@eifi1/ui-kit 0.53.0 → 0.55.0

package/src/landing/routing.tsx

@@ -1,225 +0,0 @@
-import { useEffect } from "react";
-import type { ReactNode } from "react";
-import { Navigate, Outlet, useLocation } from "react-router";
-
-import { matchesPathPattern, routerPathname } from "../lib/path-pattern";
-import { readStored, removeStored, writeStored } from "../lib/safe-storage";
-import type { LandingSession } from "./landing-actions";
-import { LoadingState } from "../components/loading-state";
-
-/**
- * 0.31.1: a session that is still being restored — an app whose access token lives in
- * memory reads it back from its refresh token first (kastlan's 0.31 adoption). Until
- * then `/` neither shows the landing nor resumes, and a public page neither shows nor
- * redirects: both render `loading` instead.
- */
-export type RoutingSession = LandingSession | "loading";
-
-/**
- * The public routes' logic (docs/landing-demo-harmonization.md §3): what `/` shows,
- * which pages a session skips, and the page a session resumes on — keksdose's
- * `RootEntry`, `RedirectIfAuthed` and use-last-visited-page.ts, for every app.
- * Router-aware (react-router), so they belong to the `./shell` entry.
- */
-
-/* ── ?next= ──────────────────────────────────────────────────────────────── */
-
-/** The query parameter that carries "where I was actually trying to go" through the
- *  sign-in bounce (keksdose's `NEXT_PARAM`). */
-export const NEXT_PARAM = "next";
-
-/**
- * A `?next=` value that is safe to navigate to, or null.
- *
- * Same-origin PATHS only, decided by the URL PARSER rather than by string prefix —
- * this is the open-redirect check, and it is the reason this lives in one place
- * instead of at each call site.
- *
- * The prefix version ("starts with `/`, does not start with `//`") let two shapes
- * through that the browser resolves cross-origin, because the WHATWG parser does not
- * read them as text: a backslash after the leading slash counts as a second slash for
- * a special scheme, so `/\evil.example` resolves to `https://evil.example/`; and tab,
- * LF and CR are STRIPPED anywhere in the input before parsing, so `/<TAB>/evil.example`
- * becomes `//evil.example`. Asking the same parser the browser will use closes every
- * such shape at once, including ones nobody has thought of yet, and it normalises what
- * comes back instead of echoing the caller's spelling.
- *
- * keksdose's (shared/hooks/use-last-visited-page.ts), verbatim but for the fallback
- * origin.
- */
-export function safeNextPath(raw: string | null | undefined): string | null {
-  if (!raw) return null;
-  const base = typeof window !== "undefined" ? window.location.origin : "https://kit.invalid";
-  try {
-    const url = new URL(raw, base);
-    if (url.origin !== base) return null;
-    return `${url.pathname}${url.search}${url.hash}`;
-  } catch {
-    return null;
-  }
-}
-
-/* ── The last visited page (§3.2) ────────────────────────────────────────── */
-
-/** A path to leave out: a string is the path and everything under it (`/demo` is
- *  `/demo` and `/demo/ended`; `/` is only `/`), a RegExp is tested on the pathname. Both
- *  as React Router matches a route: case-insensitive (a RegExp gets the `i` flag) and on
- *  the percent-decoded path (0.52). */
-export type PathPattern = string | RegExp;
-
-/**
- * The pages never recorded as a resume target (§3.2): the landing (`/`, `/welcome`), the
- * auth pages, the demo's own (`/demo*`) and the legal pages. The 404 has no path of its
- * own — call {@link useLastVisitedPage} inside the signed-in layout, as keksdose does,
- * and it never sees one. The app adds its own one-shot routes (keksdose:
- * `/banks/callback`, `/join`, `/share-target`) through `exclude`.
- */
-export const DEFAULT_LAST_VISITED_EXCLUDES: readonly PathPattern[] = Object.freeze([
-  "/",
-  "/welcome",
-  "/login",
-  "/register",
-  "/forgot-password",
-  "/reset-password",
-  "/verify-email",
-  "/demo",
-  "/impressum",
-  "/privacy",
-  "/terms",
-]);
-
-/**
- * Whether `pathname` is one of the defaults or the app's `exclude` — read as the ROUTER
- * reads it, decoded and case-insensitive (lib/path-pattern). This module's own copy of the
- * rule compared the raw pathname case-sensitively after the feedback guard's copy had
- * learnt both, and `exclude: ["/banks/callback"]` recorded `/Banks/Callback?code=…` as the
- * page the next launch resumes on (0.52 code review, lib/path-pattern.ts). One rule now.
- */
-function isExcluded(pathname: string, exclude: readonly PathPattern[]): boolean {
-  const path = routerPathname(pathname);
-  const named = (pattern: PathPattern) => matchesPathPattern(path, pattern);
-  return DEFAULT_LAST_VISITED_EXCLUDES.some(named) || exclude.some(named);
-}
-
-export interface LastVisitedPageOptions {
-  /** The device key: `<app>.lastVisitedPage` (§3.2), one per app on the origin. */
-  key: string;
-  /** The app's own paths to leave out, ON TOP of {@link DEFAULT_LAST_VISITED_EXCLUDES}. */
-  exclude?: readonly PathPattern[];
-  /** `false` records nothing — while the session is still being restored, say. */
-  enabled?: boolean;
-}
-
-/**
- * Remember the page a session is on (path and query), on every navigation, so `/` — a
- * revisit, a fresh sign-in, the installed PWA, whose `start_url` is `/` — resumes there
- * (§3.2, keksdose feedback #59). Device-local, in `localStorage` under `key`; a blocked
- * storage records nothing.
- *
- * Call it once in the signed-in layout. The excluded paths are never written, so a
- * one-shot page (a bank callback, an invitation link) never becomes the place the next
- * launch opens on.
- */
-export function useLastVisitedPage({ key, exclude = [], enabled = true }: LastVisitedPageOptions): void {
-  const { pathname, search } = useLocation();
-  // Decided here, so the effect depends on the answer and not on an `exclude` array the
-  // caller likely builds inline.
-  const skip = !enabled || isExcluded(pathname, exclude);
-  useEffect(() => {
-    if (skip) return;
-    writeStored(key, pathname + search);
-  }, [key, pathname, search, skip]);
-}
-
-/**
- * The page {@link useLastVisitedPage} remembered under `key` — checked by
- * {@link safeNextPath}, so a value someone planted in storage cannot leave the origin —
- * or `fallback` (default `null`) when there is none or storage is blocked. A string
- * fallback narrows the answer to a string, for react-router's `to`.
- */
-export function readLastVisitedPage(key: string, fallback: string): string;
-export function readLastVisitedPage(key: string, fallback?: null): string | null;
-export function readLastVisitedPage(key: string, fallback: string | null = null): string | null {
-  return safeNextPath(readStored(key)) ?? fallback;
-}
-
-/** Forget the remembered page — on an explicit sign-out, so the next account does not
- *  resume on the previous one's page. */
-export function clearLastVisitedPage(key: string): void {
-  removeStored(key);
-}
-
-/* ── RootEntry ───────────────────────────────────────────────────────────── */
-
-export interface RootEntryProps {
-  /** Without a session `/` is the landing; with one (real or demo) it resumes;
-   *  `"loading"` while the app restores one. */
-  session: RoutingSession;
-  /** What shows while `session` is `"loading"`. Default: the kit's `LoadingState`. */
-  loading?: ReactNode;
-  /** The remembered page — `readLastVisitedPage(key)`. */
-  resumePath?: string | null;
-  /** The landing page element. */
-  landing: ReactNode;
-  /** The app's home: where a session goes with nothing to resume (keksdose `/budget`,
-   *  kastlan and Kurvenschmiede `/dashboard`). */
-  home: string;
-}
-
-/**
- * The `/` route (§3.1): the landing for a visitor, and for a session — real or demo —
- * the last visited page, else the app's home. Indexed and canonical `/` for the visitor;
- * a crawler never has a session, so for it `/` is stable.
- *
- * keksdose showed a session with nothing remembered the landing; the contract sends it
- * home instead, because a session at `/` came to use the app. The landing stays one tap
- * away at `/welcome`, where the signed-in brand link points.
- */
-export function RootEntry({ session, resumePath, landing, home, loading }: RootEntryProps) {
-  if (session === "loading") return <>{loading ?? <LoadingState />}</>;
-  if (session === "none") return <>{landing}</>;
-  const resume = safeNextPath(resumePath);
-  return <Navigate to={resume && resume !== "/" ? resume : home} replace />;
-}
-
-/* ── RedirectIfAuthed ────────────────────────────────────────────────────── */
-
-export interface RedirectIfAuthedProps {
-  /** `"loading"` while the app restores a session: neither the page nor a redirect. */
-  session: RoutingSession;
-  /** What shows while `session` is `"loading"`. Default: the kit's `LoadingState`. */
-  loading?: ReactNode;
-  /**
-   * Let a DEMO session through (§5.6): on `/login`, `/register` and the app's invitation
-   * pages, so a demo visitor can sign in or accept an invitation — a successful one
-   * replaces the demo session. Default `false`: on `/demo` a live demo continues instead
-   * of starting a second one (§5.2), and on `/forgot-password` a demo has no password.
-   */
-  allowDemo?: boolean;
-  /** Where a redirected session goes: the resume target —
-   *  `readLastVisitedPage(key, home)`. A safe `?next=` goes first. */
-  fallback: string;
-  /** The page. Left out, an `<Outlet />`: the component is a layout route around the
-   *  public pages, as in keksdose. */
-  children?: ReactNode;
-}
-
-/**
- * Public pages a session skips (§3.1): a signed-in visitor at `/login` goes back into
- * the app, to a safe `?next=` when the URL carries one (a share invitation or a push
- * deep link opened with a live session in another tab — keksdose) and else to
- * `fallback`.
- *
- * A demo session passes where `allowDemo` says so (§5.6). Mount one wrapper with
- * `allowDemo` around `/login`, `/register` and the invitation pages, and one without
- * around `/demo` (and `/forgot-password`).
- */
-export function RedirectIfAuthed({ session, allowDemo = false, fallback, children, loading }: RedirectIfAuthedProps) {
-  const { search } = useLocation();
-  if (session === "loading") return <>{loading ?? <LoadingState />}</>;
-  if (session === "none" || (session === "demo" && allowDemo)) {
-    return children === undefined ? <Outlet /> : <>{children}</>;
-  }
-  const next = safeNextPath(new URLSearchParams(search).get(NEXT_PARAM));
-  return <Navigate to={next ?? fallback} replace />;
-}

package/src/lib/broadcast.ts

@@ -1,52 +0,0 @@
-/*
- * The cross-tab messages of the sync engine (the copy's new epoch after `forget()`) and of the
- * query copy (`clear`), refactor audit 2026-10-30 FLW-1. 0.52 code review
- * (src/sync/engine.ts, src/offline/query-persistence.ts): both wrote the open, the feature
- * check, the try/catch and the close by hand, the listening side twice too — and the two
- * listeners had drifted (only the query copy's let go of Node's worker).
- */
-
-/**
- * Tell this origin's other tabs one thing over a `BroadcastChannel`, and let go of the
- * channel at once.
- *
- * Best-effort by design: the message makes another tab stop sooner, and each caller has a
- * fallback that holds without it (the epoch in `meta`, the key deleted from storage).
- *
- * The message goes out on a channel of its own, so a caller that listens on `name` itself
- * hears it too, like every other channel of that name in this tab: it ignores its own.
- */
-export function postOnce(name: string, message: unknown): void {
-  // Older browsers and some test environments have none: nothing is posted.
-  if (typeof BroadcastChannel === "undefined") return;
-  try {
-    const channel = new BroadcastChannel(name);
-    try {
-      channel.postMessage(message);
-    } finally {
-      channel.close();
-    }
-  } catch {
-    /* best-effort: a message that cannot be cloned, a channel refused (an opaque origin) */
-  }
-}
-
-/**
- * Hear what this origin's other tabs post on `name` until the returned function is called.
- * Nothing is heard (and closing is a no-op) where there is no BroadcastChannel or none can be
- * opened (an opaque origin): each caller has a fallback that holds without it.
- */
-export function listenOn(name: string, onMessage: (data: unknown) => void): () => void {
-  if (typeof BroadcastChannel === "undefined") return () => undefined;
-  let channel: BroadcastChannel;
-  try {
-    channel = new BroadcastChannel(name);
-  } catch {
-    return () => undefined;
-  }
-  // Node's channel (an app's tests) holds its worker open while it listens, and a test that
-  // never stops the listener would keep it listening. Browsers have no `unref`.
-  (channel as BroadcastChannel & { unref?: () => void }).unref?.();
-  channel.onmessage = ({ data }: MessageEvent<unknown>) => onMessage(data);
-  return () => channel.close();
-}

package/src/lib/calc.ts

@@ -1,323 +0,0 @@
-/**
- * A tiny, dependency-free arithmetic evaluator for the numeric input fields.
- * It lets users type a calculation (e.g. "12.50+3.20" or "100/3") straight into
- * an amount field, or build one in the calculator popover, and have it resolve
- * to a number. Deliberately NOT backed by `eval`/`Function` — it's a hand-rolled
- * tokenizer + recursive-descent parser over a closed grammar (digits, decimals,
- * `+ - * /`, unary minus, parentheses), so no arbitrary code can run.
- */
-
-type Token =
-  | { kind: "num"; value: number }
-  | { kind: "op"; value: "+" | "-" | "*" | "/" }
-  | { kind: "lparen" }
-  | { kind: "rparen" };
-
-function tokenize(input: string): Token[] | null {
-  const tokens: Token[] = [];
-  let i = 0;
-  while (i < input.length) {
-    const ch = input[i];
-    if (ch === " ") {
-      i++;
-      continue;
-    }
-    if (ch === "+" || ch === "-" || ch === "*" || ch === "/") {
-      tokens.push({ kind: "op", value: ch });
-      i++;
-      continue;
-    }
-    if (ch === "(") {
-      tokens.push({ kind: "lparen" });
-      i++;
-      continue;
-    }
-    if (ch === ")") {
-      tokens.push({ kind: "rparen" });
-      i++;
-      continue;
-    }
-    if ((ch >= "0" && ch <= "9") || ch === ".") {
-      let j = i;
-      let dotSeen = false;
-      while (j < input.length && ((input[j] >= "0" && input[j] <= "9") || input[j] === ".")) {
-        if (input[j] === ".") {
-          if (dotSeen) return null; // two dots in one number → invalid
-          dotSeen = true;
-        }
-        j++;
-      }
-      const num = Number(input.slice(i, j));
-      if (!Number.isFinite(num)) return null;
-      tokens.push({ kind: "num", value: num });
-      i = j;
-      continue;
-    }
-    return null; // unknown character
-  }
-  return tokens;
-}
-
-/**
- * Recursive-descent parse honouring `* /` over `+ -` and left-associativity.
- * Returns `null` for any malformed input (the `null` sentinel is safe because a
- * valid result of 0 is distinct from it). Division by zero is treated as invalid.
- *
- *   expr   := term (('+' | '-') term)*
- *   term   := factor (('*' | '/') factor)*
- *   factor := ('+' | '-') factor | number | '(' expr ')'
- */
-function parse(tokens: Token[]): number | null {
-  let pos = 0;
-
-  function parseExpr(): number | null {
-    let value = parseTerm();
-    if (value === null) return null;
-    while (pos < tokens.length) {
-      const tok = tokens[pos];
-      if (tok.kind === "op" && (tok.value === "+" || tok.value === "-")) {
-        pos++;
-        const rhs = parseTerm();
-        if (rhs === null) return null;
-        value = tok.value === "+" ? value + rhs : value - rhs;
-      } else break;
-    }
-    return value;
-  }
-
-  function parseTerm(): number | null {
-    let value = parseFactor();
-    if (value === null) return null;
-    while (pos < tokens.length) {
-      const tok = tokens[pos];
-      if (tok.kind === "op" && (tok.value === "*" || tok.value === "/")) {
-        pos++;
-        const rhs = parseFactor();
-        if (rhs === null) return null;
-        if (tok.value === "/") {
-          if (rhs === 0) return null;
-          value = value / rhs;
-        } else {
-          value = value * rhs;
-        }
-      } else break;
-    }
-    return value;
-  }
-
-  function parseFactor(): number | null {
-    const tok = tokens[pos];
-    if (!tok) return null;
-    if (tok.kind === "op" && (tok.value === "+" || tok.value === "-")) {
-      pos++;
-      const operand = parseFactor();
-      if (operand === null) return null;
-      return tok.value === "-" ? -operand : operand;
-    }
-    if (tok.kind === "lparen") {
-      pos++;
-      const inner = parseExpr();
-      if (inner === null) return null;
-      if (tokens[pos]?.kind !== "rparen") return null;
-      pos++;
-      return inner;
-    }
-    if (tok.kind === "num") {
-      pos++;
-      return tok.value;
-    }
-    return null;
-  }
-
-  const result = parseExpr();
-  if (result === null) return null;
-  if (pos !== tokens.length) return null; // leftover tokens → invalid
-  return result;
-}
-
-/** Evaluate an arithmetic string, returning `null` if it isn't a valid sum.
- * Accepts the on-screen operator glyphs (`× ÷ −`) and comma decimals too. */
-export function evaluateExpression(expr: string): number | null {
-  const normalized = expr
-    .replace(/×/g, "*")
-    .replace(/÷/g, "/")
-    .replace(/[−–—]/g, "-") // unicode minus / en / em dash → ascii
-    .replace(/,/g, ".")
-    .trim();
-  if (normalized === "") return null;
-  const tokens = tokenize(normalized);
-  if (tokens === null || tokens.length === 0) return null;
-  const result = parse(tokens);
-  if (result === null || !Number.isFinite(result)) return null;
-  return result;
-}
-
-/** True when `s` carries arithmetic beyond a single leading minus — i.e. a plain
- * number (or a lone negative like "-5") is NOT an expression, but "12+5" is.
- * Used to decide whether a field's text should be evaluated on commit.
- *
- * The operator set is the one {@link evaluateExpression} accepts, on-screen glyphs
- * included: the calculator keypad inserts `× ÷ −`, and a `−` that this said was not
- * arithmetic went on to be read as a plain number — where the digits-only fallback
- * in {@link commitExpression} silently ate it, turning "-42−−50" (= 8) into a bare
- * 8 with no record that a sum had happened at all. */
-export function looksLikeExpression(s: string): boolean {
-  const t = s.trim();
-  if (t === "") return false;
-  if (/^-?\d*[.,]?\d*$/.test(t)) return false; // plain (optionally negative) decimal
-  return /[+\-*/×÷−–—()]/.test(t.replace(/^-/, ""));
-}
-
-/** Render an evaluated number back to a field-friendly string, trimming binary
- * float noise (so 0.1 + 0.2 reads "0.3", not "0.30000000000000004").
- *
- * FIXED notation, always, and that is the whole point of the function rather than a
- * detail of it. This used to end in `parseFloat(n.toFixed(10)).toString()`, and
- * `Number.prototype.toString` switches to EXPONENT notation below 1e-6 and at or
- * above 1e21 — an alphabet containing `e`, `+` and `-`. Neither function that reads a
- * field's text back accepts it: {@link tokenize} rejects `e` as an unknown character
- * and {@link sanitizeLive} deletes it. So {@link commitExpression} fell through to
- * its digits-only cleanup, which stripped the `e` and CONCATENATED the mantissa to
- * the exponent. A field committed its own output as a different number:
- *
- *     "1/10000000"                -> "1e-7"               -> "17"   (AmountInput: "6")
- *     "999999999999*999999999999" -> "9.99999999998e+23"  -> "9.9999999999823"
- *
- * Both controls commit on blur AND on Enter, so Enter-then-click-away was enough on
- * its own, it was silent, and it was in a money field.
- *
- * The invariant, which the test asserts directly rather than by example:
- * **`commitExpression(formatResult(n))` equals `formatResult(n)` for every finite
- * `n`.** Anything rendered here has to survive being read back. */
-export function formatResult(n: number): string {
-  if (!Number.isFinite(n)) return "";
-  // At or above 1e21 `toFixed` gives up and hands back `toString`'s exponent form —
-  // but every double that large is an integer, so BigInt renders it exactly.
-  if (Math.abs(n) >= 1e21) return BigInt(n).toString();
-  return trimTrailingZeros(n.toFixed(10));
-}
-
-/** "15.7000000000" -> "15.7", "0.0000000000" -> "0". The ten decimals are where the
- *  binary float noise gets rounded off; this is only about not showing the padding. */
-function trimTrailingZeros(fixed: string): string {
-  if (!fixed.includes(".")) return fixed;
-  const trimmed = fixed.replace(/0+$/, "").replace(/\.$/, "");
-  // `toFixed` keeps the sign on a magnitude that rounded away to nothing
-  // ("-0.0000000000"); `toString` did not, and "-0" in an amount field is noise.
-  return trimmed === "-0" || trimmed === "" ? "0" : trimmed;
-}
-
-/** The single "on blur / Enter" transform a numeric field applies: evaluate the
- * text if it's an expression, otherwise normalise it to a bare number string
- * (comma → dot, dropping stray characters, non-leading minuses and anything after
- * a second decimal point).
- *
- * The last clause is the backstop for Keksdose live #201. A field the user typed in
- * cannot reach here malformed any more — {@link sanitizeLive} runs on every change,
- * including a paste — but a value handed in from elsewhere (a recurring rule, an
- * import, a test) still can, and "1.2.3" is not an expression (no operator), so it
- * used to fall straight through unchanged and be read as NaN. Here the text is CUT
- * at the second dot ("1.2") rather than joined ("1.23"): with no keystroke to
- * ignore there is nothing to say which reading was meant, and the shorter one
- * cannot silently invent a bigger number. */
-export function commitExpression(raw: string): string {
-  const s = raw.trim();
-  if (looksLikeExpression(s)) {
-    const n = evaluateExpression(s);
-    if (n !== null) return formatResult(n);
-    // Unparseable (e.g. a half-typed "12+"): fall through to a digits-only clean.
-  }
-  // Global, like sanitizeLive's: these two are the two halves of one rule and must
-  // not appear to state it differently. (The `[^0-9.-]` strip on the same line
-  // already ate whatever commas a non-global replace missed, so this changes no
-  // behaviour — it removes the need for the next reader to run it to find that out.)
-  const cleaned = s
-    .replace(/,/g, ".")
-    .replace(/[^0-9.-]/g, "")
-    .replace(/(?!^)-/g, "");
-  return cleaned.replace(/^(-?\d*\.?\d*).*$/, "$1");
-}
-
-/** The live, per-keystroke transform a numeric field applies: comma → dot and
- * drop anything that isn't a digit, decimal point, arithmetic operator (incl.
- * the on-screen `× ÷` glyphs) or paren — so a typed calculation survives
- * keystroke-by-keystroke but stray characters can't be entered. A lone leading
- * `-` is kept — in a plain field it is simply a negative amount; in a field whose
- * caller owns the sign it is read off again by {@link splitLeadingSign}. The text
- * is resolved to a plain number on blur/Enter via {@link commitExpression}.
- *
- * The typographic minus and the two dashes become "-" first, as in
- * {@link evaluateExpression}: U+2212 is what the kit's own `formatMoney` and
- * `formatNumber` print for every negative since 0.49, and stripping it with the
- * stray characters turned a pasted "−1.234,50 €" into a positive amount (refactor
- * audit 2026-10-30, INP-3). */
-export function sanitizeLive(raw: string): string {
-  return dropExtraDots(
-    raw
-      .replace(/[−–—]/g, "-")
-      .replace(/,/g, ".")
-      .replace(/[^0-9.+\-*/×÷()]/g, ""),
-  );
-}
-
-/**
- * At most ONE decimal point per number (Keksdose live #201).
- *
- * Per NUMBER, not per string: "1.5+2.5" is a legitimate calculation with two dots
- * in two operands, so the counter resets at every operator and parenthesis.
- *
- * A second dot inside one operand is a **no-op keystroke** — the digits after it
- * keep landing, so "1.2" + "." + "3" is "1.23". That is what every calculator does
- * with a repeated decimal point, and it is the only option that does not make the
- * field feel broken ("my 3 disappeared"). This runs on paste as well as on typing,
- * so the malformed value never reaches the rest of the app: everything downstream
- * reads the field with `Number()`, NaN became a silent 0, and on the create form
- * that 0 was painted with the income green — a figure that was not a number at all
- * asserting money was coming in.
- */
-function dropExtraDots(s: string): string {
-  let out = "";
-  let dotInNumber = false;
-  for (const ch of s) {
-    if (ch === ".") {
-      if (dotInNumber) continue;
-      dotInNumber = true;
-    } else if (ch < "0" || ch > "9") {
-      // An operator or a paren ends the current operand.
-      dotInNumber = false;
-    }
-    out += ch;
-  }
-  return out;
-}
-
-/** A bare, unsigned amount: digits with at most one decimal separator and nothing
- *  else — "42", "42.", ".5", "0,5". NOT "" (an empty field has no figure to put a
- *  sign in front of), not "-42", not "12+5". It is the only shape a DISPLAYED sign
- *  prefix makes sense in front of; an expression carries its own arithmetic and has
- *  to survive keystroke-for-keystroke. */
-export function isBareAmount(s: string): boolean {
-  const t = s.trim();
-  return t !== "" && /^\d*[.,]?\d*$/.test(t);
-}
-
-/**
- * Split a LEADING sign off a plain signed number (Keksdose live #201 rework):
- * `"-42"` → `{ sign: "-", rest: "42" }`, everything else → `{ sign: "", rest: text }`.
- *
- * Only in front of a bare amount, because a minus with arithmetic after it IS
- * arithmetic: "12-30" is a subtraction, and "-12+5" is -7, not -(12+5). Those come
- * back untouched and are resolved by {@link commitExpression} on blur — at which
- * point the RESULT is a plain signed number and this function does get to speak.
- *
- * A lone "-" splits (rest ""): the sign is a statement about the direction the
- * moment it is typed, before any digit exists.
- */
-export function splitLeadingSign(text: string): { sign: "" | "-" | "+"; rest: string } {
-  const trimmed = text.trimStart();
-  const sign = trimmed.charAt(0);
-  if (sign !== "-" && sign !== "+") return { sign: "", rest: text };
-  const rest = trimmed.slice(1);
-  if (rest !== "" && !isBareAmount(rest)) return { sign: "", rest: text };
-  return { sign, rest };
-}