@eifi1/ui-kit 0.51.7 → 0.53.0

package/dist/lib/safe-storage.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/safe-storage.ts"],"sourcesContent":["/**\n * `localStorage` that cannot take the page down with it.\n *\n * Accessing `window.localStorage` **throws** — rather than returning null — when a\n * browser has site data blocked: Safari private browsing, Chrome with third-party\n * site data disabled, a partitioned webview. Three places in this package already\n * knew that and wrapped their calls in try/catch (`logger.ts`, and the DataTable's\n * `loadPersisted`/`savePersisted`). One did not: `AppShell` read the sidebar's\n * collapse flag straight out of a `useState` initialiser, so the throw happened\n * during render of the application's top-level shell. That is not a lost preference\n * — nothing mounts, in every consumer of this package at once.\n *\n * So the guard lives here, once, and the next storage-backed preference cannot\n * forget it. A read that cannot happen is indistinguishable from a key that was\n * never set, which is the right answer for every caller: the default.\n *\n * Since 0.34 (DUP-11, refactor audit 2026-10) it also removes, and guards\n * `sessionStorage` the same way: `landing/routing`, `billing/checkout-processing` and\n * the demo banner each wrote that guard again by hand. `removeStored` and the session\n * pair are package-private — the barrel exports `readStored` / `writeStored` only.\n */\n\n/** `access` on the storage area, or `fallback` where there is none (SSR) or it throws. */\nfunction guarded<T>(area: \"localStorage\" | \"sessionStorage\", fallback: T, access: (storage: Storage) => T): T {\n  if (typeof window === \"undefined\") return fallback;\n  try {\n    return access(window[area]);\n  } catch {\n    // private mode, quota, partitioned or blocked storage\n    return fallback;\n  }\n}\n\n/** The stored string for `key`, or null when absent, unreadable, or blocked. */\nexport function readStored(key: string): string | null {\n  return guarded(\"localStorage\", null, (storage) => storage.getItem(key));\n}\n\n/** Store `value` under `key`, silently doing nothing when storage is unavailable\n *  or full. A preference that cannot be persisted is not worth an exception. */\nexport function writeStored(key: string, value: string): void {\n  guarded(\"localStorage\", undefined, (storage) => storage.setItem(key, value));\n}\n\n/** Forget `key`, silently doing nothing when storage is blocked — there is nothing to\n *  forget then. */\nexport function removeStored(key: string): void {\n  guarded(\"localStorage\", undefined, (storage) => storage.removeItem(key));\n}\n\n/** {@link readStored} for `sessionStorage`: this tab's value, or null. */\nexport function readSessionStored(key: string): string | null {\n  return guarded(\"sessionStorage\", null, (storage) => storage.getItem(key));\n}\n\n/** {@link writeStored} for `sessionStorage`; `null` removes the key. */\nexport function writeSessionStored(key: string, value: string | null): void {\n  guarded(\"sessionStorage\", undefined, (storage) =>\n    value === null ? storage.removeItem(key) : storage.setItem(key, value),\n  );\n}\n\n/**\n * Every key in `area` that starts with `prefix`, or `[]` where storage refuses — for the\n * reset of this device's settings, which removes a table's views by their prefix\n * (docs/settings-harmonization.md §11.4). Package-private, like {@link removeStored}.\n */\nexport function storedKeys(prefix: string, area: \"local\" | \"session\" = \"local\"): string[] {\n  return guarded(area === \"session\" ? \"sessionStorage\" : \"localStorage\", [], (storage) => {\n    const keys: string[] = [];\n    for (let i = 0; i < storage.length; i++) {\n      const key = storage.key(i);\n      if (key !== null && key.startsWith(prefix)) keys.push(key);\n    }\n    return keys;\n  });\n}\n"],"mappings":";AAuBA,SAAS,QAAW,MAAyC,UAAa,QAAoC;AAC5G,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,WAAO,OAAO,OAAO,IAAI,CAAC;AAAA,EAC5B,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,WAAW,KAA4B;AACrD,SAAO,QAAQ,gBAAgB,MAAM,CAAC,YAAY,QAAQ,QAAQ,GAAG,CAAC;AACxE;AAIO,SAAS,YAAY,KAAa,OAAqB;AAC5D,UAAQ,gBAAgB,QAAW,CAAC,YAAY,QAAQ,QAAQ,KAAK,KAAK,CAAC;AAC7E;AAIO,SAAS,aAAa,KAAmB;AAC9C,UAAQ,gBAAgB,QAAW,CAAC,YAAY,QAAQ,WAAW,GAAG,CAAC;AACzE;AAGO,SAAS,kBAAkB,KAA4B;AAC5D,SAAO,QAAQ,kBAAkB,MAAM,CAAC,YAAY,QAAQ,QAAQ,GAAG,CAAC;AAC1E;AAGO,SAAS,mBAAmB,KAAa,OAA4B;AAC1E;AAAA,IAAQ;AAAA,IAAkB;AAAA,IAAW,CAAC,YACpC,UAAU,OAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAAA,EACvE;AACF;AAOO,SAAS,WAAW,QAAgB,OAA4B,SAAmB;AACxF,SAAO,QAAQ,SAAS,YAAY,mBAAmB,gBAAgB,CAAC,GAAG,CAAC,YAAY;AACtF,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,YAAM,MAAM,QAAQ,IAAI,CAAC;AACzB,UAAI,QAAQ,QAAQ,IAAI,WAAW,MAAM,EAAG,MAAK,KAAK,GAAG;AAAA,IAC3D;AACA,WAAO;AAAA,EACT,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/lib/safe-storage.ts"],"sourcesContent":["/**\n * `localStorage` that cannot take the page down with it.\n *\n * Accessing `window.localStorage` **throws** — rather than returning null — when a\n * browser has site data blocked: Safari private browsing, Chrome with third-party\n * site data disabled, a partitioned webview. Three places in this package already\n * knew that and wrapped their calls in try/catch (`logger.ts`, and the DataTable's\n * `loadPersisted`/`savePersisted`). One did not: `AppShell` read the sidebar's\n * collapse flag straight out of a `useState` initialiser, so the throw happened\n * during render of the application's top-level shell. That is not a lost preference\n * — nothing mounts, in every consumer of this package at once.\n *\n * So the guard lives here, once, and the next storage-backed preference cannot\n * forget it. A read that cannot happen is indistinguishable from a key that was\n * never set, which is the right answer for every caller: the default.\n *\n * Since 0.34 (DUP-11, refactor audit 2026-10) it also removes, and guards\n * `sessionStorage` the same way: `landing/routing`, `billing/checkout-processing` and\n * the demo banner each wrote that guard again by hand.\n *\n * Since 0.52 all of it but {@link storedKeys} is public, with a JSON pair beside it\n * (DUP-8, refactor audit 2026-10-30). Kept package-private, the guard was written again\n * four times in the kit's showcase and in 16 files across the three apps, some of them\n * without it: a token read that throws where storage is blocked takes every request\n * down with it. (The kit's own DevMenu, 0.51, wrote the session pair a second time too.)\n */\n\n/** `access` on the storage area, or `fallback` where there is none (SSR) or it throws. */\nfunction guarded<T>(area: \"localStorage\" | \"sessionStorage\", fallback: T, access: (storage: Storage) => T): T {\n  if (typeof window === \"undefined\") return fallback;\n  try {\n    return access(window[area]);\n  } catch {\n    // private mode, quota, partitioned or blocked storage\n    return fallback;\n  }\n}\n\n/** The stored string for `key`, or null when absent, unreadable, or blocked. */\nexport function readStored(key: string): string | null {\n  return guarded(\"localStorage\", null, (storage) => storage.getItem(key));\n}\n\n/** Store `value` under `key`, silently doing nothing when storage is unavailable\n *  or full. A preference that cannot be persisted is not worth an exception. `null`\n *  removes the key, as {@link writeSessionStored}'s does (0.52; the two pairs wrote\n *  differently, and `null` past the types stored the string \"null\" — 0.52 code review). */\nexport function writeStored(key: string, value: string | null): void {\n  guarded(\"localStorage\", undefined, (storage) =>\n    value === null ? storage.removeItem(key) : storage.setItem(key, value),\n  );\n}\n\n/** Forget `key`, silently doing nothing when storage is blocked — there is nothing to\n *  forget then. */\nexport function removeStored(key: string): void {\n  guarded(\"localStorage\", undefined, (storage) => storage.removeItem(key));\n}\n\n/** {@link readStored} for `sessionStorage`: this tab's value, or null. */\nexport function readSessionStored(key: string): string | null {\n  return guarded(\"sessionStorage\", null, (storage) => storage.getItem(key));\n}\n\n/** {@link writeStored} for `sessionStorage`; `null` removes the key. */\nexport function writeSessionStored(key: string, value: string | null): void {\n  guarded(\"sessionStorage\", undefined, (storage) =>\n    value === null ? storage.removeItem(key) : storage.setItem(key, value),\n  );\n}\n\n/**\n * The JSON stored under `key`, when it parses and `isShape` accepts it; else `null`. Absent,\n * blocked, malformed and another shape all read as \"never set\" — the caller's default —\n * which is what the six hand-written `JSON.parse(readStored(key))` reads in the kit each\n * answered in their own try/catch (DUP-8). `isShape` gets the parsed value as `unknown`:\n * the shape check is the one part that is the caller's. A shape check that throws reads\n * as another shape: null.\n */\nexport function readStoredJson<T>(key: string, isShape: (value: unknown) => value is T): T | null {\n  const text = readStored(key);\n  if (text === null) return null;\n  try {\n    const value: unknown = JSON.parse(text);\n    return isShape(value) ? value : null;\n  } catch {\n    // not JSON, or a shape check that read past what is there\n    return null;\n  }\n}\n\n/** Store `value` as JSON under `key`, silently doing nothing when storage is unavailable\n *  or full, or the value has no JSON form (a cycle, a BigInt) — {@link writeStored}'s rule. */\nexport function writeStoredJson(key: string, value: unknown): void {\n  let text: string | undefined;\n  try {\n    text = JSON.stringify(value);\n  } catch {\n    return;\n  }\n  // `undefined` (and a function) has no JSON form either: stringify answers undefined.\n  if (text !== undefined) writeStored(key, text);\n}\n\n/**\n * Every key in `area` that starts with `prefix`, or `[]` where storage refuses — for the\n * reset of this device's settings, which removes a table's views by their prefix\n * (docs/settings-harmonization.md §11.4). Package-private: the reset's alone.\n */\nexport function storedKeys(prefix: string, area: \"local\" | \"session\" = \"local\"): string[] {\n  return guarded(area === \"session\" ? \"sessionStorage\" : \"localStorage\", [], (storage) => {\n    const keys: string[] = [];\n    for (let i = 0; i < storage.length; i++) {\n      const key = storage.key(i);\n      if (key !== null && key.startsWith(prefix)) keys.push(key);\n    }\n    return keys;\n  });\n}\n"],"mappings":";AA4BA,SAAS,QAAW,MAAyC,UAAa,QAAoC;AAC5G,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,WAAO,OAAO,OAAO,IAAI,CAAC;AAAA,EAC5B,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,WAAW,KAA4B;AACrD,SAAO,QAAQ,gBAAgB,MAAM,CAAC,YAAY,QAAQ,QAAQ,GAAG,CAAC;AACxE;AAMO,SAAS,YAAY,KAAa,OAA4B;AACnE;AAAA,IAAQ;AAAA,IAAgB;AAAA,IAAW,CAAC,YAClC,UAAU,OAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAAA,EACvE;AACF;AAIO,SAAS,aAAa,KAAmB;AAC9C,UAAQ,gBAAgB,QAAW,CAAC,YAAY,QAAQ,WAAW,GAAG,CAAC;AACzE;AAGO,SAAS,kBAAkB,KAA4B;AAC5D,SAAO,QAAQ,kBAAkB,MAAM,CAAC,YAAY,QAAQ,QAAQ,GAAG,CAAC;AAC1E;AAGO,SAAS,mBAAmB,KAAa,OAA4B;AAC1E;AAAA,IAAQ;AAAA,IAAkB;AAAA,IAAW,CAAC,YACpC,UAAU,OAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAAA,EACvE;AACF;AAUO,SAAS,eAAkB,KAAa,SAAmD;AAChG,QAAM,OAAO,WAAW,GAAG;AAC3B,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,WAAO,QAAQ,KAAK,IAAI,QAAQ;AAAA,EAClC,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAIO,SAAS,gBAAgB,KAAa,OAAsB;AACjE,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN;AAAA,EACF;AAEA,MAAI,SAAS,OAAW,aAAY,KAAK,IAAI;AAC/C;AAOO,SAAS,WAAW,QAAgB,OAA4B,SAAmB;AACxF,SAAO,QAAQ,SAAS,YAAY,mBAAmB,gBAAgB,CAAC,GAAG,CAAC,YAAY;AACtF,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,YAAM,MAAM,QAAQ,IAAI,CAAC;AACzB,UAAI,QAAQ,QAAQ,IAAI,WAAW,MAAM,EAAG,MAAK,KAAK,GAAG;AAAA,IAC3D;AACA,WAAO;AAAA,EACT,CAAC;AACH;","names":[]}

package/dist/lib/session-refresh.js

@@ -1,5 +1,5 @@
 "use client";
-import { httpStatusOf } from "../auth/auth-errors.js";
+import { httpStatusOf } from "./http-status.js";
 const SIGNED_OUT_STEPS = [
   "login",
   "passkey/login",

package/dist/lib/session-refresh.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/session-refresh.ts"],"sourcesContent":["/**\n * Renewing a session when the access token runs out: the client half of\n * docs/auth-harmonization.md §11 (round 0.34 C7, KS U6), lifted from keksdose's\n * `refreshOnce` (Kurvenschmiede's is the same, line for line) and corrected where the\n * three apps' reviews found it wrong. It ends kastlan's sign-out over a network blip (B3).\n *\n * THE KIT OWNS THE RULE, THE APP OWNS THE CALL (§11.2, decision 1). The kit decides when\n * to refresh, who waits, what a failure means, when the session is over and whether a\n * renewal may still be stored. The app keeps its endpoint, its token storage, its\n * sign-out and where it navigates, and hands them in as {@link SessionRefreshOptions}.\n *\n *  - **One flight per tab** (decision 2): every 401 that arrives while a refresh runs\n *    waits for it, and so does `session.refresh()` (kastlan's boot).\n *  - **Definitive** (decision 3): the device holds no refresh token (`refresh` resolves\n *    `null`), the refresh answers 401 or 403, or the request replayed with the fresh\n *    token gets a 401 again. Only then does the app sign out (`onEnded`), and only while\n *    that session is still the app's.\n *  - **Transient** (decision 4): everything else. The session stays: nothing is signed\n *    out, stored or redirected, and the kit shows nothing. The request rejects with its\n *    OWN 401, marked ({@link isTransientRefreshFailure}), so the app's message can say\n *    \"can't reach the server\" instead of \"not signed in\".\n *  - **Retries only where waiting helps** (decision 5, KS 7): no answer, the kit's own\n *    timeout, 408, 429 and 5xx get up to three attempts, 1 s and then 3 s apart, each cut\n *    off after 15 s; none while the browser reports itself offline. Any other answer, and\n *    anything that is not an HTTP error, ends the flight at the first attempt.\n *  - **A stale session is never written back** (§11.7, ka 3, KS 3, KS 4): every request\n *    is stamped with `currentToken()` when it goes out, and every flight notes it when it\n *    starts. A 401 to a request sent with an older token replays it with the app's token\n *    now, without a refresh; a flight whose session changed while it ran stores nothing\n *    and ends nothing. The access token is the session's identity because every change\n *    the apps make replaces it — a refresh, another tab, a company switch, a password\n *    change, a sign-in, a demo start, a sign-out.\n *\n * Framework-free like `server-wake.ts`: {@link attachSessionRefresh} takes the app's\n * axios instance as an ARGUMENT, typed structurally, so the kit never imports axios.\n */\n\nimport type { AxiosLikeInstance, ServerWakeAxiosConfig } from \"./server-wake\";\nimport { httpStatusOf } from \"../auth/auth-errors\";\n\n/** What the app's `refresh` resolves: the new access token, plus whatever its `store`\n *  needs (its refresh token, the user). */\nexport interface SessionRenewal {\n  /** The new access token; the waiting requests are replayed with it. */\n  token: string;\n  /**\n   * `false`: store the renewal, but replay nothing — each waiting request rejects with\n   * its 401, unmarked. kastlan's refresh can land in another company (§11.5, ka 3): a\n   * waiting write, such as the handover's `POST /sync`, must not be replayed into it.\n   */\n  replay?: false;\n}\n\n/** What the app hands {@link createSessionRefresh} (§11.4). */\nexport interface SessionRefreshOptions<R extends SessionRenewal> {\n  /**\n   * The app's own `POST /auth/refresh`, on a BARE client — never the instance the kit is\n   * attached to, so the refresh cannot re-enter the interceptor. It **writes nothing**:\n   * the kit hands the answer to `store`, and only while the session is unchanged.\n   *\n   * Resolves the answer as a renewal, or `null` when the device holds no refresh token.\n   * Throws on failure, and the kit classifies the throw: a 401 or 403 is definitive; no\n   * answer (an axios error without a `response`), the kit's own timeout, 408, 429 and\n   * 5xx are transient and retried; any other answer, and anything that is not an HTTP\n   * error (a bug in this function), is transient and not retried. The status is read\n   * from `err.response.status` (axios), `err.status` or `err.statusCode`.\n   *\n   * `signal` aborts when the attempt runs past `timeoutMs`; pass it to the request.\n   */\n  refresh: (signal: AbortSignal) => Promise<R | null>;\n  /** Writes the renewal: the tokens and the user (a missing refresh token keeps the\n   *  stored one). Called only while the session the flight renews is still the app's,\n   *  and before the waiting requests are replayed — so it writes the token SYNCHRONOUSLY\n   *  where `currentToken` reads it: the replay goes through the app's own request\n   *  interceptor again, and is stamped then. A throw is the app's bug: the waiting\n   *  requests and `session.refresh()` reject with it. */\n  store: (renewal: R) => void;\n  /** The access token the app sends NOW, read where its request interceptor reads it;\n   *  `null` when there is none. */\n  currentToken: () => string | null;\n  /** Whether the session is a demo: a demo's 401 ends it, with no refresh tried\n   *  (landing-demo §5.5). */\n  isDemo: () => boolean;\n  /**\n   * The session is over: drop the tokens and the user, then navigate — `/demo/ended` for\n   * a demo, else the sign-in with the page it came from (auth §5.2). Called once per\n   * session, however many requests found out (KS 8), and never by `session.refresh()`.\n   */\n  onEnded: (ended: { demo: boolean }) => void;\n  /** Whether a URL is a signed-out step, whose 401 judges the form and never the\n   *  session. Replaces the default list, {@link isSignedOutStep}. */\n  isSignedOutStep?: (url: string) => boolean;\n  /** Attempts for a refresh that got no answer, timed out, or got a 408, 429 or 5xx.\n   *  Default 3. */\n  attempts?: number;\n  /** The waits before the second and later attempts; the last one repeats. Default\n   *  `[1000, 3000]`. */\n  backoffMs?: readonly number[];\n  /** Each attempt is cut off after this, and its `signal` aborted. Default 15 000. */\n  timeoutMs?: number;\n}\n\n/** What `session.refresh()` resolves (§11.4), by `result`:\n *\n * | `result` | When | What the kit has done |\n * |---|---|---|\n * | `\"renewed\"` | a renewal while the session was unchanged | `store(renewal)` |\n * | `\"ended\"` | definitive | nothing; `onEnded` only for requests that waited on the same flight |\n * | `\"transient\"` | transient | nothing |\n * | `\"changed\"` | the session changed while it ran | nothing; read the app's own state |\n */\nexport type SessionRefreshOutcome<R extends SessionRenewal = SessionRenewal> =\n  { result: \"renewed\"; renewal: R } | { result: \"ended\" } | { result: \"transient\" } | { result: \"changed\" };\n\n/** The flight {@link createSessionRefresh} makes; {@link attachSessionRefresh} hooks it\n *  to an axios instance. */\nexport interface SessionRefresh<R extends SessionRenewal = SessionRenewal> {\n  /**\n   * The same flight, for a caller outside the interceptor — kastlan's boot. Joins a\n   * running flight, or starts one. Never calls `onEnded`: the caller decides what an\n   * `\"ended\"` means for it.\n   */\n  refresh(): Promise<SessionRefreshOutcome<R>>;\n}\n\n// ── The signed-out steps ──────────────────────────────────────────────────────\n\n/**\n * Every `/auth/` call made without a session, the union of the three apps' lists\n * (§11.3): signing in (with its `2fa` and `set-password` steps, and a passkey's), up,\n * into a demo, a password reset, the verification link, the invitation check, the email\n * change's confirmation link, and the refresh itself. NOT `resend-verification` (KS 1):\n * in keksdose and Kurvenschmiede it needs a session; in kastlan it never answers 401.\n */\nconst SIGNED_OUT_STEPS = [\n  \"login\",\n  \"passkey/login\",\n  \"register\",\n  \"demo-session\",\n  \"password-reset\",\n  \"verify-email\",\n  \"invitations/check\",\n  \"me/email/confirm\",\n  \"refresh\",\n] as const;\n\n/**\n * Whether a request's URL is a signed-out step — the kit's default list (§11.3), exported\n * for an app's tests and for an app's own `isSignedOutStep` that adds to it.\n *\n * **Whole steps only** (KS 2): the part of the path after its `auth/` segment, without\n * the query string, is the entry itself or starts with the entry and a `/`. So\n * `login/2fa` is `login`'s, but `register` never catches `/auth/passkey/register/begin`\n * (adding a passkey, which needs a session), `invitations/check` never\n * `/auth/invitations/accept`, and `me/email/confirm` never `/auth/me/email`. Relative and\n * absolute URLs alike; a URL with no `auth` segment is no step.\n */\nexport function isSignedOutStep(url: string): boolean {\n  const path = url.replace(/[?#].*$/s, \"\").replace(/^([a-z][a-z\\d+.-]*:)?\\/\\/[^/]*/i, \"\");\n  const segments = path.split(\"/\");\n  const at = segments.indexOf(\"auth\");\n  if (at < 0) return false;\n  const step = segments.slice(at + 1).join(\"/\");\n  return SIGNED_OUT_STEPS.some((entry) => step === entry || step.startsWith(`${entry}/`));\n}\n\n// ── The marker ────────────────────────────────────────────────────────────────\n\n/** On the request's own axios error, after a transient failure (decision 8). A\n *  `Symbol.for` key: shared by every copy of the kit in a page, and left out of\n *  `JSON.stringify`, so a log that serialises the error doesn't print it (kk 2). */\nconst TRANSIENT = Symbol.for(\"@eifi1/ui-kit:session-refresh.transient\");\n\n/**\n * Whether a request was refused because the refresh behind it failed TRANSIENTLY —\n * offline, a timeout, a 5xx — and not because the session is over (decision 8). The\n * error is the request's own 401, `err.response?.status` and every check an app already\n * has keep working; this reads the mark the kit put on it, so the app's message can say\n * \"can't reach the server\" instead of \"not signed in\". Read it FIRST: keksdose's sync\n * chip, kastlan's handover sync and Kurvenschmiede's `apiErrorMessage` count it as\n * offline (§11.5).\n *\n * Not the refresh's own error: its config carries the refresh token in its body, into any\n * log or crash report that keeps the error.\n */\nexport function isTransientRefreshFailure(error: unknown): boolean {\n  return typeof error === \"object\" && error !== null && (error as Record<symbol, unknown>)[TRANSIENT] === true;\n}\n\n// ── The flight ────────────────────────────────────────────────────────────────\n\n/** A flight's result, as the interceptor needs it: `\"ended\"` keeps the session it ended. */\ntype Flight<R extends SessionRenewal> =\n  | { result: \"renewed\"; renewal: R }\n  | { result: \"ended\"; token: string | null }\n  | { result: \"transient\" }\n  | { result: \"changed\" };\n\n/** What one attempt came to. */\ntype Attempt<R> = { renewal: R } | \"definitive\" | \"retry\" | \"transient\";\n\n/** What {@link attachSessionRefresh} needs of a session. Kept off the public interface:\n *  only what {@link createSessionRefresh} made can be attached. */\ninterface Engine {\n  token(): string | null;\n  isDemo(): boolean;\n  isSignedOutStep(url: string): boolean;\n  join(): Promise<Flight<SessionRenewal>>;\n  end(token: string | null, demo: boolean): void;\n}\n\nconst engines = new WeakMap<SessionRefresh<SessionRenewal>, Engine>();\n\n/** The kit's own timeout, told apart from anything the app's `refresh` throws. */\nconst TIMED_OUT = Symbol(\"timed out\");\n\nfunction isOffline(): boolean {\n  return typeof navigator !== \"undefined\" && navigator.onLine === false;\n}\n\n/** A refresh's throw, classified (§11.4). The status is read where `isRateLimited` reads\n *  it — `httpStatusOf`, one probe for axios, ofetch and Node errors (DUP-11). */\nfunction classify(error: unknown): \"definitive\" | \"retry\" | \"transient\" {\n  if (error === TIMED_OUT) return \"retry\";\n  if (typeof error !== \"object\" || error === null) return \"transient\";\n  const status = httpStatusOf(error);\n  if (status === undefined) {\n    // No answer: axios marks its own errors, and one without a response never reached a\n    // server (offline, DNS, CORS, its own timeout). Anything else is a bug in `refresh`.\n    return (error as { isAxiosError?: unknown }).isAxiosError === true ? \"retry\" : \"transient\";\n  }\n  if (status === 401 || status === 403) return \"definitive\";\n  if (status === 408 || status === 429 || status >= 500) return \"retry\";\n  return \"transient\";\n}\n\nconst sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));\n\n/**\n * Make the flight: `const session = createSessionRefresh({ refresh, store, currentToken,\n * isDemo, onEnded })`, then {@link attachSessionRefresh}`(api, session)`. One per tab.\n */\nexport function createSessionRefresh<R extends SessionRenewal>(options: SessionRefreshOptions<R>): SessionRefresh<R> {\n  const { attempts = 3, backoffMs = [1000, 3000], timeoutMs = 15_000 } = options;\n  // An empty string is no token: the stamp and the flight compare tokens, and \"\" against\n  // `null` must not read as a change of session.\n  const token = () => options.currentToken() || null;\n\n  /** One call of the app's `refresh`, cut off after `timeoutMs` even if it ignores the\n   *  signal. */\n  const attempt = async (): Promise<Attempt<R>> => {\n    const controller = new AbortController();\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const timeout = new Promise<never>((_, reject) => {\n      timer = setTimeout(() => {\n        reject(TIMED_OUT);\n        controller.abort();\n      }, timeoutMs);\n    });\n    try {\n      // Through `then`, so a `refresh` that throws before it returns a promise is\n      // classified like one that rejects.\n      const renewal = await Promise.race([Promise.resolve().then(() => options.refresh(controller.signal)), timeout]);\n      return renewal ? { renewal } : \"definitive\";\n    } catch (error) {\n      return classify(error);\n    } finally {\n      clearTimeout(timer);\n    }\n  };\n\n  const run = async (): Promise<Flight<R>> => {\n    // The session this flight renews (§11.3 step 5).\n    const noted = token();\n    const changed = () => token() !== noted;\n    let outcome = await attempt();\n    for (let made = 1; outcome === \"retry\"; made += 1) {\n      // No further attempt while the browser says it is offline, nor for a session that\n      // is no longer the app's: whatever the answer, it would be \"changed\".\n      if (made >= attempts || isOffline() || changed()) break;\n      await sleep(backoffMs[made - 1] ?? backoffMs[backoffMs.length - 1] ?? 0);\n      if (isOffline() || changed()) break;\n      outcome = await attempt();\n    }\n    // A late answer never writes the old session back over a sign-out, a demo start or a\n    // password change, and the old session's refusal never signs anyone out (KS 3).\n    if (changed()) return { result: \"changed\" };\n    if (outcome === \"definitive\") return { result: \"ended\", token: noted };\n    if (outcome === \"retry\" || outcome === \"transient\") return { result: \"transient\" };\n    options.store(outcome.renewal);\n    return { result: \"renewed\", renewal: outcome.renewal };\n  };\n\n  let flight: Promise<Flight<R>> | null = null;\n  const join = () => {\n    // Cleared before any waiter resumes (`finally` settles first), so a waiter that\n    // needs another flight starts a new one.\n    flight ??= run().finally(() => {\n      flight = null;\n    });\n    return flight;\n  };\n\n  /** The session `onEnded` was last called for: once per session (KS 8). */\n  let ended: { token: string | null } | undefined;\n\n  const session: SessionRefresh<R> = {\n    async refresh() {\n      const outcome = await join();\n      return outcome.result === \"ended\" ? { result: \"ended\" } : outcome;\n    },\n  };\n  engines.set(session, {\n    token,\n    isDemo: () => options.isDemo(),\n    isSignedOutStep: options.isSignedOutStep ?? isSignedOutStep,\n    join,\n    end(endedToken, demo) {\n      if (ended && ended.token === endedToken) return;\n      ended = { token: endedToken };\n      options.onEnded({ demo });\n    },\n  });\n  return session;\n}\n\n// ── axios ─────────────────────────────────────────────────────────────────────\n\n/** The config fields the kit reads and writes — what axios's request config has. */\ninterface SessionRefreshAxiosConfig extends ServerWakeAxiosConfig {\n  /** axios's `AxiosHeaders` (written through its `set`), or a plain record. */\n  headers?: unknown;\n}\n\n/** An axios instance, structurally: {@link AxiosLikeInstance}, plus `request(config)` for\n *  the replay. `axios.create()`'s result fits it as is. `NoInfer`, because axios's\n *  `request` takes the WIDER `AxiosRequestConfig`: inferred from there, the config type\n *  no longer fits the interceptors, which hand out `InternalAxiosRequestConfig`. */\ninterface SessionRefreshInstance<\n  C extends SessionRefreshAxiosConfig,\n  R extends { config: C },\n> extends AxiosLikeInstance<C, R> {\n  request(config: NoInfer<C>): Promise<unknown>;\n}\n\n/** The keys the kit keeps on a request's config, as `attachServerWake` keeps\n *  `_serverWake`: never a header. Plain string keys holding primitives, because axios\n *  copies the config on a replay (`mergeConfig`) and a symbol key would be dropped. */\nconst STAMP = \"_sessionStamp\";\nconst REFRESHED = \"_sessionRefreshed\";\nconst RESTAMPED = \"_sessionRestamped\";\ntype Marked = {\n  /** `currentToken()` when the request went out. */\n  [STAMP]?: string | null;\n  /** Replayed after a refresh: a 401 now is definitive (decision 3). */\n  [REFRESHED]?: boolean;\n  /** Replayed because it was sent with an older token: once for this reason. */\n  [RESTAMPED]?: boolean;\n};\n\n/** `Authorization: Bearer <token>` on a config about to be replayed. The app's own\n *  request interceptor runs again on the replay and writes the same, from the same\n *  source. */\nfunction authorize(config: SessionRefreshAxiosConfig, token: string): void {\n  const value = `Bearer ${token}`;\n  const headers = config.headers;\n  if (typeof headers !== \"object\" || headers === null) {\n    config.headers = { Authorization: value };\n  } else if (typeof (headers as { set?: unknown }).set === \"function\") {\n    (headers as { set(name: string, value: string): unknown }).set(\"Authorization\", value);\n  } else {\n    (headers as Record<string, unknown>).Authorization = value;\n  }\n}\n\n/**\n * Hook a session to an axios instance: `attachSessionRefresh(api, session)`. Adds a\n * request interceptor (the stamp) and a response interceptor (the 401), and returns a\n * function that ejects both.\n *\n * Attach it LAST (§11.3, kk 4): after `attachServerWake`, which asks to be first, and\n * after the app's own response interceptors (logging, a watchdog of its own). axios runs\n * response interceptors in the order they were added, and each of those must see the 401\n * settle before the refresh is awaited. The request side's order does not matter.\n *\n * On a 401, in this order (§11.3):\n *\n *  1. a signed-out step → reject, nothing else;\n *  2. sent with an older token → replayed with the app's token now, with no refresh, once\n *     for this reason; with no token now, reject;\n *  3. a demo → `onEnded({ demo: true })`, reject;\n *  4. already replayed after a refresh → definitive: `onEnded({ demo: false })`, reject;\n *  5. otherwise it joins the flight, or starts it. A renewal replays it once with the\n *     renewal's token (`replay: false`: rejects, unmarked); definitive ends the session;\n *     transient rejects, marked; a session that changed meanwhile sends it through step\n *     2 again.\n *\n * Every rejection is the request's OWN error. Any other status passes through untouched.\n */\nexport function attachSessionRefresh<C extends SessionRefreshAxiosConfig, R extends { config: C }>(\n  instance: SessionRefreshInstance<C, R>,\n  session: SessionRefresh<SessionRenewal>,\n): () => void {\n  const engine = engines.get(session);\n  if (!engine) throw new TypeError(\"attachSessionRefresh takes the session createSessionRefresh made\");\n\n  const onUnauthorized = async (error: object, config: C & Marked): Promise<unknown> => {\n    if (engine.isSignedOutStep(config.url ?? \"\")) throw error;\n    // A config the kit never stamped (sent before it was attached) counts as current.\n    const stamp = config[STAMP] === undefined ? engine.token() : config[STAMP];\n    const replay = (token: string) => {\n      authorize(config, token);\n      return instance.request(config);\n    };\n    for (;;) {\n      const now = engine.token();\n      // 2. The session it was sent for is gone, and whatever ended it has already done\n      // what follows (ka 3, KS 3, KS 4).\n      if (stamp !== now) {\n        if (now === null || config[RESTAMPED]) throw error;\n        config[RESTAMPED] = true;\n        return replay(now);\n      }\n      // 3. A demo has nothing to refresh: its token lives as long as its account\n      // (landing-demo §5.5).\n      if (engine.isDemo()) {\n        engine.end(now, true);\n        throw error;\n      }\n      // 4. A replay for an older token doesn't count here: the app's current token may\n      // simply have expired too, which needs a refresh, not a sign-out.\n      if (config[REFRESHED]) {\n        engine.end(now, false);\n        throw error;\n      }\n      // 5. The flight.\n      const flight = await engine.join();\n      if (flight.result === \"changed\") continue;\n      if (flight.result === \"ended\") {\n        engine.end(flight.token, false);\n        throw error;\n      }\n      if (flight.result === \"transient\") {\n        (error as Record<symbol, unknown>)[TRANSIENT] = true;\n        throw error;\n      }\n      if (flight.renewal.replay === false) throw error;\n      config[REFRESHED] = true;\n      return replay(flight.renewal.token);\n    }\n  };\n\n  const request = instance.interceptors.request.use(\n    (config) => {\n      (config as C & Marked)[STAMP] = engine.token();\n      return config;\n    },\n    (error) => Promise.reject(error),\n  );\n  const response = instance.interceptors.response.use(\n    (res) => res,\n    (error) => {\n      const failed = error as { config?: C & Marked; response?: { status?: unknown } } | null;\n      if (failed?.response?.status !== 401 || !failed.config) return Promise.reject(error);\n      return onUnauthorized(failed, failed.config);\n    },\n  );\n  return () => {\n    instance.interceptors.request.eject(request);\n    instance.interceptors.response.eject(response);\n  };\n}\n"],"mappings":";AAsCA,SAAS,oBAAoB;AAgG7B,MAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAaO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,OAAO,IAAI,QAAQ,YAAY,EAAE,EAAE,QAAQ,mCAAmC,EAAE;AACtF,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,QAAM,KAAK,SAAS,QAAQ,MAAM;AAClC,MAAI,KAAK,EAAG,QAAO;AACnB,QAAM,OAAO,SAAS,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAC5C,SAAO,iBAAiB,KAAK,CAAC,UAAU,SAAS,SAAS,KAAK,WAAW,GAAG,KAAK,GAAG,CAAC;AACxF;AAOA,MAAM,YAAY,uBAAO,IAAI,yCAAyC;AAc/D,SAAS,0BAA0B,OAAyB;AACjE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,MAAkC,SAAS,MAAM;AAC1G;AAwBA,MAAM,UAAU,oBAAI,QAAgD;AAGpE,MAAM,YAAY,uBAAO,WAAW;AAEpC,SAAS,YAAqB;AAC5B,SAAO,OAAO,cAAc,eAAe,UAAU,WAAW;AAClE;AAIA,SAAS,SAAS,OAAsD;AACtE,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,WAAW,QAAW;AAGxB,WAAQ,MAAqC,iBAAiB,OAAO,UAAU;AAAA,EACjF;AACA,MAAI,WAAW,OAAO,WAAW,IAAK,QAAO;AAC7C,MAAI,WAAW,OAAO,WAAW,OAAO,UAAU,IAAK,QAAO;AAC9D,SAAO;AACT;AAEA,MAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAM7E,SAAS,qBAA+C,SAAsD;AACnH,QAAM,EAAE,WAAW,GAAG,YAAY,CAAC,KAAM,GAAI,GAAG,YAAY,KAAO,IAAI;AAGvE,QAAM,QAAQ,MAAM,QAAQ,aAAa,KAAK;AAI9C,QAAM,UAAU,YAAiC;AAC/C,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI;AACJ,UAAM,UAAU,IAAI,QAAe,CAAC,GAAG,WAAW;AAChD,cAAQ,WAAW,MAAM;AACvB,eAAO,SAAS;AAChB,mBAAW,MAAM;AAAA,MACnB,GAAG,SAAS;AAAA,IACd,CAAC;AACD,QAAI;AAGF,YAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,QAAQ,WAAW,MAAM,CAAC,GAAG,OAAO,CAAC;AAC9G,aAAO,UAAU,EAAE,QAAQ,IAAI;AAAA,IACjC,SAAS,OAAO;AACd,aAAO,SAAS,KAAK;AAAA,IACvB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,MAAM,YAAgC;AAE1C,UAAM,QAAQ,MAAM;AACpB,UAAM,UAAU,MAAM,MAAM,MAAM;AAClC,QAAI,UAAU,MAAM,QAAQ;AAC5B,aAAS,OAAO,GAAG,YAAY,SAAS,QAAQ,GAAG;AAGjD,UAAI,QAAQ,YAAY,UAAU,KAAK,QAAQ,EAAG;AAClD,YAAM,MAAM,UAAU,OAAO,CAAC,KAAK,UAAU,UAAU,SAAS,CAAC,KAAK,CAAC;AACvE,UAAI,UAAU,KAAK,QAAQ,EAAG;AAC9B,gBAAU,MAAM,QAAQ;AAAA,IAC1B;AAGA,QAAI,QAAQ,EAAG,QAAO,EAAE,QAAQ,UAAU;AAC1C,QAAI,YAAY,aAAc,QAAO,EAAE,QAAQ,SAAS,OAAO,MAAM;AACrE,QAAI,YAAY,WAAW,YAAY,YAAa,QAAO,EAAE,QAAQ,YAAY;AACjF,YAAQ,MAAM,QAAQ,OAAO;AAC7B,WAAO,EAAE,QAAQ,WAAW,SAAS,QAAQ,QAAQ;AAAA,EACvD;AAEA,MAAI,SAAoC;AACxC,QAAM,OAAO,MAAM;AAGjB,eAAW,IAAI,EAAE,QAAQ,MAAM;AAC7B,eAAS;AAAA,IACX,CAAC;AACD,WAAO;AAAA,EACT;AAGA,MAAI;AAEJ,QAAM,UAA6B;AAAA,IACjC,MAAM,UAAU;AACd,YAAM,UAAU,MAAM,KAAK;AAC3B,aAAO,QAAQ,WAAW,UAAU,EAAE,QAAQ,QAAQ,IAAI;AAAA,IAC5D;AAAA,EACF;AACA,UAAQ,IAAI,SAAS;AAAA,IACnB;AAAA,IACA,QAAQ,MAAM,QAAQ,OAAO;AAAA,IAC7B,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C;AAAA,IACA,IAAI,YAAY,MAAM;AACpB,UAAI,SAAS,MAAM,UAAU,WAAY;AACzC,cAAQ,EAAE,OAAO,WAAW;AAC5B,cAAQ,QAAQ,EAAE,KAAK,CAAC;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAwBA,MAAM,QAAQ;AACd,MAAM,YAAY;AAClB,MAAM,YAAY;AAalB,SAAS,UAAU,QAAmC,OAAqB;AACzE,QAAM,QAAQ,UAAU,KAAK;AAC7B,QAAM,UAAU,OAAO;AACvB,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,UAAU,EAAE,eAAe,MAAM;AAAA,EAC1C,WAAW,OAAQ,QAA8B,QAAQ,YAAY;AACnE,IAAC,QAA0D,IAAI,iBAAiB,KAAK;AAAA,EACvF,OAAO;AACL,IAAC,QAAoC,gBAAgB;AAAA,EACvD;AACF;AA0BO,SAAS,qBACd,UACA,SACY;AACZ,QAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,MAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,kEAAkE;AAEnG,QAAM,iBAAiB,OAAO,OAAe,WAAyC;AACpF,QAAI,OAAO,gBAAgB,OAAO,OAAO,EAAE,EAAG,OAAM;AAEpD,UAAM,QAAQ,OAAO,KAAK,MAAM,SAAY,OAAO,MAAM,IAAI,OAAO,KAAK;AACzE,UAAM,SAAS,CAAC,UAAkB;AAChC,gBAAU,QAAQ,KAAK;AACvB,aAAO,SAAS,QAAQ,MAAM;AAAA,IAChC;AACA,eAAS;AACP,YAAM,MAAM,OAAO,MAAM;AAGzB,UAAI,UAAU,KAAK;AACjB,YAAI,QAAQ,QAAQ,OAAO,SAAS,EAAG,OAAM;AAC7C,eAAO,SAAS,IAAI;AACpB,eAAO,OAAO,GAAG;AAAA,MACnB;AAGA,UAAI,OAAO,OAAO,GAAG;AACnB,eAAO,IAAI,KAAK,IAAI;AACpB,cAAM;AAAA,MACR;AAGA,UAAI,OAAO,SAAS,GAAG;AACrB,eAAO,IAAI,KAAK,KAAK;AACrB,cAAM;AAAA,MACR;AAEA,YAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAI,OAAO,WAAW,UAAW;AACjC,UAAI,OAAO,WAAW,SAAS;AAC7B,eAAO,IAAI,OAAO,OAAO,KAAK;AAC9B,cAAM;AAAA,MACR;AACA,UAAI,OAAO,WAAW,aAAa;AACjC,QAAC,MAAkC,SAAS,IAAI;AAChD,cAAM;AAAA,MACR;AACA,UAAI,OAAO,QAAQ,WAAW,MAAO,OAAM;AAC3C,aAAO,SAAS,IAAI;AACpB,aAAO,OAAO,OAAO,QAAQ,KAAK;AAAA,IACpC;AAAA,EACF;AAEA,QAAM,UAAU,SAAS,aAAa,QAAQ;AAAA,IAC5C,CAAC,WAAW;AACV,MAAC,OAAsB,KAAK,IAAI,OAAO,MAAM;AAC7C,aAAO;AAAA,IACT;AAAA,IACA,CAAC,UAAU,QAAQ,OAAO,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,SAAS,aAAa,SAAS;AAAA,IAC9C,CAAC,QAAQ;AAAA,IACT,CAAC,UAAU;AACT,YAAM,SAAS;AACf,UAAI,QAAQ,UAAU,WAAW,OAAO,CAAC,OAAO,OAAQ,QAAO,QAAQ,OAAO,KAAK;AACnF,aAAO,eAAe,QAAQ,OAAO,MAAM;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACX,aAAS,aAAa,QAAQ,MAAM,OAAO;AAC3C,aAAS,aAAa,SAAS,MAAM,QAAQ;AAAA,EAC/C;AACF;","names":[]}
+{"version":3,"sources":["../../src/lib/session-refresh.ts"],"sourcesContent":["/**\n * Renewing a session when the access token runs out: the client half of\n * docs/auth-harmonization.md §11 (round 0.34 C7, KS U6), lifted from keksdose's\n * `refreshOnce` (Kurvenschmiede's is the same, line for line) and corrected where the\n * three apps' reviews found it wrong. It ends kastlan's sign-out over a network blip (B3).\n *\n * THE KIT OWNS THE RULE, THE APP OWNS THE CALL (§11.2, decision 1). The kit decides when\n * to refresh, who waits, what a failure means, when the session is over and whether a\n * renewal may still be stored. The app keeps its endpoint, its token storage, its\n * sign-out and where it navigates, and hands them in as {@link SessionRefreshOptions}.\n *\n *  - **One flight per tab** (decision 2): every 401 that arrives while a refresh runs\n *    waits for it, and so does `session.refresh()` (kastlan's boot).\n *  - **Definitive** (decision 3): the device holds no refresh token (`refresh` resolves\n *    `null`), the refresh answers 401 or 403, or the request replayed with the fresh\n *    token gets a 401 again. Only then does the app sign out (`onEnded`), and only while\n *    that session is still the app's.\n *  - **Transient** (decision 4): everything else. The session stays: nothing is signed\n *    out, stored or redirected, and the kit shows nothing. The request rejects with its\n *    OWN 401, marked ({@link isTransientRefreshFailure}), so the app's message can say\n *    \"can't reach the server\" instead of \"not signed in\".\n *  - **Retries only where waiting helps** (decision 5, KS 7): no answer, the kit's own\n *    timeout, 408, 429 and 5xx get up to three attempts, 1 s and then 3 s apart, each cut\n *    off after 15 s; none while the browser reports itself offline. Any other answer, and\n *    anything that is not an HTTP error, ends the flight at the first attempt.\n *  - **A stale session is never written back** (§11.7, ka 3, KS 3, KS 4): every request\n *    is stamped with `currentToken()` when it goes out, and every flight notes it when it\n *    starts. A 401 to a request sent with an older token replays it with the app's token\n *    now, without a refresh; a flight whose session changed while it ran stores nothing\n *    and ends nothing. The access token is the session's identity because every change\n *    the apps make replaces it — a refresh, another tab, a company switch, a password\n *    change, a sign-in, a demo start, a sign-out.\n *\n * Framework-free like `server-wake.ts`: {@link attachSessionRefresh} takes the app's\n * axios instance as an ARGUMENT, typed structurally, so the kit never imports axios.\n */\n\nimport type { AxiosLikeInstance, ServerWakeAxiosConfig } from \"./server-wake\";\nimport { httpStatusOf } from \"./http-status\";\n\n/** What the app's `refresh` resolves: the new access token, plus whatever its `store`\n *  needs (its refresh token, the user). */\nexport interface SessionRenewal {\n  /** The new access token; the waiting requests are replayed with it. */\n  token: string;\n  /**\n   * `false`: store the renewal, but replay nothing — each waiting request rejects with\n   * its 401, unmarked. kastlan's refresh can land in another company (§11.5, ka 3): a\n   * waiting write, such as the handover's `POST /sync`, must not be replayed into it.\n   */\n  replay?: false;\n}\n\n/** What the app hands {@link createSessionRefresh} (§11.4). */\nexport interface SessionRefreshOptions<R extends SessionRenewal> {\n  /**\n   * The app's own `POST /auth/refresh`, on a BARE client — never the instance the kit is\n   * attached to, so the refresh cannot re-enter the interceptor. It **writes nothing**:\n   * the kit hands the answer to `store`, and only while the session is unchanged.\n   *\n   * Resolves the answer as a renewal, or `null` when the device holds no refresh token.\n   * Throws on failure, and the kit classifies the throw: a 401 or 403 is definitive; no\n   * answer (an axios error without a `response`), the kit's own timeout, 408, 429 and\n   * 5xx are transient and retried; any other answer, and anything that is not an HTTP\n   * error (a bug in this function), is transient and not retried. The status is read\n   * from `err.response.status` (axios), `err.status` or `err.statusCode`.\n   *\n   * `signal` aborts when the attempt runs past `timeoutMs`; pass it to the request.\n   */\n  refresh: (signal: AbortSignal) => Promise<R | null>;\n  /** Writes the renewal: the tokens and the user (a missing refresh token keeps the\n   *  stored one). Called only while the session the flight renews is still the app's,\n   *  and before the waiting requests are replayed — so it writes the token SYNCHRONOUSLY\n   *  where `currentToken` reads it: the replay goes through the app's own request\n   *  interceptor again, and is stamped then. A throw is the app's bug: the waiting\n   *  requests and `session.refresh()` reject with it. */\n  store: (renewal: R) => void;\n  /** The access token the app sends NOW, read where its request interceptor reads it;\n   *  `null` when there is none. */\n  currentToken: () => string | null;\n  /** Whether the session is a demo: a demo's 401 ends it, with no refresh tried\n   *  (landing-demo §5.5). */\n  isDemo: () => boolean;\n  /**\n   * The session is over: drop the tokens and the user, then navigate — `/demo/ended` for\n   * a demo, else the sign-in with the page it came from (auth §5.2). Called once per\n   * session, however many requests found out (KS 8), and never by `session.refresh()`.\n   */\n  onEnded: (ended: { demo: boolean }) => void;\n  /** Whether a URL is a signed-out step, whose 401 judges the form and never the\n   *  session. Replaces the default list, {@link isSignedOutStep}. */\n  isSignedOutStep?: (url: string) => boolean;\n  /** Attempts for a refresh that got no answer, timed out, or got a 408, 429 or 5xx.\n   *  Default 3. */\n  attempts?: number;\n  /** The waits before the second and later attempts; the last one repeats. Default\n   *  `[1000, 3000]`. */\n  backoffMs?: readonly number[];\n  /** Each attempt is cut off after this, and its `signal` aborted. Default 15 000. */\n  timeoutMs?: number;\n}\n\n/** What `session.refresh()` resolves (§11.4), by `result`:\n *\n * | `result` | When | What the kit has done |\n * |---|---|---|\n * | `\"renewed\"` | a renewal while the session was unchanged | `store(renewal)` |\n * | `\"ended\"` | definitive | nothing; `onEnded` only for requests that waited on the same flight |\n * | `\"transient\"` | transient | nothing |\n * | `\"changed\"` | the session changed while it ran | nothing; read the app's own state |\n */\nexport type SessionRefreshOutcome<R extends SessionRenewal = SessionRenewal> =\n  { result: \"renewed\"; renewal: R } | { result: \"ended\" } | { result: \"transient\" } | { result: \"changed\" };\n\n/** The flight {@link createSessionRefresh} makes; {@link attachSessionRefresh} hooks it\n *  to an axios instance. */\nexport interface SessionRefresh<R extends SessionRenewal = SessionRenewal> {\n  /**\n   * The same flight, for a caller outside the interceptor — kastlan's boot. Joins a\n   * running flight, or starts one. Never calls `onEnded`: the caller decides what an\n   * `\"ended\"` means for it.\n   */\n  refresh(): Promise<SessionRefreshOutcome<R>>;\n}\n\n// ── The signed-out steps ──────────────────────────────────────────────────────\n\n/**\n * Every `/auth/` call made without a session, the union of the three apps' lists\n * (§11.3): signing in (with its `2fa` and `set-password` steps, and a passkey's), up,\n * into a demo, a password reset, the verification link, the invitation check, the email\n * change's confirmation link, and the refresh itself. NOT `resend-verification` (KS 1):\n * in keksdose and Kurvenschmiede it needs a session; in kastlan it never answers 401.\n */\nconst SIGNED_OUT_STEPS = [\n  \"login\",\n  \"passkey/login\",\n  \"register\",\n  \"demo-session\",\n  \"password-reset\",\n  \"verify-email\",\n  \"invitations/check\",\n  \"me/email/confirm\",\n  \"refresh\",\n] as const;\n\n/**\n * Whether a request's URL is a signed-out step — the kit's default list (§11.3), exported\n * for an app's tests and for an app's own `isSignedOutStep` that adds to it.\n *\n * **Whole steps only** (KS 2): the part of the path after its `auth/` segment, without\n * the query string, is the entry itself or starts with the entry and a `/`. So\n * `login/2fa` is `login`'s, but `register` never catches `/auth/passkey/register/begin`\n * (adding a passkey, which needs a session), `invitations/check` never\n * `/auth/invitations/accept`, and `me/email/confirm` never `/auth/me/email`. Relative and\n * absolute URLs alike; a URL with no `auth` segment is no step.\n */\nexport function isSignedOutStep(url: string): boolean {\n  const path = url.replace(/[?#].*$/s, \"\").replace(/^([a-z][a-z\\d+.-]*:)?\\/\\/[^/]*/i, \"\");\n  const segments = path.split(\"/\");\n  const at = segments.indexOf(\"auth\");\n  if (at < 0) return false;\n  const step = segments.slice(at + 1).join(\"/\");\n  return SIGNED_OUT_STEPS.some((entry) => step === entry || step.startsWith(`${entry}/`));\n}\n\n// ── The marker ────────────────────────────────────────────────────────────────\n\n/** On the request's own axios error, after a transient failure (decision 8). A\n *  `Symbol.for` key: shared by every copy of the kit in a page, and left out of\n *  `JSON.stringify`, so a log that serialises the error doesn't print it (kk 2). */\nconst TRANSIENT = Symbol.for(\"@eifi1/ui-kit:session-refresh.transient\");\n\n/**\n * Whether a request was refused because the refresh behind it failed TRANSIENTLY —\n * offline, a timeout, a 5xx — and not because the session is over (decision 8). The\n * error is the request's own 401, `err.response?.status` and every check an app already\n * has keep working; this reads the mark the kit put on it, so the app's message can say\n * \"can't reach the server\" instead of \"not signed in\". Read it FIRST: keksdose's sync\n * chip, kastlan's handover sync and Kurvenschmiede's `apiErrorMessage` count it as\n * offline (§11.5).\n *\n * Not the refresh's own error: its config carries the refresh token in its body, into any\n * log or crash report that keeps the error.\n */\nexport function isTransientRefreshFailure(error: unknown): boolean {\n  return typeof error === \"object\" && error !== null && (error as Record<symbol, unknown>)[TRANSIENT] === true;\n}\n\n// ── The flight ────────────────────────────────────────────────────────────────\n\n/** A flight's result, as the interceptor needs it: `\"ended\"` keeps the session it ended. */\ntype Flight<R extends SessionRenewal> =\n  | { result: \"renewed\"; renewal: R }\n  | { result: \"ended\"; token: string | null }\n  | { result: \"transient\" }\n  | { result: \"changed\" };\n\n/** What one attempt came to. */\ntype Attempt<R> = { renewal: R } | \"definitive\" | \"retry\" | \"transient\";\n\n/** What {@link attachSessionRefresh} needs of a session. Kept off the public interface:\n *  only what {@link createSessionRefresh} made can be attached. */\ninterface Engine {\n  token(): string | null;\n  isDemo(): boolean;\n  isSignedOutStep(url: string): boolean;\n  join(): Promise<Flight<SessionRenewal>>;\n  end(token: string | null, demo: boolean): void;\n}\n\nconst engines = new WeakMap<SessionRefresh<SessionRenewal>, Engine>();\n\n/** The kit's own timeout, told apart from anything the app's `refresh` throws. */\nconst TIMED_OUT = Symbol(\"timed out\");\n\nfunction isOffline(): boolean {\n  return typeof navigator !== \"undefined\" && navigator.onLine === false;\n}\n\n/** A refresh's throw, classified (§11.4). The status is read where `isRateLimited` reads\n *  it — `httpStatusOf`, one probe for axios, ofetch and Node errors (DUP-11). */\nfunction classify(error: unknown): \"definitive\" | \"retry\" | \"transient\" {\n  if (error === TIMED_OUT) return \"retry\";\n  if (typeof error !== \"object\" || error === null) return \"transient\";\n  const status = httpStatusOf(error);\n  if (status === undefined) {\n    // No answer: axios marks its own errors, and one without a response never reached a\n    // server (offline, DNS, CORS, its own timeout). Anything else is a bug in `refresh`.\n    return (error as { isAxiosError?: unknown }).isAxiosError === true ? \"retry\" : \"transient\";\n  }\n  if (status === 401 || status === 403) return \"definitive\";\n  if (status === 408 || status === 429 || status >= 500) return \"retry\";\n  return \"transient\";\n}\n\nconst sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));\n\n/**\n * Make the flight: `const session = createSessionRefresh({ refresh, store, currentToken,\n * isDemo, onEnded })`, then {@link attachSessionRefresh}`(api, session)`. One per tab.\n */\nexport function createSessionRefresh<R extends SessionRenewal>(options: SessionRefreshOptions<R>): SessionRefresh<R> {\n  const { attempts = 3, backoffMs = [1000, 3000], timeoutMs = 15_000 } = options;\n  // An empty string is no token: the stamp and the flight compare tokens, and \"\" against\n  // `null` must not read as a change of session.\n  const token = () => options.currentToken() || null;\n\n  /** One call of the app's `refresh`, cut off after `timeoutMs` even if it ignores the\n   *  signal. */\n  const attempt = async (): Promise<Attempt<R>> => {\n    const controller = new AbortController();\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const timeout = new Promise<never>((_, reject) => {\n      timer = setTimeout(() => {\n        reject(TIMED_OUT);\n        controller.abort();\n      }, timeoutMs);\n    });\n    try {\n      // Through `then`, so a `refresh` that throws before it returns a promise is\n      // classified like one that rejects.\n      const renewal = await Promise.race([Promise.resolve().then(() => options.refresh(controller.signal)), timeout]);\n      return renewal ? { renewal } : \"definitive\";\n    } catch (error) {\n      return classify(error);\n    } finally {\n      clearTimeout(timer);\n    }\n  };\n\n  const run = async (): Promise<Flight<R>> => {\n    // The session this flight renews (§11.3 step 5).\n    const noted = token();\n    const changed = () => token() !== noted;\n    let outcome = await attempt();\n    for (let made = 1; outcome === \"retry\"; made += 1) {\n      // No further attempt while the browser says it is offline, nor for a session that\n      // is no longer the app's: whatever the answer, it would be \"changed\".\n      if (made >= attempts || isOffline() || changed()) break;\n      await sleep(backoffMs[made - 1] ?? backoffMs[backoffMs.length - 1] ?? 0);\n      if (isOffline() || changed()) break;\n      outcome = await attempt();\n    }\n    // A late answer never writes the old session back over a sign-out, a demo start or a\n    // password change, and the old session's refusal never signs anyone out (KS 3).\n    if (changed()) return { result: \"changed\" };\n    if (outcome === \"definitive\") return { result: \"ended\", token: noted };\n    if (outcome === \"retry\" || outcome === \"transient\") return { result: \"transient\" };\n    options.store(outcome.renewal);\n    return { result: \"renewed\", renewal: outcome.renewal };\n  };\n\n  let flight: Promise<Flight<R>> | null = null;\n  const join = () => {\n    // Cleared before any waiter resumes (`finally` settles first), so a waiter that\n    // needs another flight starts a new one.\n    flight ??= run().finally(() => {\n      flight = null;\n    });\n    return flight;\n  };\n\n  /** The session `onEnded` was last called for: once per session (KS 8). */\n  let ended: { token: string | null } | undefined;\n\n  const session: SessionRefresh<R> = {\n    async refresh() {\n      const outcome = await join();\n      return outcome.result === \"ended\" ? { result: \"ended\" } : outcome;\n    },\n  };\n  engines.set(session, {\n    token,\n    isDemo: () => options.isDemo(),\n    isSignedOutStep: options.isSignedOutStep ?? isSignedOutStep,\n    join,\n    end(endedToken, demo) {\n      if (ended && ended.token === endedToken) return;\n      ended = { token: endedToken };\n      options.onEnded({ demo });\n    },\n  });\n  return session;\n}\n\n// ── axios ─────────────────────────────────────────────────────────────────────\n\n/** The config fields the kit reads and writes — what axios's request config has. */\ninterface SessionRefreshAxiosConfig extends ServerWakeAxiosConfig {\n  /** axios's `AxiosHeaders` (written through its `set`), or a plain record. */\n  headers?: unknown;\n}\n\n/** An axios instance, structurally: {@link AxiosLikeInstance}, plus `request(config)` for\n *  the replay. `axios.create()`'s result fits it as is. `NoInfer`, because axios's\n *  `request` takes the WIDER `AxiosRequestConfig`: inferred from there, the config type\n *  no longer fits the interceptors, which hand out `InternalAxiosRequestConfig`. */\ninterface SessionRefreshInstance<\n  C extends SessionRefreshAxiosConfig,\n  R extends { config: C },\n> extends AxiosLikeInstance<C, R> {\n  request(config: NoInfer<C>): Promise<unknown>;\n}\n\n/** The keys the kit keeps on a request's config, as `attachServerWake` keeps\n *  `_serverWake`: never a header. Plain string keys holding primitives, because axios\n *  copies the config on a replay (`mergeConfig`) and a symbol key would be dropped. */\nconst STAMP = \"_sessionStamp\";\nconst REFRESHED = \"_sessionRefreshed\";\nconst RESTAMPED = \"_sessionRestamped\";\ntype Marked = {\n  /** `currentToken()` when the request went out. */\n  [STAMP]?: string | null;\n  /** Replayed after a refresh: a 401 now is definitive (decision 3). */\n  [REFRESHED]?: boolean;\n  /** Replayed because it was sent with an older token: once for this reason. */\n  [RESTAMPED]?: boolean;\n};\n\n/** `Authorization: Bearer <token>` on a config about to be replayed. The app's own\n *  request interceptor runs again on the replay and writes the same, from the same\n *  source. */\nfunction authorize(config: SessionRefreshAxiosConfig, token: string): void {\n  const value = `Bearer ${token}`;\n  const headers = config.headers;\n  if (typeof headers !== \"object\" || headers === null) {\n    config.headers = { Authorization: value };\n  } else if (typeof (headers as { set?: unknown }).set === \"function\") {\n    (headers as { set(name: string, value: string): unknown }).set(\"Authorization\", value);\n  } else {\n    (headers as Record<string, unknown>).Authorization = value;\n  }\n}\n\n/**\n * Hook a session to an axios instance: `attachSessionRefresh(api, session)`. Adds a\n * request interceptor (the stamp) and a response interceptor (the 401), and returns a\n * function that ejects both.\n *\n * Attach it LAST (§11.3, kk 4): after `attachServerWake`, which asks to be first, and\n * after the app's own response interceptors (logging, a watchdog of its own). axios runs\n * response interceptors in the order they were added, and each of those must see the 401\n * settle before the refresh is awaited. The request side's order does not matter.\n *\n * On a 401, in this order (§11.3):\n *\n *  1. a signed-out step → reject, nothing else;\n *  2. sent with an older token → replayed with the app's token now, with no refresh, once\n *     for this reason; with no token now, reject;\n *  3. a demo → `onEnded({ demo: true })`, reject;\n *  4. already replayed after a refresh → definitive: `onEnded({ demo: false })`, reject;\n *  5. otherwise it joins the flight, or starts it. A renewal replays it once with the\n *     renewal's token (`replay: false`: rejects, unmarked); definitive ends the session;\n *     transient rejects, marked; a session that changed meanwhile sends it through step\n *     2 again.\n *\n * Every rejection is the request's OWN error. Any other status passes through untouched.\n */\nexport function attachSessionRefresh<C extends SessionRefreshAxiosConfig, R extends { config: C }>(\n  instance: SessionRefreshInstance<C, R>,\n  session: SessionRefresh<SessionRenewal>,\n): () => void {\n  const engine = engines.get(session);\n  if (!engine) throw new TypeError(\"attachSessionRefresh takes the session createSessionRefresh made\");\n\n  const onUnauthorized = async (error: object, config: C & Marked): Promise<unknown> => {\n    if (engine.isSignedOutStep(config.url ?? \"\")) throw error;\n    // A config the kit never stamped (sent before it was attached) counts as current.\n    const stamp = config[STAMP] === undefined ? engine.token() : config[STAMP];\n    const replay = (token: string) => {\n      authorize(config, token);\n      return instance.request(config);\n    };\n    for (;;) {\n      const now = engine.token();\n      // 2. The session it was sent for is gone, and whatever ended it has already done\n      // what follows (ka 3, KS 3, KS 4).\n      if (stamp !== now) {\n        if (now === null || config[RESTAMPED]) throw error;\n        config[RESTAMPED] = true;\n        return replay(now);\n      }\n      // 3. A demo has nothing to refresh: its token lives as long as its account\n      // (landing-demo §5.5).\n      if (engine.isDemo()) {\n        engine.end(now, true);\n        throw error;\n      }\n      // 4. A replay for an older token doesn't count here: the app's current token may\n      // simply have expired too, which needs a refresh, not a sign-out.\n      if (config[REFRESHED]) {\n        engine.end(now, false);\n        throw error;\n      }\n      // 5. The flight.\n      const flight = await engine.join();\n      if (flight.result === \"changed\") continue;\n      if (flight.result === \"ended\") {\n        engine.end(flight.token, false);\n        throw error;\n      }\n      if (flight.result === \"transient\") {\n        (error as Record<symbol, unknown>)[TRANSIENT] = true;\n        throw error;\n      }\n      if (flight.renewal.replay === false) throw error;\n      config[REFRESHED] = true;\n      return replay(flight.renewal.token);\n    }\n  };\n\n  const request = instance.interceptors.request.use(\n    (config) => {\n      (config as C & Marked)[STAMP] = engine.token();\n      return config;\n    },\n    (error) => Promise.reject(error),\n  );\n  const response = instance.interceptors.response.use(\n    (res) => res,\n    (error) => {\n      const failed = error as { config?: C & Marked; response?: { status?: unknown } } | null;\n      if (failed?.response?.status !== 401 || !failed.config) return Promise.reject(error);\n      return onUnauthorized(failed, failed.config);\n    },\n  );\n  return () => {\n    instance.interceptors.request.eject(request);\n    instance.interceptors.response.eject(response);\n  };\n}\n"],"mappings":";AAsCA,SAAS,oBAAoB;AAgG7B,MAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAaO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,OAAO,IAAI,QAAQ,YAAY,EAAE,EAAE,QAAQ,mCAAmC,EAAE;AACtF,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,QAAM,KAAK,SAAS,QAAQ,MAAM;AAClC,MAAI,KAAK,EAAG,QAAO;AACnB,QAAM,OAAO,SAAS,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAC5C,SAAO,iBAAiB,KAAK,CAAC,UAAU,SAAS,SAAS,KAAK,WAAW,GAAG,KAAK,GAAG,CAAC;AACxF;AAOA,MAAM,YAAY,uBAAO,IAAI,yCAAyC;AAc/D,SAAS,0BAA0B,OAAyB;AACjE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,MAAkC,SAAS,MAAM;AAC1G;AAwBA,MAAM,UAAU,oBAAI,QAAgD;AAGpE,MAAM,YAAY,uBAAO,WAAW;AAEpC,SAAS,YAAqB;AAC5B,SAAO,OAAO,cAAc,eAAe,UAAU,WAAW;AAClE;AAIA,SAAS,SAAS,OAAsD;AACtE,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,WAAW,QAAW;AAGxB,WAAQ,MAAqC,iBAAiB,OAAO,UAAU;AAAA,EACjF;AACA,MAAI,WAAW,OAAO,WAAW,IAAK,QAAO;AAC7C,MAAI,WAAW,OAAO,WAAW,OAAO,UAAU,IAAK,QAAO;AAC9D,SAAO;AACT;AAEA,MAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAM7E,SAAS,qBAA+C,SAAsD;AACnH,QAAM,EAAE,WAAW,GAAG,YAAY,CAAC,KAAM,GAAI,GAAG,YAAY,KAAO,IAAI;AAGvE,QAAM,QAAQ,MAAM,QAAQ,aAAa,KAAK;AAI9C,QAAM,UAAU,YAAiC;AAC/C,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI;AACJ,UAAM,UAAU,IAAI,QAAe,CAAC,GAAG,WAAW;AAChD,cAAQ,WAAW,MAAM;AACvB,eAAO,SAAS;AAChB,mBAAW,MAAM;AAAA,MACnB,GAAG,SAAS;AAAA,IACd,CAAC;AACD,QAAI;AAGF,YAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,QAAQ,WAAW,MAAM,CAAC,GAAG,OAAO,CAAC;AAC9G,aAAO,UAAU,EAAE,QAAQ,IAAI;AAAA,IACjC,SAAS,OAAO;AACd,aAAO,SAAS,KAAK;AAAA,IACvB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,MAAM,YAAgC;AAE1C,UAAM,QAAQ,MAAM;AACpB,UAAM,UAAU,MAAM,MAAM,MAAM;AAClC,QAAI,UAAU,MAAM,QAAQ;AAC5B,aAAS,OAAO,GAAG,YAAY,SAAS,QAAQ,GAAG;AAGjD,UAAI,QAAQ,YAAY,UAAU,KAAK,QAAQ,EAAG;AAClD,YAAM,MAAM,UAAU,OAAO,CAAC,KAAK,UAAU,UAAU,SAAS,CAAC,KAAK,CAAC;AACvE,UAAI,UAAU,KAAK,QAAQ,EAAG;AAC9B,gBAAU,MAAM,QAAQ;AAAA,IAC1B;AAGA,QAAI,QAAQ,EAAG,QAAO,EAAE,QAAQ,UAAU;AAC1C,QAAI,YAAY,aAAc,QAAO,EAAE,QAAQ,SAAS,OAAO,MAAM;AACrE,QAAI,YAAY,WAAW,YAAY,YAAa,QAAO,EAAE,QAAQ,YAAY;AACjF,YAAQ,MAAM,QAAQ,OAAO;AAC7B,WAAO,EAAE,QAAQ,WAAW,SAAS,QAAQ,QAAQ;AAAA,EACvD;AAEA,MAAI,SAAoC;AACxC,QAAM,OAAO,MAAM;AAGjB,eAAW,IAAI,EAAE,QAAQ,MAAM;AAC7B,eAAS;AAAA,IACX,CAAC;AACD,WAAO;AAAA,EACT;AAGA,MAAI;AAEJ,QAAM,UAA6B;AAAA,IACjC,MAAM,UAAU;AACd,YAAM,UAAU,MAAM,KAAK;AAC3B,aAAO,QAAQ,WAAW,UAAU,EAAE,QAAQ,QAAQ,IAAI;AAAA,IAC5D;AAAA,EACF;AACA,UAAQ,IAAI,SAAS;AAAA,IACnB;AAAA,IACA,QAAQ,MAAM,QAAQ,OAAO;AAAA,IAC7B,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C;AAAA,IACA,IAAI,YAAY,MAAM;AACpB,UAAI,SAAS,MAAM,UAAU,WAAY;AACzC,cAAQ,EAAE,OAAO,WAAW;AAC5B,cAAQ,QAAQ,EAAE,KAAK,CAAC;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAwBA,MAAM,QAAQ;AACd,MAAM,YAAY;AAClB,MAAM,YAAY;AAalB,SAAS,UAAU,QAAmC,OAAqB;AACzE,QAAM,QAAQ,UAAU,KAAK;AAC7B,QAAM,UAAU,OAAO;AACvB,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,UAAU,EAAE,eAAe,MAAM;AAAA,EAC1C,WAAW,OAAQ,QAA8B,QAAQ,YAAY;AACnE,IAAC,QAA0D,IAAI,iBAAiB,KAAK;AAAA,EACvF,OAAO;AACL,IAAC,QAAoC,gBAAgB;AAAA,EACvD;AACF;AA0BO,SAAS,qBACd,UACA,SACY;AACZ,QAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,MAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,kEAAkE;AAEnG,QAAM,iBAAiB,OAAO,OAAe,WAAyC;AACpF,QAAI,OAAO,gBAAgB,OAAO,OAAO,EAAE,EAAG,OAAM;AAEpD,UAAM,QAAQ,OAAO,KAAK,MAAM,SAAY,OAAO,MAAM,IAAI,OAAO,KAAK;AACzE,UAAM,SAAS,CAAC,UAAkB;AAChC,gBAAU,QAAQ,KAAK;AACvB,aAAO,SAAS,QAAQ,MAAM;AAAA,IAChC;AACA,eAAS;AACP,YAAM,MAAM,OAAO,MAAM;AAGzB,UAAI,UAAU,KAAK;AACjB,YAAI,QAAQ,QAAQ,OAAO,SAAS,EAAG,OAAM;AAC7C,eAAO,SAAS,IAAI;AACpB,eAAO,OAAO,GAAG;AAAA,MACnB;AAGA,UAAI,OAAO,OAAO,GAAG;AACnB,eAAO,IAAI,KAAK,IAAI;AACpB,cAAM;AAAA,MACR;AAGA,UAAI,OAAO,SAAS,GAAG;AACrB,eAAO,IAAI,KAAK,KAAK;AACrB,cAAM;AAAA,MACR;AAEA,YAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAI,OAAO,WAAW,UAAW;AACjC,UAAI,OAAO,WAAW,SAAS;AAC7B,eAAO,IAAI,OAAO,OAAO,KAAK;AAC9B,cAAM;AAAA,MACR;AACA,UAAI,OAAO,WAAW,aAAa;AACjC,QAAC,MAAkC,SAAS,IAAI;AAChD,cAAM;AAAA,MACR;AACA,UAAI,OAAO,QAAQ,WAAW,MAAO,OAAM;AAC3C,aAAO,SAAS,IAAI;AACpB,aAAO,OAAO,OAAO,QAAQ,KAAK;AAAA,IACpC;AAAA,EACF;AAEA,QAAM,UAAU,SAAS,aAAa,QAAQ;AAAA,IAC5C,CAAC,WAAW;AACV,MAAC,OAAsB,KAAK,IAAI,OAAO,MAAM;AAC7C,aAAO;AAAA,IACT;AAAA,IACA,CAAC,UAAU,QAAQ,OAAO,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,SAAS,aAAa,SAAS;AAAA,IAC9C,CAAC,QAAQ;AAAA,IACT,CAAC,UAAU;AACT,YAAM,SAAS;AACf,UAAI,QAAQ,UAAU,WAAW,OAAO,CAAC,OAAO,OAAQ,QAAO,QAAQ,OAAO,KAAK;AACnF,aAAO,eAAe,QAAQ,OAAO,MAAM;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACX,aAAS,aAAa,QAAQ,MAAM,OAAO;AAC3C,aAAS,aAAa,SAAS,MAAM,QAAQ;AAAA,EAC/C;AACF;","names":[]}

package/dist/lib/share-format.d.ts

@@ -0,0 +1,13 @@
+/**
+ * How a chart says a share of its whole — PieChart's slices and centre, Treemap's tiles
+ * and groups. Internal, not exported from the barrel.
+ *
+ * Each chart held a copy of the same two `Intl` formats and the same switch between them
+ * (0.52 code review of treemap.tsx, finding 9); one copy is the rule both say.
+ */
+/**
+ * A formatter for shares (0–1) in `locale`, as a percent: one decimal under 10 %, where
+ * rounding to whole percents starts to lie — a slice of 0.4 % said as "0%" says it is not
+ * there — and whole percents above. Make it once per locale (it builds two `Intl` formats).
+ */
+export declare function shareFormat(locale: string | undefined): (share: number) => string;

package/dist/lib/share-format.js

@@ -0,0 +1,10 @@
+"use client";
+function shareFormat(locale) {
+  const whole = new Intl.NumberFormat(locale, { style: "percent", maximumFractionDigits: 0 });
+  const fine = new Intl.NumberFormat(locale, { style: "percent", maximumFractionDigits: 1 });
+  return (share) => (share < 0.1 ? fine : whole).format(share);
+}
+export {
+  shareFormat
+};
+//# sourceMappingURL=share-format.js.map

package/dist/lib/share-format.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/share-format.ts"],"sourcesContent":["/**\n * How a chart says a share of its whole — PieChart's slices and centre, Treemap's tiles\n * and groups. Internal, not exported from the barrel.\n *\n * Each chart held a copy of the same two `Intl` formats and the same switch between them\n * (0.52 code review of treemap.tsx, finding 9); one copy is the rule both say.\n */\n\n/**\n * A formatter for shares (0–1) in `locale`, as a percent: one decimal under 10 %, where\n * rounding to whole percents starts to lie — a slice of 0.4 % said as \"0%\" says it is not\n * there — and whole percents above. Make it once per locale (it builds two `Intl` formats).\n */\nexport function shareFormat(locale: string | undefined): (share: number) => string {\n  const whole = new Intl.NumberFormat(locale, { style: \"percent\", maximumFractionDigits: 0 });\n  const fine = new Intl.NumberFormat(locale, { style: \"percent\", maximumFractionDigits: 1 });\n  return (share) => (share < 0.1 ? fine : whole).format(share);\n}\n"],"mappings":";AAaO,SAAS,YAAY,QAAuD;AACjF,QAAM,QAAQ,IAAI,KAAK,aAAa,QAAQ,EAAE,OAAO,WAAW,uBAAuB,EAAE,CAAC;AAC1F,QAAM,OAAO,IAAI,KAAK,aAAa,QAAQ,EAAE,OAAO,WAAW,uBAAuB,EAAE,CAAC;AACzF,SAAO,CAAC,WAAW,QAAQ,MAAM,OAAO,OAAO,OAAO,KAAK;AAC7D;","names":[]}

package/dist/lib/text-case.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Upper-case the first letter only, in `locale` — the one copy of the rule (refactor audit
+ * 2026-10-30, DUP-11: MonthPicker and JumpCalendar each had it, and MiniCalendar's caption
+ * still used the CSS `capitalize` it was written against).
+ *
+ * Several locales (fr, es, it, pt, …) write month names in lower case, which at the head
+ * of a field or a panel reads as a typo. But only the FIRST letter is ours to change:
+ * `capitalize` upper-cases every word, so Spanish read "Septiembre De 2026", and a
+ * caption that does not start with the month kept its wrong capital — Hungarian read
+ * "2026. Szeptember". This gives "Septiembre de 2026" and "2026. szeptember".
+ *
+ * In `locale` because the case mapping is the language's: Turkish upper-cases "i" to "İ".
+ * `undefined` is the runtime's default, as everywhere `Intl` takes one.
+ *
+ * Package-private — not re-exported from the barrel.
+ */
+export declare function upperFirst(text: string, locale: string | undefined): string;

package/dist/lib/text-case.js

@@ -0,0 +1,8 @@
+"use client";
+function upperFirst(text, locale) {
+  return text.charAt(0).toLocaleUpperCase(locale) + text.slice(1);
+}
+export {
+  upperFirst
+};
+//# sourceMappingURL=text-case.js.map

package/dist/lib/text-case.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/text-case.ts"],"sourcesContent":["/**\n * Upper-case the first letter only, in `locale` — the one copy of the rule (refactor audit\n * 2026-10-30, DUP-11: MonthPicker and JumpCalendar each had it, and MiniCalendar's caption\n * still used the CSS `capitalize` it was written against).\n *\n * Several locales (fr, es, it, pt, …) write month names in lower case, which at the head\n * of a field or a panel reads as a typo. But only the FIRST letter is ours to change:\n * `capitalize` upper-cases every word, so Spanish read \"Septiembre De 2026\", and a\n * caption that does not start with the month kept its wrong capital — Hungarian read\n * \"2026. Szeptember\". This gives \"Septiembre de 2026\" and \"2026. szeptember\".\n *\n * In `locale` because the case mapping is the language's: Turkish upper-cases \"i\" to \"İ\".\n * `undefined` is the runtime's default, as everywhere `Intl` takes one.\n *\n * Package-private — not re-exported from the barrel.\n */\nexport function upperFirst(text: string, locale: string | undefined): string {\n  return text.charAt(0).toLocaleUpperCase(locale) + text.slice(1);\n}\n"],"mappings":";AAgBO,SAAS,WAAW,MAAc,QAAoC;AAC3E,SAAO,KAAK,OAAO,CAAC,EAAE,kBAAkB,MAAM,IAAI,KAAK,MAAM,CAAC;AAChE;","names":[]}

package/dist/lib/text-match.d.ts

@@ -68,3 +68,32 @@ export declare function rankMatch(label: string, query: string, { code, locale }
     code?: string;
     locale?: string;
 }): MatchRank;
+/** A row {@link searchRanked} kept, and how well it answers the WHOLE query:
+ *  {@link rankMatch}'s rank, or `3` for a row that holds the query's words apart
+ *  ("Zürich Migros" for "migros zürich"). */
+export interface RankedHit<T> {
+    row: T;
+    rank: Exclude<MatchRank, -1> | 3;
+}
+/**
+ * The rows that hold every word of `query`, each ranked for the WHOLE query — for the
+ * lists that FILTER by words ({@link matchesSearch}) and RANK by the whole query
+ * ({@link rankMatch}): Combobox, CountrySelect and InlineEntityCombobox (refactor audit
+ * 2026-10-30, DUP-4). In the order given; sort by `rank` with a stable sort, and the rows
+ * of one rank keep it. No words keep every row, at `0`.
+ *
+ * Each row's texts are folded ONCE, and the query once. The lists asked `matchesSearch`
+ * and then `rankMatch` of each row they kept, which folded the row three times and the
+ * query once per row, per keystroke — InlineEntityCombobox asked `rankMatch` twice of
+ * most rows (0.52 code review, combobox.tsx).
+ *
+ * `texts(row)`: where a word may stand; the FIRST is the label the rank is for.
+ * `code(row)`: a key that answers only WHOLE — a word that IS the code matches the row,
+ * and the code as the whole query ranks `0` ("ch" is Switzerland before it is Chad) —
+ * never a letter of it ("w" is not Aruba, AW: 0.52 code review, country-select.tsx).
+ * Internal: not in the barrel.
+ */
+export declare function searchRanked<T>(rows: readonly T[], query: string, texts: (row: T) => readonly (string | undefined)[], { code, locale }?: {
+    code?: (row: T) => string;
+    locale?: string;
+}): RankedHit<T>[];

package/dist/lib/text-match.js

@@ -22,16 +22,34 @@ function matchesSearch(words, texts, locale) {
 function rankMatch(label, query, { code, locale } = {}) {
   const q = foldForSearch(query.trim(), locale);
   if (!q) return 0;
-  const text = foldForSearch(label, locale);
-  if (text === q || code !== void 0 && foldForSearch(code, locale) === q) return 0;
+  return rankFolded(foldForSearch(label, locale), q, code === void 0 ? void 0 : foldForSearch(code, locale));
+}
+function rankFolded(text, q, code) {
+  if (text === q || code === q) return 0;
   if (text.startsWith(q)) return 1;
   return text.includes(q) ? 2 : -1;
 }
+function searchRanked(rows, query, texts, { code, locale } = {}) {
+  const q = foldForSearch(query.trim(), locale);
+  const words = q.split(/\s+/).filter((word) => word !== "");
+  if (words.length === 0) return rows.map((row) => ({ row, rank: 0 }));
+  const hits = [];
+  for (const row of rows) {
+    const folded = texts(row).filter((t) => t !== void 0).map((t) => foldForSearch(t, locale));
+    const key = code === void 0 ? void 0 : foldForSearch(code(row), locale);
+    const hay = folded.join("\n");
+    if (!words.every((word) => word === key || hay.includes(word))) continue;
+    const rank = rankFolded(folded[0] ?? "", q, key);
+    hits.push({ row, rank: rank === -1 ? 3 : rank });
+  }
+  return hits;
+}
 export {
   foldForSearch,
   matchesSearch,
   rankMatch,
   sameName,
+  searchRanked,
   searchWords
 };
 //# sourceMappingURL=text-match.js.map

package/dist/lib/text-match.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/text-match.ts"],"sourcesContent":["/**\n * How typing into a kit list matches its rows — one rule for every list (DUP-5, refactor\n * audit 2026-10).\n *\n * There were six. \"zurich\" found Zürich in CountrySelect and the command palette and in no\n * EntityCombobox, Combobox, MultiSelect or DataTable text filter, where keksdose's\n * Swiss-German payees and categories and kastlan's eighteen entity pickers live; \"İ\"\n * folded by the locale in GroupedPicker and nowhere in the combobox family. The folding\n * only ever widens a match, so moving every list onto it took nothing away.\n */\n\n/**\n * A text as search compares it: the locale's lower case, accents off, ß spelt \"ss\" —\n * \"Zürich\" and \"ZURICH\" both read \"zurich\", \"Straße\" reads \"strasse\". Punctuation and\n * symbols stay: a currency is found by its \"€\", and \"c++\" is not the empty query.\n *\n * Lower-cased by the locale FIRST, then decomposed: the Turkish \"İ\" lower-cases to \"i\"\n * and the dotted capital's mark is then dropped like any other, so \"istanbul\" finds\n * \"İSTANBUL\" in every locale, while \"I\" folds to the dotless \"ı\" in Turkish alone.\n * `locale` left out is the runtime's default; a malformed tag folds as if left out.\n */\nexport function foldForSearch(text: string, locale?: string): string {\n  let lower: string;\n  try {\n    lower = text.toLocaleLowerCase(locale);\n  } catch {\n    lower = text.toLocaleLowerCase();\n  }\n  return lower\n    .normalize(\"NFD\")\n    .replace(/\\p{M}+/gu, \"\")\n    .replace(/ß/g, \"ss\");\n}\n\n/**\n * Whether two names are one name as a picker's search reads them: folded\n * ({@link foldForSearch}) and trimmed — \"cafe\" is Café, \" MIGROS \" is Migros. For \"does\n * the typed text name a record that exists\" (a create row, InlineEntityCombobox's blur\n * commit), which compared with plain `toLowerCase` while the list beside it folded, so\n * \"cafe\" listed Café as a hit and offered \"Create “cafe”\" too — a duplicate payee or shop\n * chain one Enter away (refactor audit 2026-10-30, DUP-5). Internal: not in the barrel.\n */\nexport function sameName(a: string, b: string, locale?: string): boolean {\n  return foldForSearch(a.trim(), locale) === foldForSearch(b.trim(), locale);\n}\n\n/**\n * A picker's query as its words, each folded (0.51.4, keksdose's /prices shop picker):\n * \"Migros  Zürich\" → `[\"migros\", \"zurich\"]`. An empty or blank query has no words.\n */\nexport function searchWords(query: string, locale?: string): string[] {\n  return foldForSearch(query, locale)\n    .split(/\\s+/)\n    .filter((word) => word !== \"\");\n}\n\n/**\n * Whether a row matches a picker's query: EVERY word appears in at least one of the row's\n * texts — \"migros 8004\" finds a row named \"Migros · 8004 Zürich\", and a row whose chain is\n * its group and whose place is its label (pass both). Until 0.51.4 the whole query had to\n * be ONE substring of one text, so two words found nothing unless they stood side by side\n * in that order. One word matches exactly as before, and so does the old query when it\n * was a substring. No words match everything.\n *\n * `words` from {@link searchWords}; `texts` as they are (folded here), `undefined` skipped.\n *\n * Exported since 0.51.5 for an app's own async source: a picker shows `loadOptions`'\n * rows as they come, so a source that narrows on the client filters with this, the same\n * rule the kit applies to `options` (keksdose's shop picker past its first hundred shops).\n */\nexport function matchesSearch(\n  words: readonly string[],\n  texts: readonly (string | undefined)[],\n  locale?: string,\n): boolean {\n  if (words.length === 0) return true;\n  // One haystack per row; a word holds no whitespace, so it cannot match across the\n  // newline between two texts.\n  const hay = texts\n    .filter((t): t is string => t !== undefined)\n    .map((t) => foldForSearch(t, locale))\n    .join(\"\\n\");\n  return words.every((word) => hay.includes(word));\n}\n\n/** {@link rankMatch}'s answer: lower is better, `-1` is no match. */\nexport type MatchRank = -1 | 0 | 1 | 2;\n\n/**\n * How well `label` answers `query` — CountrySelect's ranking, for every list that orders\n * its hits:\n *\n * - `0`: the query IS the row — its `code` (\"ch\" means Switzerland before it means Chad)\n *   or the whole label;\n * - `1`: the label starts with it;\n * - `2`: the label contains it;\n * - `-1`: no match.\n *\n * Both sides are folded here ({@link foldForSearch}, by `locale`), so pass them as typed\n * and as shown. An empty query matches every row alike (`0`). Sort by the rank with a\n * stable sort, and rows of one rank keep the order they came in.\n */\nexport function rankMatch(\n  label: string,\n  query: string,\n  { code, locale }: { code?: string; locale?: string } = {},\n): MatchRank {\n  const q = foldForSearch(query.trim(), locale);\n  if (!q) return 0;\n  const text = foldForSearch(label, locale);\n  if (text === q || (code !== undefined && foldForSearch(code, locale) === q)) return 0;\n  if (text.startsWith(q)) return 1;\n  return text.includes(q) ? 2 : -1;\n}\n"],"mappings":";AAqBO,SAAS,cAAc,MAAc,QAAyB;AACnE,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,kBAAkB,MAAM;AAAA,EACvC,QAAQ;AACN,YAAQ,KAAK,kBAAkB;AAAA,EACjC;AACA,SAAO,MACJ,UAAU,KAAK,EACf,QAAQ,YAAY,EAAE,EACtB,QAAQ,MAAM,IAAI;AACvB;AAUO,SAAS,SAAS,GAAW,GAAW,QAA0B;AACvE,SAAO,cAAc,EAAE,KAAK,GAAG,MAAM,MAAM,cAAc,EAAE,KAAK,GAAG,MAAM;AAC3E;AAMO,SAAS,YAAY,OAAe,QAA2B;AACpE,SAAO,cAAc,OAAO,MAAM,EAC/B,MAAM,KAAK,EACX,OAAO,CAAC,SAAS,SAAS,EAAE;AACjC;AAgBO,SAAS,cACd,OACA,OACA,QACS;AACT,MAAI,MAAM,WAAW,EAAG,QAAO;AAG/B,QAAM,MAAM,MACT,OAAO,CAAC,MAAmB,MAAM,MAAS,EAC1C,IAAI,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,EACnC,KAAK,IAAI;AACZ,SAAO,MAAM,MAAM,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC;AACjD;AAmBO,SAAS,UACd,OACA,OACA,EAAE,MAAM,OAAO,IAAwC,CAAC,GAC7C;AACX,QAAM,IAAI,cAAc,MAAM,KAAK,GAAG,MAAM;AAC5C,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,cAAc,OAAO,MAAM;AACxC,MAAI,SAAS,KAAM,SAAS,UAAa,cAAc,MAAM,MAAM,MAAM,EAAI,QAAO;AACpF,MAAI,KAAK,WAAW,CAAC,EAAG,QAAO;AAC/B,SAAO,KAAK,SAAS,CAAC,IAAI,IAAI;AAChC;","names":[]}
+{"version":3,"sources":["../../src/lib/text-match.ts"],"sourcesContent":["/**\n * How typing into a kit list matches its rows — one rule for every list (DUP-5, refactor\n * audit 2026-10).\n *\n * There were six. \"zurich\" found Zürich in CountrySelect and the command palette and in no\n * EntityCombobox, Combobox, MultiSelect or DataTable text filter, where keksdose's\n * Swiss-German payees and categories and kastlan's eighteen entity pickers live; \"İ\"\n * folded by the locale in GroupedPicker and nowhere in the combobox family. The folding\n * only ever widens a match, so moving every list onto it took nothing away.\n */\n\n/**\n * A text as search compares it: the locale's lower case, accents off, ß spelt \"ss\" —\n * \"Zürich\" and \"ZURICH\" both read \"zurich\", \"Straße\" reads \"strasse\". Punctuation and\n * symbols stay: a currency is found by its \"€\", and \"c++\" is not the empty query.\n *\n * Lower-cased by the locale FIRST, then decomposed: the Turkish \"İ\" lower-cases to \"i\"\n * and the dotted capital's mark is then dropped like any other, so \"istanbul\" finds\n * \"İSTANBUL\" in every locale, while \"I\" folds to the dotless \"ı\" in Turkish alone.\n * `locale` left out is the runtime's default; a malformed tag folds as if left out.\n */\nexport function foldForSearch(text: string, locale?: string): string {\n  let lower: string;\n  try {\n    lower = text.toLocaleLowerCase(locale);\n  } catch {\n    lower = text.toLocaleLowerCase();\n  }\n  return lower\n    .normalize(\"NFD\")\n    .replace(/\\p{M}+/gu, \"\")\n    .replace(/ß/g, \"ss\");\n}\n\n/**\n * Whether two names are one name as a picker's search reads them: folded\n * ({@link foldForSearch}) and trimmed — \"cafe\" is Café, \" MIGROS \" is Migros. For \"does\n * the typed text name a record that exists\" (a create row, InlineEntityCombobox's blur\n * commit), which compared with plain `toLowerCase` while the list beside it folded, so\n * \"cafe\" listed Café as a hit and offered \"Create “cafe”\" too — a duplicate payee or shop\n * chain one Enter away (refactor audit 2026-10-30, DUP-5). Internal: not in the barrel.\n */\nexport function sameName(a: string, b: string, locale?: string): boolean {\n  return foldForSearch(a.trim(), locale) === foldForSearch(b.trim(), locale);\n}\n\n/**\n * A picker's query as its words, each folded (0.51.4, keksdose's /prices shop picker):\n * \"Migros  Zürich\" → `[\"migros\", \"zurich\"]`. An empty or blank query has no words.\n */\nexport function searchWords(query: string, locale?: string): string[] {\n  return foldForSearch(query, locale)\n    .split(/\\s+/)\n    .filter((word) => word !== \"\");\n}\n\n/**\n * Whether a row matches a picker's query: EVERY word appears in at least one of the row's\n * texts — \"migros 8004\" finds a row named \"Migros · 8004 Zürich\", and a row whose chain is\n * its group and whose place is its label (pass both). Until 0.51.4 the whole query had to\n * be ONE substring of one text, so two words found nothing unless they stood side by side\n * in that order. One word matches exactly as before, and so does the old query when it\n * was a substring. No words match everything.\n *\n * `words` from {@link searchWords}; `texts` as they are (folded here), `undefined` skipped.\n *\n * Exported since 0.51.5 for an app's own async source: a picker shows `loadOptions`'\n * rows as they come, so a source that narrows on the client filters with this, the same\n * rule the kit applies to `options` (keksdose's shop picker past its first hundred shops).\n */\nexport function matchesSearch(\n  words: readonly string[],\n  texts: readonly (string | undefined)[],\n  locale?: string,\n): boolean {\n  if (words.length === 0) return true;\n  // One haystack per row; a word holds no whitespace, so it cannot match across the\n  // newline between two texts.\n  const hay = texts\n    .filter((t): t is string => t !== undefined)\n    .map((t) => foldForSearch(t, locale))\n    .join(\"\\n\");\n  return words.every((word) => hay.includes(word));\n}\n\n/** {@link rankMatch}'s answer: lower is better, `-1` is no match. */\nexport type MatchRank = -1 | 0 | 1 | 2;\n\n/**\n * How well `label` answers `query` — CountrySelect's ranking, for every list that orders\n * its hits:\n *\n * - `0`: the query IS the row — its `code` (\"ch\" means Switzerland before it means Chad)\n *   or the whole label;\n * - `1`: the label starts with it;\n * - `2`: the label contains it;\n * - `-1`: no match.\n *\n * Both sides are folded here ({@link foldForSearch}, by `locale`), so pass them as typed\n * and as shown. An empty query matches every row alike (`0`). Sort by the rank with a\n * stable sort, and rows of one rank keep the order they came in.\n */\nexport function rankMatch(\n  label: string,\n  query: string,\n  { code, locale }: { code?: string; locale?: string } = {},\n): MatchRank {\n  const q = foldForSearch(query.trim(), locale);\n  if (!q) return 0;\n  return rankFolded(foldForSearch(label, locale), q, code === undefined ? undefined : foldForSearch(code, locale));\n}\n\n/** {@link rankMatch} on a text, a non-empty query and a code all folded already. */\nfunction rankFolded(text: string, q: string, code: string | undefined): MatchRank {\n  if (text === q || code === q) return 0;\n  if (text.startsWith(q)) return 1;\n  return text.includes(q) ? 2 : -1;\n}\n\n/** A row {@link searchRanked} kept, and how well it answers the WHOLE query:\n *  {@link rankMatch}'s rank, or `3` for a row that holds the query's words apart\n *  (\"Zürich Migros\" for \"migros zürich\"). */\nexport interface RankedHit<T> {\n  row: T;\n  rank: Exclude<MatchRank, -1> | 3;\n}\n\n/**\n * The rows that hold every word of `query`, each ranked for the WHOLE query — for the\n * lists that FILTER by words ({@link matchesSearch}) and RANK by the whole query\n * ({@link rankMatch}): Combobox, CountrySelect and InlineEntityCombobox (refactor audit\n * 2026-10-30, DUP-4). In the order given; sort by `rank` with a stable sort, and the rows\n * of one rank keep it. No words keep every row, at `0`.\n *\n * Each row's texts are folded ONCE, and the query once. The lists asked `matchesSearch`\n * and then `rankMatch` of each row they kept, which folded the row three times and the\n * query once per row, per keystroke — InlineEntityCombobox asked `rankMatch` twice of\n * most rows (0.52 code review, combobox.tsx).\n *\n * `texts(row)`: where a word may stand; the FIRST is the label the rank is for.\n * `code(row)`: a key that answers only WHOLE — a word that IS the code matches the row,\n * and the code as the whole query ranks `0` (\"ch\" is Switzerland before it is Chad) —\n * never a letter of it (\"w\" is not Aruba, AW: 0.52 code review, country-select.tsx).\n * Internal: not in the barrel.\n */\nexport function searchRanked<T>(\n  rows: readonly T[],\n  query: string,\n  texts: (row: T) => readonly (string | undefined)[],\n  { code, locale }: { code?: (row: T) => string; locale?: string } = {},\n): RankedHit<T>[] {\n  const q = foldForSearch(query.trim(), locale);\n  const words = q.split(/\\s+/).filter((word) => word !== \"\");\n  if (words.length === 0) return rows.map((row) => ({ row, rank: 0 }));\n  const hits: RankedHit<T>[] = [];\n  for (const row of rows) {\n    const folded = texts(row)\n      .filter((t): t is string => t !== undefined)\n      .map((t) => foldForSearch(t, locale));\n    const key = code === undefined ? undefined : foldForSearch(code(row), locale);\n    // One haystack, as `matchesSearch` has it: a word holds no whitespace, so it cannot\n    // match across the newline between two texts.\n    const hay = folded.join(\"\\n\");\n    if (!words.every((word) => word === key || hay.includes(word))) continue;\n    const rank = rankFolded(folded[0] ?? \"\", q, key);\n    hits.push({ row, rank: rank === -1 ? 3 : rank });\n  }\n  return hits;\n}\n"],"mappings":";AAqBO,SAAS,cAAc,MAAc,QAAyB;AACnE,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,kBAAkB,MAAM;AAAA,EACvC,QAAQ;AACN,YAAQ,KAAK,kBAAkB;AAAA,EACjC;AACA,SAAO,MACJ,UAAU,KAAK,EACf,QAAQ,YAAY,EAAE,EACtB,QAAQ,MAAM,IAAI;AACvB;AAUO,SAAS,SAAS,GAAW,GAAW,QAA0B;AACvE,SAAO,cAAc,EAAE,KAAK,GAAG,MAAM,MAAM,cAAc,EAAE,KAAK,GAAG,MAAM;AAC3E;AAMO,SAAS,YAAY,OAAe,QAA2B;AACpE,SAAO,cAAc,OAAO,MAAM,EAC/B,MAAM,KAAK,EACX,OAAO,CAAC,SAAS,SAAS,EAAE;AACjC;AAgBO,SAAS,cACd,OACA,OACA,QACS;AACT,MAAI,MAAM,WAAW,EAAG,QAAO;AAG/B,QAAM,MAAM,MACT,OAAO,CAAC,MAAmB,MAAM,MAAS,EAC1C,IAAI,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,EACnC,KAAK,IAAI;AACZ,SAAO,MAAM,MAAM,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC;AACjD;AAmBO,SAAS,UACd,OACA,OACA,EAAE,MAAM,OAAO,IAAwC,CAAC,GAC7C;AACX,QAAM,IAAI,cAAc,MAAM,KAAK,GAAG,MAAM;AAC5C,MAAI,CAAC,EAAG,QAAO;AACf,SAAO,WAAW,cAAc,OAAO,MAAM,GAAG,GAAG,SAAS,SAAY,SAAY,cAAc,MAAM,MAAM,CAAC;AACjH;AAGA,SAAS,WAAW,MAAc,GAAW,MAAqC;AAChF,MAAI,SAAS,KAAK,SAAS,EAAG,QAAO;AACrC,MAAI,KAAK,WAAW,CAAC,EAAG,QAAO;AAC/B,SAAO,KAAK,SAAS,CAAC,IAAI,IAAI;AAChC;AA4BO,SAAS,aACd,MACA,OACA,OACA,EAAE,MAAM,OAAO,IAAoD,CAAC,GACpD;AAChB,QAAM,IAAI,cAAc,MAAM,KAAK,GAAG,MAAM;AAC5C,QAAM,QAAQ,EAAE,MAAM,KAAK,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AACzD,MAAI,MAAM,WAAW,EAAG,QAAO,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,EAAE;AACnE,QAAM,OAAuB,CAAC;AAC9B,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,MAAM,GAAG,EACrB,OAAO,CAAC,MAAmB,MAAM,MAAS,EAC1C,IAAI,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACtC,UAAM,MAAM,SAAS,SAAY,SAAY,cAAc,KAAK,GAAG,GAAG,MAAM;AAG5E,UAAM,MAAM,OAAO,KAAK,IAAI;AAC5B,QAAI,CAAC,MAAM,MAAM,CAAC,SAAS,SAAS,OAAO,IAAI,SAAS,IAAI,CAAC,EAAG;AAChE,UAAM,OAAO,WAAW,OAAO,CAAC,KAAK,IAAI,GAAG,GAAG;AAC/C,SAAK,KAAK,EAAE,KAAK,MAAM,SAAS,KAAK,IAAI,KAAK,CAAC;AAAA,EACjD;AACA,SAAO;AACT;","names":[]}

package/dist/lib/thenable.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Whether a callback's answer is a promise to wait for — an object or a function with a
+ * `then` (Promises/A+ "thenable"). A callback that answers nothing is done when it
+ * returns.
+ *
+ * The auth forms (`auth/status-parts`), the admin confirm and the feedback mutation each
+ * wrote their own, three spellings of one check — and the admin's turned a thenable
+ * FUNCTION away (0.52 code review, feedback/feedback-mutation.ts; the refactor audit's
+ * DUP findings).
+ *
+ * @internal Package-private — not re-exported from the barrel.
+ */
+export declare function isThenable(value: unknown): value is PromiseLike<unknown>;

package/dist/lib/thenable.js

@@ -0,0 +1,8 @@
+"use client";
+function isThenable(value) {
+  return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
+}
+export {
+  isThenable
+};
+//# sourceMappingURL=thenable.js.map

package/dist/lib/thenable.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/thenable.ts"],"sourcesContent":["/**\n * Whether a callback's answer is a promise to wait for — an object or a function with a\n * `then` (Promises/A+ \"thenable\"). A callback that answers nothing is done when it\n * returns.\n *\n * The auth forms (`auth/status-parts`), the admin confirm and the feedback mutation each\n * wrote their own, three spellings of one check — and the admin's turned a thenable\n * FUNCTION away (0.52 code review, feedback/feedback-mutation.ts; the refactor audit's\n * DUP findings).\n *\n * @internal Package-private — not re-exported from the barrel.\n */\nexport function isThenable(value: unknown): value is PromiseLike<unknown> {\n  return (\n    (typeof value === \"object\" || typeof value === \"function\") &&\n    value !== null &&\n    typeof (value as { then?: unknown }).then === \"function\"\n  );\n}\n"],"mappings":";AAYO,SAAS,WAAW,OAA+C;AACxE,UACG,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,UAAU,QACV,OAAQ,MAA6B,SAAS;AAElD;","names":[]}

package/dist/lib/translation-review.d.ts

@@ -228,12 +228,17 @@ export interface TranslationReviewFilter {
     source: string;
     namespace: string;
     /** Searched in the key, the text and the reference, folded as every kit list's search
-     *  is (`foldForSearch`): no case, no accents — "uberweisung" finds "Überweisung". */
+     *  is (`foldForSearch`): no case, no accents — "uberweisung" finds "Überweisung". Every
+     *  word on its own (0.52): "budget assign" finds `budget.rta`, "Ready to Assign". */
     query: string;
     placeholdersOnly: boolean;
 }
 export declare const DEFAULT_TRANSLATION_REVIEW_FILTER: TranslationReviewFilter;
-export declare function filterTranslationRows(rows: readonly TranslationRow[], filter: Partial<TranslationReviewFilter>): TranslationRow[];
+/**
+ * The rows the filters leave. `locale` (0.52) folds the query and the texts as the kit's
+ * other lists do — the panel passes the provider's; left out, the runtime's default.
+ */
+export declare function filterTranslationRows(rows: readonly TranslationRow[], filter: Partial<TranslationReviewFilter>, locale?: string): TranslationRow[];
 /** One group of rows — an area, a source — and how they stand. */
 export interface TranslationRowGroup {
     key: string;

package/dist/lib/translation-review.js

@@ -1,5 +1,5 @@
 "use client";
-import { foldForSearch } from "./text-match.js";
+import { matchesSearch, searchWords } from "./text-match.js";
 const REVIEW_STATUSES = [
   "missing",
   "unreviewed",
@@ -139,11 +139,11 @@ const DEFAULT_TRANSLATION_REVIEW_FILTER = {
   query: "",
   placeholdersOnly: false
 };
-function filterTranslationRows(rows, filter) {
+function filterTranslationRows(rows, filter, locale) {
   const f = { ...DEFAULT_TRANSLATION_REVIEW_FILTER, ...filter };
-  const q = foldForSearch(f.query.trim());
+  const words = searchWords(f.query, locale);
   return rows.filter(
-    (row) => (f.status === "all" || row.status === f.status) && (f.source === "all" || row.source === f.source) && (f.namespace === "all" || row.namespace === f.namespace) && (!f.placeholdersOnly || row.placeholderMismatch) && (!q || [row.key, row.text, row.reference].some((s) => foldForSearch(s).includes(q)))
+    (row) => (f.status === "all" || row.status === f.status) && (f.source === "all" || row.source === f.source) && (f.namespace === "all" || row.namespace === f.namespace) && (!f.placeholdersOnly || row.placeholderMismatch) && matchesSearch(words, [row.key, row.text, row.reference], locale)
   );
 }
 function groupTranslationRows(rows, groupOf) {