@eifi1/ui-kit 0.53.0 → 0.54.0

package/README.md

@@ -578,7 +578,7 @@ columns, strings and permissions (see the note at the top of `src/feedback/feedb
 
 <!-- BEGIN GENERATED: exports — node scripts/gen-export-inventory.mjs -->
 
-**2129 names from 358 modules** in the main barrel — 961 values and 1168 types — and 187 more in 16 standalone entries. _Italic_ is a type-only export.
+**2137 names from 358 modules** in the main barrel — 966 values and 1171 types — and 187 more in 16 standalone entries. _Italic_ is a type-only export.
 
 Generated from `dist/index.d.ts` and each standalone entry's own `.d.ts` by
 `node scripts/gen-export-inventory.mjs`; the counts are pinned by
@@ -586,13 +586,13 @@ Generated from `dist/index.d.ts` and each standalone entry's own `.d.ts` by
 
 | Entry point | Names |
 |---|---|
-| `@eifi1/ui-kit` | 2129 |
+| `@eifi1/ui-kit` | 2137 |
 | `@eifi1/ui-kit/chart` | 99 |
 | `@eifi1/ui-kit/shell` | 106 |
-| `@eifi1/ui-kit/data-table` | 55 |
+| `@eifi1/ui-kit/data-table` | 56 |
 | `@eifi1/ui-kit/wizard` | 25 |
 | `@eifi1/ui-kit/tour` | 49 |
-| `@eifi1/ui-kit/feedback` | 194 |
+| `@eifi1/ui-kit/feedback` | 195 |
 | `@eifi1/ui-kit/search` | 20 |
 | `@eifi1/ui-kit/dates` | 22 |
 | `@eifi1/ui-kit/table-text` | 14 |
@@ -623,7 +623,7 @@ Every other subpath is a re-slicing of the barrel, never a second API.
 | `lib/calc` | `commitExpression`, `evaluateExpression`, `formatResult`, `isBareAmount`, `looksLikeExpression`, `sanitizeLive`, `splitLeadingSign` |
 | `lib/cn` | `cn` |
 | `lib/logger` | `logger`, `setStoreLog` |
-| `lib/format` | `currencyMinorDigits`, `EMPTY_FORMATTED_VALUE`, `formatDate`, `formatMoney`, `formatNumber`, `formatPercent`, `formatRelativeTime`, `roundToCurrency`, `toDate`, `useKitFormat`, _`DateInput`_, _`FormatDateOptions`_, _`FormatDateStyle`_, _`FormatDigits`_, _`FormatMoneyOptions`_, _`FormatNumberBaseOptions`_, _`FormatNumberOptions`_, _`FormatPercentOptions`_, _`FormatRelativeTimeOptions`_, _`FormattableNumber`_, _`KitFormat`_, _`RoundToCurrencyOptions`_ |
+| `lib/format` | `currencyMinorDigits`, `EMPTY_FORMATTED_VALUE`, `formatDate`, `formatDuration`, `formatMoney`, `formatNumber`, `formatPercent`, `formatRelativeTime`, `roundToCurrency`, `toDate`, `useKitFormat`, _`DateInput`_, _`FormatDateOptions`_, _`FormatDateStyle`_, _`FormatDigits`_, _`FormatDurationOptions`_, _`FormatMoneyOptions`_, _`FormatNumberBaseOptions`_, _`FormatNumberOptions`_, _`FormatPercentOptions`_, _`FormatRelativeTimeOptions`_, _`FormattableNumber`_, _`KitFormat`_, _`RoundToCurrencyOptions`_ |
 | `lib/safe-storage` | `readSessionStored`, `readStored`, `readStoredJson`, `removeStored`, `writeSessionStored`, `writeStored`, `writeStoredJson` |
 | `lib/reduced-motion` | `prefersReducedMotion` |
 | `lib/download` | `filenameFromDisposition`, `saveBlob` |
@@ -632,7 +632,7 @@ Every other subpath is a re-slicing of the barrel, never a second API.
 | `lib/server-wake` | `attachServerWake`, `createServerWake`, `serverWake`, `watchReadsAnd`, `wrapFetch`, _`AxiosLikeInstance`_, _`ServerWakeAxiosConfig`_, _`ServerWakeFilter`_, _`ServerWakeOptions`_, _`ServerWakeRequest`_, _`ServerWakeStage`_, _`ServerWakeWatcher`_ |
 | `lib/session-refresh` | `attachSessionRefresh`, `createSessionRefresh`, `isSignedOutStep`, `isTransientRefreshFailure`, _`SessionRefresh`_, _`SessionRefreshOptions`_, _`SessionRefreshOutcome`_, _`SessionRenewal`_ |
 | `lib/person-name` | `formatPersonName`, `personInitials`, _`PersonName`_ |
-| `lib/translation-review` | `DEFAULT_TRANSLATION_REVIEW_FILTER`, `DEFAULT_TRANSLATION_REVIEW_SWIPE`, `dropReviews`, `filterTranslationRows`, `flattenStrings`, `fromApiReview`, `groupTranslationRows`, `keyInArea`, `keyInAreas`, `keyNamespace`, `mergeReviews`, `placeholderMismatch`, `placeholderTokens`, `REVIEW_STATUSES`, `reviewAreaOf`, `reviewStatus`, `reviewUndo`, `reviewWrite`, `summariseRows`, `toApiWrite`, `TRANSLATION_REVIEW_SWIPE_ACTIONS`, `translationCorrections`, `translationReviewSwipePlan`, `translationRows`, `unreviewedRows`, _`ApiTranslationReview`_, _`ApiTranslationReviewsResponse`_, _`ApiTranslationReviewWrite`_, _`ReviewStatus`_, _`TranslationCorrection`_, _`TranslationReview`_, _`TranslationReviewFilter`_, _`TranslationReviewKey`_, _`TranslationReviewSwipeAction`_, _`TranslationReviewSwipeBinding`_, _`TranslationReviewUndo`_, _`TranslationReviewWrite`_, _`TranslationRow`_, _`TranslationRowGroup`_, _`TranslationRowsInput`_, _`TranslationSummary`_, _`TranslationVerdict`_ |
+| `lib/translation-review` | `clearReviewsInChunks`, `DEFAULT_TRANSLATION_REVIEW_FILTER`, `DEFAULT_TRANSLATION_REVIEW_SWIPE`, `dropReviews`, `filterTranslationRows`, `flattenStrings`, `fromApiReview`, `groupTranslationRows`, `keyInArea`, `keyInAreas`, `keyNamespace`, `mergeReviews`, `placeholderMismatch`, `placeholderTokens`, `REVIEW_STATUSES`, `reviewAreaOf`, `reviewStatus`, `reviewUndo`, `reviewWrite`, `saveReviewsInChunks`, `summariseRows`, `toApiWrite`, `TRANSLATION_REVIEW_SWIPE_ACTIONS`, `translationCorrections`, `translationReviewSwipePlan`, `translationRows`, `unreviewedRows`, _`ApiTranslationReview`_, _`ApiTranslationReviewsResponse`_, _`ApiTranslationReviewWrite`_, _`ReviewStatus`_, _`TranslationCorrection`_, _`TranslationReview`_, _`TranslationReviewFilter`_, _`TranslationReviewKey`_, _`TranslationReviewSwipeAction`_, _`TranslationReviewSwipeBinding`_, _`TranslationReviewUndo`_, _`TranslationReviewWrite`_, _`TranslationRow`_, _`TranslationRowGroup`_, _`TranslationRowsInput`_, _`TranslationSummary`_, _`TranslationVerdict`_ |
 | `lib/countries` | `COUNTRY_CODES`, `countryName` |
 | `lib/iban` | `compactIban`, `formatIban`, `IBAN_LENGTHS`, `ibanCheckDigits`, `ibanProblem`, `isQrIban`, `isValidIban`, _`IbanKind`_, _`IbanProblem`_ |
 | `lib/phone` | `formatNationalPhone`, `formatPhone`, `isE164`, `parsePhone`, `PHONE_COUNTRIES`, `PHONE_DIAL_CODES`, _`ParsedPhone`_, _`PhoneCountry`_, _`PhoneCountryCode`_ |
@@ -831,7 +831,7 @@ Every other subpath is a re-slicing of the barrel, never a second API.
 | `components/column-mapper` | `ColumnMapper`, `ColumnRoleTable`, `DEFAULT_COLUMN_MAPPER_LABELS`, _`ColumnMapperLabels`_, _`ColumnMapperProps`_, _`ColumnRoleTableBodyProps`_, _`ColumnRoleTableProps`_, _`ColumnRoleTableRowProps`_ |
 | `components/data-table-labels` | `DEFAULT_DATA_TABLE_LABELS`, _`DataTableLabels`_ |
 | `components/data-table-sort` | `compareSortValues`, `decodeSorts`, `encodeSorts`, `nextSorts`, `normalizeSorts`, _`SortCycle`_, _`SortDir`_, _`SortState`_, _`SortStepOptions`_ |
-| `components/data-table-filters` | `dateFilter`, `decodeFilterValue`, `decodeFilterValueOfType`, `defaultFilterState`, `encodeFilterValue`, `filterHref`, `isFilterActive`, `numberFilter`, `resolveFilter`, `rowMatches`, `selectFilter`, `textFilter`, _`ColumnFilter`_, _`FilterValue`_ |
+| `components/data-table-filters` | `dateFilter`, `decodeFilterValue`, `decodeFilterValueOfType`, `defaultFilterState`, `encodeFilterValue`, `filterHref`, `isFilterActive`, `numberBound`, `numberFilter`, `resolveFilter`, `rowMatches`, `selectFilter`, `textFilter`, _`ColumnFilter`_, _`FilterValue`_ |
 | `components/data-table-pagination` | `PAGE_SIZE_OPTIONS`, `Pagination` |
 | `components/data-table-filter-popover` | `FilterPopover` |
 | `components/data-table` | `DataTable`, `DEFAULT_DATA_TABLE_SORT_LABELS`, _`DataTableCellProps`_, _`DataTableChrome`_, _`DataTableColumn`_, _`DataTableDensity`_, _`DataTableDesktopSwipeActions`_, _`DataTableHeadProps`_, _`DataTableProps`_, _`DataTableRowAction`_, _`DataTableSortLabels`_, _`FilterState`_, _`MobileSwipeActions`_, _`ServerPagination`_ |
@@ -916,7 +916,7 @@ Every other subpath is a re-slicing of the barrel, never a second API.
 | `feedback/feedback-menu` | `DEFAULT_FEEDBACK_MENU_LABELS`, `FeedbackMenu`, _`FeedbackMenuLabels`_, _`FeedbackMenuProps`_ |
 | `feedback/feedback-context` | `DEFAULT_FEEDBACK_CONTEXT_LABELS`, `feedbackContext`, `FeedbackContextBox`, _`FeedbackContextBoxProps`_, _`FeedbackContextInput`_, _`FeedbackContextLabels`_, _`FeedbackSubmitter`_ |
 | `feedback/feedback-capture` | `captureAppScreenshot`, _`CaptureAppScreenshotOptions`_ |
-| `feedback/feedback-submit` | `useFeedbackSubmit`, _`FeedbackCreatePayload`_, _`FeedbackSubmit`_, _`UseFeedbackSubmitOptions`_ |
+| `feedback/feedback-submit` | `useFeedbackSubmit`, _`FeedbackCreatePayload`_, _`FeedbackSubmit`_, _`FeedbackSubmitOpenOptions`_, _`UseFeedbackSubmitOptions`_ |
 | `feedback/feedback-table` | `DEFAULT_FEEDBACK_PAGE_LABELS`, `FeedbackAwaitingToggle`, `FeedbackEmptyState`, `FeedbackMobileCard`, `feedbackMobileGroupBy`, `FeedbackSubject`, `isFeedbackAwaiting`, `useFeedbackColumns`, `useFeedbackPageLabels`, `useFeedbackRenderDate`, _`FeedbackAwaitingToggleProps`_, _`FeedbackColumnsOptions`_, _`FeedbackEmptyStateProps`_, _`FeedbackMobileCardProps`_, _`FeedbackPageLabels`_, _`FeedbackRenderDate`_, _`FeedbackSubjectProps`_, _`FeedbackTableRow`_, _`UseFeedbackColumnsOptions`_ |
 | `feedback/feedback-row-detail` | `DEFAULT_FEEDBACK_DETAIL_LABELS`, `FeedbackReworkSection`, `FeedbackRowDetail`, _`FeedbackDetailLabels`_, _`FeedbackDetailPatch`_, _`FeedbackDetailUpdateAsync`_, _`FeedbackReworkSectionProps`_, _`FeedbackReworkSend`_, _`FeedbackRowAccess`_, _`FeedbackRowDetailProps`_, _`FeedbackUpload`_ |
 | `feedback/feedback-crash` | `createCrashReporter`, _`CrashFiling`_, _`CrashReportCreate`_, _`CrashReporter`_, _`CrashReporterOptions`_, _`CrashReportResponse`_ |
@@ -970,7 +970,7 @@ Every other subpath is a re-slicing of the barrel, never a second API.
 | `auth/register-form` | `DEFAULT_REGISTER_LABELS`, `RegisterForm`, _`RegisterFormProps`_, _`RegisterLabels`_, _`RegisterValues`_ |
 | `auth/complete-name-dialog` | `CompleteNameDialog`, `DEFAULT_COMPLETE_NAME_LABELS`, _`CompleteNameDialogProps`_, _`CompleteNameLabels`_, _`CompleteNameValues`_ |
 | `auth/email-tag` | `taggedEmail` |
-| `auth/auth-errors` | `authErrorCode`, `isAuthError`, `isBillingError`, `isRateLimited`, `retryAfterSeconds`, _`AccountErrorCode`_, _`AuthErrorCode`_, _`BillingErrorCode`_, _`DemoErrorCode`_, _`KitErrorCode`_ |
+| `auth/auth-errors` | `authErrorCode`, `billingRefusalText`, `isAuthError`, `isBillingError`, `isRateLimited`, `retryAfterSeconds`, _`AccountErrorCode`_, _`AuthErrorCode`_, _`BillingErrorCode`_, _`BillingRefusalTextOptions`_, _`DemoErrorCode`_, _`KitErrorCode`_ |
 | `auth/forgot-password-form` | `DEFAULT_FORGOT_PASSWORD_LABELS`, `ForgotPasswordForm`, _`ForgotPasswordFormProps`_, _`ForgotPasswordLabels`_ |
 | `auth/reset-password-form` | `DEFAULT_RESET_PASSWORD_LABELS`, `ResetPasswordForm`, _`ResetPasswordCheck`_, _`ResetPasswordFormProps`_, _`ResetPasswordLabels`_, _`ResetPasswordResult`_, _`ResetPasswordValues`_ |
 | `auth/verify-email` | `DEFAULT_VERIFY_EMAIL_LABELS`, `EmailVerificationBanner`, `VerifyEmailStatus`, _`EmailVerificationBannerProps`_, _`VerifyEmailFailure`_, _`VerifyEmailLabels`_, _`VerifyEmailStatusProps`_ |

package/dist/account/delete-account-setting.d.ts

@@ -109,8 +109,9 @@ export interface DeleteAccountSettingProps extends Omit<ComponentPropsWithRef<"d
  * and the password. They are the tile's own {@link TypedConfirmField} and
  * {@link CurrentPasswordInput}, drawn in its fields slot and held by
  * `confirmDisabledReason` with the tile's own sentences, rather than its built-in
- * `phrase` / `requirePassword` — those have no error of their own, and a wrong password
- * belongs under the password. Its consequences are the app's list, plus
+ * `phrase` / `requirePassword` — those share ONE `error` (0.54, under the password), and
+ * this card's refusals go to two fields: a wrong password under the password, a
+ * mismatched address under the address. Its consequences are the app's list, plus
  * Kurvenschmiede's hand-over line (`handOverCount`, §2.7: shared work goes to an
  * administrator, never a refusal). The typed address goes to `onRequest` as typed, so
  * the server re-checks it (`confirm_email_matches`).

package/dist/account/delete-account-setting.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/account/delete-account-setting.tsx"],"sourcesContent":["import { isValidElement, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, ReactNode } from \"react\";\nimport { UserX } from \"lucide-react\";\n\nimport { useKitLabels, useKitLocale, type LabelOverride } from \"../i18n/kit-labels\";\nimport { cn } from \"../lib/cn\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { hasContent } from \"../lib/presence\";\nimport {\n  CurrentPasswordInput,\n  DangerConfirm,\n  DEFAULT_DANGER_CONFIRM_LABELS,\n  TypedConfirmField,\n  typedMatches,\n} from \"../components/danger-confirm\";\nimport type { DangerConsequence } from \"../components/danger-confirm\";\nimport { Card } from \"../components/card\";\nimport { authErrorCode, isRateLimited, retryAfterSeconds } from \"../auth/auth-errors\";\nimport { useFocusWhen } from \"../auth/status-parts\";\nimport { CARD_DESCRIPTION_CLASS, refusalCompanies, settle, useMounted } from \"./account-parts\";\nimport { SettingsCardTitle } from \"../settings/settings-heading\";\nimport { COMMIT_EXCEPT_BILLING } from \"../components/write-lock\";\nimport { DEFAULT_DELETE_ACCOUNT_LABELS } from \"./delete-account-setting-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/**\n * Every string {@link DeleteAccountSetting} renders — the `deleteAccount` namespace of\n * `<UiKitProvider labels>`, overridable per instance through `labels`. The confirm's\n * Cancel, \"Password\" and \"Type … to confirm\" are `dangerConfirm`'s.\n */\nexport interface DeleteAccountLabels {\n  /** The card's title. */\n  title: string;\n  /** Mode `after_days`, given the days: what happens and when. */\n  afterDays: (days: number) => string;\n  /** Mode `operator`: what happens, and who erases it. */\n  operator: string;\n  /** The button that opens the confirm. */\n  arm: string;\n  /** The confirm's warning, over the consequences. */\n  prompt: string;\n  /** The line in the consequences when `handOverCount` is given (Kurvenschmiede, §2.7),\n   *  given the count. */\n  handOver: (count: number) => string;\n  /** The button that sends it. */\n  confirm: string;\n  /** Said once the request is accepted — the app signs out next. */\n  done: string;\n  /** `password_incorrect` (server-kit's `400` for a wrong current password), under the\n   *  password field. */\n  wrongPassword: string;\n  /** `confirmation_mismatch` — the server did not take the typed address as the\n   *  account's — under the address field. */\n  confirmationMismatch: string;\n  /** `last_admin` — the account is the last active admin. */\n  lastAdmin: string;\n  /** `last_admin` naming the companies (kastlan checks per company), given them as one\n   *  list in the reader's language (\"Example AG and Sample GmbH\"). */\n  lastAdminOf: (companies: string) => string;\n  /** `household_has_members` — keksdose's guard (§6.4). */\n  householdHasMembers: string;\n  /** A request was throttled — HTTP 429 — given its `Retry-After` wait in seconds, or\n   *  `undefined` without one. */\n  rateLimited: (seconds?: number) => string;\n  /** Any other failure. */\n  failed: string;\n}\n\n// Defined in ./delete-account-setting-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_DELETE_ACCOUNT_LABELS };\n\n/* ── Props ───────────────────────────────────────────────────────────────── */\n\n/** What happens after the deactivation (§2.1, §6.4) — the app's setting. */\nexport type DeletionMode = \"after_days\" | \"operator\";\n\n/** What {@link DeleteAccountSettingProps.onRequest} gets: the `POST /auth/me/deletion`\n *  body. */\nexport interface DeleteAccountValues {\n  /** As typed. */\n  password: string;\n  /** The address as TYPED, trimmed — the server re-checks it against the account\n   *  (server-kit's `confirm_email_matches`), as keksdose's admin actions do. */\n  confirmEmail: string;\n}\n\n/** One line of the consequences: a node of the app's, or a {@link DangerConsequence}\n *  for a key of its own and the `severe` mark. */\nexport type DeleteAccountConsequence = ReactNode | DangerConsequence;\n\nexport interface DeleteAccountSettingProps extends Omit<ComponentPropsWithRef<\"div\">, \"children\"> {\n  /** The account's address — the text to type. */\n  email: string;\n  /** `\"after_days\"` (keksdose, Kurvenschmiede: erased by a scheduled job) or\n   *  `\"operator\"` (kastlan: company data is involved, an operator erases it). */\n  mode: DeletionMode;\n  /** With `after_days`: how many. Default 30 (§2.1). */\n  days?: number;\n  /**\n   * What goes, in the app's words (§6.4: \"the app's own list\") — derived from the\n   * account's own facts where it can be: keksdose's \"Budget X will be deleted; its 2\n   * guests are told\", rather than the worst case for everybody.\n   */\n  consequences?: readonly DeleteAccountConsequence[];\n  /** Kurvenschmiede (§2.7): how many owned items others can see — they pass to the\n   *  first active admin at erasure. A line of its own in the consequences; 0 or left\n   *  out, none. */\n  handOverCount?: number;\n  /**\n   * The confirm was answered: send `POST /auth/me/deletion {password, confirm_email}`.\n   * Resolve once it is accepted — the card says \"You are being signed out\" — and then\n   * sign the user out: the server ended every session with the deactivation. Reject\n   * with the client's error: `password_incorrect` under the password,\n   * `confirmation_mismatch` under the address, `last_admin` (with kastlan's\n   * `companies`) and `household_has_members` above the buttons, a 429 as\n   * `rateLimited`, anything else (a demo account's 403, an app's own code) through\n   * `describeError`, else `failed`. The confirm stays open with what was typed, for a\n   * retry.\n   */\n  onRequest: (values: DeleteAccountValues) => Promise<unknown> | void;\n  /** The app's own words for a failure, or `undefined` for the kit's. Asked first, for\n   *  every failure — kastlan's `last_admin` names the companies. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  labels?: LabelOverride<DeleteAccountLabels>;\n}\n\n/** Whether an item is a `{ text }` line rather than a node — a React element is an\n *  object too, and so would a `{ text }` lookalike be, so the element test comes first. */\nfunction isConsequence(item: DeleteAccountConsequence): item is DangerConsequence {\n  return typeof item === \"object\" && item !== null && !isValidElement(item) && \"text\" in item;\n}\n\n/**\n * Deleting one's own account (docs/user-admin-harmonization.md §6.4, §2.1): what it does,\n * the password, the typed address — then the app signs out.\n *\n * **Two stages, said before the button.** The request DEACTIVATES the account at once\n * (no sign-in, every session ended, marked for deletion); the erasure follows per the\n * app's `mode` — \"erased for good 30 days later\" (`after_days`, a scheduled job) or \"an\n * operator will erase it\" (`operator`, kastlan, where company records are involved).\n * The sentence is under the title, so it is read before anything is pressed.\n *\n * **The confirm is a {@link DangerConfirm}** with the two guards of every \"type the\n * address\" rule in the apps: the address typed (compared caseless, as in all of them)\n * and the password. They are the tile's own {@link TypedConfirmField} and\n * {@link CurrentPasswordInput}, drawn in its fields slot and held by\n * `confirmDisabledReason` with the tile's own sentences, rather than its built-in\n * `phrase` / `requirePassword` — those have no error of their own, and a wrong password\n * belongs under the password. Its consequences are the app's list, plus\n * Kurvenschmiede's hand-over line (`handOverCount`, §2.7: shared work goes to an\n * administrator, never a refusal). The typed address goes to `onRequest` as typed, so\n * the server re-checks it (`confirm_email_matches`).\n *\n * **Refusals** (§6.4) are read by code ({@link authErrorCode}): `password_incorrect` (a\n * `400`, so an app's 401 handling never signs the person out over a typo) under the\n * password, `confirmation_mismatch` under the address, `last_admin` — naming kastlan's\n * companies when the answer lists them — and keksdose's `household_has_members` guard\n * above the buttons; a 429; and the rest in the app's words. The confirm stays open with\n * what was typed, for a retry; Cancel wipes it.\n *\n * **After success** the card says the account is deactivated and the person is being\n * signed out — the app's to do, since the kit sends nothing (auth §8).\n *\n * **Under a write lock** the confirm is a `commit` exempt from billing\n * (`COMMIT_EXCEPT_BILLING`, 0.33): leaving never depends on paying\n * (docs/billing-harmonization.md decision 14, §12.36); a demo's lock still holds it.\n */\nexport function DeleteAccountSetting({\n  email,\n  mode,\n  days = 30,\n  consequences,\n  handOverCount,\n  onRequest,\n  describeError,\n  labels: labelsProp,\n  className,\n  ...rest\n}: DeleteAccountSettingProps) {\n  const labels = useKitLabels(\"deleteAccount\", DEFAULT_DELETE_ACCOUNT_LABELS, labelsProp);\n  // The guards speak the tile's words, so \"Type “…” to confirm\" and \"Enter your password\n  // to confirm\" are translated once, in `dangerConfirm`.\n  const guardLabels = useKitLabels(\"dangerConfirm\", DEFAULT_DANGER_CONFIRM_LABELS);\n  const locale = useKitLocale();\n  const [typed, setTyped] = useState(\"\");\n  const [password, setPassword] = useState(\"\");\n  const [busy, setBusy] = useState(false);\n  const [fieldError, setFieldError] = useState<\"email\" | \"password\" | null>(null);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const [done, setDone] = useState(false);\n  const mounted = useMounted();\n  const typedRef = useRef<HTMLInputElement>(null);\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  // The tile went with the press; the answer takes the focus, so it is read out.\n  useFocusWhen(done, doneRef);\n\n  const modeSentence = mode === \"operator\" ? labels.operator : labels.afterDays(days);\n\n  const lines: (string | DangerConsequence)[] = (consequences ?? [])\n    // `{cond && \"…\"}` lines that came out empty are no lines.\n    .filter((item) => item !== null && item !== undefined && item !== false && item !== \"\")\n    .map((item, index) => (isConsequence(item) ? item : { key: `app-${index}`, text: item }));\n  if (handOverCount !== undefined && handOverCount > 0) {\n    lines.push({ key: \"hand-over\", text: labels.handOver(handOverCount) });\n  }\n\n  // The first guard still open, in the order the fields are drawn — DangerConfirm's rule.\n  const held = !typedMatches(typed, email, \"caseless\")\n    ? typeof guardLabels.needsPhrase === \"function\"\n      ? guardLabels.needsPhrase(email)\n      : guardLabels.needsPhrase\n    : password === \"\"\n      ? guardLabels.needsPassword\n      : undefined;\n\n  const present = (error: unknown) => {\n    const own = describeError?.(error);\n    if (hasContent(own)) {\n      setFailure(own);\n      return;\n    }\n    if (isRateLimited(error)) {\n      setFailure(labels.rateLimited(retryAfterSeconds(error)));\n      return;\n    }\n    const code = authErrorCode(error);\n    // `invalid_credentials` too, for a server that answered a wrong password so before\n    // server-kit 0.4.0 named `password_incorrect`.\n    if (code === \"password_incorrect\" || code === \"invalid_credentials\") {\n      setFieldError(\"password\");\n      passwordRef.current?.focus();\n      return;\n    }\n    if (code === \"confirmation_mismatch\" || code === \"confirmation_required\") {\n      setFieldError(\"email\");\n      typedRef.current?.focus();\n      return;\n    }\n    if (code === \"last_admin\") {\n      const companies = refusalCompanies(error);\n      setFailure(\n        companies\n          ? labels.lastAdminOf(new Intl.ListFormat(locale, { type: \"conjunction\" }).format(companies))\n          : labels.lastAdmin,\n      );\n      return;\n    }\n    setFailure(code === \"household_has_members\" ? labels.householdHasMembers : labels.failed);\n  };\n\n  const confirm = () => {\n    setFailure(null);\n    setFieldError(null);\n    setBusy(true);\n    const values: DeleteAccountValues = { password, confirmEmail: typed.trim() };\n    return settle(() => onRequest(values)).then(\n      () => {\n        if (!mounted.current) return;\n        setBusy(false);\n        setDone(true);\n      },\n      (error: unknown) => {\n        if (mounted.current) {\n          setBusy(false);\n          present(error);\n        }\n        // Rejected again, so DangerConfirm stays armed with what was typed.\n        throw error;\n      },\n    );\n  };\n\n  // A disarmed tile holds no password — DangerConfirm's own rule, for the fields it\n  // does not own here.\n  const disarmed = (armed: boolean) => {\n    if (armed) return;\n    setTyped(\"\");\n    setPassword(\"\");\n    setFieldError(null);\n    setFailure(null);\n  };\n\n  return (\n    <Card {...rest} data-state={done ? \"done\" : \"form\"} tone=\"danger\" className={cn(\"p-4 space-y-3\", className)}>\n      <div>\n        <SettingsCardTitle>{labels.title}</SettingsCardTitle>\n        <div className={CARD_DESCRIPTION_CLASS}>{modeSentence}</div>\n      </div>\n      {done ? (\n        <div ref={doneRef} tabIndex={-1} role=\"status\" className=\"flex items-start gap-2 text-sm outline-none\">\n          <UserX aria-hidden className=\"mt-0.5 size-4 shrink-0 text-muted\" />\n          <span>{labels.done}</span>\n        </div>\n      ) : (\n        <>\n          <DangerConfirm\n            commit={COMMIT_EXCEPT_BILLING}\n            armLabel={labels.arm}\n            prompt={labels.prompt}\n            consequences={lines}\n            confirmLabel={labels.confirm}\n            confirmDisabledReason={held}\n            busy={busy}\n            onArmedChange={disarmed}\n            onConfirm={confirm}\n          >\n            <TypedConfirmField\n              ref={typedRef}\n              target={email}\n              match=\"caseless\"\n              value={typed}\n              onValueChange={(next) => {\n                setTyped(next);\n                if (fieldError === \"email\") setFieldError(null);\n              }}\n              error={fieldError === \"email\" ? labels.confirmationMismatch : undefined}\n              busy={busy}\n            />\n            <CurrentPasswordInput\n              ref={passwordRef}\n              value={password}\n              onValueChange={(next) => {\n                setPassword(next);\n                if (fieldError === \"password\") setFieldError(null);\n              }}\n              error={fieldError === \"password\" ? labels.wrongPassword : undefined}\n              busy={busy}\n            />\n          </DangerConfirm>\n          {hasContent(failure) && (\n            <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n              {failure}\n            </AlertBanner>\n          )}\n        </>\n      )}\n    </Card>\n  );\n}\n"],"mappings":";AA8RM,SAUE,UATA,KADF;AA9RN,SAAS,gBAAgB,QAAQ,gBAAgB;AAEjD,SAAS,aAAa;AAEtB,SAAS,cAAc,oBAAwC;AAC/D,SAAS,UAAU;AACnB,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,YAAY;AACrB,SAAS,eAAe,eAAe,yBAAyB;AAChE,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,kBAAkB,QAAQ,kBAAkB;AAC7E,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,qCAAqC;AA2G9C,SAAS,cAAc,MAA2D;AAChF,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,eAAe,IAAI,KAAK,UAAU;AACzF;AAqCO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA8B;AAC5B,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,cAAc,aAAa,iBAAiB,6BAA6B;AAC/E,QAAM,SAAS,aAAa;AAC5B,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,CAAC,YAAY,aAAa,IAAI,SAAsC,IAAI;AAC9E,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,WAAW;AAC3B,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAE3C,eAAa,MAAM,OAAO;AAE1B,QAAM,eAAe,SAAS,aAAa,OAAO,WAAW,OAAO,UAAU,IAAI;AAElF,QAAM,SAAyC,gBAAgB,CAAC,GAE7D,OAAO,CAAC,SAAS,SAAS,QAAQ,SAAS,UAAa,SAAS,SAAS,SAAS,EAAE,EACrF,IAAI,CAAC,MAAM,UAAW,cAAc,IAAI,IAAI,OAAO,EAAE,KAAK,OAAO,KAAK,IAAI,MAAM,KAAK,CAAE;AAC1F,MAAI,kBAAkB,UAAa,gBAAgB,GAAG;AACpD,UAAM,KAAK,EAAE,KAAK,aAAa,MAAM,OAAO,SAAS,aAAa,EAAE,CAAC;AAAA,EACvE;AAGA,QAAM,OAAO,CAAC,aAAa,OAAO,OAAO,UAAU,IAC/C,OAAO,YAAY,gBAAgB,aACjC,YAAY,YAAY,KAAK,IAC7B,YAAY,cACd,aAAa,KACX,YAAY,gBACZ;AAEN,QAAM,UAAU,CAAC,UAAmB;AAClC,UAAM,MAAM,gBAAgB,KAAK;AACjC,QAAI,WAAW,GAAG,GAAG;AACnB,iBAAW,GAAG;AACd;AAAA,IACF;AACA,QAAI,cAAc,KAAK,GAAG;AACxB,iBAAW,OAAO,YAAY,kBAAkB,KAAK,CAAC,CAAC;AACvD;AAAA,IACF;AACA,UAAM,OAAO,cAAc,KAAK;AAGhC,QAAI,SAAS,wBAAwB,SAAS,uBAAuB;AACnE,oBAAc,UAAU;AACxB,kBAAY,SAAS,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,SAAS,2BAA2B,SAAS,yBAAyB;AACxE,oBAAc,OAAO;AACrB,eAAS,SAAS,MAAM;AACxB;AAAA,IACF;AACA,QAAI,SAAS,cAAc;AACzB,YAAM,YAAY,iBAAiB,KAAK;AACxC;AAAA,QACE,YACI,OAAO,YAAY,IAAI,KAAK,WAAW,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,OAAO,SAAS,CAAC,IACzF,OAAO;AAAA,MACb;AACA;AAAA,IACF;AACA,eAAW,SAAS,0BAA0B,OAAO,sBAAsB,OAAO,MAAM;AAAA,EAC1F;AAEA,QAAM,UAAU,MAAM;AACpB,eAAW,IAAI;AACf,kBAAc,IAAI;AAClB,YAAQ,IAAI;AACZ,UAAM,SAA8B,EAAE,UAAU,cAAc,MAAM,KAAK,EAAE;AAC3E,WAAO,OAAO,MAAM,UAAU,MAAM,CAAC,EAAE;AAAA,MACrC,MAAM;AACJ,YAAI,CAAC,QAAQ,QAAS;AACtB,gBAAQ,KAAK;AACb,gBAAQ,IAAI;AAAA,MACd;AAAA,MACA,CAAC,UAAmB;AAClB,YAAI,QAAQ,SAAS;AACnB,kBAAQ,KAAK;AACb,kBAAQ,KAAK;AAAA,QACf;AAEA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,QAAM,WAAW,CAAC,UAAmB;AACnC,QAAI,MAAO;AACX,aAAS,EAAE;AACX,gBAAY,EAAE;AACd,kBAAc,IAAI;AAClB,eAAW,IAAI;AAAA,EACjB;AAEA,SACE,qBAAC,QAAM,GAAG,MAAM,cAAY,OAAO,SAAS,QAAQ,MAAK,UAAS,WAAW,GAAG,iBAAiB,SAAS,GACxG;AAAA,yBAAC,SACC;AAAA,0BAAC,qBAAmB,iBAAO,OAAM;AAAA,MACjC,oBAAC,SAAI,WAAW,wBAAyB,wBAAa;AAAA,OACxD;AAAA,IACC,OACC,qBAAC,SAAI,KAAK,SAAS,UAAU,IAAI,MAAK,UAAS,WAAU,+CACvD;AAAA,0BAAC,SAAM,eAAW,MAAC,WAAU,qCAAoC;AAAA,MACjE,oBAAC,UAAM,iBAAO,MAAK;AAAA,OACrB,IAEA,iCACE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,QAAQ;AAAA,UACR,UAAU,OAAO;AAAA,UACjB,QAAQ,OAAO;AAAA,UACf,cAAc;AAAA,UACd,cAAc,OAAO;AAAA,UACrB,uBAAuB;AAAA,UACvB;AAAA,UACA,eAAe;AAAA,UACf,WAAW;AAAA,UAEX;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,QAAQ;AAAA,gBACR,OAAM;AAAA,gBACN,OAAO;AAAA,gBACP,eAAe,CAAC,SAAS;AACvB,2BAAS,IAAI;AACb,sBAAI,eAAe,QAAS,eAAc,IAAI;AAAA,gBAChD;AAAA,gBACA,OAAO,eAAe,UAAU,OAAO,uBAAuB;AAAA,gBAC9D;AAAA;AAAA,YACF;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,OAAO;AAAA,gBACP,eAAe,CAAC,SAAS;AACvB,8BAAY,IAAI;AAChB,sBAAI,eAAe,WAAY,eAAc,IAAI;AAAA,gBACnD;AAAA,gBACA,OAAO,eAAe,aAAa,OAAO,gBAAgB;AAAA,gBAC1D;AAAA;AAAA,YACF;AAAA;AAAA;AAAA,MACF;AAAA,MACC,WAAW,OAAO,KACjB,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,OAEJ;AAAA,KAEJ;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/account/delete-account-setting.tsx"],"sourcesContent":["import { isValidElement, useRef, useState } from \"react\";\nimport type { ComponentPropsWithRef, ReactNode } from \"react\";\nimport { UserX } from \"lucide-react\";\n\nimport { useKitLabels, useKitLocale, type LabelOverride } from \"../i18n/kit-labels\";\nimport { cn } from \"../lib/cn\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { hasContent } from \"../lib/presence\";\nimport {\n  CurrentPasswordInput,\n  DangerConfirm,\n  DEFAULT_DANGER_CONFIRM_LABELS,\n  TypedConfirmField,\n  typedMatches,\n} from \"../components/danger-confirm\";\nimport type { DangerConsequence } from \"../components/danger-confirm\";\nimport { Card } from \"../components/card\";\nimport { authErrorCode, isRateLimited, retryAfterSeconds } from \"../auth/auth-errors\";\nimport { useFocusWhen } from \"../auth/status-parts\";\nimport { CARD_DESCRIPTION_CLASS, refusalCompanies, settle, useMounted } from \"./account-parts\";\nimport { SettingsCardTitle } from \"../settings/settings-heading\";\nimport { COMMIT_EXCEPT_BILLING } from \"../components/write-lock\";\nimport { DEFAULT_DELETE_ACCOUNT_LABELS } from \"./delete-account-setting-labels\";\n\n/* ── Labels ──────────────────────────────────────────────────────────────── */\n\n/**\n * Every string {@link DeleteAccountSetting} renders — the `deleteAccount` namespace of\n * `<UiKitProvider labels>`, overridable per instance through `labels`. The confirm's\n * Cancel, \"Password\" and \"Type … to confirm\" are `dangerConfirm`'s.\n */\nexport interface DeleteAccountLabels {\n  /** The card's title. */\n  title: string;\n  /** Mode `after_days`, given the days: what happens and when. */\n  afterDays: (days: number) => string;\n  /** Mode `operator`: what happens, and who erases it. */\n  operator: string;\n  /** The button that opens the confirm. */\n  arm: string;\n  /** The confirm's warning, over the consequences. */\n  prompt: string;\n  /** The line in the consequences when `handOverCount` is given (Kurvenschmiede, §2.7),\n   *  given the count. */\n  handOver: (count: number) => string;\n  /** The button that sends it. */\n  confirm: string;\n  /** Said once the request is accepted — the app signs out next. */\n  done: string;\n  /** `password_incorrect` (server-kit's `400` for a wrong current password), under the\n   *  password field. */\n  wrongPassword: string;\n  /** `confirmation_mismatch` — the server did not take the typed address as the\n   *  account's — under the address field. */\n  confirmationMismatch: string;\n  /** `last_admin` — the account is the last active admin. */\n  lastAdmin: string;\n  /** `last_admin` naming the companies (kastlan checks per company), given them as one\n   *  list in the reader's language (\"Example AG and Sample GmbH\"). */\n  lastAdminOf: (companies: string) => string;\n  /** `household_has_members` — keksdose's guard (§6.4). */\n  householdHasMembers: string;\n  /** A request was throttled — HTTP 429 — given its `Retry-After` wait in seconds, or\n   *  `undefined` without one. */\n  rateLimited: (seconds?: number) => string;\n  /** Any other failure. */\n  failed: string;\n}\n\n// Defined in ./delete-account-setting-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_DELETE_ACCOUNT_LABELS };\n\n/* ── Props ───────────────────────────────────────────────────────────────── */\n\n/** What happens after the deactivation (§2.1, §6.4) — the app's setting. */\nexport type DeletionMode = \"after_days\" | \"operator\";\n\n/** What {@link DeleteAccountSettingProps.onRequest} gets: the `POST /auth/me/deletion`\n *  body. */\nexport interface DeleteAccountValues {\n  /** As typed. */\n  password: string;\n  /** The address as TYPED, trimmed — the server re-checks it against the account\n   *  (server-kit's `confirm_email_matches`), as keksdose's admin actions do. */\n  confirmEmail: string;\n}\n\n/** One line of the consequences: a node of the app's, or a {@link DangerConsequence}\n *  for a key of its own and the `severe` mark. */\nexport type DeleteAccountConsequence = ReactNode | DangerConsequence;\n\nexport interface DeleteAccountSettingProps extends Omit<ComponentPropsWithRef<\"div\">, \"children\"> {\n  /** The account's address — the text to type. */\n  email: string;\n  /** `\"after_days\"` (keksdose, Kurvenschmiede: erased by a scheduled job) or\n   *  `\"operator\"` (kastlan: company data is involved, an operator erases it). */\n  mode: DeletionMode;\n  /** With `after_days`: how many. Default 30 (§2.1). */\n  days?: number;\n  /**\n   * What goes, in the app's words (§6.4: \"the app's own list\") — derived from the\n   * account's own facts where it can be: keksdose's \"Budget X will be deleted; its 2\n   * guests are told\", rather than the worst case for everybody.\n   */\n  consequences?: readonly DeleteAccountConsequence[];\n  /** Kurvenschmiede (§2.7): how many owned items others can see — they pass to the\n   *  first active admin at erasure. A line of its own in the consequences; 0 or left\n   *  out, none. */\n  handOverCount?: number;\n  /**\n   * The confirm was answered: send `POST /auth/me/deletion {password, confirm_email}`.\n   * Resolve once it is accepted — the card says \"You are being signed out\" — and then\n   * sign the user out: the server ended every session with the deactivation. Reject\n   * with the client's error: `password_incorrect` under the password,\n   * `confirmation_mismatch` under the address, `last_admin` (with kastlan's\n   * `companies`) and `household_has_members` above the buttons, a 429 as\n   * `rateLimited`, anything else (a demo account's 403, an app's own code) through\n   * `describeError`, else `failed`. The confirm stays open with what was typed, for a\n   * retry.\n   */\n  onRequest: (values: DeleteAccountValues) => Promise<unknown> | void;\n  /** The app's own words for a failure, or `undefined` for the kit's. Asked first, for\n   *  every failure — kastlan's `last_admin` names the companies. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  labels?: LabelOverride<DeleteAccountLabels>;\n}\n\n/** Whether an item is a `{ text }` line rather than a node — a React element is an\n *  object too, and so would a `{ text }` lookalike be, so the element test comes first. */\nfunction isConsequence(item: DeleteAccountConsequence): item is DangerConsequence {\n  return typeof item === \"object\" && item !== null && !isValidElement(item) && \"text\" in item;\n}\n\n/**\n * Deleting one's own account (docs/user-admin-harmonization.md §6.4, §2.1): what it does,\n * the password, the typed address — then the app signs out.\n *\n * **Two stages, said before the button.** The request DEACTIVATES the account at once\n * (no sign-in, every session ended, marked for deletion); the erasure follows per the\n * app's `mode` — \"erased for good 30 days later\" (`after_days`, a scheduled job) or \"an\n * operator will erase it\" (`operator`, kastlan, where company records are involved).\n * The sentence is under the title, so it is read before anything is pressed.\n *\n * **The confirm is a {@link DangerConfirm}** with the two guards of every \"type the\n * address\" rule in the apps: the address typed (compared caseless, as in all of them)\n * and the password. They are the tile's own {@link TypedConfirmField} and\n * {@link CurrentPasswordInput}, drawn in its fields slot and held by\n * `confirmDisabledReason` with the tile's own sentences, rather than its built-in\n * `phrase` / `requirePassword` — those share ONE `error` (0.54, under the password), and\n * this card's refusals go to two fields: a wrong password under the password, a\n * mismatched address under the address. Its consequences are the app's list, plus\n * Kurvenschmiede's hand-over line (`handOverCount`, §2.7: shared work goes to an\n * administrator, never a refusal). The typed address goes to `onRequest` as typed, so\n * the server re-checks it (`confirm_email_matches`).\n *\n * **Refusals** (§6.4) are read by code ({@link authErrorCode}): `password_incorrect` (a\n * `400`, so an app's 401 handling never signs the person out over a typo) under the\n * password, `confirmation_mismatch` under the address, `last_admin` — naming kastlan's\n * companies when the answer lists them — and keksdose's `household_has_members` guard\n * above the buttons; a 429; and the rest in the app's words. The confirm stays open with\n * what was typed, for a retry; Cancel wipes it.\n *\n * **After success** the card says the account is deactivated and the person is being\n * signed out — the app's to do, since the kit sends nothing (auth §8).\n *\n * **Under a write lock** the confirm is a `commit` exempt from billing\n * (`COMMIT_EXCEPT_BILLING`, 0.33): leaving never depends on paying\n * (docs/billing-harmonization.md decision 14, §12.36); a demo's lock still holds it.\n */\nexport function DeleteAccountSetting({\n  email,\n  mode,\n  days = 30,\n  consequences,\n  handOverCount,\n  onRequest,\n  describeError,\n  labels: labelsProp,\n  className,\n  ...rest\n}: DeleteAccountSettingProps) {\n  const labels = useKitLabels(\"deleteAccount\", DEFAULT_DELETE_ACCOUNT_LABELS, labelsProp);\n  // The guards speak the tile's words, so \"Type “…” to confirm\" and \"Enter your password\n  // to confirm\" are translated once, in `dangerConfirm`.\n  const guardLabels = useKitLabels(\"dangerConfirm\", DEFAULT_DANGER_CONFIRM_LABELS);\n  const locale = useKitLocale();\n  const [typed, setTyped] = useState(\"\");\n  const [password, setPassword] = useState(\"\");\n  const [busy, setBusy] = useState(false);\n  const [fieldError, setFieldError] = useState<\"email\" | \"password\" | null>(null);\n  const [failure, setFailure] = useState<ReactNode>(null);\n  const [done, setDone] = useState(false);\n  const mounted = useMounted();\n  const typedRef = useRef<HTMLInputElement>(null);\n  const passwordRef = useRef<HTMLInputElement>(null);\n  const doneRef = useRef<HTMLDivElement>(null);\n  // The tile went with the press; the answer takes the focus, so it is read out.\n  useFocusWhen(done, doneRef);\n\n  const modeSentence = mode === \"operator\" ? labels.operator : labels.afterDays(days);\n\n  const lines: (string | DangerConsequence)[] = (consequences ?? [])\n    // `{cond && \"…\"}` lines that came out empty are no lines.\n    .filter((item) => item !== null && item !== undefined && item !== false && item !== \"\")\n    .map((item, index) => (isConsequence(item) ? item : { key: `app-${index}`, text: item }));\n  if (handOverCount !== undefined && handOverCount > 0) {\n    lines.push({ key: \"hand-over\", text: labels.handOver(handOverCount) });\n  }\n\n  // The first guard still open, in the order the fields are drawn — DangerConfirm's rule.\n  const held = !typedMatches(typed, email, \"caseless\")\n    ? typeof guardLabels.needsPhrase === \"function\"\n      ? guardLabels.needsPhrase(email)\n      : guardLabels.needsPhrase\n    : password === \"\"\n      ? guardLabels.needsPassword\n      : undefined;\n\n  const present = (error: unknown) => {\n    const own = describeError?.(error);\n    if (hasContent(own)) {\n      setFailure(own);\n      return;\n    }\n    if (isRateLimited(error)) {\n      setFailure(labels.rateLimited(retryAfterSeconds(error)));\n      return;\n    }\n    const code = authErrorCode(error);\n    // `invalid_credentials` too, for a server that answered a wrong password so before\n    // server-kit 0.4.0 named `password_incorrect`.\n    if (code === \"password_incorrect\" || code === \"invalid_credentials\") {\n      setFieldError(\"password\");\n      passwordRef.current?.focus();\n      return;\n    }\n    if (code === \"confirmation_mismatch\" || code === \"confirmation_required\") {\n      setFieldError(\"email\");\n      typedRef.current?.focus();\n      return;\n    }\n    if (code === \"last_admin\") {\n      const companies = refusalCompanies(error);\n      setFailure(\n        companies\n          ? labels.lastAdminOf(new Intl.ListFormat(locale, { type: \"conjunction\" }).format(companies))\n          : labels.lastAdmin,\n      );\n      return;\n    }\n    setFailure(code === \"household_has_members\" ? labels.householdHasMembers : labels.failed);\n  };\n\n  const confirm = () => {\n    setFailure(null);\n    setFieldError(null);\n    setBusy(true);\n    const values: DeleteAccountValues = { password, confirmEmail: typed.trim() };\n    return settle(() => onRequest(values)).then(\n      () => {\n        if (!mounted.current) return;\n        setBusy(false);\n        setDone(true);\n      },\n      (error: unknown) => {\n        if (mounted.current) {\n          setBusy(false);\n          present(error);\n        }\n        // Rejected again, so DangerConfirm stays armed with what was typed.\n        throw error;\n      },\n    );\n  };\n\n  // A disarmed tile holds no password — DangerConfirm's own rule, for the fields it\n  // does not own here.\n  const disarmed = (armed: boolean) => {\n    if (armed) return;\n    setTyped(\"\");\n    setPassword(\"\");\n    setFieldError(null);\n    setFailure(null);\n  };\n\n  return (\n    <Card {...rest} data-state={done ? \"done\" : \"form\"} tone=\"danger\" className={cn(\"p-4 space-y-3\", className)}>\n      <div>\n        <SettingsCardTitle>{labels.title}</SettingsCardTitle>\n        <div className={CARD_DESCRIPTION_CLASS}>{modeSentence}</div>\n      </div>\n      {done ? (\n        <div ref={doneRef} tabIndex={-1} role=\"status\" className=\"flex items-start gap-2 text-sm outline-none\">\n          <UserX aria-hidden className=\"mt-0.5 size-4 shrink-0 text-muted\" />\n          <span>{labels.done}</span>\n        </div>\n      ) : (\n        <>\n          <DangerConfirm\n            commit={COMMIT_EXCEPT_BILLING}\n            armLabel={labels.arm}\n            prompt={labels.prompt}\n            consequences={lines}\n            confirmLabel={labels.confirm}\n            confirmDisabledReason={held}\n            busy={busy}\n            onArmedChange={disarmed}\n            onConfirm={confirm}\n          >\n            <TypedConfirmField\n              ref={typedRef}\n              target={email}\n              match=\"caseless\"\n              value={typed}\n              onValueChange={(next) => {\n                setTyped(next);\n                if (fieldError === \"email\") setFieldError(null);\n              }}\n              error={fieldError === \"email\" ? labels.confirmationMismatch : undefined}\n              busy={busy}\n            />\n            <CurrentPasswordInput\n              ref={passwordRef}\n              value={password}\n              onValueChange={(next) => {\n                setPassword(next);\n                if (fieldError === \"password\") setFieldError(null);\n              }}\n              error={fieldError === \"password\" ? labels.wrongPassword : undefined}\n              busy={busy}\n            />\n          </DangerConfirm>\n          {hasContent(failure) && (\n            <AlertBanner tone=\"danger\" size=\"sm\" role=\"alert\">\n              {failure}\n            </AlertBanner>\n          )}\n        </>\n      )}\n    </Card>\n  );\n}\n"],"mappings":";AA+RM,SAUE,UATA,KADF;AA/RN,SAAS,gBAAgB,QAAQ,gBAAgB;AAEjD,SAAS,aAAa;AAEtB,SAAS,cAAc,oBAAwC;AAC/D,SAAS,UAAU;AACnB,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,YAAY;AACrB,SAAS,eAAe,eAAe,yBAAyB;AAChE,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,kBAAkB,QAAQ,kBAAkB;AAC7E,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,qCAAqC;AA2G9C,SAAS,cAAc,MAA2D;AAChF,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,eAAe,IAAI,KAAK,UAAU;AACzF;AAsCO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA8B;AAC5B,QAAM,SAAS,aAAa,iBAAiB,+BAA+B,UAAU;AAGtF,QAAM,cAAc,aAAa,iBAAiB,6BAA6B;AAC/E,QAAM,SAAS,aAAa;AAC5B,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,CAAC,YAAY,aAAa,IAAI,SAAsC,IAAI;AAC9E,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoB,IAAI;AACtD,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,WAAW;AAC3B,QAAM,WAAW,OAAyB,IAAI;AAC9C,QAAM,cAAc,OAAyB,IAAI;AACjD,QAAM,UAAU,OAAuB,IAAI;AAE3C,eAAa,MAAM,OAAO;AAE1B,QAAM,eAAe,SAAS,aAAa,OAAO,WAAW,OAAO,UAAU,IAAI;AAElF,QAAM,SAAyC,gBAAgB,CAAC,GAE7D,OAAO,CAAC,SAAS,SAAS,QAAQ,SAAS,UAAa,SAAS,SAAS,SAAS,EAAE,EACrF,IAAI,CAAC,MAAM,UAAW,cAAc,IAAI,IAAI,OAAO,EAAE,KAAK,OAAO,KAAK,IAAI,MAAM,KAAK,CAAE;AAC1F,MAAI,kBAAkB,UAAa,gBAAgB,GAAG;AACpD,UAAM,KAAK,EAAE,KAAK,aAAa,MAAM,OAAO,SAAS,aAAa,EAAE,CAAC;AAAA,EACvE;AAGA,QAAM,OAAO,CAAC,aAAa,OAAO,OAAO,UAAU,IAC/C,OAAO,YAAY,gBAAgB,aACjC,YAAY,YAAY,KAAK,IAC7B,YAAY,cACd,aAAa,KACX,YAAY,gBACZ;AAEN,QAAM,UAAU,CAAC,UAAmB;AAClC,UAAM,MAAM,gBAAgB,KAAK;AACjC,QAAI,WAAW,GAAG,GAAG;AACnB,iBAAW,GAAG;AACd;AAAA,IACF;AACA,QAAI,cAAc,KAAK,GAAG;AACxB,iBAAW,OAAO,YAAY,kBAAkB,KAAK,CAAC,CAAC;AACvD;AAAA,IACF;AACA,UAAM,OAAO,cAAc,KAAK;AAGhC,QAAI,SAAS,wBAAwB,SAAS,uBAAuB;AACnE,oBAAc,UAAU;AACxB,kBAAY,SAAS,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,SAAS,2BAA2B,SAAS,yBAAyB;AACxE,oBAAc,OAAO;AACrB,eAAS,SAAS,MAAM;AACxB;AAAA,IACF;AACA,QAAI,SAAS,cAAc;AACzB,YAAM,YAAY,iBAAiB,KAAK;AACxC;AAAA,QACE,YACI,OAAO,YAAY,IAAI,KAAK,WAAW,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,OAAO,SAAS,CAAC,IACzF,OAAO;AAAA,MACb;AACA;AAAA,IACF;AACA,eAAW,SAAS,0BAA0B,OAAO,sBAAsB,OAAO,MAAM;AAAA,EAC1F;AAEA,QAAM,UAAU,MAAM;AACpB,eAAW,IAAI;AACf,kBAAc,IAAI;AAClB,YAAQ,IAAI;AACZ,UAAM,SAA8B,EAAE,UAAU,cAAc,MAAM,KAAK,EAAE;AAC3E,WAAO,OAAO,MAAM,UAAU,MAAM,CAAC,EAAE;AAAA,MACrC,MAAM;AACJ,YAAI,CAAC,QAAQ,QAAS;AACtB,gBAAQ,KAAK;AACb,gBAAQ,IAAI;AAAA,MACd;AAAA,MACA,CAAC,UAAmB;AAClB,YAAI,QAAQ,SAAS;AACnB,kBAAQ,KAAK;AACb,kBAAQ,KAAK;AAAA,QACf;AAEA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,QAAM,WAAW,CAAC,UAAmB;AACnC,QAAI,MAAO;AACX,aAAS,EAAE;AACX,gBAAY,EAAE;AACd,kBAAc,IAAI;AAClB,eAAW,IAAI;AAAA,EACjB;AAEA,SACE,qBAAC,QAAM,GAAG,MAAM,cAAY,OAAO,SAAS,QAAQ,MAAK,UAAS,WAAW,GAAG,iBAAiB,SAAS,GACxG;AAAA,yBAAC,SACC;AAAA,0BAAC,qBAAmB,iBAAO,OAAM;AAAA,MACjC,oBAAC,SAAI,WAAW,wBAAyB,wBAAa;AAAA,OACxD;AAAA,IACC,OACC,qBAAC,SAAI,KAAK,SAAS,UAAU,IAAI,MAAK,UAAS,WAAU,+CACvD;AAAA,0BAAC,SAAM,eAAW,MAAC,WAAU,qCAAoC;AAAA,MACjE,oBAAC,UAAM,iBAAO,MAAK;AAAA,OACrB,IAEA,iCACE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,QAAQ;AAAA,UACR,UAAU,OAAO;AAAA,UACjB,QAAQ,OAAO;AAAA,UACf,cAAc;AAAA,UACd,cAAc,OAAO;AAAA,UACrB,uBAAuB;AAAA,UACvB;AAAA,UACA,eAAe;AAAA,UACf,WAAW;AAAA,UAEX;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,QAAQ;AAAA,gBACR,OAAM;AAAA,gBACN,OAAO;AAAA,gBACP,eAAe,CAAC,SAAS;AACvB,2BAAS,IAAI;AACb,sBAAI,eAAe,QAAS,eAAc,IAAI;AAAA,gBAChD;AAAA,gBACA,OAAO,eAAe,UAAU,OAAO,uBAAuB;AAAA,gBAC9D;AAAA;AAAA,YACF;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,OAAO;AAAA,gBACP,eAAe,CAAC,SAAS;AACvB,8BAAY,IAAI;AAChB,sBAAI,eAAe,WAAY,eAAc,IAAI;AAAA,gBACnD;AAAA,gBACA,OAAO,eAAe,aAAa,OAAO,gBAAgB;AAAA,gBAC1D;AAAA;AAAA,YACF;AAAA;AAAA;AAAA,MACF;AAAA,MACC,WAAW,OAAO,KACjB,oBAAC,eAAY,MAAK,UAAS,MAAK,MAAK,MAAK,SACvC,mBACH;AAAA,OAEJ;AAAA,KAEJ;AAEJ;","names":[]}

package/dist/auth/auth-errors.d.ts

@@ -1,3 +1,4 @@
+import type { BillingLabels } from "../billing/billing-labels.js";
 import { httpStatusOf } from "../lib/http-status.js";
 /**
  * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every
@@ -149,6 +150,41 @@ export declare function isAuthError(err: unknown, code?: KitErrorCode): boolean;
  * handler asks before it decides between the write lock, a `PlanLimitNotice` and a toast.
  */
 export declare function isBillingError(err: unknown, code?: BillingErrorCode): boolean;
+/** Who reads a `billing_read_only` refusal — {@link billingRefusalText}'s third argument,
+ *  `useBillingLockReason`'s two options. */
+export interface BillingRefusalTextOptions {
+    /** The reader is a GUEST in someone else's item (§12.6): the words never say why. */
+    guest?: boolean;
+    /** A guest's item, by its own name ("Household 2026"). Ignored for the payer. */
+    item?: string;
+}
+/**
+ * The words for a billing refusal, in `labels` (an app's `useBillingLabels()`, or its
+ * `billing` catalogue outside React), or `null` when `err` is not one — for the toast or
+ * the dialog after a billing call failed, with the app's own words for anything else
+ * (kastlan reuse audit 2026-11-02, proposal 4).
+ *
+ * All three apps mapped the codes to the labels by hand: kastlan's
+ * `billing-refusal-dialog.tsx`, keksdose's `subscription-cards.tsx` and Kurvenschmiede's
+ * `api/client.ts`, the same eight codes each. This follows the most complete of them:
+ * every {@link BillingErrorCode}, so it is `null` only for an error that is not billing's.
+ *
+ * - `billing_read_only` — the write lock's sentence, as `useBillingLockReason` says it:
+ *   the payer's `lockReason`, or with `{ guest: true, item }` a guest's `guestReadOnly`,
+ *   which never says why (§12.6) — kastlan's dialog, which passes `guest: !isAdmin`.
+ * - `plan_limit` — `limitReached`, "Plan limit reached". Where the figure fits, read
+ *   `isPlanLimit` first and show `PlanLimitNotice` or `usePlanLimitToast`, as kastlan does.
+ * - the eight others — their labels: `disabled`, `notConfigured`, `providerUnavailable`,
+ *   `notAtProvider`, `alreadySubscribed`, `planNotSold`, `notSubscribed`, `planUnchanged`.
+ *
+ * Reads the code wherever {@link authErrorCode} does (axios, ofetch, a generated client,
+ * FastAPI's nested `detail`).
+ *
+ *     catch (err) {
+ *       toast.error(billingRefusalText(err, labels) ?? describeError(err));
+ *     }
+ */
+export declare function billingRefusalText(err: unknown, labels: BillingLabels, options?: BillingRefusalTextOptions): string | null;
 /**
  * The parsed body that carries a code, wherever {@link authErrorCode} would find it (in
  * the same order) — the object with the `code`, so FastAPI's nested `detail` when the code

package/dist/auth/auth-errors.js

@@ -58,6 +58,25 @@ function isBillingError(err, code) {
   const found = authErrorCode(err);
   return found !== void 0 && BILLING_CODES.has(found) && (code === void 0 || found === code);
 }
+const BILLING_REFUSAL_WORDS = {
+  billing_disabled: (labels) => labels.disabled,
+  // The lock's own sentence (`useBillingLockReason`): a guest's never says why (§12.6).
+  billing_read_only: (labels, options) => options.guest ? labels.guestReadOnly(options.item) : labels.lockReason,
+  // The notice's first line. The figure and the way to more are `isPlanLimit`'s, for
+  // `PlanLimitNotice` or `usePlanLimitToast`.
+  plan_limit: (labels) => labels.limitReached,
+  billing_not_configured: (labels) => labels.notConfigured,
+  billing_provider_unavailable: (labels) => labels.providerUnavailable,
+  billing_not_at_provider: (labels) => labels.notAtProvider,
+  billing_already_subscribed: (labels) => labels.alreadySubscribed,
+  billing_plan_not_sold: (labels) => labels.planNotSold,
+  billing_not_subscribed: (labels) => labels.notSubscribed,
+  billing_plan_unchanged: (labels) => labels.planUnchanged
+};
+function billingRefusalText(err, labels, options = {}) {
+  const found = authErrorCode(err);
+  return found !== void 0 && BILLING_CODES.has(found) ? BILLING_REFUSAL_WORDS[found](labels, options) : null;
+}
 function errorBodyWithCode(err, accept = (code) => known(code) !== void 0) {
   if (!isBag(err)) return void 0;
   const response = err.response;
@@ -106,6 +125,7 @@ function retryAfterSeconds(err, now = Date.now()) {
 import { englishRateLimited, englishWait } from "./auth-errors-labels.js";
 export {
   authErrorCode,
+  billingRefusalText,
   englishRateLimited,
   englishWait,
   errorBodyWithCode,

package/dist/auth/auth-errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/auth-errors.ts"],"sourcesContent":["import { httpStatusOf } from \"../lib/http-status\";\n\n/**\n * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every\n * refusal the auth routes answer carries a machine-readable `code`, and the pages\n * recognise the CODE, never the server's sentence.\n *\n * Today each app's pages print the server's `detail` string (keksdose's\n * `extractApiErrorMessage`), which is English on every locale and, on a credential\n * check, would be an account-enumeration oracle if it ever said more than one thing.\n * keksdose already keys one refusal on a code (`features/budgets/plan-limit.ts`,\n * `402 {detail, code: \"plan_budget_limit\"}`); §5.2 makes that the rule for auth. Each\n * app switches its server and its pages together (§9).\n *\n * - `invalid_credentials` — unknown address, wrong password AND deactivated account:\n *   one answer, in the same time (§2.10). `401`.\n * - `registration_closed` — the sign-up gate refused the address. `403`.\n * - `email_taken` — an account with this address exists. `409`.\n * - `invitation_invalid`, `invitation_expired` — the `invite` token of a sign-up or an\n *   accept (§4.4).\n * - `token_invalid` — a one-time token (reset, verification, a sign-in challenge) is\n *   unknown, spent or expired.\n * - `account_inactive` — **no server answers it.** §2.10 decided that a deactivated\n *   account gets `invalid_credentials`, because a separate answer after a correct\n *   password would confirm a leaked one. It stays in the union only for a future server\n *   step that is past the password (an admin view, a signed-in refresh) and may say so.\n * - `session_ended` — 0.34.0 (§11.2, decision 7; server-kit 0.8): every definitive\n *   refusal of `POST /auth/refresh`, a `401`. No form shows it, so it has no label: the\n *   kit's `attachSessionRefresh` decides by the STATUS, so an app whose server has not\n *   switched yet keeps working.\n */\nexport type AuthErrorCode =\n  | \"invalid_credentials\"\n  | \"registration_closed\"\n  | \"email_taken\"\n  | \"invitation_invalid\"\n  | \"invitation_expired\"\n  | \"token_invalid\"\n  /** 0.30.0: a link that WAS valid and ran out (verification, reset) — keksdose's step-3\n   *  refusals tell it from `token_invalid`, so a page can say \"expired, ask for a new one\". */\n  | \"token_expired\"\n  | \"account_inactive\"\n  | \"session_ended\";\n\n/**\n * 0.30.0: the coded refusals of user administration and the account's own settings\n * (docs/user-admin-harmonization.md §4, §6) — server-kit 0.4.0's `AccountErrorCode`,\n * value for value. The same family of answer as the sign-in codes (`{detail, code}`,\n * plus `companies` on kastlan's `last_admin`), read by the same {@link authErrorCode}.\n *\n * - `last_admin` — the action would leave no active admin: deactivating, demoting or\n *   deleting the last one (in kastlan, of a company; the answer names the `companies`).\n * - `self_action` — an admin acting on their own account where that is never allowed.\n * - `other_companies` — kastlan: the account belongs to other companies too, so a\n *   company admin may not deactivate it; \"Remove from company\" instead (§9.6).\n * - `household_has_members` — keksdose's guard on a deletion request (§6.4).\n * - `confirmation_required`, `confirmation_mismatch` — the action's confirmation level\n *   asked for a typed address (or a tick), and the request carried none, or another\n *   address (§4.2).\n * - `password_incorrect` — the CURRENT password is wrong on a signed-in route (the email\n *   change, the deletion request). `400`, not `401`: an app's client reads a 401 as an\n *   ended session and signs the user out, the wrong answer to a typo. Every other one\n *   is a `409`.\n */\nexport type AccountErrorCode =\n  | \"last_admin\"\n  | \"self_action\"\n  | \"other_companies\"\n  | \"household_has_members\"\n  | \"confirmation_required\"\n  | \"confirmation_mismatch\"\n  | \"password_incorrect\";\n\n/**\n * 0.31.0: the demo's coded refusals (docs/landing-demo-harmonization.md §6.2) —\n * server-kit 0.5's `DemoErrorCode`, value for value, answered as `{detail, code}` like\n * the others and read by the same {@link authErrorCode}.\n *\n * - `demo_disabled` — `404`: the demo switch is off (it is \"not there\", not forbidden).\n * - `demo_rate_limited` — `429` with `Retry-After`: the per-IP window of demo starts.\n * - `demo_capacity` — `429`, no `Retry-After`: the cap of live demo users.\n * - `demo_not_ready` — `503`: the demo data has not been seeded yet.\n * - `demo_read_only` — `403`, model R: any write by a demo user. The app's write lock\n *   already explains it, so it shows no toast (§5.4).\n * - `demo_refused` — `403`, both models: an action a demo never may — a way in or out,\n *   mail, uploads, the account export (§6.4).\n */\nexport type DemoErrorCode =\n  \"demo_disabled\" | \"demo_rate_limited\" | \"demo_capacity\" | \"demo_not_ready\" | \"demo_read_only\" | \"demo_refused\";\n\n/**\n * 0.32.0: billing's coded refusals (docs/billing-harmonization.md §3.3, §3.4, §4, §12.3) —\n * server-kit 0.6's `BillingError` and `PlanLimitError`, value for value, answered as\n * `{detail, code}` like the others and read by the same {@link authErrorCode}.\n *\n * - `billing_disabled` — `404`: the billing switch is off (§2.9), so every billing route\n *   but `GET /billing/status` is \"not there\", as a switched-off demo is.\n * - `billing_read_only` — `402`: a write by (or into the data of) a payer out of good\n *   standing (§3.3, §12.1). Inside a sync reply it marks the changes that were refused\n *   and not applied (§12.5). The app's write lock and banner already say why, so — like\n *   `demo_read_only` — it needs no toast of its own.\n * - `plan_limit` — `402`: a create past the plan's limit (§3.4), with the extra fields\n *   `dimension`, `plan`, `limit` and `used` — read them with `isPlanLimit`. A lapsed payer\n *   creating gets `billing_read_only` instead, never this (§12.3).\n * - `billing_not_configured` — billing is switched on but the provider's settings are\n *   missing (the secrets, a price id): the operator's mistake, not the payer's.\n *\n * 0.33.0 (server-kit 0.7, §14.2): the provider's refusals, with the `billing_` prefix of\n * the others (decision 22).\n * - `billing_provider_unavailable` — `502`: Paddle didn't answer, or refused the request.\n *   Try again.\n * - `billing_not_at_provider` — `409`: a portal request before the payer reached the\n *   provider (§14.5) — a stale page; the overview's `at_provider` says it first.\n * - `billing_already_subscribed` — `409`: a checkout while a provider subscription runs\n *   (§14.6). Since 0.39 plan changes go through the plan switch (§15.2.10).\n * - `billing_plan_not_sold` — `422`: a checkout for a plan, currency or interval the\n *   catalogue doesn't sell — or (0.39) a switch to one.\n *\n * 0.39.0 (server-kit 0.12, §15.2.10): the plan switch's refusals.\n * - `billing_not_subscribed` — `409`: a switch with no running provider subscription;\n *   the page offers the checkout instead.\n * - `billing_plan_unchanged` — `409`: a switch to the price the payer pays now.\n */\nexport type BillingErrorCode =\n  | \"billing_disabled\"\n  | \"billing_read_only\"\n  | \"plan_limit\"\n  | \"billing_not_configured\"\n  | \"billing_provider_unavailable\"\n  | \"billing_not_at_provider\"\n  | \"billing_already_subscribed\"\n  | \"billing_plan_not_sold\"\n  | \"billing_not_subscribed\"\n  | \"billing_plan_unchanged\";\n\n/** Every code the kit reads: the sign-in refusals, the account ones (0.30.0), the demo's\n *  (0.31.0) and billing's (0.32.0). */\nexport type KitErrorCode = AuthErrorCode | AccountErrorCode | DemoErrorCode | BillingErrorCode;\n\nconst BILLING_CODES: ReadonlySet<BillingErrorCode> = new Set<BillingErrorCode>([\n  \"billing_disabled\",\n  \"billing_read_only\",\n  \"plan_limit\",\n  \"billing_not_configured\",\n  \"billing_provider_unavailable\",\n  \"billing_not_at_provider\",\n  \"billing_already_subscribed\",\n  \"billing_plan_not_sold\",\n  \"billing_not_subscribed\",\n  \"billing_plan_unchanged\",\n]);\n\nconst CODES: ReadonlySet<string> = new Set<KitErrorCode>([\n  \"invalid_credentials\",\n  \"registration_closed\",\n  \"email_taken\",\n  \"invitation_invalid\",\n  \"invitation_expired\",\n  \"token_invalid\",\n  \"token_expired\",\n  \"account_inactive\",\n  \"session_ended\",\n  \"last_admin\",\n  \"self_action\",\n  \"other_companies\",\n  \"household_has_members\",\n  \"confirmation_required\",\n  \"confirmation_mismatch\",\n  \"password_incorrect\",\n  \"demo_disabled\",\n  \"demo_rate_limited\",\n  \"demo_capacity\",\n  \"demo_not_ready\",\n  \"demo_read_only\",\n  \"demo_refused\",\n  ...BILLING_CODES,\n]);\n\ntype Bag = Record<string, unknown>;\n\nconst isBag = (value: unknown): value is Bag => typeof value === \"object\" && value !== null;\n\n/** A known code, or undefined. */\nfunction known(value: unknown): KitErrorCode | undefined {\n  return typeof value === \"string\" && CODES.has(value) ? (value as KitErrorCode) : undefined;\n}\n\n/** `{code}` on a parsed body, or FastAPI's `{detail: {code}}` — what an\n *  `HTTPException(detail={\"code\": …})` serialises to. */\nfunction codeOfBody(body: unknown): KitErrorCode | undefined {\n  if (!isBag(body)) return undefined;\n  return known(body.code) ?? (isBag(body.detail) ? known(body.detail.code) : undefined);\n}\n\n/**\n * The code an error carries — an {@link AuthErrorCode}, since 0.30.0 an\n * {@link AccountErrorCode}, since 0.31.0 a {@link DemoErrorCode}, since 0.32.0 a\n * {@link BillingErrorCode} — or `undefined` when it carries none.\n *\n * Reads the parsed response body wherever the apps' HTTP clients put it, without\n * depending on any of them:\n *\n *  1. `err.response.data` — axios (keksdose's, kastlan's and Kurvenschmiede's clients;\n *     keksdose's `isPlanBudgetLimitRefusal` reads the same path);\n *  2. `err.data` — ofetch's `FetchError`, and most `fetch` wrappers that parse the body;\n *  3. `err.body` — the generated OpenAPI clients' `ApiError`;\n *  4. `err` itself — a body thrown as it came (`throw await res.json()`).\n *\n * In each, `code` or FastAPI's nested `detail.code`. Last, `err.code` — but only when\n * it is one of the codes above: axios writes its OWN codes there (`ERR_NETWORK`,\n * `ECONNABORTED`, `ERR_BAD_REQUEST`), and so does Node, so an unknown value is never\n * read as a refusal. The HTTP status is not checked: the code is the contract, and the\n * status differs per refusal (401, 402, 403, 404, 409, 410).\n */\nexport function authErrorCode(err: unknown): KitErrorCode | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (\n    (isBag(response) ? codeOfBody(response.data) : undefined) ??\n    codeOfBody(err.data) ??\n    codeOfBody(err.body) ??\n    codeOfBody(err)\n  );\n}\n\n/**\n * Whether `err` is a coded auth refusal — any of them, or the one named:\n *\n * ```ts\n * try { await api.register(values) }\n * catch (err) { if (isAuthError(err, \"email_taken\")) … }\n * ```\n *\n * The kit's `SignInForm` and `RegisterForm` call it on what their callbacks reject\n * with, so an app's `onSubmit` can simply let its client's error through. See\n * {@link authErrorCode} for the shapes it reads. Since 0.30.0 it knows the account codes\n * too: `isAuthError(err, \"last_admin\")`; since 0.31.0 the demo's:\n * `isAuthError(err, \"demo_read_only\")`; since 0.32.0 billing's:\n * `isAuthError(err, \"billing_read_only\")` (or {@link isBillingError}).\n */\nexport function isAuthError(err: unknown, code?: KitErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && (code === undefined || found === code);\n}\n\n/**\n * Whether `err` is one of billing's coded refusals (0.32.0, docs/billing-harmonization.md\n * §10, §14.2) — any of them, or the one named. {@link isAuthError} answers the same for a\n * named code; this one also answers \"is it billing's at all\", which an app's error\n * handler asks before it decides between the write lock, a `PlanLimitNotice` and a toast.\n */\nexport function isBillingError(err: unknown, code?: BillingErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && BILLING_CODES.has(found as BillingErrorCode) && (code === undefined || found === code);\n}\n\n/**\n * The parsed body that carries a code, wherever {@link authErrorCode} would find it (in\n * the same order) — the object with the `code`, so FastAPI's nested `detail` when the code\n * is there. For a reader of a refusal's EXTRA fields (`isPlanLimit`: `dimension`, `limit`,\n * `used` sit beside the code). `accept` decides which codes count; default, the known ones.\n *\n * @internal Not part of the barrel.\n */\nexport function errorBodyWithCode(\n  err: unknown,\n  accept: (code: unknown) => boolean = (code) => known(code) !== undefined,\n): Record<string, unknown> | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  for (const body of [isBag(response) ? response.data : undefined, err.data, err.body, err]) {\n    if (!isBag(body)) continue;\n    if (accept(body.code)) return body;\n    if (isBag(body.detail) && accept(body.detail.code)) return body.detail;\n  }\n  return undefined;\n}\n\n/**\n * The HTTP status a thrown error carries ({@link httpStatusOf}): axios'\n * `response.status`, then `status`, then `statusCode`. Lives in `lib/http-status.ts`\n * since 0.52 (refactor audit 2026-10-30, MOD-6); re-exported here for the modules that\n * import it from auth. Package-private — not re-exported from the barrel.\n */\nexport { httpStatusOf };\n\n/**\n * Whether `err` is a throttled request — HTTP `429 Too Many Requests` (0.30.0, from the\n * apps' 0.29 adoption: every app answered a throttled sign-in, sign-up or reset through\n * its own `describeError`, with three wordings of one sentence).\n *\n * A throttle carries no `code` in the contract — the STATUS is the answer, set by the\n * apps' limiters (server-kit's `AuthLimiters`, keksdose's per-IP limit) — so this reads\n * the status, wherever the apps' HTTP clients put it ({@link httpStatusOf}).\n *\n * There is no `rate_limited` code: keksdose answers its 429s uncoded, with a\n * `Retry-After` header, and the status is the one signal every limiter gives.\n *\n * The kit's `SignInForm`, `RegisterForm`, `ForgotPasswordForm` and `ResetPasswordForm`\n * call it AFTER the app's `describeError` — an app with words of its own keeps them —\n * and before their generic failure, so \"Too many attempts. Try again in 30 s.\" (with\n * {@link retryAfterSeconds}) or \"… Wait a moment and try again.\" needs no app code.\n */\nexport function isRateLimited(err: unknown): boolean {\n  return httpStatusOf(err) === 429;\n}\n\n/** A header's value from a `Headers` (fetch, ofetch's `response`), axios' `AxiosHeaders`\n *  or a plain record — whose keys may come in any case. */\nfunction headerOf(headers: unknown, name: string): unknown {\n  if (!isBag(headers)) return undefined;\n  if (typeof headers.get === \"function\") {\n    try {\n      const value: unknown = (headers.get as (key: string) => unknown).call(headers, name);\n      if (value !== undefined && value !== null) return value;\n    } catch {\n      // A `get` that is not a header lookup; the record below is.\n    }\n  }\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === name) return value;\n  }\n  return undefined;\n}\n\n/** `Retry-After` as seconds from `now`: delta-seconds (\"30\"), or an HTTP date\n *  (\"Wed, 07 Oct 2026 10:00:00 GMT\") counted from now, never below 0 (RFC 9110 §10.2.3). */\nfunction parseRetryAfter(value: unknown, now: number): number | undefined {\n  const raw = Array.isArray(value) ? (value as unknown[])[0] : value;\n  if (typeof raw === \"number\") return Number.isFinite(raw) && raw >= 0 ? Math.ceil(raw) : undefined;\n  if (typeof raw !== \"string\") return undefined;\n  const text = raw.trim();\n  if (/^\\d+$/.test(text)) return Number(text);\n  // An HTTP date names its day and month (\"Wed, 07 Oct 2026 …\"). Without a letter it is\n  // a malformed number (\"-5\", \"1.5\"), which `Date.parse` would happily read as a year.\n  if (!/[a-z]/i.test(text)) return undefined;\n  const at = Date.parse(text);\n  if (Number.isNaN(at)) return undefined;\n  return Math.max(0, Math.ceil((at - now) / 1000));\n}\n\n/**\n * How long a throttled request asks to wait, in whole seconds — its `Retry-After`\n * header (0.30.0, keksdose: its 429s carry no code, only the header) — or `undefined`\n * when there is none, or none that parses.\n *\n * Read where the apps' clients keep the response headers, without depending on any of\n * them: `err.response.headers` (axios' `AxiosHeaders` or a plain record; ofetch's\n * `FetchError.response`, a fetch `Headers`), then `err.headers` (a `Response` thrown as\n * it came). The value is delta-seconds, or an HTTP date turned into seconds from `now`\n * (default: the present moment) — never below 0.\n *\n * The forms hand it to their `rateLimited` label when {@link isRateLimited} is true:\n * \"Too many attempts. Try again in 30 s.\" — and, without one, \"… Wait a moment and try\n * again.\" A browser only exposes `Retry-After` to a cross-origin page when the server\n * lists it in `Access-Control-Expose-Headers`.\n */\nexport function retryAfterSeconds(err: unknown, now: number | Date = Date.now()): number | undefined {\n  if (!isBag(err)) return undefined;\n  const at = typeof now === \"number\" ? now : now.getTime();\n  const response = err.response;\n  const value =\n    (isBag(response) ? headerOf(response.headers, \"retry-after\") : undefined) ?? headerOf(err.headers, \"retry-after\");\n  return value === undefined ? undefined : parseRetryAfter(value, at);\n}\n\n// The English of the `rateLimited` labels, in auth-errors-labels since 0.52: the English\n// catalogue reached this module for them, and with it `lib/http-status` (refactor audit\n// 2026-10-30, MOD-6). Re-exported for the modules that import them from here.\nexport { englishRateLimited, englishWait } from \"./auth-errors-labels\";\n"],"mappings":";AAAA,SAAS,oBAAoB;AA2I7B,MAAM,gBAA+C,oBAAI,IAAsB;AAAA,EAC7E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,QAA6B,oBAAI,IAAkB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,CAAC;AAID,MAAM,QAAQ,CAAC,UAAiC,OAAO,UAAU,YAAY,UAAU;AAGvF,SAAS,MAAM,OAA0C;AACvD,SAAO,OAAO,UAAU,YAAY,MAAM,IAAI,KAAK,IAAK,QAAyB;AACnF;AAIA,SAAS,WAAW,MAAyC;AAC3D,MAAI,CAAC,MAAM,IAAI,EAAG,QAAO;AACzB,SAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI;AAC7E;AAsBO,SAAS,cAAc,KAAwC;AACpE,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UACG,MAAM,QAAQ,IAAI,WAAW,SAAS,IAAI,IAAI,WAC/C,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,KACnB,WAAW,GAAG;AAElB;AAiBO,SAAS,YAAY,KAAc,MAA8B;AACtE,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,WAAc,SAAS,UAAa,UAAU;AACjE;AAQO,SAAS,eAAe,KAAc,MAAkC;AAC7E,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,UAAa,cAAc,IAAI,KAAyB,MAAM,SAAS,UAAa,UAAU;AACjH;AAUO,SAAS,kBACd,KACA,SAAqC,CAAC,SAAS,MAAM,IAAI,MAAM,QAC1B;AACrC,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,aAAW,QAAQ,CAAC,MAAM,QAAQ,IAAI,SAAS,OAAO,QAAW,IAAI,MAAM,IAAI,MAAM,GAAG,GAAG;AACzF,QAAI,CAAC,MAAM,IAAI,EAAG;AAClB,QAAI,OAAO,KAAK,IAAI,EAAG,QAAO;AAC9B,QAAI,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,IAAI,EAAG,QAAO,KAAK;AAAA,EAClE;AACA,SAAO;AACT;AA2BO,SAAS,cAAc,KAAuB;AACnD,SAAO,aAAa,GAAG,MAAM;AAC/B;AAIA,SAAS,SAAS,SAAkB,MAAuB;AACzD,MAAI,CAAC,MAAM,OAAO,EAAG,QAAO;AAC5B,MAAI,OAAO,QAAQ,QAAQ,YAAY;AACrC,QAAI;AACF,YAAM,QAAkB,QAAQ,IAAiC,KAAK,SAAS,IAAI;AACnF,UAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,KAAM,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,gBAAgB,OAAgB,KAAiC;AACxE,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAK,MAAoB,CAAC,IAAI;AAC7D,MAAI,OAAO,QAAQ,SAAU,QAAO,OAAO,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,IAAI;AACxF,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,OAAO,IAAI,KAAK;AACtB,MAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,OAAO,IAAI;AAG1C,MAAI,CAAC,SAAS,KAAK,IAAI,EAAG,QAAO;AACjC,QAAM,KAAK,KAAK,MAAM,IAAI;AAC1B,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,GAAI,CAAC;AACjD;AAkBO,SAAS,kBAAkB,KAAc,MAAqB,KAAK,IAAI,GAAuB;AACnG,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,KAAK,OAAO,QAAQ,WAAW,MAAM,IAAI,QAAQ;AACvD,QAAM,WAAW,IAAI;AACrB,QAAM,SACH,MAAM,QAAQ,IAAI,SAAS,SAAS,SAAS,aAAa,IAAI,WAAc,SAAS,IAAI,SAAS,aAAa;AAClH,SAAO,UAAU,SAAY,SAAY,gBAAgB,OAAO,EAAE;AACpE;AAKA,SAAS,oBAAoB,mBAAmB;","names":[]}
+{"version":3,"sources":["../../src/auth/auth-errors.ts"],"sourcesContent":["import type { BillingLabels } from \"../billing/billing-labels\";\nimport { httpStatusOf } from \"../lib/http-status\";\n\n/**\n * The coded refusals of sign-in and sign-up (docs/auth-harmonization.md §5.2): every\n * refusal the auth routes answer carries a machine-readable `code`, and the pages\n * recognise the CODE, never the server's sentence.\n *\n * Today each app's pages print the server's `detail` string (keksdose's\n * `extractApiErrorMessage`), which is English on every locale and, on a credential\n * check, would be an account-enumeration oracle if it ever said more than one thing.\n * keksdose already keys one refusal on a code (`features/budgets/plan-limit.ts`,\n * `402 {detail, code: \"plan_budget_limit\"}`); §5.2 makes that the rule for auth. Each\n * app switches its server and its pages together (§9).\n *\n * - `invalid_credentials` — unknown address, wrong password AND deactivated account:\n *   one answer, in the same time (§2.10). `401`.\n * - `registration_closed` — the sign-up gate refused the address. `403`.\n * - `email_taken` — an account with this address exists. `409`.\n * - `invitation_invalid`, `invitation_expired` — the `invite` token of a sign-up or an\n *   accept (§4.4).\n * - `token_invalid` — a one-time token (reset, verification, a sign-in challenge) is\n *   unknown, spent or expired.\n * - `account_inactive` — **no server answers it.** §2.10 decided that a deactivated\n *   account gets `invalid_credentials`, because a separate answer after a correct\n *   password would confirm a leaked one. It stays in the union only for a future server\n *   step that is past the password (an admin view, a signed-in refresh) and may say so.\n * - `session_ended` — 0.34.0 (§11.2, decision 7; server-kit 0.8): every definitive\n *   refusal of `POST /auth/refresh`, a `401`. No form shows it, so it has no label: the\n *   kit's `attachSessionRefresh` decides by the STATUS, so an app whose server has not\n *   switched yet keeps working.\n */\nexport type AuthErrorCode =\n  | \"invalid_credentials\"\n  | \"registration_closed\"\n  | \"email_taken\"\n  | \"invitation_invalid\"\n  | \"invitation_expired\"\n  | \"token_invalid\"\n  /** 0.30.0: a link that WAS valid and ran out (verification, reset) — keksdose's step-3\n   *  refusals tell it from `token_invalid`, so a page can say \"expired, ask for a new one\". */\n  | \"token_expired\"\n  | \"account_inactive\"\n  | \"session_ended\";\n\n/**\n * 0.30.0: the coded refusals of user administration and the account's own settings\n * (docs/user-admin-harmonization.md §4, §6) — server-kit 0.4.0's `AccountErrorCode`,\n * value for value. The same family of answer as the sign-in codes (`{detail, code}`,\n * plus `companies` on kastlan's `last_admin`), read by the same {@link authErrorCode}.\n *\n * - `last_admin` — the action would leave no active admin: deactivating, demoting or\n *   deleting the last one (in kastlan, of a company; the answer names the `companies`).\n * - `self_action` — an admin acting on their own account where that is never allowed.\n * - `other_companies` — kastlan: the account belongs to other companies too, so a\n *   company admin may not deactivate it; \"Remove from company\" instead (§9.6).\n * - `household_has_members` — keksdose's guard on a deletion request (§6.4).\n * - `confirmation_required`, `confirmation_mismatch` — the action's confirmation level\n *   asked for a typed address (or a tick), and the request carried none, or another\n *   address (§4.2).\n * - `password_incorrect` — the CURRENT password is wrong on a signed-in route (the email\n *   change, the deletion request). `400`, not `401`: an app's client reads a 401 as an\n *   ended session and signs the user out, the wrong answer to a typo. Every other one\n *   is a `409`.\n */\nexport type AccountErrorCode =\n  | \"last_admin\"\n  | \"self_action\"\n  | \"other_companies\"\n  | \"household_has_members\"\n  | \"confirmation_required\"\n  | \"confirmation_mismatch\"\n  | \"password_incorrect\";\n\n/**\n * 0.31.0: the demo's coded refusals (docs/landing-demo-harmonization.md §6.2) —\n * server-kit 0.5's `DemoErrorCode`, value for value, answered as `{detail, code}` like\n * the others and read by the same {@link authErrorCode}.\n *\n * - `demo_disabled` — `404`: the demo switch is off (it is \"not there\", not forbidden).\n * - `demo_rate_limited` — `429` with `Retry-After`: the per-IP window of demo starts.\n * - `demo_capacity` — `429`, no `Retry-After`: the cap of live demo users.\n * - `demo_not_ready` — `503`: the demo data has not been seeded yet.\n * - `demo_read_only` — `403`, model R: any write by a demo user. The app's write lock\n *   already explains it, so it shows no toast (§5.4).\n * - `demo_refused` — `403`, both models: an action a demo never may — a way in or out,\n *   mail, uploads, the account export (§6.4).\n */\nexport type DemoErrorCode =\n  \"demo_disabled\" | \"demo_rate_limited\" | \"demo_capacity\" | \"demo_not_ready\" | \"demo_read_only\" | \"demo_refused\";\n\n/**\n * 0.32.0: billing's coded refusals (docs/billing-harmonization.md §3.3, §3.4, §4, §12.3) —\n * server-kit 0.6's `BillingError` and `PlanLimitError`, value for value, answered as\n * `{detail, code}` like the others and read by the same {@link authErrorCode}.\n *\n * - `billing_disabled` — `404`: the billing switch is off (§2.9), so every billing route\n *   but `GET /billing/status` is \"not there\", as a switched-off demo is.\n * - `billing_read_only` — `402`: a write by (or into the data of) a payer out of good\n *   standing (§3.3, §12.1). Inside a sync reply it marks the changes that were refused\n *   and not applied (§12.5). The app's write lock and banner already say why, so — like\n *   `demo_read_only` — it needs no toast of its own.\n * - `plan_limit` — `402`: a create past the plan's limit (§3.4), with the extra fields\n *   `dimension`, `plan`, `limit` and `used` — read them with `isPlanLimit`. A lapsed payer\n *   creating gets `billing_read_only` instead, never this (§12.3).\n * - `billing_not_configured` — billing is switched on but the provider's settings are\n *   missing (the secrets, a price id): the operator's mistake, not the payer's.\n *\n * 0.33.0 (server-kit 0.7, §14.2): the provider's refusals, with the `billing_` prefix of\n * the others (decision 22).\n * - `billing_provider_unavailable` — `502`: Paddle didn't answer, or refused the request.\n *   Try again.\n * - `billing_not_at_provider` — `409`: a portal request before the payer reached the\n *   provider (§14.5) — a stale page; the overview's `at_provider` says it first.\n * - `billing_already_subscribed` — `409`: a checkout while a provider subscription runs\n *   (§14.6). Since 0.39 plan changes go through the plan switch (§15.2.10).\n * - `billing_plan_not_sold` — `422`: a checkout for a plan, currency or interval the\n *   catalogue doesn't sell — or (0.39) a switch to one.\n *\n * 0.39.0 (server-kit 0.12, §15.2.10): the plan switch's refusals.\n * - `billing_not_subscribed` — `409`: a switch with no running provider subscription;\n *   the page offers the checkout instead.\n * - `billing_plan_unchanged` — `409`: a switch to the price the payer pays now.\n */\nexport type BillingErrorCode =\n  | \"billing_disabled\"\n  | \"billing_read_only\"\n  | \"plan_limit\"\n  | \"billing_not_configured\"\n  | \"billing_provider_unavailable\"\n  | \"billing_not_at_provider\"\n  | \"billing_already_subscribed\"\n  | \"billing_plan_not_sold\"\n  | \"billing_not_subscribed\"\n  | \"billing_plan_unchanged\";\n\n/** Every code the kit reads: the sign-in refusals, the account ones (0.30.0), the demo's\n *  (0.31.0) and billing's (0.32.0). */\nexport type KitErrorCode = AuthErrorCode | AccountErrorCode | DemoErrorCode | BillingErrorCode;\n\nconst BILLING_CODES: ReadonlySet<BillingErrorCode> = new Set<BillingErrorCode>([\n  \"billing_disabled\",\n  \"billing_read_only\",\n  \"plan_limit\",\n  \"billing_not_configured\",\n  \"billing_provider_unavailable\",\n  \"billing_not_at_provider\",\n  \"billing_already_subscribed\",\n  \"billing_plan_not_sold\",\n  \"billing_not_subscribed\",\n  \"billing_plan_unchanged\",\n]);\n\nconst CODES: ReadonlySet<string> = new Set<KitErrorCode>([\n  \"invalid_credentials\",\n  \"registration_closed\",\n  \"email_taken\",\n  \"invitation_invalid\",\n  \"invitation_expired\",\n  \"token_invalid\",\n  \"token_expired\",\n  \"account_inactive\",\n  \"session_ended\",\n  \"last_admin\",\n  \"self_action\",\n  \"other_companies\",\n  \"household_has_members\",\n  \"confirmation_required\",\n  \"confirmation_mismatch\",\n  \"password_incorrect\",\n  \"demo_disabled\",\n  \"demo_rate_limited\",\n  \"demo_capacity\",\n  \"demo_not_ready\",\n  \"demo_read_only\",\n  \"demo_refused\",\n  ...BILLING_CODES,\n]);\n\ntype Bag = Record<string, unknown>;\n\nconst isBag = (value: unknown): value is Bag => typeof value === \"object\" && value !== null;\n\n/** A known code, or undefined. */\nfunction known(value: unknown): KitErrorCode | undefined {\n  return typeof value === \"string\" && CODES.has(value) ? (value as KitErrorCode) : undefined;\n}\n\n/** `{code}` on a parsed body, or FastAPI's `{detail: {code}}` — what an\n *  `HTTPException(detail={\"code\": …})` serialises to. */\nfunction codeOfBody(body: unknown): KitErrorCode | undefined {\n  if (!isBag(body)) return undefined;\n  return known(body.code) ?? (isBag(body.detail) ? known(body.detail.code) : undefined);\n}\n\n/**\n * The code an error carries — an {@link AuthErrorCode}, since 0.30.0 an\n * {@link AccountErrorCode}, since 0.31.0 a {@link DemoErrorCode}, since 0.32.0 a\n * {@link BillingErrorCode} — or `undefined` when it carries none.\n *\n * Reads the parsed response body wherever the apps' HTTP clients put it, without\n * depending on any of them:\n *\n *  1. `err.response.data` — axios (keksdose's, kastlan's and Kurvenschmiede's clients;\n *     keksdose's `isPlanBudgetLimitRefusal` reads the same path);\n *  2. `err.data` — ofetch's `FetchError`, and most `fetch` wrappers that parse the body;\n *  3. `err.body` — the generated OpenAPI clients' `ApiError`;\n *  4. `err` itself — a body thrown as it came (`throw await res.json()`).\n *\n * In each, `code` or FastAPI's nested `detail.code`. Last, `err.code` — but only when\n * it is one of the codes above: axios writes its OWN codes there (`ERR_NETWORK`,\n * `ECONNABORTED`, `ERR_BAD_REQUEST`), and so does Node, so an unknown value is never\n * read as a refusal. The HTTP status is not checked: the code is the contract, and the\n * status differs per refusal (401, 402, 403, 404, 409, 410).\n */\nexport function authErrorCode(err: unknown): KitErrorCode | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  return (\n    (isBag(response) ? codeOfBody(response.data) : undefined) ??\n    codeOfBody(err.data) ??\n    codeOfBody(err.body) ??\n    codeOfBody(err)\n  );\n}\n\n/**\n * Whether `err` is a coded auth refusal — any of them, or the one named:\n *\n * ```ts\n * try { await api.register(values) }\n * catch (err) { if (isAuthError(err, \"email_taken\")) … }\n * ```\n *\n * The kit's `SignInForm` and `RegisterForm` call it on what their callbacks reject\n * with, so an app's `onSubmit` can simply let its client's error through. See\n * {@link authErrorCode} for the shapes it reads. Since 0.30.0 it knows the account codes\n * too: `isAuthError(err, \"last_admin\")`; since 0.31.0 the demo's:\n * `isAuthError(err, \"demo_read_only\")`; since 0.32.0 billing's:\n * `isAuthError(err, \"billing_read_only\")` (or {@link isBillingError}).\n */\nexport function isAuthError(err: unknown, code?: KitErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && (code === undefined || found === code);\n}\n\n/**\n * Whether `err` is one of billing's coded refusals (0.32.0, docs/billing-harmonization.md\n * §10, §14.2) — any of them, or the one named. {@link isAuthError} answers the same for a\n * named code; this one also answers \"is it billing's at all\", which an app's error\n * handler asks before it decides between the write lock, a `PlanLimitNotice` and a toast.\n */\nexport function isBillingError(err: unknown, code?: BillingErrorCode): boolean {\n  const found = authErrorCode(err);\n  return found !== undefined && BILLING_CODES.has(found as BillingErrorCode) && (code === undefined || found === code);\n}\n\n/** Who reads a `billing_read_only` refusal — {@link billingRefusalText}'s third argument,\n *  `useBillingLockReason`'s two options. */\nexport interface BillingRefusalTextOptions {\n  /** The reader is a GUEST in someone else's item (§12.6): the words never say why. */\n  guest?: boolean;\n  /** A guest's item, by its own name (\"Household 2026\"). Ignored for the payer. */\n  item?: string;\n}\n\ntype RefusalWords = (labels: BillingLabels, options: BillingRefusalTextOptions) => string;\n\n/**\n * Each billing refusal's words in the `billing` labels. A `Record` over the whole union, so\n * a code server-kit adds is a type error here until it has words.\n */\nconst BILLING_REFUSAL_WORDS: Record<BillingErrorCode, RefusalWords> = {\n  billing_disabled: (labels) => labels.disabled,\n  // The lock's own sentence (`useBillingLockReason`): a guest's never says why (§12.6).\n  billing_read_only: (labels, options) => (options.guest ? labels.guestReadOnly(options.item) : labels.lockReason),\n  // The notice's first line. The figure and the way to more are `isPlanLimit`'s, for\n  // `PlanLimitNotice` or `usePlanLimitToast`.\n  plan_limit: (labels) => labels.limitReached,\n  billing_not_configured: (labels) => labels.notConfigured,\n  billing_provider_unavailable: (labels) => labels.providerUnavailable,\n  billing_not_at_provider: (labels) => labels.notAtProvider,\n  billing_already_subscribed: (labels) => labels.alreadySubscribed,\n  billing_plan_not_sold: (labels) => labels.planNotSold,\n  billing_not_subscribed: (labels) => labels.notSubscribed,\n  billing_plan_unchanged: (labels) => labels.planUnchanged,\n};\n\n/**\n * The words for a billing refusal, in `labels` (an app's `useBillingLabels()`, or its\n * `billing` catalogue outside React), or `null` when `err` is not one — for the toast or\n * the dialog after a billing call failed, with the app's own words for anything else\n * (kastlan reuse audit 2026-11-02, proposal 4).\n *\n * All three apps mapped the codes to the labels by hand: kastlan's\n * `billing-refusal-dialog.tsx`, keksdose's `subscription-cards.tsx` and Kurvenschmiede's\n * `api/client.ts`, the same eight codes each. This follows the most complete of them:\n * every {@link BillingErrorCode}, so it is `null` only for an error that is not billing's.\n *\n * - `billing_read_only` — the write lock's sentence, as `useBillingLockReason` says it:\n *   the payer's `lockReason`, or with `{ guest: true, item }` a guest's `guestReadOnly`,\n *   which never says why (§12.6) — kastlan's dialog, which passes `guest: !isAdmin`.\n * - `plan_limit` — `limitReached`, \"Plan limit reached\". Where the figure fits, read\n *   `isPlanLimit` first and show `PlanLimitNotice` or `usePlanLimitToast`, as kastlan does.\n * - the eight others — their labels: `disabled`, `notConfigured`, `providerUnavailable`,\n *   `notAtProvider`, `alreadySubscribed`, `planNotSold`, `notSubscribed`, `planUnchanged`.\n *\n * Reads the code wherever {@link authErrorCode} does (axios, ofetch, a generated client,\n * FastAPI's nested `detail`).\n *\n *     catch (err) {\n *       toast.error(billingRefusalText(err, labels) ?? describeError(err));\n *     }\n */\nexport function billingRefusalText(\n  err: unknown,\n  labels: BillingLabels,\n  options: BillingRefusalTextOptions = {},\n): string | null {\n  const found = authErrorCode(err);\n  return found !== undefined && BILLING_CODES.has(found as BillingErrorCode)\n    ? BILLING_REFUSAL_WORDS[found as BillingErrorCode](labels, options)\n    : null;\n}\n\n/**\n * The parsed body that carries a code, wherever {@link authErrorCode} would find it (in\n * the same order) — the object with the `code`, so FastAPI's nested `detail` when the code\n * is there. For a reader of a refusal's EXTRA fields (`isPlanLimit`: `dimension`, `limit`,\n * `used` sit beside the code). `accept` decides which codes count; default, the known ones.\n *\n * @internal Not part of the barrel.\n */\nexport function errorBodyWithCode(\n  err: unknown,\n  accept: (code: unknown) => boolean = (code) => known(code) !== undefined,\n): Record<string, unknown> | undefined {\n  if (!isBag(err)) return undefined;\n  const response = err.response;\n  for (const body of [isBag(response) ? response.data : undefined, err.data, err.body, err]) {\n    if (!isBag(body)) continue;\n    if (accept(body.code)) return body;\n    if (isBag(body.detail) && accept(body.detail.code)) return body.detail;\n  }\n  return undefined;\n}\n\n/**\n * The HTTP status a thrown error carries ({@link httpStatusOf}): axios'\n * `response.status`, then `status`, then `statusCode`. Lives in `lib/http-status.ts`\n * since 0.52 (refactor audit 2026-10-30, MOD-6); re-exported here for the modules that\n * import it from auth. Package-private — not re-exported from the barrel.\n */\nexport { httpStatusOf };\n\n/**\n * Whether `err` is a throttled request — HTTP `429 Too Many Requests` (0.30.0, from the\n * apps' 0.29 adoption: every app answered a throttled sign-in, sign-up or reset through\n * its own `describeError`, with three wordings of one sentence).\n *\n * A throttle carries no `code` in the contract — the STATUS is the answer, set by the\n * apps' limiters (server-kit's `AuthLimiters`, keksdose's per-IP limit) — so this reads\n * the status, wherever the apps' HTTP clients put it ({@link httpStatusOf}).\n *\n * There is no `rate_limited` code: keksdose answers its 429s uncoded, with a\n * `Retry-After` header, and the status is the one signal every limiter gives.\n *\n * The kit's `SignInForm`, `RegisterForm`, `ForgotPasswordForm` and `ResetPasswordForm`\n * call it AFTER the app's `describeError` — an app with words of its own keeps them —\n * and before their generic failure, so \"Too many attempts. Try again in 30 s.\" (with\n * {@link retryAfterSeconds}) or \"… Wait a moment and try again.\" needs no app code.\n */\nexport function isRateLimited(err: unknown): boolean {\n  return httpStatusOf(err) === 429;\n}\n\n/** A header's value from a `Headers` (fetch, ofetch's `response`), axios' `AxiosHeaders`\n *  or a plain record — whose keys may come in any case. */\nfunction headerOf(headers: unknown, name: string): unknown {\n  if (!isBag(headers)) return undefined;\n  if (typeof headers.get === \"function\") {\n    try {\n      const value: unknown = (headers.get as (key: string) => unknown).call(headers, name);\n      if (value !== undefined && value !== null) return value;\n    } catch {\n      // A `get` that is not a header lookup; the record below is.\n    }\n  }\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === name) return value;\n  }\n  return undefined;\n}\n\n/** `Retry-After` as seconds from `now`: delta-seconds (\"30\"), or an HTTP date\n *  (\"Wed, 07 Oct 2026 10:00:00 GMT\") counted from now, never below 0 (RFC 9110 §10.2.3). */\nfunction parseRetryAfter(value: unknown, now: number): number | undefined {\n  const raw = Array.isArray(value) ? (value as unknown[])[0] : value;\n  if (typeof raw === \"number\") return Number.isFinite(raw) && raw >= 0 ? Math.ceil(raw) : undefined;\n  if (typeof raw !== \"string\") return undefined;\n  const text = raw.trim();\n  if (/^\\d+$/.test(text)) return Number(text);\n  // An HTTP date names its day and month (\"Wed, 07 Oct 2026 …\"). Without a letter it is\n  // a malformed number (\"-5\", \"1.5\"), which `Date.parse` would happily read as a year.\n  if (!/[a-z]/i.test(text)) return undefined;\n  const at = Date.parse(text);\n  if (Number.isNaN(at)) return undefined;\n  return Math.max(0, Math.ceil((at - now) / 1000));\n}\n\n/**\n * How long a throttled request asks to wait, in whole seconds — its `Retry-After`\n * header (0.30.0, keksdose: its 429s carry no code, only the header) — or `undefined`\n * when there is none, or none that parses.\n *\n * Read where the apps' clients keep the response headers, without depending on any of\n * them: `err.response.headers` (axios' `AxiosHeaders` or a plain record; ofetch's\n * `FetchError.response`, a fetch `Headers`), then `err.headers` (a `Response` thrown as\n * it came). The value is delta-seconds, or an HTTP date turned into seconds from `now`\n * (default: the present moment) — never below 0.\n *\n * The forms hand it to their `rateLimited` label when {@link isRateLimited} is true:\n * \"Too many attempts. Try again in 30 s.\" — and, without one, \"… Wait a moment and try\n * again.\" A browser only exposes `Retry-After` to a cross-origin page when the server\n * lists it in `Access-Control-Expose-Headers`.\n */\nexport function retryAfterSeconds(err: unknown, now: number | Date = Date.now()): number | undefined {\n  if (!isBag(err)) return undefined;\n  const at = typeof now === \"number\" ? now : now.getTime();\n  const response = err.response;\n  const value =\n    (isBag(response) ? headerOf(response.headers, \"retry-after\") : undefined) ?? headerOf(err.headers, \"retry-after\");\n  return value === undefined ? undefined : parseRetryAfter(value, at);\n}\n\n// The English of the `rateLimited` labels, in auth-errors-labels since 0.52: the English\n// catalogue reached this module for them, and with it `lib/http-status` (refactor audit\n// 2026-10-30, MOD-6). Re-exported for the modules that import them from here.\nexport { englishRateLimited, englishWait } from \"./auth-errors-labels\";\n"],"mappings":";AACA,SAAS,oBAAoB;AA2I7B,MAAM,gBAA+C,oBAAI,IAAsB;AAAA,EAC7E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,QAA6B,oBAAI,IAAkB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,CAAC;AAID,MAAM,QAAQ,CAAC,UAAiC,OAAO,UAAU,YAAY,UAAU;AAGvF,SAAS,MAAM,OAA0C;AACvD,SAAO,OAAO,UAAU,YAAY,MAAM,IAAI,KAAK,IAAK,QAAyB;AACnF;AAIA,SAAS,WAAW,MAAyC;AAC3D,MAAI,CAAC,MAAM,IAAI,EAAG,QAAO;AACzB,SAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI;AAC7E;AAsBO,SAAS,cAAc,KAAwC;AACpE,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,UACG,MAAM,QAAQ,IAAI,WAAW,SAAS,IAAI,IAAI,WAC/C,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,KACnB,WAAW,GAAG;AAElB;AAiBO,SAAS,YAAY,KAAc,MAA8B;AACtE,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,WAAc,SAAS,UAAa,UAAU;AACjE;AAQO,SAAS,eAAe,KAAc,MAAkC;AAC7E,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,UAAa,cAAc,IAAI,KAAyB,MAAM,SAAS,UAAa,UAAU;AACjH;AAiBA,MAAM,wBAAgE;AAAA,EACpE,kBAAkB,CAAC,WAAW,OAAO;AAAA;AAAA,EAErC,mBAAmB,CAAC,QAAQ,YAAa,QAAQ,QAAQ,OAAO,cAAc,QAAQ,IAAI,IAAI,OAAO;AAAA;AAAA;AAAA,EAGrG,YAAY,CAAC,WAAW,OAAO;AAAA,EAC/B,wBAAwB,CAAC,WAAW,OAAO;AAAA,EAC3C,8BAA8B,CAAC,WAAW,OAAO;AAAA,EACjD,yBAAyB,CAAC,WAAW,OAAO;AAAA,EAC5C,4BAA4B,CAAC,WAAW,OAAO;AAAA,EAC/C,uBAAuB,CAAC,WAAW,OAAO;AAAA,EAC1C,wBAAwB,CAAC,WAAW,OAAO;AAAA,EAC3C,wBAAwB,CAAC,WAAW,OAAO;AAC7C;AA4BO,SAAS,mBACd,KACA,QACA,UAAqC,CAAC,GACvB;AACf,QAAM,QAAQ,cAAc,GAAG;AAC/B,SAAO,UAAU,UAAa,cAAc,IAAI,KAAyB,IACrE,sBAAsB,KAAyB,EAAE,QAAQ,OAAO,IAChE;AACN;AAUO,SAAS,kBACd,KACA,SAAqC,CAAC,SAAS,MAAM,IAAI,MAAM,QAC1B;AACrC,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,WAAW,IAAI;AACrB,aAAW,QAAQ,CAAC,MAAM,QAAQ,IAAI,SAAS,OAAO,QAAW,IAAI,MAAM,IAAI,MAAM,GAAG,GAAG;AACzF,QAAI,CAAC,MAAM,IAAI,EAAG;AAClB,QAAI,OAAO,KAAK,IAAI,EAAG,QAAO;AAC9B,QAAI,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,IAAI,EAAG,QAAO,KAAK;AAAA,EAClE;AACA,SAAO;AACT;AA2BO,SAAS,cAAc,KAAuB;AACnD,SAAO,aAAa,GAAG,MAAM;AAC/B;AAIA,SAAS,SAAS,SAAkB,MAAuB;AACzD,MAAI,CAAC,MAAM,OAAO,EAAG,QAAO;AAC5B,MAAI,OAAO,QAAQ,QAAQ,YAAY;AACrC,QAAI;AACF,YAAM,QAAkB,QAAQ,IAAiC,KAAK,SAAS,IAAI;AACnF,UAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,KAAM,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,gBAAgB,OAAgB,KAAiC;AACxE,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAK,MAAoB,CAAC,IAAI;AAC7D,MAAI,OAAO,QAAQ,SAAU,QAAO,OAAO,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,IAAI;AACxF,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,OAAO,IAAI,KAAK;AACtB,MAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,OAAO,IAAI;AAG1C,MAAI,CAAC,SAAS,KAAK,IAAI,EAAG,QAAO;AACjC,QAAM,KAAK,KAAK,MAAM,IAAI;AAC1B,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,GAAI,CAAC;AACjD;AAkBO,SAAS,kBAAkB,KAAc,MAAqB,KAAK,IAAI,GAAuB;AACnG,MAAI,CAAC,MAAM,GAAG,EAAG,QAAO;AACxB,QAAM,KAAK,OAAO,QAAQ,WAAW,MAAM,IAAI,QAAQ;AACvD,QAAM,WAAW,IAAI;AACrB,QAAM,SACH,MAAM,QAAQ,IAAI,SAAS,SAAS,SAAS,aAAa,IAAI,WAAc,SAAS,IAAI,SAAS,aAAa;AAClH,SAAO,UAAU,SAAY,SAAY,gBAAgB,OAAO,EAAE;AACpE;AAKA,SAAS,oBAAoB,mBAAmB;","names":[]}

package/dist/components/amount-input.d.ts

@@ -116,7 +116,8 @@ export interface AmountInputProps extends FieldHelpProps, DataAttributes {
     currencyNames?: Record<string, string>;
     /** Offer only these ISO codes in the chip's list, in this order — `CurrencySelect`'s
      *  `options`, since the chip renders CurrencySelect's list (round 0.34 Wave 2, DUP-4).
-     *  Default every currency the kit knows. */
+     *  Default every currency the kit knows but a `retired` one (the lev), which only the
+     *  field that holds it lists. */
     currencyOptions?: string[];
     /** Focus the field on mount — on mobile this also opens the numpad sheet, so a
      *  new-transaction form can jump straight to amount entry (feedback #70). */