@hadoku/task-ui-components 4.20.3 → 4.20.4

package/dist/components/ConnectedSettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConnectedSettings.d.ts","sourceRoot":"","sources":["../../src/components/ConnectedSettings.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAmD,MAAM,OAAO,CAAA;AAEvE,OAAO,EAOL,KAAK,IAAI,EACV,MAAM,uBAAuB,CAAA;AAC9B,OAAO,mBAAmB,CAAA;AAE1B,MAAM,WAAW,sBAAsB;IACrC;;;;;;+EAM2E;IAC3E,QAAQ,CAAC,EAAE,IAAI,CAAA;IACf,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,mEAAmE;IACnE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAA;IAC5C;;;;;;8BAM0B;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAC3B;AAkBD,wBAAgB,iBAAiB,CAAC,EAChC,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,QAAQ,EACd,YAAY,EACZ,QAAQ,EACT,EAAE,sBAAsB,qBA6XxB"}
+{"version":3,"file":"ConnectedSettings.d.ts","sourceRoot":"","sources":["../../src/components/ConnectedSettings.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAmD,MAAM,OAAO,CAAA;AAEvE,OAAO,EAUL,KAAK,IAAI,EACV,MAAM,uBAAuB,CAAA;AAC9B,OAAO,mBAAmB,CAAA;AAE1B,MAAM,WAAW,sBAAsB;IACrC;;;;;;+EAM2E;IAC3E,QAAQ,CAAC,EAAE,IAAI,CAAA;IACf,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,mEAAmE;IACnE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAA;IAC5C;;;;;;8BAM0B;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAC3B;AAkBD,wBAAgB,iBAAiB,CAAC,EAChC,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,QAAQ,EACd,YAAY,EACZ,QAAQ,EACT,EAAE,sBAAsB,qBA0cxB"}

package/dist/components/ConnectedSettings.js

@@ -1,7 +1,7 @@
 import { jsxs, jsx, Fragment } from "react/jsx-runtime";
 import { useState, useRef, useEffect, useCallback } from "react";
 import { SettingsIcon } from "./ThemeIcons.js";
-import { prefetchSettings, setDisplayName, loadSignIn, switchKeyHref, setContentLevel } from "../lib/settingsClient.js";
+import { prefetchSettings, setDisplayName, loadSignIn, switchKeyHref, loadSignInClient, passkeyHref, setContentLevel, passkeysSupported } from "../lib/settingsClient.js";
 /* empty css                */
 function reportErr(err) {
   console.error("[ConnectedSettings] action failed", err?.message ?? err);
@@ -31,6 +31,9 @@ function ConnectedSettings({
   const [keyDraft, setKeyDraft] = useState("");
   const [keyBusy, setKeyBusy] = useState(false);
   const [keyError, setKeyError] = useState(null);
+  const [passkeyBusy, setPasskeyBusy] = useState(false);
+  const [passkeySaved, setPasskeySaved] = useState(false);
+  const [passkeyError, setPasskeyError] = useState(null);
   const [content, setContent] = useState(null);
   const [levelSaving, setLevelSaving] = useState(false);
   const [resolving, setResolving] = useState(true);
@@ -111,6 +114,39 @@ function ConnectedSettings({
     }
     window.location.reload();
   }, [keyDraft]);
+  const savePasskey = useCallback(async () => {
+    setPasskeyBusy(true);
+    setPasskeyError(null);
+    const client = await loadSignInClient();
+    if (!client?.addPasskey) {
+      window.location.assign(passkeyHref("add"));
+      return;
+    }
+    try {
+      await client.addPasskey();
+      setPasskeySaved(true);
+    } catch (err) {
+      setPasskeyError(err?.message || "Passkey not saved");
+    }
+    setPasskeyBusy(false);
+  }, []);
+  const signInWithPasskey = useCallback(async () => {
+    setKeyBusy(true);
+    setKeyError(null);
+    const client = await loadSignInClient();
+    if (!client?.signInWithPasskey) {
+      window.location.assign(passkeyHref("signin"));
+      return;
+    }
+    try {
+      await client.signInWithPasskey();
+    } catch (err) {
+      setKeyError(err?.message || "Passkey sign-in cancelled");
+      setKeyBusy(false);
+      return;
+    }
+    window.location.reload();
+  }, []);
   const pickLevel = useCallback(
     async (level) => {
       if (!content || level === content.level || levelSaving) return;
@@ -227,6 +263,24 @@ function ConnectedSettings({
           /* @__PURE__ */ jsx("span", { className: "settings-popout__hint", children: "Currently unavailable." })
         )
       ] }),
+      !resolving && userType !== "public" && passkeysSupported() && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsxs("section", { className: "settings-popout__row", children: [
+          /* @__PURE__ */ jsx("span", { className: "settings-popout__label", children: "Passkey" }),
+          /* @__PURE__ */ jsx(
+            "button",
+            {
+              type: "button",
+              className: "settings-popout__btn",
+              disabled: passkeyBusy || passkeySaved,
+              onClick: () => {
+                savePasskey().catch(reportErr);
+              },
+              children: passkeySaved ? "Saved" : passkeyBusy ? "Saving…" : "Save"
+            }
+          )
+        ] }),
+        passkeyError && /* @__PURE__ */ jsx("span", { className: "settings-popout__error", role: "alert", children: passkeyError })
+      ] }),
       keyFormOpen ? /* @__PURE__ */ jsx("section", { className: "settings-popout__row settings-popout__row--stack", children: /* @__PURE__ */ jsxs(
         "form",
         {
@@ -277,6 +331,18 @@ function ConnectedSettings({
                 }
               )
             ] }),
+            passkeysSupported() && /* @__PURE__ */ jsx(
+              "button",
+              {
+                type: "button",
+                className: "settings-popout__btn",
+                disabled: keyBusy,
+                onClick: () => {
+                  signInWithPasskey().catch(reportErr);
+                },
+                children: "Use a passkey"
+              }
+            ),
             keyError && /* @__PURE__ */ jsx(
               "span",
               {

package/dist/components/ConnectedSettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConnectedSettings.js","sources":["../../src/components/ConnectedSettings.tsx"],"sourcesContent":["/**\n * ConnectedSettings — the unified per-user settings control for the hadoku\n * ecosystem: a gear button that opens a popout housing everything that is a\n * property of the PERSON (not the app):\n *   - current access tier (read-only, friendly label)\n *   - display name (inline edit → POST /session/name)\n *   - global content-visibility level (tiered pill → PUT /prefs/api/v1/content-level)\n *   - switch key (an inline sign-in form, on the site's own sign-in client)\n *\n * \"Connected\" (parallel to ConnectedThemePicker): it self-wires to the\n * hadoku.me edge-router via same-origin fetches (see lib/settingsClient), so\n * dropping `<ConnectedSettings />` into any app under hadoku.me needs zero\n * props. Identity is resolved via whoami() unless the host passes `userType` /\n * `name` (avoids a redundant fetch when the app already knows).\n *\n * All of that is resolved AT MOUNT via `prefetchSettings()`, never on\n * gear-click — opening the popout must cost zero requests. See the effect\n * below, and `e2e/settings-prefetch.spec.ts` in hadoku-task, which fails if the\n * fetch moves back behind the click.\n *\n * Mirrors ThemePicker's controlled-popout pattern: owns its own `open` state +\n * a full-viewport overlay for click-outside dismiss. The content pill renders\n * `maxLevel` segments (friend ⇒ 3, admin ⇒ 4) and is hidden for public callers.\n * maxLevel comes from the server so the tier ceiling is never trusted from the\n * client.\n */\nimport React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { SettingsIcon } from './ThemeIcons'\nimport {\n  prefetchSettings,\n  setContentLevel,\n  setDisplayName,\n  loadSignIn,\n  switchKeyHref,\n  type ContentLevelState,\n  type Tier\n} from '../lib/settingsClient'\nimport '../app-header.css'\n\nexport interface ConnectedSettingsProps {\n  /** Caller's tier. Omit to self-resolve via whoami().\n   *\n   *  This exists for apps that CANNOT reach `/session/whoami` — conjure sits\n   *  behind a path-prefixed shim that serves nothing outside `/conjure`, so\n   *  whoami 404s and the tier would fall back to guest. It is an identity\n   *  hint, not a way to present a different tier than the edge assigns: every\n   *  gate that matters is enforced server-side off the edge-stamped tier. */\n  userType?: Tier\n  /** Display name. Omit to self-resolve via whoami(). Same rationale. */\n  name?: string | null\n  /** Notify the host (e.g. a \"Signed in as …\" label) of a rename. */\n  onNameChange?: (name: string | null) => void\n  /** App-specific settings rendered as a final section in the same popout, so\n   *  an app with its own preferences keeps ONE unified gear instead of a second\n   *  control. Shown under an \"App preferences\" divider.\n   *\n   *  This slot is deliberately unconstrained — put whatever the app needs in\n   *  it. The constraint is only that it lands AFTER the four canonical rows and\n   *  cannot change them. */\n  children?: React.ReactNode\n}\n\n/** Rejection sink for fire-and-forget settings actions. The client helpers\n *  already resolve to null on failure (state reflects it), so this only trips\n *  on truly unexpected throws — log rather than swallow silently. */\nfunction reportErr(err: unknown) {\n  // task-ui-components v2 dropped its logger; keep the package dependency-free.\n  console.error('[ConnectedSettings] action failed', (err as Error)?.message ?? err)\n}\n\nconst TIER_LABEL: Record<Tier, string> = {\n  admin: 'Administrator',\n  wife: 'Wife',\n  service: 'Service',\n  friend: 'Friend',\n  public: 'Guest'\n}\n\nexport function ConnectedSettings({\n  userType: userTypeProp,\n  name: nameProp,\n  onNameChange,\n  children\n}: ConnectedSettingsProps) {\n  const [open, setOpen] = useState(false)\n  const rootRef = useRef<HTMLDivElement>(null)\n\n  // Identity — from props if supplied, else resolved lazily via whoami().\n  const [userType, setUserType] = useState<Tier>(userTypeProp ?? 'public')\n  const [resolvedName, setResolvedName] = useState<string | null>(nameProp ?? null)\n\n  // Name editing\n  const [nameDraft, setNameDraft] = useState(resolvedName ?? '')\n  const [editingName, setEditingName] = useState(false)\n  const [nameSaving, setNameSaving] = useState(false)\n  const [displayName, setLocalName] = useState<string | null>(resolvedName)\n\n  // Key swap. The draft lives only in this state and the input: it is never\n  // logged, stored or sent anywhere but the site's sign-in client.\n  const [keyFormOpen, setKeyFormOpen] = useState(false)\n  const [keyDraft, setKeyDraft] = useState('')\n  const [keyBusy, setKeyBusy] = useState(false)\n  const [keyError, setKeyError] = useState<string | null>(null)\n\n  // Content level\n  const [content, setContent] = useState<ContentLevelState | null>(null)\n  const [levelSaving, setLevelSaving] = useState(false)\n\n  // One flag for the whole prefetch, not one per request — the panel body\n  // reveals when everything has settled, so nothing pops in a beat late. In\n  // practice the user never sees it: the prefetch starts at mount and is long\n  // done by the time the gear is clicked. It only shows if they click within\n  // the first moments of the page.\n  const [resolving, setResolving] = useState(true)\n\n  // Everyone who is SIGNED IN, expressed as \"not public\" rather than as a list\n  // of tiers. The list form (`=== 'admin' || === 'friend' || === 'service'`)\n  // is an exact-match allowlist: it silently excluded `wife` the moment that\n  // tier existed, which is the failure the rank model is meant to prevent.\n  // There is no rank helper in this bundle, but \"above public\" needs none.\n  const showContentPill = userType !== 'public'\n\n  // Keep local identity in sync when the host controls it via props.\n  useEffect(() => {\n    if (userTypeProp !== undefined) setUserType(userTypeProp)\n  }, [userTypeProp])\n  useEffect(() => {\n    if (nameProp !== undefined) {\n      setResolvedName(nameProp)\n      setLocalName(nameProp)\n      setNameDraft(nameProp ?? '')\n    }\n  }, [nameProp])\n\n  // Resolve everything the panel shows AT MOUNT — not on open.\n  //\n  // This used to be gated on `open`, which made the gear the trigger for\n  // whoami + content-level (167ms / 186ms on prod, concurrent) — a round trip\n  // the user waited out with the panel already on screen and blank. Nothing\n  // about that data depends on the click:\n  // it's the signed-in user's own identity, settled at boot and unchanged for\n  // the life of the page. So it rides along with the app's boot traffic, and\n  // clicking the gear costs zero requests. `e2e/settings-prefetch.spec.ts` in\n  // hadoku-task pins that.\n  //\n  // The client memoises across callers, so mounting this in several places (or\n  // remounting it) does not multiply requests, and on hadoku.me the identity\n  // half is free — it awaits the whoami the shell already had in flight.\n  useEffect(() => {\n    let live = true\n    prefetchSettings({ userType: userTypeProp, name: nameProp })\n      .then(({ identity, content: state }) => {\n        if (!live) return\n        // Props stay authoritative: the host passed them because it can see an\n        // identity this component can't resolve for itself.\n        if (userTypeProp === undefined) {\n          setUserType(identity.userType)\n          setResolvedName(identity.name)\n          setLocalName(identity.name)\n          setNameDraft(identity.name ?? '')\n        }\n        if (state) setContent(state)\n      })\n      .catch(reportErr)\n      .finally(() => {\n        if (live) setResolving(false)\n      })\n    return () => {\n      live = false\n    }\n    // Hints are read once, on the first mount that gets there — the prefetch is\n    // page-scoped and a later prop change cannot un-issue it. Identity changes\n    // arrive through the sync effects above, and a key swap reloads the page.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [])\n\n  // Escape closes.\n  useEffect(() => {\n    if (!open) return\n    const onKey = (e: KeyboardEvent) => {\n      if (e.key === 'Escape') setOpen(false)\n    }\n    window.addEventListener('keydown', onKey)\n    return () => window.removeEventListener('keydown', onKey)\n  }, [open])\n\n  const saveName = useCallback(async () => {\n    const trimmed = nameDraft.trim()\n    if (!trimmed || trimmed === displayName) {\n      setEditingName(false)\n      return\n    }\n    setNameSaving(true)\n    const stored = await setDisplayName(trimmed)\n    setNameSaving(false)\n    if (stored !== null) {\n      setLocalName(stored)\n      setNameDraft(stored)\n      onNameChange?.(stored)\n    }\n    setEditingName(false)\n  }, [nameDraft, displayName, onNameChange])\n\n  // Open the form AND start loading the site's sign-in client, which begins its\n  // fingerprint collection as it evaluates — so it is ready by submit. Where the\n  // client cannot load at all (not on hadoku.me), the page-level /auth flow is\n  // the only way to sign in, so go there.\n  const openKeyForm = useCallback(() => {\n    setKeyFormOpen(true)\n    setKeyError(null)\n    loadSignIn()\n      .then(signIn => {\n        if (!signIn) window.location.assign(switchKeyHref())\n      })\n      .catch(reportErr)\n  }, [])\n\n  const submitKey = useCallback(async () => {\n    setKeyBusy(true)\n    setKeyError(null)\n    const signIn = await loadSignIn()\n    if (!signIn) {\n      window.location.assign(switchKeyHref())\n      return\n    }\n    try {\n      await signIn(keyDraft)\n    } catch (err) {\n      // A refused key is an inline error, never a redirect.\n      setKeyError((err as Error)?.message || 'Invalid key')\n      setKeyBusy(false)\n      return\n    }\n    // The page now acts for a different identity: everything must re-mount.\n    // Busy stays on through the reload so the form can't be resubmitted.\n    window.location.reload()\n  }, [keyDraft])\n\n  const pickLevel = useCallback(\n    async (level: number) => {\n      if (!content || level === content.level || levelSaving) return\n      const prev = content\n      setContent({ ...content, level }) // optimistic\n      setLevelSaving(true)\n      const result = await setContentLevel(level)\n      setLevelSaving(false)\n      setContent(result ?? prev) // adopt server truth, or revert\n    },\n    [content, levelSaving]\n  )\n\n  // No caller-supplied class on the root. The four rows below are the\n  // platform's, not the app's, and a className here is enough to restyle or\n  // hide any of them — which is the drift this component exists to prevent.\n  // Apps extend via `children`, never by reaching into this markup.\n  return (\n    <div className=\"settings-popout\" ref={rootRef}>\n      <button\n        type=\"button\"\n        className=\"app-header__icon-btn settings-toggle-btn\"\n        aria-label=\"User settings\"\n        aria-expanded={open}\n        onClick={() => setOpen(v => !v)}\n      >\n        <SettingsIcon />\n      </button>\n\n      {open && <div className=\"settings-popout__overlay\" onClick={() => setOpen(false)} />}\n\n      {open && (\n        <div className=\"settings-popout__panel\" role=\"dialog\" aria-label=\"User settings\">\n          <div className=\"settings-popout__header\">Settings</div>\n\n          {/* Access tier. While resolving, the state still says 'public' —\n              rendering \"Guest\" there would be a wrong answer that corrects\n              itself a moment later, which reads exactly like the lag this\n              placeholder exists to remove. */}\n          <section className=\"settings-popout__row\">\n            <span className=\"settings-popout__label\">Access tier</span>\n            {resolving ? (\n              <span className=\"settings-popout__value\">…</span>\n            ) : (\n              <span className={`settings-popout__tier settings-popout__tier--${userType}`}>\n                {TIER_LABEL[userType]}\n              </span>\n            )}\n          </section>\n\n          {/* Display name */}\n          <section className=\"settings-popout__row\">\n            <span className=\"settings-popout__label\">Display name</span>\n            {resolving ? (\n              <span className=\"settings-popout__value\">…</span>\n            ) : editingName ? (\n              <span className=\"settings-popout__inline\">\n                <input\n                  className=\"settings-popout__input\"\n                  value={nameDraft}\n                  maxLength={64}\n                  autoFocus\n                  disabled={nameSaving}\n                  onChange={e => setNameDraft(e.target.value)}\n                  onKeyDown={e => {\n                    if (e.key === 'Enter') {\n                      saveName().catch(reportErr)\n                    }\n                    if (e.key === 'Escape') {\n                      setEditingName(false)\n                      setNameDraft(displayName ?? '')\n                    }\n                  }}\n                />\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn settings-popout__btn--primary\"\n                  disabled={nameSaving}\n                  onClick={() => {\n                    saveName().catch(reportErr)\n                  }}\n                >\n                  {nameSaving ? '…' : 'Save'}\n                </button>\n              </span>\n            ) : (\n              <span className=\"settings-popout__inline\">\n                <span className=\"settings-popout__value\">{displayName || 'Unnamed'}</span>\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn\"\n                  onClick={() => {\n                    setNameDraft(displayName ?? '')\n                    setEditingName(true)\n                  }}\n                >\n                  Edit\n                </button>\n              </span>\n            )}\n          </section>\n\n          {/* Content visibility level. Held back until the first-open fetch\n              settles, so it lands in the same paint as the tier and name\n              rather than a round trip behind them. `content` is fetched\n              concurrently with whoami(), so by then it is already here. */}\n          {!resolving && showContentPill && (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <span className=\"settings-popout__label\">Content visibility</span>\n              {content ? (\n                <>\n                  <div\n                    className=\"settings-popout__pill\"\n                    role=\"radiogroup\"\n                    aria-label=\"Content visibility level\"\n                  >\n                    {Array.from({ length: content.maxLevel }, (_, i) => i + 1).map(lvl => (\n                      <button\n                        key={lvl}\n                        type=\"button\"\n                        role=\"radio\"\n                        aria-checked={lvl === content.level}\n                        aria-label={`Level ${lvl}`}\n                        className={`settings-popout__seg${\n                          lvl <= content.level ? ' settings-popout__seg--filled' : ''\n                        }`}\n                        disabled={levelSaving}\n                        onClick={() => {\n                          pickLevel(lvl).catch(reportErr)\n                        }}\n                      >\n                        {lvl}\n                      </button>\n                    ))}\n                  </div>\n                  <span className=\"settings-popout__hint\">\n                    Higher levels reveal more mature content across apps. Level 1 is\n                    safe-for-everyone.\n                  </span>\n                </>\n              ) : (\n                // Not \"Loading…\" — the fetch has already settled by the time\n                // this section renders at all, so a null here means it failed.\n                <span className=\"settings-popout__hint\">Currently unavailable.</span>\n              )}\n            </section>\n          )}\n\n          {/* Switch key. Signs in inline through the SITE's sign-in client\n              (the /auth page's own code path), never a post of ours. A real\n              <form> with a username + current-password pair, so password\n              managers offer and save the key. */}\n          {keyFormOpen ? (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <form\n                className=\"settings-popout__key-form\"\n                onSubmit={e => {\n                  e.preventDefault()\n                  submitKey().catch(reportErr)\n                }}\n              >\n                <input\n                  type=\"text\"\n                  name=\"username\"\n                  autoComplete=\"username\"\n                  value=\"hadoku\"\n                  readOnly\n                  hidden\n                />\n                <label className=\"settings-popout__label\" htmlFor=\"settings-popout-key\">\n                  Access key\n                </label>\n                <span className=\"settings-popout__inline\">\n                  <input\n                    id=\"settings-popout-key\"\n                    className=\"settings-popout__input\"\n                    type=\"password\"\n                    name=\"password\"\n                    autoComplete=\"current-password\"\n                    autoCapitalize=\"none\"\n                    spellCheck={false}\n                    autoFocus\n                    value={keyDraft}\n                    disabled={keyBusy}\n                    aria-invalid={keyError !== null}\n                    aria-describedby={keyError ? 'settings-popout-key-error' : undefined}\n                    onChange={e => setKeyDraft(e.target.value)}\n                  />\n                  <button\n                    type=\"submit\"\n                    className=\"settings-popout__btn settings-popout__btn--primary\"\n                    disabled={keyBusy}\n                  >\n                    {keyBusy ? 'Signing in…' : 'Sign in'}\n                  </button>\n                </span>\n                {keyError && (\n                  <span\n                    id=\"settings-popout-key-error\"\n                    className=\"settings-popout__error\"\n                    role=\"alert\"\n                  >\n                    {keyError}\n                  </span>\n                )}\n              </form>\n            </section>\n          ) : (\n            <section className=\"settings-popout__row\">\n              <span className=\"settings-popout__label\">Access key</span>\n              <button type=\"button\" className=\"settings-popout__btn\" onClick={openKeyForm}>\n                Switch key\n              </button>\n            </section>\n          )}\n\n          {/* App-specific settings (optional) — same popout, one gear. */}\n          {children && (\n            <section className=\"settings-popout__row settings-popout__row--stack settings-popout__app\">\n              {children}\n            </section>\n          )}\n        </div>\n      )}\n    </div>\n  )\n}\n"],"names":[],"mappings":";;;;;AAiEA,SAAS,UAAU,KAAc;AAE/B,UAAQ,MAAM,qCAAsC,KAAe,WAAW,GAAG;AACnF;AAEA,MAAM,aAAmC;AAAA,EACvC,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,kBAAkB;AAAA,EAChC,UAAU;AAAA,EACV,MAAM;AAAA,EACN;AAAA,EACA;AACF,GAA2B;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,OAAuB,IAAI;AAG3C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAe,gBAAgB,QAAQ;AACvE,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,YAAY,IAAI;AAGhF,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,gBAAgB,EAAE;AAC7D,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,aAAa,YAAY,IAAI,SAAwB,YAAY;AAIxE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAG5D,QAAM,CAAC,SAAS,UAAU,IAAI,SAAmC,IAAI;AACrE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AAOpD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAO/C,QAAM,kBAAkB,aAAa;AAGrC,YAAU,MAAM;AACd,QAAI,iBAAiB,OAAW,aAAY,YAAY;AAAA,EAC1D,GAAG,CAAC,YAAY,CAAC;AACjB,YAAU,MAAM;AACd,QAAI,aAAa,QAAW;AAC1B,sBAAgB,QAAQ;AACxB,mBAAa,QAAQ;AACrB,mBAAa,YAAY,EAAE;AAAA,IAC7B;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAgBb,YAAU,MAAM;AACd,QAAI,OAAO;AACX,qBAAiB,EAAE,UAAU,cAAc,MAAM,SAAA,CAAU,EACxD,KAAK,CAAC,EAAE,UAAU,SAAS,YAAY;AACtC,UAAI,CAAC,KAAM;AAGX,UAAI,iBAAiB,QAAW;AAC9B,oBAAY,SAAS,QAAQ;AAC7B,wBAAgB,SAAS,IAAI;AAC7B,qBAAa,SAAS,IAAI;AAC1B,qBAAa,SAAS,QAAQ,EAAE;AAAA,MAClC;AACA,UAAI,kBAAkB,KAAK;AAAA,IAC7B,CAAC,EACA,MAAM,SAAS,EACf,QAAQ,MAAM;AACb,UAAI,mBAAmB,KAAK;AAAA,IAC9B,CAAC;AACH,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EAKF,GAAG,CAAA,CAAE;AAGL,YAAU,MAAM;AACd,QAAI,CAAC,KAAM;AACX,UAAM,QAAQ,CAAC,MAAqB;AAClC,UAAI,EAAE,QAAQ,SAAU,SAAQ,KAAK;AAAA,IACvC;AACA,WAAO,iBAAiB,WAAW,KAAK;AACxC,WAAO,MAAM,OAAO,oBAAoB,WAAW,KAAK;AAAA,EAC1D,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,WAAW,YAAY,YAAY;AACvC,UAAM,UAAU,UAAU,KAAA;AAC1B,QAAI,CAAC,WAAW,YAAY,aAAa;AACvC,qBAAe,KAAK;AACpB;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,UAAM,SAAS,MAAM,eAAe,OAAO;AAC3C,kBAAc,KAAK;AACnB,QAAI,WAAW,MAAM;AACnB,mBAAa,MAAM;AACnB,mBAAa,MAAM;AACnB,qBAAe,MAAM;AAAA,IACvB;AACA,mBAAe,KAAK;AAAA,EACtB,GAAG,CAAC,WAAW,aAAa,YAAY,CAAC;AAMzC,QAAM,cAAc,YAAY,MAAM;AACpC,mBAAe,IAAI;AACnB,gBAAY,IAAI;AAChB,eAAA,EACG,KAAK,CAAA,WAAU;AACd,UAAI,CAAC,OAAQ,QAAO,SAAS,OAAO,eAAe;AAAA,IACrD,CAAC,EACA,MAAM,SAAS;AAAA,EACpB,GAAG,CAAA,CAAE;AAEL,QAAM,YAAY,YAAY,YAAY;AACxC,eAAW,IAAI;AACf,gBAAY,IAAI;AAChB,UAAM,SAAS,MAAM,WAAA;AACrB,QAAI,CAAC,QAAQ;AACX,aAAO,SAAS,OAAO,eAAe;AACtC;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,QAAQ;AAAA,IACvB,SAAS,KAAK;AAEZ,kBAAa,KAAe,WAAW,aAAa;AACpD,iBAAW,KAAK;AAChB;AAAA,IACF;AAGA,WAAO,SAAS,OAAA;AAAA,EAClB,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,YAAY;AAAA,IAChB,OAAO,UAAkB;AACvB,UAAI,CAAC,WAAW,UAAU,QAAQ,SAAS,YAAa;AACxD,YAAM,OAAO;AACb,iBAAW,EAAE,GAAG,SAAS,OAAO;AAChC,qBAAe,IAAI;AACnB,YAAM,SAAS,MAAM,gBAAgB,KAAK;AAC1C,qBAAe,KAAK;AACpB,iBAAW,UAAU,IAAI;AAAA,IAC3B;AAAA,IACA,CAAC,SAAS,WAAW;AAAA,EAAA;AAOvB,SACE,qBAAC,OAAA,EAAI,WAAU,mBAAkB,KAAK,SACpC,UAAA;AAAA,IAAA;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,MAAK;AAAA,QACL,WAAU;AAAA,QACV,cAAW;AAAA,QACX,iBAAe;AAAA,QACf,SAAS,MAAM,QAAQ,CAAA,MAAK,CAAC,CAAC;AAAA,QAE9B,8BAAC,cAAA,CAAA,CAAa;AAAA,MAAA;AAAA,IAAA;AAAA,IAGf,4BAAS,OAAA,EAAI,WAAU,4BAA2B,SAAS,MAAM,QAAQ,KAAK,GAAG;AAAA,IAEjF,6BACE,OAAA,EAAI,WAAU,0BAAyB,MAAK,UAAS,cAAW,iBAC/D,UAAA;AAAA,MAAA,oBAAC,OAAA,EAAI,WAAU,2BAA0B,UAAA,YAAQ;AAAA,MAMjD,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,eAAW;AAAA,QACnD,YACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,IAAA,CAAC,IAE1C,oBAAC,QAAA,EAAK,WAAW,gDAAgD,QAAQ,IACtE,UAAA,WAAW,QAAQ,EAAA,CACtB;AAAA,MAAA,GAEJ;AAAA,MAGA,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,gBAAY;AAAA,QACpD,YACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,IAAA,CAAC,IACxC,cACF,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,WAAU;AAAA,cACV,OAAO;AAAA,cACP,WAAW;AAAA,cACX,WAAS;AAAA,cACT,UAAU;AAAA,cACV,UAAU,CAAA,MAAK,aAAa,EAAE,OAAO,KAAK;AAAA,cAC1C,WAAW,CAAA,MAAK;AACd,oBAAI,EAAE,QAAQ,SAAS;AACrB,2BAAA,EAAW,MAAM,SAAS;AAAA,gBAC5B;AACA,oBAAI,EAAE,QAAQ,UAAU;AACtB,iCAAe,KAAK;AACpB,+BAAa,eAAe,EAAE;AAAA,gBAChC;AAAA,cACF;AAAA,YAAA;AAAA,UAAA;AAAA,UAEF;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,UAAU;AAAA,cACV,SAAS,MAAM;AACb,yBAAA,EAAW,MAAM,SAAS;AAAA,cAC5B;AAAA,cAEC,uBAAa,MAAM;AAAA,YAAA;AAAA,UAAA;AAAA,QACtB,EAAA,CACF,IAEA,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAA,oBAAC,QAAA,EAAK,WAAU,0BAA0B,UAAA,eAAe,WAAU;AAAA,UACnE;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM;AACb,6BAAa,eAAe,EAAE;AAC9B,+BAAe,IAAI;AAAA,cACrB;AAAA,cACD,UAAA;AAAA,YAAA;AAAA,UAAA;AAAA,QAED,EAAA,CACF;AAAA,MAAA,GAEJ;AAAA,MAMC,CAAC,aAAa,mBACb,qBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,sBAAkB;AAAA,QAC1D,UACC,qBAAA,UAAA,EACE,UAAA;AAAA,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,WAAU;AAAA,cACV,MAAK;AAAA,cACL,cAAW;AAAA,cAEV,UAAA,MAAM,KAAK,EAAE,QAAQ,QAAQ,SAAA,GAAY,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,IAAI,CAAA,QAC7D;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBAEC,MAAK;AAAA,kBACL,MAAK;AAAA,kBACL,gBAAc,QAAQ,QAAQ;AAAA,kBAC9B,cAAY,SAAS,GAAG;AAAA,kBACxB,WAAW,uBACT,OAAO,QAAQ,QAAQ,kCAAkC,EAC3D;AAAA,kBACA,UAAU;AAAA,kBACV,SAAS,MAAM;AACb,8BAAU,GAAG,EAAE,MAAM,SAAS;AAAA,kBAChC;AAAA,kBAEC,UAAA;AAAA,gBAAA;AAAA,gBAbI;AAAA,cAAA,CAeR;AAAA,YAAA;AAAA,UAAA;AAAA,UAEH,oBAAC,QAAA,EAAK,WAAU,yBAAwB,UAAA,sFAAA,CAGxC;AAAA,QAAA,GACF;AAAA;AAAA;AAAA,UAIA,oBAAC,QAAA,EAAK,WAAU,yBAAwB,UAAA,yBAAA,CAAsB;AAAA;AAAA,MAAA,GAElE;AAAA,MAOD,cACC,oBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAC;AAAA,QAAA;AAAA,UACC,WAAU;AAAA,UACV,UAAU,CAAA,MAAK;AACb,cAAE,eAAA;AACF,sBAAA,EAAY,MAAM,SAAS;AAAA,UAC7B;AAAA,UAEA,UAAA;AAAA,YAAA;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,MAAK;AAAA,gBACL,cAAa;AAAA,gBACb,OAAM;AAAA,gBACN,UAAQ;AAAA,gBACR,QAAM;AAAA,cAAA;AAAA,YAAA;AAAA,gCAEP,SAAA,EAAM,WAAU,0BAAyB,SAAQ,uBAAsB,UAAA,cAExE;AAAA,YACA,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,cAAA;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBACC,IAAG;AAAA,kBACH,WAAU;AAAA,kBACV,MAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,gBAAe;AAAA,kBACf,YAAY;AAAA,kBACZ,WAAS;AAAA,kBACT,OAAO;AAAA,kBACP,UAAU;AAAA,kBACV,gBAAc,aAAa;AAAA,kBAC3B,oBAAkB,WAAW,8BAA8B;AAAA,kBAC3D,UAAU,CAAA,MAAK,YAAY,EAAE,OAAO,KAAK;AAAA,gBAAA;AAAA,cAAA;AAAA,cAE3C;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBACC,MAAK;AAAA,kBACL,WAAU;AAAA,kBACV,UAAU;AAAA,kBAET,oBAAU,gBAAgB;AAAA,gBAAA;AAAA,cAAA;AAAA,YAC7B,GACF;AAAA,YACC,YACC;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,IAAG;AAAA,gBACH,WAAU;AAAA,gBACV,MAAK;AAAA,gBAEJ,UAAA;AAAA,cAAA;AAAA,YAAA;AAAA,UACH;AAAA,QAAA;AAAA,MAAA,EAEJ,CACF,IAEA,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,cAAU;AAAA,QACnD,oBAAC,YAAO,MAAK,UAAS,WAAU,wBAAuB,SAAS,aAAa,UAAA,aAAA,CAE7E;AAAA,MAAA,GACF;AAAA,MAID,YACC,oBAAC,WAAA,EAAQ,WAAU,yEAChB,SAAA,CACH;AAAA,IAAA,EAAA,CAEJ;AAAA,EAAA,GAEJ;AAEJ;"}
+{"version":3,"file":"ConnectedSettings.js","sources":["../../src/components/ConnectedSettings.tsx"],"sourcesContent":["/**\n * ConnectedSettings — the unified per-user settings control for the hadoku\n * ecosystem: a gear button that opens a popout housing everything that is a\n * property of the PERSON (not the app):\n *   - current access tier (read-only, friendly label)\n *   - display name (inline edit → POST /session/name)\n *   - global content-visibility level (tiered pill → PUT /prefs/api/v1/content-level)\n *   - switch key (an inline sign-in form, on the site's own sign-in client)\n *\n * \"Connected\" (parallel to ConnectedThemePicker): it self-wires to the\n * hadoku.me edge-router via same-origin fetches (see lib/settingsClient), so\n * dropping `<ConnectedSettings />` into any app under hadoku.me needs zero\n * props. Identity is resolved via whoami() unless the host passes `userType` /\n * `name` (avoids a redundant fetch when the app already knows).\n *\n * All of that is resolved AT MOUNT via `prefetchSettings()`, never on\n * gear-click — opening the popout must cost zero requests. See the effect\n * below, and `e2e/settings-prefetch.spec.ts` in hadoku-task, which fails if the\n * fetch moves back behind the click.\n *\n * Mirrors ThemePicker's controlled-popout pattern: owns its own `open` state +\n * a full-viewport overlay for click-outside dismiss. The content pill renders\n * `maxLevel` segments (friend ⇒ 3, admin ⇒ 4) and is hidden for public callers.\n * maxLevel comes from the server so the tier ceiling is never trusted from the\n * client.\n */\nimport React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { SettingsIcon } from './ThemeIcons'\nimport {\n  prefetchSettings,\n  setContentLevel,\n  setDisplayName,\n  loadSignIn,\n  loadSignInClient,\n  passkeyHref,\n  passkeysSupported,\n  switchKeyHref,\n  type ContentLevelState,\n  type Tier\n} from '../lib/settingsClient'\nimport '../app-header.css'\n\nexport interface ConnectedSettingsProps {\n  /** Caller's tier. Omit to self-resolve via whoami().\n   *\n   *  This exists for apps that CANNOT reach `/session/whoami` — conjure sits\n   *  behind a path-prefixed shim that serves nothing outside `/conjure`, so\n   *  whoami 404s and the tier would fall back to guest. It is an identity\n   *  hint, not a way to present a different tier than the edge assigns: every\n   *  gate that matters is enforced server-side off the edge-stamped tier. */\n  userType?: Tier\n  /** Display name. Omit to self-resolve via whoami(). Same rationale. */\n  name?: string | null\n  /** Notify the host (e.g. a \"Signed in as …\" label) of a rename. */\n  onNameChange?: (name: string | null) => void\n  /** App-specific settings rendered as a final section in the same popout, so\n   *  an app with its own preferences keeps ONE unified gear instead of a second\n   *  control. Shown under an \"App preferences\" divider.\n   *\n   *  This slot is deliberately unconstrained — put whatever the app needs in\n   *  it. The constraint is only that it lands AFTER the four canonical rows and\n   *  cannot change them. */\n  children?: React.ReactNode\n}\n\n/** Rejection sink for fire-and-forget settings actions. The client helpers\n *  already resolve to null on failure (state reflects it), so this only trips\n *  on truly unexpected throws — log rather than swallow silently. */\nfunction reportErr(err: unknown) {\n  // task-ui-components v2 dropped its logger; keep the package dependency-free.\n  console.error('[ConnectedSettings] action failed', (err as Error)?.message ?? err)\n}\n\nconst TIER_LABEL: Record<Tier, string> = {\n  admin: 'Administrator',\n  wife: 'Wife',\n  service: 'Service',\n  friend: 'Friend',\n  public: 'Guest'\n}\n\nexport function ConnectedSettings({\n  userType: userTypeProp,\n  name: nameProp,\n  onNameChange,\n  children\n}: ConnectedSettingsProps) {\n  const [open, setOpen] = useState(false)\n  const rootRef = useRef<HTMLDivElement>(null)\n\n  // Identity — from props if supplied, else resolved lazily via whoami().\n  const [userType, setUserType] = useState<Tier>(userTypeProp ?? 'public')\n  const [resolvedName, setResolvedName] = useState<string | null>(nameProp ?? null)\n\n  // Name editing\n  const [nameDraft, setNameDraft] = useState(resolvedName ?? '')\n  const [editingName, setEditingName] = useState(false)\n  const [nameSaving, setNameSaving] = useState(false)\n  const [displayName, setLocalName] = useState<string | null>(resolvedName)\n\n  // Key swap. The draft lives only in this state and the input: it is never\n  // logged, stored or sent anywhere but the site's sign-in client.\n  const [keyFormOpen, setKeyFormOpen] = useState(false)\n  const [keyDraft, setKeyDraft] = useState('')\n  const [keyBusy, setKeyBusy] = useState(false)\n  const [keyError, setKeyError] = useState<string | null>(null)\n\n  // Passkeys, through the same site client: save one while signed in, or\n  // sign in with one from the key form.\n  const [passkeyBusy, setPasskeyBusy] = useState(false)\n  const [passkeySaved, setPasskeySaved] = useState(false)\n  const [passkeyError, setPasskeyError] = useState<string | null>(null)\n\n  // Content level\n  const [content, setContent] = useState<ContentLevelState | null>(null)\n  const [levelSaving, setLevelSaving] = useState(false)\n\n  // One flag for the whole prefetch, not one per request — the panel body\n  // reveals when everything has settled, so nothing pops in a beat late. In\n  // practice the user never sees it: the prefetch starts at mount and is long\n  // done by the time the gear is clicked. It only shows if they click within\n  // the first moments of the page.\n  const [resolving, setResolving] = useState(true)\n\n  // Everyone who is SIGNED IN, expressed as \"not public\" rather than as a list\n  // of tiers. The list form (`=== 'admin' || === 'friend' || === 'service'`)\n  // is an exact-match allowlist: it silently excluded `wife` the moment that\n  // tier existed, which is the failure the rank model is meant to prevent.\n  // There is no rank helper in this bundle, but \"above public\" needs none.\n  const showContentPill = userType !== 'public'\n\n  // Keep local identity in sync when the host controls it via props.\n  useEffect(() => {\n    if (userTypeProp !== undefined) setUserType(userTypeProp)\n  }, [userTypeProp])\n  useEffect(() => {\n    if (nameProp !== undefined) {\n      setResolvedName(nameProp)\n      setLocalName(nameProp)\n      setNameDraft(nameProp ?? '')\n    }\n  }, [nameProp])\n\n  // Resolve everything the panel shows AT MOUNT — not on open.\n  //\n  // This used to be gated on `open`, which made the gear the trigger for\n  // whoami + content-level (167ms / 186ms on prod, concurrent) — a round trip\n  // the user waited out with the panel already on screen and blank. Nothing\n  // about that data depends on the click:\n  // it's the signed-in user's own identity, settled at boot and unchanged for\n  // the life of the page. So it rides along with the app's boot traffic, and\n  // clicking the gear costs zero requests. `e2e/settings-prefetch.spec.ts` in\n  // hadoku-task pins that.\n  //\n  // The client memoises across callers, so mounting this in several places (or\n  // remounting it) does not multiply requests, and on hadoku.me the identity\n  // half is free — it awaits the whoami the shell already had in flight.\n  useEffect(() => {\n    let live = true\n    prefetchSettings({ userType: userTypeProp, name: nameProp })\n      .then(({ identity, content: state }) => {\n        if (!live) return\n        // Props stay authoritative: the host passed them because it can see an\n        // identity this component can't resolve for itself.\n        if (userTypeProp === undefined) {\n          setUserType(identity.userType)\n          setResolvedName(identity.name)\n          setLocalName(identity.name)\n          setNameDraft(identity.name ?? '')\n        }\n        if (state) setContent(state)\n      })\n      .catch(reportErr)\n      .finally(() => {\n        if (live) setResolving(false)\n      })\n    return () => {\n      live = false\n    }\n    // Hints are read once, on the first mount that gets there — the prefetch is\n    // page-scoped and a later prop change cannot un-issue it. Identity changes\n    // arrive through the sync effects above, and a key swap reloads the page.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [])\n\n  // Escape closes.\n  useEffect(() => {\n    if (!open) return\n    const onKey = (e: KeyboardEvent) => {\n      if (e.key === 'Escape') setOpen(false)\n    }\n    window.addEventListener('keydown', onKey)\n    return () => window.removeEventListener('keydown', onKey)\n  }, [open])\n\n  const saveName = useCallback(async () => {\n    const trimmed = nameDraft.trim()\n    if (!trimmed || trimmed === displayName) {\n      setEditingName(false)\n      return\n    }\n    setNameSaving(true)\n    const stored = await setDisplayName(trimmed)\n    setNameSaving(false)\n    if (stored !== null) {\n      setLocalName(stored)\n      setNameDraft(stored)\n      onNameChange?.(stored)\n    }\n    setEditingName(false)\n  }, [nameDraft, displayName, onNameChange])\n\n  // Open the form AND start loading the site's sign-in client, which begins its\n  // fingerprint collection as it evaluates — so it is ready by submit. Where the\n  // client cannot load at all (not on hadoku.me), the page-level /auth flow is\n  // the only way to sign in, so go there.\n  const openKeyForm = useCallback(() => {\n    setKeyFormOpen(true)\n    setKeyError(null)\n    loadSignIn()\n      .then(signIn => {\n        if (!signIn) window.location.assign(switchKeyHref())\n      })\n      .catch(reportErr)\n  }, [])\n\n  const submitKey = useCallback(async () => {\n    setKeyBusy(true)\n    setKeyError(null)\n    const signIn = await loadSignIn()\n    if (!signIn) {\n      window.location.assign(switchKeyHref())\n      return\n    }\n    try {\n      await signIn(keyDraft)\n    } catch (err) {\n      // A refused key is an inline error, never a redirect.\n      setKeyError((err as Error)?.message || 'Invalid key')\n      setKeyBusy(false)\n      return\n    }\n    // The page now acts for a different identity: everything must re-mount.\n    // Busy stays on through the reload so the form can't be resubmitted.\n    window.location.reload()\n  }, [keyDraft])\n\n  const savePasskey = useCallback(async () => {\n    setPasskeyBusy(true)\n    setPasskeyError(null)\n    const client = await loadSignInClient()\n    if (!client?.addPasskey) {\n      window.location.assign(passkeyHref('add'))\n      return\n    }\n    try {\n      await client.addPasskey()\n      setPasskeySaved(true)\n    } catch (err) {\n      setPasskeyError((err as Error)?.message || 'Passkey not saved')\n    }\n    setPasskeyBusy(false)\n  }, [])\n\n  const signInWithPasskey = useCallback(async () => {\n    setKeyBusy(true)\n    setKeyError(null)\n    const client = await loadSignInClient()\n    if (!client?.signInWithPasskey) {\n      window.location.assign(passkeyHref('signin'))\n      return\n    }\n    try {\n      await client.signInWithPasskey()\n    } catch (err) {\n      setKeyError((err as Error)?.message || 'Passkey sign-in cancelled')\n      setKeyBusy(false)\n      return\n    }\n    window.location.reload()\n  }, [])\n\n  const pickLevel = useCallback(\n    async (level: number) => {\n      if (!content || level === content.level || levelSaving) return\n      const prev = content\n      setContent({ ...content, level }) // optimistic\n      setLevelSaving(true)\n      const result = await setContentLevel(level)\n      setLevelSaving(false)\n      setContent(result ?? prev) // adopt server truth, or revert\n    },\n    [content, levelSaving]\n  )\n\n  // No caller-supplied class on the root. The four rows below are the\n  // platform's, not the app's, and a className here is enough to restyle or\n  // hide any of them — which is the drift this component exists to prevent.\n  // Apps extend via `children`, never by reaching into this markup.\n  return (\n    <div className=\"settings-popout\" ref={rootRef}>\n      <button\n        type=\"button\"\n        className=\"app-header__icon-btn settings-toggle-btn\"\n        aria-label=\"User settings\"\n        aria-expanded={open}\n        onClick={() => setOpen(v => !v)}\n      >\n        <SettingsIcon />\n      </button>\n\n      {open && <div className=\"settings-popout__overlay\" onClick={() => setOpen(false)} />}\n\n      {open && (\n        <div className=\"settings-popout__panel\" role=\"dialog\" aria-label=\"User settings\">\n          <div className=\"settings-popout__header\">Settings</div>\n\n          {/* Access tier. While resolving, the state still says 'public' —\n              rendering \"Guest\" there would be a wrong answer that corrects\n              itself a moment later, which reads exactly like the lag this\n              placeholder exists to remove. */}\n          <section className=\"settings-popout__row\">\n            <span className=\"settings-popout__label\">Access tier</span>\n            {resolving ? (\n              <span className=\"settings-popout__value\">…</span>\n            ) : (\n              <span className={`settings-popout__tier settings-popout__tier--${userType}`}>\n                {TIER_LABEL[userType]}\n              </span>\n            )}\n          </section>\n\n          {/* Display name */}\n          <section className=\"settings-popout__row\">\n            <span className=\"settings-popout__label\">Display name</span>\n            {resolving ? (\n              <span className=\"settings-popout__value\">…</span>\n            ) : editingName ? (\n              <span className=\"settings-popout__inline\">\n                <input\n                  className=\"settings-popout__input\"\n                  value={nameDraft}\n                  maxLength={64}\n                  autoFocus\n                  disabled={nameSaving}\n                  onChange={e => setNameDraft(e.target.value)}\n                  onKeyDown={e => {\n                    if (e.key === 'Enter') {\n                      saveName().catch(reportErr)\n                    }\n                    if (e.key === 'Escape') {\n                      setEditingName(false)\n                      setNameDraft(displayName ?? '')\n                    }\n                  }}\n                />\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn settings-popout__btn--primary\"\n                  disabled={nameSaving}\n                  onClick={() => {\n                    saveName().catch(reportErr)\n                  }}\n                >\n                  {nameSaving ? '…' : 'Save'}\n                </button>\n              </span>\n            ) : (\n              <span className=\"settings-popout__inline\">\n                <span className=\"settings-popout__value\">{displayName || 'Unnamed'}</span>\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn\"\n                  onClick={() => {\n                    setNameDraft(displayName ?? '')\n                    setEditingName(true)\n                  }}\n                >\n                  Edit\n                </button>\n              </span>\n            )}\n          </section>\n\n          {/* Content visibility level. Held back until the first-open fetch\n              settles, so it lands in the same paint as the tier and name\n              rather than a round trip behind them. `content` is fetched\n              concurrently with whoami(), so by then it is already here. */}\n          {!resolving && showContentPill && (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <span className=\"settings-popout__label\">Content visibility</span>\n              {content ? (\n                <>\n                  <div\n                    className=\"settings-popout__pill\"\n                    role=\"radiogroup\"\n                    aria-label=\"Content visibility level\"\n                  >\n                    {Array.from({ length: content.maxLevel }, (_, i) => i + 1).map(lvl => (\n                      <button\n                        key={lvl}\n                        type=\"button\"\n                        role=\"radio\"\n                        aria-checked={lvl === content.level}\n                        aria-label={`Level ${lvl}`}\n                        className={`settings-popout__seg${\n                          lvl <= content.level ? ' settings-popout__seg--filled' : ''\n                        }`}\n                        disabled={levelSaving}\n                        onClick={() => {\n                          pickLevel(lvl).catch(reportErr)\n                        }}\n                      >\n                        {lvl}\n                      </button>\n                    ))}\n                  </div>\n                  <span className=\"settings-popout__hint\">\n                    Higher levels reveal more mature content across apps. Level 1 is\n                    safe-for-everyone.\n                  </span>\n                </>\n              ) : (\n                // Not \"Loading…\" — the fetch has already settled by the time\n                // this section renders at all, so a null here means it failed.\n                <span className=\"settings-popout__hint\">Currently unavailable.</span>\n              )}\n            </section>\n          )}\n\n          {/* Save a passkey: signed-in people only (the site refuses others). */}\n          {!resolving && userType !== 'public' && passkeysSupported() && (\n            <>\n              <section className=\"settings-popout__row\">\n                <span className=\"settings-popout__label\">Passkey</span>\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn\"\n                  disabled={passkeyBusy || passkeySaved}\n                  onClick={() => {\n                    savePasskey().catch(reportErr)\n                  }}\n                >\n                  {passkeySaved ? 'Saved' : passkeyBusy ? 'Saving…' : 'Save'}\n                </button>\n              </section>\n              {passkeyError && (\n                <span className=\"settings-popout__error\" role=\"alert\">\n                  {passkeyError}\n                </span>\n              )}\n            </>\n          )}\n\n          {/* Switch key. Signs in inline through the SITE's sign-in client\n              (the /auth page's own code path), never a post of ours. A real\n              <form> with a username + current-password pair, so password\n              managers offer and save the key. */}\n          {keyFormOpen ? (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <form\n                className=\"settings-popout__key-form\"\n                onSubmit={e => {\n                  e.preventDefault()\n                  submitKey().catch(reportErr)\n                }}\n              >\n                <input\n                  type=\"text\"\n                  name=\"username\"\n                  autoComplete=\"username\"\n                  value=\"hadoku\"\n                  readOnly\n                  hidden\n                />\n                <label className=\"settings-popout__label\" htmlFor=\"settings-popout-key\">\n                  Access key\n                </label>\n                <span className=\"settings-popout__inline\">\n                  <input\n                    id=\"settings-popout-key\"\n                    className=\"settings-popout__input\"\n                    type=\"password\"\n                    name=\"password\"\n                    autoComplete=\"current-password\"\n                    autoCapitalize=\"none\"\n                    spellCheck={false}\n                    autoFocus\n                    value={keyDraft}\n                    disabled={keyBusy}\n                    aria-invalid={keyError !== null}\n                    aria-describedby={keyError ? 'settings-popout-key-error' : undefined}\n                    onChange={e => setKeyDraft(e.target.value)}\n                  />\n                  <button\n                    type=\"submit\"\n                    className=\"settings-popout__btn settings-popout__btn--primary\"\n                    disabled={keyBusy}\n                  >\n                    {keyBusy ? 'Signing in…' : 'Sign in'}\n                  </button>\n                </span>\n                {passkeysSupported() && (\n                  <button\n                    type=\"button\"\n                    className=\"settings-popout__btn\"\n                    disabled={keyBusy}\n                    onClick={() => {\n                      signInWithPasskey().catch(reportErr)\n                    }}\n                  >\n                    Use a passkey\n                  </button>\n                )}\n                {keyError && (\n                  <span\n                    id=\"settings-popout-key-error\"\n                    className=\"settings-popout__error\"\n                    role=\"alert\"\n                  >\n                    {keyError}\n                  </span>\n                )}\n              </form>\n            </section>\n          ) : (\n            <section className=\"settings-popout__row\">\n              <span className=\"settings-popout__label\">Access key</span>\n              <button type=\"button\" className=\"settings-popout__btn\" onClick={openKeyForm}>\n                Switch key\n              </button>\n            </section>\n          )}\n\n          {/* App-specific settings (optional) — same popout, one gear. */}\n          {children && (\n            <section className=\"settings-popout__row settings-popout__row--stack settings-popout__app\">\n              {children}\n            </section>\n          )}\n        </div>\n      )}\n    </div>\n  )\n}\n"],"names":[],"mappings":";;;;;AAoEA,SAAS,UAAU,KAAc;AAE/B,UAAQ,MAAM,qCAAsC,KAAe,WAAW,GAAG;AACnF;AAEA,MAAM,aAAmC;AAAA,EACvC,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,kBAAkB;AAAA,EAChC,UAAU;AAAA,EACV,MAAM;AAAA,EACN;AAAA,EACA;AACF,GAA2B;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,OAAuB,IAAI;AAG3C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAe,gBAAgB,QAAQ;AACvE,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,YAAY,IAAI;AAGhF,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,gBAAgB,EAAE;AAC7D,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,aAAa,YAAY,IAAI,SAAwB,YAAY;AAIxE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAI5D,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,KAAK;AACtD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,IAAI;AAGpE,QAAM,CAAC,SAAS,UAAU,IAAI,SAAmC,IAAI;AACrE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AAOpD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAO/C,QAAM,kBAAkB,aAAa;AAGrC,YAAU,MAAM;AACd,QAAI,iBAAiB,OAAW,aAAY,YAAY;AAAA,EAC1D,GAAG,CAAC,YAAY,CAAC;AACjB,YAAU,MAAM;AACd,QAAI,aAAa,QAAW;AAC1B,sBAAgB,QAAQ;AACxB,mBAAa,QAAQ;AACrB,mBAAa,YAAY,EAAE;AAAA,IAC7B;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAgBb,YAAU,MAAM;AACd,QAAI,OAAO;AACX,qBAAiB,EAAE,UAAU,cAAc,MAAM,SAAA,CAAU,EACxD,KAAK,CAAC,EAAE,UAAU,SAAS,YAAY;AACtC,UAAI,CAAC,KAAM;AAGX,UAAI,iBAAiB,QAAW;AAC9B,oBAAY,SAAS,QAAQ;AAC7B,wBAAgB,SAAS,IAAI;AAC7B,qBAAa,SAAS,IAAI;AAC1B,qBAAa,SAAS,QAAQ,EAAE;AAAA,MAClC;AACA,UAAI,kBAAkB,KAAK;AAAA,IAC7B,CAAC,EACA,MAAM,SAAS,EACf,QAAQ,MAAM;AACb,UAAI,mBAAmB,KAAK;AAAA,IAC9B,CAAC;AACH,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EAKF,GAAG,CAAA,CAAE;AAGL,YAAU,MAAM;AACd,QAAI,CAAC,KAAM;AACX,UAAM,QAAQ,CAAC,MAAqB;AAClC,UAAI,EAAE,QAAQ,SAAU,SAAQ,KAAK;AAAA,IACvC;AACA,WAAO,iBAAiB,WAAW,KAAK;AACxC,WAAO,MAAM,OAAO,oBAAoB,WAAW,KAAK;AAAA,EAC1D,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,WAAW,YAAY,YAAY;AACvC,UAAM,UAAU,UAAU,KAAA;AAC1B,QAAI,CAAC,WAAW,YAAY,aAAa;AACvC,qBAAe,KAAK;AACpB;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,UAAM,SAAS,MAAM,eAAe,OAAO;AAC3C,kBAAc,KAAK;AACnB,QAAI,WAAW,MAAM;AACnB,mBAAa,MAAM;AACnB,mBAAa,MAAM;AACnB,qBAAe,MAAM;AAAA,IACvB;AACA,mBAAe,KAAK;AAAA,EACtB,GAAG,CAAC,WAAW,aAAa,YAAY,CAAC;AAMzC,QAAM,cAAc,YAAY,MAAM;AACpC,mBAAe,IAAI;AACnB,gBAAY,IAAI;AAChB,eAAA,EACG,KAAK,CAAA,WAAU;AACd,UAAI,CAAC,OAAQ,QAAO,SAAS,OAAO,eAAe;AAAA,IACrD,CAAC,EACA,MAAM,SAAS;AAAA,EACpB,GAAG,CAAA,CAAE;AAEL,QAAM,YAAY,YAAY,YAAY;AACxC,eAAW,IAAI;AACf,gBAAY,IAAI;AAChB,UAAM,SAAS,MAAM,WAAA;AACrB,QAAI,CAAC,QAAQ;AACX,aAAO,SAAS,OAAO,eAAe;AACtC;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,QAAQ;AAAA,IACvB,SAAS,KAAK;AAEZ,kBAAa,KAAe,WAAW,aAAa;AACpD,iBAAW,KAAK;AAChB;AAAA,IACF;AAGA,WAAO,SAAS,OAAA;AAAA,EAClB,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,cAAc,YAAY,YAAY;AAC1C,mBAAe,IAAI;AACnB,oBAAgB,IAAI;AACpB,UAAM,SAAS,MAAM,iBAAA;AACrB,QAAI,CAAC,QAAQ,YAAY;AACvB,aAAO,SAAS,OAAO,YAAY,KAAK,CAAC;AACzC;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,WAAA;AACb,sBAAgB,IAAI;AAAA,IACtB,SAAS,KAAK;AACZ,sBAAiB,KAAe,WAAW,mBAAmB;AAAA,IAChE;AACA,mBAAe,KAAK;AAAA,EACtB,GAAG,CAAA,CAAE;AAEL,QAAM,oBAAoB,YAAY,YAAY;AAChD,eAAW,IAAI;AACf,gBAAY,IAAI;AAChB,UAAM,SAAS,MAAM,iBAAA;AACrB,QAAI,CAAC,QAAQ,mBAAmB;AAC9B,aAAO,SAAS,OAAO,YAAY,QAAQ,CAAC;AAC5C;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,kBAAA;AAAA,IACf,SAAS,KAAK;AACZ,kBAAa,KAAe,WAAW,2BAA2B;AAClE,iBAAW,KAAK;AAChB;AAAA,IACF;AACA,WAAO,SAAS,OAAA;AAAA,EAClB,GAAG,CAAA,CAAE;AAEL,QAAM,YAAY;AAAA,IAChB,OAAO,UAAkB;AACvB,UAAI,CAAC,WAAW,UAAU,QAAQ,SAAS,YAAa;AACxD,YAAM,OAAO;AACb,iBAAW,EAAE,GAAG,SAAS,OAAO;AAChC,qBAAe,IAAI;AACnB,YAAM,SAAS,MAAM,gBAAgB,KAAK;AAC1C,qBAAe,KAAK;AACpB,iBAAW,UAAU,IAAI;AAAA,IAC3B;AAAA,IACA,CAAC,SAAS,WAAW;AAAA,EAAA;AAOvB,SACE,qBAAC,OAAA,EAAI,WAAU,mBAAkB,KAAK,SACpC,UAAA;AAAA,IAAA;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,MAAK;AAAA,QACL,WAAU;AAAA,QACV,cAAW;AAAA,QACX,iBAAe;AAAA,QACf,SAAS,MAAM,QAAQ,CAAA,MAAK,CAAC,CAAC;AAAA,QAE9B,8BAAC,cAAA,CAAA,CAAa;AAAA,MAAA;AAAA,IAAA;AAAA,IAGf,4BAAS,OAAA,EAAI,WAAU,4BAA2B,SAAS,MAAM,QAAQ,KAAK,GAAG;AAAA,IAEjF,6BACE,OAAA,EAAI,WAAU,0BAAyB,MAAK,UAAS,cAAW,iBAC/D,UAAA;AAAA,MAAA,oBAAC,OAAA,EAAI,WAAU,2BAA0B,UAAA,YAAQ;AAAA,MAMjD,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,eAAW;AAAA,QACnD,YACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,IAAA,CAAC,IAE1C,oBAAC,QAAA,EAAK,WAAW,gDAAgD,QAAQ,IACtE,UAAA,WAAW,QAAQ,EAAA,CACtB;AAAA,MAAA,GAEJ;AAAA,MAGA,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,gBAAY;AAAA,QACpD,YACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,IAAA,CAAC,IACxC,cACF,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,WAAU;AAAA,cACV,OAAO;AAAA,cACP,WAAW;AAAA,cACX,WAAS;AAAA,cACT,UAAU;AAAA,cACV,UAAU,CAAA,MAAK,aAAa,EAAE,OAAO,KAAK;AAAA,cAC1C,WAAW,CAAA,MAAK;AACd,oBAAI,EAAE,QAAQ,SAAS;AACrB,2BAAA,EAAW,MAAM,SAAS;AAAA,gBAC5B;AACA,oBAAI,EAAE,QAAQ,UAAU;AACtB,iCAAe,KAAK;AACpB,+BAAa,eAAe,EAAE;AAAA,gBAChC;AAAA,cACF;AAAA,YAAA;AAAA,UAAA;AAAA,UAEF;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,UAAU;AAAA,cACV,SAAS,MAAM;AACb,yBAAA,EAAW,MAAM,SAAS;AAAA,cAC5B;AAAA,cAEC,uBAAa,MAAM;AAAA,YAAA;AAAA,UAAA;AAAA,QACtB,EAAA,CACF,IAEA,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAA,oBAAC,QAAA,EAAK,WAAU,0BAA0B,UAAA,eAAe,WAAU;AAAA,UACnE;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM;AACb,6BAAa,eAAe,EAAE;AAC9B,+BAAe,IAAI;AAAA,cACrB;AAAA,cACD,UAAA;AAAA,YAAA;AAAA,UAAA;AAAA,QAED,EAAA,CACF;AAAA,MAAA,GAEJ;AAAA,MAMC,CAAC,aAAa,mBACb,qBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,sBAAkB;AAAA,QAC1D,UACC,qBAAA,UAAA,EACE,UAAA;AAAA,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,WAAU;AAAA,cACV,MAAK;AAAA,cACL,cAAW;AAAA,cAEV,UAAA,MAAM,KAAK,EAAE,QAAQ,QAAQ,SAAA,GAAY,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,IAAI,CAAA,QAC7D;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBAEC,MAAK;AAAA,kBACL,MAAK;AAAA,kBACL,gBAAc,QAAQ,QAAQ;AAAA,kBAC9B,cAAY,SAAS,GAAG;AAAA,kBACxB,WAAW,uBACT,OAAO,QAAQ,QAAQ,kCAAkC,EAC3D;AAAA,kBACA,UAAU;AAAA,kBACV,SAAS,MAAM;AACb,8BAAU,GAAG,EAAE,MAAM,SAAS;AAAA,kBAChC;AAAA,kBAEC,UAAA;AAAA,gBAAA;AAAA,gBAbI;AAAA,cAAA,CAeR;AAAA,YAAA;AAAA,UAAA;AAAA,UAEH,oBAAC,QAAA,EAAK,WAAU,yBAAwB,UAAA,sFAAA,CAGxC;AAAA,QAAA,GACF;AAAA;AAAA;AAAA,UAIA,oBAAC,QAAA,EAAK,WAAU,yBAAwB,UAAA,yBAAA,CAAsB;AAAA;AAAA,MAAA,GAElE;AAAA,MAID,CAAC,aAAa,aAAa,YAAY,kBAAA,KACtC,qBAAA,UAAA,EACE,UAAA;AAAA,QAAA,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,UAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,WAAO;AAAA,UAChD;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,UAAU,eAAe;AAAA,cACzB,SAAS,MAAM;AACb,4BAAA,EAAc,MAAM,SAAS;AAAA,cAC/B;AAAA,cAEC,UAAA,eAAe,UAAU,cAAc,YAAY;AAAA,YAAA;AAAA,UAAA;AAAA,QACtD,GACF;AAAA,QACC,gBACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,MAAK,SAC3C,UAAA,aAAA,CACH;AAAA,MAAA,GAEJ;AAAA,MAOD,cACC,oBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAC;AAAA,QAAA;AAAA,UACC,WAAU;AAAA,UACV,UAAU,CAAA,MAAK;AACb,cAAE,eAAA;AACF,sBAAA,EAAY,MAAM,SAAS;AAAA,UAC7B;AAAA,UAEA,UAAA;AAAA,YAAA;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,MAAK;AAAA,gBACL,cAAa;AAAA,gBACb,OAAM;AAAA,gBACN,UAAQ;AAAA,gBACR,QAAM;AAAA,cAAA;AAAA,YAAA;AAAA,gCAEP,SAAA,EAAM,WAAU,0BAAyB,SAAQ,uBAAsB,UAAA,cAExE;AAAA,YACA,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,cAAA;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBACC,IAAG;AAAA,kBACH,WAAU;AAAA,kBACV,MAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,gBAAe;AAAA,kBACf,YAAY;AAAA,kBACZ,WAAS;AAAA,kBACT,OAAO;AAAA,kBACP,UAAU;AAAA,kBACV,gBAAc,aAAa;AAAA,kBAC3B,oBAAkB,WAAW,8BAA8B;AAAA,kBAC3D,UAAU,CAAA,MAAK,YAAY,EAAE,OAAO,KAAK;AAAA,gBAAA;AAAA,cAAA;AAAA,cAE3C;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBACC,MAAK;AAAA,kBACL,WAAU;AAAA,kBACV,UAAU;AAAA,kBAET,oBAAU,gBAAgB;AAAA,gBAAA;AAAA,cAAA;AAAA,YAC7B,GACF;AAAA,YACC,uBACC;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,UAAU;AAAA,gBACV,SAAS,MAAM;AACb,oCAAA,EAAoB,MAAM,SAAS;AAAA,gBACrC;AAAA,gBACD,UAAA;AAAA,cAAA;AAAA,YAAA;AAAA,YAIF,YACC;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,IAAG;AAAA,gBACH,WAAU;AAAA,gBACV,MAAK;AAAA,gBAEJ,UAAA;AAAA,cAAA;AAAA,YAAA;AAAA,UACH;AAAA,QAAA;AAAA,MAAA,EAEJ,CACF,IAEA,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,cAAU;AAAA,QACnD,oBAAC,YAAO,MAAK,UAAS,WAAU,wBAAuB,SAAS,aAAa,UAAA,aAAA,CAE7E;AAAA,MAAA,GACF;AAAA,MAID,YACC,oBAAC,WAAA,EAAQ,WAAU,yEAChB,SAAA,CACH;AAAA,IAAA,EAAA,CAEJ;AAAA,EAAA,GAEJ;AAEJ;"}

package/dist/index.d.ts

@@ -32,8 +32,8 @@ export { SunIcon, MoonIcon, StrawberryIcon, WaveIcon, ZapIcon, CoffeeIcon, Flowe
 export type { ThemeName, ThemeFamily, DropdownPlacement, ThemeMode } from './types';
 export type { AppHeaderProps } from './components/AppHeader';
 export type { ConnectedSettingsProps } from './components/ConnectedSettings';
-export type { ContentLevelState, Identity, SignIn, SignInResult, Tier } from './lib/settingsClient';
-export { loadSignIn, switchKeyHref } from './lib/settingsClient';
+export type { ContentLevelState, Identity, SignIn, SignInClient, SignInResult, Tier } from './lib/settingsClient';
+export { loadSignIn, loadSignInClient, passkeyHref, passkeysSupported, switchKeyHref } from './lib/settingsClient';
 export type { ToastProps } from './components/Toast';
 export type { ToasterProps, ToastState } from './components/Toaster';
 export type { UseToastReturn } from './hooks/useToast';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAOlE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAC5F,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAChF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAI1D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAG9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAGtD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAGlD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAG3D,OAAO,EACL,YAAY,EACZ,OAAO,EAEP,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,WAAW,EACX,cAAc,EACd,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EACL,OAAO,EACP,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,OAAO,EACP,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,WAAW,EACZ,MAAM,gBAAgB,CAAA;AAMvB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnF,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC5E,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AACjF,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,YAAY,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,EACV,WAAW,EACZ,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,WAAW,EACX,YAAY,EACZ,aAAa,EACb,UAAU,EACV,iBAAiB,EAClB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1E,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAOlE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAC5F,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAChF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAI1D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAG9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAGtD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAGlD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAG3D,OAAO,EACL,YAAY,EACZ,OAAO,EAEP,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,WAAW,EACX,cAAc,EACd,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EACL,OAAO,EACP,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,OAAO,EACP,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,WAAW,EACZ,MAAM,gBAAgB,CAAA;AAMvB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnF,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC5E,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,IAAI,EACL,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACd,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AACjF,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,YAAY,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,EACV,WAAW,EACZ,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,WAAW,EACX,YAAY,EACZ,aAAa,EACb,UAAU,EACV,iBAAiB,EAClB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1E,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/index.js

@@ -19,7 +19,7 @@ import { BentoCard } from "./components/BentoCard.js";
 import { useToast } from "./hooks/useToast.js";
 import { useReducedMotion } from "./hooks/useReducedMotion.js";
 import { CircleIcon, DiamondIcon, FALLBACK_ICONS, HexagonIcon, OctagonIcon, PentagonIcon, SettingsIcon, SquareIcon, StarIcon, TagIcon, TriangleIcon, getFallbackIcon } from "./components/ThemeIcons.js";
-import { loadSignIn, switchKeyHref } from "./lib/settingsClient.js";
+import { loadSignIn, loadSignInClient, passkeyHref, passkeysSupported, switchKeyHref } from "./lib/settingsClient.js";
 export {
   AppHeader,
   BentoCard,
@@ -63,6 +63,9 @@ export {
   installSelectMenus,
   installTitleTooltips,
   loadSignIn,
+  loadSignInClient,
+  passkeyHref,
+  passkeysSupported,
   switchKeyHref,
   useHadokuTheme,
   useHadokuThemeOptional,

package/dist/lib/settingsClient.d.ts

@@ -83,7 +83,31 @@ export interface SignInResult {
 /** `signIn` from hadoku.me's `/auth/sign-in.js`. Resolves on success; throws an
  *  `Error` carrying the server's message on a refused or empty key. */
 export type SignIn = (key: string) => Promise<SignInResult>;
+/**
+ * The whole sign-in client. The passkey half is optional: a site build from
+ * before it exports only `signIn`, and the passkey controls then fall back to
+ * the /auth page (`passkeyHref()`), as a missing module does.
+ */
+export interface SignInClient {
+    signIn: SignIn;
+    /** Like `signIn`, with a passkey in place of the key. Throws Error(message). */
+    signInWithPasskey?: () => Promise<SignInResult>;
+    /** Saves a passkey for the signed-in person on this device. Throws Error(message). */
+    addPasskey?: () => Promise<{
+        saved: boolean;
+        passkeys: number;
+    }>;
+}
+export declare function loadSignInClient(): Promise<SignInClient | null>;
 export declare function loadSignIn(): Promise<SignIn | null>;
+/** Whether this browser can use a passkey at all (WebAuthn present). */
+export declare function passkeysSupported(): boolean;
+/**
+ * The /auth page's passkey flows, for when the sign-in client can't be
+ * loaded: `add` saves one for the signed-in visitor, `signin` is the page with
+ * its passkey button. Both come back here afterwards.
+ */
+export declare function passkeyHref(mode: 'add' | 'signin'): string;
 /** Everything the settings popout displays, resolved together. */
 export interface SettingsSnapshot {
     identity: Identity;

package/dist/lib/settingsClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settingsClient.d.ts","sourceRoot":"","sources":["../../src/lib/settingsClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAmDH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAYzE;AAED;uEACuE;AACvE,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAgBtF;AAED;gFACgF;AAChF,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;AAErE,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,IAAI,CAAA;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAyBD;;;;GAIG;AACH,wBAAsB,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAShD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;uEACuE;AACvE,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAyB3D,wBAAgB,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUnD;AAMD,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAA;IAClB,4DAA4D;IAC5D,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAClC;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,IAAI,CAAA;IACf,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,qBAA0B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAG7F"}
+{"version":3,"file":"settingsClient.d.ts","sourceRoot":"","sources":["../../src/lib/settingsClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAmDH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAYzE;AAED;uEACuE;AACvE,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAgBtF;AAED;gFACgF;AAChF,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;AAErE,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,IAAI,CAAA;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAyBD;;;;GAIG;AACH,wBAAsB,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAShD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;uEACuE;AACvE,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAyB3D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/C,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjE;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAuB/D;AAED,wBAAgB,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnD;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAM1D;AAMD,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAA;IAClB,4DAA4D;IAC5D,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAClC;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,IAAI,CAAA;IACf,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,qBAA0B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAG7F"}

package/dist/lib/settingsClient.js

@@ -80,12 +80,16 @@ function switchKeyHref() {
 }
 const SIGN_IN_MODULE = "/auth/sign-in.js";
 let signInModule = null;
-function loadSignIn() {
+function loadSignInClient() {
   signInModule ??= import(
     /* @vite-ignore */
     SIGN_IN_MODULE
   ).then(
-    (m) => typeof m.signIn === "function" ? m.signIn : null,
+    (m) => typeof m.signIn === "function" ? {
+      signIn: m.signIn,
+      signInWithPasskey: typeof m.signInWithPasskey === "function" ? m.signInWithPasskey : void 0,
+      addPasskey: typeof m.addPasskey === "function" ? m.addPasskey : void 0
+    } : null,
     () => {
       signInModule = null;
       return null;
@@ -93,6 +97,16 @@ function loadSignIn() {
   );
   return signInModule;
 }
+function loadSignIn() {
+  return loadSignInClient().then((c) => c?.signIn ?? null);
+}
+function passkeysSupported() {
+  return typeof window !== "undefined" && "PublicKeyCredential" in window;
+}
+function passkeyHref(mode) {
+  if (mode === "signin") return switchKeyHref();
+  return "/auth?passkey=add&return=" + encodeURIComponent(window.location.pathname + window.location.search + window.location.hash);
+}
 let snapshot = null;
 function prefetchSettings(hints = {}) {
   snapshot ??= resolveSettings(hints);
@@ -131,6 +145,9 @@ function patchSnapshot(patch) {
 export {
   getContentLevel,
   loadSignIn,
+  loadSignInClient,
+  passkeyHref,
+  passkeysSupported,
   prefetchSettings,
   setContentLevel,
   setDisplayName,

package/dist/lib/settingsClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"settingsClient.js","sources":["../../src/lib/settingsClient.ts"],"sourcesContent":["/**\n * Client for the unified user-settings modal (ConnectedSettings).\n *\n * Two concerns, both cookie-authed against the hadoku.me edge-router, which\n * resolves the `hadoku_session` cookie / `X-Session-Id` header → X-User-Key +\n * X-User-Id for the backend:\n *   - display name  → POST /session/name                   (edge-router, self rename)\n *   - content level → GET/PUT /prefs/api/v1/content-level  (prefs-api)\n *\n * Switching keys goes through the SITE's sign-in client, never a call of ours:\n * see `loadSignIn()`, with `switchKeyHref()` as the fallback.\n *\n * These are same-origin relative paths, so ConnectedSettings is portable to any\n * app served under hadoku.me with zero wiring. Off-origin (e.g. a Storybook or\n * a non-hadoku host) every call resolves to null and the UI degrades to a\n * read-only shell — it never throws.\n *\n * The raw key is never held in the browser (the auth page deliberately drops\n * it), so name + content-level changes go through session identity, not a key\n * header, and no app ever asks for a key at all.\n *\n * WHEN THESE RUN\n * --------------\n * Everything the popout displays is resolved at PAGE LOAD, not on gear-click —\n * see `prefetchSettings()`. Opening settings must cost zero requests. Pinned by\n * `e2e/settings-prefetch.spec.ts` in hadoku-task.\n */\n\n/** Edge-router / prefs-api endpoints (same-origin relative). */\nconst CONTENT_LEVEL_PATH = '/prefs/api/v1/content-level'\nconst SESSION_NAME = '/session/name'\nconst SESSION_WHOAMI = '/session/whoami'\n\n/**\n * The ecosystem's shared boot-whoami promise. hadoku_site's `mf-loader.js`\n * kicks `GET /session/whoami` in parallel with the micro-frontend's module\n * import and parks the promise here precisely so the app it loads doesn't\n * resolve identity a second time; @wolffm/prefs-client already consumes it\n * under the same name. Reading it is what makes settings' identity free.\n *\n * Absent outside that shell (standalone vite, Capacitor, Storybook) — there we\n * fetch, and publish the result under the same key so the next reader is free\n * too.\n */\nconst WHOAMI_GLOBAL = '__hadokuWhoami'\n\n/**\n * Raw whoami body, as both mf-loader and this module see it off the wire.\n *\n * `contentLevel` / `maxContentLevel` are OPTIONAL because the shape is\n * versioned by whatever edge-router is deployed, not by this bundle. They\n * arrive from edge-router ≥ the 2026-08-07 change, which reports the level\n * `authGate` had already resolved to stamp X-Hadoku-Content-Level. When they\n * are absent we fall back to the standalone GET — see resolveSettings.\n */\ninterface WhoamiBody {\n  valid?: boolean\n  userType?: Tier\n  name?: string | null\n  contentLevel?: number\n  maxContentLevel?: number\n}\n\n// Hard timeout on every settings request. Without it, a request throttled by\n// the browser (e.g. the tab going to the background) leaves the caller's\n// \"saving\" flag stuck true — which disabled the content-level pills until the\n// tab regained focus. AbortSignal.timeout guarantees the promise settles.\nconst REQUEST_TIMEOUT_MS = 8000\n\n/** Session-id header the same way whoami() sends it (cookie is the fallback). */\nfunction sessionHeaders(extra?: Record<string, string>): Record<string, string> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json', ...extra }\n  const sid = typeof window !== 'undefined' ? localStorage.getItem('hadoku_session_id') : null\n  if (sid) headers['X-Session-Id'] = sid\n  return headers\n}\n\nexport interface ContentLevelState {\n  /** Current global content-visibility level (1 = safest default). */\n  level: number\n  /** Highest level this caller's tier may select (friend=3, admin=4). */\n  maxLevel: number\n}\n\n/** GET the caller's current content level + tier ceiling. null on error. */\nexport async function getContentLevel(): Promise<ContentLevelState | null> {\n  try {\n    const res = await fetch(CONTENT_LEVEL_PATH, {\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    return (await res.json()) as ContentLevelState\n  } catch {\n    return null\n  }\n}\n\n/** PUT a new content level. Server clamps to the tier ceiling → 400 if out of\n *  range. Returns the stored state on success, null on any failure. */\nexport async function setContentLevel(level: number): Promise<ContentLevelState | null> {\n  try {\n    const res = await fetch(CONTENT_LEVEL_PATH, {\n      method: 'PUT',\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      body: JSON.stringify({ level }),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    const stored = (await res.json()) as ContentLevelState\n    patchSnapshot(prev => ({ ...prev, content: stored }))\n    return stored\n  } catch {\n    return null\n  }\n}\n\n/** POST a new display name for the signed-in user. Returns the stored name\n *  (may differ from the request for wp-* protected keys) or null on failure. */\nexport async function setDisplayName(name: string): Promise<string | null> {\n  try {\n    const res = await fetch(SESSION_NAME, {\n      method: 'POST',\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      body: JSON.stringify({ name }),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    const body = (await res.json()) as { ok: boolean; name: string | null }\n    patchSnapshot(prev => ({ ...prev, identity: { ...prev.identity, name: body.name } }))\n    return body.name\n  } catch {\n    return null\n  }\n}\n\n/**\n * The hadoku tier ladder, LOW to HIGH: `public < friend < service < wife < admin`.\n * Mirrors TIER_RANK in @wolffm/worker-utils, which this browser bundle cannot\n * import (it would pull hono into the client). A tier missing here does not\n * error — it fails the union and, worse, drops out of every `Record<Tier, …>`\n * lookup, so the caller renders as if unrecognised. Keep it complete.\n */\nexport type Tier = 'public' | 'friend' | 'service' | 'wife' | 'admin'\n\nexport interface Identity {\n  userType: Tier\n  name: string | null\n}\n\n/**\n * The page's one whoami body, resolved at most once no matter how many callers.\n *\n * Under the hadoku.me shell this costs NO request: mf-loader kicks whoami in\n * parallel with the micro-frontend's module import and parks the promise on\n * WHOAMI_GLOBAL for exactly this reason (@wolffm/prefs-client reads the same\n * key). Elsewhere — standalone vite, Capacitor, Storybook — we fetch once and\n * publish under the same key so the next reader is free too.\n *\n * Resolves to null rather than throwing on any failure.\n */\nfunction sharedWhoami(): Promise<WhoamiBody | null> {\n  const g = globalThis as { [WHOAMI_GLOBAL]?: Promise<WhoamiBody | null> }\n  g[WHOAMI_GLOBAL] ??= fetch(SESSION_WHOAMI, {\n    credentials: 'same-origin',\n    headers: sessionHeaders(),\n    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n  })\n    .then(res => (res.ok ? (res.json() as Promise<WhoamiBody>) : null))\n    .catch(() => null)\n  return g[WHOAMI_GLOBAL]\n}\n\n/**\n * Resolve the signed-in caller's tier + display name from the edge-router.\n * Returns { userType: 'public', name: null } for anonymous / off-origin / any\n * failure — never throws, so ConnectedSettings can render unconditionally.\n */\nexport async function whoami(): Promise<Identity> {\n  if (typeof window === 'undefined') return { userType: 'public', name: null }\n  try {\n    const body = await sharedWhoami()\n    if (!body?.valid) return { userType: 'public', name: null }\n    return { userType: body.userType ?? 'public', name: body.name ?? null }\n  } catch {\n    return { userType: 'public', name: null }\n  }\n}\n\n/**\n * Where a \"Switch key\" control sends the user when the inline sign-in client\n * (`loadSignIn()`) can't be loaded: the site's sign-in page, which brings them\n * back here afterwards.\n *\n * A browser session is created ONLY by /auth (hadoku_site, 2026-10-25): every\n * render of that page carries an edge-signed funnel token and the device\n * fingerprint, and /session/create alerts on — and will refuse — a sign-in\n * without them. So an app never posts a key itself.\n *\n * `switch=1` stops /auth from sending an already signed-in visitor straight\n * back, which would make switching impossible. `return` is this page's path,\n * query and hash; /auth redirects there with the new session cookie, and the\n * shell's mf-loader resyncs the localStorage mirror (hadoku_session_id /\n * hadoku_user_type) from /session/whoami on that load, so nothing here writes it.\n */\nexport function switchKeyHref(): string {\n  return (\n    '/auth?switch=1&return=' +\n    encodeURIComponent(window.location.pathname + window.location.search + window.location.hash)\n  )\n}\n\n/** What the site's sign-in client resolves to on success. */\nexport interface SignInResult {\n  valid: boolean\n  userType?: string\n  sessionId?: string\n}\n\n/** `signIn` from hadoku.me's `/auth/sign-in.js`. Resolves on success; throws an\n *  `Error` carrying the server's message on a refused or empty key. */\nexport type SignIn = (key: string) => Promise<SignInResult>\n\n/**\n * The site serves its sign-in page's own client as a module, so an app can sign\n * in INLINE on the same code path as /auth: a fresh funnel token per call, the\n * device fingerprint, and the `/session/create` post that sets the cookie (and\n * writes the hadoku_session_id / hadoku_user_type mirror). This package never\n * posts /session/create itself — a direct post would skip the fingerprint and\n * read as off-funnel — and it does not vendor a copy.\n *\n * The specifier is a VARIABLE on purpose. A literal `import('/auth/sign-in.js')`\n * would have every bundler that re-bundles this package (hadoku_site's build\n * among them) try to resolve the path at build time; this one is only ever\n * resolved by the browser, against whatever origin the page is on. For the\n * same reason it is typed here (`SignIn`) rather than by an ambient module\n * declaration, which only a literal specifier would pick up.\n *\n * The module starts collecting the fingerprint as soon as it evaluates, so call\n * this when a sign-in form OPENS, not when it submits. Memoised; resolves to\n * null when the module can't be loaded (a dev server that isn't hadoku.me),\n * which is the caller's cue to fall back to `switchKeyHref()`.\n */\nconst SIGN_IN_MODULE = '/auth/sign-in.js'\nlet signInModule: Promise<SignIn | null> | null = null\n\nexport function loadSignIn(): Promise<SignIn | null> {\n  signInModule ??= import(/* @vite-ignore */ SIGN_IN_MODULE).then(\n    (m: { signIn?: unknown }) => (typeof m.signIn === 'function' ? (m.signIn as SignIn) : null),\n    () => {\n      // Let a later open retry: a failed fetch is not cached by the browser.\n      signInModule = null\n      return null\n    }\n  )\n  return signInModule\n}\n\n/* ------------------------------------------------------------------ *\n * Prefetch\n * ------------------------------------------------------------------ */\n\n/** Everything the settings popout displays, resolved together. */\nexport interface SettingsSnapshot {\n  identity: Identity\n  /** null = public caller (no pill) or the request failed. */\n  content: ContentLevelState | null\n}\n\n/** Identity the host already knows, so we don't ask the server for it again. */\nexport interface SettingsPrefetchHints {\n  /** Caller's tier. When supplied, whoami is skipped entirely. */\n  userType?: Tier\n  /** Caller's display name. Only meaningful alongside `userType`. */\n  name?: string | null\n}\n\nlet snapshot: Promise<SettingsSnapshot> | null = null\n\n/**\n * Resolve — once per page load — everything the settings popout shows.\n *\n * This is THE entry point, and it is called from ConnectedSettings' MOUNT, not\n * from its open handler. Settings data is user identity: it is known at boot,\n * it doesn't change while the page is up, and making the gear the trigger left\n * the panel on screen but blank for a round trip (measured on prod: whoami\n * 167ms and content-level 186ms, issued concurrently). It now rides along with\n * the app's own boot traffic and the click costs nothing.\n *\n * Idempotent and shared: every caller after the first gets the same promise, so\n * N mounted consumers still produce at most one whoami for the whole page.\n * Mutations below write through to it rather than invalidating, so a remount\n * never shows a value the user just changed.\n *\n * Against a current edge-router this issues NO requests of its own at all — the\n * level rides on the whoami the shell already had in flight. See\n * resolveSettings for the fallback when it doesn't.\n */\nexport function prefetchSettings(hints: SettingsPrefetchHints = {}): Promise<SettingsSnapshot> {\n  snapshot ??= resolveSettings(hints)\n  return snapshot\n}\n\nasync function resolveSettings(hints: SettingsPrefetchHints): Promise<SettingsSnapshot> {\n  // The whoami body, not just the adapted identity — edge-router carries the\n  // content level on it (see below), and reading the raw body is how we get at\n  // it without a second request.\n  //\n  // Skipped entirely when the host supplied identity: that prop exists for apps\n  // that CANNOT reach /session/whoami (conjure sits behind a path-prefixed shim\n  // where it 404s), so asking anyway would spend a request to learn nothing.\n  const selfResolving = hints.userType === undefined && typeof window !== 'undefined'\n  const bodyPromise = selfResolving ? sharedWhoami() : Promise.resolve(null)\n\n  const identityPromise: Promise<Identity> =\n    hints.userType !== undefined\n      ? Promise.resolve({ userType: hints.userType, name: hints.name ?? null })\n      : whoami()\n\n  // PREFERRED PATH: take the level straight off whoami.\n  //\n  // edge-router's authGate has already resolved it (registry key → userId →\n  // prefs D1) to stamp X-Hadoku-Content-Level, so reporting it on whoami costs\n  // it nothing — and it saves us a proxied round trip to prefs-api that\n  // measured 132-420ms against prod. Better still, whoami is in flight before\n  // this bundle has even loaded, so the value is here the moment we ask.\n  //\n  // FALLBACK: the standalone GET, for any edge-router older than the\n  // 2026-08-07 change, and for callers not behind it at all (Capacitor,\n  // Storybook, a non-hadoku host). Gated on identity because the pill is\n  // hidden for public callers — fetching an anonymous visitor's level is a\n  // guaranteed-wasted request on every page view. `hadoku_user_type` is\n  // written by the loader before anything mounts, so where it already says\n  // \"signed in\" the fallback goes out concurrently rather than behind whoami.\n  const contentPromise = bodyPromise.then(body => {\n    const carried = contentFromWhoami(body)\n    if (carried) return carried\n    if (looksSignedIn(hints.userType)) return getContentLevel()\n    return identityPromise.then(id => (id.userType === 'public' ? null : getContentLevel()))\n  })\n\n  const [identity, content] = await Promise.all([identityPromise, contentPromise])\n  return { identity, content }\n}\n\n/**\n * Adapt the content level off a whoami body, or null if that edge-router\n * doesn't report it.\n *\n * Both fields are required, and both must be numbers: a body carrying a level\n * without its ceiling would render a pill with zero segments — worse than the\n * fallback fetch, because it looks like a working control that offers nothing.\n */\nfunction contentFromWhoami(body: WhoamiBody | null): ContentLevelState | null {\n  if (!body?.valid) return null\n  const { contentLevel, maxContentLevel } = body\n  if (typeof contentLevel !== 'number' || typeof maxContentLevel !== 'number') return null\n  if (maxContentLevel < 1) return null\n  return { level: contentLevel, maxLevel: maxContentLevel }\n}\n\n/** Best-effort \"is this caller signed in?\" from state available synchronously. */\nfunction looksSignedIn(hinted?: Tier): boolean {\n  if (hinted !== undefined) return hinted !== 'public'\n  if (typeof window === 'undefined') return false\n  const cached = localStorage.getItem('hadoku_user_type')\n  return cached !== null && cached !== 'public'\n}\n\n/** Keep the prefetched snapshot in step with a successful mutation. */\nfunction patchSnapshot(patch: (prev: SettingsSnapshot) => SettingsSnapshot) {\n  if (!snapshot) return\n  snapshot = snapshot.then(patch)\n}\n"],"names":[],"mappings":"AA6BA,MAAM,qBAAqB;AAC3B,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAavB,MAAM,gBAAgB;AAuBtB,MAAM,qBAAqB;AAG3B,SAAS,eAAe,OAAwD;AAC9E,QAAM,UAAkC,EAAE,gBAAgB,oBAAoB,GAAG,MAAA;AACjF,QAAM,MAAM,OAAO,WAAW,cAAc,aAAa,QAAQ,mBAAmB,IAAI;AACxF,MAAI,IAAK,SAAQ,cAAc,IAAI;AACnC,SAAO;AACT;AAUA,eAAsB,kBAAqD;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB;AAAA,MAC1C,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAA;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,gBAAgB,OAAkD;AACtF,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB;AAAA,MAC1C,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,OAAO;AAAA,MAC9B,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,SAAU,MAAM,IAAI,KAAA;AAC1B,kBAAc,WAAS,EAAE,GAAG,MAAM,SAAS,SAAS;AACpD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,eAAe,MAAsC;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,cAAc;AAAA,MACpC,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,MAAM;AAAA,MAC7B,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAA;AACxB,kBAAc,CAAA,UAAS,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,KAAK,UAAU,MAAM,KAAK,KAAA,IAAS;AACpF,WAAO,KAAK;AAAA,EACd,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA2BA,SAAS,eAA2C;AAClD,QAAM,IAAI;AACV,IAAE,aAAa,MAAM,MAAM,gBAAgB;AAAA,IACzC,aAAa;AAAA,IACb,SAAS,eAAA;AAAA,IACT,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,EAAA,CAC/C,EACE,KAAK,CAAA,QAAQ,IAAI,KAAM,IAAI,KAAA,IAAiC,IAAK,EACjE,MAAM,MAAM,IAAI;AACnB,SAAO,EAAE,aAAa;AACxB;AAOA,eAAsB,SAA4B;AAChD,MAAI,OAAO,WAAW,YAAa,QAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AACtE,MAAI;AACF,UAAM,OAAO,MAAM,aAAA;AACnB,QAAI,CAAC,MAAM,MAAO,QAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AACrD,WAAO,EAAE,UAAU,KAAK,YAAY,UAAU,MAAM,KAAK,QAAQ,KAAA;AAAA,EACnE,QAAQ;AACN,WAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AAAA,EACrC;AACF;AAkBO,SAAS,gBAAwB;AACtC,SACE,2BACA,mBAAmB,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,IAAI;AAE/F;AAiCA,MAAM,iBAAiB;AACvB,IAAI,eAA8C;AAE3C,SAAS,aAAqC;AACnD,mBAAiB;AAAA;AAAA,IAA0B;AAAA,IAAgB;AAAA,IACzD,CAAC,MAA6B,OAAO,EAAE,WAAW,aAAc,EAAE,SAAoB;AAAA,IACtF,MAAM;AAEJ,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EAAA;AAEF,SAAO;AACT;AAqBA,IAAI,WAA6C;AAqB1C,SAAS,iBAAiB,QAA+B,IAA+B;AAC7F,eAAa,gBAAgB,KAAK;AAClC,SAAO;AACT;AAEA,eAAe,gBAAgB,OAAyD;AAQtF,QAAM,gBAAgB,MAAM,aAAa,UAAa,OAAO,WAAW;AACxE,QAAM,cAAc,gBAAgB,aAAA,IAAiB,QAAQ,QAAQ,IAAI;AAEzE,QAAM,kBACJ,MAAM,aAAa,SACf,QAAQ,QAAQ,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,QAAQ,KAAA,CAAM,IACtE,OAAA;AAiBN,QAAM,iBAAiB,YAAY,KAAK,CAAA,SAAQ;AAC9C,UAAM,UAAU,kBAAkB,IAAI;AACtC,QAAI,QAAS,QAAO;AACpB,QAAI,cAAc,MAAM,QAAQ,UAAU,gBAAA;AAC1C,WAAO,gBAAgB,KAAK,CAAA,OAAO,GAAG,aAAa,WAAW,OAAO,iBAAkB;AAAA,EACzF,CAAC;AAED,QAAM,CAAC,UAAU,OAAO,IAAI,MAAM,QAAQ,IAAI,CAAC,iBAAiB,cAAc,CAAC;AAC/E,SAAO,EAAE,UAAU,QAAA;AACrB;AAUA,SAAS,kBAAkB,MAAmD;AAC5E,MAAI,CAAC,MAAM,MAAO,QAAO;AACzB,QAAM,EAAE,cAAc,gBAAA,IAAoB;AAC1C,MAAI,OAAO,iBAAiB,YAAY,OAAO,oBAAoB,SAAU,QAAO;AACpF,MAAI,kBAAkB,EAAG,QAAO;AAChC,SAAO,EAAE,OAAO,cAAc,UAAU,gBAAA;AAC1C;AAGA,SAAS,cAAc,QAAwB;AAC7C,MAAI,WAAW,OAAW,QAAO,WAAW;AAC5C,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,SAAS,aAAa,QAAQ,kBAAkB;AACtD,SAAO,WAAW,QAAQ,WAAW;AACvC;AAGA,SAAS,cAAc,OAAqD;AAC1E,MAAI,CAAC,SAAU;AACf,aAAW,SAAS,KAAK,KAAK;AAChC;"}
+{"version":3,"file":"settingsClient.js","sources":["../../src/lib/settingsClient.ts"],"sourcesContent":["/**\n * Client for the unified user-settings modal (ConnectedSettings).\n *\n * Two concerns, both cookie-authed against the hadoku.me edge-router, which\n * resolves the `hadoku_session` cookie / `X-Session-Id` header → X-User-Key +\n * X-User-Id for the backend:\n *   - display name  → POST /session/name                   (edge-router, self rename)\n *   - content level → GET/PUT /prefs/api/v1/content-level  (prefs-api)\n *\n * Switching keys goes through the SITE's sign-in client, never a call of ours:\n * see `loadSignIn()`, with `switchKeyHref()` as the fallback.\n *\n * These are same-origin relative paths, so ConnectedSettings is portable to any\n * app served under hadoku.me with zero wiring. Off-origin (e.g. a Storybook or\n * a non-hadoku host) every call resolves to null and the UI degrades to a\n * read-only shell — it never throws.\n *\n * The raw key is never held in the browser (the auth page deliberately drops\n * it), so name + content-level changes go through session identity, not a key\n * header, and no app ever asks for a key at all.\n *\n * WHEN THESE RUN\n * --------------\n * Everything the popout displays is resolved at PAGE LOAD, not on gear-click —\n * see `prefetchSettings()`. Opening settings must cost zero requests. Pinned by\n * `e2e/settings-prefetch.spec.ts` in hadoku-task.\n */\n\n/** Edge-router / prefs-api endpoints (same-origin relative). */\nconst CONTENT_LEVEL_PATH = '/prefs/api/v1/content-level'\nconst SESSION_NAME = '/session/name'\nconst SESSION_WHOAMI = '/session/whoami'\n\n/**\n * The ecosystem's shared boot-whoami promise. hadoku_site's `mf-loader.js`\n * kicks `GET /session/whoami` in parallel with the micro-frontend's module\n * import and parks the promise here precisely so the app it loads doesn't\n * resolve identity a second time; @wolffm/prefs-client already consumes it\n * under the same name. Reading it is what makes settings' identity free.\n *\n * Absent outside that shell (standalone vite, Capacitor, Storybook) — there we\n * fetch, and publish the result under the same key so the next reader is free\n * too.\n */\nconst WHOAMI_GLOBAL = '__hadokuWhoami'\n\n/**\n * Raw whoami body, as both mf-loader and this module see it off the wire.\n *\n * `contentLevel` / `maxContentLevel` are OPTIONAL because the shape is\n * versioned by whatever edge-router is deployed, not by this bundle. They\n * arrive from edge-router ≥ the 2026-08-07 change, which reports the level\n * `authGate` had already resolved to stamp X-Hadoku-Content-Level. When they\n * are absent we fall back to the standalone GET — see resolveSettings.\n */\ninterface WhoamiBody {\n  valid?: boolean\n  userType?: Tier\n  name?: string | null\n  contentLevel?: number\n  maxContentLevel?: number\n}\n\n// Hard timeout on every settings request. Without it, a request throttled by\n// the browser (e.g. the tab going to the background) leaves the caller's\n// \"saving\" flag stuck true — which disabled the content-level pills until the\n// tab regained focus. AbortSignal.timeout guarantees the promise settles.\nconst REQUEST_TIMEOUT_MS = 8000\n\n/** Session-id header the same way whoami() sends it (cookie is the fallback). */\nfunction sessionHeaders(extra?: Record<string, string>): Record<string, string> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json', ...extra }\n  const sid = typeof window !== 'undefined' ? localStorage.getItem('hadoku_session_id') : null\n  if (sid) headers['X-Session-Id'] = sid\n  return headers\n}\n\nexport interface ContentLevelState {\n  /** Current global content-visibility level (1 = safest default). */\n  level: number\n  /** Highest level this caller's tier may select (friend=3, admin=4). */\n  maxLevel: number\n}\n\n/** GET the caller's current content level + tier ceiling. null on error. */\nexport async function getContentLevel(): Promise<ContentLevelState | null> {\n  try {\n    const res = await fetch(CONTENT_LEVEL_PATH, {\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    return (await res.json()) as ContentLevelState\n  } catch {\n    return null\n  }\n}\n\n/** PUT a new content level. Server clamps to the tier ceiling → 400 if out of\n *  range. Returns the stored state on success, null on any failure. */\nexport async function setContentLevel(level: number): Promise<ContentLevelState | null> {\n  try {\n    const res = await fetch(CONTENT_LEVEL_PATH, {\n      method: 'PUT',\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      body: JSON.stringify({ level }),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    const stored = (await res.json()) as ContentLevelState\n    patchSnapshot(prev => ({ ...prev, content: stored }))\n    return stored\n  } catch {\n    return null\n  }\n}\n\n/** POST a new display name for the signed-in user. Returns the stored name\n *  (may differ from the request for wp-* protected keys) or null on failure. */\nexport async function setDisplayName(name: string): Promise<string | null> {\n  try {\n    const res = await fetch(SESSION_NAME, {\n      method: 'POST',\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      body: JSON.stringify({ name }),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    const body = (await res.json()) as { ok: boolean; name: string | null }\n    patchSnapshot(prev => ({ ...prev, identity: { ...prev.identity, name: body.name } }))\n    return body.name\n  } catch {\n    return null\n  }\n}\n\n/**\n * The hadoku tier ladder, LOW to HIGH: `public < friend < service < wife < admin`.\n * Mirrors TIER_RANK in @wolffm/worker-utils, which this browser bundle cannot\n * import (it would pull hono into the client). A tier missing here does not\n * error — it fails the union and, worse, drops out of every `Record<Tier, …>`\n * lookup, so the caller renders as if unrecognised. Keep it complete.\n */\nexport type Tier = 'public' | 'friend' | 'service' | 'wife' | 'admin'\n\nexport interface Identity {\n  userType: Tier\n  name: string | null\n}\n\n/**\n * The page's one whoami body, resolved at most once no matter how many callers.\n *\n * Under the hadoku.me shell this costs NO request: mf-loader kicks whoami in\n * parallel with the micro-frontend's module import and parks the promise on\n * WHOAMI_GLOBAL for exactly this reason (@wolffm/prefs-client reads the same\n * key). Elsewhere — standalone vite, Capacitor, Storybook — we fetch once and\n * publish under the same key so the next reader is free too.\n *\n * Resolves to null rather than throwing on any failure.\n */\nfunction sharedWhoami(): Promise<WhoamiBody | null> {\n  const g = globalThis as { [WHOAMI_GLOBAL]?: Promise<WhoamiBody | null> }\n  g[WHOAMI_GLOBAL] ??= fetch(SESSION_WHOAMI, {\n    credentials: 'same-origin',\n    headers: sessionHeaders(),\n    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n  })\n    .then(res => (res.ok ? (res.json() as Promise<WhoamiBody>) : null))\n    .catch(() => null)\n  return g[WHOAMI_GLOBAL]\n}\n\n/**\n * Resolve the signed-in caller's tier + display name from the edge-router.\n * Returns { userType: 'public', name: null } for anonymous / off-origin / any\n * failure — never throws, so ConnectedSettings can render unconditionally.\n */\nexport async function whoami(): Promise<Identity> {\n  if (typeof window === 'undefined') return { userType: 'public', name: null }\n  try {\n    const body = await sharedWhoami()\n    if (!body?.valid) return { userType: 'public', name: null }\n    return { userType: body.userType ?? 'public', name: body.name ?? null }\n  } catch {\n    return { userType: 'public', name: null }\n  }\n}\n\n/**\n * Where a \"Switch key\" control sends the user when the inline sign-in client\n * (`loadSignIn()`) can't be loaded: the site's sign-in page, which brings them\n * back here afterwards.\n *\n * A browser session is created ONLY by /auth (hadoku_site, 2026-10-25): every\n * render of that page carries an edge-signed funnel token and the device\n * fingerprint, and /session/create alerts on — and will refuse — a sign-in\n * without them. So an app never posts a key itself.\n *\n * `switch=1` stops /auth from sending an already signed-in visitor straight\n * back, which would make switching impossible. `return` is this page's path,\n * query and hash; /auth redirects there with the new session cookie, and the\n * shell's mf-loader resyncs the localStorage mirror (hadoku_session_id /\n * hadoku_user_type) from /session/whoami on that load, so nothing here writes it.\n */\nexport function switchKeyHref(): string {\n  return (\n    '/auth?switch=1&return=' +\n    encodeURIComponent(window.location.pathname + window.location.search + window.location.hash)\n  )\n}\n\n/** What the site's sign-in client resolves to on success. */\nexport interface SignInResult {\n  valid: boolean\n  userType?: string\n  sessionId?: string\n}\n\n/** `signIn` from hadoku.me's `/auth/sign-in.js`. Resolves on success; throws an\n *  `Error` carrying the server's message on a refused or empty key. */\nexport type SignIn = (key: string) => Promise<SignInResult>\n\n/**\n * The site serves its sign-in page's own client as a module, so an app can sign\n * in INLINE on the same code path as /auth: a fresh funnel token per call, the\n * device fingerprint, and the `/session/create` post that sets the cookie (and\n * writes the hadoku_session_id / hadoku_user_type mirror). This package never\n * posts /session/create itself — a direct post would skip the fingerprint and\n * read as off-funnel — and it does not vendor a copy.\n *\n * The specifier is a VARIABLE on purpose. A literal `import('/auth/sign-in.js')`\n * would have every bundler that re-bundles this package (hadoku_site's build\n * among them) try to resolve the path at build time; this one is only ever\n * resolved by the browser, against whatever origin the page is on. For the\n * same reason it is typed here (`SignIn`) rather than by an ambient module\n * declaration, which only a literal specifier would pick up.\n *\n * The module starts collecting the fingerprint as soon as it evaluates, so call\n * this when a sign-in form OPENS, not when it submits. Memoised; resolves to\n * null when the module can't be loaded (a dev server that isn't hadoku.me),\n * which is the caller's cue to fall back to `switchKeyHref()`.\n */\nconst SIGN_IN_MODULE = '/auth/sign-in.js'\nlet signInModule: Promise<SignInClient | null> | null = null\n\n/**\n * The whole sign-in client. The passkey half is optional: a site build from\n * before it exports only `signIn`, and the passkey controls then fall back to\n * the /auth page (`passkeyHref()`), as a missing module does.\n */\nexport interface SignInClient {\n  signIn: SignIn\n  /** Like `signIn`, with a passkey in place of the key. Throws Error(message). */\n  signInWithPasskey?: () => Promise<SignInResult>\n  /** Saves a passkey for the signed-in person on this device. Throws Error(message). */\n  addPasskey?: () => Promise<{ saved: boolean; passkeys: number }>\n}\n\nexport function loadSignInClient(): Promise<SignInClient | null> {\n  signInModule ??= import(/* @vite-ignore */ SIGN_IN_MODULE).then(\n    (m: Partial<Record<keyof SignInClient, unknown>>) =>\n      typeof m.signIn === 'function'\n        ? {\n            signIn: m.signIn as SignIn,\n            signInWithPasskey:\n              typeof m.signInWithPasskey === 'function'\n                ? (m.signInWithPasskey as SignInClient['signInWithPasskey'])\n                : undefined,\n            addPasskey:\n              typeof m.addPasskey === 'function'\n                ? (m.addPasskey as SignInClient['addPasskey'])\n                : undefined\n          }\n        : null,\n    () => {\n      // Let a later open retry: a failed fetch is not cached by the browser.\n      signInModule = null\n      return null\n    }\n  )\n  return signInModule\n}\n\nexport function loadSignIn(): Promise<SignIn | null> {\n  return loadSignInClient().then(c => c?.signIn ?? null)\n}\n\n/** Whether this browser can use a passkey at all (WebAuthn present). */\nexport function passkeysSupported(): boolean {\n  return typeof window !== 'undefined' && 'PublicKeyCredential' in window\n}\n\n/**\n * The /auth page's passkey flows, for when the sign-in client can't be\n * loaded: `add` saves one for the signed-in visitor, `signin` is the page with\n * its passkey button. Both come back here afterwards.\n */\nexport function passkeyHref(mode: 'add' | 'signin'): string {\n  if (mode === 'signin') return switchKeyHref()\n  return (\n    '/auth?passkey=add&return=' +\n    encodeURIComponent(window.location.pathname + window.location.search + window.location.hash)\n  )\n}\n\n/* ------------------------------------------------------------------ *\n * Prefetch\n * ------------------------------------------------------------------ */\n\n/** Everything the settings popout displays, resolved together. */\nexport interface SettingsSnapshot {\n  identity: Identity\n  /** null = public caller (no pill) or the request failed. */\n  content: ContentLevelState | null\n}\n\n/** Identity the host already knows, so we don't ask the server for it again. */\nexport interface SettingsPrefetchHints {\n  /** Caller's tier. When supplied, whoami is skipped entirely. */\n  userType?: Tier\n  /** Caller's display name. Only meaningful alongside `userType`. */\n  name?: string | null\n}\n\nlet snapshot: Promise<SettingsSnapshot> | null = null\n\n/**\n * Resolve — once per page load — everything the settings popout shows.\n *\n * This is THE entry point, and it is called from ConnectedSettings' MOUNT, not\n * from its open handler. Settings data is user identity: it is known at boot,\n * it doesn't change while the page is up, and making the gear the trigger left\n * the panel on screen but blank for a round trip (measured on prod: whoami\n * 167ms and content-level 186ms, issued concurrently). It now rides along with\n * the app's own boot traffic and the click costs nothing.\n *\n * Idempotent and shared: every caller after the first gets the same promise, so\n * N mounted consumers still produce at most one whoami for the whole page.\n * Mutations below write through to it rather than invalidating, so a remount\n * never shows a value the user just changed.\n *\n * Against a current edge-router this issues NO requests of its own at all — the\n * level rides on the whoami the shell already had in flight. See\n * resolveSettings for the fallback when it doesn't.\n */\nexport function prefetchSettings(hints: SettingsPrefetchHints = {}): Promise<SettingsSnapshot> {\n  snapshot ??= resolveSettings(hints)\n  return snapshot\n}\n\nasync function resolveSettings(hints: SettingsPrefetchHints): Promise<SettingsSnapshot> {\n  // The whoami body, not just the adapted identity — edge-router carries the\n  // content level on it (see below), and reading the raw body is how we get at\n  // it without a second request.\n  //\n  // Skipped entirely when the host supplied identity: that prop exists for apps\n  // that CANNOT reach /session/whoami (conjure sits behind a path-prefixed shim\n  // where it 404s), so asking anyway would spend a request to learn nothing.\n  const selfResolving = hints.userType === undefined && typeof window !== 'undefined'\n  const bodyPromise = selfResolving ? sharedWhoami() : Promise.resolve(null)\n\n  const identityPromise: Promise<Identity> =\n    hints.userType !== undefined\n      ? Promise.resolve({ userType: hints.userType, name: hints.name ?? null })\n      : whoami()\n\n  // PREFERRED PATH: take the level straight off whoami.\n  //\n  // edge-router's authGate has already resolved it (registry key → userId →\n  // prefs D1) to stamp X-Hadoku-Content-Level, so reporting it on whoami costs\n  // it nothing — and it saves us a proxied round trip to prefs-api that\n  // measured 132-420ms against prod. Better still, whoami is in flight before\n  // this bundle has even loaded, so the value is here the moment we ask.\n  //\n  // FALLBACK: the standalone GET, for any edge-router older than the\n  // 2026-08-07 change, and for callers not behind it at all (Capacitor,\n  // Storybook, a non-hadoku host). Gated on identity because the pill is\n  // hidden for public callers — fetching an anonymous visitor's level is a\n  // guaranteed-wasted request on every page view. `hadoku_user_type` is\n  // written by the loader before anything mounts, so where it already says\n  // \"signed in\" the fallback goes out concurrently rather than behind whoami.\n  const contentPromise = bodyPromise.then(body => {\n    const carried = contentFromWhoami(body)\n    if (carried) return carried\n    if (looksSignedIn(hints.userType)) return getContentLevel()\n    return identityPromise.then(id => (id.userType === 'public' ? null : getContentLevel()))\n  })\n\n  const [identity, content] = await Promise.all([identityPromise, contentPromise])\n  return { identity, content }\n}\n\n/**\n * Adapt the content level off a whoami body, or null if that edge-router\n * doesn't report it.\n *\n * Both fields are required, and both must be numbers: a body carrying a level\n * without its ceiling would render a pill with zero segments — worse than the\n * fallback fetch, because it looks like a working control that offers nothing.\n */\nfunction contentFromWhoami(body: WhoamiBody | null): ContentLevelState | null {\n  if (!body?.valid) return null\n  const { contentLevel, maxContentLevel } = body\n  if (typeof contentLevel !== 'number' || typeof maxContentLevel !== 'number') return null\n  if (maxContentLevel < 1) return null\n  return { level: contentLevel, maxLevel: maxContentLevel }\n}\n\n/** Best-effort \"is this caller signed in?\" from state available synchronously. */\nfunction looksSignedIn(hinted?: Tier): boolean {\n  if (hinted !== undefined) return hinted !== 'public'\n  if (typeof window === 'undefined') return false\n  const cached = localStorage.getItem('hadoku_user_type')\n  return cached !== null && cached !== 'public'\n}\n\n/** Keep the prefetched snapshot in step with a successful mutation. */\nfunction patchSnapshot(patch: (prev: SettingsSnapshot) => SettingsSnapshot) {\n  if (!snapshot) return\n  snapshot = snapshot.then(patch)\n}\n"],"names":[],"mappings":"AA6BA,MAAM,qBAAqB;AAC3B,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAavB,MAAM,gBAAgB;AAuBtB,MAAM,qBAAqB;AAG3B,SAAS,eAAe,OAAwD;AAC9E,QAAM,UAAkC,EAAE,gBAAgB,oBAAoB,GAAG,MAAA;AACjF,QAAM,MAAM,OAAO,WAAW,cAAc,aAAa,QAAQ,mBAAmB,IAAI;AACxF,MAAI,IAAK,SAAQ,cAAc,IAAI;AACnC,SAAO;AACT;AAUA,eAAsB,kBAAqD;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB;AAAA,MAC1C,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAA;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,gBAAgB,OAAkD;AACtF,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB;AAAA,MAC1C,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,OAAO;AAAA,MAC9B,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,SAAU,MAAM,IAAI,KAAA;AAC1B,kBAAc,WAAS,EAAE,GAAG,MAAM,SAAS,SAAS;AACpD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,eAAe,MAAsC;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,cAAc;AAAA,MACpC,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,MAAM;AAAA,MAC7B,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAA;AACxB,kBAAc,CAAA,UAAS,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,KAAK,UAAU,MAAM,KAAK,KAAA,IAAS;AACpF,WAAO,KAAK;AAAA,EACd,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA2BA,SAAS,eAA2C;AAClD,QAAM,IAAI;AACV,IAAE,aAAa,MAAM,MAAM,gBAAgB;AAAA,IACzC,aAAa;AAAA,IACb,SAAS,eAAA;AAAA,IACT,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,EAAA,CAC/C,EACE,KAAK,CAAA,QAAQ,IAAI,KAAM,IAAI,KAAA,IAAiC,IAAK,EACjE,MAAM,MAAM,IAAI;AACnB,SAAO,EAAE,aAAa;AACxB;AAOA,eAAsB,SAA4B;AAChD,MAAI,OAAO,WAAW,YAAa,QAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AACtE,MAAI;AACF,UAAM,OAAO,MAAM,aAAA;AACnB,QAAI,CAAC,MAAM,MAAO,QAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AACrD,WAAO,EAAE,UAAU,KAAK,YAAY,UAAU,MAAM,KAAK,QAAQ,KAAA;AAAA,EACnE,QAAQ;AACN,WAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AAAA,EACrC;AACF;AAkBO,SAAS,gBAAwB;AACtC,SACE,2BACA,mBAAmB,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,IAAI;AAE/F;AAiCA,MAAM,iBAAiB;AACvB,IAAI,eAAoD;AAejD,SAAS,mBAAiD;AAC/D,mBAAiB;AAAA;AAAA,IAA0B;AAAA,IAAgB;AAAA,IACzD,CAAC,MACC,OAAO,EAAE,WAAW,aAChB;AAAA,MACE,QAAQ,EAAE;AAAA,MACV,mBACE,OAAO,EAAE,sBAAsB,aAC1B,EAAE,oBACH;AAAA,MACN,YACE,OAAO,EAAE,eAAe,aACnB,EAAE,aACH;AAAA,IAAA,IAER;AAAA,IACN,MAAM;AAEJ,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EAAA;AAEF,SAAO;AACT;AAEO,SAAS,aAAqC;AACnD,SAAO,mBAAmB,KAAK,CAAA,MAAK,GAAG,UAAU,IAAI;AACvD;AAGO,SAAS,oBAA6B;AAC3C,SAAO,OAAO,WAAW,eAAe,yBAAyB;AACnE;AAOO,SAAS,YAAY,MAAgC;AAC1D,MAAI,SAAS,SAAU,QAAO,cAAA;AAC9B,SACE,8BACA,mBAAmB,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,IAAI;AAE/F;AAqBA,IAAI,WAA6C;AAqB1C,SAAS,iBAAiB,QAA+B,IAA+B;AAC7F,eAAa,gBAAgB,KAAK;AAClC,SAAO;AACT;AAEA,eAAe,gBAAgB,OAAyD;AAQtF,QAAM,gBAAgB,MAAM,aAAa,UAAa,OAAO,WAAW;AACxE,QAAM,cAAc,gBAAgB,aAAA,IAAiB,QAAQ,QAAQ,IAAI;AAEzE,QAAM,kBACJ,MAAM,aAAa,SACf,QAAQ,QAAQ,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,QAAQ,KAAA,CAAM,IACtE,OAAA;AAiBN,QAAM,iBAAiB,YAAY,KAAK,CAAA,SAAQ;AAC9C,UAAM,UAAU,kBAAkB,IAAI;AACtC,QAAI,QAAS,QAAO;AACpB,QAAI,cAAc,MAAM,QAAQ,UAAU,gBAAA;AAC1C,WAAO,gBAAgB,KAAK,CAAA,OAAO,GAAG,aAAa,WAAW,OAAO,iBAAkB;AAAA,EACzF,CAAC;AAED,QAAM,CAAC,UAAU,OAAO,IAAI,MAAM,QAAQ,IAAI,CAAC,iBAAiB,cAAc,CAAC;AAC/E,SAAO,EAAE,UAAU,QAAA;AACrB;AAUA,SAAS,kBAAkB,MAAmD;AAC5E,MAAI,CAAC,MAAM,MAAO,QAAO;AACzB,QAAM,EAAE,cAAc,gBAAA,IAAoB;AAC1C,MAAI,OAAO,iBAAiB,YAAY,OAAO,oBAAoB,SAAU,QAAO;AACpF,MAAI,kBAAkB,EAAG,QAAO;AAChC,SAAO,EAAE,OAAO,cAAc,UAAU,gBAAA;AAC1C;AAGA,SAAS,cAAc,QAAwB;AAC7C,MAAI,WAAW,OAAW,QAAO,WAAW;AAC5C,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,SAAS,aAAa,QAAQ,kBAAkB;AACtD,SAAO,WAAW,QAAQ,WAAW;AACvC;AAGA,SAAS,cAAc,OAAqD;AAC1E,MAAI,CAAC,SAAU;AACf,aAAW,SAAS,KAAK,KAAK;AAChC;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadoku/task-ui-components",
-  "version": "4.20.3",
+  "version": "4.20.4",
   "description": "Reusable UI components with Bento grid and metallic gradient support",
   "type": "module",
   "main": "dist/index.js",

package/src/components/ConnectedSettings.tsx

@@ -31,6 +31,9 @@ import {
   setContentLevel,
   setDisplayName,
   loadSignIn,
+  loadSignInClient,
+  passkeyHref,
+  passkeysSupported,
   switchKeyHref,
   type ContentLevelState,
   type Tier
@@ -102,6 +105,12 @@ export function ConnectedSettings({
   const [keyBusy, setKeyBusy] = useState(false)
   const [keyError, setKeyError] = useState<string | null>(null)
 
+  // Passkeys, through the same site client: save one while signed in, or
+  // sign in with one from the key form.
+  const [passkeyBusy, setPasskeyBusy] = useState(false)
+  const [passkeySaved, setPasskeySaved] = useState(false)
+  const [passkeyError, setPasskeyError] = useState<string | null>(null)
+
   // Content level
   const [content, setContent] = useState<ContentLevelState | null>(null)
   const [levelSaving, setLevelSaving] = useState(false)
@@ -236,6 +245,41 @@ export function ConnectedSettings({
     window.location.reload()
   }, [keyDraft])
 
+  const savePasskey = useCallback(async () => {
+    setPasskeyBusy(true)
+    setPasskeyError(null)
+    const client = await loadSignInClient()
+    if (!client?.addPasskey) {
+      window.location.assign(passkeyHref('add'))
+      return
+    }
+    try {
+      await client.addPasskey()
+      setPasskeySaved(true)
+    } catch (err) {
+      setPasskeyError((err as Error)?.message || 'Passkey not saved')
+    }
+    setPasskeyBusy(false)
+  }, [])
+
+  const signInWithPasskey = useCallback(async () => {
+    setKeyBusy(true)
+    setKeyError(null)
+    const client = await loadSignInClient()
+    if (!client?.signInWithPasskey) {
+      window.location.assign(passkeyHref('signin'))
+      return
+    }
+    try {
+      await client.signInWithPasskey()
+    } catch (err) {
+      setKeyError((err as Error)?.message || 'Passkey sign-in cancelled')
+      setKeyBusy(false)
+      return
+    }
+    window.location.reload()
+  }, [])
+
   const pickLevel = useCallback(
     async (level: number) => {
       if (!content || level === content.level || levelSaving) return
@@ -384,6 +428,30 @@ export function ConnectedSettings({
             </section>
           )}
 
+          {/* Save a passkey: signed-in people only (the site refuses others). */}
+          {!resolving && userType !== 'public' && passkeysSupported() && (
+            <>
+              <section className="settings-popout__row">
+                <span className="settings-popout__label">Passkey</span>
+                <button
+                  type="button"
+                  className="settings-popout__btn"
+                  disabled={passkeyBusy || passkeySaved}
+                  onClick={() => {
+                    savePasskey().catch(reportErr)
+                  }}
+                >
+                  {passkeySaved ? 'Saved' : passkeyBusy ? 'Saving…' : 'Save'}
+                </button>
+              </section>
+              {passkeyError && (
+                <span className="settings-popout__error" role="alert">
+                  {passkeyError}
+                </span>
+              )}
+            </>
+          )}
+
           {/* Switch key. Signs in inline through the SITE's sign-in client
               (the /auth page's own code path), never a post of ours. A real
               <form> with a username + current-password pair, so password
@@ -432,6 +500,18 @@ export function ConnectedSettings({
                     {keyBusy ? 'Signing in…' : 'Sign in'}
                   </button>
                 </span>
+                {passkeysSupported() && (
+                  <button
+                    type="button"
+                    className="settings-popout__btn"
+                    disabled={keyBusy}
+                    onClick={() => {
+                      signInWithPasskey().catch(reportErr)
+                    }}
+                  >
+                    Use a passkey
+                  </button>
+                )}
                 {keyError && (
                   <span
                     id="settings-popout-key-error"

package/src/index.ts

@@ -95,8 +95,21 @@ export {
 export type { ThemeName, ThemeFamily, DropdownPlacement, ThemeMode } from './types'
 export type { AppHeaderProps } from './components/AppHeader'
 export type { ConnectedSettingsProps } from './components/ConnectedSettings'
-export type { ContentLevelState, Identity, SignIn, SignInResult, Tier } from './lib/settingsClient'
-export { loadSignIn, switchKeyHref } from './lib/settingsClient'
+export type {
+  ContentLevelState,
+  Identity,
+  SignIn,
+  SignInClient,
+  SignInResult,
+  Tier
+} from './lib/settingsClient'
+export {
+  loadSignIn,
+  loadSignInClient,
+  passkeyHref,
+  passkeysSupported,
+  switchKeyHref
+} from './lib/settingsClient'
 export type { ToastProps } from './components/Toast'
 export type { ToasterProps, ToastState } from './components/Toaster'
 export type { UseToastReturn } from './hooks/useToast'

package/src/lib/settingsClient.ts

@@ -245,11 +245,37 @@ export type SignIn = (key: string) => Promise<SignInResult>
  * which is the caller's cue to fall back to `switchKeyHref()`.
  */
 const SIGN_IN_MODULE = '/auth/sign-in.js'
-let signInModule: Promise<SignIn | null> | null = null
+let signInModule: Promise<SignInClient | null> | null = null
 
-export function loadSignIn(): Promise<SignIn | null> {
+/**
+ * The whole sign-in client. The passkey half is optional: a site build from
+ * before it exports only `signIn`, and the passkey controls then fall back to
+ * the /auth page (`passkeyHref()`), as a missing module does.
+ */
+export interface SignInClient {
+  signIn: SignIn
+  /** Like `signIn`, with a passkey in place of the key. Throws Error(message). */
+  signInWithPasskey?: () => Promise<SignInResult>
+  /** Saves a passkey for the signed-in person on this device. Throws Error(message). */
+  addPasskey?: () => Promise<{ saved: boolean; passkeys: number }>
+}
+
+export function loadSignInClient(): Promise<SignInClient | null> {
   signInModule ??= import(/* @vite-ignore */ SIGN_IN_MODULE).then(
-    (m: { signIn?: unknown }) => (typeof m.signIn === 'function' ? (m.signIn as SignIn) : null),
+    (m: Partial<Record<keyof SignInClient, unknown>>) =>
+      typeof m.signIn === 'function'
+        ? {
+            signIn: m.signIn as SignIn,
+            signInWithPasskey:
+              typeof m.signInWithPasskey === 'function'
+                ? (m.signInWithPasskey as SignInClient['signInWithPasskey'])
+                : undefined,
+            addPasskey:
+              typeof m.addPasskey === 'function'
+                ? (m.addPasskey as SignInClient['addPasskey'])
+                : undefined
+          }
+        : null,
     () => {
       // Let a later open retry: a failed fetch is not cached by the browser.
       signInModule = null
@@ -259,6 +285,28 @@ export function loadSignIn(): Promise<SignIn | null> {
   return signInModule
 }
 
+export function loadSignIn(): Promise<SignIn | null> {
+  return loadSignInClient().then(c => c?.signIn ?? null)
+}
+
+/** Whether this browser can use a passkey at all (WebAuthn present). */
+export function passkeysSupported(): boolean {
+  return typeof window !== 'undefined' && 'PublicKeyCredential' in window
+}
+
+/**
+ * The /auth page's passkey flows, for when the sign-in client can't be
+ * loaded: `add` saves one for the signed-in visitor, `signin` is the page with
+ * its passkey button. Both come back here afterwards.
+ */
+export function passkeyHref(mode: 'add' | 'signin'): string {
+  if (mode === 'signin') return switchKeyHref()
+  return (
+    '/auth?passkey=add&return=' +
+    encodeURIComponent(window.location.pathname + window.location.search + window.location.hash)
+  )
+}
+
 /* ------------------------------------------------------------------ *
  * Prefetch
  * ------------------------------------------------------------------ */