@eifi1/ui-kit 0.51.7 → 0.53.0

package/dist/auth/auth-errors-labels.js

@@ -0,0 +1,13 @@
+"use client";
+function englishRateLimited(seconds) {
+  if (!seconds || seconds <= 0) return "Too many attempts. Wait a moment and try again.";
+  return `Too many attempts. Try again in ${englishWait(seconds)}.`;
+}
+function englishWait(seconds) {
+  return seconds < 60 ? `${Math.ceil(seconds)} s` : `${Math.ceil(seconds / 60)} min`;
+}
+export {
+  englishRateLimited,
+  englishWait
+};
+//# sourceMappingURL=auth-errors-labels.js.map

package/dist/auth/auth-errors-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/auth-errors-labels.ts"],"sourcesContent":["// The English of every `rateLimited` label, in a module with no component code and no\n// error probing: the English catalogue (src/i18n/defaults.ts) reaches it through nine\n// `*-labels.ts` modules, and until 0.52 that pulled `auth/auth-errors` — and since MOD-6\n// its `lib/http-status` — into the `en` chunk (refactor audit 2026-10-30, MOD-6).\n// auth/auth-errors re-exports both.\n\n/**\n * The English of every `rateLimited` label (0.30.0): \"Too many attempts. Try again in\n * 30 s.\" with a wait under a minute, in whole minutes from one minute up (keksdose's\n * reset throttle answers in hours, and \"3600 s\" is a number nobody reads), and \"Wait a\n * moment and try again.\" without one — or with a `0`.\n *\n * @internal The namespaces' English; not part of the barrel.\n */\nexport function englishRateLimited(seconds?: number): string {\n  if (!seconds || seconds <= 0) return \"Too many attempts. Wait a moment and try again.\";\n  return `Too many attempts. Try again in ${englishWait(seconds)}.`;\n}\n\n/** \"30 s\", \"2 min\" — a wait in English, rounded up. @internal */\nexport function englishWait(seconds: number): string {\n  return seconds < 60 ? `${Math.ceil(seconds)} s` : `${Math.ceil(seconds / 60)} min`;\n}\n"],"mappings":";AAcO,SAAS,mBAAmB,SAA0B;AAC3D,MAAI,CAAC,WAAW,WAAW,EAAG,QAAO;AACrC,SAAO,mCAAmC,YAAY,OAAO,CAAC;AAChE;AAGO,SAAS,YAAY,SAAyB;AACnD,SAAO,UAAU,KAAK,GAAG,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,KAAK,KAAK,UAAU,EAAE,CAAC;AAC9E;","names":[]}

package/dist/auth/auth-errors.d.ts

@@ -1,3 +1,4 @@
+import { httpStatusOf } from "../lib/http-status.js";
 /**
  * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every
  * refusal the auth routes answer carries a machine-readable `code`, and the pages
@@ -158,19 +159,12 @@ export declare function isBillingError(err: unknown, code?: BillingErrorCode): b
  */
 export declare function errorBodyWithCode(err: unknown, accept?: (code: unknown) => boolean): Record<string, unknown> | undefined;
 /**
- * The HTTP status a thrown error carries, wherever the apps' HTTP clients put it —
- * without depending on any of them:
- *
- *  1. `err.response.status` — axios (all three apps' clients);
- *  2. `err.status` — ofetch's `FetchError`, the generated OpenAPI clients' `ApiError`, and
- *     a `Response` thrown as it came;
- *  3. `err.statusCode` — ofetch's alias, and Node-style errors.
- *
- * `undefined` when none is a whole number. Package-private — not re-exported from the
- * barrel; {@link isRateLimited} and the session refresh's classifier read it (DUP-11,
- * refactor audit 2026-10: the refresh carried its own copy of this probe).
+ * The HTTP status a thrown error carries ({@link httpStatusOf}): axios'
+ * `response.status`, then `status`, then `statusCode`. Lives in `lib/http-status.ts`
+ * since 0.52 (refactor audit 2026-10-30, MOD-6); re-exported here for the modules that
+ * import it from auth. Package-private — not re-exported from the barrel.
  */
-export declare function httpStatusOf(err: unknown): number | undefined;
+export { httpStatusOf };
 /**
  * Whether `err` is a throttled request — HTTP `429 Too Many Requests` (0.30.0, from the
  * apps' 0.29 adoption: every app answered a throttled sign-in, sign-up or reset through
@@ -206,14 +200,4 @@ export declare function isRateLimited(err: unknown): boolean;
  * lists it in `Access-Control-Expose-Headers`.
  */
 export declare function retryAfterSeconds(err: unknown, now?: number | Date): number | undefined;
-/**
- * The English of every `rateLimited` label (0.30.0): "Too many attempts. Try again in
- * 30 s." with a wait under a minute, in whole minutes from one minute up (keksdose's
- * reset throttle answers in hours, and "3600 s" is a number nobody reads), and "Wait a
- * moment and try again." without one — or with a `0`.
- *
- * @internal The namespaces' English; not part of the barrel.
- */
-export declare function englishRateLimited(seconds?: number): string;
-/** "30 s", "2 min" — a wait in English, rounded up. @internal */
-export declare function englishWait(seconds: number): string;
+export { englishRateLimited, englishWait } from "./auth-errors-labels.js";

package/dist/auth/auth-errors.js

@@ -1,4 +1,5 @@
 "use client";
+import { httpStatusOf } from "../lib/http-status.js";
 const BILLING_CODES = /* @__PURE__ */ new Set([
   "billing_disabled",
   "billing_read_only",
@@ -67,14 +68,6 @@ function errorBodyWithCode(err, accept = (code) => known(code) !== void 0) {
   }
   return void 0;
 }
-function statusOf(value) {
-  return typeof value === "number" && Number.isInteger(value) ? value : void 0;
-}
-function httpStatusOf(err) {
-  if (!isBag(err)) return void 0;
-  const response = err.response;
-  return (isBag(response) ? statusOf(response.status) : void 0) ?? statusOf(err.status) ?? statusOf(err.statusCode);
-}
 function isRateLimited(err) {
   return httpStatusOf(err) === 429;
 }
@@ -110,13 +103,7 @@ function retryAfterSeconds(err, now = Date.now()) {
   const value = (isBag(response) ? headerOf(response.headers, "retry-after") : void 0) ?? headerOf(err.headers, "retry-after");
   return value === void 0 ? void 0 : parseRetryAfter(value, at);
 }
-function englishRateLimited(seconds) {
-  if (!seconds || seconds <= 0) return "Too many attempts. Wait a moment and try again.";
-  return `Too many attempts. Try again in ${englishWait(seconds)}.`;
-}
-function englishWait(seconds) {
-  return seconds < 60 ? `${Math.ceil(seconds)} s` : `${Math.ceil(seconds / 60)} min`;
-}
+import { englishRateLimited, englishWait } from "./auth-errors-labels.js";
 export {
   authErrorCode,
   englishRateLimited,

package/dist/auth/auth-errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/auth-errors.ts"],"sourcesContent":["/**\n * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every\n * refusal the auth routes answer carries a machine-readable `code`, and the pages\n * recognise the CODE, never the server's sentence.\n *\n * Today each app's pages print the server's `detail` string (keksdose's\n * `extractApiErrorMessage`), which is English on every locale and, on a credential\n * check, would be an account-enumeration oracle if it ever said more than one thing.\n * keksdose already keys one refusal on a code (`features/budgets/plan-limit.ts`,\n * `402 {detail, code: \"plan_budget_limit\"}`); §5.2 makes that the rule for auth. Each\n * app switches its server and its pages together (§9).\n *\n * - `invalid_credentials` — unknown address, wrong password AND deactivated account:\n *   one answer, in the same time (§2.10). `401`.\n * - `registration_closed` — the sign-up gate refused the address. `403`.\n * - `email_taken` — an account with this address exists. `409`.\n * - `invitation_invalid`, `invitation_expired` — the `invite` token of a sign-up or an\n *   accept (§4.4).\n * - `token_invalid` — a one-time token (reset, verification, a sign-in challenge) is\n *   unknown, spent or expired.\n * - `account_inactive` — **no server answers it.** §2.10 decided that a deactivated\n *   account gets `invalid_credentials`, because a separate answer after a correct\n *   password would confirm a leaked one. It stays in the union only for a future server\n *   step that is past the password (an admin view, a signed-in refresh) and may say so.\n * - `session_ended` — 0.34.0 (§11.2, decision 7; server-kit 0.8): every definitive\n *   refusal of `POST /auth/refresh`, a `401`. No form shows it, so it has no label: the\n *   kit's `attachSessionRefresh` decides by the STATUS, so an app whose server has not\n *   switched yet keeps working.\n */\nexport type AuthErrorCode =\n  | \"invalid_credentials\"\n  | \"registration_closed\"\n  | \"email_taken\"\n  | \"invitation_invalid\"\n  | \"invitation_expired\"\n  | \"token_invalid\"\n  /** 0.30.0: a link that WAS valid and ran out (verification, reset) — keksdose's step-3\n   *  refusals tell it from `token_invalid`, so a page can say \"expired, ask for a new one\". */\n  | \"token_expired\"\n  | \"account_inactive\"\n  | \"session_ended\";\n\n/**\n * 0.30.0: the coded refusals of user administration and the account's own settings\n * (docs/user-admin-harmonization.md §4, §6) — server-kit 0.4.0's `AccountErrorCode`,\n * value for value. The same family of answer as the sign-in codes (`{detail, code}`,\n * plus `companies` on kastlan's `last_admin`), read by the same {@link authErrorCode}.\n *\n * - `last_admin` — the action would leave no active admin: deactivating, demoting or\n *   deleting the last one (in kastlan, of a company; the answer names the `companies`).\n * - `self_action` — an admin acting on their own account where that is never allowed.\n * - `other_companies` — kastlan: the account belongs to other companies too, so a\n *   company admin may not deactivate it; \"Remove from company\" instead (§9.6).\n * - `household_has_members` — keksdose's guard on a deletion request (§6.4).\n * - `confirmation_required`, `confirmation_mismatch` — the action's confirmation level\n *   asked for a typed address (or a tick), and the request carried none, or another\n *   address (§4.2).\n * - `password_incorrect` — the CURRENT password is wrong on a signed-in route (the email\n *   change, the deletion request). `400`, not `401`: an app's client reads a 401 as an\n *   ended session and signs the user out, the wrong answer to a typo. Every other one\n *   is a `409`.\n */\nexport type AccountErrorCode =\n  | \"last_admin\"\n  | \"self_action\"\n  | \"other_companies\"\n  | \"household_has_members\"\n  | \"confirmation_required\"\n  | \"confirmation_mismatch\"\n  | \"password_incorrect\";\n\n/**\n * 0.31.0: the demo's coded refusals (docs/landing-demo-harmonization.md §6.2) —\n * server-kit 0.5's `DemoErrorCode`, value for value, answered as `{detail, code}` like\n * the others and read by the same {@link authErrorCode}.\n *\n * - `demo_disabled` — `404`: the demo switch is off (it is \"not there\", not forbidden).\n * - `demo_rate_limited` — `429` with `Retry-After`: the per-IP window of demo starts.\n * - `demo_capacity` — `429`, no `Retry-After`: the cap of live demo users.\n * - `demo_not_ready` — `503`: the demo data has not been seeded yet.\n * - `demo_read_only` — `403`, model R: any write by a demo user. The app's write lock\n *   already explains it, so it shows no toast (§5.4).\n * - `demo_refused` — `403`, both models: an action a demo never may — a way in or out,\n *   mail, uploads, the account export (§6.4).\n */\nexport type DemoErrorCode =\n  \"demo_disabled\" | \"demo_rate_limited\" | \"demo_capacity\" | \"demo_not_ready\" | \"demo_read_only\" | \"demo_refused\";\n\n/**\n * 0.32.0: billing's coded refusals (docs/billing-harmonization.md §3.3, §3.4, §4, §12.3) —\n * server-kit 0.6's `BillingError` and `PlanLimitError`, value for value, answered as\n * `{detail, code}` like the others and read by the same {@link authErrorCode}.\n *\n * - `billing_disabled` — `404`: the billing switch is off (§2.9), so every billing route\n *   but `GET /billing/status` is \"not there\", as a switched-off demo is.\n * - `billing_read_only` — `402`: a write by (or into the data of) a payer out of good\n *   standing (§3.3, §12.1). Inside a sync reply it marks the changes that were refused\n *   and not applied (§12.5). The app's write lock and banner already say why, so — like\n *   `demo_read_only` — it needs no toast of its own.\n * - `plan_limit` — `402`: a create past the plan's limit (§3.4), with the extra fields\n *   `dimension`, `plan`, `limit` and `used` — read them with `isPlanLimit`. A lapsed payer\n *   creating gets `billing_read_only` instead, never this (§12.3).\n * - `billing_not_configured` — billing is switched on but the provider's settings are\n *   missing (the secrets, a price id): the operator's mistake, not the payer's.\n *\n * 0.33.0 (server-kit 0.7, §14.2): the provider's refusals, with the `billing_` prefix of\n * the others (decision 22).\n * - `billing_provider_unavailable` — `502`: Paddle didn't answer, or refused the request.\n *   Try again.\n * - `billing_not_at_provider` — `409`: a portal request before the payer reached the\n *   provider (§14.5) — a stale page; the overview's `at_provider` says it first.\n * - `billing_already_subscribed` — `409`: a checkout while a provider subscription runs\n *   (§14.6). Since 0.39 plan changes go through the plan switch (§15.2.10).\n * - `billing_plan_not_sold` — `422`: a checkout for a plan, currency or interval the\n *   catalogue doesn't sell — or (0.39) a switch to one.\n *\n * 0.39.0 (server-kit 0.12, §15.2.10): the plan switch's refusals.\n * - `billing_not_subscribed` — `409`: a switch with no running provider subscription;\n *   the page offers the checkout instead.\n * - `billing_plan_unchanged` — `409`: a switch to the price the payer pays now.\n */\nexport type BillingErrorCode =\n  | \"billing_disabled\"\n  | \"billing_read_only\"\n  | \"plan_limit\"\n  | \"billing_not_configured\"\n  | \"billing_provider_unavailable\"\n  | \"billing_not_at_provider\"\n  | \"billing_already_subscribed\"\n  | \"billing_plan_not_sold\"\n  | \"billing_not_subscribed\"\n  | \"billing_plan_unchanged\";\n\n/** Every code the kit reads: the sign-in refusals, the account ones (0.30.0), the demo's\n *  (0.31.0) and billing's (0.32.0). */\nexport type KitErrorCode = AuthErrorCode | AccountErrorCode | DemoErrorCode | BillingErrorCode;\n\nconst BILLING_CODES: ReadonlySet<BillingErrorCode> = new Set<BillingErrorCode>([\n  \"billing_disabled\",\n  \"billing_read_only\",\n  \"plan_limit\",\n  \"billing_not_configured\",\n  \"billing_provider_unavailable\",\n  \"billing_not_at_provider\",\n  \"billing_already_subscribed\",\n  \"billing_plan_not_sold\",\n  \"billing_not_subscribed\",\n  \"billing_plan_unchanged\",\n]);\n\nconst CODES: ReadonlySet<string> = new Set<KitErrorCode>([\n  \"invalid_credentials\",\n  \"registration_closed\",\n  \"email_taken\",\n  \"invitation_invalid\",\n  \"invitation_expired\",\n  \"token_invalid\",\n  \"token_expired\",\n  \"account_inactive\",\n  \"session_ended\",\n  \"last_admin\",\n  \"self_action\",\n  \"other_companies\",\n  \"household_has_members\",\n  \"confirmation_required\",\n  \"confirmation_mismatch\",\n  \"password_incorrect\",\n  \"demo_disabled\",\n  \"demo_rate_limited\",\n  \"demo_capacity\",\n  \"demo_not_ready\",\n  \"demo_read_only\",\n  \"demo_refused\",\n  ...BILLING_CODES,\n]);\n\ntype Bag = Record<string, unknown>;\n\nconst isBag = (value: unknown): value is Bag => typeof value === \"object\" && value !== null;\n\n/** A known code, or undefined. */\nfunction known(value: unknown): KitErrorCode | undefined {\n  return typeof value === \"string\" && CODES.has(value) ? (value as KitErrorCode) : undefined;\n}\n\n/** `{code}` on a parsed body, or FastAPI's `{detail: {code}}` — what an\n *  `HTTPException(detail={\"code\": …})` serialises to. */\nfunction codeOfBody(body: unknown): KitErrorCode | undefined {\n  if (!isBag(body)) return undefined;\n  return known(body.code) ?? (isBag(body.detail) ? known(body.detail.code) : undefined);\n}\n\n/**\n * The code an error carries — an {@link AuthErrorCode}, since 0.30.0 an\n * {@link AccountErrorCode}, since 0.31.0 a {@link DemoErrorCode}, since 0.32.0 a\n * {@link BillingErrorCode} — or `undefined` when it carries none.\n *\n * Reads the parsed response body wherever the apps' HTTP clients put it, without\n * depending on any of them:\n *\n *  1. `err.response.data` — axios (keksdose's, kastlan's and Kurvenschmiede's clients;\n *     keksdose's `isPlanBudgetLimitRefusal` reads the same path);\n *  2. `err.data` — ofetch's `FetchError`, and most `fetch` wrappers that parse the body;\n *  3. `err.body` — the generated OpenAPI clients' `ApiError`;\n *  4. `err` itself — a body thrown as it came (`throw await res.json()`).\n *\n * In each, `code` or FastAPI's nested `detail.code`. Last, `err.code` — but only when\n * it is one of the codes above: axios writes its OWN codes there (`ERR_NETWORK`,\n * `ECONNABORTED`, `ERR_BAD_REQUEST`), and so does Node, so an unknown value is never\n * read as a refusal. The HTTP status is not checked: the code is the contract, and the\n * status differs per refusal (401, 402, 403, 404, 409, 410).\n */\nexport function authErrorCode(err: unknown): KitErrorCode | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (\n    (isBag(response) ? codeOfBody(response.data) : undefined) ??\n    codeOfBody(err.data) ??\n    codeOfBody(err.body) ??\n    codeOfBody(err)\n  );\n}\n\n/**\n * Whether `err` is a coded auth refusal — any of them, or the one named:\n *\n * ```ts\n * try { await api.register(values) }\n * catch (err) { if (isAuthError(err, \"email_taken\")) … }\n * ```\n *\n * The kit's `SignInForm` and `RegisterForm` call it on what their callbacks reject\n * with, so an app's `onSubmit` can simply let its client's error through. See\n * {@link authErrorCode} for the shapes it reads. Since 0.30.0 it knows the account codes\n * too: `isAuthError(err, \"last_admin\")`; since 0.31.0 the demo's:\n * `isAuthError(err, \"demo_read_only\")`; since 0.32.0 billing's:\n * `isAuthError(err, \"billing_read_only\")` (or {@link isBillingError}).\n */\nexport function isAuthError(err: unknown, code?: KitErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && (code === undefined || found === code);\n}\n\n/**\n * Whether `err` is one of billing's coded refusals (0.32.0, docs/billing-harmonization.md\n * §10, §14.2) — any of them, or the one named. {@link isAuthError} answers the same for a\n * named code; this one also answers \"is it billing's at all\", which an app's error\n * handler asks before it decides between the write lock, a `PlanLimitNotice` and a toast.\n */\nexport function isBillingError(err: unknown, code?: BillingErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && BILLING_CODES.has(found as BillingErrorCode) && (code === undefined || found === code);\n}\n\n/**\n * The parsed body that carries a code, wherever {@link authErrorCode} would find it (in\n * the same order) — the object with the `code`, so FastAPI's nested `detail` when the code\n * is there. For a reader of a refusal's EXTRA fields (`isPlanLimit`: `dimension`, `limit`,\n * `used` sit beside the code). `accept` decides which codes count; default, the known ones.\n *\n * @internal Not part of the barrel.\n */\nexport function errorBodyWithCode(\n  err: unknown,\n  accept: (code: unknown) => boolean = (code) => known(code) !== undefined,\n): Record<string, unknown> | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  for (const body of [isBag(response) ? response.data : undefined, err.data, err.body, err]) {\n    if (!isBag(body)) continue;\n    if (accept(body.code)) return body;\n    if (isBag(body.detail) && accept(body.detail.code)) return body.detail;\n  }\n  return undefined;\n}\n\n/** An HTTP status as a number, or undefined. */\nfunction statusOf(value: unknown): number | undefined {\n  return typeof value === \"number\" && Number.isInteger(value) ? value : undefined;\n}\n\n/**\n * The HTTP status a thrown error carries, wherever the apps' HTTP clients put it —\n * without depending on any of them:\n *\n *  1. `err.response.status` — axios (all three apps' clients);\n *  2. `err.status` — ofetch's `FetchError`, the generated OpenAPI clients' `ApiError`, and\n *     a `Response` thrown as it came;\n *  3. `err.statusCode` — ofetch's alias, and Node-style errors.\n *\n * `undefined` when none is a whole number. Package-private — not re-exported from the\n * barrel; {@link isRateLimited} and the session refresh's classifier read it (DUP-11,\n * refactor audit 2026-10: the refresh carried its own copy of this probe).\n */\nexport function httpStatusOf(err: unknown): number | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (isBag(response) ? statusOf(response.status) : undefined) ?? statusOf(err.status) ?? statusOf(err.statusCode);\n}\n\n/**\n * Whether `err` is a throttled request — HTTP `429 Too Many Requests` (0.30.0, from the\n * apps' 0.29 adoption: every app answered a throttled sign-in, sign-up or reset through\n * its own `describeError`, with three wordings of one sentence).\n *\n * A throttle carries no `code` in the contract — the STATUS is the answer, set by the\n * apps' limiters (server-kit's `AuthLimiters`, keksdose's per-IP limit) — so this reads\n * the status, wherever the apps' HTTP clients put it ({@link httpStatusOf}).\n *\n * There is no `rate_limited` code: keksdose answers its 429s uncoded, with a\n * `Retry-After` header, and the status is the one signal every limiter gives.\n *\n * The kit's `SignInForm`, `RegisterForm`, `ForgotPasswordForm` and `ResetPasswordForm`\n * call it AFTER the app's `describeError` — an app with words of its own keeps them —\n * and before their generic failure, so \"Too many attempts. Try again in 30 s.\" (with\n * {@link retryAfterSeconds}) or \"… Wait a moment and try again.\" needs no app code.\n */\nexport function isRateLimited(err: unknown): boolean {\n  return httpStatusOf(err) === 429;\n}\n\n/** A header's value from a `Headers` (fetch, ofetch's `response`), axios' `AxiosHeaders`\n *  or a plain record — whose keys may come in any case. */\nfunction headerOf(headers: unknown, name: string): unknown {\n  if (!isBag(headers)) return undefined;\n  if (typeof headers.get === \"function\") {\n    try {\n      const value: unknown = (headers.get as (key: string) => unknown).call(headers, name);\n      if (value !== undefined && value !== null) return value;\n    } catch {\n      // A `get` that is not a header lookup; the record below is.\n    }\n  }\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === name) return value;\n  }\n  return undefined;\n}\n\n/** `Retry-After` as seconds from `now`: delta-seconds (\"30\"), or an HTTP date\n *  (\"Wed, 07 Oct 2026 10:00:00 GMT\") counted from now, never below 0 (RFC 9110 §10.2.3). */\nfunction parseRetryAfter(value: unknown, now: number): number | undefined {\n  const raw = Array.isArray(value) ? (value as unknown[])[0] : value;\n  if (typeof raw === \"number\") return Number.isFinite(raw) && raw >= 0 ? Math.ceil(raw) : undefined;\n  if (typeof raw !== \"string\") return undefined;\n  const text = raw.trim();\n  if (/^\\d+$/.test(text)) return Number(text);\n  // An HTTP date names its day and month (\"Wed, 07 Oct 2026 …\"). Without a letter it is\n  // a malformed number (\"-5\", \"1.5\"), which `Date.parse` would happily read as a year.\n  if (!/[a-z]/i.test(text)) return undefined;\n  const at = Date.parse(text);\n  if (Number.isNaN(at)) return undefined;\n  return Math.max(0, Math.ceil((at - now) / 1000));\n}\n\n/**\n * How long a throttled request asks to wait, in whole seconds — its `Retry-After`\n * header (0.30.0, keksdose: its 429s carry no code, only the header) — or `undefined`\n * when there is none, or none that parses.\n *\n * Read where the apps' clients keep the response headers, without depending on any of\n * them: `err.response.headers` (axios' `AxiosHeaders` or a plain record; ofetch's\n * `FetchError.response`, a fetch `Headers`), then `err.headers` (a `Response` thrown as\n * it came). The value is delta-seconds, or an HTTP date turned into seconds from `now`\n * (default: the present moment) — never below 0.\n *\n * The forms hand it to their `rateLimited` label when {@link isRateLimited} is true:\n * \"Too many attempts. Try again in 30 s.\" — and, without one, \"… Wait a moment and try\n * again.\" A browser only exposes `Retry-After` to a cross-origin page when the server\n * lists it in `Access-Control-Expose-Headers`.\n */\nexport function retryAfterSeconds(err: unknown, now: number | Date = Date.now()): number | undefined {\n  if (!isBag(err)) return undefined;\n  const at = typeof now === \"number\" ? now : now.getTime();\n  const response = err.response;\n  const value =\n    (isBag(response) ? headerOf(response.headers, \"retry-after\") : undefined) ?? headerOf(err.headers, \"retry-after\");\n  return value === undefined ? undefined : parseRetryAfter(value, at);\n}\n\n/**\n * The English of every `rateLimited` label (0.30.0): \"Too many attempts. Try again in\n * 30 s.\" with a wait under a minute, in whole minutes from one minute up (keksdose's\n * reset throttle answers in hours, and \"3600 s\" is a number nobody reads), and \"Wait a\n * moment and try again.\" without one — or with a `0`.\n *\n * @internal The namespaces' English; not part of the barrel.\n */\nexport function englishRateLimited(seconds?: number): string {\n  if (!seconds || seconds <= 0) return \"Too many attempts. Wait a moment and try again.\";\n  return `Too many attempts. Try again in ${englishWait(seconds)}.`;\n}\n\n/** \"30 s\", \"2 min\" — a wait in English, rounded up. @internal */\nexport function englishWait(seconds: number): string {\n  return seconds < 60 ? `${Math.ceil(seconds)} s` : `${Math.ceil(seconds / 60)} min`;\n}\n"],"mappings":";AAyIA,MAAM,gBAA+C,oBAAI,IAAsB;AAAA,EAC7E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,QAA6B,oBAAI,IAAkB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,CAAC;AAID,MAAM,QAAQ,CAAC,UAAiC,OAAO,UAAU,YAAY,UAAU;AAGvF,SAAS,MAAM,OAA0C;AACvD,SAAO,OAAO,UAAU,YAAY,MAAM,IAAI,KAAK,IAAK,QAAyB;AACnF;AAIA,SAAS,WAAW,MAAyC;AAC3D,MAAI,CAAC,MAAM,IAAI,EAAG,QAAO;AACzB,SAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI;AAC7E;AAsBO,SAAS,cAAc,KAAwC;AACpE,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UACG,MAAM,QAAQ,IAAI,WAAW,SAAS,IAAI,IAAI,WAC/C,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,KACnB,WAAW,GAAG;AAElB;AAiBO,SAAS,YAAY,KAAc,MAA8B;AACtE,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,WAAc,SAAS,UAAa,UAAU;AACjE;AAQO,SAAS,eAAe,KAAc,MAAkC;AAC7E,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,UAAa,cAAc,IAAI,KAAyB,MAAM,SAAS,UAAa,UAAU;AACjH;AAUO,SAAS,kBACd,KACA,SAAqC,CAAC,SAAS,MAAM,IAAI,MAAM,QAC1B;AACrC,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,aAAW,QAAQ,CAAC,MAAM,QAAQ,IAAI,SAAS,OAAO,QAAW,IAAI,MAAM,IAAI,MAAM,GAAG,GAAG;AACzF,QAAI,CAAC,MAAM,IAAI,EAAG;AAClB,QAAI,OAAO,KAAK,IAAI,EAAG,QAAO;AAC9B,QAAI,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,IAAI,EAAG,QAAO,KAAK;AAAA,EAClE;AACA,SAAO;AACT;AAGA,SAAS,SAAS,OAAoC;AACpD,SAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,IAAI,QAAQ;AACxE;AAeO,SAAS,aAAa,KAAkC;AAC7D,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UAAQ,MAAM,QAAQ,IAAI,SAAS,SAAS,MAAM,IAAI,WAAc,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU;AACrH;AAmBO,SAAS,cAAc,KAAuB;AACnD,SAAO,aAAa,GAAG,MAAM;AAC/B;AAIA,SAAS,SAAS,SAAkB,MAAuB;AACzD,MAAI,CAAC,MAAM,OAAO,EAAG,QAAO;AAC5B,MAAI,OAAO,QAAQ,QAAQ,YAAY;AACrC,QAAI;AACF,YAAM,QAAkB,QAAQ,IAAiC,KAAK,SAAS,IAAI;AACnF,UAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,KAAM,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,gBAAgB,OAAgB,KAAiC;AACxE,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAK,MAAoB,CAAC,IAAI;AAC7D,MAAI,OAAO,QAAQ,SAAU,QAAO,OAAO,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,IAAI;AACxF,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,OAAO,IAAI,KAAK;AACtB,MAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,OAAO,IAAI;AAG1C,MAAI,CAAC,SAAS,KAAK,IAAI,EAAG,QAAO;AACjC,QAAM,KAAK,KAAK,MAAM,IAAI;AAC1B,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,GAAI,CAAC;AACjD;AAkBO,SAAS,kBAAkB,KAAc,MAAqB,KAAK,IAAI,GAAuB;AACnG,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,KAAK,OAAO,QAAQ,WAAW,MAAM,IAAI,QAAQ;AACvD,QAAM,WAAW,IAAI;AACrB,QAAM,SACH,MAAM,QAAQ,IAAI,SAAS,SAAS,SAAS,aAAa,IAAI,WAAc,SAAS,IAAI,SAAS,aAAa;AAClH,SAAO,UAAU,SAAY,SAAY,gBAAgB,OAAO,EAAE;AACpE;AAUO,SAAS,mBAAmB,SAA0B;AAC3D,MAAI,CAAC,WAAW,WAAW,EAAG,QAAO;AACrC,SAAO,mCAAmC,YAAY,OAAO,CAAC;AAChE;AAGO,SAAS,YAAY,SAAyB;AACnD,SAAO,UAAU,KAAK,GAAG,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,KAAK,KAAK,UAAU,EAAE,CAAC;AAC9E;","names":[]}
+{"version":3,"sources":["../../src/auth/auth-errors.ts"],"sourcesContent":["import { httpStatusOf } from \"../lib/http-status\";\n\n/**\n * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every\n * refusal the auth routes answer carries a machine-readable `code`, and the pages\n * recognise the CODE, never the server's sentence.\n *\n * Today each app's pages print the server's `detail` string (keksdose's\n * `extractApiErrorMessage`), which is English on every locale and, on a credential\n * check, would be an account-enumeration oracle if it ever said more than one thing.\n * keksdose already keys one refusal on a code (`features/budgets/plan-limit.ts`,\n * `402 {detail, code: \"plan_budget_limit\"}`); §5.2 makes that the rule for auth. Each\n * app switches its server and its pages together (§9).\n *\n * - `invalid_credentials` — unknown address, wrong password AND deactivated account:\n *   one answer, in the same time (§2.10). `401`.\n * - `registration_closed` — the sign-up gate refused the address. `403`.\n * - `email_taken` — an account with this address exists. `409`.\n * - `invitation_invalid`, `invitation_expired` — the `invite` token of a sign-up or an\n *   accept (§4.4).\n * - `token_invalid` — a one-time token (reset, verification, a sign-in challenge) is\n *   unknown, spent or expired.\n * - `account_inactive` — **no server answers it.** §2.10 decided that a deactivated\n *   account gets `invalid_credentials`, because a separate answer after a correct\n *   password would confirm a leaked one. It stays in the union only for a future server\n *   step that is past the password (an admin view, a signed-in refresh) and may say so.\n * - `session_ended` — 0.34.0 (§11.2, decision 7; server-kit 0.8): every definitive\n *   refusal of `POST /auth/refresh`, a `401`. No form shows it, so it has no label: the\n *   kit's `attachSessionRefresh` decides by the STATUS, so an app whose server has not\n *   switched yet keeps working.\n */\nexport type AuthErrorCode =\n  | \"invalid_credentials\"\n  | \"registration_closed\"\n  | \"email_taken\"\n  | \"invitation_invalid\"\n  | \"invitation_expired\"\n  | \"token_invalid\"\n  /** 0.30.0: a link that WAS valid and ran out (verification, reset) — keksdose's step-3\n   *  refusals tell it from `token_invalid`, so a page can say \"expired, ask for a new one\". */\n  | \"token_expired\"\n  | \"account_inactive\"\n  | \"session_ended\";\n\n/**\n * 0.30.0: the coded refusals of user administration and the account's own settings\n * (docs/user-admin-harmonization.md §4, §6) — server-kit 0.4.0's `AccountErrorCode`,\n * value for value. The same family of answer as the sign-in codes (`{detail, code}`,\n * plus `companies` on kastlan's `last_admin`), read by the same {@link authErrorCode}.\n *\n * - `last_admin` — the action would leave no active admin: deactivating, demoting or\n *   deleting the last one (in kastlan, of a company; the answer names the `companies`).\n * - `self_action` — an admin acting on their own account where that is never allowed.\n * - `other_companies` — kastlan: the account belongs to other companies too, so a\n *   company admin may not deactivate it; \"Remove from company\" instead (§9.6).\n * - `household_has_members` — keksdose's guard on a deletion request (§6.4).\n * - `confirmation_required`, `confirmation_mismatch` — the action's confirmation level\n *   asked for a typed address (or a tick), and the request carried none, or another\n *   address (§4.2).\n * - `password_incorrect` — the CURRENT password is wrong on a signed-in route (the email\n *   change, the deletion request). `400`, not `401`: an app's client reads a 401 as an\n *   ended session and signs the user out, the wrong answer to a typo. Every other one\n *   is a `409`.\n */\nexport type AccountErrorCode =\n  | \"last_admin\"\n  | \"self_action\"\n  | \"other_companies\"\n  | \"household_has_members\"\n  | \"confirmation_required\"\n  | \"confirmation_mismatch\"\n  | \"password_incorrect\";\n\n/**\n * 0.31.0: the demo's coded refusals (docs/landing-demo-harmonization.md §6.2) —\n * server-kit 0.5's `DemoErrorCode`, value for value, answered as `{detail, code}` like\n * the others and read by the same {@link authErrorCode}.\n *\n * - `demo_disabled` — `404`: the demo switch is off (it is \"not there\", not forbidden).\n * - `demo_rate_limited` — `429` with `Retry-After`: the per-IP window of demo starts.\n * - `demo_capacity` — `429`, no `Retry-After`: the cap of live demo users.\n * - `demo_not_ready` — `503`: the demo data has not been seeded yet.\n * - `demo_read_only` — `403`, model R: any write by a demo user. The app's write lock\n *   already explains it, so it shows no toast (§5.4).\n * - `demo_refused` — `403`, both models: an action a demo never may — a way in or out,\n *   mail, uploads, the account export (§6.4).\n */\nexport type DemoErrorCode =\n  \"demo_disabled\" | \"demo_rate_limited\" | \"demo_capacity\" | \"demo_not_ready\" | \"demo_read_only\" | \"demo_refused\";\n\n/**\n * 0.32.0: billing's coded refusals (docs/billing-harmonization.md §3.3, §3.4, §4, §12.3) —\n * server-kit 0.6's `BillingError` and `PlanLimitError`, value for value, answered as\n * `{detail, code}` like the others and read by the same {@link authErrorCode}.\n *\n * - `billing_disabled` — `404`: the billing switch is off (§2.9), so every billing route\n *   but `GET /billing/status` is \"not there\", as a switched-off demo is.\n * - `billing_read_only` — `402`: a write by (or into the data of) a payer out of good\n *   standing (§3.3, §12.1). Inside a sync reply it marks the changes that were refused\n *   and not applied (§12.5). The app's write lock and banner already say why, so — like\n *   `demo_read_only` — it needs no toast of its own.\n * - `plan_limit` — `402`: a create past the plan's limit (§3.4), with the extra fields\n *   `dimension`, `plan`, `limit` and `used` — read them with `isPlanLimit`. A lapsed payer\n *   creating gets `billing_read_only` instead, never this (§12.3).\n * - `billing_not_configured` — billing is switched on but the provider's settings are\n *   missing (the secrets, a price id): the operator's mistake, not the payer's.\n *\n * 0.33.0 (server-kit 0.7, §14.2): the provider's refusals, with the `billing_` prefix of\n * the others (decision 22).\n * - `billing_provider_unavailable` — `502`: Paddle didn't answer, or refused the request.\n *   Try again.\n * - `billing_not_at_provider` — `409`: a portal request before the payer reached the\n *   provider (§14.5) — a stale page; the overview's `at_provider` says it first.\n * - `billing_already_subscribed` — `409`: a checkout while a provider subscription runs\n *   (§14.6). Since 0.39 plan changes go through the plan switch (§15.2.10).\n * - `billing_plan_not_sold` — `422`: a checkout for a plan, currency or interval the\n *   catalogue doesn't sell — or (0.39) a switch to one.\n *\n * 0.39.0 (server-kit 0.12, §15.2.10): the plan switch's refusals.\n * - `billing_not_subscribed` — `409`: a switch with no running provider subscription;\n *   the page offers the checkout instead.\n * - `billing_plan_unchanged` — `409`: a switch to the price the payer pays now.\n */\nexport type BillingErrorCode =\n  | \"billing_disabled\"\n  | \"billing_read_only\"\n  | \"plan_limit\"\n  | \"billing_not_configured\"\n  | \"billing_provider_unavailable\"\n  | \"billing_not_at_provider\"\n  | \"billing_already_subscribed\"\n  | \"billing_plan_not_sold\"\n  | \"billing_not_subscribed\"\n  | \"billing_plan_unchanged\";\n\n/** Every code the kit reads: the sign-in refusals, the account ones (0.30.0), the demo's\n *  (0.31.0) and billing's (0.32.0). */\nexport type KitErrorCode = AuthErrorCode | AccountErrorCode | DemoErrorCode | BillingErrorCode;\n\nconst BILLING_CODES: ReadonlySet<BillingErrorCode> = new Set<BillingErrorCode>([\n  \"billing_disabled\",\n  \"billing_read_only\",\n  \"plan_limit\",\n  \"billing_not_configured\",\n  \"billing_provider_unavailable\",\n  \"billing_not_at_provider\",\n  \"billing_already_subscribed\",\n  \"billing_plan_not_sold\",\n  \"billing_not_subscribed\",\n  \"billing_plan_unchanged\",\n]);\n\nconst CODES: ReadonlySet<string> = new Set<KitErrorCode>([\n  \"invalid_credentials\",\n  \"registration_closed\",\n  \"email_taken\",\n  \"invitation_invalid\",\n  \"invitation_expired\",\n  \"token_invalid\",\n  \"token_expired\",\n  \"account_inactive\",\n  \"session_ended\",\n  \"last_admin\",\n  \"self_action\",\n  \"other_companies\",\n  \"household_has_members\",\n  \"confirmation_required\",\n  \"confirmation_mismatch\",\n  \"password_incorrect\",\n  \"demo_disabled\",\n  \"demo_rate_limited\",\n  \"demo_capacity\",\n  \"demo_not_ready\",\n  \"demo_read_only\",\n  \"demo_refused\",\n  ...BILLING_CODES,\n]);\n\ntype Bag = Record<string, unknown>;\n\nconst isBag = (value: unknown): value is Bag => typeof value === \"object\" && value !== null;\n\n/** A known code, or undefined. */\nfunction known(value: unknown): KitErrorCode | undefined {\n  return typeof value === \"string\" && CODES.has(value) ? (value as KitErrorCode) : undefined;\n}\n\n/** `{code}` on a parsed body, or FastAPI's `{detail: {code}}` — what an\n *  `HTTPException(detail={\"code\": …})` serialises to. */\nfunction codeOfBody(body: unknown): KitErrorCode | undefined {\n  if (!isBag(body)) return undefined;\n  return known(body.code) ?? (isBag(body.detail) ? known(body.detail.code) : undefined);\n}\n\n/**\n * The code an error carries — an {@link AuthErrorCode}, since 0.30.0 an\n * {@link AccountErrorCode}, since 0.31.0 a {@link DemoErrorCode}, since 0.32.0 a\n * {@link BillingErrorCode} — or `undefined` when it carries none.\n *\n * Reads the parsed response body wherever the apps' HTTP clients put it, without\n * depending on any of them:\n *\n *  1. `err.response.data` — axios (keksdose's, kastlan's and Kurvenschmiede's clients;\n *     keksdose's `isPlanBudgetLimitRefusal` reads the same path);\n *  2. `err.data` — ofetch's `FetchError`, and most `fetch` wrappers that parse the body;\n *  3. `err.body` — the generated OpenAPI clients' `ApiError`;\n *  4. `err` itself — a body thrown as it came (`throw await res.json()`).\n *\n * In each, `code` or FastAPI's nested `detail.code`. Last, `err.code` — but only when\n * it is one of the codes above: axios writes its OWN codes there (`ERR_NETWORK`,\n * `ECONNABORTED`, `ERR_BAD_REQUEST`), and so does Node, so an unknown value is never\n * read as a refusal. The HTTP status is not checked: the code is the contract, and the\n * status differs per refusal (401, 402, 403, 404, 409, 410).\n */\nexport function authErrorCode(err: unknown): KitErrorCode | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (\n    (isBag(response) ? codeOfBody(response.data) : undefined) ??\n    codeOfBody(err.data) ??\n    codeOfBody(err.body) ??\n    codeOfBody(err)\n  );\n}\n\n/**\n * Whether `err` is a coded auth refusal — any of them, or the one named:\n *\n * ```ts\n * try { await api.register(values) }\n * catch (err) { if (isAuthError(err, \"email_taken\")) … }\n * ```\n *\n * The kit's `SignInForm` and `RegisterForm` call it on what their callbacks reject\n * with, so an app's `onSubmit` can simply let its client's error through. See\n * {@link authErrorCode} for the shapes it reads. Since 0.30.0 it knows the account codes\n * too: `isAuthError(err, \"last_admin\")`; since 0.31.0 the demo's:\n * `isAuthError(err, \"demo_read_only\")`; since 0.32.0 billing's:\n * `isAuthError(err, \"billing_read_only\")` (or {@link isBillingError}).\n */\nexport function isAuthError(err: unknown, code?: KitErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && (code === undefined || found === code);\n}\n\n/**\n * Whether `err` is one of billing's coded refusals (0.32.0, docs/billing-harmonization.md\n * §10, §14.2) — any of them, or the one named. {@link isAuthError} answers the same for a\n * named code; this one also answers \"is it billing's at all\", which an app's error\n * handler asks before it decides between the write lock, a `PlanLimitNotice` and a toast.\n */\nexport function isBillingError(err: unknown, code?: BillingErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && BILLING_CODES.has(found as BillingErrorCode) && (code === undefined || found === code);\n}\n\n/**\n * The parsed body that carries a code, wherever {@link authErrorCode} would find it (in\n * the same order) — the object with the `code`, so FastAPI's nested `detail` when the code\n * is there. For a reader of a refusal's EXTRA fields (`isPlanLimit`: `dimension`, `limit`,\n * `used` sit beside the code). `accept` decides which codes count; default, the known ones.\n *\n * @internal Not part of the barrel.\n */\nexport function errorBodyWithCode(\n  err: unknown,\n  accept: (code: unknown) => boolean = (code) => known(code) !== undefined,\n): Record<string, unknown> | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  for (const body of [isBag(response) ? response.data : undefined, err.data, err.body, err]) {\n    if (!isBag(body)) continue;\n    if (accept(body.code)) return body;\n    if (isBag(body.detail) && accept(body.detail.code)) return body.detail;\n  }\n  return undefined;\n}\n\n/**\n * The HTTP status a thrown error carries ({@link httpStatusOf}): axios'\n * `response.status`, then `status`, then `statusCode`. Lives in `lib/http-status.ts`\n * since 0.52 (refactor audit 2026-10-30, MOD-6); re-exported here for the modules that\n * import it from auth. Package-private — not re-exported from the barrel.\n */\nexport { httpStatusOf };\n\n/**\n * Whether `err` is a throttled request — HTTP `429 Too Many Requests` (0.30.0, from the\n * apps' 0.29 adoption: every app answered a throttled sign-in, sign-up or reset through\n * its own `describeError`, with three wordings of one sentence).\n *\n * A throttle carries no `code` in the contract — the STATUS is the answer, set by the\n * apps' limiters (server-kit's `AuthLimiters`, keksdose's per-IP limit) — so this reads\n * the status, wherever the apps' HTTP clients put it ({@link httpStatusOf}).\n *\n * There is no `rate_limited` code: keksdose answers its 429s uncoded, with a\n * `Retry-After` header, and the status is the one signal every limiter gives.\n *\n * The kit's `SignInForm`, `RegisterForm`, `ForgotPasswordForm` and `ResetPasswordForm`\n * call it AFTER the app's `describeError` — an app with words of its own keeps them —\n * and before their generic failure, so \"Too many attempts. Try again in 30 s.\" (with\n * {@link retryAfterSeconds}) or \"… Wait a moment and try again.\" needs no app code.\n */\nexport function isRateLimited(err: unknown): boolean {\n  return httpStatusOf(err) === 429;\n}\n\n/** A header's value from a `Headers` (fetch, ofetch's `response`), axios' `AxiosHeaders`\n *  or a plain record — whose keys may come in any case. */\nfunction headerOf(headers: unknown, name: string): unknown {\n  if (!isBag(headers)) return undefined;\n  if (typeof headers.get === \"function\") {\n    try {\n      const value: unknown = (headers.get as (key: string) => unknown).call(headers, name);\n      if (value !== undefined && value !== null) return value;\n    } catch {\n      // A `get` that is not a header lookup; the record below is.\n    }\n  }\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === name) return value;\n  }\n  return undefined;\n}\n\n/** `Retry-After` as seconds from `now`: delta-seconds (\"30\"), or an HTTP date\n *  (\"Wed, 07 Oct 2026 10:00:00 GMT\") counted from now, never below 0 (RFC 9110 §10.2.3). */\nfunction parseRetryAfter(value: unknown, now: number): number | undefined {\n  const raw = Array.isArray(value) ? (value as unknown[])[0] : value;\n  if (typeof raw === \"number\") return Number.isFinite(raw) && raw >= 0 ? Math.ceil(raw) : undefined;\n  if (typeof raw !== \"string\") return undefined;\n  const text = raw.trim();\n  if (/^\\d+$/.test(text)) return Number(text);\n  // An HTTP date names its day and month (\"Wed, 07 Oct 2026 …\"). Without a letter it is\n  // a malformed number (\"-5\", \"1.5\"), which `Date.parse` would happily read as a year.\n  if (!/[a-z]/i.test(text)) return undefined;\n  const at = Date.parse(text);\n  if (Number.isNaN(at)) return undefined;\n  return Math.max(0, Math.ceil((at - now) / 1000));\n}\n\n/**\n * How long a throttled request asks to wait, in whole seconds — its `Retry-After`\n * header (0.30.0, keksdose: its 429s carry no code, only the header) — or `undefined`\n * when there is none, or none that parses.\n *\n * Read where the apps' clients keep the response headers, without depending on any of\n * them: `err.response.headers` (axios' `AxiosHeaders` or a plain record; ofetch's\n * `FetchError.response`, a fetch `Headers`), then `err.headers` (a `Response` thrown as\n * it came). The value is delta-seconds, or an HTTP date turned into seconds from `now`\n * (default: the present moment) — never below 0.\n *\n * The forms hand it to their `rateLimited` label when {@link isRateLimited} is true:\n * \"Too many attempts. Try again in 30 s.\" — and, without one, \"… Wait a moment and try\n * again.\" A browser only exposes `Retry-After` to a cross-origin page when the server\n * lists it in `Access-Control-Expose-Headers`.\n */\nexport function retryAfterSeconds(err: unknown, now: number | Date = Date.now()): number | undefined {\n  if (!isBag(err)) return undefined;\n  const at = typeof now === \"number\" ? now : now.getTime();\n  const response = err.response;\n  const value =\n    (isBag(response) ? headerOf(response.headers, \"retry-after\") : undefined) ?? headerOf(err.headers, \"retry-after\");\n  return value === undefined ? undefined : parseRetryAfter(value, at);\n}\n\n// The English of the `rateLimited` labels, in auth-errors-labels since 0.52: the English\n// catalogue reached this module for them, and with it `lib/http-status` (refactor audit\n// 2026-10-30, MOD-6). Re-exported for the modules that import them from here.\nexport { englishRateLimited, englishWait } from \"./auth-errors-labels\";\n"],"mappings":";AAAA,SAAS,oBAAoB;AA2I7B,MAAM,gBAA+C,oBAAI,IAAsB;AAAA,EAC7E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,QAA6B,oBAAI,IAAkB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,CAAC;AAID,MAAM,QAAQ,CAAC,UAAiC,OAAO,UAAU,YAAY,UAAU;AAGvF,SAAS,MAAM,OAA0C;AACvD,SAAO,OAAO,UAAU,YAAY,MAAM,IAAI,KAAK,IAAK,QAAyB;AACnF;AAIA,SAAS,WAAW,MAAyC;AAC3D,MAAI,CAAC,MAAM,IAAI,EAAG,QAAO;AACzB,SAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI;AAC7E;AAsBO,SAAS,cAAc,KAAwC;AACpE,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UACG,MAAM,QAAQ,IAAI,WAAW,SAAS,IAAI,IAAI,WAC/C,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,KACnB,WAAW,GAAG;AAElB;AAiBO,SAAS,YAAY,KAAc,MAA8B;AACtE,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,WAAc,SAAS,UAAa,UAAU;AACjE;AAQO,SAAS,eAAe,KAAc,MAAkC;AAC7E,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,UAAa,cAAc,IAAI,KAAyB,MAAM,SAAS,UAAa,UAAU;AACjH;AAUO,SAAS,kBACd,KACA,SAAqC,CAAC,SAAS,MAAM,IAAI,MAAM,QAC1B;AACrC,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,aAAW,QAAQ,CAAC,MAAM,QAAQ,IAAI,SAAS,OAAO,QAAW,IAAI,MAAM,IAAI,MAAM,GAAG,GAAG;AACzF,QAAI,CAAC,MAAM,IAAI,EAAG;AAClB,QAAI,OAAO,KAAK,IAAI,EAAG,QAAO;AAC9B,QAAI,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,IAAI,EAAG,QAAO,KAAK;AAAA,EAClE;AACA,SAAO;AACT;AA2BO,SAAS,cAAc,KAAuB;AACnD,SAAO,aAAa,GAAG,MAAM;AAC/B;AAIA,SAAS,SAAS,SAAkB,MAAuB;AACzD,MAAI,CAAC,MAAM,OAAO,EAAG,QAAO;AAC5B,MAAI,OAAO,QAAQ,QAAQ,YAAY;AACrC,QAAI;AACF,YAAM,QAAkB,QAAQ,IAAiC,KAAK,SAAS,IAAI;AACnF,UAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,KAAM,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,gBAAgB,OAAgB,KAAiC;AACxE,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAK,MAAoB,CAAC,IAAI;AAC7D,MAAI,OAAO,QAAQ,SAAU,QAAO,OAAO,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,IAAI;AACxF,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,OAAO,IAAI,KAAK;AACtB,MAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,OAAO,IAAI;AAG1C,MAAI,CAAC,SAAS,KAAK,IAAI,EAAG,QAAO;AACjC,QAAM,KAAK,KAAK,MAAM,IAAI;AAC1B,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,GAAI,CAAC;AACjD;AAkBO,SAAS,kBAAkB,KAAc,MAAqB,KAAK,IAAI,GAAuB;AACnG,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,KAAK,OAAO,QAAQ,WAAW,MAAM,IAAI,QAAQ;AACvD,QAAM,WAAW,IAAI;AACrB,QAAM,SACH,MAAM,QAAQ,IAAI,SAAS,SAAS,SAAS,aAAa,IAAI,WAAc,SAAS,IAAI,SAAS,aAAa;AAClH,SAAO,UAAU,SAAY,SAAY,gBAAgB,OAAO,EAAE;AACpE;AAKA,SAAS,oBAAoB,mBAAmB;","names":[]}

package/dist/auth/complete-name-dialog.js

@@ -2,6 +2,7 @@
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { useContext, useEffect, useId, useRef, useState } from "react";
 import { useKitLabels } from "../i18n/kit-labels.js";
+import { describeFailure } from "../lib/describe-failure.js";
 import { usePromisePending } from "../components/danger-confirm.js";
 import { DialogFrame } from "../components/dialog-frame.js";
 import { ModalCloseContext } from "../components/modal.js";
@@ -67,7 +68,7 @@ function CompleteNameDialog({
     set(value);
     setFailed(false);
   };
-  const message = failed ? error ?? labels.failed : void 0;
+  const message = failed ? describeFailure(error, labels.failed) : void 0;
   return /* @__PURE__ */ jsx(
     DialogFrame,
     {

package/dist/auth/complete-name-dialog.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/complete-name-dialog.tsx"],"sourcesContent":["import { useContext, useEffect, useId, useRef, useState } from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { usePromisePending } from \"../components/danger-confirm\";\nimport { DialogFrame } from \"../components/dialog-frame\";\nimport { ModalCloseContext } from \"../components/modal\";\nimport { Button } from \"../components/button\";\nimport { Input } from \"../components/input\";\nimport { personNameOk, PERSON_NAME_MAX_LENGTH } from \"./form-rules\";\nimport { COMMIT_EXCEPT_BILLING } from \"../components/write-lock\";\nimport { DEFAULT_COMPLETE_NAME_LABELS } from \"./complete-name-dialog-labels\";\n\n/** What `CompleteNameDialog` hands `onSave`: both names, trimmed, 1–120 characters —\n *  `PATCH /auth/me {first_name, last_name}` (§6.1). */\nexport interface CompleteNameValues {\n  firstName: string;\n  lastName: string;\n}\n\n/**\n * Every string the dialog renders — the `completeName` namespace of `<UiKitProvider\n * labels>`, overridable per instance through `labels`.\n */\nexport interface CompleteNameLabels {\n  title: string;\n  description: string;\n  firstName: string;\n  lastName: string;\n  save: string;\n  /** Dismisses the dialog until the next sign-in. */\n  later: string;\n  /** Under the fields when `onSave` rejected and the app passed no `error`. */\n  failed: string;\n}\n\n// Defined in ./complete-name-dialog-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_COMPLETE_NAME_LABELS };\n\nexport interface CompleteNameDialogProps {\n  /** What the account holds now — after the migration, the old display name (§3.3). */\n  firstName?: string;\n  /** Usually empty: that is why the dialog is up. */\n  lastName?: string;\n  /**\n   * Save the names (`PATCH /auth/me`). Resolve and the dialog closes (`onClose(true)`);\n   * reject and it stays open with the names kept and `error` — or \"Your name could not\n   * be saved\" — under them.\n   */\n  onSave: (values: CompleteNameValues) => Promise<unknown>;\n  /**\n   * The dialog has closed: `true` after a resolved `onSave`, `false` for \"Later\", Escape,\n   * the backdrop and Back. `false` only DEFERS it: the app shows it again after the\n   * next sign-in while `/auth/me` still answers `name_incomplete: true`.\n   */\n  onClose: (saved: boolean) => void;\n  /** The app's words for the last failed save, instead of `labels.failed`. Hidden again\n   *  once a name is edited. */\n  error?: ReactNode;\n  /** Kept-mounted mode, as on `Modal`: left out, the dialog is open while mounted. */\n  open?: boolean;\n  labels?: LabelOverride<CompleteNameLabels>;\n}\n\n/**\n * \"Complete your name\" — asked once after sign-in of a user whose name was migrated\n * (docs/auth-harmonization.md §3.3). keksdose's and Kurvenschmiede's accounts had one\n * `display_name`; it moved whole into `first_name`, `last_name` stayed empty, and\n * nothing was split by guesswork (§2.4). The app shows this while `/auth/me` answers\n * `name_incomplete: true` — never for a demo user.\n *\n * Both names prefilled with what is there; \"Save\" waits until both have 1–120\n * characters after trimming. **\"Later\" only defers it**: nothing else waits on a\n * complete name, no page is blocked, and the app asks again at the next sign-in.\n *\n * The promise handling is `ReauthDialog`'s: busy while `onSave` runs (the fields\n * read-only, \"Later\" disabled, Escape, the backdrop and Back held — a request that has\n * left cannot be called back by closing the dialog), closed on resolve, kept open on\n * reject. Save is a\n * `commit` control, so a `WriteLockProvider` above it locks it with its reason — every\n * lock but a lapsed plan's (`COMMIT_EXCEPT_BILLING`, 0.33): one's own name is the\n * account's own settings, which billing never locks (docs/billing-harmonization.md §3.3,\n * §12.36).\n *\n * Focus starts in the first EMPTY field — the last name, as a rule — because filling it\n * in is the whole of what the dialog is for.\n */\nexport function CompleteNameDialog({\n  firstName: initialFirst = \"\",\n  lastName: initialLast = \"\",\n  onSave,\n  onClose,\n  error,\n  open,\n  labels: labelsProp,\n}: CompleteNameDialogProps) {\n  const labels = useKitLabels(\"completeName\", DEFAULT_COMPLETE_NAME_LABELS, labelsProp);\n  const [first, setFirst] = useState(initialFirst);\n  const [last, setLast] = useState(initialLast);\n  // A failed save describes the names that were sent; an edit makes it stale.\n  const [failed, setFailed] = useState(false);\n  const { pending, run } = usePromisePending();\n  const [done, setDone] = useState(false);\n  const saved = useRef(false);\n  const formId = useId();\n  const firstRef = useRef<HTMLInputElement>(null);\n  const lastRef = useRef<HTMLInputElement>(null);\n  const isOpen = open ?? true;\n\n  // Reopened (kept-mounted): start again from what the account holds. During render,\n  // as ReauthDialog wipes its password, so no frame shows the old draft.\n  const [wasOpen, setWasOpen] = useState(isOpen);\n  if (wasOpen !== isOpen) {\n    setWasOpen(isOpen);\n    if (isOpen) {\n      setFirst(initialFirst);\n      setLast(initialLast);\n      setFailed(false);\n      setDone(false);\n    }\n  }\n\n  // After Modal's own effect, so its trap has recorded the trigger before focus moves.\n  useEffect(() => {\n    if (!isOpen) return;\n    saved.current = false;\n    const target = firstRef.current?.value.trim() ? lastRef.current : firstRef.current;\n    target?.focus();\n  }, [isOpen]);\n\n  const canSave = personNameOk(first) && personNameOk(last);\n\n  const submit = () => {\n    if (pending || !canSave) return;\n    setFailed(false);\n    const values = { firstName: first.trim(), lastName: last.trim() };\n    let result: Promise<unknown>;\n    try {\n      result = Promise.resolve(onSave(values));\n    } catch (err) {\n      result = Promise.reject(err);\n    }\n    // A rejection must not go unhandled; usePromisePending clears `pending` on it.\n    result.catch(() => setFailed(true));\n    run(result, () => {\n      saved.current = true;\n      setDone(true);\n    });\n  };\n\n  const edit = (set: (value: string) => void) => (value: string) => {\n    set(value);\n    setFailed(false);\n  };\n\n  const message = failed ? (error ?? labels.failed) : undefined;\n\n  return (\n    <DialogFrame\n      open={open}\n      title={labels.title}\n      description={labels.description}\n      onClose={() => onClose(saved.current)}\n      busy={pending}\n      actions={\n        <CompleteNameActions\n          formId={formId}\n          done={done}\n          busy={pending}\n          canSave={canSave}\n          laterLabel={labels.later}\n          saveLabel={labels.save}\n        />\n      }\n    >\n      <form\n        id={formId}\n        noValidate\n        className=\"grid gap-3 @container\"\n        onSubmit={(e) => {\n          e.preventDefault();\n          submit();\n        }}\n      >\n        <div className=\"grid gap-3 @xs:grid-cols-2\">\n          <Input\n            ref={firstRef}\n            name=\"given-name\"\n            autoComplete=\"given-name\"\n            label={labels.firstName}\n            value={first}\n            onChange={(e) => edit(setFirst)(e.target.value)}\n            maxLength={PERSON_NAME_MAX_LENGTH}\n            readOnly={pending}\n            required\n          />\n          <Input\n            ref={lastRef}\n            name=\"family-name\"\n            autoComplete=\"family-name\"\n            label={labels.lastName}\n            value={last}\n            onChange={(e) => edit(setLast)(e.target.value)}\n            maxLength={PERSON_NAME_MAX_LENGTH}\n            readOnly={pending}\n            required\n          />\n        </div>\n        {message !== undefined && (\n          <p role=\"alert\" className=\"text-xs text-danger\">\n            {message}\n          </p>\n        )}\n      </form>\n    </DialogFrame>\n  );\n}\n\n/** The actions row, inside the `Modal`, where its animated close is in context: a\n *  resolved save lowers the panel through it, as \"Later\" and Escape do. */\nfunction CompleteNameActions({\n  formId,\n  done,\n  busy,\n  canSave,\n  laterLabel,\n  saveLabel,\n}: {\n  formId: string;\n  done: boolean;\n  busy: boolean;\n  canSave: boolean;\n  laterLabel: string;\n  saveLabel: string;\n}) {\n  const close = useContext(ModalCloseContext);\n  useEffect(() => {\n    if (done) close?.();\n  }, [done, close]);\n  return (\n    <>\n      <Button type=\"button\" variant=\"ghost\" disabled={busy} onClick={() => close?.()}>\n        {laterLabel}\n      </Button>\n      <Button type=\"submit\" form={formId} commit={COMMIT_EXCEPT_BILLING} disabled={!busy && !canSave} pending={busy}>\n        {saveLabel}\n      </Button>\n    </>\n  );\n}\n"],"mappings":";AAqKQ,SA2EJ,UA3EI,KAmBA,YAnBA;AArKR,SAAS,YAAY,WAAW,OAAO,QAAQ,gBAAgB;AAG/D,SAAS,oBAAwC;AACjD,SAAS,yBAAyB;AAClC,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,cAAc,8BAA8B;AACrD,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AA4EtC,SAAS,mBAAmB;AAAA,EACjC,WAAW,eAAe;AAAA,EAC1B,UAAU,cAAc;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAA4B;AAC1B,QAAM,SAAS,aAAa,gBAAgB,8BAA8B,UAAU;AACpF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,YAAY;AAC/C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,WAAW;AAE5C,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,EAAE,SAAS,IAAI,IAAI,kBAAkB;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,QAAQ,OAAO,KAAK;AAC1B,QAAM,SAAS,MAAM;AACrB,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,UAAU,OAAyB,IAAI;AAC7C,QAAM,SAAS,QAAQ;AAIvB,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,MAAM;AAC7C,MAAI,YAAY,QAAQ;AACtB,eAAW,MAAM;AACjB,QAAI,QAAQ;AACV,eAAS,YAAY;AACrB,cAAQ,WAAW;AACnB,gBAAU,KAAK;AACf,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAGA,YAAU,MAAM;AACd,QAAI,CAAC,OAAQ;AACb,UAAM,UAAU;AAChB,UAAM,SAAS,SAAS,SAAS,MAAM,KAAK,IAAI,QAAQ,UAAU,SAAS;AAC3E,YAAQ,MAAM;AAAA,EAChB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,UAAU,aAAa,KAAK,KAAK,aAAa,IAAI;AAExD,QAAM,SAAS,MAAM;AACnB,QAAI,WAAW,CAAC,QAAS;AACzB,cAAU,KAAK;AACf,UAAM,SAAS,EAAE,WAAW,MAAM,KAAK,GAAG,UAAU,KAAK,KAAK,EAAE;AAChE,QAAI;AACJ,QAAI;AACF,eAAS,QAAQ,QAAQ,OAAO,MAAM,CAAC;AAAA,IACzC,SAAS,KAAK;AACZ,eAAS,QAAQ,OAAO,GAAG;AAAA,IAC7B;AAEA,WAAO,MAAM,MAAM,UAAU,IAAI,CAAC;AAClC,QAAI,QAAQ,MAAM;AAChB,YAAM,UAAU;AAChB,cAAQ,IAAI;AAAA,IACd,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,CAAC,QAAiC,CAAC,UAAkB;AAChE,QAAI,KAAK;AACT,cAAU,KAAK;AAAA,EACjB;AAEA,QAAM,UAAU,SAAU,SAAS,OAAO,SAAU;AAEpD,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,OAAO,OAAO;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,SAAS,MAAM,QAAQ,MAAM,OAAO;AAAA,MACpC,MAAM;AAAA,MACN,SACE;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,WAAW,OAAO;AAAA;AAAA,MACpB;AAAA,MAGF;AAAA,QAAC;AAAA;AAAA,UACC,IAAI;AAAA,UACJ,YAAU;AAAA,UACV,WAAU;AAAA,UACV,UAAU,CAAC,MAAM;AACf,cAAE,eAAe;AACjB,mBAAO;AAAA,UACT;AAAA,UAEA;AAAA,iCAAC,SAAI,WAAU,8BACb;AAAA;AAAA,gBAAC;AAAA;AAAA,kBACC,KAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,OAAO,OAAO;AAAA,kBACd,OAAO;AAAA,kBACP,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,EAAE,OAAO,KAAK;AAAA,kBAC9C,WAAW;AAAA,kBACX,UAAU;AAAA,kBACV,UAAQ;AAAA;AAAA,cACV;AAAA,cACA;AAAA,gBAAC;AAAA;AAAA,kBACC,KAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,OAAO,OAAO;AAAA,kBACd,OAAO;AAAA,kBACP,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,EAAE,OAAO,KAAK;AAAA,kBAC7C,WAAW;AAAA,kBACX,UAAU;AAAA,kBACV,UAAQ;AAAA;AAAA,cACV;AAAA,eACF;AAAA,YACC,YAAY,UACX,oBAAC,OAAE,MAAK,SAAQ,WAAU,uBACvB,mBACH;AAAA;AAAA;AAAA,MAEJ;AAAA;AAAA,EACF;AAEJ;AAIA,SAAS,oBAAoB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOG;AACD,QAAM,QAAQ,WAAW,iBAAiB;AAC1C,YAAU,MAAM;AACd,QAAI,KAAM,SAAQ;AAAA,EACpB,GAAG,CAAC,MAAM,KAAK,CAAC;AAChB,SACE,iCACE;AAAA,wBAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,UAAU,MAAM,SAAS,MAAM,QAAQ,GAC1E,sBACH;AAAA,IACA,oBAAC,UAAO,MAAK,UAAS,MAAM,QAAQ,QAAQ,uBAAuB,UAAU,CAAC,QAAQ,CAAC,SAAS,SAAS,MACtG,qBACH;AAAA,KACF;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/auth/complete-name-dialog.tsx"],"sourcesContent":["import { useContext, useEffect, useId, useRef, useState } from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { describeFailure } from \"../lib/describe-failure\";\nimport { usePromisePending } from \"../components/danger-confirm\";\nimport { DialogFrame } from \"../components/dialog-frame\";\nimport { ModalCloseContext } from \"../components/modal\";\nimport { Button } from \"../components/button\";\nimport { Input } from \"../components/input\";\nimport { personNameOk, PERSON_NAME_MAX_LENGTH } from \"./form-rules\";\nimport { COMMIT_EXCEPT_BILLING } from \"../components/write-lock\";\nimport { DEFAULT_COMPLETE_NAME_LABELS } from \"./complete-name-dialog-labels\";\n\n/** What `CompleteNameDialog` hands `onSave`: both names, trimmed, 1–120 characters —\n *  `PATCH /auth/me {first_name, last_name}` (§6.1). */\nexport interface CompleteNameValues {\n  firstName: string;\n  lastName: string;\n}\n\n/**\n * Every string the dialog renders — the `completeName` namespace of `<UiKitProvider\n * labels>`, overridable per instance through `labels`.\n */\nexport interface CompleteNameLabels {\n  title: string;\n  description: string;\n  firstName: string;\n  lastName: string;\n  save: string;\n  /** Dismisses the dialog until the next sign-in. */\n  later: string;\n  /** Under the fields when `onSave` rejected and the app passed no `error`. */\n  failed: string;\n}\n\n// Defined in ./complete-name-dialog-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_COMPLETE_NAME_LABELS };\n\nexport interface CompleteNameDialogProps {\n  /** What the account holds now — after the migration, the old display name (§3.3). */\n  firstName?: string;\n  /** Usually empty: that is why the dialog is up. */\n  lastName?: string;\n  /**\n   * Save the names (`PATCH /auth/me`). Resolve and the dialog closes (`onClose(true)`);\n   * reject and it stays open with the names kept and `error` — or \"Your name could not\n   * be saved\" — under them.\n   */\n  onSave: (values: CompleteNameValues) => Promise<unknown>;\n  /**\n   * The dialog has closed: `true` after a resolved `onSave`, `false` for \"Later\", Escape,\n   * the backdrop and Back. `false` only DEFERS it: the app shows it again after the\n   * next sign-in while `/auth/me` still answers `name_incomplete: true`.\n   */\n  onClose: (saved: boolean) => void;\n  /** The app's words for the last failed save, instead of `labels.failed`. Hidden again\n   *  once a name is edited. */\n  error?: ReactNode;\n  /** Kept-mounted mode, as on `Modal`: left out, the dialog is open while mounted. */\n  open?: boolean;\n  labels?: LabelOverride<CompleteNameLabels>;\n}\n\n/**\n * \"Complete your name\" — asked once after sign-in of a user whose name was migrated\n * (docs/auth-harmonization.md §3.3). keksdose's and Kurvenschmiede's accounts had one\n * `display_name`; it moved whole into `first_name`, `last_name` stayed empty, and\n * nothing was split by guesswork (§2.4). The app shows this while `/auth/me` answers\n * `name_incomplete: true` — never for a demo user.\n *\n * Both names prefilled with what is there; \"Save\" waits until both have 1–120\n * characters after trimming. **\"Later\" only defers it**: nothing else waits on a\n * complete name, no page is blocked, and the app asks again at the next sign-in.\n *\n * The promise handling is `ReauthDialog`'s: busy while `onSave` runs (the fields\n * read-only, \"Later\" disabled, Escape, the backdrop and Back held — a request that has\n * left cannot be called back by closing the dialog), closed on resolve, kept open on\n * reject. Save is a\n * `commit` control, so a `WriteLockProvider` above it locks it with its reason — every\n * lock but a lapsed plan's (`COMMIT_EXCEPT_BILLING`, 0.33): one's own name is the\n * account's own settings, which billing never locks (docs/billing-harmonization.md §3.3,\n * §12.36).\n *\n * Focus starts in the first EMPTY field — the last name, as a rule — because filling it\n * in is the whole of what the dialog is for.\n */\nexport function CompleteNameDialog({\n  firstName: initialFirst = \"\",\n  lastName: initialLast = \"\",\n  onSave,\n  onClose,\n  error,\n  open,\n  labels: labelsProp,\n}: CompleteNameDialogProps) {\n  const labels = useKitLabels(\"completeName\", DEFAULT_COMPLETE_NAME_LABELS, labelsProp);\n  const [first, setFirst] = useState(initialFirst);\n  const [last, setLast] = useState(initialLast);\n  // A failed save describes the names that were sent; an edit makes it stale.\n  const [failed, setFailed] = useState(false);\n  const { pending, run } = usePromisePending();\n  const [done, setDone] = useState(false);\n  const saved = useRef(false);\n  const formId = useId();\n  const firstRef = useRef<HTMLInputElement>(null);\n  const lastRef = useRef<HTMLInputElement>(null);\n  const isOpen = open ?? true;\n\n  // Reopened (kept-mounted): start again from what the account holds. During render,\n  // as ReauthDialog wipes its password, so no frame shows the old draft.\n  const [wasOpen, setWasOpen] = useState(isOpen);\n  if (wasOpen !== isOpen) {\n    setWasOpen(isOpen);\n    if (isOpen) {\n      setFirst(initialFirst);\n      setLast(initialLast);\n      setFailed(false);\n      setDone(false);\n    }\n  }\n\n  // After Modal's own effect, so its trap has recorded the trigger before focus moves.\n  useEffect(() => {\n    if (!isOpen) return;\n    saved.current = false;\n    const target = firstRef.current?.value.trim() ? lastRef.current : firstRef.current;\n    target?.focus();\n  }, [isOpen]);\n\n  const canSave = personNameOk(first) && personNameOk(last);\n\n  const submit = () => {\n    if (pending || !canSave) return;\n    setFailed(false);\n    const values = { firstName: first.trim(), lastName: last.trim() };\n    let result: Promise<unknown>;\n    try {\n      result = Promise.resolve(onSave(values));\n    } catch (err) {\n      result = Promise.reject(err);\n    }\n    // A rejection must not go unhandled; usePromisePending clears `pending` on it.\n    result.catch(() => setFailed(true));\n    run(result, () => {\n      saved.current = true;\n      setDone(true);\n    });\n  };\n\n  const edit = (set: (value: string) => void) => (value: string) => {\n    set(value);\n    setFailed(false);\n  };\n\n  // An app's `failed && words` before it has words is `false`, which `??` kept (refactor\n  // audit 2026-10-30, DUP-14): the kit's sentence unless the app's says something.\n  const message = failed ? describeFailure(error, labels.failed) : undefined;\n\n  return (\n    <DialogFrame\n      open={open}\n      title={labels.title}\n      description={labels.description}\n      onClose={() => onClose(saved.current)}\n      busy={pending}\n      actions={\n        <CompleteNameActions\n          formId={formId}\n          done={done}\n          busy={pending}\n          canSave={canSave}\n          laterLabel={labels.later}\n          saveLabel={labels.save}\n        />\n      }\n    >\n      <form\n        id={formId}\n        noValidate\n        className=\"grid gap-3 @container\"\n        onSubmit={(e) => {\n          e.preventDefault();\n          submit();\n        }}\n      >\n        <div className=\"grid gap-3 @xs:grid-cols-2\">\n          <Input\n            ref={firstRef}\n            name=\"given-name\"\n            autoComplete=\"given-name\"\n            label={labels.firstName}\n            value={first}\n            onChange={(e) => edit(setFirst)(e.target.value)}\n            maxLength={PERSON_NAME_MAX_LENGTH}\n            readOnly={pending}\n            required\n          />\n          <Input\n            ref={lastRef}\n            name=\"family-name\"\n            autoComplete=\"family-name\"\n            label={labels.lastName}\n            value={last}\n            onChange={(e) => edit(setLast)(e.target.value)}\n            maxLength={PERSON_NAME_MAX_LENGTH}\n            readOnly={pending}\n            required\n          />\n        </div>\n        {message !== undefined && (\n          <p role=\"alert\" className=\"text-xs text-danger\">\n            {message}\n          </p>\n        )}\n      </form>\n    </DialogFrame>\n  );\n}\n\n/** The actions row, inside the `Modal`, where its animated close is in context: a\n *  resolved save lowers the panel through it, as \"Later\" and Escape do. */\nfunction CompleteNameActions({\n  formId,\n  done,\n  busy,\n  canSave,\n  laterLabel,\n  saveLabel,\n}: {\n  formId: string;\n  done: boolean;\n  busy: boolean;\n  canSave: boolean;\n  laterLabel: string;\n  saveLabel: string;\n}) {\n  const close = useContext(ModalCloseContext);\n  useEffect(() => {\n    if (done) close?.();\n  }, [done, close]);\n  return (\n    <>\n      <Button type=\"button\" variant=\"ghost\" disabled={busy} onClick={() => close?.()}>\n        {laterLabel}\n      </Button>\n      <Button type=\"submit\" form={formId} commit={COMMIT_EXCEPT_BILLING} disabled={!busy && !canSave} pending={busy}>\n        {saveLabel}\n      </Button>\n    </>\n  );\n}\n"],"mappings":";AAwKQ,SA2EJ,UA3EI,KAmBA,YAnBA;AAxKR,SAAS,YAAY,WAAW,OAAO,QAAQ,gBAAgB;AAG/D,SAAS,oBAAwC;AACjD,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,cAAc,8BAA8B;AACrD,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AA4EtC,SAAS,mBAAmB;AAAA,EACjC,WAAW,eAAe;AAAA,EAC1B,UAAU,cAAc;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAA4B;AAC1B,QAAM,SAAS,aAAa,gBAAgB,8BAA8B,UAAU;AACpF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,YAAY;AAC/C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,WAAW;AAE5C,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,EAAE,SAAS,IAAI,IAAI,kBAAkB;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,QAAQ,OAAO,KAAK;AAC1B,QAAM,SAAS,MAAM;AACrB,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,UAAU,OAAyB,IAAI;AAC7C,QAAM,SAAS,QAAQ;AAIvB,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,MAAM;AAC7C,MAAI,YAAY,QAAQ;AACtB,eAAW,MAAM;AACjB,QAAI,QAAQ;AACV,eAAS,YAAY;AACrB,cAAQ,WAAW;AACnB,gBAAU,KAAK;AACf,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAGA,YAAU,MAAM;AACd,QAAI,CAAC,OAAQ;AACb,UAAM,UAAU;AAChB,UAAM,SAAS,SAAS,SAAS,MAAM,KAAK,IAAI,QAAQ,UAAU,SAAS;AAC3E,YAAQ,MAAM;AAAA,EAChB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,UAAU,aAAa,KAAK,KAAK,aAAa,IAAI;AAExD,QAAM,SAAS,MAAM;AACnB,QAAI,WAAW,CAAC,QAAS;AACzB,cAAU,KAAK;AACf,UAAM,SAAS,EAAE,WAAW,MAAM,KAAK,GAAG,UAAU,KAAK,KAAK,EAAE;AAChE,QAAI;AACJ,QAAI;AACF,eAAS,QAAQ,QAAQ,OAAO,MAAM,CAAC;AAAA,IACzC,SAAS,KAAK;AACZ,eAAS,QAAQ,OAAO,GAAG;AAAA,IAC7B;AAEA,WAAO,MAAM,MAAM,UAAU,IAAI,CAAC;AAClC,QAAI,QAAQ,MAAM;AAChB,YAAM,UAAU;AAChB,cAAQ,IAAI;AAAA,IACd,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,CAAC,QAAiC,CAAC,UAAkB;AAChE,QAAI,KAAK;AACT,cAAU,KAAK;AAAA,EACjB;AAIA,QAAM,UAAU,SAAS,gBAAgB,OAAO,OAAO,MAAM,IAAI;AAEjE,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,OAAO,OAAO;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,SAAS,MAAM,QAAQ,MAAM,OAAO;AAAA,MACpC,MAAM;AAAA,MACN,SACE;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,WAAW,OAAO;AAAA;AAAA,MACpB;AAAA,MAGF;AAAA,QAAC;AAAA;AAAA,UACC,IAAI;AAAA,UACJ,YAAU;AAAA,UACV,WAAU;AAAA,UACV,UAAU,CAAC,MAAM;AACf,cAAE,eAAe;AACjB,mBAAO;AAAA,UACT;AAAA,UAEA;AAAA,iCAAC,SAAI,WAAU,8BACb;AAAA;AAAA,gBAAC;AAAA;AAAA,kBACC,KAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,OAAO,OAAO;AAAA,kBACd,OAAO;AAAA,kBACP,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,EAAE,OAAO,KAAK;AAAA,kBAC9C,WAAW;AAAA,kBACX,UAAU;AAAA,kBACV,UAAQ;AAAA;AAAA,cACV;AAAA,cACA;AAAA,gBAAC;AAAA;AAAA,kBACC,KAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,OAAO,OAAO;AAAA,kBACd,OAAO;AAAA,kBACP,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,EAAE,OAAO,KAAK;AAAA,kBAC7C,WAAW;AAAA,kBACX,UAAU;AAAA,kBACV,UAAQ;AAAA;AAAA,cACV;AAAA,eACF;AAAA,YACC,YAAY,UACX,oBAAC,OAAE,MAAK,SAAQ,WAAU,uBACvB,mBACH;AAAA;AAAA;AAAA,MAEJ;AAAA;AAAA,EACF;AAEJ;AAIA,SAAS,oBAAoB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOG;AACD,QAAM,QAAQ,WAAW,iBAAiB;AAC1C,YAAU,MAAM;AACd,QAAI,KAAM,SAAQ;AAAA,EACpB,GAAG,CAAC,MAAM,KAAK,CAAC;AAChB,SACE,iCACE;AAAA,wBAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,UAAU,MAAM,SAAS,MAAM,QAAQ,GAC1E,sBACH;AAAA,IACA,oBAAC,UAAO,MAAK,UAAS,MAAM,QAAQ,QAAQ,uBAAuB,UAAU,CAAC,QAAQ,CAAC,SAAS,SAAS,MACtG,qBACH;AAAA,KACF;AAEJ;","names":[]}

package/dist/auth/forgot-password-form-labels.js

@@ -1,5 +1,5 @@
 "use client";
-import { englishRateLimited } from "./auth-errors.js";
+import { englishRateLimited } from "./auth-errors-labels.js";
 const DEFAULT_FORGOT_PASSWORD_LABELS = {
   title: "Forgot password",
   intro: "Enter your account\u2019s email address. We\u2019ll send you a link to choose a new password.",

package/dist/auth/forgot-password-form-labels.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/forgot-password-form-labels.ts"],"sourcesContent":["// The English words of ./forgot-password-form, in a module with no component code: the\n// English catalogue (src/i18n/defaults.ts) imports them without the component, so `en`\n// loads as one chunk like the other languages (0.34, KS U8). ./forgot-password-form\n// re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors\";\nimport type { ForgotPasswordLabels } from \"./forgot-password-form\";\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_FORGOT_PASSWORD_LABELS: Required<ForgotPasswordLabels> = {\n  title: \"Forgot password\",\n  intro: \"Enter your account’s email address. We’ll send you a link to choose a new password.\",\n  email: \"Email\",\n  submit: \"Send the link\",\n  sent: (email) => `If an account exists for ${email}, the link is on its way.`,\n  sentHint: \"The link is valid for one hour and works exactly once. Check your spam folder too.\",\n  backToSignIn: \"Back to sign in\",\n  error: \"The request failed. Please try again later.\",\n  rateLimited: englishRateLimited,\n};\n"],"mappings":";AAKA,SAAS,0BAA0B;AAI5B,MAAM,iCAAiE;AAAA,EAC5E,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM,CAAC,UAAU,4BAA4B,KAAK;AAAA,EAClD,UAAU;AAAA,EACV,cAAc;AAAA,EACd,OAAO;AAAA,EACP,aAAa;AACf;","names":[]}
+{"version":3,"sources":["../../src/auth/forgot-password-form-labels.ts"],"sourcesContent":["// The English words of ./forgot-password-form, in a module with no component code: the\n// English catalogue (src/i18n/defaults.ts) imports them without the component, so `en`\n// loads as one chunk like the other languages (0.34, KS U8). ./forgot-password-form\n// re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors-labels\";\nimport type { ForgotPasswordLabels } from \"./forgot-password-form\";\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_FORGOT_PASSWORD_LABELS: Required<ForgotPasswordLabels> = {\n  title: \"Forgot password\",\n  intro: \"Enter your account’s email address. We’ll send you a link to choose a new password.\",\n  email: \"Email\",\n  submit: \"Send the link\",\n  sent: (email) => `If an account exists for ${email}, the link is on its way.`,\n  sentHint: \"The link is valid for one hour and works exactly once. Check your spam folder too.\",\n  backToSignIn: \"Back to sign in\",\n  error: \"The request failed. Please try again later.\",\n  rateLimited: englishRateLimited,\n};\n"],"mappings":";AAKA,SAAS,0BAA0B;AAI5B,MAAM,iCAAiE;AAAA,EAC5E,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM,CAAC,UAAU,4BAA4B,KAAK;AAAA,EAClD,UAAU;AAAA,EACV,cAAc;AAAA,EACd,OAAO;AAAA,EACP,aAAa;AACf;","names":[]}

package/dist/auth/forgot-password-form.js

@@ -3,13 +3,15 @@ import { jsx, jsxs } from "react/jsx-runtime";
 import { useId, useRef, useState } from "react";
 import { MailCheck } from "lucide-react";
 import { cn } from "../lib/cn.js";
+import { describeFailure } from "../lib/describe-failure.js";
 import { useKitLabels } from "../i18n/kit-labels.js";
 import { AlertBanner } from "../components/alert-banner.js";
 import { TextLink } from "../components/text-link.js";
 import { Button } from "../components/button.js";
 import { Input } from "../components/input.js";
 import { isRateLimited, retryAfterSeconds } from "./auth-errors.js";
-import { FORM_HEADING_CLASS, INTRO_CLASS, OutcomeMessage, isThenable, useFocusWhen } from "./status-parts.js";
+import { isThenable } from "../lib/thenable.js";
+import { FORM_HEADING_CLASS, INTRO_CLASS, OutcomeMessage, useFocusWhen } from "./status-parts.js";
 import { DEFAULT_FORGOT_PASSWORD_LABELS } from "./forgot-password-form-labels.js";
 function ForgotPasswordForm({
   onSubmit,
@@ -43,7 +45,10 @@ function ForgotPasswordForm({
       back
     ] });
   }
-  const failureFor = (error) => describeError?.(error) ?? (isRateLimited(error) ? (labels.rateLimited ?? DEFAULT_FORGOT_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error)) : labels.error);
+  const failureFor = (error) => describeFailure(
+    describeError?.(error),
+    isRateLimited(error) ? (labels.rateLimited ?? DEFAULT_FORGOT_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error)) : labels.error
+  );
   const submit = (e) => {
     e.preventDefault();
     const address = email.trim();

package/dist/auth/forgot-password-form.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/forgot-password-form.tsx"],"sourcesContent":["import { useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, FormEvent, ReactNode } from \"react\";\nimport { MailCheck } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { TextLink } from \"../components/text-link\";\nimport { Button } from \"../components/button\";\nimport { Input } from \"../components/input\";\nimport { isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport { FORM_HEADING_CLASS, INTRO_CLASS, OutcomeMessage, isThenable, useFocusWhen } from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\nimport { DEFAULT_FORGOT_PASSWORD_LABELS } from \"./forgot-password-form-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `forgotPassword` namespace. keksdose's words\n *  (`auth.forgot.*`), which kastlan took over unchanged. */\nexport interface ForgotPasswordLabels {\n  /** The heading. */\n  title: string;\n  /** Under the heading, before the field. */\n  intro: string;\n  /** The email field's label. */\n  email: string;\n  submit: string;\n  /** The one answer, whatever the server knows — given the address as typed. */\n  sent: (email: string) => string;\n  /** Under it: how long the link lives, and where else to look. */\n  sentHint: string;\n  /** The link back to the sign-in page, on both states. */\n  backToSignIn: string;\n  /** A request that did not go through: a throttle, an outage. Never \"unknown\n   *  address\" — the endpoint does not say. */\n  error: string;\n  /** 0.30.0: the request was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  `Retry-After` wait in seconds, or `undefined` without one. OPTIONAL, like every key\n   *  added to a shipped interface; the provider's `forgotPassword`, then English, fill\n   *  it. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n// Defined in ./forgot-password-form-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_FORGOT_PASSWORD_LABELS };\n\n/* ── The form ────────────────────────────────────────────────────────────── */\n\nexport interface ForgotPasswordFormProps extends Omit<ComponentPropsWithRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /**\n   * The address was submitted, trimmed: send `POST /auth/password-reset/request`.\n   * Resolve when the server answered — whatever it answered: it is `204` whether or not\n   * an account exists. Reject only when the request did not go through (a throttle, an\n   * outage); the form then stays, with the address, and says so. The form never sends a\n   * request itself (§8).\n   */\n  onSubmit: (email: string) => Promise<unknown> | void;\n  /** \"Back to sign in\" — the app's `/login`. Default `/login`. */\n  signInHref?: string;\n  /** The field's start value — the address the sign-in form already had, so someone\n   *  whose password just failed need not type it twice. */\n  defaultEmail?: string;\n  /**\n   * The app's words for a failed request (\"Too many requests — try again in an hour\"),\n   * or `undefined` for the kit's: `rateLimited` for a bare `429` (0.30.0), else `error`.\n   * The same hook as `SignInForm`'s.\n   */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** App content under the intro — a notice, a support address. */\n  formContent?: ReactNode;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: LabelOverride<ForgotPasswordLabels>;\n}\n\n/**\n * \"I forgot my password\" for every app (docs/auth-harmonization.md §7): one field, then\n * the same sentence whatever the answer — keksdose's `ForgotPasswordPage`\n * (features/auth/forgot-password-page.tsx), kastlan's copy of it, as one component.\n *\n * **It always ends on the same message**: \"If an account exists for …, the link is on\n * its way.\" The server answers `204` whether or not the address has an account — so the\n * page cannot be used to find out who has one — and the page must not undo that by\n * saying more than the server knows. Worded as a promise (\"we sent you a link\"), a typo\n * would look like a mail-delivery problem and send the person waiting instead of trying\n * their other address (keksdose #198). The address shown is the one they typed, so a\n * typo is visible.\n *\n * The only failure it can show is a request that did not go through (throttled, the\n * server down), never \"unknown address\". §4.5's fallback to a tagged address\n * (`you+kastlan@…` when `you@…` has no account) is the server's and changes nothing here.\n *\n * The submit is not disabled while the field is empty — a browser that autofills\n * withholds the value until the first interaction, and a disabled button would swallow\n * that first click; the field's own `required` answers an empty submit instead. After a\n * submit the confirmation takes focus, because the button that had it is gone with the\n * form.\n */\nexport function ForgotPasswordForm({\n  onSubmit,\n  signInHref = \"/login\",\n  defaultEmail = \"\",\n  describeError,\n  formContent,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ForgotPasswordFormProps) {\n  const labels = useKitLabels(\"forgotPassword\", DEFAULT_FORGOT_PASSWORD_LABELS, labelsProp);\n  const [email, setEmail] = useState(defaultEmail);\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const [sentTo, setSentTo] = useState<string | null>(null);\n  const headingId = useId();\n  const sentRef = useRef<HTMLDivElement>(null);\n  useFocusWhen(sentTo !== null, sentRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const back = (\n    <p className=\"text-center text-sm\">\n      <TextLink href={signInHref} tone=\"primary\">\n        {labels.backToSignIn}\n      </TextLink>\n    </p>\n  );\n\n  if (sentTo !== null) {\n    return (\n      <div {...rest} data-state=\"sent\" className={cn(\"space-y-3\", className)}>\n        {heading}\n        <OutcomeMessage icon={<MailCheck className=\"text-success\" />} focusRef={sentRef}>\n          <p className={INTRO_CLASS}>{labels.sent(sentTo)}</p>\n          <p className=\"text-xs text-muted\">{labels.sentHint}</p>\n        </OutcomeMessage>\n        {back}\n      </div>\n    );\n  }\n\n  // The app's words first, then the throttle's, then the kit's catch-all.\n  const failureFor = (error: unknown): ReactNode =>\n    describeError?.(error) ??\n    (isRateLimited(error)\n      ? (labels.rateLimited ?? DEFAULT_FORGOT_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error))\n      : labels.error);\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    const address = email.trim();\n    if (pending || address === \"\") return;\n    setFailure(null);\n    let result: unknown;\n    try {\n      result = onSubmit(address);\n    } catch (error) {\n      setFailure(failureFor(error));\n      return;\n    }\n    if (!isThenable(result)) {\n      setSentTo(address);\n      return;\n    }\n    setPending(true);\n    result.then(\n      () => {\n        setPending(false);\n        setSentTo(address);\n      },\n      (error: unknown) => {\n        setPending(false);\n        setFailure(failureFor(error));\n      },\n    );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={cn(\"space-y-3\", className)}>\n      <form className=\"space-y-3\" aria-labelledby={title === null ? undefined : headingId} onSubmit={submit}>\n        {heading}\n        <p className={INTRO_CLASS}>{labels.intro}</p>\n        {formContent}\n        <Input\n          type=\"email\"\n          name=\"email\"\n          autoComplete=\"email\"\n          label={labels.email}\n          value={email}\n          onChange={(e) => {\n            setEmail(e.target.value);\n            if (failure) setFailure(null);\n          }}\n          readOnly={pending}\n          required\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n      {back}\n    </div>\n  );\n}\n"],"mappings":";AA2HM,cAgBE,YAhBF;AA3HN,SAAS,OAAO,QAAQ,gBAAgB;AAExC,SAAS,iBAAiB;AAC1B,SAAS,UAAU;AACnB,SAAS,oBAAwC;AACjD,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,eAAe,yBAAyB;AACjD,SAAS,oBAAoB,aAAa,gBAAgB,YAAY,oBAAoB;AAE1F,SAAS,sCAAsC;AAwFxC,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,aAAa;AAAA,EACb,eAAe;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA4B;AAC1B,QAAM,SAAS,aAAa,kBAAkB,gCAAgC,UAAU;AACxF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,YAAY;AAC/C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAwB,IAAI;AACxD,QAAM,YAAY,MAAM;AACxB,QAAM,UAAU,OAAuB,IAAI;AAC3C,eAAa,WAAW,MAAM,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,OACJ,oBAAC,OAAE,WAAU,uBACX,8BAAC,YAAS,MAAM,YAAY,MAAK,WAC9B,iBAAO,cACV,GACF;AAGF,MAAI,WAAW,MAAM;AACnB,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,GAAG,aAAa,SAAS,GAClE;AAAA;AAAA,MACD,qBAAC,kBAAe,MAAM,oBAAC,aAAU,WAAU,gBAAe,GAAI,UAAU,SACtE;AAAA,4BAAC,OAAE,WAAW,aAAc,iBAAO,KAAK,MAAM,GAAE;AAAA,QAChD,oBAAC,OAAE,WAAU,sBAAsB,iBAAO,UAAS;AAAA,SACrD;AAAA,MACC;AAAA,OACH;AAAA,EAEJ;AAGA,QAAM,aAAa,CAAC,UAClB,gBAAgB,KAAK,MACpB,cAAc,KAAK,KACf,OAAO,eAAe,+BAA+B,aAAa,kBAAkB,KAAK,CAAC,IAC3F,OAAO;AAEb,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,WAAW,YAAY,GAAI;AAC/B,eAAW,IAAI;AACf,QAAI;AACJ,QAAI;AACF,eAAS,SAAS,OAAO;AAAA,IAC3B,SAAS,OAAO;AACd,iBAAW,WAAW,KAAK,CAAC;AAC5B;AAAA,IACF;AACA,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,gBAAU,OAAO;AACjB;AAAA,IACF;AACA,eAAW,IAAI;AACf,WAAO;AAAA,MACL,MAAM;AACJ,mBAAW,KAAK;AAChB,kBAAU,OAAO;AAAA,MACnB;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAChB,mBAAW,WAAW,KAAK,CAAC;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,GAAG,aAAa,SAAS,GACnE;AAAA,yBAAC,UAAK,WAAU,aAAY,mBAAiB,UAAU,OAAO,SAAY,WAAW,UAAU,QAC5F;AAAA;AAAA,MACD,oBAAC,OAAE,WAAW,aAAc,iBAAO,OAAM;AAAA,MACxC;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM;AACf,qBAAS,EAAE,OAAO,KAAK;AACvB,gBAAI,QAAS,YAAW,IAAI;AAAA,UAC9B;AAAA,UACA,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,MACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,MAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,SACtC,iBAAO,QACV;AAAA,OACF;AAAA,IACC;AAAA,KACH;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/auth/forgot-password-form.tsx"],"sourcesContent":["import { useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, FormEvent, ReactNode } from \"react\";\nimport { MailCheck } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { describeFailure } from \"../lib/describe-failure\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { TextLink } from \"../components/text-link\";\nimport { Button } from \"../components/button\";\nimport { Input } from \"../components/input\";\nimport { isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport { isThenable } from \"../lib/thenable\";\nimport { FORM_HEADING_CLASS, INTRO_CLASS, OutcomeMessage, useFocusWhen } from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\nimport { DEFAULT_FORGOT_PASSWORD_LABELS } from \"./forgot-password-form-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `forgotPassword` namespace. keksdose's words\n *  (`auth.forgot.*`), which kastlan took over unchanged. */\nexport interface ForgotPasswordLabels {\n  /** The heading. */\n  title: string;\n  /** Under the heading, before the field. */\n  intro: string;\n  /** The email field's label. */\n  email: string;\n  submit: string;\n  /** The one answer, whatever the server knows — given the address as typed. */\n  sent: (email: string) => string;\n  /** Under it: how long the link lives, and where else to look. */\n  sentHint: string;\n  /** The link back to the sign-in page, on both states. */\n  backToSignIn: string;\n  /** A request that did not go through: a throttle, an outage. Never \"unknown\n   *  address\" — the endpoint does not say. */\n  error: string;\n  /** 0.30.0: the request was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  `Retry-After` wait in seconds, or `undefined` without one. OPTIONAL, like every key\n   *  added to a shipped interface; the provider's `forgotPassword`, then English, fill\n   *  it. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n// Defined in ./forgot-password-form-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_FORGOT_PASSWORD_LABELS };\n\n/* ── The form ────────────────────────────────────────────────────────────── */\n\nexport interface ForgotPasswordFormProps extends Omit<ComponentPropsWithRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /**\n   * The address was submitted, trimmed: send `POST /auth/password-reset/request`.\n   * Resolve when the server answered — whatever it answered: it is `204` whether or not\n   * an account exists. Reject only when the request did not go through (a throttle, an\n   * outage); the form then stays, with the address, and says so. The form never sends a\n   * request itself (§8).\n   */\n  onSubmit: (email: string) => Promise<unknown> | void;\n  /** \"Back to sign in\" — the app's `/login`. Default `/login`. */\n  signInHref?: string;\n  /** The field's start value — the address the sign-in form already had, so someone\n   *  whose password just failed need not type it twice. */\n  defaultEmail?: string;\n  /**\n   * The app's words for a failed request (\"Too many requests — try again in an hour\"),\n   * or `undefined` for the kit's: `rateLimited` for a bare `429` (0.30.0), else `error`.\n   * The same hook as `SignInForm`'s.\n   */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** App content under the intro — a notice, a support address. */\n  formContent?: ReactNode;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: LabelOverride<ForgotPasswordLabels>;\n}\n\n/**\n * \"I forgot my password\" for every app (docs/auth-harmonization.md §7): one field, then\n * the same sentence whatever the answer — keksdose's `ForgotPasswordPage`\n * (features/auth/forgot-password-page.tsx), kastlan's copy of it, as one component.\n *\n * **It always ends on the same message**: \"If an account exists for …, the link is on\n * its way.\" The server answers `204` whether or not the address has an account — so the\n * page cannot be used to find out who has one — and the page must not undo that by\n * saying more than the server knows. Worded as a promise (\"we sent you a link\"), a typo\n * would look like a mail-delivery problem and send the person waiting instead of trying\n * their other address (keksdose #198). The address shown is the one they typed, so a\n * typo is visible.\n *\n * The only failure it can show is a request that did not go through (throttled, the\n * server down), never \"unknown address\". §4.5's fallback to a tagged address\n * (`you+kastlan@…` when `you@…` has no account) is the server's and changes nothing here.\n *\n * The submit is not disabled while the field is empty — a browser that autofills\n * withholds the value until the first interaction, and a disabled button would swallow\n * that first click; the field's own `required` answers an empty submit instead. After a\n * submit the confirmation takes focus, because the button that had it is gone with the\n * form.\n */\nexport function ForgotPasswordForm({\n  onSubmit,\n  signInHref = \"/login\",\n  defaultEmail = \"\",\n  describeError,\n  formContent,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ForgotPasswordFormProps) {\n  const labels = useKitLabels(\"forgotPassword\", DEFAULT_FORGOT_PASSWORD_LABELS, labelsProp);\n  const [email, setEmail] = useState(defaultEmail);\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const [sentTo, setSentTo] = useState<string | null>(null);\n  const headingId = useId();\n  const sentRef = useRef<HTMLDivElement>(null);\n  useFocusWhen(sentTo !== null, sentRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const back = (\n    <p className=\"text-center text-sm\">\n      <TextLink href={signInHref} tone=\"primary\">\n        {labels.backToSignIn}\n      </TextLink>\n    </p>\n  );\n\n  if (sentTo !== null) {\n    return (\n      <div {...rest} data-state=\"sent\" className={cn(\"space-y-3\", className)}>\n        {heading}\n        <OutcomeMessage icon={<MailCheck className=\"text-success\" />} focusRef={sentRef}>\n          <p className={INTRO_CLASS}>{labels.sent(sentTo)}</p>\n          <p className=\"text-xs text-muted\">{labels.sentHint}</p>\n        </OutcomeMessage>\n        {back}\n      </div>\n    );\n  }\n\n  // The app's words first, then the throttle's, then the kit's catch-all — an app's \"\"\n  // is no words (refactor audit 2026-10-30, DUP-14: `??` drew an empty alert).\n  const failureFor = (error: unknown): ReactNode =>\n    describeFailure(\n      describeError?.(error),\n      isRateLimited(error)\n        ? (labels.rateLimited ?? DEFAULT_FORGOT_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error))\n        : labels.error,\n    );\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    const address = email.trim();\n    if (pending || address === \"\") return;\n    setFailure(null);\n    let result: unknown;\n    try {\n      result = onSubmit(address);\n    } catch (error) {\n      setFailure(failureFor(error));\n      return;\n    }\n    if (!isThenable(result)) {\n      setSentTo(address);\n      return;\n    }\n    setPending(true);\n    result.then(\n      () => {\n        setPending(false);\n        setSentTo(address);\n      },\n      (error: unknown) => {\n        setPending(false);\n        setFailure(failureFor(error));\n      },\n    );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={cn(\"space-y-3\", className)}>\n      <form className=\"space-y-3\" aria-labelledby={title === null ? undefined : headingId} onSubmit={submit}>\n        {heading}\n        <p className={INTRO_CLASS}>{labels.intro}</p>\n        {formContent}\n        <Input\n          type=\"email\"\n          name=\"email\"\n          autoComplete=\"email\"\n          label={labels.email}\n          value={email}\n          onChange={(e) => {\n            setEmail(e.target.value);\n            if (failure) setFailure(null);\n          }}\n          readOnly={pending}\n          required\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n      {back}\n    </div>\n  );\n}\n"],"mappings":";AA6HM,cAgBE,YAhBF;AA7HN,SAAS,OAAO,QAAQ,gBAAgB;AAExC,SAAS,iBAAiB;AAC1B,SAAS,UAAU;AACnB,SAAS,uBAAuB;AAChC,SAAS,oBAAwC;AACjD,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,eAAe,yBAAyB;AACjD,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB,aAAa,gBAAgB,oBAAoB;AAE9E,SAAS,sCAAsC;AAwFxC,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,aAAa;AAAA,EACb,eAAe;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA4B;AAC1B,QAAM,SAAS,aAAa,kBAAkB,gCAAgC,UAAU;AACxF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,YAAY;AAC/C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAwB,IAAI;AACxD,QAAM,YAAY,MAAM;AACxB,QAAM,UAAU,OAAuB,IAAI;AAC3C,eAAa,WAAW,MAAM,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,OACJ,oBAAC,OAAE,WAAU,uBACX,8BAAC,YAAS,MAAM,YAAY,MAAK,WAC9B,iBAAO,cACV,GACF;AAGF,MAAI,WAAW,MAAM;AACnB,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,GAAG,aAAa,SAAS,GAClE;AAAA;AAAA,MACD,qBAAC,kBAAe,MAAM,oBAAC,aAAU,WAAU,gBAAe,GAAI,UAAU,SACtE;AAAA,4BAAC,OAAE,WAAW,aAAc,iBAAO,KAAK,MAAM,GAAE;AAAA,QAChD,oBAAC,OAAE,WAAU,sBAAsB,iBAAO,UAAS;AAAA,SACrD;AAAA,MACC;AAAA,OACH;AAAA,EAEJ;AAIA,QAAM,aAAa,CAAC,UAClB;AAAA,IACE,gBAAgB,KAAK;AAAA,IACrB,cAAc,KAAK,KACd,OAAO,eAAe,+BAA+B,aAAa,kBAAkB,KAAK,CAAC,IAC3F,OAAO;AAAA,EACb;AAEF,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,WAAW,YAAY,GAAI;AAC/B,eAAW,IAAI;AACf,QAAI;AACJ,QAAI;AACF,eAAS,SAAS,OAAO;AAAA,IAC3B,SAAS,OAAO;AACd,iBAAW,WAAW,KAAK,CAAC;AAC5B;AAAA,IACF;AACA,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,gBAAU,OAAO;AACjB;AAAA,IACF;AACA,eAAW,IAAI;AACf,WAAO;AAAA,MACL,MAAM;AACJ,mBAAW,KAAK;AAChB,kBAAU,OAAO;AAAA,MACnB;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAChB,mBAAW,WAAW,KAAK,CAAC;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,GAAG,aAAa,SAAS,GACnE;AAAA,yBAAC,UAAK,WAAU,aAAY,mBAAiB,UAAU,OAAO,SAAY,WAAW,UAAU,QAC5F;AAAA;AAAA,MACD,oBAAC,OAAE,WAAW,aAAc,iBAAO,OAAM;AAAA,MACxC;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO,OAAO;AAAA,UACd,OAAO;AAAA,UACP,UAAU,CAAC,MAAM;AACf,qBAAS,EAAE,OAAO,KAAK;AACvB,gBAAI,QAAS,YAAW,IAAI;AAAA,UAC9B;AAAA,UACA,UAAU;AAAA,UACV,UAAQ;AAAA;AAAA,MACV;AAAA,MACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,MAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,SACtC,iBAAO,QACV;AAAA,OACF;AAAA,IACC;AAAA,KACH;AAEJ;","names":[]}

package/dist/auth/register-form-labels.js

@@ -1,5 +1,5 @@
 "use client";
-import { englishRateLimited } from "./auth-errors.js";
+import { englishRateLimited } from "./auth-errors-labels.js";
 const DEFAULT_REGISTER_LABELS = {
   firstName: "First name",
   lastName: "Last name",

package/dist/auth/register-form-labels.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/register-form-labels.ts"],"sourcesContent":["// The English words of ./register-form, in a module with no component code: the English\n// catalogue (src/i18n/defaults.ts) imports them without the component, so `en` loads as one\n// chunk like the other languages (0.34, KS U8). ./register-form re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors\";\nimport type { RegisterLabels } from \"./register-form\";\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_REGISTER_LABELS: Required<RegisterLabels> = {\n  firstName: \"First name\",\n  lastName: \"Last name\",\n  email: \"Email\",\n  emailTagUse: (address) => `Use ${address}`,\n  emailTagHint:\n    \"Many providers deliver name+tag@… to the same inbox, so mail from this app is easy to filter and trace. Check yours does before you rely on it: you would sign in with the tagged address.\",\n  invitedEmailHint: \"The address your invitation was sent to.\",\n  invitedTagNote: \"The tagged address gets a confirmation mail of its own.\",\n  password: \"Password\",\n  confirmPassword: \"Repeat password\",\n  passwordMismatch: \"The passwords don't match.\",\n  language: \"Language\",\n  submit: \"Create account\",\n  haveAccount: \"Already have an account?\",\n  signIn: \"Sign in\",\n  emailTaken: \"An account with this email address already exists.\",\n  registrationClosed: \"New accounts are by invitation only. Ask the operator to invite your email address.\",\n  invitationInvalid: \"This invitation link is not valid.\",\n  invitationExpired: \"This invitation has expired. Ask for a new one.\",\n  failed: \"Registration failed. Please try again.\",\n  rateLimited: englishRateLimited,\n};\n"],"mappings":";AAIA,SAAS,0BAA0B;AAI5B,MAAM,0BAAoD;AAAA,EAC/D,WAAW;AAAA,EACX,UAAU;AAAA,EACV,OAAO;AAAA,EACP,aAAa,CAAC,YAAY,OAAO,OAAO;AAAA,EACxC,cACE;AAAA,EACF,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,QAAQ;AAAA,EACR,aAAa;AACf;","names":[]}
+{"version":3,"sources":["../../src/auth/register-form-labels.ts"],"sourcesContent":["// The English words of ./register-form, in a module with no component code: the English\n// catalogue (src/i18n/defaults.ts) imports them without the component, so `en` loads as one\n// chunk like the other languages (0.34, KS U8). ./register-form re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors-labels\";\nimport type { RegisterLabels } from \"./register-form\";\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_REGISTER_LABELS: Required<RegisterLabels> = {\n  firstName: \"First name\",\n  lastName: \"Last name\",\n  email: \"Email\",\n  emailTagUse: (address) => `Use ${address}`,\n  emailTagHint:\n    \"Many providers deliver name+tag@… to the same inbox, so mail from this app is easy to filter and trace. Check yours does before you rely on it: you would sign in with the tagged address.\",\n  invitedEmailHint: \"The address your invitation was sent to.\",\n  invitedTagNote: \"The tagged address gets a confirmation mail of its own.\",\n  password: \"Password\",\n  confirmPassword: \"Repeat password\",\n  passwordMismatch: \"The passwords don't match.\",\n  language: \"Language\",\n  submit: \"Create account\",\n  haveAccount: \"Already have an account?\",\n  signIn: \"Sign in\",\n  emailTaken: \"An account with this email address already exists.\",\n  registrationClosed: \"New accounts are by invitation only. Ask the operator to invite your email address.\",\n  invitationInvalid: \"This invitation link is not valid.\",\n  invitationExpired: \"This invitation has expired. Ask for a new one.\",\n  failed: \"Registration failed. Please try again.\",\n  rateLimited: englishRateLimited,\n};\n"],"mappings":";AAIA,SAAS,0BAA0B;AAI5B,MAAM,0BAAoD;AAAA,EAC/D,WAAW;AAAA,EACX,UAAU;AAAA,EACV,OAAO;AAAA,EACP,aAAa,CAAC,YAAY,OAAO,OAAO;AAAA,EACxC,cACE;AAAA,EACF,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,QAAQ;AAAA,EACR,aAAa;AACf;","names":[]}

package/dist/auth/reset-password-form-labels.js

@@ -1,5 +1,5 @@
 "use client";
-import { englishRateLimited } from "./auth-errors.js";
+import { englishRateLimited } from "./auth-errors-labels.js";
 const DEFAULT_RESET_PASSWORD_LABELS = {
   title: "Choose a new password",
   checking: "Checking the link\u2026",

package/dist/auth/reset-password-form-labels.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/reset-password-form-labels.ts"],"sourcesContent":["// The English words of ./reset-password-form, in a module with no component code: the\n// English catalogue (src/i18n/defaults.ts) imports them without the component, so `en`\n// loads as one chunk like the other languages (0.34, KS U8). ./reset-password-form\n// re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors\";\nimport type { ResetPasswordLabels } from \"./reset-password-form\";\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_RESET_PASSWORD_LABELS: Required<ResetPasswordLabels> = {\n  title: \"Choose a new password\",\n  checking: \"Checking the link…\",\n  intro: (email) => `You’re setting a new password for ${email}.`,\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  mismatch: \"The passwords don’t match.\",\n  submit: \"Save password\",\n  failed: \"The password could not be changed.\",\n  noToken: \"This link is incomplete.\",\n  invalid: \"This link is invalid or has expired.\",\n  invalidHint: \"Links are valid for one hour and work only once. Just request a new one.\",\n  requestNew: \"Request a new link\",\n  success: \"Your password has been changed. You can sign in with it now.\",\n  sessionsEnded: \"Signed-in devices were signed out — you’ll need to sign in again there.\",\n  signIn: \"Go to sign in\",\n  rateLimited: englishRateLimited,\n};\n"],"mappings":";AAKA,SAAS,0BAA0B;AAI5B,MAAM,gCAA+D;AAAA,EAC1E,OAAO;AAAA,EACP,UAAU;AAAA,EACV,OAAO,CAAC,UAAU,0CAAqC,KAAK;AAAA,EAC5D,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,aAAa;AACf;","names":[]}
+{"version":3,"sources":["../../src/auth/reset-password-form-labels.ts"],"sourcesContent":["// The English words of ./reset-password-form, in a module with no component code: the\n// English catalogue (src/i18n/defaults.ts) imports them without the component, so `en`\n// loads as one chunk like the other languages (0.34, KS U8). ./reset-password-form\n// re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors-labels\";\nimport type { ResetPasswordLabels } from \"./reset-password-form\";\n\n/** `Required`: every key, the 0.30 one included, has its English here. */\nexport const DEFAULT_RESET_PASSWORD_LABELS: Required<ResetPasswordLabels> = {\n  title: \"Choose a new password\",\n  checking: \"Checking the link…\",\n  intro: (email) => `You’re setting a new password for ${email}.`,\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  mismatch: \"The passwords don’t match.\",\n  submit: \"Save password\",\n  failed: \"The password could not be changed.\",\n  noToken: \"This link is incomplete.\",\n  invalid: \"This link is invalid or has expired.\",\n  invalidHint: \"Links are valid for one hour and work only once. Just request a new one.\",\n  requestNew: \"Request a new link\",\n  success: \"Your password has been changed. You can sign in with it now.\",\n  sessionsEnded: \"Signed-in devices were signed out — you’ll need to sign in again there.\",\n  signIn: \"Go to sign in\",\n  rateLimited: englishRateLimited,\n};\n"],"mappings":";AAKA,SAAS,0BAA0B;AAI5B,MAAM,gCAA+D;AAAA,EAC1E,OAAO;AAAA,EACP,UAAU;AAAA,EACV,OAAO,CAAC,UAAU,0CAAqC,KAAK;AAAA,EAC5D,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,aAAa;AACf;","names":[]}

package/dist/auth/reset-password-form.js

@@ -3,6 +3,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 import { useEffect, useId, useRef, useState } from "react";
 import { CheckCircle2, XCircle } from "lucide-react";
 import { cn } from "../lib/cn.js";
+import { describeFailure } from "../lib/describe-failure.js";
 import { useKitLabels } from "../i18n/kit-labels.js";
 import { AlertBanner } from "../components/alert-banner.js";
 import { LoadingState } from "../components/loading-state.js";
@@ -116,7 +117,10 @@ function ResetPasswordForm({
           return;
         }
         setFailure(
-          describeError?.(error) ?? (isRateLimited(error) ? (labels.rateLimited ?? DEFAULT_RESET_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error)) : labels.failed)
+          describeFailure(
+            describeError?.(error),
+            isRateLimited(error) ? (labels.rateLimited ?? DEFAULT_RESET_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error)) : labels.failed
+          )
         );
       }
     );

package/dist/auth/reset-password-form.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/reset-password-form.tsx"],"sourcesContent":["import { useEffect, useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, FormEvent, ReactNode } from \"react\";\nimport { CheckCircle2, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button } from \"../components/button\";\nimport { EmptyState } from \"../components/empty-state\";\nimport { authErrorCode, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport { newPasswordProblem } from \"./form-rules\";\nimport { NewPasswordFields } from \"./new-password-fields\";\nimport {\n  FORM_HEADING_CLASS,\n  INTRO_CLASS,\n  OUTCOME_CLASS,\n  OutcomeMessage,\n  useFocusWhen,\n  useOncePerKey,\n  withQuery,\n} from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\nimport { DEFAULT_RESET_PASSWORD_LABELS } from \"./reset-password-form-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `resetPassword` namespace. keksdose's words\n *  (`auth.reset.*`), which kastlan took over. */\nexport interface ResetPasswordLabels {\n  /** The heading, on every state. */\n  title: string;\n  /** While the link is checked. */\n  checking: string;\n  /** Over the fields, given the account's address (when the check returned one). */\n  intro: (email: string) => string;\n  newPassword: string;\n  confirmPassword: string;\n  /** Under the confirmation while it differs. */\n  mismatch: string;\n  submit: string;\n  /** The new password was not saved, for a reason that is not the link. */\n  failed: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** The link is unknown, spent or expired — one sentence, as the server gives one\n   *  code (`token_invalid`). */\n  invalid: string;\n  /** Under it. */\n  invalidHint: string;\n  /** The way forward from an invalid link: back to \"Forgot password\". */\n  requestNew: string;\n  /** Done. */\n  success: string;\n  /** Under it: a reset ends every session (§6.3). */\n  sessionsEnded: string;\n  /** The button out — to sign-in, with the address filled in. */\n  signIn: string;\n  /** 0.30.0: the save was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  `Retry-After` wait in seconds, or `undefined` without one. OPTIONAL, like every key\n   *  added to a shipped interface; the provider's `resetPassword`, then English, fill\n   *  it. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n// Defined in ./reset-password-form-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_RESET_PASSWORD_LABELS };\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onCheck` may resolve with — keksdose's `/password-reset/check` answer. */\nexport interface ResetPasswordCheck {\n  /** The account's address: named over the fields (\"You're setting a new password for\n   *  …\") and handed to the password manager, which files the new password under it. */\n  email?: string;\n  /** The app's notices over the fields, shown BEFORE the password is typed — keksdose's\n   *  \"your account is end-to-end encrypted: this restores your sign-in, not your data\". */\n  notices?: ReactNode;\n}\n\n/** What `onSubmit` hands over. */\nexport interface ResetPasswordValues {\n  token: string;\n  password: string;\n}\n\n/** What `onSubmit` resolves with — keksdose's `/password-reset/confirm` answer, which\n *  carries no tokens (§6.3). */\nexport interface ResetPasswordResult {\n  /** The account's address — the sign-in it leads to is filled in with it. */\n  email: string;\n  /** The app's outcomes, shown on the done state: keksdose's recovery-code notice for an\n   *  encrypted account, \"Your 2 personal access tokens were revoked\". */\n  notices?: ReactNode;\n}\n\ntype Phase =\n  { kind: \"form\"; check: ResetPasswordCheck } | { kind: \"invalid\" } | { kind: \"done\"; result: ResetPasswordResult };\n\nexport interface ResetPasswordFormProps extends Omit<ComponentPropsWithRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=` (keksdose, kastlan: `/reset-password?token=…`).\n   *  Empty: the link was cut short, and the page says so without asking anyone. */\n  token: string;\n  /**\n   * Check the link before the form shows (`/auth/password-reset/check`) — once per\n   * token, on mount. Checking does not use it up, so a reload is free. Resolve (with\n   * the address and any notices) for a live link; reject for a dead one, and the page\n   * says \"This link is invalid or has expired\" with the way to a new one.\n   */\n  onCheck: (token: string) => Promise<ResetPasswordCheck | void | undefined>;\n  /**\n   * The new password was submitted: send `/auth/password-reset/confirm`. Resolve with\n   * the account's address (and the app's notices) — no tokens: a reset is not a sign-in\n   * (§6.3). Reject with the client's error: `token_invalid` (the link expired or was\n   * used in another tab while the form was open) goes to the invalid state; anything\n   * else stays on the form with the password kept.\n   */\n  onSubmit: (values: ResetPasswordValues) => Promise<ResetPasswordResult>;\n  /** \"Go to sign in\" calls this with the address, for an app that routes in code.\n   *  Without it, the button is a link to `signInHref`. */\n  onSignIn?: (email: string) => void;\n  /** Where \"Go to sign in\" leads, with `?email=` added — read it into `SignInForm`'s\n   *  `defaultEmail`. Default `/login`. */\n  signInHref?: string;\n  /** \"Request a new link\" — the app's \"Forgot password\" page. Default\n   *  `/forgot-password`. */\n  forgotHref?: string;\n  /** The app's words for a failed save (the device offline), or `undefined` for the\n   *  kit's: `rateLimited` for a bare `429` (0.30.0), else `failed`. Not asked for\n   *  `token_invalid` or `token_expired`, which are a state. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: LabelOverride<ResetPasswordLabels>;\n}\n\n/**\n * Redeem a password-reset link (`/reset-password?token=…`, docs/auth-harmonization.md\n * §6.3, §7) — keksdose's `ResetPasswordPage` (features/auth/reset-password-page.tsx),\n * which kastlan built its own on.\n *\n * **The link is checked first** (`onCheck`), and only then does the form appear: an\n * expired link should say so before someone types a new password twice, not after.\n *\n * **A reset is not a sign-in** (§6.3, §10.11). The confirm answers without tokens, so a\n * 2FA account cannot skip its second factor by way of its inbox, and the page ends on\n * \"Go to sign in\" with the address filled in — the person has just typed the new\n * password twice; signing in is one step. What else the reset did is said there:\n * every other session ended (the kit's line, true in all three apps), and the app's own\n * outcomes in `notices` — keksdose's recovery-code notice and its revoked API tokens.\n *\n * **The password** is chosen with the same fields as `RegisterForm` and `SignInForm`'s\n * set-password step ({@link NewPasswordFields}): the strength meter and its checklist as\n * advice, and only the two hard rules — at least 8 characters, at most 72 bytes (§8).\n * The submit waits for both and a matching confirmation.\n *\n * The form never sends a request itself (§8): the token and the password go to the\n * callbacks, and the page renders what they resolve with.\n */\nexport function ResetPasswordForm({\n  token,\n  onCheck,\n  onSubmit,\n  onSignIn,\n  signInHref = \"/login\",\n  forgotHref = \"/forgot-password\",\n  describeError,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ResetPasswordFormProps) {\n  const labels = useKitLabels(\"resetPassword\", DEFAULT_RESET_PASSWORD_LABELS, labelsProp);\n  // The phase belongs to the token it was reached with: a new token starts over at the\n  // check without a reset effect.\n  const [phase, setPhase] = useState<{ token: string; phase: Phase } | null>(null);\n  const current: Phase | \"checking\" =\n    token === \"\" ? { kind: \"invalid\" } : phase?.token === token ? phase.phase : \"checking\";\n\n  useOncePerKey(token === \"\" ? null : token, onCheck, (key, result) =>\n    setPhase({\n      token: key,\n      phase: result.ok ? { kind: \"form\", check: result.value ?? {} } : { kind: \"invalid\" },\n    }),\n  );\n\n  const [password, setPassword] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const headingId = useId();\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  const kind = current === \"checking\" ? \"checking\" : current.kind;\n\n  // The form arrives after the check: the field is where the person is going.\n  useEffect(() => {\n    if (kind === \"form\") passwordRef.current?.focus();\n  }, [kind]);\n  useFocusWhen(kind === \"done\", doneRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const rootClass = cn(\"space-y-3\", className);\n\n  if (current === \"checking\") {\n    return (\n      <div {...rest} data-state=\"checking\" aria-busy className={rootClass}>\n        {heading}\n        <LoadingState size=\"sm\" label={labels.checking} />\n      </div>\n    );\n  }\n\n  if (current.kind === \"invalid\") {\n    return (\n      <div {...rest} data-state=\"invalid\" className={rootClass}>\n        {heading}\n        <EmptyState\n          tone=\"danger\"\n          icon={<XCircle />}\n          title={token === \"\" ? labels.noToken : labels.invalid}\n          hint={labels.invalidHint}\n          action={\n            <Button href={forgotHref} variant=\"accent\">\n              {labels.requestNew}\n            </Button>\n          }\n          className={OUTCOME_CLASS}\n        />\n      </div>\n    );\n  }\n\n  if (current.kind === \"done\") {\n    const { email, notices } = current.result;\n    return (\n      <div {...rest} data-state=\"done\" className={rootClass}>\n        {heading}\n        <OutcomeMessage icon={<CheckCircle2 className=\"text-success\" />} focusRef={doneRef}>\n          <p className={INTRO_CLASS}>{labels.success}</p>\n        </OutcomeMessage>\n        {notices}\n        <p className=\"text-xs text-muted\">{labels.sessionsEnded}</p>\n        {onSignIn ? (\n          <Button type=\"button\" variant=\"accent\" className=\"w-full\" onClick={() => onSignIn(email)}>\n            {labels.signIn}\n          </Button>\n        ) : (\n          <Button href={email ? withQuery(signInHref, \"email\", email) : signInHref} variant=\"accent\" className=\"w-full\">\n            {labels.signIn}\n          </Button>\n        )}\n      </div>\n    );\n  }\n\n  const { email, notices } = current.check;\n  const problem = newPasswordProblem(password, confirm);\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    if (pending || problem !== null) return;\n    setFailure(null);\n    setPending(true);\n    Promise.resolve()\n      .then(() => onSubmit({ token, password }))\n      .then(\n        (result) => {\n          setPending(false);\n          setPassword(\"\");\n          setConfirm(\"\");\n          setPhase({ token, phase: { kind: \"done\", result } });\n        },\n        (error: unknown) => {\n          setPending(false);\n          // A link that died between the check and the save — used, or run out — is the\n          // dead-link state, under either code (0.31.1: keksdose mapped `token_expired`\n          // to it itself, `asDeadLink`).\n          const code = authErrorCode(error);\n          if (code === \"token_invalid\" || code === \"token_expired\") {\n            setPassword(\"\");\n            setConfirm(\"\");\n            setPhase({ token, phase: { kind: \"invalid\" } });\n            return;\n          }\n          // The app's words first, then the throttle's, then the kit's catch-all.\n          setFailure(\n            describeError?.(error) ??\n              (isRateLimited(error)\n                ? (labels.rateLimited ?? DEFAULT_RESET_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error))\n                : labels.failed),\n          );\n        },\n      );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={rootClass}>\n      <form className=\"space-y-3\" aria-labelledby={title === null ? undefined : headingId} onSubmit={submit}>\n        {heading}\n        {email ? <p className={INTRO_CLASS}>{labels.intro(email)}</p> : null}\n        {notices}\n        {/* Which account the new password is for, for the password manager: it files\n            the new password under this username instead of guessing (kastlan). */}\n        {email ? <input type=\"email\" name=\"username\" autoComplete=\"username\" value={email} readOnly hidden /> : null}\n        <NewPasswordFields\n          password={password}\n          confirm={confirm}\n          onPasswordChange={(next) => {\n            setPassword(next);\n            if (failure) setFailure(null);\n          }}\n          onConfirmChange={setConfirm}\n          busy={pending}\n          passwordRef={passwordRef}\n          text={{ password: labels.newPassword, confirm: labels.confirmPassword, mismatch: labels.mismatch }}\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" disabled={!pending && problem !== null} pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n    </div>\n  );\n}\n"],"mappings":";AA8MM,cAQA,YARA;AA9MN,SAAS,WAAW,OAAO,QAAQ,gBAAgB;AAEnD,SAAS,cAAc,eAAe;AACtC,SAAS,UAAU;AACnB,SAAS,oBAAwC;AACjD,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,eAAe,eAAe,yBAAyB;AAChE,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,qCAAqC;AA2IvC,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAiD,IAAI;AAC/E,QAAM,UACJ,UAAU,KAAK,EAAE,MAAM,UAAU,IAAI,OAAO,UAAU,QAAQ,MAAM,QAAQ;AAE9E;AAAA,IAAc,UAAU,KAAK,OAAO;AAAA,IAAO;AAAA,IAAS,CAAC,KAAK,WACxD,SAAS;AAAA,MACP,OAAO;AAAA,MACP,OAAO,OAAO,KAAK,EAAE,MAAM,QAAQ,OAAO,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU;AAAA,IACrF,CAAC;AAAA,EACH;AAEA,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,YAAY,MAAM;AACxB,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAC3C,QAAM,OAAO,YAAY,aAAa,aAAa,QAAQ;AAG3D,YAAU,MAAM;AACd,QAAI,SAAS,OAAQ,aAAY,SAAS,MAAM;AAAA,EAClD,GAAG,CAAC,IAAI,CAAC;AACT,eAAa,SAAS,QAAQ,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,YAAY,GAAG,aAAa,SAAS;AAE3C,MAAI,YAAY,YAAY;AAC1B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,YAAW,aAAS,MAAC,WAAW,WACvD;AAAA;AAAA,MACD,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,UAAU;AAAA,OAClD;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,WAAW;AAC9B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,WAAU,WAAW,WAC5C;AAAA;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAM,oBAAC,WAAQ;AAAA,UACf,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO;AAAA,UAC9C,MAAM,OAAO;AAAA,UACb,QACE,oBAAC,UAAO,MAAM,YAAY,SAAQ,UAC/B,iBAAO,YACV;AAAA,UAEF,WAAW;AAAA;AAAA,MACb;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,EAAE,OAAAA,QAAO,SAAAC,SAAQ,IAAI,QAAQ;AACnC,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WACzC;AAAA;AAAA,MACD,oBAAC,kBAAe,MAAM,oBAAC,gBAAa,WAAU,gBAAe,GAAI,UAAU,SACzE,8BAAC,OAAE,WAAW,aAAc,iBAAO,SAAQ,GAC7C;AAAA,MACCA;AAAA,MACD,oBAAC,OAAE,WAAU,sBAAsB,iBAAO,eAAc;AAAA,MACvD,WACC,oBAAC,UAAO,MAAK,UAAS,SAAQ,UAAS,WAAU,UAAS,SAAS,MAAM,SAASD,MAAK,GACpF,iBAAO,QACV,IAEA,oBAAC,UAAO,MAAMA,SAAQ,UAAU,YAAY,SAASA,MAAK,IAAI,YAAY,SAAQ,UAAS,WAAU,UAClG,iBAAO,QACV;AAAA,OAEJ;AAAA,EAEJ;AAEA,QAAM,EAAE,OAAO,QAAQ,IAAI,QAAQ;AACnC,QAAM,UAAU,mBAAmB,UAAU,OAAO;AAEpD,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,QAAI,WAAW,YAAY,KAAM;AACjC,eAAW,IAAI;AACf,eAAW,IAAI;AACf,YAAQ,QAAQ,EACb,KAAK,MAAM,SAAS,EAAE,OAAO,SAAS,CAAC,CAAC,EACxC;AAAA,MACC,CAAC,WAAW;AACV,mBAAW,KAAK;AAChB,oBAAY,EAAE;AACd,mBAAW,EAAE;AACb,iBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,MACrD;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAIhB,cAAM,OAAO,cAAc,KAAK;AAChC,YAAI,SAAS,mBAAmB,SAAS,iBAAiB;AACxD,sBAAY,EAAE;AACd,qBAAW,EAAE;AACb,mBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE,CAAC;AAC9C;AAAA,QACF;AAEA;AAAA,UACE,gBAAgB,KAAK,MAClB,cAAc,KAAK,KACf,OAAO,eAAe,8BAA8B,aAAa,kBAAkB,KAAK,CAAC,IAC1F,OAAO;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACJ;AAEA,SACE,oBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WAC1C,+BAAC,UAAK,WAAU,aAAY,mBAAiB,UAAU,OAAO,SAAY,WAAW,UAAU,QAC5F;AAAA;AAAA,IACA,QAAQ,oBAAC,OAAE,WAAW,aAAc,iBAAO,MAAM,KAAK,GAAE,IAAO;AAAA,IAC/D;AAAA,IAGA,QAAQ,oBAAC,WAAM,MAAK,SAAQ,MAAK,YAAW,cAAa,YAAW,OAAO,OAAO,UAAQ,MAAC,QAAM,MAAC,IAAK;AAAA,IACxG;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA,kBAAkB,CAAC,SAAS;AAC1B,sBAAY,IAAI;AAChB,cAAI,QAAS,YAAW,IAAI;AAAA,QAC9B;AAAA,QACA,iBAAiB;AAAA,QACjB,MAAM;AAAA,QACN;AAAA,QACA,MAAM,EAAE,UAAU,OAAO,aAAa,SAAS,OAAO,iBAAiB,UAAU,OAAO,SAAS;AAAA;AAAA,IACnG;AAAA,IACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,IAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,YAAY,MAAM,SAC9E,iBAAO,QACV;AAAA,KACF,GACF;AAEJ;","names":["email","notices"]}
+{"version":3,"sources":["../../src/auth/reset-password-form.tsx"],"sourcesContent":["import { useEffect, useId, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, FormEvent, ReactNode } from \"react\";\nimport { CheckCircle2, XCircle } from \"lucide-react\";\nimport { cn } from \"../lib/cn\";\nimport { describeFailure } from \"../lib/describe-failure\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { LoadingState } from \"../components/loading-state\";\nimport { Button } from \"../components/button\";\nimport { EmptyState } from \"../components/empty-state\";\nimport { authErrorCode, isRateLimited, retryAfterSeconds } from \"./auth-errors\";\nimport { newPasswordProblem } from \"./form-rules\";\nimport { NewPasswordFields } from \"./new-password-fields\";\nimport {\n  FORM_HEADING_CLASS,\n  INTRO_CLASS,\n  OUTCOME_CLASS,\n  OutcomeMessage,\n  useFocusWhen,\n  useOncePerKey,\n  withQuery,\n} from \"./status-parts\";\nimport type { AuthHeadingLevel } from \"./status-parts\";\nimport { DEFAULT_RESET_PASSWORD_LABELS } from \"./reset-password-form-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/** Every string the form renders — the `resetPassword` namespace. keksdose's words\n *  (`auth.reset.*`), which kastlan took over. */\nexport interface ResetPasswordLabels {\n  /** The heading, on every state. */\n  title: string;\n  /** While the link is checked. */\n  checking: string;\n  /** Over the fields, given the account's address (when the check returned one). */\n  intro: (email: string) => string;\n  newPassword: string;\n  confirmPassword: string;\n  /** Under the confirmation while it differs. */\n  mismatch: string;\n  submit: string;\n  /** The new password was not saved, for a reason that is not the link. */\n  failed: string;\n  /** The page was opened without a `token`. */\n  noToken: string;\n  /** The link is unknown, spent or expired — one sentence, as the server gives one\n   *  code (`token_invalid`). */\n  invalid: string;\n  /** Under it. */\n  invalidHint: string;\n  /** The way forward from an invalid link: back to \"Forgot password\". */\n  requestNew: string;\n  /** Done. */\n  success: string;\n  /** Under it: a reset ends every session (§6.3). */\n  sessionsEnded: string;\n  /** The button out — to sign-in, with the address filled in. */\n  signIn: string;\n  /** 0.30.0: the save was throttled — HTTP 429 ({@link isRateLimited}) — given the\n   *  `Retry-After` wait in seconds, or `undefined` without one. OPTIONAL, like every key\n   *  added to a shipped interface; the provider's `resetPassword`, then English, fill\n   *  it. */\n  rateLimited?: (seconds?: number) => string;\n}\n\n// Defined in ./reset-password-form-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_RESET_PASSWORD_LABELS };\n\n/* ── Types ───────────────────────────────────────────────────────────────── */\n\n/** What `onCheck` may resolve with — keksdose's `/password-reset/check` answer. */\nexport interface ResetPasswordCheck {\n  /** The account's address: named over the fields (\"You're setting a new password for\n   *  …\") and handed to the password manager, which files the new password under it. */\n  email?: string;\n  /** The app's notices over the fields, shown BEFORE the password is typed — keksdose's\n   *  \"your account is end-to-end encrypted: this restores your sign-in, not your data\". */\n  notices?: ReactNode;\n}\n\n/** What `onSubmit` hands over. */\nexport interface ResetPasswordValues {\n  token: string;\n  password: string;\n}\n\n/** What `onSubmit` resolves with — keksdose's `/password-reset/confirm` answer, which\n *  carries no tokens (§6.3). */\nexport interface ResetPasswordResult {\n  /** The account's address — the sign-in it leads to is filled in with it. */\n  email: string;\n  /** The app's outcomes, shown on the done state: keksdose's recovery-code notice for an\n   *  encrypted account, \"Your 2 personal access tokens were revoked\". */\n  notices?: ReactNode;\n}\n\ntype Phase =\n  { kind: \"form\"; check: ResetPasswordCheck } | { kind: \"invalid\" } | { kind: \"done\"; result: ResetPasswordResult };\n\nexport interface ResetPasswordFormProps extends Omit<ComponentPropsWithRef<\"div\">, \"onSubmit\" | \"children\" | \"title\"> {\n  /** The link's token — the app's `?token=` (keksdose, kastlan: `/reset-password?token=…`).\n   *  Empty: the link was cut short, and the page says so without asking anyone. */\n  token: string;\n  /**\n   * Check the link before the form shows (`/auth/password-reset/check`) — once per\n   * token, on mount. Checking does not use it up, so a reload is free. Resolve (with\n   * the address and any notices) for a live link; reject for a dead one, and the page\n   * says \"This link is invalid or has expired\" with the way to a new one.\n   */\n  onCheck: (token: string) => Promise<ResetPasswordCheck | void | undefined>;\n  /**\n   * The new password was submitted: send `/auth/password-reset/confirm`. Resolve with\n   * the account's address (and the app's notices) — no tokens: a reset is not a sign-in\n   * (§6.3). Reject with the client's error: `token_invalid` (the link expired or was\n   * used in another tab while the form was open) goes to the invalid state; anything\n   * else stays on the form with the password kept.\n   */\n  onSubmit: (values: ResetPasswordValues) => Promise<ResetPasswordResult>;\n  /** \"Go to sign in\" calls this with the address, for an app that routes in code.\n   *  Without it, the button is a link to `signInHref`. */\n  onSignIn?: (email: string) => void;\n  /** Where \"Go to sign in\" leads, with `?email=` added — read it into `SignInForm`'s\n   *  `defaultEmail`. Default `/login`. */\n  signInHref?: string;\n  /** \"Request a new link\" — the app's \"Forgot password\" page. Default\n   *  `/forgot-password`. */\n  forgotHref?: string;\n  /** The app's words for a failed save (the device offline), or `undefined` for the\n   *  kit's: `rateLimited` for a bare `429` (0.30.0), else `failed`. Not asked for\n   *  `token_invalid` or `token_expired`, which are a state. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** The heading. Default `labels.title`; `null` draws none, for a page that puts it\n   *  in `AuthLayout`'s `title` instead. */\n  title?: ReactNode;\n  /** The heading's level. Default `h2`, under the page's `h1`. */\n  headingAs?: AuthHeadingLevel;\n  labels?: LabelOverride<ResetPasswordLabels>;\n}\n\n/**\n * Redeem a password-reset link (`/reset-password?token=…`, docs/auth-harmonization.md\n * §6.3, §7) — keksdose's `ResetPasswordPage` (features/auth/reset-password-page.tsx),\n * which kastlan built its own on.\n *\n * **The link is checked first** (`onCheck`), and only then does the form appear: an\n * expired link should say so before someone types a new password twice, not after.\n *\n * **A reset is not a sign-in** (§6.3, §10.11). The confirm answers without tokens, so a\n * 2FA account cannot skip its second factor by way of its inbox, and the page ends on\n * \"Go to sign in\" with the address filled in — the person has just typed the new\n * password twice; signing in is one step. What else the reset did is said there:\n * every other session ended (the kit's line, true in all three apps), and the app's own\n * outcomes in `notices` — keksdose's recovery-code notice and its revoked API tokens.\n *\n * **The password** is chosen with the same fields as `RegisterForm` and `SignInForm`'s\n * set-password step ({@link NewPasswordFields}): the strength meter and its checklist as\n * advice, and only the two hard rules — at least 8 characters, at most 72 bytes (§8).\n * The submit waits for both and a matching confirmation.\n *\n * The form never sends a request itself (§8): the token and the password go to the\n * callbacks, and the page renders what they resolve with.\n */\nexport function ResetPasswordForm({\n  token,\n  onCheck,\n  onSubmit,\n  onSignIn,\n  signInHref = \"/login\",\n  forgotHref = \"/forgot-password\",\n  describeError,\n  title,\n  headingAs: Heading = \"h2\",\n  labels: labelsProp,\n  className,\n  ...rest\n}: ResetPasswordFormProps) {\n  const labels = useKitLabels(\"resetPassword\", DEFAULT_RESET_PASSWORD_LABELS, labelsProp);\n  // The phase belongs to the token it was reached with: a new token starts over at the\n  // check without a reset effect.\n  const [phase, setPhase] = useState<{ token: string; phase: Phase } | null>(null);\n  const current: Phase | \"checking\" =\n    token === \"\" ? { kind: \"invalid\" } : phase?.token === token ? phase.phase : \"checking\";\n\n  useOncePerKey(token === \"\" ? null : token, onCheck, (key, result) =>\n    setPhase({\n      token: key,\n      phase: result.ok ? { kind: \"form\", check: result.value ?? {} } : { kind: \"invalid\" },\n    }),\n  );\n\n  const [password, setPassword] = useState(\"\");\n  const [confirm, setConfirm] = useState(\"\");\n  const [pending, setPending] = useState(false);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const headingId = useId();\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  const kind = current === \"checking\" ? \"checking\" : current.kind;\n\n  // The form arrives after the check: the field is where the person is going.\n  useEffect(() => {\n    if (kind === \"form\") passwordRef.current?.focus();\n  }, [kind]);\n  useFocusWhen(kind === \"done\", doneRef);\n\n  const heading =\n    title === null ? null : (\n      <Heading id={headingId} className={FORM_HEADING_CLASS}>\n        {title ?? labels.title}\n      </Heading>\n    );\n  const rootClass = cn(\"space-y-3\", className);\n\n  if (current === \"checking\") {\n    return (\n      <div {...rest} data-state=\"checking\" aria-busy className={rootClass}>\n        {heading}\n        <LoadingState size=\"sm\" label={labels.checking} />\n      </div>\n    );\n  }\n\n  if (current.kind === \"invalid\") {\n    return (\n      <div {...rest} data-state=\"invalid\" className={rootClass}>\n        {heading}\n        <EmptyState\n          tone=\"danger\"\n          icon={<XCircle />}\n          title={token === \"\" ? labels.noToken : labels.invalid}\n          hint={labels.invalidHint}\n          action={\n            <Button href={forgotHref} variant=\"accent\">\n              {labels.requestNew}\n            </Button>\n          }\n          className={OUTCOME_CLASS}\n        />\n      </div>\n    );\n  }\n\n  if (current.kind === \"done\") {\n    const { email, notices } = current.result;\n    return (\n      <div {...rest} data-state=\"done\" className={rootClass}>\n        {heading}\n        <OutcomeMessage icon={<CheckCircle2 className=\"text-success\" />} focusRef={doneRef}>\n          <p className={INTRO_CLASS}>{labels.success}</p>\n        </OutcomeMessage>\n        {notices}\n        <p className=\"text-xs text-muted\">{labels.sessionsEnded}</p>\n        {onSignIn ? (\n          <Button type=\"button\" variant=\"accent\" className=\"w-full\" onClick={() => onSignIn(email)}>\n            {labels.signIn}\n          </Button>\n        ) : (\n          <Button href={email ? withQuery(signInHref, \"email\", email) : signInHref} variant=\"accent\" className=\"w-full\">\n            {labels.signIn}\n          </Button>\n        )}\n      </div>\n    );\n  }\n\n  const { email, notices } = current.check;\n  const problem = newPasswordProblem(password, confirm);\n\n  const submit = (e: FormEvent) => {\n    e.preventDefault();\n    if (pending || problem !== null) return;\n    setFailure(null);\n    setPending(true);\n    Promise.resolve()\n      .then(() => onSubmit({ token, password }))\n      .then(\n        (result) => {\n          setPending(false);\n          setPassword(\"\");\n          setConfirm(\"\");\n          setPhase({ token, phase: { kind: \"done\", result } });\n        },\n        (error: unknown) => {\n          setPending(false);\n          // A link that died between the check and the save — used, or run out — is the\n          // dead-link state, under either code (0.31.1: keksdose mapped `token_expired`\n          // to it itself, `asDeadLink`).\n          const code = authErrorCode(error);\n          if (code === \"token_invalid\" || code === \"token_expired\") {\n            setPassword(\"\");\n            setConfirm(\"\");\n            setPhase({ token, phase: { kind: \"invalid\" } });\n            return;\n          }\n          // The app's words first, then the throttle's, then the kit's catch-all — an app's\n          // \"\" is no words (refactor audit 2026-10-30, DUP-14: `??` drew an empty alert).\n          setFailure(\n            describeFailure(\n              describeError?.(error),\n              isRateLimited(error)\n                ? (labels.rateLimited ?? DEFAULT_RESET_PASSWORD_LABELS.rateLimited)(retryAfterSeconds(error))\n                : labels.failed,\n            ),\n          );\n        },\n      );\n  };\n\n  return (\n    <div {...rest} data-state=\"form\" className={rootClass}>\n      <form className=\"space-y-3\" aria-labelledby={title === null ? undefined : headingId} onSubmit={submit}>\n        {heading}\n        {email ? <p className={INTRO_CLASS}>{labels.intro(email)}</p> : null}\n        {notices}\n        {/* Which account the new password is for, for the password manager: it files\n            the new password under this username instead of guessing (kastlan). */}\n        {email ? <input type=\"email\" name=\"username\" autoComplete=\"username\" value={email} readOnly hidden /> : null}\n        <NewPasswordFields\n          password={password}\n          confirm={confirm}\n          onPasswordChange={(next) => {\n            setPassword(next);\n            if (failure) setFailure(null);\n          }}\n          onConfirmChange={setConfirm}\n          busy={pending}\n          passwordRef={passwordRef}\n          text={{ password: labels.newPassword, confirm: labels.confirmPassword, mismatch: labels.mismatch }}\n        />\n        {failure != null && (\n          <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n            {failure}\n          </AlertBanner>\n        )}\n        <Button type=\"submit\" className=\"w-full\" disabled={!pending && problem !== null} pending={pending}>\n          {labels.submit}\n        </Button>\n      </form>\n    </div>\n  );\n}\n"],"mappings":";AA+MM,cAQA,YARA;AA/MN,SAAS,WAAW,OAAO,QAAQ,gBAAgB;AAEnD,SAAS,cAAc,eAAe;AACtC,SAAS,UAAU;AACnB,SAAS,uBAAuB;AAChC,SAAS,oBAAwC;AACjD,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,eAAe,eAAe,yBAAyB;AAChE,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,qCAAqC;AA2IvC,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,WAAW,UAAU;AAAA,EACrB,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA2B;AACzB,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAiD,IAAI;AAC/E,QAAM,UACJ,UAAU,KAAK,EAAE,MAAM,UAAU,IAAI,OAAO,UAAU,QAAQ,MAAM,QAAQ;AAE9E;AAAA,IAAc,UAAU,KAAK,OAAO;AAAA,IAAO;AAAA,IAAS,CAAC,KAAK,WACxD,SAAS;AAAA,MACP,OAAO;AAAA,MACP,OAAO,OAAO,KAAK,EAAE,MAAM,QAAQ,OAAO,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU;AAAA,IACrF,CAAC;AAAA,EACH;AAEA,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,EAAE;AACzC,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,YAAY,MAAM;AACxB,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAC3C,QAAM,OAAO,YAAY,aAAa,aAAa,QAAQ;AAG3D,YAAU,MAAM;AACd,QAAI,SAAS,OAAQ,aAAY,SAAS,MAAM;AAAA,EAClD,GAAG,CAAC,IAAI,CAAC;AACT,eAAa,SAAS,QAAQ,OAAO;AAErC,QAAM,UACJ,UAAU,OAAO,OACf,oBAAC,WAAQ,IAAI,WAAW,WAAW,oBAChC,mBAAS,OAAO,OACnB;AAEJ,QAAM,YAAY,GAAG,aAAa,SAAS;AAE3C,MAAI,YAAY,YAAY;AAC1B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,YAAW,aAAS,MAAC,WAAW,WACvD;AAAA;AAAA,MACD,oBAAC,gBAAa,MAAK,MAAK,OAAO,OAAO,UAAU;AAAA,OAClD;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,WAAW;AAC9B,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,WAAU,WAAW,WAC5C;AAAA;AAAA,MACD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAM,oBAAC,WAAQ;AAAA,UACf,OAAO,UAAU,KAAK,OAAO,UAAU,OAAO;AAAA,UAC9C,MAAM,OAAO;AAAA,UACb,QACE,oBAAC,UAAO,MAAM,YAAY,SAAQ,UAC/B,iBAAO,YACV;AAAA,UAEF,WAAW;AAAA;AAAA,MACb;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,EAAE,OAAAA,QAAO,SAAAC,SAAQ,IAAI,QAAQ;AACnC,WACE,qBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WACzC;AAAA;AAAA,MACD,oBAAC,kBAAe,MAAM,oBAAC,gBAAa,WAAU,gBAAe,GAAI,UAAU,SACzE,8BAAC,OAAE,WAAW,aAAc,iBAAO,SAAQ,GAC7C;AAAA,MACCA;AAAA,MACD,oBAAC,OAAE,WAAU,sBAAsB,iBAAO,eAAc;AAAA,MACvD,WACC,oBAAC,UAAO,MAAK,UAAS,SAAQ,UAAS,WAAU,UAAS,SAAS,MAAM,SAASD,MAAK,GACpF,iBAAO,QACV,IAEA,oBAAC,UAAO,MAAMA,SAAQ,UAAU,YAAY,SAASA,MAAK,IAAI,YAAY,SAAQ,UAAS,WAAU,UAClG,iBAAO,QACV;AAAA,OAEJ;AAAA,EAEJ;AAEA,QAAM,EAAE,OAAO,QAAQ,IAAI,QAAQ;AACnC,QAAM,UAAU,mBAAmB,UAAU,OAAO;AAEpD,QAAM,SAAS,CAAC,MAAiB;AAC/B,MAAE,eAAe;AACjB,QAAI,WAAW,YAAY,KAAM;AACjC,eAAW,IAAI;AACf,eAAW,IAAI;AACf,YAAQ,QAAQ,EACb,KAAK,MAAM,SAAS,EAAE,OAAO,SAAS,CAAC,CAAC,EACxC;AAAA,MACC,CAAC,WAAW;AACV,mBAAW,KAAK;AAChB,oBAAY,EAAE;AACd,mBAAW,EAAE;AACb,iBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,MACrD;AAAA,MACA,CAAC,UAAmB;AAClB,mBAAW,KAAK;AAIhB,cAAM,OAAO,cAAc,KAAK;AAChC,YAAI,SAAS,mBAAmB,SAAS,iBAAiB;AACxD,sBAAY,EAAE;AACd,qBAAW,EAAE;AACb,mBAAS,EAAE,OAAO,OAAO,EAAE,MAAM,UAAU,EAAE,CAAC;AAC9C;AAAA,QACF;AAGA;AAAA,UACE;AAAA,YACE,gBAAgB,KAAK;AAAA,YACrB,cAAc,KAAK,KACd,OAAO,eAAe,8BAA8B,aAAa,kBAAkB,KAAK,CAAC,IAC1F,OAAO;AAAA,UACb;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACJ;AAEA,SACE,oBAAC,SAAK,GAAG,MAAM,cAAW,QAAO,WAAW,WAC1C,+BAAC,UAAK,WAAU,aAAY,mBAAiB,UAAU,OAAO,SAAY,WAAW,UAAU,QAC5F;AAAA;AAAA,IACA,QAAQ,oBAAC,OAAE,WAAW,aAAc,iBAAO,MAAM,KAAK,GAAE,IAAO;AAAA,IAC/D;AAAA,IAGA,QAAQ,oBAAC,WAAM,MAAK,SAAQ,MAAK,YAAW,cAAa,YAAW,OAAO,OAAO,UAAQ,MAAC,QAAM,MAAC,IAAK;AAAA,IACxG;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA,kBAAkB,CAAC,SAAS;AAC1B,sBAAY,IAAI;AAChB,cAAI,QAAS,YAAW,IAAI;AAAA,QAC9B;AAAA,QACA,iBAAiB;AAAA,QACjB,MAAM;AAAA,QACN;AAAA,QACA,MAAM,EAAE,UAAU,OAAO,aAAa,SAAS,OAAO,iBAAiB,UAAU,OAAO,SAAS;AAAA;AAAA,IACnG;AAAA,IACC,WAAW,QACV,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,IAEF,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,CAAC,WAAW,YAAY,MAAM,SAC9E,iBAAO,QACV;AAAA,KACF,GACF;AAEJ;","names":["email","notices"]}

package/dist/auth/sign-in-form-labels.js

@@ -1,5 +1,5 @@
 "use client";
-import { englishRateLimited } from "./auth-errors.js";
+import { englishRateLimited } from "./auth-errors-labels.js";
 const DEFAULT_SIGN_IN_LABELS = {
   email: "Email",
   password: "Password",

package/dist/auth/sign-in-form-labels.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/sign-in-form-labels.ts"],"sourcesContent":["// The English words of ./sign-in-form, in a module with no component code: the English\n// catalogue (src/i18n/defaults.ts) imports them without the component, so `en` loads as one\n// chunk like the other languages (0.34, KS U8). ./sign-in-form re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors\";\nimport type { SignInLabels } from \"./sign-in-form\";\n\n/** `Required`: every key, the 0.30 ones included, has its English here. */\nexport const DEFAULT_SIGN_IN_LABELS: Required<SignInLabels> = {\n  email: \"Email\",\n  password: \"Password\",\n  submit: \"Sign in\",\n  passkey: \"Sign in with a passkey\",\n  forgotPassword: \"Forgot your password?\",\n  noAccount: \"No account yet?\",\n  register: \"Create account\",\n  invalidCredentials: \"The email or password is incorrect.\",\n  failed: \"Sign-in failed. Please try again.\",\n  passkeyFailed: \"Passkey sign-in failed.\",\n  deactivatedHint: \"Account deactivated? Write to {contact}.\",\n  tagHint: (taggedAddress) => `Signed up with ${taggedAddress}? Use that address.`,\n  twoFactorTitle: \"Two-factor authentication\",\n  twoFactorIntro: \"Enter the code your authenticator app shows.\",\n  code: \"2FA code\",\n  verify: \"Verify\",\n  codeInvalid: \"Invalid 2FA code.\",\n  setPasswordTitle: \"Choose a new password\",\n  setPasswordIntro: \"A new password was requested for this account. Choose one and you are straight back in.\",\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  passwordMismatch: \"The passwords don't match.\",\n  setPasswordSubmit: \"Set password and sign in\",\n  setPasswordFailed: \"The password could not be set.\",\n  expired: \"This sign-in has expired. Please sign in again.\",\n  backToSignIn: \"Back to sign in\",\n  useRecoveryCode: \"Use a backup code\",\n  useAuthenticatorCode: \"Use your authenticator app\",\n  recoveryCode: \"Backup code\",\n  recoveryIntro: \"Enter one of the backup codes you saved when you turned on two-factor authentication.\",\n  recoveryCodeHint: (length) => `${length} letters and digits. Dashes and spaces don’t matter.`,\n  recoveryCodeInvalid: \"This backup code is not valid, or it has been used already.\",\n  rateLimited: englishRateLimited,\n  requestAccess: \"Request access\",\n};\n"],"mappings":";AAIA,SAAS,0BAA0B;AAI5B,MAAM,yBAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,SAAS,CAAC,kBAAkB,kBAAkB,aAAa;AAAA,EAC3D,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,kBAAkB,CAAC,WAAW,GAAG,MAAM;AAAA,EACvC,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,eAAe;AACjB;","names":[]}
+{"version":3,"sources":["../../src/auth/sign-in-form-labels.ts"],"sourcesContent":["// The English words of ./sign-in-form, in a module with no component code: the English\n// catalogue (src/i18n/defaults.ts) imports them without the component, so `en` loads as one\n// chunk like the other languages (0.34, KS U8). ./sign-in-form re-exports them.\n\nimport { englishRateLimited } from \"./auth-errors-labels\";\nimport type { SignInLabels } from \"./sign-in-form\";\n\n/** `Required`: every key, the 0.30 ones included, has its English here. */\nexport const DEFAULT_SIGN_IN_LABELS: Required<SignInLabels> = {\n  email: \"Email\",\n  password: \"Password\",\n  submit: \"Sign in\",\n  passkey: \"Sign in with a passkey\",\n  forgotPassword: \"Forgot your password?\",\n  noAccount: \"No account yet?\",\n  register: \"Create account\",\n  invalidCredentials: \"The email or password is incorrect.\",\n  failed: \"Sign-in failed. Please try again.\",\n  passkeyFailed: \"Passkey sign-in failed.\",\n  deactivatedHint: \"Account deactivated? Write to {contact}.\",\n  tagHint: (taggedAddress) => `Signed up with ${taggedAddress}? Use that address.`,\n  twoFactorTitle: \"Two-factor authentication\",\n  twoFactorIntro: \"Enter the code your authenticator app shows.\",\n  code: \"2FA code\",\n  verify: \"Verify\",\n  codeInvalid: \"Invalid 2FA code.\",\n  setPasswordTitle: \"Choose a new password\",\n  setPasswordIntro: \"A new password was requested for this account. Choose one and you are straight back in.\",\n  newPassword: \"New password\",\n  confirmPassword: \"Repeat new password\",\n  passwordMismatch: \"The passwords don't match.\",\n  setPasswordSubmit: \"Set password and sign in\",\n  setPasswordFailed: \"The password could not be set.\",\n  expired: \"This sign-in has expired. Please sign in again.\",\n  backToSignIn: \"Back to sign in\",\n  useRecoveryCode: \"Use a backup code\",\n  useAuthenticatorCode: \"Use your authenticator app\",\n  recoveryCode: \"Backup code\",\n  recoveryIntro: \"Enter one of the backup codes you saved when you turned on two-factor authentication.\",\n  recoveryCodeHint: (length) => `${length} letters and digits. Dashes and spaces don’t matter.`,\n  recoveryCodeInvalid: \"This backup code is not valid, or it has been used already.\",\n  rateLimited: englishRateLimited,\n  requestAccess: \"Request access\",\n};\n"],"mappings":";AAIA,SAAS,0BAA0B;AAI5B,MAAM,yBAAiD;AAAA,EAC5D,OAAO;AAAA,EACP,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,SAAS,CAAC,kBAAkB,kBAAkB,aAAa;AAAA,EAC3D,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,kBAAkB,CAAC,WAAW,GAAG,MAAM;AAAA,EACvC,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,eAAe;AACjB;","names":[]}