   *  on mount would fetch in a loop. */\n  retry: () => void;\n}\n\ninterface Attempt<P> {\n  Component: LazyExoticComponent<ComponentType<P>>;\n  /** Its import failed and its fallback was drawn: the next mount, or `retry`, takes a\n   *  fresh attempt. Marked when the fallback COMMITS, not when the import rejects: a\n   *  first mount that suspended is thrown away and rendered anew, and an attempt marked\n   *  at the rejection would hand that re-render a fresh import — which fails, and so on. */\n  spent: boolean;\n}\n\nconst RetryContext = createContext<() => void>(() => {});\n\n/**\n * `React.lazy` for a module the kit loads late (refactor audit 2026-10, MOD-1: the tour\n * overlay, the search palette, the feedback dialog), where an import that fails — a tab\n * left open across a deploy, a local-first app offline — draws `Fallback` instead of\n * throwing.\n *\n * `React.lazy` keeps what its import settled to, so one failed fetch threw on every render\n * for as long as the component stayed mounted, to the nearest error boundary. All three\n * sit above the routes — in the provider every app mounts, in the top bar — where that\n * boundary is the whole app's: a white page because somebody pressed ⌘K or \"Take the\n * tour\" (0.52 code review, tour.tsx: the tour's own fix, written by hand with a module-level\n * `let`, made shared here).\n *\n * A failure is logged and the next mount (or the fallback's `retry`) fetches again; a\n * re-render of a mounted fallback does not. `load` resolves to the component itself,\n * through a LITERAL relative dynamic import of its module (as feedback-submit's), so an\n * app's bundler can split it off. Render the result under a `Suspense`, as a lazy\n * component. (No import call is spelled out here: the build's fix-esm-extensions step\n * reads specifiers in the .d.ts comments too, and would try to resolve an example.)\n */\nexport function lazyWithFallback<P extends object>(\n  load: () => Promise<ComponentType<P>>,\n  Fallback: ComponentType<P & LazyFallbackProps>,\n): ComponentType<P> {\n  const attempt = (): Attempt<P> => {\n    const made: Attempt<P> = {\n      spent: false,\n      Component: lazy<ComponentType<P>>(() =>\n        load().then(\n          (Loaded) => ({ default: Loaded }),\n          (error: unknown) => {\n            console.error(error);\n            function Failed(props: P) {\n              const retry = useContext(RetryContext);\n              useLayoutEffect(() => {\n                made.spent = true;\n              }, []);\n              return createElement(Fallback, { ...props, error, retry });\n            }\n            return { default: Failed };\n          },\n        ),\n      ),\n    };\n    return made;\n  };\n  let latest = attempt();\n  /** The attempt a new mount takes: the latest, or a fresh one once that has failed. */\n  const take = () => (latest.spent ? (latest = attempt()) : latest);\n\n  function LazyWithFallback(props: P) {\n    // Fixed per mount, so a re-render of a mounted fallback fetches nothing.\n    const [current, setCurrent] = useState(take);\n    const retry = useCallback(() => setCurrent(take), []);\n    return createElement(RetryContext.Provider, { value: retry }, createElement(current.Component, props));\n  }\n  return LazyWithFallback;\n}\n"],"mappings":";AAAA,SAAS,eAAe,eAAe,MAAM,aAAa,YAAY,iBAAiB,gBAAgB;AAsBvG,MAAM,eAAe,cAA0B,MAAM;AAAC,CAAC;AAsBhD,SAAS,iBACd,MACA,UACkB;AAClB,QAAM,UAAU,MAAkB;AAChC,UAAM,OAAmB;AAAA,MACvB,OAAO;AAAA,MACP,WAAW;AAAA,QAAuB,MAChC,KAAK,EAAE;AAAA,UACL,CAAC,YAAY,EAAE,SAAS,OAAO;AAAA,UAC/B,CAAC,UAAmB;AAClB,oBAAQ,MAAM,KAAK;AACnB,qBAAS,OAAO,OAAU;AACxB,oBAAM,QAAQ,WAAW,YAAY;AACrC,8BAAgB,MAAM;AACpB,qBAAK,QAAQ;AAAA,cACf,GAAG,CAAC,CAAC;AACL,qBAAO,cAAc,UAAU,EAAE,GAAG,OAAO,OAAO,MAAM,CAAC;AAAA,YAC3D;AACA,mBAAO,EAAE,SAAS,OAAO;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS,QAAQ;AAErB,QAAM,OAAO,MAAO,OAAO,QAAS,SAAS,QAAQ,IAAK;AAE1D,WAAS,iBAAiB,OAAU;AAElC,UAAM,CAAC,SAAS,UAAU,IAAI,SAAS,IAAI;AAC3C,UAAM,QAAQ,YAAY,MAAM,WAAW,IAAI,GAAG,CAAC,CAAC;AACpD,WAAO,cAAc,aAAa,UAAU,EAAE,OAAO,MAAM,GAAG,cAAc,QAAQ,WAAW,KAAK,CAAC;AAAA,EACvG;AACA,SAAO;AACT;","names":[]}

package/dist/lib/path-pattern.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Whether a pathname is one a `PathPattern` names — the rule `useLastVisitedPage`'s
+ * `exclude` reads (landing/routing.tsx) and the feedback guard's one-shot routes
+ * (refactor audit 2026-10-30, FLW-7), here without the router: `landing/routing` imports
+ * react-router, which `/feedback` must not drag in. The one copy: routing kept a private
+ * one, and the two had drifted within the round (0.52 code review, this file).
+ *
+ * A string is that path and everything under it (`/join` is `/join` and `/join/abc`, not
+ * `/joined`; `/` is only `/`); a RegExp is tested on the pathname (a `g` flag dropped, so
+ * `lastIndex` never carries over between calls).
+ *
+ * Case-INSENSITIVE, as React Router matches a route unless it sets `caseSensitive` (0.52
+ * code review, feedback/feedback-page-link.ts): the FLW-7 guard compared case-sensitively,
+ * and `/Join?token=` went out as a link the router still rendered as `/join`. A RegExp
+ * gets the `i` flag for the same reason. Matching more than a case-sensitive route would
+ * only turns a link into text, or leaves a page unrecorded as a resume target: both
+ * callers' safe side.
+ *
+ * @internal Package-private — not re-exported from the barrel.
+ */
+export declare function matchesPathPattern(pathname: string, pattern: string | RegExp): boolean;
+/**
+ * The pathname of `href` (a path with its query and hash) as React Router matches it:
+ * each segment percent-decoded, an encoded `/` kept as `%2F` so it never splits a segment
+ * (react-router 8, `decodePath` in `matchRoutesImpl`). The 0.52 code review
+ * (feedback/feedback-page-link.ts) found `/j%6Fin?token=` passing the FLW-7 guard as a
+ * link that the router decoded to `/join`.
+ *
+ * A malformed escape leaves its own segment as written, where the router gives up on the
+ * whole path: the rest still decodes, so the answer is never less than the router's.
+ *
+ * @internal Package-private — not re-exported from the barrel.
+ */
+export declare function routerPathname(href: string): string;

package/dist/lib/path-pattern.js

@@ -0,0 +1,24 @@
+"use client";
+function matchesPathPattern(pathname, pattern) {
+  if (typeof pattern !== "string") {
+    return new RegExp(pattern.source, `${pattern.flags.replace(/[gi]/g, "")}i`).test(pathname);
+  }
+  const path = pathname.toLowerCase();
+  if (pattern === "/") return path === "/";
+  const base = (pattern.endsWith("/") ? pattern.slice(0, -1) : pattern).toLowerCase();
+  return path === base || path.startsWith(`${base}/`);
+}
+function routerPathname(href) {
+  return href.replace(/[?#].*$/, "").split("/").map((segment) => {
+    try {
+      return decodeURIComponent(segment).replace(/\//g, "%2F");
+    } catch {
+      return segment;
+    }
+  }).join("/");
+}
+export {
+  matchesPathPattern,
+  routerPathname
+};
+//# sourceMappingURL=path-pattern.js.map

package/dist/lib/path-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/path-pattern.ts"],"sourcesContent":["/**\n * Whether a pathname is one a `PathPattern` names — the rule `useLastVisitedPage`'s\n * `exclude` reads (landing/routing.tsx) and the feedback guard's one-shot routes\n * (refactor audit 2026-10-30, FLW-7), here without the router: `landing/routing` imports\n * react-router, which `/feedback` must not drag in. The one copy: routing kept a private\n * one, and the two had drifted within the round (0.52 code review, this file).\n *\n * A string is that path and everything under it (`/join` is `/join` and `/join/abc`, not\n * `/joined`; `/` is only `/`); a RegExp is tested on the pathname (a `g` flag dropped, so\n * `lastIndex` never carries over between calls).\n *\n * Case-INSENSITIVE, as React Router matches a route unless it sets `caseSensitive` (0.52\n * code review, feedback/feedback-page-link.ts): the FLW-7 guard compared case-sensitively,\n * and `/Join?token=` went out as a link the router still rendered as `/join`. A RegExp\n * gets the `i` flag for the same reason. Matching more than a case-sensitive route would\n * only turns a link into text, or leaves a page unrecorded as a resume target: both\n * callers' safe side.\n *\n * @internal Package-private — not re-exported from the barrel.\n */\nexport function matchesPathPattern(pathname: string, pattern: string | RegExp): boolean {\n  if (typeof pattern !== \"string\") {\n    return new RegExp(pattern.source, `${pattern.flags.replace(/[gi]/g, \"\")}i`).test(pathname);\n  }\n  const path = pathname.toLowerCase();\n  if (pattern === \"/\") return path === \"/\";\n  const base = (pattern.endsWith(\"/\") ? pattern.slice(0, -1) : pattern).toLowerCase();\n  return path === base || path.startsWith(`${base}/`);\n}\n\n/**\n * The pathname of `href` (a path with its query and hash) as React Router matches it:\n * each segment percent-decoded, an encoded `/` kept as `%2F` so it never splits a segment\n * (react-router 8, `decodePath` in `matchRoutesImpl`). The 0.52 code review\n * (feedback/feedback-page-link.ts) found `/j%6Fin?token=` passing the FLW-7 guard as a\n * link that the router decoded to `/join`.\n *\n * A malformed escape leaves its own segment as written, where the router gives up on the\n * whole path: the rest still decodes, so the answer is never less than the router's.\n *\n * @internal Package-private — not re-exported from the barrel.\n */\nexport function routerPathname(href: string): string {\n  return href\n    .replace(/[?#].*$/, \"\")\n    .split(\"/\")\n    .map((segment) => {\n      try {\n        return decodeURIComponent(segment).replace(/\\//g, \"%2F\");\n      } catch {\n        return segment;\n      }\n    })\n    .join(\"/\");\n}\n"],"mappings":";AAoBO,SAAS,mBAAmB,UAAkB,SAAmC;AACtF,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,IAAI,OAAO,QAAQ,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,EAAE,CAAC,GAAG,EAAE,KAAK,QAAQ;AAAA,EAC3F;AACA,QAAM,OAAO,SAAS,YAAY;AAClC,MAAI,YAAY,IAAK,QAAO,SAAS;AACrC,QAAM,QAAQ,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI,SAAS,YAAY;AAClF,SAAO,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG;AACpD;AAcO,SAAS,eAAe,MAAsB;AACnD,SAAO,KACJ,QAAQ,WAAW,EAAE,EACrB,MAAM,GAAG,EACT,IAAI,CAAC,YAAY;AAChB,QAAI;AACF,aAAO,mBAAmB,OAAO,EAAE,QAAQ,OAAO,KAAK;AAAA,IACzD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,CAAC,EACA,KAAK,GAAG;AACb;","names":[]}

package/dist/lib/reduced-motion.d.ts

@@ -13,6 +13,7 @@
  * screen only delays its `onClose` — every test suite, the kit's and the apps', reads a
  * closed overlay as gone at once.
  *
- * Package-private — not re-exported from the barrel.
+ * Public since 0.52 (DUP-8, refactor audit 2026-10-30): Kurvenschmiede's chain animation
+ * carried a copy of its own.
  */
 export declare function prefersReducedMotion(whereUnknown?: boolean): boolean;

package/dist/lib/reduced-motion.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/reduced-motion.ts"],"sourcesContent":["/**\n * Whether the user has asked for no motion (`prefers-reduced-motion: reduce`), read NOW —\n * not at mount: the setting can change under a long-lived page. The kit's one copy\n * (DUP-11, refactor audit 2026-10: the settings focus and the exit timers each had their\n * own, with opposite answers where `matchMedia` is missing).\n *\n * Where there is no `matchMedia` to ask (SSR, jsdom) the answer is `whereUnknown`,\n * default `false`: motion allowed — the platform's own default, `no-preference`, which\n * is what a browser that cannot say otherwise has. A smooth scroll there is harmless.\n *\n * An exit animation passes `true` (`skipsExitAnimation` in `hooks/use-close-transition`):\n * without `matchMedia` nothing is painting, and a timer that holds an unpainted panel on\n * screen only delays its `onClose` — every test suite, the kit's and the apps', reads a\n * closed overlay as gone at once.\n *\n * Package-private — not re-exported from the barrel.\n */\nexport function prefersReducedMotion(whereUnknown = false): boolean {\n  if (typeof window === \"undefined\" || typeof window.matchMedia !== \"function\") return whereUnknown;\n  return window.matchMedia(\"(prefers-reduced-motion: reduce)\").matches;\n}\n"],"mappings":";AAiBO,SAAS,qBAAqB,eAAe,OAAgB;AAClE,MAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,WAAY,QAAO;AACrF,SAAO,OAAO,WAAW,kCAAkC,EAAE;AAC/D;","names":[]}
+{"version":3,"sources":["../../src/lib/reduced-motion.ts"],"sourcesContent":["/**\n * Whether the user has asked for no motion (`prefers-reduced-motion: reduce`), read NOW —\n * not at mount: the setting can change under a long-lived page. The kit's one copy\n * (DUP-11, refactor audit 2026-10: the settings focus and the exit timers each had their\n * own, with opposite answers where `matchMedia` is missing).\n *\n * Where there is no `matchMedia` to ask (SSR, jsdom) the answer is `whereUnknown`,\n * default `false`: motion allowed — the platform's own default, `no-preference`, which\n * is what a browser that cannot say otherwise has. A smooth scroll there is harmless.\n *\n * An exit animation passes `true` (`skipsExitAnimation` in `hooks/use-close-transition`):\n * without `matchMedia` nothing is painting, and a timer that holds an unpainted panel on\n * screen only delays its `onClose` — every test suite, the kit's and the apps', reads a\n * closed overlay as gone at once.\n *\n * Public since 0.52 (DUP-8, refactor audit 2026-10-30): Kurvenschmiede's chain animation\n * carried a copy of its own.\n */\nexport function prefersReducedMotion(whereUnknown = false): boolean {\n  if (typeof window === \"undefined\" || typeof window.matchMedia !== \"function\") return whereUnknown;\n  return window.matchMedia(\"(prefers-reduced-motion: reduce)\").matches;\n}\n"],"mappings":";AAkBO,SAAS,qBAAqB,eAAe,OAAgB;AAClE,MAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,WAAY,QAAO;AACrF,SAAO,OAAO,WAAW,kCAAkC,EAAE;AAC/D;","names":[]}

package/dist/lib/round.d.ts

@@ -17,6 +17,7 @@
  * `n` rounded to `digits` decimals, half away from zero, in decimal arithmetic:
  * 1.005 → 1.01, -2.5 at 0 → -3. Never NaN for a finite `n`, and never -0 — `formatMoney`
  * prints -0 as "-0,00 €", so a negative that rounds away comes back as 0. A non-finite
- * `n` comes back unchanged.
+ * `n` comes back unchanged. `digits` counts in whole decimals, as `toFixed` takes it: 2.5
+ * is 2, and NaN is 0.
  */
 export declare function roundHalfAway(n: number, digits: number): number;

package/dist/lib/round.js

@@ -5,8 +5,9 @@ function shiftDecimal(value, by) {
 }
 function roundHalfAway(n, digits) {
   if (!Number.isFinite(n)) return n;
+  const places = Math.trunc(digits) || 0;
   const abs = Math.abs(n);
-  const magnitude = abs >= 2 ** 53 ? abs : shiftDecimal(Math.round(shiftDecimal(abs, digits)), -digits);
+  const magnitude = abs >= 2 ** 53 ? abs : shiftDecimal(Math.round(shiftDecimal(abs, places)), -places);
   return (n < 0 ? -magnitude : magnitude) || 0;
 }
 export {

package/dist/lib/round.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/round.ts"],"sourcesContent":["/**\n * Decimal rounding, half away from zero — the one copy behind {@link roundToCurrency}\n * and AmountInput's settle (BUG-11, refactor audit 2026-10).\n *\n * Package-private — not re-exported from the barrel; `format.ts` and `calc.ts` are\n * re-exported wholesale, so a helper there would become API.\n *\n * WHY THE STRING SHIFT. `Math.round(1.005 * 100)` is 100, because 1.005 is 1.00499…\n * in binary. Shifting the decimal point in the number's SHORTEST spelling instead\n * (\"1.005e2\" is exactly 100.5) rounds the figure a person typed. Both helpers did that\n * by gluing `e${digits}` onto `String(n)` — but `String(n)` is itself in exponent form\n * below 1e-6 and at or above 1e21, and \"5.55e-17e2\" is NaN: `roundToCurrency(0.1 + 0.2\n * - 0.3, \"EUR\")` was NaN, and AmountInput blanked a typed \"0.0000001\" on blur (U-2's\n * class, 2026-08-24). {@link shiftDecimal} moves the exponent the string already has.\n */\n\n/** `value × 10^by`, by moving the exponent of its shortest spelling (\"1.005\" → \"1.005e2\",\n *  \"5.55e-17\" → \"5.55e-15\"), so no binary multiplication creeps in. */\nfunction shiftDecimal(value: number, by: number): number {\n  const [mantissa, exponent = \"0\"] = String(value).split(\"e\");\n  return Number(`${mantissa}e${Number(exponent) + by}`);\n}\n\n/**\n * `n` rounded to `digits` decimals, half away from zero, in decimal arithmetic:\n * 1.005 → 1.01, -2.5 at 0 → -3. Never NaN for a finite `n`, and never -0 — `formatMoney`\n * prints -0 as \"-0,00 €\", so a negative that rounds away comes back as 0. A non-finite\n * `n` comes back unchanged.\n */\nexport function roundHalfAway(n: number, digits: number): number {\n  if (!Number.isFinite(n)) return n;\n  const abs = Math.abs(n);\n  // Every double from 2^53 up is a whole number already, and scaling one near\n  // Number.MAX_VALUE up would overflow to Infinity.\n  const magnitude = abs >= 2 ** 53 ? abs : shiftDecimal(Math.round(shiftDecimal(abs, digits)), -digits);\n  // The sign goes back on after rounding, so `|| 0` must see the signed result.\n  return (n < 0 ? -magnitude : magnitude) || 0;\n}\n"],"mappings":";AAkBA,SAAS,aAAa,OAAe,IAAoB;AACvD,QAAM,CAAC,UAAU,WAAW,GAAG,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG;AAC1D,SAAO,OAAO,GAAG,QAAQ,IAAI,OAAO,QAAQ,IAAI,EAAE,EAAE;AACtD;AAQO,SAAS,cAAc,GAAW,QAAwB;AAC/D,MAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO;AAChC,QAAM,MAAM,KAAK,IAAI,CAAC;AAGtB,QAAM,YAAY,OAAO,KAAK,KAAK,MAAM,aAAa,KAAK,MAAM,aAAa,KAAK,MAAM,CAAC,GAAG,CAAC,MAAM;AAEpG,UAAQ,IAAI,IAAI,CAAC,YAAY,cAAc;AAC7C;","names":[]}
+{"version":3,"sources":["../../src/lib/round.ts"],"sourcesContent":["/**\n * Decimal rounding, half away from zero — the one copy behind {@link roundToCurrency}\n * and AmountInput's settle (BUG-11, refactor audit 2026-10).\n *\n * Package-private — not re-exported from the barrel; `format.ts` and `calc.ts` are\n * re-exported wholesale, so a helper there would become API.\n *\n * WHY THE STRING SHIFT. `Math.round(1.005 * 100)` is 100, because 1.005 is 1.00499…\n * in binary. Shifting the decimal point in the number's SHORTEST spelling instead\n * (\"1.005e2\" is exactly 100.5) rounds the figure a person typed. Both helpers did that\n * by gluing `e${digits}` onto `String(n)` — but `String(n)` is itself in exponent form\n * below 1e-6 and at or above 1e21, and \"5.55e-17e2\" is NaN: `roundToCurrency(0.1 + 0.2\n * - 0.3, \"EUR\")` was NaN, and AmountInput blanked a typed \"0.0000001\" on blur (U-2's\n * class, 2026-08-24). {@link shiftDecimal} moves the exponent the string already has.\n */\n\n/** `value × 10^by`, by moving the exponent of its shortest spelling (\"1.005\" → \"1.005e2\",\n *  \"5.55e-17\" → \"5.55e-15\"), so no binary multiplication creeps in. */\nfunction shiftDecimal(value: number, by: number): number {\n  const [mantissa, exponent = \"0\"] = String(value).split(\"e\");\n  return Number(`${mantissa}e${Number(exponent) + by}`);\n}\n\n/**\n * `n` rounded to `digits` decimals, half away from zero, in decimal arithmetic:\n * 1.005 → 1.01, -2.5 at 0 → -3. Never NaN for a finite `n`, and never -0 — `formatMoney`\n * prints -0 as \"-0,00 €\", so a negative that rounds away comes back as 0. A non-finite\n * `n` comes back unchanged. `digits` counts in whole decimals, as `toFixed` takes it: 2.5\n * is 2, and NaN is 0.\n */\nexport function roundHalfAway(n: number, digits: number): number {\n  if (!Number.isFinite(n)) return n;\n  // \"1.2345e2.5\" is NaN, and `|| 0` below made it 0: MeasuredGrid's `digits`, which went to\n  // `toFixed` before DUP-14 brought it here, wrote every computed cell of a table with a\n  // fractional one as \"0\" (0.52 code review, deep, charts, finding 5).\n  const places = Math.trunc(digits) || 0;\n  const abs = Math.abs(n);\n  // Every double from 2^53 up is a whole number already, and scaling one near\n  // Number.MAX_VALUE up would overflow to Infinity.\n  const magnitude = abs >= 2 ** 53 ? abs : shiftDecimal(Math.round(shiftDecimal(abs, places)), -places);\n  // The sign goes back on after rounding, so `|| 0` must see the signed result.\n  return (n < 0 ? -magnitude : magnitude) || 0;\n}\n"],"mappings":";AAkBA,SAAS,aAAa,OAAe,IAAoB;AACvD,QAAM,CAAC,UAAU,WAAW,GAAG,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG;AAC1D,SAAO,OAAO,GAAG,QAAQ,IAAI,OAAO,QAAQ,IAAI,EAAE,EAAE;AACtD;AASO,SAAS,cAAc,GAAW,QAAwB;AAC/D,MAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO;AAIhC,QAAM,SAAS,KAAK,MAAM,MAAM,KAAK;AACrC,QAAM,MAAM,KAAK,IAAI,CAAC;AAGtB,QAAM,YAAY,OAAO,KAAK,KAAK,MAAM,aAAa,KAAK,MAAM,aAAa,KAAK,MAAM,CAAC,GAAG,CAAC,MAAM;AAEpG,UAAQ,IAAI,IAAI,CAAC,YAAY,cAAc;AAC7C;","names":[]}

package/dist/lib/safe-storage.d.ts

@@ -16,14 +16,21 @@
  *
  * Since 0.34 (DUP-11, refactor audit 2026-10) it also removes, and guards
  * `sessionStorage` the same way: `landing/routing`, `billing/checkout-processing` and
- * the demo banner each wrote that guard again by hand. `removeStored` and the session
- * pair are package-private — the barrel exports `readStored` / `writeStored` only.
+ * the demo banner each wrote that guard again by hand.
+ *
+ * Since 0.52 all of it but {@link storedKeys} is public, with a JSON pair beside it
+ * (DUP-8, refactor audit 2026-10-30). Kept package-private, the guard was written again
+ * four times in the kit's showcase and in 16 files across the three apps, some of them
+ * without it: a token read that throws where storage is blocked takes every request
+ * down with it. (The kit's own DevMenu, 0.51, wrote the session pair a second time too.)
  */
 /** The stored string for `key`, or null when absent, unreadable, or blocked. */
 export declare function readStored(key: string): string | null;
 /** Store `value` under `key`, silently doing nothing when storage is unavailable
- *  or full. A preference that cannot be persisted is not worth an exception. */
-export declare function writeStored(key: string, value: string): void;
+ *  or full. A preference that cannot be persisted is not worth an exception. `null`
+ *  removes the key, as {@link writeSessionStored}'s does (0.52; the two pairs wrote
+ *  differently, and `null` past the types stored the string "null" — 0.52 code review). */
+export declare function writeStored(key: string, value: string | null): void;
 /** Forget `key`, silently doing nothing when storage is blocked — there is nothing to
  *  forget then. */
 export declare function removeStored(key: string): void;
@@ -31,9 +38,21 @@ export declare function removeStored(key: string): void;
 export declare function readSessionStored(key: string): string | null;
 /** {@link writeStored} for `sessionStorage`; `null` removes the key. */
 export declare function writeSessionStored(key: string, value: string | null): void;
+/**
+ * The JSON stored under `key`, when it parses and `isShape` accepts it; else `null`. Absent,
+ * blocked, malformed and another shape all read as "never set" — the caller's default —
+ * which is what the six hand-written `JSON.parse(readStored(key))` reads in the kit each
+ * answered in their own try/catch (DUP-8). `isShape` gets the parsed value as `unknown`:
+ * the shape check is the one part that is the caller's. A shape check that throws reads
+ * as another shape: null.
+ */
+export declare function readStoredJson<T>(key: string, isShape: (value: unknown) => value is T): T | null;
+/** Store `value` as JSON under `key`, silently doing nothing when storage is unavailable
+ *  or full, or the value has no JSON form (a cycle, a BigInt) — {@link writeStored}'s rule. */
+export declare function writeStoredJson(key: string, value: unknown): void;
 /**
  * Every key in `area` that starts with `prefix`, or `[]` where storage refuses — for the
  * reset of this device's settings, which removes a table's views by their prefix
- * (docs/settings-harmonization.md §11.4). Package-private, like {@link removeStored}.
+ * (docs/settings-harmonization.md §11.4). Package-private: the reset's alone.
  */
 export declare function storedKeys(prefix: string, area?: "local" | "session"): string[];

package/dist/lib/safe-storage.js

@@ -11,7 +11,11 @@ function readStored(key) {
   return guarded("localStorage", null, (storage) => storage.getItem(key));
 }
 function writeStored(key, value) {
-  guarded("localStorage", void 0, (storage) => storage.setItem(key, value));
+  guarded(
+    "localStorage",
+    void 0,
+    (storage) => value === null ? storage.removeItem(key) : storage.setItem(key, value)
+  );
 }
 function removeStored(key) {
   guarded("localStorage", void 0, (storage) => storage.removeItem(key));
@@ -26,6 +30,25 @@ function writeSessionStored(key, value) {
     (storage) => value === null ? storage.removeItem(key) : storage.setItem(key, value)
   );
 }
+function readStoredJson(key, isShape) {
+  const text = readStored(key);
+  if (text === null) return null;
+  try {
+    const value = JSON.parse(text);
+    return isShape(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function writeStoredJson(key, value) {
+  let text;
+  try {
+    text = JSON.stringify(value);
+  } catch {
+    return;
+  }
+  if (text !== void 0) writeStored(key, text);
+}
 function storedKeys(prefix, area = "local") {
   return guarded(area === "session" ? "sessionStorage" : "localStorage", [], (storage) => {
     const keys = [];
@@ -39,9 +62,11 @@ function storedKeys(prefix, area = "local") {
 export {
   readSessionStored,
   readStored,
+  readStoredJson,
   removeStored,
   storedKeys,
   writeSessionStored,
-  writeStored
+  writeStored,
+  writeStoredJson
 };
 //# sourceMappingURL=safe-storage.js.map

package/dist/lib/safe-storage.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/safe-storage.ts"],"sourcesContent":["/**\n * `localStorage` that cannot take the page down with it.\n *\n * Accessing `window.localStorage` **throws** — rather than returning null — when a\n * browser has site data blocked: Safari private browsing, Chrome with third-party\n * site data disabled, a partitioned webview. Three places in this package already\n * knew that and wrapped their calls in try/catch (`logger.ts`, and the DataTable's\n * `loadPersisted`/`savePersisted`). One did not: `AppShell` read the sidebar's\n * collapse flag straight out of a `useState` initialiser, so the throw happened\n * during render of the application's top-level shell. That is not a lost preference\n * — nothing mounts, in every consumer of this package at once.\n *\n * So the guard lives here, once, and the next storage-backed preference cannot\n * forget it. A read that cannot happen is indistinguishable from a key that was\n * never set, which is the right answer for every caller: the default.\n *\n * Since 0.34 (DUP-11, refactor audit 2026-10) it also removes, and guards\n * `sessionStorage` the same way: `landing/routing`, `billing/checkout-processing` and\n * the demo banner each wrote that guard again by hand. `removeStored` and the session\n * pair are package-private — the barrel exports `readStored` / `writeStored` only.\n */\n\n/** `access` on the storage area, or `fallback` where there is none (SSR) or it throws. */\nfunction guarded<T>(area: \"localStorage\" | \"sessionStorage\", fallback: T, access: (storage: Storage) => T): T {\n  if (typeof window === \"undefined\") return fallback;\n  try {\n    return access(window[area]);\n  } catch {\n    // private mode, quota, partitioned or blocked storage\n    return fallback;\n  }\n}\n\n/** The stored string for `key`, or null when absent, unreadable, or blocked. */\nexport function readStored(key: string): string | null {\n  return guarded(\"localStorage\", null, (storage) => storage.getItem(key));\n}\n\n/** Store `value` under `key`, silently doing nothing when storage is unavailable\n *  or full. A preference that cannot be persisted is not worth an exception. */\nexport function writeStored(key: string, value: string): void {\n  guarded(\"localStorage\", undefined, (storage) => storage.setItem(key, value));\n}\n\n/** Forget `key`, silently doing nothing when storage is blocked — there is nothing to\n *  forget then. */\nexport function removeStored(key: string): void {\n  guarded(\"localStorage\", undefined, (storage) => storage.removeItem(key));\n}\n\n/** {@link readStored} for `sessionStorage`: this tab's value, or null. */\nexport function readSessionStored(key: string): string | null {\n  return guarded(\"sessionStorage\", null, (storage) => storage.getItem(key));\n}\n\n/** {@link writeStored} for `sessionStorage`; `null` removes the key. */\nexport function writeSessionStored(key: string, value: string | null): void {\n  guarded(\"sessionStorage\", undefined, (storage) =>\n    value === null ? storage.removeItem(key) : storage.setItem(key, value),\n  );\n}\n\n/**\n * Every key in `area` that starts with `prefix`, or `[]` where storage refuses — for the\n * reset of this device's settings, which removes a table's views by their prefix\n * (docs/settings-harmonization.md §11.4). Package-private, like {@link removeStored}.\n */\nexport function storedKeys(prefix: string, area: \"local\" | \"session\" = \"local\"): string[] {\n  return guarded(area === \"session\" ? \"sessionStorage\" : \"localStorage\", [], (storage) => {\n    const keys: string[] = [];\n    for (let i = 0; i < storage.length; i++) {\n      const key = storage.key(i);\n      if (key !== null && key.startsWith(prefix)) keys.push(key);\n    }\n    return keys;\n  });\n}\n"],"mappings":";AAuBA,SAAS,QAAW,MAAyC,UAAa,QAAoC;AAC5G,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,WAAO,OAAO,OAAO,IAAI,CAAC;AAAA,EAC5B,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,WAAW,KAA4B;AACrD,SAAO,QAAQ,gBAAgB,MAAM,CAAC,YAAY,QAAQ,QAAQ,GAAG,CAAC;AACxE;AAIO,SAAS,YAAY,KAAa,OAAqB;AAC5D,UAAQ,gBAAgB,QAAW,CAAC,YAAY,QAAQ,QAAQ,KAAK,KAAK,CAAC;AAC7E;AAIO,SAAS,aAAa,KAAmB;AAC9C,UAAQ,gBAAgB,QAAW,CAAC,YAAY,QAAQ,WAAW,GAAG,CAAC;AACzE;AAGO,SAAS,kBAAkB,KAA4B;AAC5D,SAAO,QAAQ,kBAAkB,MAAM,CAAC,YAAY,QAAQ,QAAQ,GAAG,CAAC;AAC1E;AAGO,SAAS,mBAAmB,KAAa,OAA4B;AAC1E;AAAA,IAAQ;AAAA,IAAkB;AAAA,IAAW,CAAC,YACpC,UAAU,OAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAAA,EACvE;AACF;AAOO,SAAS,WAAW,QAAgB,OAA4B,SAAmB;AACxF,SAAO,QAAQ,SAAS,YAAY,mBAAmB,gBAAgB,CAAC,GAAG,CAAC,YAAY;AACtF,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,YAAM,MAAM,QAAQ,IAAI,CAAC;AACzB,UAAI,QAAQ,QAAQ,IAAI,WAAW,MAAM,EAAG,MAAK,KAAK,GAAG;AAAA,IAC3D;AACA,WAAO;AAAA,EACT,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/lib/safe-storage.ts"],"sourcesContent":["/**\n * `localStorage` that cannot take the page down with it.\n *\n * Accessing `window.localStorage` **throws** — rather than returning null — when a\n * browser has site data blocked: Safari private browsing, Chrome with third-party\n * site data disabled, a partitioned webview. Three places in this package already\n * knew that and wrapped their calls in try/catch (`logger.ts`, and the DataTable's\n * `loadPersisted`/`savePersisted`). One did not: `AppShell` read the sidebar's\n * collapse flag straight out of a `useState` initialiser, so the throw happened\n * during render of the application's top-level shell. That is not a lost preference\n * — nothing mounts, in every consumer of this package at once.\n *\n * So the guard lives here, once, and the next storage-backed preference cannot\n * forget it. A read that cannot happen is indistinguishable from a key that was\n * never set, which is the right answer for every caller: the default.\n *\n * Since 0.34 (DUP-11, refactor audit 2026-10) it also removes, and guards\n * `sessionStorage` the same way: `landing/routing`, `billing/checkout-processing` and\n * the demo banner each wrote that guard again by hand.\n *\n * Since 0.52 all of it but {@link storedKeys} is public, with a JSON pair beside it\n * (DUP-8, refactor audit 2026-10-30). Kept package-private, the guard was written again\n * four times in the kit's showcase and in 16 files across the three apps, some of them\n * without it: a token read that throws where storage is blocked takes every request\n * down with it. (The kit's own DevMenu, 0.51, wrote the session pair a second time too.)\n */\n\n/** `access` on the storage area, or `fallback` where there is none (SSR) or it throws. */\nfunction guarded<T>(area: \"localStorage\" | \"sessionStorage\", fallback: T, access: (storage: Storage) => T): T {\n  if (typeof window === \"undefined\") return fallback;\n  try {\n    return access(window[area]);\n  } catch {\n    // private mode, quota, partitioned or blocked storage\n    return fallback;\n  }\n}\n\n/** The stored string for `key`, or null when absent, unreadable, or blocked. */\nexport function readStored(key: string): string | null {\n  return guarded(\"localStorage\", null, (storage) => storage.getItem(key));\n}\n\n/** Store `value` under `key`, silently doing nothing when storage is unavailable\n *  or full. A preference that cannot be persisted is not worth an exception. `null`\n *  removes the key, as {@link writeSessionStored}'s does (0.52; the two pairs wrote\n *  differently, and `null` past the types stored the string \"null\" — 0.52 code review). */\nexport function writeStored(key: string, value: string | null): void {\n  guarded(\"localStorage\", undefined, (storage) =>\n    value === null ? storage.removeItem(key) : storage.setItem(key, value),\n  );\n}\n\n/** Forget `key`, silently doing nothing when storage is blocked — there is nothing to\n *  forget then. */\nexport function removeStored(key: string): void {\n  guarded(\"localStorage\", undefined, (storage) => storage.removeItem(key));\n}\n\n/** {@link readStored} for `sessionStorage`: this tab's value, or null. */\nexport function readSessionStored(key: string): string | null {\n  return guarded(\"sessionStorage\", null, (storage) => storage.getItem(key));\n}\n\n/** {@link writeStored} for `sessionStorage`; `null` removes the key. */\nexport function writeSessionStored(key: string, value: string | null): void {\n  guarded(\"sessionStorage\", undefined, (storage) =>\n    value === null ? storage.removeItem(key) : storage.setItem(key, value),\n  );\n}\n\n/**\n * The JSON stored under `key`, when it parses and `isShape` accepts it; else `null`. Absent,\n * blocked, malformed and another shape all read as \"never set\" — the caller's default —\n * which is what the six hand-written `JSON.parse(readStored(key))` reads in the kit each\n * answered in their own try/catch (DUP-8). `isShape` gets the parsed value as `unknown`:\n * the shape check is the one part that is the caller's. A shape check that throws reads\n * as another shape: null.\n */\nexport function readStoredJson<T>(key: string, isShape: (value: unknown) => value is T): T | null {\n  const text = readStored(key);\n  if (text === null) return null;\n  try {\n    const value: unknown = JSON.parse(text);\n    return isShape(value) ? value : null;\n  } catch {\n    // not JSON, or a shape check that read past what is there\n    return null;\n  }\n}\n\n/** Store `value` as JSON under `key`, silently doing nothing when storage is unavailable\n *  or full, or the value has no JSON form (a cycle, a BigInt) — {@link writeStored}'s rule. */\nexport function writeStoredJson(key: string, value: unknown): void {\n  let text: string | undefined;\n  try {\n    text = JSON.stringify(value);\n  } catch {\n    return;\n  }\n  // `undefined` (and a function) has no JSON form either: stringify answers undefined.\n  if (text !== undefined) writeStored(key, text);\n}\n\n/**\n * Every key in `area` that starts with `prefix`, or `[]` where storage refuses — for the\n * reset of this device's settings, which removes a table's views by their prefix\n * (docs/settings-harmonization.md §11.4). Package-private: the reset's alone.\n */\nexport function storedKeys(prefix: string, area: \"local\" | \"session\" = \"local\"): string[] {\n  return guarded(area === \"session\" ? \"sessionStorage\" : \"localStorage\", [], (storage) => {\n    const keys: string[] = [];\n    for (let i = 0; i < storage.length; i++) {\n      const key = storage.key(i);\n      if (key !== null && key.startsWith(prefix)) keys.push(key);\n    }\n    return keys;\n  });\n}\n"],"mappings":";AA4BA,SAAS,QAAW,MAAyC,UAAa,QAAoC;AAC5G,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,WAAO,OAAO,OAAO,IAAI,CAAC;AAAA,EAC5B,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,WAAW,KAA4B;AACrD,SAAO,QAAQ,gBAAgB,MAAM,CAAC,YAAY,QAAQ,QAAQ,GAAG,CAAC;AACxE;AAMO,SAAS,YAAY,KAAa,OAA4B;AACnE;AAAA,IAAQ;AAAA,IAAgB;AAAA,IAAW,CAAC,YAClC,UAAU,OAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAAA,EACvE;AACF;AAIO,SAAS,aAAa,KAAmB;AAC9C,UAAQ,gBAAgB,QAAW,CAAC,YAAY,QAAQ,WAAW,GAAG,CAAC;AACzE;AAGO,SAAS,kBAAkB,KAA4B;AAC5D,SAAO,QAAQ,kBAAkB,MAAM,CAAC,YAAY,QAAQ,QAAQ,GAAG,CAAC;AAC1E;AAGO,SAAS,mBAAmB,KAAa,OAA4B;AAC1E;AAAA,IAAQ;AAAA,IAAkB;AAAA,IAAW,CAAC,YACpC,UAAU,OAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAAA,EACvE;AACF;AAUO,SAAS,eAAkB,KAAa,SAAmD;AAChG,QAAM,OAAO,WAAW,GAAG;AAC3B,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,WAAO,QAAQ,KAAK,IAAI,QAAQ;AAAA,EAClC,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAIO,SAAS,gBAAgB,KAAa,OAAsB;AACjE,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN;AAAA,EACF;AAEA,MAAI,SAAS,OAAW,aAAY,KAAK,IAAI;AAC/C;AAOO,SAAS,WAAW,QAAgB,OAA4B,SAAmB;AACxF,SAAO,QAAQ,SAAS,YAAY,mBAAmB,gBAAgB,CAAC,GAAG,CAAC,YAAY;AACtF,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,YAAM,MAAM,QAAQ,IAAI,CAAC;AACzB,UAAI,QAAQ,QAAQ,IAAI,WAAW,MAAM,EAAG,MAAK,KAAK,GAAG;AAAA,IAC3D;AACA,WAAO;AAAA,EACT,CAAC;AACH;","names":[]}

package/dist/lib/session-refresh.js

@@ -1,5 +1,5 @@
 "use client";
-import { httpStatusOf } from "../auth/auth-errors.js";
+import { httpStatusOf } from "./http-status.js";
 const SIGNED_OUT_STEPS = [
   "login",
   "passkey/login",

package/dist/lib/session-refresh.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/session-refresh.ts"],"sourcesContent":["/**\n * Renewing a session when the access token runs out: the client half of\n * docs/auth-harmonization.md §11 (round 0.34 C7, KS U6), lifted from keksdose's\n * `refreshOnce` (Kurvenschmiede's is the same, line for line) and corrected where the\n * three apps' reviews found it wrong. It ends kastlan's sign-out over a network blip (B3).\n *\n * THE KIT OWNS THE RULE, THE APP OWNS THE CALL (§11.2, decision 1). The kit decides when\n * to refresh, who waits, what a failure means, when the session is over and whether a\n * renewal may still be stored. The app keeps its endpoint, its token storage, its\n * sign-out and where it navigates, and hands them in as {@link SessionRefreshOptions}.\n *\n *  - **One flight per tab** (decision 2): every 401 that arrives while a refresh runs\n *    waits for it, and so does `session.refresh()` (kastlan's boot).\n *  - **Definitive** (decision 3): the device holds no refresh token (`refresh` resolves\n *    `null`), the refresh answers 401 or 403, or the request replayed with the fresh\n *    token gets a 401 again. Only then does the app sign out (`onEnded`), and only while\n *    that session is still the app's.\n *  - **Transient** (decision 4): everything else. The session stays: nothing is signed\n *    out, stored or redirected, and the kit shows nothing. The request rejects with its\n *    OWN 401, marked ({@link isTransientRefreshFailure}), so the app's message can say\n *    \"can't reach the server\" instead of \"not signed in\".\n *  - **Retries only where waiting helps** (decision 5, KS 7): no answer, the kit's own\n *    timeout, 408, 429 and 5xx get up to three attempts, 1 s and then 3 s apart, each cut\n *    off after 15 s; none while the browser reports itself offline. Any other answer, and\n *    anything that is not an HTTP error, ends the flight at the first attempt.\n *  - **A stale session is never written back** (§11.7, ka 3, KS 3, KS 4): every request\n *    is stamped with `currentToken()` when it goes out, and every flight notes it when it\n *    starts. A 401 to a request sent with an older token replays it with the app's token\n *    now, without a refresh; a flight whose session changed while it ran stores nothing\n *    and ends nothing. The access token is the session's identity because every change\n *    the apps make replaces it — a refresh, another tab, a company switch, a password\n *    change, a sign-in, a demo start, a sign-out.\n *\n * Framework-free like `server-wake.ts`: {@link attachSessionRefresh} takes the app's\n * axios instance as an ARGUMENT, typed structurally, so the kit never imports axios.\n */\n\nimport type { AxiosLikeInstance, ServerWakeAxiosConfig } from \"./server-wake\";\nimport { httpStatusOf } from \"../auth/auth-errors\";\n\n/** What the app's `refresh` resolves: the new access token, plus whatever its `store`\n *  needs (its refresh token, the user). */\nexport interface SessionRenewal {\n  /** The new access token; the waiting requests are replayed with it. */\n  token: string;\n  /**\n   * `false`: store the renewal, but replay nothing — each waiting request rejects with\n   * its 401, unmarked. kastlan's refresh can land in another company (§11.5, ka 3): a\n   * waiting write, such as the handover's `POST /sync`, must not be replayed into it.\n   */\n  replay?: false;\n}\n\n/** What the app hands {@link createSessionRefresh} (§11.4). */\nexport interface SessionRefreshOptions<R extends SessionRenewal> {\n  /**\n   * The app's own `POST /auth/refresh`, on a BARE client — never the instance the kit is\n   * attached to, so the refresh cannot re-enter the interceptor. It **writes nothing**:\n   * the kit hands the answer to `store`, and only while the session is unchanged.\n   *\n   * Resolves the answer as a renewal, or `null` when the device holds no refresh token.\n   * Throws on failure, and the kit classifies the throw: a 401 or 403 is definitive; no\n   * answer (an axios error without a `response`), the kit's own timeout, 408, 429 and\n   * 5xx are transient and retried; any other answer, and anything that is not an HTTP\n   * error (a bug in this function), is transient and not retried. The status is read\n   * from `err.response.status` (axios), `err.status` or `err.statusCode`.\n   *\n   * `signal` aborts when the attempt runs past `timeoutMs`; pass it to the request.\n   */\n  refresh: (signal: AbortSignal) => Promise<R | null>;\n  /** Writes the renewal: the tokens and the user (a missing refresh token keeps the\n   *  stored one). Called only while the session the flight renews is still the app's,\n   *  and before the waiting requests are replayed — so it writes the token SYNCHRONOUSLY\n   *  where `currentToken` reads it: the replay goes through the app's own request\n   *  interceptor again, and is stamped then. A throw is the app's bug: the waiting\n   *  requests and `session.refresh()` reject with it. */\n  store: (renewal: R) => void;\n  /** The access token the app sends NOW, read where its request interceptor reads it;\n   *  `null` when there is none. */\n  currentToken: () => string | null;\n  /** Whether the session is a demo: a demo's 401 ends it, with no refresh tried\n   *  (landing-demo §5.5). */\n  isDemo: () => boolean;\n  /**\n   * The session is over: drop the tokens and the user, then navigate — `/demo/ended` for\n   * a demo, else the sign-in with the page it came from (auth §5.2). Called once per\n   * session, however many requests found out (KS 8), and never by `session.refresh()`.\n   */\n  onEnded: (ended: { demo: boolean }) => void;\n  /** Whether a URL is a signed-out step, whose 401 judges the form and never the\n   *  session. Replaces the default list, {@link isSignedOutStep}. */\n  isSignedOutStep?: (url: string) => boolean;\n  /** Attempts for a refresh that got no answer, timed out, or got a 408, 429 or 5xx.\n   *  Default 3. */\n  attempts?: number;\n  /** The waits before the second and later attempts; the last one repeats. Default\n   *  `[1000, 3000]`. */\n  backoffMs?: readonly number[];\n  /** Each attempt is cut off after this, and its `signal` aborted. Default 15 000. */\n  timeoutMs?: number;\n}\n\n/** What `session.refresh()` resolves (§11.4), by `result`:\n *\n * | `result` | When | What the kit has done |\n * |---|---|---|\n * | `\"renewed\"` | a renewal while the session was unchanged | `store(renewal)` |\n * | `\"ended\"` | definitive | nothing; `onEnded` only for requests that waited on the same flight |\n * | `\"transient\"` | transient | nothing |\n * | `\"changed\"` | the session changed while it ran | nothing; read the app's own state |\n */\nexport type SessionRefreshOutcome<R extends SessionRenewal = SessionRenewal> =\n  { result: \"renewed\"; renewal: R } | { result: \"ended\" } | { result: \"transient\" } | { result: \"changed\" };\n\n/** The flight {@link createSessionRefresh} makes; {@link attachSessionRefresh} hooks it\n *  to an axios instance. */\nexport interface SessionRefresh<R extends SessionRenewal = SessionRenewal> {\n  /**\n   * The same flight, for a caller outside the interceptor — kastlan's boot. Joins a\n   * running flight, or starts one. Never calls `onEnded`: the caller decides what an\n   * `\"ended\"` means for it.\n   */\n  refresh(): Promise<SessionRefreshOutcome<R>>;\n}\n\n// ── The signed-out steps ──────────────────────────────────────────────────────\n\n/**\n * Every `/auth/` call made without a session, the union of the three apps' lists\n * (§11.3): signing in (with its `2fa` and `set-password` steps, and a passkey's), up,\n * into a demo, a password reset, the verification link, the invitation check, the email\n * change's confirmation link, and the refresh itself. NOT `resend-verification` (KS 1):\n * in keksdose and Kurvenschmiede it needs a session; in kastlan it never answers 401.\n */\nconst SIGNED_OUT_STEPS = [\n  \"login\",\n  \"passkey/login\",\n  \"register\",\n  \"demo-session\",\n  \"password-reset\",\n  \"verify-email\",\n  \"invitations/check\",\n  \"me/email/confirm\",\n  \"refresh\",\n] as const;\n\n/**\n * Whether a request's URL is a signed-out step — the kit's default list (§11.3), exported\n * for an app's tests and for an app's own `isSignedOutStep` that adds to it.\n *\n * **Whole steps only** (KS 2): the part of the path after its `auth/` segment, without\n * the query string, is the entry itself or starts with the entry and a `/`. So\n * `login/2fa` is `login`'s, but `register` never catches `/auth/passkey/register/begin`\n * (adding a passkey, which needs a session), `invitations/check` never\n * `/auth/invitations/accept`, and `me/email/confirm` never `/auth/me/email`. Relative and\n * absolute URLs alike; a URL with no `auth` segment is no step.\n */\nexport function isSignedOutStep(url: string): boolean {\n  const path = url.replace(/[?#].*$/s, \"\").replace(/^([a-z][a-z\\d+.-]*:)?\\/\\/[^/]*/i, \"\");\n  const segments = path.split(\"/\");\n  const at = segments.indexOf(\"auth\");\n  if (at < 0) return false;\n  const step = segments.slice(at + 1).join(\"/\");\n  return SIGNED_OUT_STEPS.some((entry) => step === entry || step.startsWith(`${entry}/`));\n}\n\n// ── The marker ────────────────────────────────────────────────────────────────\n\n/** On the request's own axios error, after a transient failure (decision 8). A\n *  `Symbol.for` key: shared by every copy of the kit in a page, and left out of\n *  `JSON.stringify`, so a log that serialises the error doesn't print it (kk 2). */\nconst TRANSIENT = Symbol.for(\"@eifi1/ui-kit:session-refresh.transient\");\n\n/**\n * Whether a request was refused because the refresh behind it failed TRANSIENTLY —\n * offline, a timeout, a 5xx — and not because the session is over (decision 8). The\n * error is the request's own 401, `err.response?.status` and every check an app already\n * has keep working; this reads the mark the kit put on it, so the app's message can say\n * \"can't reach the server\" instead of \"not signed in\". Read it FIRST: keksdose's sync\n * chip, kastlan's handover sync and Kurvenschmiede's `apiErrorMessage` count it as\n * offline (§11.5).\n *\n * Not the refresh's own error: its config carries the refresh token in its body, into any\n * log or crash report that keeps the error.\n */\nexport function isTransientRefreshFailure(error: unknown): boolean {\n  return typeof error === \"object\" && error !== null && (error as Record<symbol, unknown>)[TRANSIENT] === true;\n}\n\n// ── The flight ────────────────────────────────────────────────────────────────\n\n/** A flight's result, as the interceptor needs it: `\"ended\"` keeps the session it ended. */\ntype Flight<R extends SessionRenewal> =\n  | { result: \"renewed\"; renewal: R }\n  | { result: \"ended\"; token: string | null }\n  | { result: \"transient\" }\n  | { result: \"changed\" };\n\n/** What one attempt came to. */\ntype Attempt<R> = { renewal: R } | \"definitive\" | \"retry\" | \"transient\";\n\n/** What {@link attachSessionRefresh} needs of a session. Kept off the public interface:\n *  only what {@link createSessionRefresh} made can be attached. */\ninterface Engine {\n  token(): string | null;\n  isDemo(): boolean;\n  isSignedOutStep(url: string): boolean;\n  join(): Promise<Flight<SessionRenewal>>;\n  end(token: string | null, demo: boolean): void;\n}\n\nconst engines = new WeakMap<SessionRefresh<SessionRenewal>, Engine>();\n\n/** The kit's own timeout, told apart from anything the app's `refresh` throws. */\nconst TIMED_OUT = Symbol(\"timed out\");\n\nfunction isOffline(): boolean {\n  return typeof navigator !== \"undefined\" && navigator.onLine === false;\n}\n\n/** A refresh's throw, classified (§11.4). The status is read where `isRateLimited` reads\n *  it — `httpStatusOf`, one probe for axios, ofetch and Node errors (DUP-11). */\nfunction classify(error: unknown): \"definitive\" | \"retry\" | \"transient\" {\n  if (error === TIMED_OUT) return \"retry\";\n  if (typeof error !== \"object\" || error === null) return \"transient\";\n  const status = httpStatusOf(error);\n  if (status === undefined) {\n    // No answer: axios marks its own errors, and one without a response never reached a\n    // server (offline, DNS, CORS, its own timeout). Anything else is a bug in `refresh`.\n    return (error as { isAxiosError?: unknown }).isAxiosError === true ? \"retry\" : \"transient\";\n  }\n  if (status === 401 || status === 403) return \"definitive\";\n  if (status === 408 || status === 429 || status >= 500) return \"retry\";\n  return \"transient\";\n}\n\nconst sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));\n\n/**\n * Make the flight: `const session = createSessionRefresh({ refresh, store, currentToken,\n * isDemo, onEnded })`, then {@link attachSessionRefresh}`(api, session)`. One per tab.\n */\nexport function createSessionRefresh<R extends SessionRenewal>(options: SessionRefreshOptions<R>): SessionRefresh<R> {\n  const { attempts = 3, backoffMs = [1000, 3000], timeoutMs = 15_000 } = options;\n  // An empty string is no token: the stamp and the flight compare tokens, and \"\" against\n  // `null` must not read as a change of session.\n  const token = () => options.currentToken() || null;\n\n  /** One call of the app's `refresh`, cut off after `timeoutMs` even if it ignores the\n   *  signal. */\n  const attempt = async (): Promise<Attempt<R>> => {\n    const controller = new AbortController();\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const timeout = new Promise<never>((_, reject) => {\n      timer = setTimeout(() => {\n        reject(TIMED_OUT);\n        controller.abort();\n      }, timeoutMs);\n    });\n    try {\n      // Through `then`, so a `refresh` that throws before it returns a promise is\n      // classified like one that rejects.\n      const renewal = await Promise.race([Promise.resolve().then(() => options.refresh(controller.signal)), timeout]);\n      return renewal ? { renewal } : \"definitive\";\n    } catch (error) {\n      return classify(error);\n    } finally {\n      clearTimeout(timer);\n    }\n  };\n\n  const run = async (): Promise<Flight<R>> => {\n    // The session this flight renews (§11.3 step 5).\n    const noted = token();\n    const changed = () => token() !== noted;\n    let outcome = await attempt();\n    for (let made = 1; outcome === \"retry\"; made += 1) {\n      // No further attempt while the browser says it is offline, nor for a session that\n      // is no longer the app's: whatever the answer, it would be \"changed\".\n      if (made >= attempts || isOffline() || changed()) break;\n      await sleep(backoffMs[made - 1] ?? backoffMs[backoffMs.length - 1] ?? 0);\n      if (isOffline() || changed()) break;\n      outcome = await attempt();\n    }\n    // A late answer never writes the old session back over a sign-out, a demo start or a\n    // password change, and the old session's refusal never signs anyone out (KS 3).\n    if (changed()) return { result: \"changed\" };\n    if (outcome === \"definitive\") return { result: \"ended\", token: noted };\n    if (outcome === \"retry\" || outcome === \"transient\") return { result: \"transient\" };\n    options.store(outcome.renewal);\n    return { result: \"renewed\", renewal: outcome.renewal };\n  };\n\n  let flight: Promise<Flight<R>> | null = null;\n  const join = () => {\n    // Cleared before any waiter resumes (`finally` settles first), so a waiter that\n    // needs another flight starts a new one.\n    flight ??= run().finally(() => {\n      flight = null;\n    });\n    return flight;\n  };\n\n  /** The session `onEnded` was last called for: once per session (KS 8). */\n  let ended: { token: string | null } | undefined;\n\n  const session: SessionRefresh<R> = {\n    async refresh() {\n      const outcome = await join();\n      return outcome.result === \"ended\" ? { result: \"ended\" } : outcome;\n    },\n  };\n  engines.set(session, {\n    token,\n    isDemo: () => options.isDemo(),\n    isSignedOutStep: options.isSignedOutStep ?? isSignedOutStep,\n    join,\n    end(endedToken, demo) {\n      if (ended && ended.token === endedToken) return;\n      ended = { token: endedToken };\n      options.onEnded({ demo });\n    },\n  });\n  return session;\n}\n\n// ── axios ─────────────────────────────────────────────────────────────────────\n\n/** The config fields the kit reads and writes — what axios's request config has. */\ninterface SessionRefreshAxiosConfig extends ServerWakeAxiosConfig {\n  /** axios's `AxiosHeaders` (written through its `set`), or a plain record. */\n  headers?: unknown;\n}\n\n/** An axios instance, structurally: {@link AxiosLikeInstance}, plus `request(config)` for\n *  the replay. `axios.create()`'s result fits it as is. `NoInfer`, because axios's\n *  `request` takes the WIDER `AxiosRequestConfig`: inferred from there, the config type\n *  no longer fits the interceptors, which hand out `InternalAxiosRequestConfig`. */\ninterface SessionRefreshInstance<\n  C extends SessionRefreshAxiosConfig,\n  R extends { config: C },\n> extends AxiosLikeInstance<C, R> {\n  request(config: NoInfer<C>): Promise<unknown>;\n}\n\n/** The keys the kit keeps on a request's config, as `attachServerWake` keeps\n *  `_serverWake`: never a header. Plain string keys holding primitives, because axios\n *  copies the config on a replay (`mergeConfig`) and a symbol key would be dropped. */\nconst STAMP = \"_sessionStamp\";\nconst REFRESHED = \"_sessionRefreshed\";\nconst RESTAMPED = \"_sessionRestamped\";\ntype Marked = {\n  /** `currentToken()` when the request went out. */\n  [STAMP]?: string | null;\n  /** Replayed after a refresh: a 401 now is definitive (decision 3). */\n  [REFRESHED]?: boolean;\n  /** Replayed because it was sent with an older token: once for this reason. */\n  [RESTAMPED]?: boolean;\n};\n\n/** `Authorization: Bearer <token>` on a config about to be replayed. The app's own\n *  request interceptor runs again on the replay and writes the same, from the same\n *  source. */\nfunction authorize(config: SessionRefreshAxiosConfig, token: string): void {\n  const value = `Bearer ${token}`;\n  const headers = config.headers;\n  if (typeof headers !== \"object\" || headers === null) {\n    config.headers = { Authorization: value };\n  } else if (typeof (headers as { set?: unknown }).set === \"function\") {\n    (headers as { set(name: string, value: string): unknown }).set(\"Authorization\", value);\n  } else {\n    (headers as Record<string, unknown>).Authorization = value;\n  }\n}\n\n/**\n * Hook a session to an axios instance: `attachSessionRefresh(api, session)`. Adds a\n * request interceptor (the stamp) and a response interceptor (the 401), and returns a\n * function that ejects both.\n *\n * Attach it LAST (§11.3, kk 4): after `attachServerWake`, which asks to be first, and\n * after the app's own response interceptors (logging, a watchdog of its own). axios runs\n * response interceptors in the order they were added, and each of those must see the 401\n * settle before the refresh is awaited. The request side's order does not matter.\n *\n * On a 401, in this order (§11.3):\n *\n *  1. a signed-out step → reject, nothing else;\n *  2. sent with an older token → replayed with the app's token now, with no refresh, once\n *     for this reason; with no token now, reject;\n *  3. a demo → `onEnded({ demo: true })`, reject;\n *  4. already replayed after a refresh → definitive: `onEnded({ demo: false })`, reject;\n *  5. otherwise it joins the flight, or starts it. A renewal replays it once with the\n *     renewal's token (`replay: false`: rejects, unmarked); definitive ends the session;\n *     transient rejects, marked; a session that changed meanwhile sends it through step\n *     2 again.\n *\n * Every rejection is the request's OWN error. Any other status passes through untouched.\n */\nexport function attachSessionRefresh<C extends SessionRefreshAxiosConfig, R extends { config: C }>(\n  instance: SessionRefreshInstance<C, R>,\n  session: SessionRefresh<SessionRenewal>,\n): () => void {\n  const engine = engines.get(session);\n  if (!engine) throw new TypeError(\"attachSessionRefresh takes the session createSessionRefresh made\");\n\n  const onUnauthorized = async (error: object, config: C & Marked): Promise<unknown> => {\n    if (engine.isSignedOutStep(config.url ?? \"\")) throw error;\n    // A config the kit never stamped (sent before it was attached) counts as current.\n    const stamp = config[STAMP] === undefined ? engine.token() : config[STAMP];\n    const replay = (token: string) => {\n      authorize(config, token);\n      return instance.request(config);\n    };\n    for (;;) {\n      const now = engine.token();\n      // 2. The session it was sent for is gone, and whatever ended it has already done\n      // what follows (ka 3, KS 3, KS 4).\n      if (stamp !== now) {\n        if (now === null || config[RESTAMPED]) throw error;\n        config[RESTAMPED] = true;\n        return replay(now);\n      }\n      // 3. A demo has nothing to refresh: its token lives as long as its account\n      // (landing-demo §5.5).\n      if (engine.isDemo()) {\n        engine.end(now, true);\n        throw error;\n      }\n      // 4. A replay for an older token doesn't count here: the app's current token may\n      // simply have expired too, which needs a refresh, not a sign-out.\n      if (config[REFRESHED]) {\n        engine.end(now, false);\n        throw error;\n      }\n      // 5. The flight.\n      const flight = await engine.join();\n      if (flight.result === \"changed\") continue;\n      if (flight.result === \"ended\") {\n        engine.end(flight.token, false);\n        throw error;\n      }\n      if (flight.result === \"transient\") {\n        (error as Record<symbol, unknown>)[TRANSIENT] = true;\n        throw error;\n      }\n      if (flight.renewal.replay === false) throw error;\n      config[REFRESHED] = true;\n      return replay(flight.renewal.token);\n    }\n  };\n\n  const request = instance.interceptors.request.use(\n    (config) => {\n      (config as C & Marked)[STAMP] = engine.token();\n      return config;\n    },\n    (error) => Promise.reject(error),\n  );\n  const response = instance.interceptors.response.use(\n    (res) => res,\n    (error) => {\n      const failed = error as { config?: C & Marked; response?: { status?: unknown } } | null;\n      if (failed?.response?.status !== 401 || !failed.config) return Promise.reject(error);\n      return onUnauthorized(failed, failed.config);\n    },\n  );\n  return () => {\n    instance.interceptors.request.eject(request);\n    instance.interceptors.response.eject(response);\n  };\n}\n"],"mappings":";AAsCA,SAAS,oBAAoB;AAgG7B,MAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAaO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,OAAO,IAAI,QAAQ,YAAY,EAAE,EAAE,QAAQ,mCAAmC,EAAE;AACtF,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,QAAM,KAAK,SAAS,QAAQ,MAAM;AAClC,MAAI,KAAK,EAAG,QAAO;AACnB,QAAM,OAAO,SAAS,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAC5C,SAAO,iBAAiB,KAAK,CAAC,UAAU,SAAS,SAAS,KAAK,WAAW,GAAG,KAAK,GAAG,CAAC;AACxF;AAOA,MAAM,YAAY,uBAAO,IAAI,yCAAyC;AAc/D,SAAS,0BAA0B,OAAyB;AACjE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,MAAkC,SAAS,MAAM;AAC1G;AAwBA,MAAM,UAAU,oBAAI,QAAgD;AAGpE,MAAM,YAAY,uBAAO,WAAW;AAEpC,SAAS,YAAqB;AAC5B,SAAO,OAAO,cAAc,eAAe,UAAU,WAAW;AAClE;AAIA,SAAS,SAAS,OAAsD;AACtE,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,WAAW,QAAW;AAGxB,WAAQ,MAAqC,iBAAiB,OAAO,UAAU;AAAA,EACjF;AACA,MAAI,WAAW,OAAO,WAAW,IAAK,QAAO;AAC7C,MAAI,WAAW,OAAO,WAAW,OAAO,UAAU,IAAK,QAAO;AAC9D,SAAO;AACT;AAEA,MAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAM7E,SAAS,qBAA+C,SAAsD;AACnH,QAAM,EAAE,WAAW,GAAG,YAAY,CAAC,KAAM,GAAI,GAAG,YAAY,KAAO,IAAI;AAGvE,QAAM,QAAQ,MAAM,QAAQ,aAAa,KAAK;AAI9C,QAAM,UAAU,YAAiC;AAC/C,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI;AACJ,UAAM,UAAU,IAAI,QAAe,CAAC,GAAG,WAAW;AAChD,cAAQ,WAAW,MAAM;AACvB,eAAO,SAAS;AAChB,mBAAW,MAAM;AAAA,MACnB,GAAG,SAAS;AAAA,IACd,CAAC;AACD,QAAI;AAGF,YAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,QAAQ,WAAW,MAAM,CAAC,GAAG,OAAO,CAAC;AAC9G,aAAO,UAAU,EAAE,QAAQ,IAAI;AAAA,IACjC,SAAS,OAAO;AACd,aAAO,SAAS,KAAK;AAAA,IACvB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,MAAM,YAAgC;AAE1C,UAAM,QAAQ,MAAM;AACpB,UAAM,UAAU,MAAM,MAAM,MAAM;AAClC,QAAI,UAAU,MAAM,QAAQ;AAC5B,aAAS,OAAO,GAAG,YAAY,SAAS,QAAQ,GAAG;AAGjD,UAAI,QAAQ,YAAY,UAAU,KAAK,QAAQ,EAAG;AAClD,YAAM,MAAM,UAAU,OAAO,CAAC,KAAK,UAAU,UAAU,SAAS,CAAC,KAAK,CAAC;AACvE,UAAI,UAAU,KAAK,QAAQ,EAAG;AAC9B,gBAAU,MAAM,QAAQ;AAAA,IAC1B;AAGA,QAAI,QAAQ,EAAG,QAAO,EAAE,QAAQ,UAAU;AAC1C,QAAI,YAAY,aAAc,QAAO,EAAE,QAAQ,SAAS,OAAO,MAAM;AACrE,QAAI,YAAY,WAAW,YAAY,YAAa,QAAO,EAAE,QAAQ,YAAY;AACjF,YAAQ,MAAM,QAAQ,OAAO;AAC7B,WAAO,EAAE,QAAQ,WAAW,SAAS,QAAQ,QAAQ;AAAA,EACvD;AAEA,MAAI,SAAoC;AACxC,QAAM,OAAO,MAAM;AAGjB,eAAW,IAAI,EAAE,QAAQ,MAAM;AAC7B,eAAS;AAAA,IACX,CAAC;AACD,WAAO;AAAA,EACT;AAGA,MAAI;AAEJ,QAAM,UAA6B;AAAA,IACjC,MAAM,UAAU;AACd,YAAM,UAAU,MAAM,KAAK;AAC3B,aAAO,QAAQ,WAAW,UAAU,EAAE,QAAQ,QAAQ,IAAI;AAAA,IAC5D;AAAA,EACF;AACA,UAAQ,IAAI,SAAS;AAAA,IACnB;AAAA,IACA,QAAQ,MAAM,QAAQ,OAAO;AAAA,IAC7B,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C;AAAA,IACA,IAAI,YAAY,MAAM;AACpB,UAAI,SAAS,MAAM,UAAU,WAAY;AACzC,cAAQ,EAAE,OAAO,WAAW;AAC5B,cAAQ,QAAQ,EAAE,KAAK,CAAC;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAwBA,MAAM,QAAQ;AACd,MAAM,YAAY;AAClB,MAAM,YAAY;AAalB,SAAS,UAAU,QAAmC,OAAqB;AACzE,QAAM,QAAQ,UAAU,KAAK;AAC7B,QAAM,UAAU,OAAO;AACvB,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,UAAU,EAAE,eAAe,MAAM;AAAA,EAC1C,WAAW,OAAQ,QAA8B,QAAQ,YAAY;AACnE,IAAC,QAA0D,IAAI,iBAAiB,KAAK;AAAA,EACvF,OAAO;AACL,IAAC,QAAoC,gBAAgB;AAAA,EACvD;AACF;AA0BO,SAAS,qBACd,UACA,SACY;AACZ,QAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,MAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,kEAAkE;AAEnG,QAAM,iBAAiB,OAAO,OAAe,WAAyC;AACpF,QAAI,OAAO,gBAAgB,OAAO,OAAO,EAAE,EAAG,OAAM;AAEpD,UAAM,QAAQ,OAAO,KAAK,MAAM,SAAY,OAAO,MAAM,IAAI,OAAO,KAAK;AACzE,UAAM,SAAS,CAAC,UAAkB;AAChC,gBAAU,QAAQ,KAAK;AACvB,aAAO,SAAS,QAAQ,MAAM;AAAA,IAChC;AACA,eAAS;AACP,YAAM,MAAM,OAAO,MAAM;AAGzB,UAAI,UAAU,KAAK;AACjB,YAAI,QAAQ,QAAQ,OAAO,SAAS,EAAG,OAAM;AAC7C,eAAO,SAAS,IAAI;AACpB,eAAO,OAAO,GAAG;AAAA,MACnB;AAGA,UAAI,OAAO,OAAO,GAAG;AACnB,eAAO,IAAI,KAAK,IAAI;AACpB,cAAM;AAAA,MACR;AAGA,UAAI,OAAO,SAAS,GAAG;AACrB,eAAO,IAAI,KAAK,KAAK;AACrB,cAAM;AAAA,MACR;AAEA,YAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAI,OAAO,WAAW,UAAW;AACjC,UAAI,OAAO,WAAW,SAAS;AAC7B,eAAO,IAAI,OAAO,OAAO,KAAK;AAC9B,cAAM;AAAA,MACR;AACA,UAAI,OAAO,WAAW,aAAa;AACjC,QAAC,MAAkC,SAAS,IAAI;AAChD,cAAM;AAAA,MACR;AACA,UAAI,OAAO,QAAQ,WAAW,MAAO,OAAM;AAC3C,aAAO,SAAS,IAAI;AACpB,aAAO,OAAO,OAAO,QAAQ,KAAK;AAAA,IACpC;AAAA,EACF;AAEA,QAAM,UAAU,SAAS,aAAa,QAAQ;AAAA,IAC5C,CAAC,WAAW;AACV,MAAC,OAAsB,KAAK,IAAI,OAAO,MAAM;AAC7C,aAAO;AAAA,IACT;AAAA,IACA,CAAC,UAAU,QAAQ,OAAO,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,SAAS,aAAa,SAAS;AAAA,IAC9C,CAAC,QAAQ;AAAA,IACT,CAAC,UAAU;AACT,YAAM,SAAS;AACf,UAAI,QAAQ,UAAU,WAAW,OAAO,CAAC,OAAO,OAAQ,QAAO,QAAQ,OAAO,KAAK;AACnF,aAAO,eAAe,QAAQ,OAAO,MAAM;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACX,aAAS,aAAa,QAAQ,MAAM,OAAO;AAC3C,aAAS,aAAa,SAAS,MAAM,QAAQ;AAAA,EAC/C;AACF;","names":[]}
+{"version":3,"sources":["../../src/lib/session-refresh.ts"],"sourcesContent":["/**\n * Renewing a session when the access token runs out: the client half of\n * docs/auth-harmonization.md §11 (round 0.34 C7, KS U6), lifted from keksdose's\n * `refreshOnce` (Kurvenschmiede's is the same, line for line) and corrected where the\n * three apps' reviews found it wrong. It ends kastlan's sign-out over a network blip (B3).\n *\n * THE KIT OWNS THE RULE, THE APP OWNS THE CALL (§11.2, decision 1). The kit decides when\n * to refresh, who waits, what a failure means, when the session is over and whether a\n * renewal may still be stored. The app keeps its endpoint, its token storage, its\n * sign-out and where it navigates, and hands them in as {@link SessionRefreshOptions}.\n *\n *  - **One flight per tab** (decision 2): every 401 that arrives while a refresh runs\n *    waits for it, and so does `session.refresh()` (kastlan's boot).\n *  - **Definitive** (decision 3): the device holds no refresh token (`refresh` resolves\n *    `null`), the refresh answers 401 or 403, or the request replayed with the fresh\n *    token gets a 401 again. Only then does the app sign out (`onEnded`), and only while\n *    that session is still the app's.\n *  - **Transient** (decision 4): everything else. The session stays: nothing is signed\n *    out, stored or redirected, and the kit shows nothing. The request rejects with its\n *    OWN 401, marked ({@link isTransientRefreshFailure}), so the app's message can say\n *    \"can't reach the server\" instead of \"not signed in\".\n *  - **Retries only where waiting helps** (decision 5, KS 7): no answer, the kit's own\n *    timeout, 408, 429 and 5xx get up to three attempts, 1 s and then 3 s apart, each cut\n *    off after 15 s; none while the browser reports itself offline. Any other answer, and\n *    anything that is not an HTTP error, ends the flight at the first attempt.\n *  - **A stale session is never written back** (§11.7, ka 3, KS 3, KS 4): every request\n *    is stamped with `currentToken()` when it goes out, and every flight notes it when it\n *    starts. A 401 to a request sent with an older token replays it with the app's token\n *    now, without a refresh; a flight whose session changed while it ran stores nothing\n *    and ends nothing. The access token is the session's identity because every change\n *    the apps make replaces it — a refresh, another tab, a company switch, a password\n *    change, a sign-in, a demo start, a sign-out.\n *\n * Framework-free like `server-wake.ts`: {@link attachSessionRefresh} takes the app's\n * axios instance as an ARGUMENT, typed structurally, so the kit never imports axios.\n */\n\nimport type { AxiosLikeInstance, ServerWakeAxiosConfig } from \"./server-wake\";\nimport { httpStatusOf } from \"./http-status\";\n\n/** What the app's `refresh` resolves: the new access token, plus whatever its `store`\n *  needs (its refresh token, the user). */\nexport interface SessionRenewal {\n  /** The new access token; the waiting requests are replayed with it. */\n  token: string;\n  /**\n   * `false`: store the renewal, but replay nothing — each waiting request rejects with\n   * its 401, unmarked. kastlan's refresh can land in another company (§11.5, ka 3): a\n   * waiting write, such as the handover's `POST /sync`, must not be replayed into it.\n   */\n  replay?: false;\n}\n\n/** What the app hands {@link createSessionRefresh} (§11.4). */\nexport interface SessionRefreshOptions<R extends SessionRenewal> {\n  /**\n   * The app's own `POST /auth/refresh`, on a BARE client — never the instance the kit is\n   * attached to, so the refresh cannot re-enter the interceptor. It **writes nothing**:\n   * the kit hands the answer to `store`, and only while the session is unchanged.\n   *\n   * Resolves the answer as a renewal, or `null` when the device holds no refresh token.\n   * Throws on failure, and the kit classifies the throw: a 401 or 403 is definitive; no\n   * answer (an axios error without a `response`), the kit's own timeout, 408, 429 and\n   * 5xx are transient and retried; any other answer, and anything that is not an HTTP\n   * error (a bug in this function), is transient and not retried. The status is read\n   * from `err.response.status` (axios), `err.status` or `err.statusCode`.\n   *\n   * `signal` aborts when the attempt runs past `timeoutMs`; pass it to the request.\n   */\n  refresh: (signal: AbortSignal) => Promise<R | null>;\n  /** Writes the renewal: the tokens and the user (a missing refresh token keeps the\n   *  stored one). Called only while the session the flight renews is still the app's,\n   *  and before the waiting requests are replayed — so it writes the token SYNCHRONOUSLY\n   *  where `currentToken` reads it: the replay goes through the app's own request\n   *  interceptor again, and is stamped then. A throw is the app's bug: the waiting\n   *  requests and `session.refresh()` reject with it. */\n  store: (renewal: R) => void;\n  /** The access token the app sends NOW, read where its request interceptor reads it;\n   *  `null` when there is none. */\n  currentToken: () => string | null;\n  /** Whether the session is a demo: a demo's 401 ends it, with no refresh tried\n   *  (landing-demo §5.5). */\n  isDemo: () => boolean;\n  /**\n   * The session is over: drop the tokens and the user, then navigate — `/demo/ended` for\n   * a demo, else the sign-in with the page it came from (auth §5.2). Called once per\n   * session, however many requests found out (KS 8), and never by `session.refresh()`.\n   */\n  onEnded: (ended: { demo: boolean }) => void;\n  /** Whether a URL is a signed-out step, whose 401 judges the form and never the\n   *  session. Replaces the default list, {@link isSignedOutStep}. */\n  isSignedOutStep?: (url: string) => boolean;\n  /** Attempts for a refresh that got no answer, timed out, or got a 408, 429 or 5xx.\n   *  Default 3. */\n  attempts?: number;\n  /** The waits before the second and later attempts; the last one repeats. Default\n   *  `[1000, 3000]`. */\n  backoffMs?: readonly number[];\n  /** Each attempt is cut off after this, and its `signal` aborted. Default 15 000. */\n  timeoutMs?: number;\n}\n\n/** What `session.refresh()` resolves (§11.4), by `result`:\n *\n * | `result` | When | What the kit has done |\n * |---|---|---|\n * | `\"renewed\"` | a renewal while the session was unchanged | `store(renewal)` |\n * | `\"ended\"` | definitive | nothing; `onEnded` only for requests that waited on the same flight |\n * | `\"transient\"` | transient | nothing |\n * | `\"changed\"` | the session changed while it ran | nothing; read the app's own state |\n */\nexport type SessionRefreshOutcome<R extends SessionRenewal = SessionRenewal> =\n  { result: \"renewed\"; renewal: R } | { result: \"ended\" } | { result: \"transient\" } | { result: \"changed\" };\n\n/** The flight {@link createSessionRefresh} makes; {@link attachSessionRefresh} hooks it\n *  to an axios instance. */\nexport interface SessionRefresh<R extends SessionRenewal = SessionRenewal> {\n  /**\n   * The same flight, for a caller outside the interceptor — kastlan's boot. Joins a\n   * running flight, or starts one. Never calls `onEnded`: the caller decides what an\n   * `\"ended\"` means for it.\n   */\n  refresh(): Promise<SessionRefreshOutcome<R>>;\n}\n\n// ── The signed-out steps ──────────────────────────────────────────────────────\n\n/**\n * Every `/auth/` call made without a session, the union of the three apps' lists\n * (§11.3): signing in (with its `2fa` and `set-password` steps, and a passkey's), up,\n * into a demo, a password reset, the verification link, the invitation check, the email\n * change's confirmation link, and the refresh itself. NOT `resend-verification` (KS 1):\n * in keksdose and Kurvenschmiede it needs a session; in kastlan it never answers 401.\n */\nconst SIGNED_OUT_STEPS = [\n  \"login\",\n  \"passkey/login\",\n  \"register\",\n  \"demo-session\",\n  \"password-reset\",\n  \"verify-email\",\n  \"invitations/check\",\n  \"me/email/confirm\",\n  \"refresh\",\n] as const;\n\n/**\n * Whether a request's URL is a signed-out step — the kit's default list (§11.3), exported\n * for an app's tests and for an app's own `isSignedOutStep` that adds to it.\n *\n * **Whole steps only** (KS 2): the part of the path after its `auth/` segment, without\n * the query string, is the entry itself or starts with the entry and a `/`. So\n * `login/2fa` is `login`'s, but `register` never catches `/auth/passkey/register/begin`\n * (adding a passkey, which needs a session), `invitations/check` never\n * `/auth/invitations/accept`, and `me/email/confirm` never `/auth/me/email`. Relative and\n * absolute URLs alike; a URL with no `auth` segment is no step.\n */\nexport function isSignedOutStep(url: string): boolean {\n  const path = url.replace(/[?#].*$/s, \"\").replace(/^([a-z][a-z\\d+.-]*:)?\\/\\/[^/]*/i, \"\");\n  const segments = path.split(\"/\");\n  const at = segments.indexOf(\"auth\");\n  if (at < 0) return false;\n  const step = segments.slice(at + 1).join(\"/\");\n  return SIGNED_OUT_STEPS.some((entry) => step === entry || step.startsWith(`${entry}/`));\n}\n\n// ── The marker ────────────────────────────────────────────────────────────────\n\n/** On the request's own axios error, after a transient failure (decision 8). A\n *  `Symbol.for` key: shared by every copy of the kit in a page, and left out of\n *  `JSON.stringify`, so a log that serialises the error doesn't print it (kk 2). */\nconst TRANSIENT = Symbol.for(\"@eifi1/ui-kit:session-refresh.transient\");\n\n/**\n * Whether a request was refused because the refresh behind it failed TRANSIENTLY —\n * offline, a timeout, a 5xx — and not because the session is over (decision 8). The\n * error is the request's own 401, `err.response?.status` and every check an app already\n * has keep working; this reads the mark the kit put on it, so the app's message can say\n * \"can't reach the server\" instead of \"not signed in\". Read it FIRST: keksdose's sync\n * chip, kastlan's handover sync and Kurvenschmiede's `apiErrorMessage` count it as\n * offline (§11.5).\n *\n * Not the refresh's own error: its config carries the refresh token in its body, into any\n * log or crash report that keeps the error.\n */\nexport function isTransientRefreshFailure(error: unknown): boolean {\n  return typeof error === \"object\" && error !== null && (error as Record<symbol, unknown>)[TRANSIENT] === true;\n}\n\n// ── The flight ────────────────────────────────────────────────────────────────\n\n/** A flight's result, as the interceptor needs it: `\"ended\"` keeps the session it ended. */\ntype Flight<R extends SessionRenewal> =\n  | { result: \"renewed\"; renewal: R }\n  | { result: \"ended\"; token: string | null }\n  | { result: \"transient\" }\n  | { result: \"changed\" };\n\n/** What one attempt came to. */\ntype Attempt<R> = { renewal: R } | \"definitive\" | \"retry\" | \"transient\";\n\n/** What {@link attachSessionRefresh} needs of a session. Kept off the public interface:\n *  only what {@link createSessionRefresh} made can be attached. */\ninterface Engine {\n  token(): string | null;\n  isDemo(): boolean;\n  isSignedOutStep(url: string): boolean;\n  join(): Promise<Flight<SessionRenewal>>;\n  end(token: string | null, demo: boolean): void;\n}\n\nconst engines = new WeakMap<SessionRefresh<SessionRenewal>, Engine>();\n\n/** The kit's own timeout, told apart from anything the app's `refresh` throws. */\nconst TIMED_OUT = Symbol(\"timed out\");\n\nfunction isOffline(): boolean {\n  return typeof navigator !== \"undefined\" && navigator.onLine === false;\n}\n\n/** A refresh's throw, classified (§11.4). The status is read where `isRateLimited` reads\n *  it — `httpStatusOf`, one probe for axios, ofetch and Node errors (DUP-11). */\nfunction classify(error: unknown): \"definitive\" | \"retry\" | \"transient\" {\n  if (error === TIMED_OUT) return \"retry\";\n  if (typeof error !== \"object\" || error === null) return \"transient\";\n  const status = httpStatusOf(error);\n  if (status === undefined) {\n    // No answer: axios marks its own errors, and one without a response never reached a\n    // server (offline, DNS, CORS, its own timeout). Anything else is a bug in `refresh`.\n    return (error as { isAxiosError?: unknown }).isAxiosError === true ? \"retry\" : \"transient\";\n  }\n  if (status === 401 || status === 403) return \"definitive\";\n  if (status === 408 || status === 429 || status >= 500) return \"retry\";\n  return \"transient\";\n}\n\nconst sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));\n\n/**\n * Make the flight: `const session = createSessionRefresh({ refresh, store, currentToken,\n * isDemo, onEnded })`, then {@link attachSessionRefresh}`(api, session)`. One per tab.\n */\nexport function createSessionRefresh<R extends SessionRenewal>(options: SessionRefreshOptions<R>): SessionRefresh<R> {\n  const { attempts = 3, backoffMs = [1000, 3000], timeoutMs = 15_000 } = options;\n  // An empty string is no token: the stamp and the flight compare tokens, and \"\" against\n  // `null` must not read as a change of session.\n  const token = () => options.currentToken() || null;\n\n  /** One call of the app's `refresh`, cut off after `timeoutMs` even if it ignores the\n   *  signal. */\n  const attempt = async (): Promise<Attempt<R>> => {\n    const controller = new AbortController();\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const timeout = new Promise<never>((_, reject) => {\n      timer = setTimeout(() => {\n        reject(TIMED_OUT);\n        controller.abort();\n      }, timeoutMs);\n    });\n    try {\n      // Through `then`, so a `refresh` that throws before it returns a promise is\n      // classified like one that rejects.\n      const renewal = await Promise.race([Promise.resolve().then(() => options.refresh(controller.signal)), timeout]);\n      return renewal ? { renewal } : \"definitive\";\n    } catch (error) {\n      return classify(error);\n    } finally {\n      clearTimeout(timer);\n    }\n  };\n\n  const run = async (): Promise<Flight<R>> => {\n    // The session this flight renews (§11.3 step 5).\n    const noted = token();\n    const changed = () => token() !== noted;\n    let outcome = await attempt();\n    for (let made = 1; outcome === \"retry\"; made += 1) {\n      // No further attempt while the browser says it is offline, nor for a session that\n      // is no longer the app's: whatever the answer, it would be \"changed\".\n      if (made >= attempts || isOffline() || changed()) break;\n      await sleep(backoffMs[made - 1] ?? backoffMs[backoffMs.length - 1] ?? 0);\n      if (isOffline() || changed()) break;\n      outcome = await attempt();\n    }\n    // A late answer never writes the old session back over a sign-out, a demo start or a\n    // password change, and the old session's refusal never signs anyone out (KS 3).\n    if (changed()) return { result: \"changed\" };\n    if (outcome === \"definitive\") return { result: \"ended\", token: noted };\n    if (outcome === \"retry\" || outcome === \"transient\") return { result: \"transient\" };\n    options.store(outcome.renewal);\n    return { result: \"renewed\", renewal: outcome.renewal };\n  };\n\n  let flight: Promise<Flight<R>> | null = null;\n  const join = () => {\n    // Cleared before any waiter resumes (`finally` settles first), so a waiter that\n    // needs another flight starts a new one.\n    flight ??= run().finally(() => {\n      flight = null;\n    });\n    return flight;\n  };\n\n  /** The session `onEnded` was last called for: once per session (KS 8). */\n  let ended: { token: string | null } | undefined;\n\n  const session: SessionRefresh<R> = {\n    async refresh() {\n      const outcome = await join();\n      return outcome.result === \"ended\" ? { result: \"ended\" } : outcome;\n    },\n  };\n  engines.set(session, {\n    token,\n    isDemo: () => options.isDemo(),\n    isSignedOutStep: options.isSignedOutStep ?? isSignedOutStep,\n    join,\n    end(endedToken, demo) {\n      if (ended && ended.token === endedToken) return;\n      ended = { token: endedToken };\n      options.onEnded({ demo });\n    },\n  });\n  return session;\n}\n\n// ── axios ─────────────────────────────────────────────────────────────────────\n\n/** The config fields the kit reads and writes — what axios's request config has. */\ninterface SessionRefreshAxiosConfig extends ServerWakeAxiosConfig {\n  /** axios's `AxiosHeaders` (written through its `set`), or a plain record. */\n  headers?: unknown;\n}\n\n/** An axios instance, structurally: {@link AxiosLikeInstance}, plus `request(config)` for\n *  the replay. `axios.create()`'s result fits it as is. `NoInfer`, because axios's\n *  `request` takes the WIDER `AxiosRequestConfig`: inferred from there, the config type\n *  no longer fits the interceptors, which hand out `InternalAxiosRequestConfig`. */\ninterface SessionRefreshInstance<\n  C extends SessionRefreshAxiosConfig,\n  R extends { config: C },\n> extends AxiosLikeInstance<C, R> {\n  request(config: NoInfer<C>): Promise<unknown>;\n}\n\n/** The keys the kit keeps on a request's config, as `attachServerWake` keeps\n *  `_serverWake`: never a header. Plain string keys holding primitives, because axios\n *  copies the config on a replay (`mergeConfig`) and a symbol key would be dropped. */\nconst STAMP = \"_sessionStamp\";\nconst REFRESHED = \"_sessionRefreshed\";\nconst RESTAMPED = \"_sessionRestamped\";\ntype Marked = {\n  /** `currentToken()` when the request went out. */\n  [STAMP]?: string | null;\n  /** Replayed after a refresh: a 401 now is definitive (decision 3). */\n  [REFRESHED]?: boolean;\n  /** Replayed because it was sent with an older token: once for this reason. */\n  [RESTAMPED]?: boolean;\n};\n\n/** `Authorization: Bearer <token>` on a config about to be replayed. The app's own\n *  request interceptor runs again on the replay and writes the same, from the same\n *  source. */\nfunction authorize(config: SessionRefreshAxiosConfig, token: string): void {\n  const value = `Bearer ${token}`;\n  const headers = config.headers;\n  if (typeof headers !== \"object\" || headers === null) {\n    config.headers = { Authorization: value };\n  } else if (typeof (headers as { set?: unknown }).set === \"function\") {\n    (headers as { set(name: string, value: string): unknown }).set(\"Authorization\", value);\n  } else {\n    (headers as Record<string, unknown>).Authorization = value;\n  }\n}\n\n/**\n * Hook a session to an axios instance: `attachSessionRefresh(api, session)`. Adds a\n * request interceptor (the stamp) and a response interceptor (the 401), and returns a\n * function that ejects both.\n *\n * Attach it LAST (§11.3, kk 4): after `attachServerWake`, which asks to be first, and\n * after the app's own response interceptors (logging, a watchdog of its own). axios runs\n * response interceptors in the order they were added, and each of those must see the 401\n * settle before the refresh is awaited. The request side's order does not matter.\n *\n * On a 401, in this order (§11.3):\n *\n *  1. a signed-out step → reject, nothing else;\n *  2. sent with an older token → replayed with the app's token now, with no refresh, once\n *     for this reason; with no token now, reject;\n *  3. a demo → `onEnded({ demo: true })`, reject;\n *  4. already replayed after a refresh → definitive: `onEnded({ demo: false })`, reject;\n *  5. otherwise it joins the flight, or starts it. A renewal replays it once with the\n *     renewal's token (`replay: false`: rejects, unmarked); definitive ends the session;\n *     transient rejects, marked; a session that changed meanwhile sends it through step\n *     2 again.\n *\n * Every rejection is the request's OWN error. Any other status passes through untouched.\n */\nexport function attachSessionRefresh<C extends SessionRefreshAxiosConfig, R extends { config: C }>(\n  instance: SessionRefreshInstance<C, R>,\n  session: SessionRefresh<SessionRenewal>,\n): () => void {\n  const engine = engines.get(session);\n  if (!engine) throw new TypeError(\"attachSessionRefresh takes the session createSessionRefresh made\");\n\n  const onUnauthorized = async (error: object, config: C & Marked): Promise<unknown> => {\n    if (engine.isSignedOutStep(config.url ?? \"\")) throw error;\n    // A config the kit never stamped (sent before it was attached) counts as current.\n    const stamp = config[STAMP] === undefined ? engine.token() : config[STAMP];\n    const replay = (token: string) => {\n      authorize(config, token);\n      return instance.request(config);\n    };\n    for (;;) {\n      const now = engine.token();\n      // 2. The session it was sent for is gone, and whatever ended it has already done\n      // what follows (ka 3, KS 3, KS 4).\n      if (stamp !== now) {\n        if (now === null || config[RESTAMPED]) throw error;\n        config[RESTAMPED] = true;\n        return replay(now);\n      }\n      // 3. A demo has nothing to refresh: its token lives as long as its account\n      // (landing-demo §5.5).\n      if (engine.isDemo()) {\n        engine.end(now, true);\n        throw error;\n      }\n      // 4. A replay for an older token doesn't count here: the app's current token may\n      // simply have expired too, which needs a refresh, not a sign-out.\n      if (config[REFRESHED]) {\n        engine.end(now, false);\n        throw error;\n      }\n      // 5. The flight.\n      const flight = await engine.join();\n      if (flight.result === \"changed\") continue;\n      if (flight.result === \"ended\") {\n        engine.end(flight.token, false);\n        throw error;\n      }\n      if (flight.result === \"transient\") {\n        (error as Record<symbol, unknown>)[TRANSIENT] = true;\n        throw error;\n      }\n      if (flight.renewal.replay === false) throw error;\n      config[REFRESHED] = true;\n      return replay(flight.renewal.token);\n    }\n  };\n\n  const request = instance.interceptors.request.use(\n    (config) => {\n      (config as C & Marked)[STAMP] = engine.token();\n      return config;\n    },\n    (error) => Promise.reject(error),\n  );\n  const response = instance.interceptors.response.use(\n    (res) => res,\n    (error) => {\n      const failed = error as { config?: C & Marked; response?: { status?: unknown } } | null;\n      if (failed?.response?.status !== 401 || !failed.config) return Promise.reject(error);\n      return onUnauthorized(failed, failed.config);\n    },\n  );\n  return () => {\n    instance.interceptors.request.eject(request);\n    instance.interceptors.response.eject(response);\n  };\n}\n"],"mappings":";AAsCA,SAAS,oBAAoB;AAgG7B,MAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAaO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,OAAO,IAAI,QAAQ,YAAY,EAAE,EAAE,QAAQ,mCAAmC,EAAE;AACtF,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,QAAM,KAAK,SAAS,QAAQ,MAAM;AAClC,MAAI,KAAK,EAAG,QAAO;AACnB,QAAM,OAAO,SAAS,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAC5C,SAAO,iBAAiB,KAAK,CAAC,UAAU,SAAS,SAAS,KAAK,WAAW,GAAG,KAAK,GAAG,CAAC;AACxF;AAOA,MAAM,YAAY,uBAAO,IAAI,yCAAyC;AAc/D,SAAS,0BAA0B,OAAyB;AACjE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,MAAkC,SAAS,MAAM;AAC1G;AAwBA,MAAM,UAAU,oBAAI,QAAgD;AAGpE,MAAM,YAAY,uBAAO,WAAW;AAEpC,SAAS,YAAqB;AAC5B,SAAO,OAAO,cAAc,eAAe,UAAU,WAAW;AAClE;AAIA,SAAS,SAAS,OAAsD;AACtE,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,WAAW,QAAW;AAGxB,WAAQ,MAAqC,iBAAiB,OAAO,UAAU;AAAA,EACjF;AACA,MAAI,WAAW,OAAO,WAAW,IAAK,QAAO;AAC7C,MAAI,WAAW,OAAO,WAAW,OAAO,UAAU,IAAK,QAAO;AAC9D,SAAO;AACT;AAEA,MAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAM7E,SAAS,qBAA+C,SAAsD;AACnH,QAAM,EAAE,WAAW,GAAG,YAAY,CAAC,KAAM,GAAI,GAAG,YAAY,KAAO,IAAI;AAGvE,QAAM,QAAQ,MAAM,QAAQ,aAAa,KAAK;AAI9C,QAAM,UAAU,YAAiC;AAC/C,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI;AACJ,UAAM,UAAU,IAAI,QAAe,CAAC,GAAG,WAAW;AAChD,cAAQ,WAAW,MAAM;AACvB,eAAO,SAAS;AAChB,mBAAW,MAAM;AAAA,MACnB,GAAG,SAAS;AAAA,IACd,CAAC;AACD,QAAI;AAGF,YAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,QAAQ,WAAW,MAAM,CAAC,GAAG,OAAO,CAAC;AAC9G,aAAO,UAAU,EAAE,QAAQ,IAAI;AAAA,IACjC,SAAS,OAAO;AACd,aAAO,SAAS,KAAK;AAAA,IACvB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,MAAM,YAAgC;AAE1C,UAAM,QAAQ,MAAM;AACpB,UAAM,UAAU,MAAM,MAAM,MAAM;AAClC,QAAI,UAAU,MAAM,QAAQ;AAC5B,aAAS,OAAO,GAAG,YAAY,SAAS,QAAQ,GAAG;AAGjD,UAAI,QAAQ,YAAY,UAAU,KAAK,QAAQ,EAAG;AAClD,YAAM,MAAM,UAAU,OAAO,CAAC,KAAK,UAAU,UAAU,SAAS,CAAC,KAAK,CAAC;AACvE,UAAI,UAAU,KAAK,QAAQ,EAAG;AAC9B,gBAAU,MAAM,QAAQ;AAAA,IAC1B;AAGA,QAAI,QAAQ,EAAG,QAAO,EAAE,QAAQ,UAAU;AAC1C,QAAI,YAAY,aAAc,QAAO,EAAE,QAAQ,SAAS,OAAO,MAAM;AACrE,QAAI,YAAY,WAAW,YAAY,YAAa,QAAO,EAAE,QAAQ,YAAY;AACjF,YAAQ,MAAM,QAAQ,OAAO;AAC7B,WAAO,EAAE,QAAQ,WAAW,SAAS,QAAQ,QAAQ;AAAA,EACvD;AAEA,MAAI,SAAoC;AACxC,QAAM,OAAO,MAAM;AAGjB,eAAW,IAAI,EAAE,QAAQ,MAAM;AAC7B,eAAS;AAAA,IACX,CAAC;AACD,WAAO;AAAA,EACT;AAGA,MAAI;AAEJ,QAAM,UAA6B;AAAA,IACjC,MAAM,UAAU;AACd,YAAM,UAAU,MAAM,KAAK;AAC3B,aAAO,QAAQ,WAAW,UAAU,EAAE,QAAQ,QAAQ,IAAI;AAAA,IAC5D;AAAA,EACF;AACA,UAAQ,IAAI,SAAS;AAAA,IACnB;AAAA,IACA,QAAQ,MAAM,QAAQ,OAAO;AAAA,IAC7B,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C;AAAA,IACA,IAAI,YAAY,MAAM;AACpB,UAAI,SAAS,MAAM,UAAU,WAAY;AACzC,cAAQ,EAAE,OAAO,WAAW;AAC5B,cAAQ,QAAQ,EAAE,KAAK,CAAC;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAwBA,MAAM,QAAQ;AACd,MAAM,YAAY;AAClB,MAAM,YAAY;AAalB,SAAS,UAAU,QAAmC,OAAqB;AACzE,QAAM,QAAQ,UAAU,KAAK;AAC7B,QAAM,UAAU,OAAO;AACvB,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,UAAU,EAAE,eAAe,MAAM;AAAA,EAC1C,WAAW,OAAQ,QAA8B,QAAQ,YAAY;AACnE,IAAC,QAA0D,IAAI,iBAAiB,KAAK;AAAA,EACvF,OAAO;AACL,IAAC,QAAoC,gBAAgB;AAAA,EACvD;AACF;AA0BO,SAAS,qBACd,UACA,SACY;AACZ,QAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,MAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,kEAAkE;AAEnG,QAAM,iBAAiB,OAAO,OAAe,WAAyC;AACpF,QAAI,OAAO,gBAAgB,OAAO,OAAO,EAAE,EAAG,OAAM;AAEpD,UAAM,QAAQ,OAAO,KAAK,MAAM,SAAY,OAAO,MAAM,IAAI,OAAO,KAAK;AACzE,UAAM,SAAS,CAAC,UAAkB;AAChC,gBAAU,QAAQ,KAAK;AACvB,aAAO,SAAS,QAAQ,MAAM;AAAA,IAChC;AACA,eAAS;AACP,YAAM,MAAM,OAAO,MAAM;AAGzB,UAAI,UAAU,KAAK;AACjB,YAAI,QAAQ,QAAQ,OAAO,SAAS,EAAG,OAAM;AAC7C,eAAO,SAAS,IAAI;AACpB,eAAO,OAAO,GAAG;AAAA,MACnB;AAGA,UAAI,OAAO,OAAO,GAAG;AACnB,eAAO,IAAI,KAAK,IAAI;AACpB,cAAM;AAAA,MACR;AAGA,UAAI,OAAO,SAAS,GAAG;AACrB,eAAO,IAAI,KAAK,KAAK;AACrB,cAAM;AAAA,MACR;AAEA,YAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAI,OAAO,WAAW,UAAW;AACjC,UAAI,OAAO,WAAW,SAAS;AAC7B,eAAO,IAAI,OAAO,OAAO,KAAK;AAC9B,cAAM;AAAA,MACR;AACA,UAAI,OAAO,WAAW,aAAa;AACjC,QAAC,MAAkC,SAAS,IAAI;AAChD,cAAM;AAAA,MACR;AACA,UAAI,OAAO,QAAQ,WAAW,MAAO,OAAM;AAC3C,aAAO,SAAS,IAAI;AACpB,aAAO,OAAO,OAAO,QAAQ,KAAK;AAAA,IACpC;AAAA,EACF;AAEA,QAAM,UAAU,SAAS,aAAa,QAAQ;AAAA,IAC5C,CAAC,WAAW;AACV,MAAC,OAAsB,KAAK,IAAI,OAAO,MAAM;AAC7C,aAAO;AAAA,IACT;AAAA,IACA,CAAC,UAAU,QAAQ,OAAO,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,SAAS,aAAa,SAAS;AAAA,IAC9C,CAAC,QAAQ;AAAA,IACT,CAAC,UAAU;AACT,YAAM,SAAS;AACf,UAAI,QAAQ,UAAU,WAAW,OAAO,CAAC,OAAO,OAAQ,QAAO,QAAQ,OAAO,KAAK;AACnF,aAAO,eAAe,QAAQ,OAAO,MAAM;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACX,aAAS,aAAa,QAAQ,MAAM,OAAO;AAC3C,aAAS,aAAa,SAAS,MAAM,QAAQ;AAAA,EAC/C;AACF;","names":[]}

package/dist/lib/share-format.d.ts

@@ -0,0 +1,13 @@
+/**
+ * How a chart says a share of its whole — PieChart's slices and centre, Treemap's tiles
+ * and groups. Internal, not exported from the barrel.
+ *
+ * Each chart held a copy of the same two `Intl` formats and the same switch between them
+ * (0.52 code review of treemap.tsx, finding 9); one copy is the rule both say.
+ */
+/**
+ * A formatter for shares (0–1) in `locale`, as a percent: one decimal under 10 %, where
+ * rounding to whole percents starts to lie — a slice of 0.4 % said as "0%" says it is not
+ * there — and whole percents above. Make it once per locale (it builds two `Intl` formats).
+ */
+export declare function shareFormat(locale: string | undefined): (share: number) => string;

package/dist/lib/share-format.js

@@ -0,0 +1,10 @@
+"use client";
+function shareFormat(locale) {
+  const whole = new Intl.NumberFormat(locale, { style: "percent", maximumFractionDigits: 0 });
+  const fine = new Intl.NumberFormat(locale, { style: "percent", maximumFractionDigits: 1 });
+  return (share) => (share < 0.1 ? fine : whole).format(share);
+}
+export {
+  shareFormat
+};
+//# sourceMappingURL=share-format.js.map

package/dist/lib/share-format.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/share-format.ts"],"sourcesContent":["/**\n * How a chart says a share of its whole — PieChart's slices and centre, Treemap's tiles\n * and groups. Internal, not exported from the barrel.\n *\n * Each chart held a copy of the same two `Intl` formats and the same switch between them\n * (0.52 code review of treemap.tsx, finding 9); one copy is the rule both say.\n */\n\n/**\n * A formatter for shares (0–1) in `locale`, as a percent: one decimal under 10 %, where\n * rounding to whole percents starts to lie — a slice of 0.4 % said as \"0%\" says it is not\n * there — and whole percents above. Make it once per locale (it builds two `Intl` formats).\n */\nexport function shareFormat(locale: string | undefined): (share: number) => string {\n  const whole = new Intl.NumberFormat(locale, { style: \"percent\", maximumFractionDigits: 0 });\n  const fine = new Intl.NumberFormat(locale, { style: \"percent\", maximumFractionDigits: 1 });\n  return (share) => (share < 0.1 ? fine : whole).format(share);\n}\n"],"mappings":";AAaO,SAAS,YAAY,QAAuD;AACjF,QAAM,QAAQ,IAAI,KAAK,aAAa,QAAQ,EAAE,OAAO,WAAW,uBAAuB,EAAE,CAAC;AAC1F,QAAM,OAAO,IAAI,KAAK,aAAa,QAAQ,EAAE,OAAO,WAAW,uBAAuB,EAAE,CAAC;AACzF,SAAO,CAAC,WAAW,QAAQ,MAAM,OAAO,OAAO,OAAO,KAAK;AAC7D;","names":[]}

package/dist/lib/text-case.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Upper-case the first letter only, in `locale` — the one copy of the rule (refactor audit
+ * 2026-10-30, DUP-11: MonthPicker and JumpCalendar each had it, and MiniCalendar's caption
+ * still used the CSS `capitalize` it was written against).
+ *
+ * Several locales (fr, es, it, pt, …) write month names in lower case, which at the head
+ * of a field or a panel reads as a typo. But only the FIRST letter is ours to change:
+ * `capitalize` upper-cases every word, so Spanish read "Septiembre De 2026", and a
+ * caption that does not start with the month kept its wrong capital — Hungarian read
+ * "2026. Szeptember". This gives "Septiembre de 2026" and "2026. szeptember".
+ *
+ * In `locale` because the case mapping is the language's: Turkish upper-cases "i" to "İ".
+ * `undefined` is the runtime's default, as everywhere `Intl` takes one.
+ *
+ * Package-private — not re-exported from the barrel.
+ */
+export declare function upperFirst(text: string, locale: string | undefined): string;

package/dist/lib/text-case.js

@@ -0,0 +1,8 @@
+"use client";
+function upperFirst(text, locale) {
+  return text.charAt(0).toLocaleUpperCase(locale) + text.slice(1);
+}
+export {
+  upperFirst
+};
+//# sourceMappingURL=text-case.js.map

package/dist/lib/text-case.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/text-case.ts"],"sourcesContent":["/**\n * Upper-case the first letter only, in `locale` — the one copy of the rule (refactor audit\n * 2026-10-30, DUP-11: MonthPicker and JumpCalendar each had it, and MiniCalendar's caption\n * still used the CSS `capitalize` it was written against).\n *\n * Several locales (fr, es, it, pt, …) write month names in lower case, which at the head\n * of a field or a panel reads as a typo. But only the FIRST letter is ours to change:\n * `capitalize` upper-cases every word, so Spanish read \"Septiembre De 2026\", and a\n * caption that does not start with the month kept its wrong capital — Hungarian read\n * \"2026. Szeptember\". This gives \"Septiembre de 2026\" and \"2026. szeptember\".\n *\n * In `locale` because the case mapping is the language's: Turkish upper-cases \"i\" to \"İ\".\n * `undefined` is the runtime's default, as everywhere `Intl` takes one.\n *\n * Package-private — not re-exported from the barrel.\n */\nexport function upperFirst(text: string, locale: string | undefined): string {\n  return text.charAt(0).toLocaleUpperCase(locale) + text.slice(1);\n}\n"],"mappings":";AAgBO,SAAS,WAAW,MAAc,QAAoC;AAC3E,SAAO,KAAK,OAAO,CAAC,EAAE,kBAAkB,MAAM,IAAI,KAAK,MAAM,CAAC;AAChE;","names":[]}

package/dist/lib/text-match.d.ts

@@ -19,6 +19,15 @@
  * `locale` left out is the runtime's default; a malformed tag folds as if left out.
  */
 export declare function foldForSearch(text: string, locale?: string): string;
+/**
+ * Whether two names are one name as a picker's search reads them: folded
+ * ({@link foldForSearch}) and trimmed — "cafe" is Café, " MIGROS " is Migros. For "does
+ * the typed text name a record that exists" (a create row, InlineEntityCombobox's blur
+ * commit), which compared with plain `toLowerCase` while the list beside it folded, so
+ * "cafe" listed Café as a hit and offered "Create “cafe”" too — a duplicate payee or shop
+ * chain one Enter away (refactor audit 2026-10-30, DUP-5). Internal: not in the barrel.
+ */
+export declare function sameName(a: string, b: string, locale?: string): boolean;
 /**
  * A picker's query as its words, each folded (0.51.4, keksdose's /prices shop picker):
  * "Migros  Zürich" → `["migros", "zurich"]`. An empty or blank query has no words.
@@ -59,3 +68,32 @@ export declare function rankMatch(label: string, query: string, { code, locale }
     code?: string;
     locale?: string;
 }): MatchRank;
+/** A row {@link searchRanked} kept, and how well it answers the WHOLE query:
+ *  {@link rankMatch}'s rank, or `3` for a row that holds the query's words apart
+ *  ("Zürich Migros" for "migros zürich"). */
+export interface RankedHit<T> {
+    row: T;
+    rank: Exclude<MatchRank, -1> | 3;
+}
+/**
+ * The rows that hold every word of `query`, each ranked for the WHOLE query — for the
+ * lists that FILTER by words ({@link matchesSearch}) and RANK by the whole query
+ * ({@link rankMatch}): Combobox, CountrySelect and InlineEntityCombobox (refactor audit
+ * 2026-10-30, DUP-4). In the order given; sort by `rank` with a stable sort, and the rows
+ * of one rank keep it. No words keep every row, at `0`.
+ *
+ * Each row's texts are folded ONCE, and the query once. The lists asked `matchesSearch`
+ * and then `rankMatch` of each row they kept, which folded the row three times and the
+ * query once per row, per keystroke — InlineEntityCombobox asked `rankMatch` twice of
+ * most rows (0.52 code review, combobox.tsx).
+ *
+ * `texts(row)`: where a word may stand; the FIRST is the label the rank is for.
+ * `code(row)`: a key that answers only WHOLE — a word that IS the code matches the row,
+ * and the code as the whole query ranks `0` ("ch" is Switzerland before it is Chad) —
+ * never a letter of it ("w" is not Aruba, AW: 0.52 code review, country-select.tsx).
+ * Internal: not in the barrel.
+ */
+export declare function searchRanked<T>(rows: readonly T[], query: string, texts: (row: T) => readonly (string | undefined)[], { code, locale }?: {
+    code?: (row: T) => string;
+    locale?: string;
+}): RankedHit<T>[];