@eifi1/ui-kit 0.51.6 → 0.52.0

package/dist/notifications/use-push-device.js

@@ -1,7 +1,7 @@
 "use client";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useMediaQuery } from "../hooks/use-media-query.js";
-import { httpStatusOf } from "../auth/auth-errors.js";
+import { httpStatusOf } from "../lib/http-status.js";
 import { PUSH_SUBSCRIPTION_CHANGED, keyBytes, pushSubscriptionInput as inputOf } from "./push-worker.js";
 class PushDeviceError extends Error {
   code;
@@ -39,6 +39,31 @@ async function activeRegistration() {
   return within(navigator.serviceWorker.ready, READY_TIMEOUT_MS, "no_service_worker");
 }
 const defaultEndpointTaken = (error) => httpStatusOf(error) === 409;
+async function releaseSubscription(unregister) {
+  const registration = await activeRegistration();
+  const subscription = await registration.pushManager.getSubscription();
+  if (!subscription) return false;
+  await unregister(subscription.endpoint);
+  await within(subscription.unsubscribe(), PUSH_TIMEOUT_MS, "push_timeout");
+  return true;
+}
+async function releaseThisDevicePush(unregister) {
+  if (!pushSupported()) return false;
+  try {
+    const registration = await navigator.serviceWorker.getRegistration();
+    if (!registration?.active) return false;
+    const subscription = await registration.pushManager.getSubscription();
+    if (!subscription) return false;
+    try {
+      await unregister(subscription.endpoint);
+    } finally {
+      await within(subscription.unsubscribe(), PUSH_TIMEOUT_MS, "push_timeout");
+    }
+    return true;
+  } finally {
+    notifyPushSubscriptionChanged();
+  }
+}
 function usePushDevice(options) {
   const latest = useRef(options);
   useEffect(() => {
@@ -183,12 +208,7 @@ function usePushDevice(options) {
     if (!supported) return;
     setBusy(true);
     try {
-      const registration = await activeRegistration();
-      const subscription = await registration.pushManager.getSubscription();
-      if (subscription) {
-        await latest.current.unregister(subscription.endpoint);
-        await within(subscription.unsubscribe(), PUSH_TIMEOUT_MS, "push_timeout");
-      }
+      await releaseSubscription((endpoint) => latest.current.unregister(endpoint));
       if (mounted.current) {
         setSubscribed(false);
         setForeignSubscription(false);
@@ -220,6 +240,7 @@ export {
   PushDeviceError,
   notifyPushSubscriptionChanged,
   pushSupported,
+  releaseThisDevicePush,
   usePushDevice
 };
 //# sourceMappingURL=use-push-device.js.map

package/dist/notifications/use-push-device.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/notifications/use-push-device.ts"],"sourcesContent":["import { useCallback, useEffect, useRef, useState } from \"react\";\n\nimport { useMediaQuery } from \"../hooks/use-media-query\";\nimport { httpStatusOf } from \"../auth/auth-errors\";\nimport { PUSH_SUBSCRIPTION_CHANGED, keyBytes, pushSubscriptionInput as inputOf } from \"./push-worker\";\nimport type { PushSubscriptionInput } from \"./push-worker\";\n\nexport { PUSH_SUBSCRIPTION_CHANGED };\nexport type { PushSubscriptionInput };\n\n/**\n * This browser's Web Push subscription for the signed-in account\n * (docs/notifications-harmonization.md §2.7, §3.5, §4.2) — keksdose's\n * `shared/push/use-push.ts`, lifted. The service worker with its `push` and\n * `notificationclick` handlers stays the app's; this hook owns the browser's side:\n * permission, subscribe with the server's VAPID key, register the subscription, and\n * unsubscribe. The kit makes no request of its own: the app hands it one function per\n * endpoint.\n */\n\n/** The browser's notification permission, or `\"unsupported\"` where it has no push. */\nexport type PushPermission = NotificationPermission | \"unsupported\";\n\n/** Why turning push on or off could not finish — a {@link PushDeviceError}'s `code`. */\nexport type PushDeviceErrorCode = \"no_service_worker\" | \"push_timeout\";\n\n/**\n * The two failures the card has words of its own for: no service worker registered (or\n * one not ready in 10 s) — \"reload and try again\" — and a browser push service that did\n * not answer in 15 s — \"check your connection\". Anything else is the app's request\n * failing, rejected as it came.\n */\nexport class PushDeviceError extends Error {\n  readonly code: PushDeviceErrorCode;\n  constructor(code: PushDeviceErrorCode) {\n    super(code);\n    this.name = \"PushDeviceError\";\n    this.code = code;\n  }\n}\n\nexport interface UsePushDeviceOptions {\n  /** `GET /notifications/push-key` → its `key`; `\"\"` when push is off on the server. */\n  pushKey: () => Promise<string>;\n  /** `POST /notifications/devices`. A 409 (another account's endpoint) is recovered\n   *  once: the hook unsubscribes and registers a fresh endpoint. */\n  register: (subscription: PushSubscriptionInput) => Promise<unknown>;\n  /** `POST /notifications/devices/unregister {endpoint}` — the endpoint never goes in a\n   *  URL. */\n  unregister: (endpoint: string) => Promise<unknown>;\n  /** `GET /notifications/devices`: the account's own list, which says whether THIS\n   *  account holds this browser's subscription. */\n  devices: () => Promise<readonly { endpoint: string }[]>;\n  /** `POST /notifications/test` → how many devices the push service accepted it for. */\n  test: () => Promise<{ sent: number }>;\n  /** Whether `register` refused another account's endpoint. Default: HTTP 409. */\n  isEndpointTaken?: (error: unknown) => boolean;\n  /** After an enable or a disable: the app refreshes its device queries. */\n  onChange?: () => void;\n}\n\n/** What {@link usePushDevice} answers. */\nexport interface PushDevice {\n  /** The browser exposes service workers, `PushManager` and `Notification`. */\n  supported: boolean;\n  /** The server has VAPID keys; `undefined` until `pushKey` answered (or when it failed). */\n  configured: boolean | undefined;\n  /** Running as an installed app: `display-mode: standalone`, or iOS's\n   *  `navigator.standalone`. */\n  installed: boolean;\n  /** iPhone or iPad — where push reaches only the installed app. */\n  ios: boolean;\n  permission: PushPermission;\n  /** THIS account holds this browser's subscription. An unreachable device list falls\n   *  back to the browser's own answer. */\n  subscribed: boolean;\n  /** This browser holds a subscription that belongs to another account (two accounts in\n   *  one browser profile): `subscribed` is false, and turning on mints a fresh one. */\n  foreignSubscription: boolean;\n  /** This browser's subscription endpoint, or `null` — marks \"This device\" in a list. */\n  currentEndpoint: string | null;\n  /** An enable or a disable is running. */\n  busy: boolean;\n  /** Ask for permission (the browser's one prompt), subscribe and register. `false` when\n   *  the permission was not granted or push is off on the server; rejects with a\n   *  {@link PushDeviceError} or the app's request's error. */\n  enable: () => Promise<boolean>;\n  /** Tell the server first, then the browser, so a dropped device stops at once. */\n  disable: () => Promise<void>;\n  sendTest: () => Promise<{ sent: number }>;\n}\n\n/*\n * PUSH_SUBSCRIPTION_CHANGED (push-worker.ts): the window event every mounted\n * {@link usePushDevice} re-reads its state on. Fired by every enable and disable, and by\n * `PushDevicesSetting` when it removes this device — so an app's own card on the same\n * hook (keksdose's check-up) stays in step. The hook that fires it does not re-read: it\n * knows what it changed. Since 0.46 also the message a service worker posts after a\n * rotated subscription was re-registered (`handlePushSubscriptionChange`). Namespaced\n * for the kit; keksdose's was `\"keksdose:push-subscription-changed\"`.\n */\n\n/** Tell every {@link usePushDevice} that this browser's subscription changed. */\nexport function notifyPushSubscriptionChanged(): void {\n  if (typeof window !== \"undefined\") window.dispatchEvent(new Event(PUSH_SUBSCRIPTION_CHANGED));\n}\n\n/** Whether this browser has the APIs push needs. iOS exposes them only to an INSTALLED\n *  app (Add to Home Screen). */\nexport function pushSupported(): boolean {\n  return (\n    typeof window !== \"undefined\" &&\n    typeof navigator !== \"undefined\" &&\n    \"serviceWorker\" in navigator &&\n    \"PushManager\" in window &&\n    \"Notification\" in window\n  );\n}\n\n/** iPhone or iPad. iPadOS 13+ reports itself as a Mac; the touch points tell it apart. */\nfunction isIos(): boolean {\n  if (typeof navigator === \"undefined\") return false;\n  const ua = navigator.userAgent;\n  return /iphone|ipad|ipod/i.test(ua) || (/Macintosh/.test(ua) && navigator.maxTouchPoints > 1);\n}\n\nconst READY_TIMEOUT_MS = 10_000;\nconst PUSH_TIMEOUT_MS = 15_000;\n\n/** `promise`, or a {@link PushDeviceError} after `ms`. The timer is cleared either way. */\nfunction within<T>(promise: Promise<T>, ms: number, code: PushDeviceErrorCode): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  return Promise.race([\n    promise,\n    new Promise<never>((_, reject) => {\n      timer = setTimeout(() => reject(new PushDeviceError(code)), ms);\n    }),\n  ]).finally(() => clearTimeout(timer));\n}\n\n/**\n * The active registration. `navigator.serviceWorker.ready` never settles while the origin\n * has no registration, so a missing one fails at once, and one stuck installing fails\n * after 10 s (keksdose: enable() hung with the button latched before its worker was\n * served).\n */\nasync function activeRegistration(): Promise<ServiceWorkerRegistration> {\n  const existing = await navigator.serviceWorker.getRegistration();\n  if (!existing) throw new PushDeviceError(\"no_service_worker\");\n  return within(navigator.serviceWorker.ready, READY_TIMEOUT_MS, \"no_service_worker\");\n}\n\nconst defaultEndpointTaken = (error: unknown) => httpStatusOf(error) === 409;\n\n/**\n * This browser's push for the signed-in account. Hand it one function per endpoint\n * (§3.8); {@link PushDeviceSetting} draws it, and an app's own card may use it too.\n *\n * **\"Subscribed\" means this account**, not \"this browser holds a subscription\": a\n * browser profile's subscription has no account in it, so a second account in the same\n * profile would read the first's as its own (keksdose). The endpoint is checked against\n * the account's own `devices()`; when that list cannot be read (offline), the browser's\n * answer stands — a wrong \"on\" costs what it did before the check, a wrong \"off\" invites\n * re-subscribing a device that is fine.\n *\n * **A 409 from `register`** — the endpoint belongs to another account, and the server\n * will not re-home what it cannot prove this browser holds — unsubscribes and registers\n * a fresh endpoint, once.\n *\n * **Timeouts:** no registration fails at once and a worker not ready in 10 s fails, both\n * `PushDeviceError(\"no_service_worker\")`; the browser's subscribe and unsubscribe are cut\n * at 15 s, `PushDeviceError(\"push_timeout\")` — so `busy` can never latch.\n *\n * Every mounted hook re-reads its state on {@link PUSH_SUBSCRIPTION_CHANGED}.\n */\nexport function usePushDevice(options: UsePushDeviceOptions): PushDevice {\n  // The app's functions are usually new on every render; the effects read the latest.\n  const latest = useRef(options);\n  useEffect(() => {\n    latest.current = options;\n  });\n\n  const supported = pushSupported();\n  const ios = isIos();\n  const standalone = useMediaQuery(\"(display-mode: standalone)\", false);\n  const installed =\n    standalone ||\n    (typeof navigator !== \"undefined\" && (navigator as Navigator & { standalone?: boolean }).standalone === true);\n\n  const [permission, setPermission] = useState<PushPermission>(() =>\n    supported ? Notification.permission : \"unsupported\",\n  );\n  const [configured, setConfigured] = useState<boolean | undefined>(undefined);\n  const [subscribed, setSubscribed] = useState(false);\n  const [foreignSubscription, setForeignSubscription] = useState(false);\n  const [currentEndpoint, setCurrentEndpoint] = useState<string | null>(null);\n  const [busy, setBusy] = useState(false);\n  const mounted = useRef(true);\n  // Set while this hook fires the event itself: it already knows what changed, and a\n  // re-read could only be worse — an app whose `devices()` answers from a cache would\n  // hand back the list from before the change.\n  const announcing = useRef(false);\n  const announce = useCallback(() => {\n    announcing.current = true;\n    try {\n      notifyPushSubscriptionChanged();\n    } finally {\n      announcing.current = false;\n    }\n    latest.current.onChange?.();\n  }, []);\n  useEffect(() => {\n    mounted.current = true;\n    return () => {\n      mounted.current = false;\n    };\n  }, []);\n\n  // Whether the server has keys (\"\" → push is off there). Once per mount.\n  useEffect(() => {\n    if (!supported) return;\n    let cancelled = false;\n    latest.current.pushKey().then(\n      (key) => {\n        if (!cancelled) setConfigured(key !== \"\");\n      },\n      () => {\n        /* unknown: the card shows the ordinary states */\n      },\n    );\n    return () => {\n      cancelled = true;\n    };\n  }, [supported]);\n\n  // What this browser holds, and whether it is this account's — at mount, and whenever\n  // a subscription changes anywhere in the app.\n  useEffect(() => {\n    if (!supported) return;\n    let cancelled = false;\n    const sync = async () => {\n      try {\n        const registration = await activeRegistration();\n        const existing = await registration.pushManager.getSubscription();\n        if (cancelled) return;\n        // Read again: the person may have changed it in the browser's settings.\n        setPermission(Notification.permission);\n        if (!existing) {\n          setSubscribed(false);\n          setForeignSubscription(false);\n          setCurrentEndpoint(null);\n          return;\n        }\n        let mine: boolean;\n        try {\n          const devices = await latest.current.devices();\n          mine = devices.some((device) => device.endpoint === existing.endpoint);\n        } catch {\n          mine = true;\n        }\n        if (cancelled) return;\n        setCurrentEndpoint(existing.endpoint);\n        setSubscribed(mine);\n        setForeignSubscription(!mine);\n      } catch {\n        /* no active service worker yet: not subscribed */\n      }\n    };\n    const heard = () => {\n      if (!announcing.current) void sync();\n    };\n    // The worker's word after it re-registered a rotated subscription (0.46).\n    const fromWorker = (event: MessageEvent) => {\n      if ((event.data as { type?: unknown } | null)?.type === PUSH_SUBSCRIPTION_CHANGED) void sync();\n    };\n    const worker = navigator.serviceWorker as ServiceWorkerContainer | undefined;\n    void sync();\n    window.addEventListener(PUSH_SUBSCRIPTION_CHANGED, heard);\n    worker?.addEventListener?.(\"message\", fromWorker);\n    return () => {\n      cancelled = true;\n      window.removeEventListener(PUSH_SUBSCRIPTION_CHANGED, heard);\n      worker?.removeEventListener?.(\"message\", fromWorker);\n    };\n  }, [supported]);\n\n  const enable = useCallback(async (): Promise<boolean> => {\n    if (!supported) return false;\n    const { pushKey, register, isEndpointTaken = defaultEndpointTaken } = latest.current;\n    setBusy(true);\n    try {\n      const granted = await Notification.requestPermission();\n      if (mounted.current) setPermission(granted);\n      if (granted !== \"granted\") return false;\n\n      const key = await pushKey();\n      if (!key) {\n        if (mounted.current) setConfigured(false);\n        return false;\n      }\n      if (mounted.current) setConfigured(true);\n\n      const registration = await activeRegistration();\n      // The one place the browser is asked for a subscription, so the timeout and the\n      // `{userVisibleOnly, applicationServerKey}` literal are on both paths.\n      const subscribe = (reuse: boolean) =>\n        within(\n          (async () =>\n            (reuse ? await registration.pushManager.getSubscription() : null) ??\n            (await registration.pushManager.subscribe({\n              userVisibleOnly: true,\n              applicationServerKey: keyBytes(key),\n            })))(),\n          PUSH_TIMEOUT_MS,\n          \"push_timeout\",\n        );\n\n      let subscription = await subscribe(true);\n      let input = inputOf(subscription);\n      if (!input) return false;\n      try {\n        await register(input);\n      } catch (error) {\n        if (!isEndpointTaken(error)) throw error;\n        await within(subscription.unsubscribe(), PUSH_TIMEOUT_MS, \"push_timeout\");\n        subscription = await subscribe(false);\n        input = inputOf(subscription);\n        if (!input) return false;\n        await register(input);\n      }\n      if (mounted.current) {\n        setSubscribed(true);\n        setForeignSubscription(false);\n        setCurrentEndpoint(input.endpoint);\n      }\n      announce();\n      return true;\n    } finally {\n      if (mounted.current) setBusy(false);\n    }\n  }, [supported, announce]);\n\n  const disable = useCallback(async (): Promise<void> => {\n    if (!supported) return;\n    setBusy(true);\n    try {\n      const registration = await activeRegistration();\n      const subscription = await registration.pushManager.getSubscription();\n      if (subscription) {\n        // The server first: a dropped device stops receiving even if the browser's\n        // unsubscribe below fails.\n        await latest.current.unregister(subscription.endpoint);\n        await within(subscription.unsubscribe(), PUSH_TIMEOUT_MS, \"push_timeout\");\n      }\n      if (mounted.current) {\n        setSubscribed(false);\n        setForeignSubscription(false);\n        setCurrentEndpoint(null);\n      }\n      announce();\n    } finally {\n      if (mounted.current) setBusy(false);\n    }\n  }, [supported, announce]);\n\n  const sendTest = useCallback(() => latest.current.test(), []);\n\n  return {\n    supported,\n    configured,\n    installed,\n    ios,\n    permission,\n    subscribed,\n    foreignSubscription,\n    currentEndpoint,\n    busy,\n    enable,\n    disable,\n    sendTest,\n  };\n}\n"],"mappings":";AAAA,SAAS,aAAa,WAAW,QAAQ,gBAAgB;AAEzD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,UAAU,yBAAyB,eAAe;AA4B/E,MAAM,wBAAwB,MAAM;AAAA,EAChC;AAAA,EACT,YAAY,MAA2B;AACrC,UAAM,IAAI;AACV,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAgEO,SAAS,gCAAsC;AACpD,MAAI,OAAO,WAAW,YAAa,QAAO,cAAc,IAAI,MAAM,yBAAyB,CAAC;AAC9F;AAIO,SAAS,gBAAyB;AACvC,SACE,OAAO,WAAW,eAClB,OAAO,cAAc,eACrB,mBAAmB,aACnB,iBAAiB,UACjB,kBAAkB;AAEtB;AAGA,SAAS,QAAiB;AACxB,MAAI,OAAO,cAAc,YAAa,QAAO;AAC7C,QAAM,KAAK,UAAU;AACrB,SAAO,oBAAoB,KAAK,EAAE,KAAM,YAAY,KAAK,EAAE,KAAK,UAAU,iBAAiB;AAC7F;AAEA,MAAM,mBAAmB;AACzB,MAAM,kBAAkB;AAGxB,SAAS,OAAU,SAAqB,IAAY,MAAuC;AACzF,MAAI;AACJ,SAAO,QAAQ,KAAK;AAAA,IAClB;AAAA,IACA,IAAI,QAAe,CAAC,GAAG,WAAW;AAChC,cAAQ,WAAW,MAAM,OAAO,IAAI,gBAAgB,IAAI,CAAC,GAAG,EAAE;AAAA,IAChE,CAAC;AAAA,EACH,CAAC,EAAE,QAAQ,MAAM,aAAa,KAAK,CAAC;AACtC;AAQA,eAAe,qBAAyD;AACtE,QAAM,WAAW,MAAM,UAAU,cAAc,gBAAgB;AAC/D,MAAI,CAAC,SAAU,OAAM,IAAI,gBAAgB,mBAAmB;AAC5D,SAAO,OAAO,UAAU,cAAc,OAAO,kBAAkB,mBAAmB;AACpF;AAEA,MAAM,uBAAuB,CAAC,UAAmB,aAAa,KAAK,MAAM;AAuBlE,SAAS,cAAc,SAA2C;AAEvE,QAAM,SAAS,OAAO,OAAO;AAC7B,YAAU,MAAM;AACd,WAAO,UAAU;AAAA,EACnB,CAAC;AAED,QAAM,YAAY,cAAc;AAChC,QAAM,MAAM,MAAM;AAClB,QAAM,aAAa,cAAc,8BAA8B,KAAK;AACpE,QAAM,YACJ,cACC,OAAO,cAAc,eAAgB,UAAmD,eAAe;AAE1G,QAAM,CAAC,YAAY,aAAa,IAAI;AAAA,IAAyB,MAC3D,YAAY,aAAa,aAAa;AAAA,EACxC;AACA,QAAM,CAAC,YAAY,aAAa,IAAI,SAA8B,MAAS;AAC3E,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,qBAAqB,sBAAsB,IAAI,SAAS,KAAK;AACpE,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,SAAwB,IAAI;AAC1E,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,OAAO,IAAI;AAI3B,QAAM,aAAa,OAAO,KAAK;AAC/B,QAAM,WAAW,YAAY,MAAM;AACjC,eAAW,UAAU;AACrB,QAAI;AACF,oCAA8B;AAAA,IAChC,UAAE;AACA,iBAAW,UAAU;AAAA,IACvB;AACA,WAAO,QAAQ,WAAW;AAAA,EAC5B,GAAG,CAAC,CAAC;AACL,YAAU,MAAM;AACd,YAAQ,UAAU;AAClB,WAAO,MAAM;AACX,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAGL,YAAU,MAAM;AACd,QAAI,CAAC,UAAW;AAChB,QAAI,YAAY;AAChB,WAAO,QAAQ,QAAQ,EAAE;AAAA,MACvB,CAAC,QAAQ;AACP,YAAI,CAAC,UAAW,eAAc,QAAQ,EAAE;AAAA,MAC1C;AAAA,MACA,MAAM;AAAA,MAEN;AAAA,IACF;AACA,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,SAAS,CAAC;AAId,YAAU,MAAM;AACd,QAAI,CAAC,UAAW;AAChB,QAAI,YAAY;AAChB,UAAM,OAAO,YAAY;AACvB,UAAI;AACF,cAAM,eAAe,MAAM,mBAAmB;AAC9C,cAAM,WAAW,MAAM,aAAa,YAAY,gBAAgB;AAChE,YAAI,UAAW;AAEf,sBAAc,aAAa,UAAU;AACrC,YAAI,CAAC,UAAU;AACb,wBAAc,KAAK;AACnB,iCAAuB,KAAK;AAC5B,6BAAmB,IAAI;AACvB;AAAA,QACF;AACA,YAAI;AACJ,YAAI;AACF,gBAAM,UAAU,MAAM,OAAO,QAAQ,QAAQ;AAC7C,iBAAO,QAAQ,KAAK,CAAC,WAAW,OAAO,aAAa,SAAS,QAAQ;AAAA,QACvE,QAAQ;AACN,iBAAO;AAAA,QACT;AACA,YAAI,UAAW;AACf,2BAAmB,SAAS,QAAQ;AACpC,sBAAc,IAAI;AAClB,+BAAuB,CAAC,IAAI;AAAA,MAC9B,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,QAAQ,MAAM;AAClB,UAAI,CAAC,WAAW,QAAS,MAAK,KAAK;AAAA,IACrC;AAEA,UAAM,aAAa,CAAC,UAAwB;AAC1C,UAAK,MAAM,MAAoC,SAAS,0BAA2B,MAAK,KAAK;AAAA,IAC/F;AACA,UAAM,SAAS,UAAU;AACzB,SAAK,KAAK;AACV,WAAO,iBAAiB,2BAA2B,KAAK;AACxD,YAAQ,mBAAmB,WAAW,UAAU;AAChD,WAAO,MAAM;AACX,kBAAY;AACZ,aAAO,oBAAoB,2BAA2B,KAAK;AAC3D,cAAQ,sBAAsB,WAAW,UAAU;AAAA,IACrD;AAAA,EACF,GAAG,CAAC,SAAS,CAAC;AAEd,QAAM,SAAS,YAAY,YAA8B;AACvD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,EAAE,SAAS,UAAU,kBAAkB,qBAAqB,IAAI,OAAO;AAC7E,YAAQ,IAAI;AACZ,QAAI;AACF,YAAM,UAAU,MAAM,aAAa,kBAAkB;AACrD,UAAI,QAAQ,QAAS,eAAc,OAAO;AAC1C,UAAI,YAAY,UAAW,QAAO;AAElC,YAAM,MAAM,MAAM,QAAQ;AAC1B,UAAI,CAAC,KAAK;AACR,YAAI,QAAQ,QAAS,eAAc,KAAK;AACxC,eAAO;AAAA,MACT;AACA,UAAI,QAAQ,QAAS,eAAc,IAAI;AAEvC,YAAM,eAAe,MAAM,mBAAmB;AAG9C,YAAM,YAAY,CAAC,UACjB;AAAA,SACG,aACE,QAAQ,MAAM,aAAa,YAAY,gBAAgB,IAAI,SAC3D,MAAM,aAAa,YAAY,UAAU;AAAA,UACxC,iBAAiB;AAAA,UACjB,sBAAsB,SAAS,GAAG;AAAA,QACpC,CAAC,GAAI;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAEF,UAAI,eAAe,MAAM,UAAU,IAAI;AACvC,UAAI,QAAQ,QAAQ,YAAY;AAChC,UAAI,CAAC,MAAO,QAAO;AACnB,UAAI;AACF,cAAM,SAAS,KAAK;AAAA,MACtB,SAAS,OAAO;AACd,YAAI,CAAC,gBAAgB,KAAK,EAAG,OAAM;AACnC,cAAM,OAAO,aAAa,YAAY,GAAG,iBAAiB,cAAc;AACxE,uBAAe,MAAM,UAAU,KAAK;AACpC,gBAAQ,QAAQ,YAAY;AAC5B,YAAI,CAAC,MAAO,QAAO;AACnB,cAAM,SAAS,KAAK;AAAA,MACtB;AACA,UAAI,QAAQ,SAAS;AACnB,sBAAc,IAAI;AAClB,+BAAuB,KAAK;AAC5B,2BAAmB,MAAM,QAAQ;AAAA,MACnC;AACA,eAAS;AACT,aAAO;AAAA,IACT,UAAE;AACA,UAAI,QAAQ,QAAS,SAAQ,KAAK;AAAA,IACpC;AAAA,EACF,GAAG,CAAC,WAAW,QAAQ,CAAC;AAExB,QAAM,UAAU,YAAY,YAA2B;AACrD,QAAI,CAAC,UAAW;AAChB,YAAQ,IAAI;AACZ,QAAI;AACF,YAAM,eAAe,MAAM,mBAAmB;AAC9C,YAAM,eAAe,MAAM,aAAa,YAAY,gBAAgB;AACpE,UAAI,cAAc;AAGhB,cAAM,OAAO,QAAQ,WAAW,aAAa,QAAQ;AACrD,cAAM,OAAO,aAAa,YAAY,GAAG,iBAAiB,cAAc;AAAA,MAC1E;AACA,UAAI,QAAQ,SAAS;AACnB,sBAAc,KAAK;AACnB,+BAAuB,KAAK;AAC5B,2BAAmB,IAAI;AAAA,MACzB;AACA,eAAS;AAAA,IACX,UAAE;AACA,UAAI,QAAQ,QAAS,SAAQ,KAAK;AAAA,IACpC;AAAA,EACF,GAAG,CAAC,WAAW,QAAQ,CAAC;AAExB,QAAM,WAAW,YAAY,MAAM,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC;AAE5D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/notifications/use-push-device.ts"],"sourcesContent":["import { useCallback, useEffect, useRef, useState } from \"react\";\n\nimport { useMediaQuery } from \"../hooks/use-media-query\";\nimport { httpStatusOf } from \"../lib/http-status\";\nimport { PUSH_SUBSCRIPTION_CHANGED, keyBytes, pushSubscriptionInput as inputOf } from \"./push-worker\";\nimport type { PushSubscriptionInput } from \"./push-worker\";\n\nexport { PUSH_SUBSCRIPTION_CHANGED };\nexport type { PushSubscriptionInput };\n\n/**\n * This browser's Web Push subscription for the signed-in account\n * (docs/notifications-harmonization.md §2.7, §3.5, §4.2) — keksdose's\n * `shared/push/use-push.ts`, lifted. The service worker with its `push` and\n * `notificationclick` handlers stays the app's; this hook owns the browser's side:\n * permission, subscribe with the server's VAPID key, register the subscription, and\n * unsubscribe. The kit makes no request of its own: the app hands it one function per\n * endpoint.\n */\n\n/** The browser's notification permission, or `\"unsupported\"` where it has no push. */\nexport type PushPermission = NotificationPermission | \"unsupported\";\n\n/** Why turning push on or off could not finish — a {@link PushDeviceError}'s `code`. */\nexport type PushDeviceErrorCode = \"no_service_worker\" | \"push_timeout\";\n\n/**\n * The two failures the card has words of its own for: no service worker registered (or\n * one not ready in 10 s) — \"reload and try again\" — and a browser push service that did\n * not answer in 15 s — \"check your connection\". Anything else is the app's request\n * failing, rejected as it came.\n */\nexport class PushDeviceError extends Error {\n  readonly code: PushDeviceErrorCode;\n  constructor(code: PushDeviceErrorCode) {\n    super(code);\n    this.name = \"PushDeviceError\";\n    this.code = code;\n  }\n}\n\nexport interface UsePushDeviceOptions {\n  /** `GET /notifications/push-key` → its `key`; `\"\"` when push is off on the server. */\n  pushKey: () => Promise<string>;\n  /** `POST /notifications/devices`. A 409 (another account's endpoint) is recovered\n   *  once: the hook unsubscribes and registers a fresh endpoint. */\n  register: (subscription: PushSubscriptionInput) => Promise<unknown>;\n  /** `POST /notifications/devices/unregister {endpoint}` — the endpoint never goes in a\n   *  URL. */\n  unregister: (endpoint: string) => Promise<unknown>;\n  /** `GET /notifications/devices`: the account's own list, which says whether THIS\n   *  account holds this browser's subscription. */\n  devices: () => Promise<readonly { endpoint: string }[]>;\n  /** `POST /notifications/test` → how many devices the push service accepted it for. */\n  test: () => Promise<{ sent: number }>;\n  /** Whether `register` refused another account's endpoint. Default: HTTP 409. */\n  isEndpointTaken?: (error: unknown) => boolean;\n  /** After an enable or a disable: the app refreshes its device queries. */\n  onChange?: () => void;\n}\n\n/** What {@link usePushDevice} answers. */\nexport interface PushDevice {\n  /** The browser exposes service workers, `PushManager` and `Notification`. */\n  supported: boolean;\n  /** The server has VAPID keys; `undefined` until `pushKey` answered (or when it failed). */\n  configured: boolean | undefined;\n  /** Running as an installed app: `display-mode: standalone`, or iOS's\n   *  `navigator.standalone`. */\n  installed: boolean;\n  /** iPhone or iPad — where push reaches only the installed app. */\n  ios: boolean;\n  permission: PushPermission;\n  /** THIS account holds this browser's subscription. An unreachable device list falls\n   *  back to the browser's own answer. */\n  subscribed: boolean;\n  /** This browser holds a subscription that belongs to another account (two accounts in\n   *  one browser profile): `subscribed` is false, and turning on mints a fresh one. */\n  foreignSubscription: boolean;\n  /** This browser's subscription endpoint, or `null` — marks \"This device\" in a list. */\n  currentEndpoint: string | null;\n  /** An enable or a disable is running. */\n  busy: boolean;\n  /** Ask for permission (the browser's one prompt), subscribe and register. `false` when\n   *  the permission was not granted or push is off on the server; rejects with a\n   *  {@link PushDeviceError} or the app's request's error. */\n  enable: () => Promise<boolean>;\n  /** Tell the server first, then the browser, so a dropped device stops at once. At a\n   *  sign-out, with no card mounted: {@link releaseThisDevicePush}. */\n  disable: () => Promise<void>;\n  sendTest: () => Promise<{ sent: number }>;\n}\n\n/*\n * PUSH_SUBSCRIPTION_CHANGED (push-worker.ts): the window event every mounted\n * {@link usePushDevice} re-reads its state on. Fired by every enable and disable, and by\n * `PushDevicesSetting` when it removes this device — so an app's own card on the same\n * hook (keksdose's check-up) stays in step. The hook that fires it does not re-read: it\n * knows what it changed. Since 0.46 also the message a service worker posts after a\n * rotated subscription was re-registered (`handlePushSubscriptionChange`). Namespaced\n * for the kit; keksdose's was `\"keksdose:push-subscription-changed\"`.\n */\n\n/** Tell every {@link usePushDevice} that this browser's subscription changed. */\nexport function notifyPushSubscriptionChanged(): void {\n  if (typeof window !== \"undefined\") window.dispatchEvent(new Event(PUSH_SUBSCRIPTION_CHANGED));\n}\n\n/** Whether this browser has the APIs push needs. iOS exposes them only to an INSTALLED\n *  app (Add to Home Screen). */\nexport function pushSupported(): boolean {\n  return (\n    typeof window !== \"undefined\" &&\n    typeof navigator !== \"undefined\" &&\n    \"serviceWorker\" in navigator &&\n    \"PushManager\" in window &&\n    \"Notification\" in window\n  );\n}\n\n/** iPhone or iPad. iPadOS 13+ reports itself as a Mac; the touch points tell it apart. */\nfunction isIos(): boolean {\n  if (typeof navigator === \"undefined\") return false;\n  const ua = navigator.userAgent;\n  return /iphone|ipad|ipod/i.test(ua) || (/Macintosh/.test(ua) && navigator.maxTouchPoints > 1);\n}\n\nconst READY_TIMEOUT_MS = 10_000;\nconst PUSH_TIMEOUT_MS = 15_000;\n\n/** `promise`, or a {@link PushDeviceError} after `ms`. The timer is cleared either way. */\nfunction within<T>(promise: Promise<T>, ms: number, code: PushDeviceErrorCode): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  return Promise.race([\n    promise,\n    new Promise<never>((_, reject) => {\n      timer = setTimeout(() => reject(new PushDeviceError(code)), ms);\n    }),\n  ]).finally(() => clearTimeout(timer));\n}\n\n/**\n * The active registration. `navigator.serviceWorker.ready` never settles while the origin\n * has no registration, so a missing one fails at once, and one stuck installing fails\n * after 10 s (keksdose: enable() hung with the button latched before its worker was\n * served).\n */\nasync function activeRegistration(): Promise<ServiceWorkerRegistration> {\n  const existing = await navigator.serviceWorker.getRegistration();\n  if (!existing) throw new PushDeviceError(\"no_service_worker\");\n  return within(navigator.serviceWorker.ready, READY_TIMEOUT_MS, \"no_service_worker\");\n}\n\nconst defaultEndpointTaken = (error: unknown) => httpStatusOf(error) === 409;\n\n/**\n * Drop this browser's subscription when the person turns push off: the server first, so a\n * dropped device stops receiving even if the browser's unsubscribe fails, then the\n * browser, cut at 15 s. Whether there was one. A refused server keeps the browser's\n * subscription: the card says the turn-off failed, still reads on, and the person tries\n * again. {@link usePushDevice}'s `disable`; a sign-out has its own\n * ({@link releaseThisDevicePush}).\n */\nasync function releaseSubscription(unregister: (endpoint: string) => Promise<unknown>): Promise<boolean> {\n  const registration = await activeRegistration();\n  const subscription = await registration.pushManager.getSubscription();\n  if (!subscription) return false;\n  await unregister(subscription.endpoint);\n  await within(subscription.unsubscribe(), PUSH_TIMEOUT_MS, \"push_timeout\");\n  return true;\n}\n\n/**\n * Release this browser's push at an EXPLICIT sign-out (0.52, docs/notifications-\n * harmonization.md §10.6; refactor audit 2026-10-30, FLW-2) — without the settings card\n * mounted, which `usePushDevice().disable` needs.\n *\n * A sign-out left the subscription registered to the account, so the device went on\n * showing that account's notifications, title and body (keksdose: invoices, bookings,\n * shares), to whoever used it next — while the same sign-out wiped the mirror, the outbox\n * and the query cache \"for the next person on this device\".\n *\n * Call it with the app's `unregister` (`POST /notifications/devices/unregister\n * {endpoint}`) BEFORE the session is cleared, while the token is still valid:\n *\n *     async function logOut() {\n *       await releaseThisDevicePush(api.unregisterDevice).catch(() => undefined);\n *       clear();\n *     }\n *\n * The server first, then the browser — and the browser EVEN WHEN THE SERVER REFUSED (0.52\n * code review, this file): `disable`'s order left a sign-out on a flaky network, or one\n * that met a 5xx, with the device still subscribed. Unsubscribed, the push service answers\n * the server's next send with 410 and the server prunes the row. The browser's unsubscribe\n * is cut at 15 s (`PushDeviceError(\"push_timeout\")`). Then it tells every mounted\n * {@link usePushDevice} ({@link PUSH_SUBSCRIPTION_CHANGED}).\n *\n * Resolves whether this browser held a subscription; `false` at once where push is\n * unsupported or was never set up — no service worker registration, or none ever active\n * (0.52 code review: most devices, which used to reject with `no_service_worker`, after\n * 10 s for a worker stuck installing). It asks the registration, not `ready`: a\n * subscription belongs to the registration, and a sign-out waits for no worker. Rejects\n * as the app's request did — once the browser has let go — or with `push_timeout`. Best\n * effort at a sign-out: catch it, a sign-out must not stop on push.\n *\n * Only an explicit sign-out (Marcel's decision 2 of the 2026-10-30 audit): a session that\n * merely expired keeps its device, and whoever signs back in turns push on again.\n */\nexport async function releaseThisDevicePush(unregister: (endpoint: string) => Promise<unknown>): Promise<boolean> {\n  if (!pushSupported()) return false;\n  try {\n    const registration = await navigator.serviceWorker.getRegistration();\n    // A worker never active holds no subscription: `subscribe` needs an active one.\n    if (!registration?.active) return false;\n    const subscription = await registration.pushManager.getSubscription();\n    if (!subscription) return false;\n    try {\n      await unregister(subscription.endpoint);\n    } finally {\n      await within(subscription.unsubscribe(), PUSH_TIMEOUT_MS, \"push_timeout\");\n    }\n    return true;\n  } finally {\n    notifyPushSubscriptionChanged();\n  }\n}\n\n/**\n * This browser's push for the signed-in account. Hand it one function per endpoint\n * (§3.8); {@link PushDeviceSetting} draws it, and an app's own card may use it too.\n *\n * **\"Subscribed\" means this account**, not \"this browser holds a subscription\": a\n * browser profile's subscription has no account in it, so a second account in the same\n * profile would read the first's as its own (keksdose). The endpoint is checked against\n * the account's own `devices()`; when that list cannot be read (offline), the browser's\n * answer stands — a wrong \"on\" costs what it did before the check, a wrong \"off\" invites\n * re-subscribing a device that is fine.\n *\n * **A 409 from `register`** — the endpoint belongs to another account, and the server\n * will not re-home what it cannot prove this browser holds — unsubscribes and registers\n * a fresh endpoint, once.\n *\n * **Timeouts:** no registration fails at once and a worker not ready in 10 s fails, both\n * `PushDeviceError(\"no_service_worker\")`; the browser's subscribe and unsubscribe are cut\n * at 15 s, `PushDeviceError(\"push_timeout\")` — so `busy` can never latch.\n *\n * Every mounted hook re-reads its state on {@link PUSH_SUBSCRIPTION_CHANGED}.\n */\nexport function usePushDevice(options: UsePushDeviceOptions): PushDevice {\n  // The app's functions are usually new on every render; the effects read the latest.\n  const latest = useRef(options);\n  useEffect(() => {\n    latest.current = options;\n  });\n\n  const supported = pushSupported();\n  const ios = isIos();\n  const standalone = useMediaQuery(\"(display-mode: standalone)\", false);\n  const installed =\n    standalone ||\n    (typeof navigator !== \"undefined\" && (navigator as Navigator & { standalone?: boolean }).standalone === true);\n\n  const [permission, setPermission] = useState<PushPermission>(() =>\n    supported ? Notification.permission : \"unsupported\",\n  );\n  const [configured, setConfigured] = useState<boolean | undefined>(undefined);\n  const [subscribed, setSubscribed] = useState(false);\n  const [foreignSubscription, setForeignSubscription] = useState(false);\n  const [currentEndpoint, setCurrentEndpoint] = useState<string | null>(null);\n  const [busy, setBusy] = useState(false);\n  const mounted = useRef(true);\n  // Set while this hook fires the event itself: it already knows what changed, and a\n  // re-read could only be worse — an app whose `devices()` answers from a cache would\n  // hand back the list from before the change.\n  const announcing = useRef(false);\n  const announce = useCallback(() => {\n    announcing.current = true;\n    try {\n      notifyPushSubscriptionChanged();\n    } finally {\n      announcing.current = false;\n    }\n    latest.current.onChange?.();\n  }, []);\n  useEffect(() => {\n    mounted.current = true;\n    return () => {\n      mounted.current = false;\n    };\n  }, []);\n\n  // Whether the server has keys (\"\" → push is off there). Once per mount.\n  useEffect(() => {\n    if (!supported) return;\n    let cancelled = false;\n    latest.current.pushKey().then(\n      (key) => {\n        if (!cancelled) setConfigured(key !== \"\");\n      },\n      () => {\n        /* unknown: the card shows the ordinary states */\n      },\n    );\n    return () => {\n      cancelled = true;\n    };\n  }, [supported]);\n\n  // What this browser holds, and whether it is this account's — at mount, and whenever\n  // a subscription changes anywhere in the app.\n  useEffect(() => {\n    if (!supported) return;\n    let cancelled = false;\n    const sync = async () => {\n      try {\n        const registration = await activeRegistration();\n        const existing = await registration.pushManager.getSubscription();\n        if (cancelled) return;\n        // Read again: the person may have changed it in the browser's settings.\n        setPermission(Notification.permission);\n        if (!existing) {\n          setSubscribed(false);\n          setForeignSubscription(false);\n          setCurrentEndpoint(null);\n          return;\n        }\n        let mine: boolean;\n        try {\n          const devices = await latest.current.devices();\n          mine = devices.some((device) => device.endpoint === existing.endpoint);\n        } catch {\n          mine = true;\n        }\n        if (cancelled) return;\n        setCurrentEndpoint(existing.endpoint);\n        setSubscribed(mine);\n        setForeignSubscription(!mine);\n      } catch {\n        /* no active service worker yet: not subscribed */\n      }\n    };\n    const heard = () => {\n      if (!announcing.current) void sync();\n    };\n    // The worker's word after it re-registered a rotated subscription (0.46).\n    const fromWorker = (event: MessageEvent) => {\n      if ((event.data as { type?: unknown } | null)?.type === PUSH_SUBSCRIPTION_CHANGED) void sync();\n    };\n    const worker = navigator.serviceWorker as ServiceWorkerContainer | undefined;\n    void sync();\n    window.addEventListener(PUSH_SUBSCRIPTION_CHANGED, heard);\n    worker?.addEventListener?.(\"message\", fromWorker);\n    return () => {\n      cancelled = true;\n      window.removeEventListener(PUSH_SUBSCRIPTION_CHANGED, heard);\n      worker?.removeEventListener?.(\"message\", fromWorker);\n    };\n  }, [supported]);\n\n  const enable = useCallback(async (): Promise<boolean> => {\n    if (!supported) return false;\n    const { pushKey, register, isEndpointTaken = defaultEndpointTaken } = latest.current;\n    setBusy(true);\n    try {\n      const granted = await Notification.requestPermission();\n      if (mounted.current) setPermission(granted);\n      if (granted !== \"granted\") return false;\n\n      const key = await pushKey();\n      if (!key) {\n        if (mounted.current) setConfigured(false);\n        return false;\n      }\n      if (mounted.current) setConfigured(true);\n\n      const registration = await activeRegistration();\n      // The one place the browser is asked for a subscription, so the timeout and the\n      // `{userVisibleOnly, applicationServerKey}` literal are on both paths.\n      const subscribe = (reuse: boolean) =>\n        within(\n          (async () =>\n            (reuse ? await registration.pushManager.getSubscription() : null) ??\n            (await registration.pushManager.subscribe({\n              userVisibleOnly: true,\n              applicationServerKey: keyBytes(key),\n            })))(),\n          PUSH_TIMEOUT_MS,\n          \"push_timeout\",\n        );\n\n      let subscription = await subscribe(true);\n      let input = inputOf(subscription);\n      if (!input) return false;\n      try {\n        await register(input);\n      } catch (error) {\n        if (!isEndpointTaken(error)) throw error;\n        await within(subscription.unsubscribe(), PUSH_TIMEOUT_MS, \"push_timeout\");\n        subscription = await subscribe(false);\n        input = inputOf(subscription);\n        if (!input) return false;\n        await register(input);\n      }\n      if (mounted.current) {\n        setSubscribed(true);\n        setForeignSubscription(false);\n        setCurrentEndpoint(input.endpoint);\n      }\n      announce();\n      return true;\n    } finally {\n      if (mounted.current) setBusy(false);\n    }\n  }, [supported, announce]);\n\n  const disable = useCallback(async (): Promise<void> => {\n    if (!supported) return;\n    setBusy(true);\n    try {\n      await releaseSubscription((endpoint) => latest.current.unregister(endpoint));\n      if (mounted.current) {\n        setSubscribed(false);\n        setForeignSubscription(false);\n        setCurrentEndpoint(null);\n      }\n      announce();\n    } finally {\n      if (mounted.current) setBusy(false);\n    }\n  }, [supported, announce]);\n\n  const sendTest = useCallback(() => latest.current.test(), []);\n\n  return {\n    supported,\n    configured,\n    installed,\n    ios,\n    permission,\n    subscribed,\n    foreignSubscription,\n    currentEndpoint,\n    busy,\n    enable,\n    disable,\n    sendTest,\n  };\n}\n"],"mappings":";AAAA,SAAS,aAAa,WAAW,QAAQ,gBAAgB;AAEzD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,UAAU,yBAAyB,eAAe;AA4B/E,MAAM,wBAAwB,MAAM;AAAA,EAChC;AAAA,EACT,YAAY,MAA2B;AACrC,UAAM,IAAI;AACV,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAiEO,SAAS,gCAAsC;AACpD,MAAI,OAAO,WAAW,YAAa,QAAO,cAAc,IAAI,MAAM,yBAAyB,CAAC;AAC9F;AAIO,SAAS,gBAAyB;AACvC,SACE,OAAO,WAAW,eAClB,OAAO,cAAc,eACrB,mBAAmB,aACnB,iBAAiB,UACjB,kBAAkB;AAEtB;AAGA,SAAS,QAAiB;AACxB,MAAI,OAAO,cAAc,YAAa,QAAO;AAC7C,QAAM,KAAK,UAAU;AACrB,SAAO,oBAAoB,KAAK,EAAE,KAAM,YAAY,KAAK,EAAE,KAAK,UAAU,iBAAiB;AAC7F;AAEA,MAAM,mBAAmB;AACzB,MAAM,kBAAkB;AAGxB,SAAS,OAAU,SAAqB,IAAY,MAAuC;AACzF,MAAI;AACJ,SAAO,QAAQ,KAAK;AAAA,IAClB;AAAA,IACA,IAAI,QAAe,CAAC,GAAG,WAAW;AAChC,cAAQ,WAAW,MAAM,OAAO,IAAI,gBAAgB,IAAI,CAAC,GAAG,EAAE;AAAA,IAChE,CAAC;AAAA,EACH,CAAC,EAAE,QAAQ,MAAM,aAAa,KAAK,CAAC;AACtC;AAQA,eAAe,qBAAyD;AACtE,QAAM,WAAW,MAAM,UAAU,cAAc,gBAAgB;AAC/D,MAAI,CAAC,SAAU,OAAM,IAAI,gBAAgB,mBAAmB;AAC5D,SAAO,OAAO,UAAU,cAAc,OAAO,kBAAkB,mBAAmB;AACpF;AAEA,MAAM,uBAAuB,CAAC,UAAmB,aAAa,KAAK,MAAM;AAUzE,eAAe,oBAAoB,YAAsE;AACvG,QAAM,eAAe,MAAM,mBAAmB;AAC9C,QAAM,eAAe,MAAM,aAAa,YAAY,gBAAgB;AACpE,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,WAAW,aAAa,QAAQ;AACtC,QAAM,OAAO,aAAa,YAAY,GAAG,iBAAiB,cAAc;AACxE,SAAO;AACT;AAsCA,eAAsB,sBAAsB,YAAsE;AAChH,MAAI,CAAC,cAAc,EAAG,QAAO;AAC7B,MAAI;AACF,UAAM,eAAe,MAAM,UAAU,cAAc,gBAAgB;AAEnE,QAAI,CAAC,cAAc,OAAQ,QAAO;AAClC,UAAM,eAAe,MAAM,aAAa,YAAY,gBAAgB;AACpE,QAAI,CAAC,aAAc,QAAO;AAC1B,QAAI;AACF,YAAM,WAAW,aAAa,QAAQ;AAAA,IACxC,UAAE;AACA,YAAM,OAAO,aAAa,YAAY,GAAG,iBAAiB,cAAc;AAAA,IAC1E;AACA,WAAO;AAAA,EACT,UAAE;AACA,kCAA8B;AAAA,EAChC;AACF;AAuBO,SAAS,cAAc,SAA2C;AAEvE,QAAM,SAAS,OAAO,OAAO;AAC7B,YAAU,MAAM;AACd,WAAO,UAAU;AAAA,EACnB,CAAC;AAED,QAAM,YAAY,cAAc;AAChC,QAAM,MAAM,MAAM;AAClB,QAAM,aAAa,cAAc,8BAA8B,KAAK;AACpE,QAAM,YACJ,cACC,OAAO,cAAc,eAAgB,UAAmD,eAAe;AAE1G,QAAM,CAAC,YAAY,aAAa,IAAI;AAAA,IAAyB,MAC3D,YAAY,aAAa,aAAa;AAAA,EACxC;AACA,QAAM,CAAC,YAAY,aAAa,IAAI,SAA8B,MAAS;AAC3E,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,qBAAqB,sBAAsB,IAAI,SAAS,KAAK;AACpE,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,SAAwB,IAAI;AAC1E,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,OAAO,IAAI;AAI3B,QAAM,aAAa,OAAO,KAAK;AAC/B,QAAM,WAAW,YAAY,MAAM;AACjC,eAAW,UAAU;AACrB,QAAI;AACF,oCAA8B;AAAA,IAChC,UAAE;AACA,iBAAW,UAAU;AAAA,IACvB;AACA,WAAO,QAAQ,WAAW;AAAA,EAC5B,GAAG,CAAC,CAAC;AACL,YAAU,MAAM;AACd,YAAQ,UAAU;AAClB,WAAO,MAAM;AACX,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAGL,YAAU,MAAM;AACd,QAAI,CAAC,UAAW;AAChB,QAAI,YAAY;AAChB,WAAO,QAAQ,QAAQ,EAAE;AAAA,MACvB,CAAC,QAAQ;AACP,YAAI,CAAC,UAAW,eAAc,QAAQ,EAAE;AAAA,MAC1C;AAAA,MACA,MAAM;AAAA,MAEN;AAAA,IACF;AACA,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,SAAS,CAAC;AAId,YAAU,MAAM;AACd,QAAI,CAAC,UAAW;AAChB,QAAI,YAAY;AAChB,UAAM,OAAO,YAAY;AACvB,UAAI;AACF,cAAM,eAAe,MAAM,mBAAmB;AAC9C,cAAM,WAAW,MAAM,aAAa,YAAY,gBAAgB;AAChE,YAAI,UAAW;AAEf,sBAAc,aAAa,UAAU;AACrC,YAAI,CAAC,UAAU;AACb,wBAAc,KAAK;AACnB,iCAAuB,KAAK;AAC5B,6BAAmB,IAAI;AACvB;AAAA,QACF;AACA,YAAI;AACJ,YAAI;AACF,gBAAM,UAAU,MAAM,OAAO,QAAQ,QAAQ;AAC7C,iBAAO,QAAQ,KAAK,CAAC,WAAW,OAAO,aAAa,SAAS,QAAQ;AAAA,QACvE,QAAQ;AACN,iBAAO;AAAA,QACT;AACA,YAAI,UAAW;AACf,2BAAmB,SAAS,QAAQ;AACpC,sBAAc,IAAI;AAClB,+BAAuB,CAAC,IAAI;AAAA,MAC9B,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,QAAQ,MAAM;AAClB,UAAI,CAAC,WAAW,QAAS,MAAK,KAAK;AAAA,IACrC;AAEA,UAAM,aAAa,CAAC,UAAwB;AAC1C,UAAK,MAAM,MAAoC,SAAS,0BAA2B,MAAK,KAAK;AAAA,IAC/F;AACA,UAAM,SAAS,UAAU;AACzB,SAAK,KAAK;AACV,WAAO,iBAAiB,2BAA2B,KAAK;AACxD,YAAQ,mBAAmB,WAAW,UAAU;AAChD,WAAO,MAAM;AACX,kBAAY;AACZ,aAAO,oBAAoB,2BAA2B,KAAK;AAC3D,cAAQ,sBAAsB,WAAW,UAAU;AAAA,IACrD;AAAA,EACF,GAAG,CAAC,SAAS,CAAC;AAEd,QAAM,SAAS,YAAY,YAA8B;AACvD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,EAAE,SAAS,UAAU,kBAAkB,qBAAqB,IAAI,OAAO;AAC7E,YAAQ,IAAI;AACZ,QAAI;AACF,YAAM,UAAU,MAAM,aAAa,kBAAkB;AACrD,UAAI,QAAQ,QAAS,eAAc,OAAO;AAC1C,UAAI,YAAY,UAAW,QAAO;AAElC,YAAM,MAAM,MAAM,QAAQ;AAC1B,UAAI,CAAC,KAAK;AACR,YAAI,QAAQ,QAAS,eAAc,KAAK;AACxC,eAAO;AAAA,MACT;AACA,UAAI,QAAQ,QAAS,eAAc,IAAI;AAEvC,YAAM,eAAe,MAAM,mBAAmB;AAG9C,YAAM,YAAY,CAAC,UACjB;AAAA,SACG,aACE,QAAQ,MAAM,aAAa,YAAY,gBAAgB,IAAI,SAC3D,MAAM,aAAa,YAAY,UAAU;AAAA,UACxC,iBAAiB;AAAA,UACjB,sBAAsB,SAAS,GAAG;AAAA,QACpC,CAAC,GAAI;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAEF,UAAI,eAAe,MAAM,UAAU,IAAI;AACvC,UAAI,QAAQ,QAAQ,YAAY;AAChC,UAAI,CAAC,MAAO,QAAO;AACnB,UAAI;AACF,cAAM,SAAS,KAAK;AAAA,MACtB,SAAS,OAAO;AACd,YAAI,CAAC,gBAAgB,KAAK,EAAG,OAAM;AACnC,cAAM,OAAO,aAAa,YAAY,GAAG,iBAAiB,cAAc;AACxE,uBAAe,MAAM,UAAU,KAAK;AACpC,gBAAQ,QAAQ,YAAY;AAC5B,YAAI,CAAC,MAAO,QAAO;AACnB,cAAM,SAAS,KAAK;AAAA,MACtB;AACA,UAAI,QAAQ,SAAS;AACnB,sBAAc,IAAI;AAClB,+BAAuB,KAAK;AAC5B,2BAAmB,MAAM,QAAQ;AAAA,MACnC;AACA,eAAS;AACT,aAAO;AAAA,IACT,UAAE;AACA,UAAI,QAAQ,QAAS,SAAQ,KAAK;AAAA,IACpC;AAAA,EACF,GAAG,CAAC,WAAW,QAAQ,CAAC;AAExB,QAAM,UAAU,YAAY,YAA2B;AACrD,QAAI,CAAC,UAAW;AAChB,YAAQ,IAAI;AACZ,QAAI;AACF,YAAM,oBAAoB,CAAC,aAAa,OAAO,QAAQ,WAAW,QAAQ,CAAC;AAC3E,UAAI,QAAQ,SAAS;AACnB,sBAAc,KAAK;AACnB,+BAAuB,KAAK;AAC5B,2BAAmB,IAAI;AAAA,MACzB;AACA,eAAS;AAAA,IACX,UAAE;AACA,UAAI,QAAQ,QAAS,SAAQ,KAAK;AAAA,IACpC;AAAA,EACF,GAAG,CAAC,WAAW,QAAQ,CAAC;AAExB,QAAM,WAAW,YAAY,MAAM,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC;AAE5D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/offline/query-persistence.d.ts

@@ -88,7 +88,9 @@ export interface QueryPersistence {
     /** Everything `<PersistQueryClientProvider persistOptions>` needs. */
     persistOptions: Omit<PersistQueryClientOptions, "queryClient">;
     /** Sign-out: stops writing under this key, empties the in-memory cache and deletes this
-     *  key's persisted copy. Best-effort; never throws. */
+     *  key's persisted copy. In every tab (0.52): the persistences of this key in the other tabs
+     *  stop writing too, and delete the key once more after any save of theirs under way.
+     *  Best-effort; never throws. */
     clear: (queryClient: QueryClient) => Promise<void>;
     /** The company switch (or any change of key without a sign-out): stops writing under this
      *  key — a save already scheduled is dropped too — and empties the in-memory cache, so

package/dist/offline/query-persistence.js

@@ -1,6 +1,7 @@
 "use client";
 import { createAsyncStoragePersister } from "@tanstack/query-async-storage-persister";
 import { del, get, keys, set } from "idb-keyval";
+import { listenOn, postOnce } from "../lib/broadcast.js";
 const DEFAULT_SCRUB_FIELDS = Object.freeze([
   "iban",
   "qr_iban",
@@ -78,6 +79,20 @@ function createQueryPersistence({
   const key = `${prefix}${user}${company === void 0 || company === null || company === "" ? "" : `-${company}`}`;
   const denied = new Set(denyRoots);
   let retired = false;
+  const across = `eifi1-query-cache:${key}`;
+  let unlisten = null;
+  const retire = () => {
+    retired = true;
+    unlisten?.();
+    unlisten = null;
+  };
+  const listen = () => {
+    unlisten ??= listenOn(across, (data) => {
+      if (data !== "clear") return;
+      retire();
+      Promise.resolve().then(() => storage.removeItem(key)).catch(() => void 0);
+    });
+  };
   const keyAllowed = (queryKey) => !denied.has(String(queryKey[0])) && (shouldPersistKey ? shouldPersistKey(queryKey) : true);
   const shouldDehydrateQuery = (query) => {
     if (query.state.status !== "success" || !keyAllowed(query.queryKey)) return false;
@@ -136,6 +151,7 @@ function createQueryPersistence({
       // Only the provider's restore reads: mounting this persistence again re-arms it.
       getItem: async (k) => {
         retired = false;
+        listen();
         return await storage.getItem(k) ?? null;
       },
       setItem: async (k, v) => {
@@ -151,14 +167,15 @@ function createQueryPersistence({
     deserialize
   });
   const leave = async (queryClient) => {
-    retired = true;
+    retire();
     try {
       queryClient.clear();
     } catch {
     }
   };
   const clear = async (queryClient) => {
-    retired = true;
+    retire();
+    postOnce(across, "clear");
     try {
       queryClient.clear();
       await persister.removeClient();

package/dist/offline/query-persistence.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/offline/query-persistence.ts"],"sourcesContent":["import { createAsyncStoragePersister } from \"@tanstack/query-async-storage-persister\";\nimport type { QueryClient } from \"@tanstack/react-query\";\nimport type { PersistedClient, PersistQueryClientOptions } from \"@tanstack/react-query-persist-client\";\nimport { del, get, keys, set } from \"idb-keyval\";\n\n/**\n * The persisted TanStack Query cache, keksdose's policy as a kit helper\n * (docs/local-first-harmonization.md §1.5 D4, D5, D7; §1.6). keksdose's\n * shared/state/query-client.ts is the canon: an IndexedDB persister, a deny-list, the\n * plain-JSON guard on write (`shouldDehydrateQuery`) and its twin on restore that keeps\n * paused mutations. On top: a key per account (and company), a scrub list that removes\n * secret fields from payloads that are otherwise wanted offline, and `removeStale` for\n * another account's leftovers.\n *\n * The only module of the kit that imports TanStack and idb-keyval: both are optional peers\n * of `@eifi1/ui-kit/offline` and never reached from the main barrel (packaging-contract).\n */\n\n/** A field name the scrub removes: an exact name, or a pattern (`/^signature_/`). */\nexport type ScrubField = string | RegExp;\n\n/**\n * Removed from every query's data, at any depth, before it is persisted (D4, D7): bank\n * account numbers and the handover protocol's signatures. A page restored offline shows\n * such a field as missing (\"Needs a connection\").\n */\nexport const DEFAULT_SCRUB_FIELDS: readonly ScrubField[] = Object.freeze([\n  \"iban\",\n  \"qr_iban\",\n  \"default_qr_iban\",\n  /^signature_/,\n]);\n\n/** The storage the persister writes to. The default is IndexedDB through idb-keyval. */\nexport interface QueryPersistenceStorage {\n  getItem: (key: string) => Promise<string | null | undefined>;\n  setItem: (key: string, value: string) => Promise<unknown>;\n  removeItem: (key: string) => Promise<unknown>;\n  /** Every key in the store — what `removeStale` walks. */\n  keys: () => Promise<readonly unknown[]>;\n}\n\nexport interface QueryPersistenceOptions {\n  /** The app's name, the key's first part: `kastlan` → `kastlan-query-cache-…`. */\n  app: string;\n  /** The signed-in account. One cache per account (D5). */\n  user: string | number;\n  /** The acting company, where the app has several (kastlan): the switch changes the key,\n   *  so no wipe and no cross-company leak — provided the app switches as\n   *  {@link QueryPersistence.leave} says (leave, then remount the provider per key). */\n  company?: string | number | null;\n  /** The app's own rule, beside `denyRoots` — keksdose denies one exact key and every key\n   *  whose second segment is `\"admin\"`. `false` keeps the query out. */\n  shouldPersistKey?: (queryKey: readonly unknown[]) => boolean;\n  /** Query roots (`queryKey[0]`) that never reach the disk: admin, billing, reports… */\n  denyRoots?: readonly string[];\n  /** Replaces {@link DEFAULT_SCRUB_FIELDS}; spread it to add to it. `[]` scrubs nothing.\n   *  A paused mutation whose variables carry one of these fields is never persisted (a\n   *  scrubbed mutation would send something else), and one an older build wrote is dropped\n   *  on restore. */\n  scrubFields?: readonly ScrubField[];\n  /** Told when a query's data is not plain JSON and is therefore not persisted. Default:\n   *  `console.error`, as keksdose's `cacheSafeOrWarn`. */\n  onUnsafe?: (queryKey: readonly unknown[], data: unknown) => void;\n  /** Changes with each deploy (the app version), so a new build discards the old cache. */\n  buster: string;\n  /** How long a persisted cache is good for, in ms (keksdose: 24 h). The QueryClient's\n   *  `gcTime` must be at least this, or restore drops every query. */\n  maxAge: number;\n  /** Default: IndexedDB (idb-keyval). Tests pass an in-memory one. */\n  storage?: QueryPersistenceStorage;\n  /** Default 1000 ms, as keksdose. */\n  throttleTime?: number;\n  /**\n   * 0.46 (kastlan K1): whether paused mutations are written with the cache. Default `true`\n   * (keksdose: an offline write waits in TanStack's queue and is sent after a reload).\n   * `false` keeps every mutation off the disk, and drops any an older build wrote on\n   * restore — for an app that queues offline writes in its own outbox (kastlan's Dexie\n   * outbox), instead of overriding `dehydrateOptions` by hand.\n   */\n  persistMutations?: boolean;\n}\n\n/**\n * One persisted cache, for one key. **Mount it per key**: the provider subscribes once and\n * ignores a changed `persistOptions`, so give it the key as its React key —\n *\n * ```tsx\n * <PersistQueryClientProvider key={persistence.key} client={queryClient} persistOptions={persistence.persistOptions}>\n * ```\n *\n * — and create the persistence once the account (and company) is known (`useMemo` on\n * them); before sign-in, mount the plain `QueryClientProvider`. On a company switch, call\n * {@link QueryPersistence.leave} on the old one BEFORE the new key mounts, instead of a bare\n * `queryClient.clear()`: otherwise the old subscription saves the emptied (or the next\n * company's) cache under the old key.\n */\nexport interface QueryPersistence {\n  /** `<app>-query-cache-<user>[-<company>]`. */\n  key: string;\n  /** Everything `<PersistQueryClientProvider persistOptions>` needs. */\n  persistOptions: Omit<PersistQueryClientOptions, \"queryClient\">;\n  /** Sign-out: stops writing under this key, empties the in-memory cache and deletes this\n   *  key's persisted copy. Best-effort; never throws. */\n  clear: (queryClient: QueryClient) => Promise<void>;\n  /** The company switch (or any change of key without a sign-out): stops writing under this\n   *  key — a save already scheduled is dropped too — and empties the in-memory cache, so\n   *  the next key's provider starts clean. The persisted copy stays for the way back. A\n   *  provider that mounts this persistence again re-arms it with its restore. Never throws. */\n  leave: (queryClient: QueryClient) => Promise<void>;\n  /** At sign-in: deletes this app's OTHER persisted caches older than `maxAge` (another\n   *  account's, another company's). Other apps' keys and fresh ones stay. Never throws. */\n  removeStale: () => Promise<void>;\n}\n\nconst idbStorage: QueryPersistenceStorage = {\n  getItem: (key) => get<string>(key),\n  setItem: (key, value) => set(key, value),\n  removeItem: (key) => del(key),\n  keys: () => keys(),\n};\n\nexport interface RemoveStaleQueryCopiesOptions {\n  /** Default: IndexedDB (idb-keyval), the store {@link createQueryPersistence} writes to. */\n  storage?: QueryPersistenceStorage;\n  /** One key to spare whatever its age — the signed-in account's own\n   *  (`QueryPersistence.removeStale` passes its key). */\n  keep?: string;\n}\n\n/**\n * 0.46 (kastlan K2): deletes this app's persisted query caches (`<app>-query-cache-…`)\n * older than `maxAge`, with no persistence at hand — for the sign-in page, where no\n * account is known. A session that ended with no user known (a refresh token refused at\n * boot) cannot name its key for `clear`; this sweeps its copy once it is stale, without\n * waiting for someone's next sign-in. Other apps' keys, other stores' keys and fresh\n * caches stay; an unreadable one is stale. Never throws.\n * {@link QueryPersistence.removeStale} is this with `keep` = its own key.\n */\nexport async function removeStaleQueryCopies(\n  app: string,\n  maxAge: number,\n  { storage = idbStorage, keep }: RemoveStaleQueryCopiesOptions = {},\n): Promise<void> {\n  const prefix = `${app}-query-cache-`;\n  try {\n    const now = Date.now();\n    for (const k of await storage.keys()) {\n      if (typeof k !== \"string\" || !k.startsWith(prefix) || k === keep) continue;\n      let timestamp = 0;\n      try {\n        const raw = await storage.getItem(k);\n        const parsed: unknown = raw ? JSON.parse(raw) : null;\n        if (parsed && typeof parsed === \"object\" && typeof (parsed as PersistedClient).timestamp === \"number\") {\n          timestamp = (parsed as PersistedClient).timestamp;\n        }\n      } catch {\n        /* unreadable: stale */\n      }\n      if (now - timestamp > maxAge) await storage.removeItem(k);\n    }\n  } catch {\n    /* best-effort */\n  }\n}\n\n/**\n * True when `data` still means the same thing after JSON.stringify and JSON.parse —\n * keksdose's `isCacheSafe` (query-client.ts:165). Class instances, Map/Set/Date/Blob, a\n * non-finite number, a function: all refused. An `undefined` property survives.\n */\nexport function isCacheSafe(data: unknown, depth = 0): boolean {\n  if (depth > 12) return false;\n  if (data === null) return true;\n  const t = typeof data;\n  if (t === \"string\" || t === \"boolean\") return true;\n  if (t === \"number\") return Number.isFinite(data as number);\n  if (t !== \"object\") return false;\n  if (Array.isArray(data)) return data.every((v) => isCacheSafe(v, depth + 1));\n  const proto: unknown = Object.getPrototypeOf(data);\n  if (proto !== Object.prototype && proto !== null) return false;\n  return Object.values(data as Record<string, unknown>).every((v) => v === undefined || isCacheSafe(v, depth + 1));\n}\n\n/** A copy of `data` without the scrubbed fields, at any depth. The input is not touched. */\nfunction scrub(data: unknown, fields: readonly ScrubField[]): unknown {\n  if (fields.length === 0 || data === null || typeof data !== \"object\") return data;\n  if (Array.isArray(data)) return data.map((v) => scrub(v, fields));\n  const out: Record<string, unknown> = {};\n  for (const [name, value] of Object.entries(data as Record<string, unknown>)) {\n    if (fields.some((f) => (typeof f === \"string\" ? f === name : f.test(name)))) continue;\n    out[name] = scrub(value, fields);\n  }\n  return out;\n}\n\nconst defaultOnUnsafe = (queryKey: readonly unknown[]) => {\n  console.error(\n    `[query-cache] refusing to persist ${JSON.stringify(queryKey)}: the value is not plain JSON ` +\n      `(a class instance, Map, Set, Date or Blob). Return plain data from the queryFn and build ` +\n      `the rich object at the call site.`,\n  );\n};\n\nexport function createQueryPersistence({\n  app,\n  user,\n  company,\n  shouldPersistKey,\n  denyRoots = [],\n  scrubFields = DEFAULT_SCRUB_FIELDS,\n  onUnsafe = defaultOnUnsafe,\n  buster,\n  maxAge,\n  storage = idbStorage,\n  throttleTime = 1000,\n  persistMutations = true,\n}: QueryPersistenceOptions): QueryPersistence {\n  const prefix = `${app}-query-cache-`;\n  const key = `${prefix}${user}${company === undefined || company === null || company === \"\" ? \"\" : `-${company}`}`;\n  const denied = new Set(denyRoots);\n  // Set by `leave` and `clear`: a write under this key after the person left it (a\n  // throttled save of the emptied cache) is dropped. A restore re-arms it.\n  let retired = false;\n\n  const keyAllowed = (queryKey: readonly unknown[]) =>\n    !denied.has(String(queryKey[0])) && (shouldPersistKey ? shouldPersistKey(queryKey) : true);\n\n  /** The write side: a success, an allowed key, plain JSON (or the warning). */\n  const shouldDehydrateQuery = (query: {\n    queryKey: readonly unknown[];\n    state: { status: string; data?: unknown };\n  }): boolean => {\n    if (query.state.status !== \"success\" || !keyAllowed(query.queryKey)) return false;\n    if (isCacheSafe(query.state.data)) return true;\n    onUnsafe(query.queryKey, query.state.data);\n    return false;\n  };\n\n  /** One persisted query entry, scrubbed; `null` when it may not be restored. */\n  const restorable = (entry: unknown): unknown => {\n    if (!entry || typeof entry !== \"object\") return null;\n    const { queryKey, state } = entry as { queryKey?: unknown; state?: { data?: unknown } };\n    if (!Array.isArray(queryKey) || !keyAllowed(queryKey)) return null;\n    if (!isCacheSafe(state?.data)) return null;\n    return withScrubbedData(entry);\n  };\n\n  /** Whether `value` has a scrubbed field's name anywhere in it. */\n  const carriesScrubbed = (value: unknown, depth = 0): boolean => {\n    if (scrubFields.length === 0 || depth > 12 || value === null || typeof value !== \"object\") return false;\n    if (Array.isArray(value)) return value.some((v) => carriesScrubbed(v, depth + 1));\n    return Object.entries(value as Record<string, unknown>).some(\n      ([name, v]) =>\n        scrubFields.some((f) => (typeof f === \"string\" ? f === name : f.test(name))) || carriesScrubbed(v, depth + 1),\n    );\n  };\n\n  /** The write side for mutations: TanStack's default (paused ones), minus any whose\n   *  variables carry a scrubbed field (S6); none at all with `persistMutations: false`. */\n  const shouldDehydrateMutation = (mutation: { state: { isPaused: boolean; variables?: unknown } }): boolean =>\n    persistMutations && mutation.state.isPaused && !carriesScrubbed(mutation.state.variables);\n\n  const withScrubbedData = (entry: unknown): unknown => {\n    const query = entry as { state?: { data?: unknown } };\n    if (!query.state || !(\"data\" in query.state)) return entry;\n    return { ...query, state: { ...query.state, data: scrub(query.state.data, scrubFields) } };\n  };\n\n  // The scrub on the way OUT: the in-memory cache keeps the field (the page that is open\n  // shows it), the disk never sees it. Mutations are a paused write queue and are kept\n  // whole — scrubbing one would change what it sends — so one carrying a scrubbed field is\n  // not written at all (`shouldDehydrateMutation`).\n  const serialize = (client: PersistedClient): string =>\n    JSON.stringify({\n      ...client,\n      clientState: { ...client.clientState, queries: client.clientState.queries.map(withScrubbedData) },\n    });\n\n  // The twin on the way IN (keksdose's `sanitizePersistedCache`, :264-298): an older build\n  // wrote what this one may deny. Never throws; an unreadable blob comes back with\n  // `timestamp: 0`, which the restore treats as unusable and removes.\n  const deserialize = (raw: string): PersistedClient => {\n    const empty: PersistedClient = { timestamp: 0, buster: \"\", clientState: { mutations: [], queries: [] } };\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (!parsed || typeof parsed !== \"object\") return empty;\n      const { timestamp, buster: stored, clientState } = parsed as Partial<PersistedClient>;\n      if (typeof timestamp !== \"number\" || typeof stored !== \"string\") return empty;\n      if (!clientState || typeof clientState !== \"object\" || !Array.isArray(clientState.queries)) return empty;\n      return {\n        timestamp,\n        buster: stored,\n        clientState: {\n          mutations:\n            persistMutations && Array.isArray(clientState.mutations)\n              ? clientState.mutations.filter(\n                  (m) => !carriesScrubbed((m as { state?: { variables?: unknown } } | null)?.state?.variables),\n                )\n              : [],\n          queries: clientState.queries\n            .map(restorable)\n            .filter((q) => q !== null) as PersistedClient[\"clientState\"][\"queries\"],\n        },\n      };\n    } catch {\n      return empty;\n    }\n  };\n\n  const persister = createAsyncStoragePersister({\n    storage: {\n      // Only the provider's restore reads: mounting this persistence again re-arms it.\n      getItem: async (k) => {\n        retired = false;\n        return (await storage.getItem(k)) ?? null;\n      },\n      setItem: async (k, v) => {\n        if (!retired) await storage.setItem(k, v);\n      },\n      removeItem: async (k) => {\n        await storage.removeItem(k);\n      },\n    },\n    key,\n    throttleTime,\n    serialize,\n    deserialize,\n  });\n\n  const leave = async (queryClient: QueryClient) => {\n    retired = true;\n    try {\n      queryClient.clear();\n    } catch {\n      /* best-effort */\n    }\n  };\n\n  const clear = async (queryClient: QueryClient) => {\n    retired = true;\n    try {\n      queryClient.clear();\n      await persister.removeClient();\n    } catch {\n      /* best-effort: private mode / IndexedDB unavailable */\n    }\n  };\n\n  const removeStale = () => removeStaleQueryCopies(app, maxAge, { storage, keep: key });\n\n  return {\n    key,\n    persistOptions: { persister, maxAge, buster, dehydrateOptions: { shouldDehydrateQuery, shouldDehydrateMutation } },\n    clear,\n    leave,\n    removeStale,\n  };\n}\n"],"mappings":";AAAA,SAAS,mCAAmC;AAG5C,SAAS,KAAK,KAAK,MAAM,WAAW;AAuB7B,MAAM,uBAA8C,OAAO,OAAO;AAAA,EACvE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAoFD,MAAM,aAAsC;AAAA,EAC1C,SAAS,CAAC,QAAQ,IAAY,GAAG;AAAA,EACjC,SAAS,CAAC,KAAK,UAAU,IAAI,KAAK,KAAK;AAAA,EACvC,YAAY,CAAC,QAAQ,IAAI,GAAG;AAAA,EAC5B,MAAM,MAAM,KAAK;AACnB;AAmBA,eAAsB,uBACpB,KACA,QACA,EAAE,UAAU,YAAY,KAAK,IAAmC,CAAC,GAClD;AACf,QAAM,SAAS,GAAG,GAAG;AACrB,MAAI;AACF,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,KAAK,MAAM,QAAQ,KAAK,GAAG;AACpC,UAAI,OAAO,MAAM,YAAY,CAAC,EAAE,WAAW,MAAM,KAAK,MAAM,KAAM;AAClE,UAAI,YAAY;AAChB,UAAI;AACF,cAAM,MAAM,MAAM,QAAQ,QAAQ,CAAC;AACnC,cAAM,SAAkB,MAAM,KAAK,MAAM,GAAG,IAAI;AAChD,YAAI,UAAU,OAAO,WAAW,YAAY,OAAQ,OAA2B,cAAc,UAAU;AACrG,sBAAa,OAA2B;AAAA,QAC1C;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI,MAAM,YAAY,OAAQ,OAAM,QAAQ,WAAW,CAAC;AAAA,IAC1D;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAOO,SAAS,YAAY,MAAe,QAAQ,GAAY;AAC7D,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,UAAW,QAAO;AAC9C,MAAI,MAAM,SAAU,QAAO,OAAO,SAAS,IAAc;AACzD,MAAI,MAAM,SAAU,QAAO;AAC3B,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC;AAC3E,QAAM,QAAiB,OAAO,eAAe,IAAI;AACjD,MAAI,UAAU,OAAO,aAAa,UAAU,KAAM,QAAO;AACzD,SAAO,OAAO,OAAO,IAA+B,EAAE,MAAM,CAAC,MAAM,MAAM,UAAa,YAAY,GAAG,QAAQ,CAAC,CAAC;AACjH;AAGA,SAAS,MAAM,MAAe,QAAwC;AACpE,MAAI,OAAO,WAAW,KAAK,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC7E,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,IAAI,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC;AAChE,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,QAAI,OAAO,KAAK,CAAC,MAAO,OAAO,MAAM,WAAW,MAAM,OAAO,EAAE,KAAK,IAAI,CAAE,EAAG;AAC7E,QAAI,IAAI,IAAI,MAAM,OAAO,MAAM;AAAA,EACjC;AACA,SAAO;AACT;AAEA,MAAM,kBAAkB,CAAC,aAAiC;AACxD,UAAQ;AAAA,IACN,qCAAqC,KAAK,UAAU,QAAQ,CAAC;AAAA,EAG/D;AACF;AAEO,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY,CAAC;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,eAAe;AAAA,EACf,mBAAmB;AACrB,GAA8C;AAC5C,QAAM,SAAS,GAAG,GAAG;AACrB,QAAM,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,YAAY,UAAa,YAAY,QAAQ,YAAY,KAAK,KAAK,IAAI,OAAO,EAAE;AAC/G,QAAM,SAAS,IAAI,IAAI,SAAS;AAGhC,MAAI,UAAU;AAEd,QAAM,aAAa,CAAC,aAClB,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,mBAAmB,iBAAiB,QAAQ,IAAI;AAGvF,QAAM,uBAAuB,CAAC,UAGf;AACb,QAAI,MAAM,MAAM,WAAW,aAAa,CAAC,WAAW,MAAM,QAAQ,EAAG,QAAO;AAC5E,QAAI,YAAY,MAAM,MAAM,IAAI,EAAG,QAAO;AAC1C,aAAS,MAAM,UAAU,MAAM,MAAM,IAAI;AACzC,WAAO;AAAA,EACT;AAGA,QAAM,aAAa,CAAC,UAA4B;AAC9C,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,UAAM,EAAE,UAAU,MAAM,IAAI;AAC5B,QAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,CAAC,WAAW,QAAQ,EAAG,QAAO;AAC9D,QAAI,CAAC,YAAY,OAAO,IAAI,EAAG,QAAO;AACtC,WAAO,iBAAiB,KAAK;AAAA,EAC/B;AAGA,QAAM,kBAAkB,CAAC,OAAgB,QAAQ,MAAe;AAC9D,QAAI,YAAY,WAAW,KAAK,QAAQ,MAAM,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAClG,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,KAAK,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC;AAChF,WAAO,OAAO,QAAQ,KAAgC,EAAE;AAAA,MACtD,CAAC,CAAC,MAAM,CAAC,MACP,YAAY,KAAK,CAAC,MAAO,OAAO,MAAM,WAAW,MAAM,OAAO,EAAE,KAAK,IAAI,CAAE,KAAK,gBAAgB,GAAG,QAAQ,CAAC;AAAA,IAChH;AAAA,EACF;AAIA,QAAM,0BAA0B,CAAC,aAC/B,oBAAoB,SAAS,MAAM,YAAY,CAAC,gBAAgB,SAAS,MAAM,SAAS;AAE1F,QAAM,mBAAmB,CAAC,UAA4B;AACpD,UAAM,QAAQ;AACd,QAAI,CAAC,MAAM,SAAS,EAAE,UAAU,MAAM,OAAQ,QAAO;AACrD,WAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,WAAW,EAAE,EAAE;AAAA,EAC3F;AAMA,QAAM,YAAY,CAAC,WACjB,KAAK,UAAU;AAAA,IACb,GAAG;AAAA,IACH,aAAa,EAAE,GAAG,OAAO,aAAa,SAAS,OAAO,YAAY,QAAQ,IAAI,gBAAgB,EAAE;AAAA,EAClG,CAAC;AAKH,QAAM,cAAc,CAAC,QAAiC;AACpD,UAAM,QAAyB,EAAE,WAAW,GAAG,QAAQ,IAAI,aAAa,EAAE,WAAW,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE;AACvG,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,YAAM,EAAE,WAAW,QAAQ,QAAQ,YAAY,IAAI;AACnD,UAAI,OAAO,cAAc,YAAY,OAAO,WAAW,SAAU,QAAO;AACxE,UAAI,CAAC,eAAe,OAAO,gBAAgB,YAAY,CAAC,MAAM,QAAQ,YAAY,OAAO,EAAG,QAAO;AACnG,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR,aAAa;AAAA,UACX,WACE,oBAAoB,MAAM,QAAQ,YAAY,SAAS,IACnD,YAAY,UAAU;AAAA,YACpB,CAAC,MAAM,CAAC,gBAAiB,GAAkD,OAAO,SAAS;AAAA,UAC7F,IACA,CAAC;AAAA,UACP,SAAS,YAAY,QAClB,IAAI,UAAU,EACd,OAAO,CAAC,MAAM,MAAM,IAAI;AAAA,QAC7B;AAAA,MACF;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,YAAY,4BAA4B;AAAA,IAC5C,SAAS;AAAA;AAAA,MAEP,SAAS,OAAO,MAAM;AACpB,kBAAU;AACV,eAAQ,MAAM,QAAQ,QAAQ,CAAC,KAAM;AAAA,MACvC;AAAA,MACA,SAAS,OAAO,GAAG,MAAM;AACvB,YAAI,CAAC,QAAS,OAAM,QAAQ,QAAQ,GAAG,CAAC;AAAA,MAC1C;AAAA,MACA,YAAY,OAAO,MAAM;AACvB,cAAM,QAAQ,WAAW,CAAC;AAAA,MAC5B;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,gBAA6B;AAChD,cAAU;AACV,QAAI;AACF,kBAAY,MAAM;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,gBAA6B;AAChD,cAAU;AACV,QAAI;AACF,kBAAY,MAAM;AAClB,YAAM,UAAU,aAAa;AAAA,IAC/B,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,uBAAuB,KAAK,QAAQ,EAAE,SAAS,MAAM,IAAI,CAAC;AAEpF,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,EAAE,WAAW,QAAQ,QAAQ,kBAAkB,EAAE,sBAAsB,wBAAwB,EAAE;AAAA,IACjH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/offline/query-persistence.ts"],"sourcesContent":["import { createAsyncStoragePersister } from \"@tanstack/query-async-storage-persister\";\nimport type { QueryClient } from \"@tanstack/react-query\";\nimport type { PersistedClient, PersistQueryClientOptions } from \"@tanstack/react-query-persist-client\";\nimport { del, get, keys, set } from \"idb-keyval\";\nimport { listenOn, postOnce } from \"../lib/broadcast\";\n\n/**\n * The persisted TanStack Query cache, keksdose's policy as a kit helper\n * (docs/local-first-harmonization.md §1.5 D4, D5, D7; §1.6). keksdose's\n * shared/state/query-client.ts is the canon: an IndexedDB persister, a deny-list, the\n * plain-JSON guard on write (`shouldDehydrateQuery`) and its twin on restore that keeps\n * paused mutations. On top: a key per account (and company), a scrub list that removes\n * secret fields from payloads that are otherwise wanted offline, and `removeStale` for\n * another account's leftovers.\n *\n * The only module of the kit that imports TanStack and idb-keyval: both are optional peers\n * of `@eifi1/ui-kit/offline` and never reached from the main barrel (packaging-contract).\n */\n\n/** A field name the scrub removes: an exact name, or a pattern (`/^signature_/`). */\nexport type ScrubField = string | RegExp;\n\n/**\n * Removed from every query's data, at any depth, before it is persisted (D4, D7): bank\n * account numbers and the handover protocol's signatures. A page restored offline shows\n * such a field as missing (\"Needs a connection\").\n */\nexport const DEFAULT_SCRUB_FIELDS: readonly ScrubField[] = Object.freeze([\n  \"iban\",\n  \"qr_iban\",\n  \"default_qr_iban\",\n  /^signature_/,\n]);\n\n/** The storage the persister writes to. The default is IndexedDB through idb-keyval. */\nexport interface QueryPersistenceStorage {\n  getItem: (key: string) => Promise<string | null | undefined>;\n  setItem: (key: string, value: string) => Promise<unknown>;\n  removeItem: (key: string) => Promise<unknown>;\n  /** Every key in the store — what `removeStale` walks. */\n  keys: () => Promise<readonly unknown[]>;\n}\n\nexport interface QueryPersistenceOptions {\n  /** The app's name, the key's first part: `kastlan` → `kastlan-query-cache-…`. */\n  app: string;\n  /** The signed-in account. One cache per account (D5). */\n  user: string | number;\n  /** The acting company, where the app has several (kastlan): the switch changes the key,\n   *  so no wipe and no cross-company leak — provided the app switches as\n   *  {@link QueryPersistence.leave} says (leave, then remount the provider per key). */\n  company?: string | number | null;\n  /** The app's own rule, beside `denyRoots` — keksdose denies one exact key and every key\n   *  whose second segment is `\"admin\"`. `false` keeps the query out. */\n  shouldPersistKey?: (queryKey: readonly unknown[]) => boolean;\n  /** Query roots (`queryKey[0]`) that never reach the disk: admin, billing, reports… */\n  denyRoots?: readonly string[];\n  /** Replaces {@link DEFAULT_SCRUB_FIELDS}; spread it to add to it. `[]` scrubs nothing.\n   *  A paused mutation whose variables carry one of these fields is never persisted (a\n   *  scrubbed mutation would send something else), and one an older build wrote is dropped\n   *  on restore. */\n  scrubFields?: readonly ScrubField[];\n  /** Told when a query's data is not plain JSON and is therefore not persisted. Default:\n   *  `console.error`, as keksdose's `cacheSafeOrWarn`. */\n  onUnsafe?: (queryKey: readonly unknown[], data: unknown) => void;\n  /** Changes with each deploy (the app version), so a new build discards the old cache. */\n  buster: string;\n  /** How long a persisted cache is good for, in ms (keksdose: 24 h). The QueryClient's\n   *  `gcTime` must be at least this, or restore drops every query. */\n  maxAge: number;\n  /** Default: IndexedDB (idb-keyval). Tests pass an in-memory one. */\n  storage?: QueryPersistenceStorage;\n  /** Default 1000 ms, as keksdose. */\n  throttleTime?: number;\n  /**\n   * 0.46 (kastlan K1): whether paused mutations are written with the cache. Default `true`\n   * (keksdose: an offline write waits in TanStack's queue and is sent after a reload).\n   * `false` keeps every mutation off the disk, and drops any an older build wrote on\n   * restore — for an app that queues offline writes in its own outbox (kastlan's Dexie\n   * outbox), instead of overriding `dehydrateOptions` by hand.\n   */\n  persistMutations?: boolean;\n}\n\n/**\n * One persisted cache, for one key. **Mount it per key**: the provider subscribes once and\n * ignores a changed `persistOptions`, so give it the key as its React key —\n *\n * ```tsx\n * <PersistQueryClientProvider key={persistence.key} client={queryClient} persistOptions={persistence.persistOptions}>\n * ```\n *\n * — and create the persistence once the account (and company) is known (`useMemo` on\n * them); before sign-in, mount the plain `QueryClientProvider`. On a company switch, call\n * {@link QueryPersistence.leave} on the old one BEFORE the new key mounts, instead of a bare\n * `queryClient.clear()`: otherwise the old subscription saves the emptied (or the next\n * company's) cache under the old key.\n */\nexport interface QueryPersistence {\n  /** `<app>-query-cache-<user>[-<company>]`. */\n  key: string;\n  /** Everything `<PersistQueryClientProvider persistOptions>` needs. */\n  persistOptions: Omit<PersistQueryClientOptions, \"queryClient\">;\n  /** Sign-out: stops writing under this key, empties the in-memory cache and deletes this\n   *  key's persisted copy. In every tab (0.52): the persistences of this key in the other tabs\n   *  stop writing too, and delete the key once more after any save of theirs under way.\n   *  Best-effort; never throws. */\n  clear: (queryClient: QueryClient) => Promise<void>;\n  /** The company switch (or any change of key without a sign-out): stops writing under this\n   *  key — a save already scheduled is dropped too — and empties the in-memory cache, so\n   *  the next key's provider starts clean. The persisted copy stays for the way back. A\n   *  provider that mounts this persistence again re-arms it with its restore. Never throws. */\n  leave: (queryClient: QueryClient) => Promise<void>;\n  /** At sign-in: deletes this app's OTHER persisted caches older than `maxAge` (another\n   *  account's, another company's). Other apps' keys and fresh ones stay. Never throws. */\n  removeStale: () => Promise<void>;\n}\n\nconst idbStorage: QueryPersistenceStorage = {\n  getItem: (key) => get<string>(key),\n  setItem: (key, value) => set(key, value),\n  removeItem: (key) => del(key),\n  keys: () => keys(),\n};\n\nexport interface RemoveStaleQueryCopiesOptions {\n  /** Default: IndexedDB (idb-keyval), the store {@link createQueryPersistence} writes to. */\n  storage?: QueryPersistenceStorage;\n  /** One key to spare whatever its age — the signed-in account's own\n   *  (`QueryPersistence.removeStale` passes its key). */\n  keep?: string;\n}\n\n/**\n * 0.46 (kastlan K2): deletes this app's persisted query caches (`<app>-query-cache-…`)\n * older than `maxAge`, with no persistence at hand — for the sign-in page, where no\n * account is known. A session that ended with no user known (a refresh token refused at\n * boot) cannot name its key for `clear`; this sweeps its copy once it is stale, without\n * waiting for someone's next sign-in. Other apps' keys, other stores' keys and fresh\n * caches stay; an unreadable one is stale. Never throws.\n * {@link QueryPersistence.removeStale} is this with `keep` = its own key.\n */\nexport async function removeStaleQueryCopies(\n  app: string,\n  maxAge: number,\n  { storage = idbStorage, keep }: RemoveStaleQueryCopiesOptions = {},\n): Promise<void> {\n  const prefix = `${app}-query-cache-`;\n  try {\n    const now = Date.now();\n    for (const k of await storage.keys()) {\n      if (typeof k !== \"string\" || !k.startsWith(prefix) || k === keep) continue;\n      let timestamp = 0;\n      try {\n        const raw = await storage.getItem(k);\n        const parsed: unknown = raw ? JSON.parse(raw) : null;\n        if (parsed && typeof parsed === \"object\" && typeof (parsed as PersistedClient).timestamp === \"number\") {\n          timestamp = (parsed as PersistedClient).timestamp;\n        }\n      } catch {\n        /* unreadable: stale */\n      }\n      if (now - timestamp > maxAge) await storage.removeItem(k);\n    }\n  } catch {\n    /* best-effort */\n  }\n}\n\n/**\n * True when `data` still means the same thing after JSON.stringify and JSON.parse —\n * keksdose's `isCacheSafe` (query-client.ts:165). Class instances, Map/Set/Date/Blob, a\n * non-finite number, a function: all refused. An `undefined` property survives.\n */\nexport function isCacheSafe(data: unknown, depth = 0): boolean {\n  if (depth > 12) return false;\n  if (data === null) return true;\n  const t = typeof data;\n  if (t === \"string\" || t === \"boolean\") return true;\n  if (t === \"number\") return Number.isFinite(data as number);\n  if (t !== \"object\") return false;\n  if (Array.isArray(data)) return data.every((v) => isCacheSafe(v, depth + 1));\n  const proto: unknown = Object.getPrototypeOf(data);\n  if (proto !== Object.prototype && proto !== null) return false;\n  return Object.values(data as Record<string, unknown>).every((v) => v === undefined || isCacheSafe(v, depth + 1));\n}\n\n/** A copy of `data` without the scrubbed fields, at any depth. The input is not touched. */\nfunction scrub(data: unknown, fields: readonly ScrubField[]): unknown {\n  if (fields.length === 0 || data === null || typeof data !== \"object\") return data;\n  if (Array.isArray(data)) return data.map((v) => scrub(v, fields));\n  const out: Record<string, unknown> = {};\n  for (const [name, value] of Object.entries(data as Record<string, unknown>)) {\n    if (fields.some((f) => (typeof f === \"string\" ? f === name : f.test(name)))) continue;\n    out[name] = scrub(value, fields);\n  }\n  return out;\n}\n\nconst defaultOnUnsafe = (queryKey: readonly unknown[]) => {\n  console.error(\n    `[query-cache] refusing to persist ${JSON.stringify(queryKey)}: the value is not plain JSON ` +\n      `(a class instance, Map, Set, Date or Blob). Return plain data from the queryFn and build ` +\n      `the rich object at the call site.`,\n  );\n};\n\nexport function createQueryPersistence({\n  app,\n  user,\n  company,\n  shouldPersistKey,\n  denyRoots = [],\n  scrubFields = DEFAULT_SCRUB_FIELDS,\n  onUnsafe = defaultOnUnsafe,\n  buster,\n  maxAge,\n  storage = idbStorage,\n  throttleTime = 1000,\n  persistMutations = true,\n}: QueryPersistenceOptions): QueryPersistence {\n  const prefix = `${app}-query-cache-`;\n  const key = `${prefix}${user}${company === undefined || company === null || company === \"\" ? \"\" : `-${company}`}`;\n  const denied = new Set(denyRoots);\n  // Set by `leave` and `clear`: a write under this key after the person left it (a\n  // throttled save of the emptied cache) is dropped. A restore re-arms it.\n  let retired = false;\n\n  // 0.52 (refactor audit 2026-10-30, FLW-1): `retired` lived in this tab alone, so a sign-out\n  // in one tab deleted the key and another tab's persister wrote its in-memory cache straight\n  // back under it. While armed, a persistence listens on a channel named after its key; a\n  // `clear` there retires it, and it deletes the key once more — IndexedDB runs a save of its\n  // own already under way first. A `leave` posts nothing: another tab may still be on that\n  // company. Without BroadcastChannel, as before 0.52.\n  const across = `eifi1-query-cache:${key}`;\n  let unlisten: (() => void) | null = null;\n\n  const retire = () => {\n    retired = true;\n    unlisten?.();\n    unlisten = null;\n  };\n\n  const listen = () => {\n    unlisten ??= listenOn(across, (data) => {\n      if (data !== \"clear\") return;\n      retire();\n      Promise.resolve()\n        .then(() => storage.removeItem(key))\n        .catch(() => undefined);\n    });\n  };\n\n  const keyAllowed = (queryKey: readonly unknown[]) =>\n    !denied.has(String(queryKey[0])) && (shouldPersistKey ? shouldPersistKey(queryKey) : true);\n\n  /** The write side: a success, an allowed key, plain JSON (or the warning). */\n  const shouldDehydrateQuery = (query: {\n    queryKey: readonly unknown[];\n    state: { status: string; data?: unknown };\n  }): boolean => {\n    if (query.state.status !== \"success\" || !keyAllowed(query.queryKey)) return false;\n    if (isCacheSafe(query.state.data)) return true;\n    onUnsafe(query.queryKey, query.state.data);\n    return false;\n  };\n\n  /** One persisted query entry, scrubbed; `null` when it may not be restored. */\n  const restorable = (entry: unknown): unknown => {\n    if (!entry || typeof entry !== \"object\") return null;\n    const { queryKey, state } = entry as { queryKey?: unknown; state?: { data?: unknown } };\n    if (!Array.isArray(queryKey) || !keyAllowed(queryKey)) return null;\n    if (!isCacheSafe(state?.data)) return null;\n    return withScrubbedData(entry);\n  };\n\n  /** Whether `value` has a scrubbed field's name anywhere in it. */\n  const carriesScrubbed = (value: unknown, depth = 0): boolean => {\n    if (scrubFields.length === 0 || depth > 12 || value === null || typeof value !== \"object\") return false;\n    if (Array.isArray(value)) return value.some((v) => carriesScrubbed(v, depth + 1));\n    return Object.entries(value as Record<string, unknown>).some(\n      ([name, v]) =>\n        scrubFields.some((f) => (typeof f === \"string\" ? f === name : f.test(name))) || carriesScrubbed(v, depth + 1),\n    );\n  };\n\n  /** The write side for mutations: TanStack's default (paused ones), minus any whose\n   *  variables carry a scrubbed field (S6); none at all with `persistMutations: false`. */\n  const shouldDehydrateMutation = (mutation: { state: { isPaused: boolean; variables?: unknown } }): boolean =>\n    persistMutations && mutation.state.isPaused && !carriesScrubbed(mutation.state.variables);\n\n  const withScrubbedData = (entry: unknown): unknown => {\n    const query = entry as { state?: { data?: unknown } };\n    if (!query.state || !(\"data\" in query.state)) return entry;\n    return { ...query, state: { ...query.state, data: scrub(query.state.data, scrubFields) } };\n  };\n\n  // The scrub on the way OUT: the in-memory cache keeps the field (the page that is open\n  // shows it), the disk never sees it. Mutations are a paused write queue and are kept\n  // whole — scrubbing one would change what it sends — so one carrying a scrubbed field is\n  // not written at all (`shouldDehydrateMutation`).\n  const serialize = (client: PersistedClient): string =>\n    JSON.stringify({\n      ...client,\n      clientState: { ...client.clientState, queries: client.clientState.queries.map(withScrubbedData) },\n    });\n\n  // The twin on the way IN (keksdose's `sanitizePersistedCache`, :264-298): an older build\n  // wrote what this one may deny. Never throws; an unreadable blob comes back with\n  // `timestamp: 0`, which the restore treats as unusable and removes.\n  const deserialize = (raw: string): PersistedClient => {\n    const empty: PersistedClient = { timestamp: 0, buster: \"\", clientState: { mutations: [], queries: [] } };\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (!parsed || typeof parsed !== \"object\") return empty;\n      const { timestamp, buster: stored, clientState } = parsed as Partial<PersistedClient>;\n      if (typeof timestamp !== \"number\" || typeof stored !== \"string\") return empty;\n      if (!clientState || typeof clientState !== \"object\" || !Array.isArray(clientState.queries)) return empty;\n      return {\n        timestamp,\n        buster: stored,\n        clientState: {\n          mutations:\n            persistMutations && Array.isArray(clientState.mutations)\n              ? clientState.mutations.filter(\n                  (m) => !carriesScrubbed((m as { state?: { variables?: unknown } } | null)?.state?.variables),\n                )\n              : [],\n          queries: clientState.queries\n            .map(restorable)\n            .filter((q) => q !== null) as PersistedClient[\"clientState\"][\"queries\"],\n        },\n      };\n    } catch {\n      return empty;\n    }\n  };\n\n  const persister = createAsyncStoragePersister({\n    storage: {\n      // Only the provider's restore reads: mounting this persistence again re-arms it.\n      getItem: async (k) => {\n        retired = false;\n        listen();\n        return (await storage.getItem(k)) ?? null;\n      },\n      setItem: async (k, v) => {\n        if (!retired) await storage.setItem(k, v);\n      },\n      removeItem: async (k) => {\n        await storage.removeItem(k);\n      },\n    },\n    key,\n    throttleTime,\n    serialize,\n    deserialize,\n  });\n\n  const leave = async (queryClient: QueryClient) => {\n    retire();\n    try {\n      queryClient.clear();\n    } catch {\n      /* best-effort */\n    }\n  };\n\n  const clear = async (queryClient: QueryClient) => {\n    // Retired first, so this tab's own channel is closed and does not hear its `clear`.\n    retire();\n    // Before this tab's delete: the other tabs stop writing as early as they can.\n    postOnce(across, \"clear\");\n    try {\n      queryClient.clear();\n      await persister.removeClient();\n    } catch {\n      /* best-effort: private mode / IndexedDB unavailable */\n    }\n  };\n\n  const removeStale = () => removeStaleQueryCopies(app, maxAge, { storage, keep: key });\n\n  return {\n    key,\n    persistOptions: { persister, maxAge, buster, dehydrateOptions: { shouldDehydrateQuery, shouldDehydrateMutation } },\n    clear,\n    leave,\n    removeStale,\n  };\n}\n"],"mappings":";AAAA,SAAS,mCAAmC;AAG5C,SAAS,KAAK,KAAK,MAAM,WAAW;AACpC,SAAS,UAAU,gBAAgB;AAuB5B,MAAM,uBAA8C,OAAO,OAAO;AAAA,EACvE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAsFD,MAAM,aAAsC;AAAA,EAC1C,SAAS,CAAC,QAAQ,IAAY,GAAG;AAAA,EACjC,SAAS,CAAC,KAAK,UAAU,IAAI,KAAK,KAAK;AAAA,EACvC,YAAY,CAAC,QAAQ,IAAI,GAAG;AAAA,EAC5B,MAAM,MAAM,KAAK;AACnB;AAmBA,eAAsB,uBACpB,KACA,QACA,EAAE,UAAU,YAAY,KAAK,IAAmC,CAAC,GAClD;AACf,QAAM,SAAS,GAAG,GAAG;AACrB,MAAI;AACF,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,KAAK,MAAM,QAAQ,KAAK,GAAG;AACpC,UAAI,OAAO,MAAM,YAAY,CAAC,EAAE,WAAW,MAAM,KAAK,MAAM,KAAM;AAClE,UAAI,YAAY;AAChB,UAAI;AACF,cAAM,MAAM,MAAM,QAAQ,QAAQ,CAAC;AACnC,cAAM,SAAkB,MAAM,KAAK,MAAM,GAAG,IAAI;AAChD,YAAI,UAAU,OAAO,WAAW,YAAY,OAAQ,OAA2B,cAAc,UAAU;AACrG,sBAAa,OAA2B;AAAA,QAC1C;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI,MAAM,YAAY,OAAQ,OAAM,QAAQ,WAAW,CAAC;AAAA,IAC1D;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAOO,SAAS,YAAY,MAAe,QAAQ,GAAY;AAC7D,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,UAAW,QAAO;AAC9C,MAAI,MAAM,SAAU,QAAO,OAAO,SAAS,IAAc;AACzD,MAAI,MAAM,SAAU,QAAO;AAC3B,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC;AAC3E,QAAM,QAAiB,OAAO,eAAe,IAAI;AACjD,MAAI,UAAU,OAAO,aAAa,UAAU,KAAM,QAAO;AACzD,SAAO,OAAO,OAAO,IAA+B,EAAE,MAAM,CAAC,MAAM,MAAM,UAAa,YAAY,GAAG,QAAQ,CAAC,CAAC;AACjH;AAGA,SAAS,MAAM,MAAe,QAAwC;AACpE,MAAI,OAAO,WAAW,KAAK,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC7E,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,IAAI,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC;AAChE,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,QAAI,OAAO,KAAK,CAAC,MAAO,OAAO,MAAM,WAAW,MAAM,OAAO,EAAE,KAAK,IAAI,CAAE,EAAG;AAC7E,QAAI,IAAI,IAAI,MAAM,OAAO,MAAM;AAAA,EACjC;AACA,SAAO;AACT;AAEA,MAAM,kBAAkB,CAAC,aAAiC;AACxD,UAAQ;AAAA,IACN,qCAAqC,KAAK,UAAU,QAAQ,CAAC;AAAA,EAG/D;AACF;AAEO,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY,CAAC;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,eAAe;AAAA,EACf,mBAAmB;AACrB,GAA8C;AAC5C,QAAM,SAAS,GAAG,GAAG;AACrB,QAAM,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,YAAY,UAAa,YAAY,QAAQ,YAAY,KAAK,KAAK,IAAI,OAAO,EAAE;AAC/G,QAAM,SAAS,IAAI,IAAI,SAAS;AAGhC,MAAI,UAAU;AAQd,QAAM,SAAS,qBAAqB,GAAG;AACvC,MAAI,WAAgC;AAEpC,QAAM,SAAS,MAAM;AACnB,cAAU;AACV,eAAW;AACX,eAAW;AAAA,EACb;AAEA,QAAM,SAAS,MAAM;AACnB,iBAAa,SAAS,QAAQ,CAAC,SAAS;AACtC,UAAI,SAAS,QAAS;AACtB,aAAO;AACP,cAAQ,QAAQ,EACb,KAAK,MAAM,QAAQ,WAAW,GAAG,CAAC,EAClC,MAAM,MAAM,MAAS;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,CAAC,aAClB,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,mBAAmB,iBAAiB,QAAQ,IAAI;AAGvF,QAAM,uBAAuB,CAAC,UAGf;AACb,QAAI,MAAM,MAAM,WAAW,aAAa,CAAC,WAAW,MAAM,QAAQ,EAAG,QAAO;AAC5E,QAAI,YAAY,MAAM,MAAM,IAAI,EAAG,QAAO;AAC1C,aAAS,MAAM,UAAU,MAAM,MAAM,IAAI;AACzC,WAAO;AAAA,EACT;AAGA,QAAM,aAAa,CAAC,UAA4B;AAC9C,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,UAAM,EAAE,UAAU,MAAM,IAAI;AAC5B,QAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,CAAC,WAAW,QAAQ,EAAG,QAAO;AAC9D,QAAI,CAAC,YAAY,OAAO,IAAI,EAAG,QAAO;AACtC,WAAO,iBAAiB,KAAK;AAAA,EAC/B;AAGA,QAAM,kBAAkB,CAAC,OAAgB,QAAQ,MAAe;AAC9D,QAAI,YAAY,WAAW,KAAK,QAAQ,MAAM,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAClG,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,KAAK,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC;AAChF,WAAO,OAAO,QAAQ,KAAgC,EAAE;AAAA,MACtD,CAAC,CAAC,MAAM,CAAC,MACP,YAAY,KAAK,CAAC,MAAO,OAAO,MAAM,WAAW,MAAM,OAAO,EAAE,KAAK,IAAI,CAAE,KAAK,gBAAgB,GAAG,QAAQ,CAAC;AAAA,IAChH;AAAA,EACF;AAIA,QAAM,0BAA0B,CAAC,aAC/B,oBAAoB,SAAS,MAAM,YAAY,CAAC,gBAAgB,SAAS,MAAM,SAAS;AAE1F,QAAM,mBAAmB,CAAC,UAA4B;AACpD,UAAM,QAAQ;AACd,QAAI,CAAC,MAAM,SAAS,EAAE,UAAU,MAAM,OAAQ,QAAO;AACrD,WAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,WAAW,EAAE,EAAE;AAAA,EAC3F;AAMA,QAAM,YAAY,CAAC,WACjB,KAAK,UAAU;AAAA,IACb,GAAG;AAAA,IACH,aAAa,EAAE,GAAG,OAAO,aAAa,SAAS,OAAO,YAAY,QAAQ,IAAI,gBAAgB,EAAE;AAAA,EAClG,CAAC;AAKH,QAAM,cAAc,CAAC,QAAiC;AACpD,UAAM,QAAyB,EAAE,WAAW,GAAG,QAAQ,IAAI,aAAa,EAAE,WAAW,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE;AACvG,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,YAAM,EAAE,WAAW,QAAQ,QAAQ,YAAY,IAAI;AACnD,UAAI,OAAO,cAAc,YAAY,OAAO,WAAW,SAAU,QAAO;AACxE,UAAI,CAAC,eAAe,OAAO,gBAAgB,YAAY,CAAC,MAAM,QAAQ,YAAY,OAAO,EAAG,QAAO;AACnG,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR,aAAa;AAAA,UACX,WACE,oBAAoB,MAAM,QAAQ,YAAY,SAAS,IACnD,YAAY,UAAU;AAAA,YACpB,CAAC,MAAM,CAAC,gBAAiB,GAAkD,OAAO,SAAS;AAAA,UAC7F,IACA,CAAC;AAAA,UACP,SAAS,YAAY,QAClB,IAAI,UAAU,EACd,OAAO,CAAC,MAAM,MAAM,IAAI;AAAA,QAC7B;AAAA,MACF;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,YAAY,4BAA4B;AAAA,IAC5C,SAAS;AAAA;AAAA,MAEP,SAAS,OAAO,MAAM;AACpB,kBAAU;AACV,eAAO;AACP,eAAQ,MAAM,QAAQ,QAAQ,CAAC,KAAM;AAAA,MACvC;AAAA,MACA,SAAS,OAAO,GAAG,MAAM;AACvB,YAAI,CAAC,QAAS,OAAM,QAAQ,QAAQ,GAAG,CAAC;AAAA,MAC1C;AAAA,MACA,YAAY,OAAO,MAAM;AACvB,cAAM,QAAQ,WAAW,CAAC;AAAA,MAC5B;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,gBAA6B;AAChD,WAAO;AACP,QAAI;AACF,kBAAY,MAAM;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,gBAA6B;AAEhD,WAAO;AAEP,aAAS,QAAQ,OAAO;AACxB,QAAI;AACF,kBAAY,MAAM;AAClB,YAAM,UAAU,aAAa;AAAA,IAC/B,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,uBAAuB,KAAK,QAAQ,EAAE,SAAS,MAAM,IAAI,CAAC;AAEpF,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,EAAE,WAAW,QAAQ,QAAQ,kBAAkB,EAAE,sBAAsB,wBAAwB,EAAE;AAAA,IACjH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/rhf/fields.d.ts

@@ -226,7 +226,11 @@ export type RhfDateFieldProps<TFieldValues extends FieldValues = FieldValues, TN
      *  nullable schema. */
     emptyValue?: "" | null;
 };
-/** The kit's {@link DatePicker}, holding an ISO `"YYYY-MM-DD"` string. */
+/**
+ * The kit's {@link DatePicker}, holding an ISO `"YYYY-MM-DD"` string. `commit` and
+ * `disabledReason` are the picker's own (0.52, refactor audit 2026-10-30, API-3): a date
+ * that saves itself stays focusable under a lock and says why.
+ */
 export declare function RhfDateField<TFieldValues extends FieldValues = FieldValues, TName extends FieldPath<TFieldValues> = FieldPath<TFieldValues>, TTransformed = TFieldValues>({ name, control, rules, label, hint, help, required, disabled, excludeWhenDisabled, className, inputClassName, emptyValue, ...pickerProps }: RhfDateFieldProps<TFieldValues, TName, TTransformed>): import("react").JSX.Element;
 type OwnDateRangeProps = Omit<DateRangePickerProps, "from" | "to" | "onChange" | "label" | "invalid" | "disabled" | "className" | "id" | "error">;
 export type RhfDateRangePickerProps<TFieldValues extends FieldValues = FieldValues, TFromName extends FieldPath<TFieldValues> = FieldPath<TFieldValues>, TToName extends FieldPath<TFieldValues> = FieldPath<TFieldValues>, TTransformed = TFieldValues> = Omit<RhfFieldBaseProps<TFieldValues, TFromName, TTransformed>, "name" | "rules"> & OwnDateRangeProps & {
@@ -276,9 +280,11 @@ export type RhfDateRangePickerProps<TFieldValues extends FieldValues = FieldValu
  *    pick, which would mark (and, with `mode: "onTouched"`, validate) an end the user
  *    is still choosing.
  *
- * In `commit="immediate"` mode (the picker's default) the first calendar click is
- * reported on its own, so the form holds `(from, emptyValue)` until the second; with
- * `commit="apply"` nothing reaches the form until Apply.
+ * Without `apply` (the picker's default) the first calendar click is reported on its
+ * own, so the form holds `(from, emptyValue)` until the second; with `apply` nothing
+ * reaches the form until Apply. `apply` was `commit="apply"` until 0.52 (deprecated, gone
+ * in 0.53): `commit` is now the write lock's, as on every other binding — with
+ * `disabledReason`, the picker's own (refactor audit 2026-10-30, API-3).
  *
  * The common props (`label`, `hint`, `required`, `disabled`, `excludeWhenDisabled`,
  * `control`, `className`) apply to the pair; `rules` are per field.
@@ -383,6 +389,7 @@ export type RhfMonthPickerProps<TFieldValues extends FieldValues = FieldValues,
  * lookup until 0.34, API-3), so focus-on-error lands there; the form's error paints the
  * trigger and is the shell's message; the hint is the shell's description; neither is
  * handed to the picker, so its box never changes. Picking marks the field touched.
+ * `commit` and `disabledReason` are the picker's own (0.52, API-3).
  *
  * ```tsx
  * <RhfMonthPicker name="fiscalYear" label="Fiscal year" mode="year" valueAsNumber