@hadoku/task-ui-components 4.20.5 → 4.20.7

package/dist/components/ConnectedSettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConnectedSettings.d.ts","sourceRoot":"","sources":["../../src/components/ConnectedSettings.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAmD,MAAM,OAAO,CAAA;AAEvE,OAAO,EAUL,KAAK,IAAI,EACV,MAAM,uBAAuB,CAAA;AAC9B,OAAO,mBAAmB,CAAA;AAE1B,MAAM,WAAW,sBAAsB;IACrC;;;;;;+EAM2E;IAC3E,QAAQ,CAAC,EAAE,IAAI,CAAA;IACf,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,mEAAmE;IACnE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAA;IAC5C;;;;;;8BAM0B;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAC3B;AA+BD,wBAAgB,iBAAiB,CAAC,EAChC,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,QAAQ,EACd,YAAY,EACZ,QAAQ,EACT,EAAE,sBAAsB,qBAohBxB"}
+{"version":3,"file":"ConnectedSettings.d.ts","sourceRoot":"","sources":["../../src/components/ConnectedSettings.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAmD,MAAM,OAAO,CAAA;AAEvE,OAAO,EAUL,KAAK,IAAI,EACV,MAAM,uBAAuB,CAAA;AAC9B,OAAO,mBAAmB,CAAA;AAE1B,MAAM,WAAW,sBAAsB;IACrC;;;;;;+EAM2E;IAC3E,QAAQ,CAAC,EAAE,IAAI,CAAA;IACf,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,mEAAmE;IACnE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAA;IAC5C;;;;;;8BAM0B;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAC3B;AA6CD,wBAAgB,iBAAiB,CAAC,EAChC,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,QAAQ,EACd,YAAY,EACZ,QAAQ,EACT,EAAE,sBAAsB,qBAoiBxB"}

package/dist/components/ConnectedSettings.js

@@ -14,6 +14,16 @@ const CLOSED = "closed";
 function reportErr(err) {
   console.error("[ConnectedSettings] action failed", err?.message ?? err);
 }
+const PASSKEY_DOT = {
+  position: "absolute",
+  top: 2,
+  right: 2,
+  width: 8,
+  height: 8,
+  borderRadius: "50%",
+  background: "var(--color-primary)",
+  pointerEvents: "none"
+};
 const TIER_LABEL = {
   admin: "Administrator",
   wife: "Wife",
@@ -41,6 +51,7 @@ function ConnectedSettings({
   const [keyError, setKeyError] = useState(null);
   const [passkeyMode, setPasskeyMode] = useState(null);
   const [passkeySaved, setPasskeySaved] = useState(false);
+  const [passkeyCount, setPasskeyCount] = useState(null);
   const [passkeyError, setPasskeyError] = useState(null);
   const passkeyCtl = useRef(null);
   const cancelPasskey = useCallback((reason) => passkeyCtl.current?.abort(reason), []);
@@ -48,6 +59,7 @@ function ConnectedSettings({
   const [levelSaving, setLevelSaving] = useState(false);
   const [resolving, setResolving] = useState(true);
   const showContentPill = userType !== "public";
+  const needsPasskey = !resolving && userType !== "public" && passkeyCount === 0 && !passkeySaved && passkeysSupported();
   useEffect(() => {
     if (userTypeProp !== void 0) setUserType(userTypeProp);
   }, [userTypeProp]);
@@ -60,8 +72,9 @@ function ConnectedSettings({
   }, [nameProp]);
   useEffect(() => {
     let live = true;
-    prefetchSettings({ userType: userTypeProp, name: nameProp }).then(({ identity, content: state }) => {
+    prefetchSettings({ userType: userTypeProp, name: nameProp }).then(({ identity, content: state, passkeys }) => {
       if (!live) return;
+      setPasskeyCount(passkeys);
       if (userTypeProp === void 0) {
         setUserType(identity.userType);
         setResolvedName(identity.name);
@@ -199,15 +212,19 @@ function ConnectedSettings({
     [content, levelSaving]
   );
   return /* @__PURE__ */ jsxs("div", { className: "settings-popout", ref: rootRef, children: [
-    /* @__PURE__ */ jsx(
+    /* @__PURE__ */ jsxs(
       "button",
       {
         type: "button",
         className: "app-header__icon-btn settings-toggle-btn",
-        "aria-label": "User settings",
+        "aria-label": needsPasskey ? "User settings, no passkey saved" : "User settings",
+        style: needsPasskey ? { position: "relative" } : void 0,
         "aria-expanded": open,
         onClick: () => setOpen((v) => !v),
-        children: /* @__PURE__ */ jsx(SettingsIcon, {})
+        children: [
+          /* @__PURE__ */ jsx(SettingsIcon, {}),
+          needsPasskey && /* @__PURE__ */ jsx("span", { className: "settings-toggle-btn__dot", style: PASSKEY_DOT, "aria-hidden": "true" })
+        ]
       }
     ),
     open && /* @__PURE__ */ jsx("div", { className: "settings-popout__overlay", onClick: () => setOpen(false) }),
@@ -390,7 +407,7 @@ function ConnectedSettings({
             "button",
             {
               type: "button",
-              className: "settings-popout__btn",
+              className: `settings-popout__btn${needsPasskey ? " settings-popout__btn--primary" : ""}`,
               disabled: passkeyMode !== null || passkeySaved,
               onClick: () => {
                 savePasskey().catch(reportErr);

package/dist/components/ConnectedSettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConnectedSettings.js","sources":["../../src/components/ConnectedSettings.tsx"],"sourcesContent":["/**\n * ConnectedSettings — the unified per-user settings control for the hadoku\n * ecosystem: a gear button that opens a popout housing everything that is a\n * property of the PERSON (not the app):\n *   - current access tier (read-only, friendly label)\n *   - display name (inline edit → POST /session/name)\n *   - global content-visibility level (tiered pill → PUT /prefs/api/v1/content-level)\n *   - switch key (an inline sign-in form, on the site's own sign-in client)\n *\n * \"Connected\" (parallel to ConnectedThemePicker): it self-wires to the\n * hadoku.me edge-router via same-origin fetches (see lib/settingsClient), so\n * dropping `<ConnectedSettings />` into any app under hadoku.me needs zero\n * props. Identity is resolved via whoami() unless the host passes `userType` /\n * `name` (avoids a redundant fetch when the app already knows).\n *\n * All of that is resolved AT MOUNT via `prefetchSettings()`, never on\n * gear-click — opening the popout must cost zero requests. See the effect\n * below, and `e2e/settings-prefetch.spec.ts` in hadoku-task, which fails if the\n * fetch moves back behind the click.\n *\n * Mirrors ThemePicker's controlled-popout pattern: owns its own `open` state +\n * a full-viewport overlay for click-outside dismiss. The content pill renders\n * `maxLevel` segments (friend ⇒ 3, admin ⇒ 4) and is hidden for public callers.\n * maxLevel comes from the server so the tier ceiling is never trusted from the\n * client.\n */\nimport React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { SettingsIcon } from './ThemeIcons'\nimport {\n  prefetchSettings,\n  setContentLevel,\n  setDisplayName,\n  loadSignIn,\n  loadSignInClient,\n  passkeyHref,\n  passkeysSupported,\n  switchKeyHref,\n  type ContentLevelState,\n  type Tier\n} from '../lib/settingsClient'\nimport '../app-header.css'\n\nexport interface ConnectedSettingsProps {\n  /** Caller's tier. Omit to self-resolve via whoami().\n   *\n   *  This exists for apps that CANNOT reach `/session/whoami` — conjure sits\n   *  behind a path-prefixed shim that serves nothing outside `/conjure`, so\n   *  whoami 404s and the tier would fall back to guest. It is an identity\n   *  hint, not a way to present a different tier than the edge assigns: every\n   *  gate that matters is enforced server-side off the edge-stamped tier. */\n  userType?: Tier\n  /** Display name. Omit to self-resolve via whoami(). Same rationale. */\n  name?: string | null\n  /** Notify the host (e.g. a \"Signed in as …\" label) of a rename. */\n  onNameChange?: (name: string | null) => void\n  /** App-specific settings rendered as a final section in the same popout, so\n   *  an app with its own preferences keeps ONE unified gear instead of a second\n   *  control. Shown under an \"App preferences\" divider.\n   *\n   *  This slot is deliberately unconstrained — put whatever the app needs in\n   *  it. The constraint is only that it lands AFTER the four canonical rows and\n   *  cannot change them. */\n  children?: React.ReactNode\n}\n\n/** Rejects once `signal` aborts, so a call that ignores the signal (an older\n *  site client, a prompt that never settles) still lets the UI go. */\nfunction untilAborted(signal: AbortSignal): Promise<never> {\n  return new Promise((_, reject) => {\n    const fail = () => reject(new Error('cancelled'))\n    if (signal.aborted) fail()\n    else signal.addEventListener('abort', fail, { once: true })\n  })\n}\n\n/** Abort reason when the popout closes: a dismissal, not an error to show. */\nconst CLOSED = 'closed'\n\n/** Rejection sink for fire-and-forget settings actions. The client helpers\n *  already resolve to null on failure (state reflects it), so this only trips\n *  on truly unexpected throws — log rather than swallow silently. */\nfunction reportErr(err: unknown) {\n  // task-ui-components v2 dropped its logger; keep the package dependency-free.\n  console.error('[ConnectedSettings] action failed', (err as Error)?.message ?? err)\n}\n\nconst TIER_LABEL: Record<Tier, string> = {\n  admin: 'Administrator',\n  wife: 'Wife',\n  service: 'Service',\n  friend: 'Friend',\n  public: 'Guest'\n}\n\nexport function ConnectedSettings({\n  userType: userTypeProp,\n  name: nameProp,\n  onNameChange,\n  children\n}: ConnectedSettingsProps) {\n  const [open, setOpen] = useState(false)\n  const rootRef = useRef<HTMLDivElement>(null)\n\n  // Identity — from props if supplied, else resolved lazily via whoami().\n  const [userType, setUserType] = useState<Tier>(userTypeProp ?? 'public')\n  const [resolvedName, setResolvedName] = useState<string | null>(nameProp ?? null)\n\n  // Name editing\n  const [nameDraft, setNameDraft] = useState(resolvedName ?? '')\n  const [editingName, setEditingName] = useState(false)\n  const [nameSaving, setNameSaving] = useState(false)\n  const [displayName, setLocalName] = useState<string | null>(resolvedName)\n\n  // Key swap. The draft lives only in this state and the input: it is never\n  // logged, stored or sent anywhere but the site's sign-in client.\n  const [keyFormOpen, setKeyFormOpen] = useState(false)\n  const [keyDraft, setKeyDraft] = useState('')\n  const [keyBusy, setKeyBusy] = useState(false)\n  const [keyError, setKeyError] = useState<string | null>(null)\n\n  // Passkeys, through the same site client: save one while signed in, or\n  // sign in with one from the key form. One prompt at a time, and always\n  // cancellable: a password manager can dismiss the browser's prompt without\n  // ever answering it, so Cancel, closing the popout and the site client's own\n  // time limit each end the wait.\n  const [passkeyMode, setPasskeyMode] = useState<'save' | 'signin' | null>(null)\n  const [passkeySaved, setPasskeySaved] = useState(false)\n  const [passkeyError, setPasskeyError] = useState<string | null>(null)\n  const passkeyCtl = useRef<AbortController | null>(null)\n  const cancelPasskey = useCallback((reason?: string) => passkeyCtl.current?.abort(reason), [])\n\n  // Content level\n  const [content, setContent] = useState<ContentLevelState | null>(null)\n  const [levelSaving, setLevelSaving] = useState(false)\n\n  // One flag for the whole prefetch, not one per request — the panel body\n  // reveals when everything has settled, so nothing pops in a beat late. In\n  // practice the user never sees it: the prefetch starts at mount and is long\n  // done by the time the gear is clicked. It only shows if they click within\n  // the first moments of the page.\n  const [resolving, setResolving] = useState(true)\n\n  // Everyone who is SIGNED IN, expressed as \"not public\" rather than as a list\n  // of tiers. The list form (`=== 'admin' || === 'friend' || === 'service'`)\n  // is an exact-match allowlist: it silently excluded `wife` the moment that\n  // tier existed, which is the failure the rank model is meant to prevent.\n  // There is no rank helper in this bundle, but \"above public\" needs none.\n  const showContentPill = userType !== 'public'\n\n  // Keep local identity in sync when the host controls it via props.\n  useEffect(() => {\n    if (userTypeProp !== undefined) setUserType(userTypeProp)\n  }, [userTypeProp])\n  useEffect(() => {\n    if (nameProp !== undefined) {\n      setResolvedName(nameProp)\n      setLocalName(nameProp)\n      setNameDraft(nameProp ?? '')\n    }\n  }, [nameProp])\n\n  // Resolve everything the panel shows AT MOUNT — not on open.\n  //\n  // This used to be gated on `open`, which made the gear the trigger for\n  // whoami + content-level (167ms / 186ms on prod, concurrent) — a round trip\n  // the user waited out with the panel already on screen and blank. Nothing\n  // about that data depends on the click:\n  // it's the signed-in user's own identity, settled at boot and unchanged for\n  // the life of the page. So it rides along with the app's boot traffic, and\n  // clicking the gear costs zero requests. `e2e/settings-prefetch.spec.ts` in\n  // hadoku-task pins that.\n  //\n  // The client memoises across callers, so mounting this in several places (or\n  // remounting it) does not multiply requests, and on hadoku.me the identity\n  // half is free — it awaits the whoami the shell already had in flight.\n  useEffect(() => {\n    let live = true\n    prefetchSettings({ userType: userTypeProp, name: nameProp })\n      .then(({ identity, content: state }) => {\n        if (!live) return\n        // Props stay authoritative: the host passed them because it can see an\n        // identity this component can't resolve for itself.\n        if (userTypeProp === undefined) {\n          setUserType(identity.userType)\n          setResolvedName(identity.name)\n          setLocalName(identity.name)\n          setNameDraft(identity.name ?? '')\n        }\n        if (state) setContent(state)\n      })\n      .catch(reportErr)\n      .finally(() => {\n        if (live) setResolving(false)\n      })\n    return () => {\n      live = false\n    }\n    // Hints are read once, on the first mount that gets there — the prefetch is\n    // page-scoped and a later prop change cannot un-issue it. Identity changes\n    // arrive through the sync effects above, and a key swap reloads the page.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [])\n\n  // Escape closes.\n  useEffect(() => {\n    if (!open) return\n    const onKey = (e: KeyboardEvent) => {\n      if (e.key === 'Escape') setOpen(false)\n    }\n    window.addEventListener('keydown', onKey)\n    return () => window.removeEventListener('keydown', onKey)\n  }, [open])\n\n  const saveName = useCallback(async () => {\n    const trimmed = nameDraft.trim()\n    if (!trimmed || trimmed === displayName) {\n      setEditingName(false)\n      return\n    }\n    setNameSaving(true)\n    const stored = await setDisplayName(trimmed)\n    setNameSaving(false)\n    if (stored !== null) {\n      setLocalName(stored)\n      setNameDraft(stored)\n      onNameChange?.(stored)\n    }\n    setEditingName(false)\n  }, [nameDraft, displayName, onNameChange])\n\n  // Open the form AND start loading the site's sign-in client, which begins its\n  // fingerprint collection as it evaluates — so it is ready by submit. Where the\n  // client cannot load at all (not on hadoku.me), the page-level /auth flow is\n  // the only way to sign in, so go there.\n  const openKeyForm = useCallback(() => {\n    setKeyFormOpen(true)\n    setKeyError(null)\n    loadSignIn()\n      .then(signIn => {\n        if (!signIn) window.location.assign(switchKeyHref())\n      })\n      .catch(reportErr)\n  }, [])\n\n  const submitKey = useCallback(async () => {\n    setKeyBusy(true)\n    setKeyError(null)\n    const signIn = await loadSignIn()\n    if (!signIn) {\n      window.location.assign(switchKeyHref())\n      return\n    }\n    try {\n      await signIn(keyDraft)\n    } catch (err) {\n      // A refused key is an inline error, never a redirect.\n      setKeyError((err as Error)?.message || 'Invalid key')\n      setKeyBusy(false)\n      return\n    }\n    // The page now acts for a different identity: everything must re-mount.\n    // Busy stays on through the reload so the form can't be resubmitted.\n    window.location.reload()\n  }, [keyDraft])\n\n  const savePasskey = useCallback(async () => {\n    const ctl = new AbortController()\n    passkeyCtl.current = ctl\n    setPasskeyMode('save')\n    setPasskeyError(null)\n    try {\n      const client = await Promise.race([loadSignInClient(), untilAborted(ctl.signal)])\n      if (!client?.addPasskey) {\n        window.location.assign(passkeyHref('add'))\n        return\n      }\n      await Promise.race([client.addPasskey({ signal: ctl.signal }), untilAborted(ctl.signal)])\n      setPasskeySaved(true)\n    } catch (err) {\n      if (ctl.signal.reason !== CLOSED) {\n        setPasskeyError(\n          ctl.signal.aborted ? 'Passkey not saved' : (err as Error)?.message || 'Passkey not saved'\n        )\n      }\n    } finally {\n      if (passkeyCtl.current === ctl) passkeyCtl.current = null\n      setPasskeyMode(null)\n    }\n  }, [])\n\n  const signInWithPasskey = useCallback(async () => {\n    const ctl = new AbortController()\n    passkeyCtl.current = ctl\n    setPasskeyMode('signin')\n    setKeyBusy(true)\n    setKeyError(null)\n    let leaving = false\n    try {\n      const client = await Promise.race([loadSignInClient(), untilAborted(ctl.signal)])\n      if (!client?.signInWithPasskey) {\n        leaving = true\n        window.location.assign(passkeyHref('signin'))\n        return\n      }\n      await Promise.race([\n        client.signInWithPasskey({ signal: ctl.signal }),\n        untilAborted(ctl.signal)\n      ])\n      // The page now acts for a different identity: everything must re-mount.\n      // Busy stays on through the reload so nothing can be resubmitted.\n      leaving = true\n      window.location.reload()\n    } catch (err) {\n      if (ctl.signal.reason !== CLOSED) {\n        setKeyError(\n          ctl.signal.aborted\n            ? 'Passkey sign-in cancelled'\n            : (err as Error)?.message || 'Passkey sign-in cancelled'\n        )\n      }\n    } finally {\n      if (passkeyCtl.current === ctl) passkeyCtl.current = null\n      if (!leaving) {\n        setPasskeyMode(null)\n        setKeyBusy(false)\n      }\n    }\n  }, [])\n\n  // Closing the popout (or leaving the page) abandons an open prompt.\n  useEffect(() => {\n    if (!open) cancelPasskey(CLOSED)\n  }, [open, cancelPasskey])\n  useEffect(() => () => cancelPasskey(CLOSED), [cancelPasskey])\n\n  const pickLevel = useCallback(\n    async (level: number) => {\n      if (!content || level === content.level || levelSaving) return\n      const prev = content\n      setContent({ ...content, level }) // optimistic\n      setLevelSaving(true)\n      const result = await setContentLevel(level)\n      setLevelSaving(false)\n      setContent(result ?? prev) // adopt server truth, or revert\n    },\n    [content, levelSaving]\n  )\n\n  // No caller-supplied class on the root. The four rows below are the\n  // platform's, not the app's, and a className here is enough to restyle or\n  // hide any of them — which is the drift this component exists to prevent.\n  // Apps extend via `children`, never by reaching into this markup.\n  return (\n    <div className=\"settings-popout\" ref={rootRef}>\n      <button\n        type=\"button\"\n        className=\"app-header__icon-btn settings-toggle-btn\"\n        aria-label=\"User settings\"\n        aria-expanded={open}\n        onClick={() => setOpen(v => !v)}\n      >\n        <SettingsIcon />\n      </button>\n\n      {open && <div className=\"settings-popout__overlay\" onClick={() => setOpen(false)} />}\n\n      {open && (\n        <div className=\"settings-popout__panel\" role=\"dialog\" aria-label=\"User settings\">\n          <div className=\"settings-popout__header\">Settings</div>\n\n          {/* Access tier. While resolving, the state still says 'public' —\n              rendering \"Guest\" there would be a wrong answer that corrects\n              itself a moment later, which reads exactly like the lag this\n              placeholder exists to remove. */}\n          <section className=\"settings-popout__row\">\n            <span className=\"settings-popout__label\">Access tier</span>\n            {resolving ? (\n              <span className=\"settings-popout__value\">…</span>\n            ) : (\n              <span className={`settings-popout__tier settings-popout__tier--${userType}`}>\n                {TIER_LABEL[userType]}\n              </span>\n            )}\n          </section>\n\n          {/* Display name */}\n          <section className=\"settings-popout__row\">\n            <span className=\"settings-popout__label\">Display name</span>\n            {resolving ? (\n              <span className=\"settings-popout__value\">…</span>\n            ) : editingName ? (\n              <span className=\"settings-popout__inline\">\n                <input\n                  className=\"settings-popout__input\"\n                  value={nameDraft}\n                  maxLength={64}\n                  autoFocus\n                  disabled={nameSaving}\n                  onChange={e => setNameDraft(e.target.value)}\n                  onKeyDown={e => {\n                    if (e.key === 'Enter') {\n                      saveName().catch(reportErr)\n                    }\n                    if (e.key === 'Escape') {\n                      // The edit's Escape, not the popout's (window listener).\n                      e.stopPropagation()\n                      setEditingName(false)\n                      setNameDraft(displayName ?? '')\n                    }\n                  }}\n                />\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn settings-popout__btn--primary\"\n                  disabled={nameSaving}\n                  onClick={() => {\n                    saveName().catch(reportErr)\n                  }}\n                >\n                  {nameSaving ? '…' : 'Save'}\n                </button>\n              </span>\n            ) : (\n              <button\n                type=\"button\"\n                className=\"settings-popout__value settings-popout__value--editable\"\n                aria-label=\"Edit display name\"\n                onClick={() => {\n                  setNameDraft(displayName ?? '')\n                  setEditingName(true)\n                }}\n              >\n                {displayName || 'Unnamed'}\n              </button>\n            )}\n          </section>\n\n          {/* Content visibility level. Held back until the first-open fetch\n              settles, so it lands in the same paint as the tier and name\n              rather than a round trip behind them. `content` is fetched\n              concurrently with whoami(), so by then it is already here. */}\n          {!resolving && showContentPill && (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <span className=\"settings-popout__label\">Content visibility</span>\n              {content ? (\n                <>\n                  <div\n                    className=\"settings-popout__pill\"\n                    role=\"radiogroup\"\n                    aria-label=\"Content visibility level\"\n                  >\n                    {Array.from({ length: content.maxLevel }, (_, i) => i + 1).map(lvl => (\n                      <button\n                        key={lvl}\n                        type=\"button\"\n                        role=\"radio\"\n                        aria-checked={lvl === content.level}\n                        aria-label={`Level ${lvl}`}\n                        className={`settings-popout__seg${\n                          lvl <= content.level ? ' settings-popout__seg--filled' : ''\n                        }`}\n                        disabled={levelSaving}\n                        onClick={() => {\n                          pickLevel(lvl).catch(reportErr)\n                        }}\n                      >\n                        {lvl}\n                      </button>\n                    ))}\n                  </div>\n                  <span className=\"settings-popout__hint\">\n                    Higher levels reveal more mature content across apps. Level 1 is\n                    safe-for-everyone.\n                  </span>\n                </>\n              ) : (\n                // Not \"Loading…\" — the fetch has already settled by the time\n                // this section renders at all, so a null here means it failed.\n                <span className=\"settings-popout__hint\">Currently unavailable.</span>\n              )}\n            </section>\n          )}\n\n          {/* Switch key. Signs in inline through the SITE's sign-in client\n              (the /auth page's own code path), never a post of ours. A real\n              <form> with a username + current-password pair, so password\n              managers offer and save the key. */}\n          {keyFormOpen ? (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <form\n                className=\"settings-popout__key-form\"\n                onSubmit={e => {\n                  e.preventDefault()\n                  submitKey().catch(reportErr)\n                }}\n              >\n                <input\n                  type=\"text\"\n                  name=\"username\"\n                  autoComplete=\"username\"\n                  value=\"hadoku\"\n                  readOnly\n                  hidden\n                />\n                <label className=\"settings-popout__label\" htmlFor=\"settings-popout-key\">\n                  Access key\n                </label>\n                <span className=\"settings-popout__inline\">\n                  <input\n                    id=\"settings-popout-key\"\n                    className=\"settings-popout__input\"\n                    type=\"password\"\n                    name=\"password\"\n                    autoComplete=\"current-password\"\n                    autoCapitalize=\"none\"\n                    spellCheck={false}\n                    autoFocus\n                    value={keyDraft}\n                    disabled={keyBusy}\n                    aria-invalid={keyError !== null}\n                    aria-describedby={keyError ? 'settings-popout-key-error' : undefined}\n                    onChange={e => setKeyDraft(e.target.value)}\n                  />\n                  <button\n                    type=\"submit\"\n                    className=\"settings-popout__btn settings-popout__btn--primary\"\n                    disabled={keyBusy}\n                  >\n                    {keyBusy ? 'Signing in…' : 'Sign in'}\n                  </button>\n                </span>\n                {passkeysSupported() && (\n                  <span className=\"settings-popout__inline\">\n                    <button\n                      type=\"button\"\n                      className=\"settings-popout__btn\"\n                      disabled={keyBusy}\n                      onClick={() => {\n                        signInWithPasskey().catch(reportErr)\n                      }}\n                    >\n                      {passkeyMode === 'signin' ? 'Waiting for passkey…' : 'Use a passkey'}\n                    </button>\n                  </span>\n                )}\n                {/* Cancel on a line of its own: in the row it would slide under\n                    the pointer, and a double click would cancel what it started. */}\n                {passkeyMode === 'signin' && (\n                  <span className=\"settings-popout__inline\">\n                    <button\n                      type=\"button\"\n                      className=\"settings-popout__btn\"\n                      onClick={() => cancelPasskey()}\n                    >\n                      Cancel\n                    </button>\n                  </span>\n                )}\n                {keyError && (\n                  <span\n                    id=\"settings-popout-key-error\"\n                    className=\"settings-popout__error\"\n                    role=\"alert\"\n                  >\n                    {keyError}\n                  </span>\n                )}\n              </form>\n            </section>\n          ) : (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <span className=\"settings-popout__inline\">\n                <span className=\"settings-popout__label settings-popout__label--grow\">\n                  Access key\n                </span>\n                {/* Signed-in people only: the site refuses to save one for anyone else. */}\n                {!resolving && userType !== 'public' && passkeysSupported() && (\n                  <button\n                    type=\"button\"\n                    className=\"settings-popout__btn\"\n                    disabled={passkeyMode !== null || passkeySaved}\n                    onClick={() => {\n                      savePasskey().catch(reportErr)\n                    }}\n                  >\n                    {passkeySaved\n                      ? 'Passkey saved'\n                      : passkeyMode === 'save'\n                        ? 'Saving…'\n                        : 'Save passkey'}\n                  </button>\n                )}\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn\"\n                  disabled={passkeyMode === 'save'}\n                  onClick={openKeyForm}\n                >\n                  Switch key\n                </button>\n              </span>\n              {/* Its own line, so nothing moves under a double click. */}\n              {passkeyMode === 'save' && (\n                <span className=\"settings-popout__inline\">\n                  <button\n                    type=\"button\"\n                    className=\"settings-popout__btn\"\n                    onClick={() => cancelPasskey()}\n                  >\n                    Cancel\n                  </button>\n                </span>\n              )}\n              {passkeyError && (\n                <span className=\"settings-popout__error\" role=\"alert\">\n                  {passkeyError}\n                </span>\n              )}\n            </section>\n          )}\n\n          {/* App-specific settings (optional) — same popout, one gear. */}\n          {children && (\n            <section className=\"settings-popout__row settings-popout__row--stack settings-popout__app\">\n              {children}\n            </section>\n          )}\n        </div>\n      )}\n    </div>\n  )\n}\n"],"names":[],"mappings":";;;;;AAmEA,SAAS,aAAa,QAAqC;AACzD,SAAO,IAAI,QAAQ,CAAC,GAAG,WAAW;AAChC,UAAM,OAAO,MAAM,OAAO,IAAI,MAAM,WAAW,CAAC;AAChD,QAAI,OAAO,QAAS,MAAA;AAAA,gBACR,iBAAiB,SAAS,MAAM,EAAE,MAAM,MAAM;AAAA,EAC5D,CAAC;AACH;AAGA,MAAM,SAAS;AAKf,SAAS,UAAU,KAAc;AAE/B,UAAQ,MAAM,qCAAsC,KAAe,WAAW,GAAG;AACnF;AAEA,MAAM,aAAmC;AAAA,EACvC,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,kBAAkB;AAAA,EAChC,UAAU;AAAA,EACV,MAAM;AAAA,EACN;AAAA,EACA;AACF,GAA2B;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,OAAuB,IAAI;AAG3C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAe,gBAAgB,QAAQ;AACvE,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,YAAY,IAAI;AAGhF,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,gBAAgB,EAAE;AAC7D,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,aAAa,YAAY,IAAI,SAAwB,YAAY;AAIxE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAO5D,QAAM,CAAC,aAAa,cAAc,IAAI,SAAmC,IAAI;AAC7E,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,KAAK;AACtD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,IAAI;AACpE,QAAM,aAAa,OAA+B,IAAI;AACtD,QAAM,gBAAgB,YAAY,CAAC,WAAoB,WAAW,SAAS,MAAM,MAAM,GAAG,EAAE;AAG5F,QAAM,CAAC,SAAS,UAAU,IAAI,SAAmC,IAAI;AACrE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AAOpD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAO/C,QAAM,kBAAkB,aAAa;AAGrC,YAAU,MAAM;AACd,QAAI,iBAAiB,OAAW,aAAY,YAAY;AAAA,EAC1D,GAAG,CAAC,YAAY,CAAC;AACjB,YAAU,MAAM;AACd,QAAI,aAAa,QAAW;AAC1B,sBAAgB,QAAQ;AACxB,mBAAa,QAAQ;AACrB,mBAAa,YAAY,EAAE;AAAA,IAC7B;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAgBb,YAAU,MAAM;AACd,QAAI,OAAO;AACX,qBAAiB,EAAE,UAAU,cAAc,MAAM,SAAA,CAAU,EACxD,KAAK,CAAC,EAAE,UAAU,SAAS,YAAY;AACtC,UAAI,CAAC,KAAM;AAGX,UAAI,iBAAiB,QAAW;AAC9B,oBAAY,SAAS,QAAQ;AAC7B,wBAAgB,SAAS,IAAI;AAC7B,qBAAa,SAAS,IAAI;AAC1B,qBAAa,SAAS,QAAQ,EAAE;AAAA,MAClC;AACA,UAAI,kBAAkB,KAAK;AAAA,IAC7B,CAAC,EACA,MAAM,SAAS,EACf,QAAQ,MAAM;AACb,UAAI,mBAAmB,KAAK;AAAA,IAC9B,CAAC;AACH,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EAKF,GAAG,CAAA,CAAE;AAGL,YAAU,MAAM;AACd,QAAI,CAAC,KAAM;AACX,UAAM,QAAQ,CAAC,MAAqB;AAClC,UAAI,EAAE,QAAQ,SAAU,SAAQ,KAAK;AAAA,IACvC;AACA,WAAO,iBAAiB,WAAW,KAAK;AACxC,WAAO,MAAM,OAAO,oBAAoB,WAAW,KAAK;AAAA,EAC1D,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,WAAW,YAAY,YAAY;AACvC,UAAM,UAAU,UAAU,KAAA;AAC1B,QAAI,CAAC,WAAW,YAAY,aAAa;AACvC,qBAAe,KAAK;AACpB;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,UAAM,SAAS,MAAM,eAAe,OAAO;AAC3C,kBAAc,KAAK;AACnB,QAAI,WAAW,MAAM;AACnB,mBAAa,MAAM;AACnB,mBAAa,MAAM;AACnB,qBAAe,MAAM;AAAA,IACvB;AACA,mBAAe,KAAK;AAAA,EACtB,GAAG,CAAC,WAAW,aAAa,YAAY,CAAC;AAMzC,QAAM,cAAc,YAAY,MAAM;AACpC,mBAAe,IAAI;AACnB,gBAAY,IAAI;AAChB,eAAA,EACG,KAAK,CAAA,WAAU;AACd,UAAI,CAAC,OAAQ,QAAO,SAAS,OAAO,eAAe;AAAA,IACrD,CAAC,EACA,MAAM,SAAS;AAAA,EACpB,GAAG,CAAA,CAAE;AAEL,QAAM,YAAY,YAAY,YAAY;AACxC,eAAW,IAAI;AACf,gBAAY,IAAI;AAChB,UAAM,SAAS,MAAM,WAAA;AACrB,QAAI,CAAC,QAAQ;AACX,aAAO,SAAS,OAAO,eAAe;AACtC;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,QAAQ;AAAA,IACvB,SAAS,KAAK;AAEZ,kBAAa,KAAe,WAAW,aAAa;AACpD,iBAAW,KAAK;AAChB;AAAA,IACF;AAGA,WAAO,SAAS,OAAA;AAAA,EAClB,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,cAAc,YAAY,YAAY;AAC1C,UAAM,MAAM,IAAI,gBAAA;AAChB,eAAW,UAAU;AACrB,mBAAe,MAAM;AACrB,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,iBAAA,GAAoB,aAAa,IAAI,MAAM,CAAC,CAAC;AAChF,UAAI,CAAC,QAAQ,YAAY;AACvB,eAAO,SAAS,OAAO,YAAY,KAAK,CAAC;AACzC;AAAA,MACF;AACA,YAAM,QAAQ,KAAK,CAAC,OAAO,WAAW,EAAE,QAAQ,IAAI,OAAA,CAAQ,GAAG,aAAa,IAAI,MAAM,CAAC,CAAC;AACxF,sBAAgB,IAAI;AAAA,IACtB,SAAS,KAAK;AACZ,UAAI,IAAI,OAAO,WAAW,QAAQ;AAChC;AAAA,UACE,IAAI,OAAO,UAAU,sBAAuB,KAAe,WAAW;AAAA,QAAA;AAAA,MAE1E;AAAA,IACF,UAAA;AACE,UAAI,WAAW,YAAY,IAAK,YAAW,UAAU;AACrD,qBAAe,IAAI;AAAA,IACrB;AAAA,EACF,GAAG,CAAA,CAAE;AAEL,QAAM,oBAAoB,YAAY,YAAY;AAChD,UAAM,MAAM,IAAI,gBAAA;AAChB,eAAW,UAAU;AACrB,mBAAe,QAAQ;AACvB,eAAW,IAAI;AACf,gBAAY,IAAI;AAChB,QAAI,UAAU;AACd,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,iBAAA,GAAoB,aAAa,IAAI,MAAM,CAAC,CAAC;AAChF,UAAI,CAAC,QAAQ,mBAAmB;AAC9B,kBAAU;AACV,eAAO,SAAS,OAAO,YAAY,QAAQ,CAAC;AAC5C;AAAA,MACF;AACA,YAAM,QAAQ,KAAK;AAAA,QACjB,OAAO,kBAAkB,EAAE,QAAQ,IAAI,QAAQ;AAAA,QAC/C,aAAa,IAAI,MAAM;AAAA,MAAA,CACxB;AAGD,gBAAU;AACV,aAAO,SAAS,OAAA;AAAA,IAClB,SAAS,KAAK;AACZ,UAAI,IAAI,OAAO,WAAW,QAAQ;AAChC;AAAA,UACE,IAAI,OAAO,UACP,8BACC,KAAe,WAAW;AAAA,QAAA;AAAA,MAEnC;AAAA,IACF,UAAA;AACE,UAAI,WAAW,YAAY,IAAK,YAAW,UAAU;AACrD,UAAI,CAAC,SAAS;AACZ,uBAAe,IAAI;AACnB,mBAAW,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,EACF,GAAG,CAAA,CAAE;AAGL,YAAU,MAAM;AACd,QAAI,CAAC,KAAM,eAAc,MAAM;AAAA,EACjC,GAAG,CAAC,MAAM,aAAa,CAAC;AACxB,YAAU,MAAM,MAAM,cAAc,MAAM,GAAG,CAAC,aAAa,CAAC;AAE5D,QAAM,YAAY;AAAA,IAChB,OAAO,UAAkB;AACvB,UAAI,CAAC,WAAW,UAAU,QAAQ,SAAS,YAAa;AACxD,YAAM,OAAO;AACb,iBAAW,EAAE,GAAG,SAAS,OAAO;AAChC,qBAAe,IAAI;AACnB,YAAM,SAAS,MAAM,gBAAgB,KAAK;AAC1C,qBAAe,KAAK;AACpB,iBAAW,UAAU,IAAI;AAAA,IAC3B;AAAA,IACA,CAAC,SAAS,WAAW;AAAA,EAAA;AAOvB,SACE,qBAAC,OAAA,EAAI,WAAU,mBAAkB,KAAK,SACpC,UAAA;AAAA,IAAA;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,MAAK;AAAA,QACL,WAAU;AAAA,QACV,cAAW;AAAA,QACX,iBAAe;AAAA,QACf,SAAS,MAAM,QAAQ,CAAA,MAAK,CAAC,CAAC;AAAA,QAE9B,8BAAC,cAAA,CAAA,CAAa;AAAA,MAAA;AAAA,IAAA;AAAA,IAGf,4BAAS,OAAA,EAAI,WAAU,4BAA2B,SAAS,MAAM,QAAQ,KAAK,GAAG;AAAA,IAEjF,6BACE,OAAA,EAAI,WAAU,0BAAyB,MAAK,UAAS,cAAW,iBAC/D,UAAA;AAAA,MAAA,oBAAC,OAAA,EAAI,WAAU,2BAA0B,UAAA,YAAQ;AAAA,MAMjD,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,eAAW;AAAA,QACnD,YACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,IAAA,CAAC,IAE1C,oBAAC,QAAA,EAAK,WAAW,gDAAgD,QAAQ,IACtE,UAAA,WAAW,QAAQ,EAAA,CACtB;AAAA,MAAA,GAEJ;AAAA,MAGA,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,gBAAY;AAAA,QACpD,YACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,IAAA,CAAC,IACxC,cACF,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,WAAU;AAAA,cACV,OAAO;AAAA,cACP,WAAW;AAAA,cACX,WAAS;AAAA,cACT,UAAU;AAAA,cACV,UAAU,CAAA,MAAK,aAAa,EAAE,OAAO,KAAK;AAAA,cAC1C,WAAW,CAAA,MAAK;AACd,oBAAI,EAAE,QAAQ,SAAS;AACrB,2BAAA,EAAW,MAAM,SAAS;AAAA,gBAC5B;AACA,oBAAI,EAAE,QAAQ,UAAU;AAEtB,oBAAE,gBAAA;AACF,iCAAe,KAAK;AACpB,+BAAa,eAAe,EAAE;AAAA,gBAChC;AAAA,cACF;AAAA,YAAA;AAAA,UAAA;AAAA,UAEF;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,UAAU;AAAA,cACV,SAAS,MAAM;AACb,yBAAA,EAAW,MAAM,SAAS;AAAA,cAC5B;AAAA,cAEC,uBAAa,MAAM;AAAA,YAAA;AAAA,UAAA;AAAA,QACtB,EAAA,CACF,IAEA;AAAA,UAAC;AAAA,UAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,cAAW;AAAA,YACX,SAAS,MAAM;AACb,2BAAa,eAAe,EAAE;AAC9B,6BAAe,IAAI;AAAA,YACrB;AAAA,YAEC,UAAA,eAAe;AAAA,UAAA;AAAA,QAAA;AAAA,MAClB,GAEJ;AAAA,MAMC,CAAC,aAAa,mBACb,qBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,sBAAkB;AAAA,QAC1D,UACC,qBAAA,UAAA,EACE,UAAA;AAAA,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,WAAU;AAAA,cACV,MAAK;AAAA,cACL,cAAW;AAAA,cAEV,UAAA,MAAM,KAAK,EAAE,QAAQ,QAAQ,SAAA,GAAY,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,IAAI,CAAA,QAC7D;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBAEC,MAAK;AAAA,kBACL,MAAK;AAAA,kBACL,gBAAc,QAAQ,QAAQ;AAAA,kBAC9B,cAAY,SAAS,GAAG;AAAA,kBACxB,WAAW,uBACT,OAAO,QAAQ,QAAQ,kCAAkC,EAC3D;AAAA,kBACA,UAAU;AAAA,kBACV,SAAS,MAAM;AACb,8BAAU,GAAG,EAAE,MAAM,SAAS;AAAA,kBAChC;AAAA,kBAEC,UAAA;AAAA,gBAAA;AAAA,gBAbI;AAAA,cAAA,CAeR;AAAA,YAAA;AAAA,UAAA;AAAA,UAEH,oBAAC,QAAA,EAAK,WAAU,yBAAwB,UAAA,sFAAA,CAGxC;AAAA,QAAA,GACF;AAAA;AAAA;AAAA,UAIA,oBAAC,QAAA,EAAK,WAAU,yBAAwB,UAAA,yBAAA,CAAsB;AAAA;AAAA,MAAA,GAElE;AAAA,MAOD,cACC,oBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAC;AAAA,QAAA;AAAA,UACC,WAAU;AAAA,UACV,UAAU,CAAA,MAAK;AACb,cAAE,eAAA;AACF,sBAAA,EAAY,MAAM,SAAS;AAAA,UAC7B;AAAA,UAEA,UAAA;AAAA,YAAA;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,MAAK;AAAA,gBACL,cAAa;AAAA,gBACb,OAAM;AAAA,gBACN,UAAQ;AAAA,gBACR,QAAM;AAAA,cAAA;AAAA,YAAA;AAAA,gCAEP,SAAA,EAAM,WAAU,0BAAyB,SAAQ,uBAAsB,UAAA,cAExE;AAAA,YACA,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,cAAA;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBACC,IAAG;AAAA,kBACH,WAAU;AAAA,kBACV,MAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,gBAAe;AAAA,kBACf,YAAY;AAAA,kBACZ,WAAS;AAAA,kBACT,OAAO;AAAA,kBACP,UAAU;AAAA,kBACV,gBAAc,aAAa;AAAA,kBAC3B,oBAAkB,WAAW,8BAA8B;AAAA,kBAC3D,UAAU,CAAA,MAAK,YAAY,EAAE,OAAO,KAAK;AAAA,gBAAA;AAAA,cAAA;AAAA,cAE3C;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBACC,MAAK;AAAA,kBACL,WAAU;AAAA,kBACV,UAAU;AAAA,kBAET,oBAAU,gBAAgB;AAAA,gBAAA;AAAA,cAAA;AAAA,YAC7B,GACF;AAAA,YACC,kBAAA,KACC,oBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,UAAU;AAAA,gBACV,SAAS,MAAM;AACb,oCAAA,EAAoB,MAAM,SAAS;AAAA,gBACrC;AAAA,gBAEC,UAAA,gBAAgB,WAAW,yBAAyB;AAAA,cAAA;AAAA,YAAA,GAEzD;AAAA,YAID,gBAAgB,YACf,oBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,SAAS,MAAM,cAAA;AAAA,gBAChB,UAAA;AAAA,cAAA;AAAA,YAAA,GAGH;AAAA,YAED,YACC;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,IAAG;AAAA,gBACH,WAAU;AAAA,gBACV,MAAK;AAAA,gBAEJ,UAAA;AAAA,cAAA;AAAA,YAAA;AAAA,UACH;AAAA,QAAA;AAAA,MAAA,EAEJ,CACF,IAEA,qBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAA,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAA,oBAAC,QAAA,EAAK,WAAU,uDAAsD,UAAA,cAEtE;AAAA,UAEC,CAAC,aAAa,aAAa,YAAY,uBACtC;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,UAAU,gBAAgB,QAAQ;AAAA,cAClC,SAAS,MAAM;AACb,4BAAA,EAAc,MAAM,SAAS;AAAA,cAC/B;AAAA,cAEC,UAAA,eACG,kBACA,gBAAgB,SACd,YACA;AAAA,YAAA;AAAA,UAAA;AAAA,UAGV;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,UAAU,gBAAgB;AAAA,cAC1B,SAAS;AAAA,cACV,UAAA;AAAA,YAAA;AAAA,UAAA;AAAA,QAED,GACF;AAAA,QAEC,gBAAgB,UACf,oBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAC;AAAA,UAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM,cAAA;AAAA,YAChB,UAAA;AAAA,UAAA;AAAA,QAAA,GAGH;AAAA,QAED,gBACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,MAAK,SAC3C,UAAA,aAAA,CACH;AAAA,MAAA,GAEJ;AAAA,MAID,YACC,oBAAC,WAAA,EAAQ,WAAU,yEAChB,SAAA,CACH;AAAA,IAAA,EAAA,CAEJ;AAAA,EAAA,GAEJ;AAEJ;"}
+{"version":3,"file":"ConnectedSettings.js","sources":["../../src/components/ConnectedSettings.tsx"],"sourcesContent":["/**\n * ConnectedSettings — the unified per-user settings control for the hadoku\n * ecosystem: a gear button that opens a popout housing everything that is a\n * property of the PERSON (not the app):\n *   - current access tier (read-only, friendly label)\n *   - display name (inline edit → POST /session/name)\n *   - global content-visibility level (tiered pill → PUT /prefs/api/v1/content-level)\n *   - switch key (an inline sign-in form, on the site's own sign-in client)\n *\n * \"Connected\" (parallel to ConnectedThemePicker): it self-wires to the\n * hadoku.me edge-router via same-origin fetches (see lib/settingsClient), so\n * dropping `<ConnectedSettings />` into any app under hadoku.me needs zero\n * props. Identity is resolved via whoami() unless the host passes `userType` /\n * `name` (avoids a redundant fetch when the app already knows).\n *\n * All of that is resolved AT MOUNT via `prefetchSettings()`, never on\n * gear-click — opening the popout must cost zero requests. See the effect\n * below, and `e2e/settings-prefetch.spec.ts` in hadoku-task, which fails if the\n * fetch moves back behind the click.\n *\n * Mirrors ThemePicker's controlled-popout pattern: owns its own `open` state +\n * a full-viewport overlay for click-outside dismiss. The content pill renders\n * `maxLevel` segments (friend ⇒ 3, admin ⇒ 4) and is hidden for public callers.\n * maxLevel comes from the server so the tier ceiling is never trusted from the\n * client.\n */\nimport React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { SettingsIcon } from './ThemeIcons'\nimport {\n  prefetchSettings,\n  setContentLevel,\n  setDisplayName,\n  loadSignIn,\n  loadSignInClient,\n  passkeyHref,\n  passkeysSupported,\n  switchKeyHref,\n  type ContentLevelState,\n  type Tier\n} from '../lib/settingsClient'\nimport '../app-header.css'\n\nexport interface ConnectedSettingsProps {\n  /** Caller's tier. Omit to self-resolve via whoami().\n   *\n   *  This exists for apps that CANNOT reach `/session/whoami` — conjure sits\n   *  behind a path-prefixed shim that serves nothing outside `/conjure`, so\n   *  whoami 404s and the tier would fall back to guest. It is an identity\n   *  hint, not a way to present a different tier than the edge assigns: every\n   *  gate that matters is enforced server-side off the edge-stamped tier. */\n  userType?: Tier\n  /** Display name. Omit to self-resolve via whoami(). Same rationale. */\n  name?: string | null\n  /** Notify the host (e.g. a \"Signed in as …\" label) of a rename. */\n  onNameChange?: (name: string | null) => void\n  /** App-specific settings rendered as a final section in the same popout, so\n   *  an app with its own preferences keeps ONE unified gear instead of a second\n   *  control. Shown under an \"App preferences\" divider.\n   *\n   *  This slot is deliberately unconstrained — put whatever the app needs in\n   *  it. The constraint is only that it lands AFTER the four canonical rows and\n   *  cannot change them. */\n  children?: React.ReactNode\n}\n\n/** Rejects once `signal` aborts, so a call that ignores the signal (an older\n *  site client, a prompt that never settles) still lets the UI go. */\nfunction untilAborted(signal: AbortSignal): Promise<never> {\n  return new Promise((_, reject) => {\n    const fail = () => reject(new Error('cancelled'))\n    if (signal.aborted) fail()\n    else signal.addEventListener('abort', fail, { once: true })\n  })\n}\n\n/** Abort reason when the popout closes: a dismissal, not an error to show. */\nconst CLOSED = 'closed'\n\n/** Rejection sink for fire-and-forget settings actions. The client helpers\n *  already resolve to null on failure (state reflects it), so this only trips\n *  on truly unexpected throws — log rather than swallow silently. */\nfunction reportErr(err: unknown) {\n  // task-ui-components v2 dropped its logger; keep the package dependency-free.\n  console.error('[ConnectedSettings] action failed', (err as Error)?.message ?? err)\n}\n\n/** Inline, not in app-header.css: every app runs this component from the\n *  site's shared vendor module, but compiles app-header.css into its own\n *  stylesheet at ITS build, so a new rule reaches an app only when it rebuilds. */\nconst PASSKEY_DOT: React.CSSProperties = {\n  position: 'absolute',\n  top: 2,\n  right: 2,\n  width: 8,\n  height: 8,\n  borderRadius: '50%',\n  background: 'var(--color-primary)',\n  pointerEvents: 'none'\n}\n\nconst TIER_LABEL: Record<Tier, string> = {\n  admin: 'Administrator',\n  wife: 'Wife',\n  service: 'Service',\n  friend: 'Friend',\n  public: 'Guest'\n}\n\nexport function ConnectedSettings({\n  userType: userTypeProp,\n  name: nameProp,\n  onNameChange,\n  children\n}: ConnectedSettingsProps) {\n  const [open, setOpen] = useState(false)\n  const rootRef = useRef<HTMLDivElement>(null)\n\n  // Identity — from props if supplied, else resolved lazily via whoami().\n  const [userType, setUserType] = useState<Tier>(userTypeProp ?? 'public')\n  const [resolvedName, setResolvedName] = useState<string | null>(nameProp ?? null)\n\n  // Name editing\n  const [nameDraft, setNameDraft] = useState(resolvedName ?? '')\n  const [editingName, setEditingName] = useState(false)\n  const [nameSaving, setNameSaving] = useState(false)\n  const [displayName, setLocalName] = useState<string | null>(resolvedName)\n\n  // Key swap. The draft lives only in this state and the input: it is never\n  // logged, stored or sent anywhere but the site's sign-in client.\n  const [keyFormOpen, setKeyFormOpen] = useState(false)\n  const [keyDraft, setKeyDraft] = useState('')\n  const [keyBusy, setKeyBusy] = useState(false)\n  const [keyError, setKeyError] = useState<string | null>(null)\n\n  // Passkeys, through the same site client: save one while signed in, or\n  // sign in with one from the key form. One prompt at a time, and always\n  // cancellable: a password manager can dismiss the browser's prompt without\n  // ever answering it, so Cancel, closing the popout and the site client's own\n  // time limit each end the wait.\n  const [passkeyMode, setPasskeyMode] = useState<'save' | 'signin' | null>(null)\n  const [passkeySaved, setPasskeySaved] = useState(false)\n  // How many passkeys sign this person in, from whoami; null = unknown.\n  const [passkeyCount, setPasskeyCount] = useState<number | null>(null)\n  const [passkeyError, setPasskeyError] = useState<string | null>(null)\n  const passkeyCtl = useRef<AbortController | null>(null)\n  const cancelPasskey = useCallback((reason?: string) => passkeyCtl.current?.abort(reason), [])\n\n  // Content level\n  const [content, setContent] = useState<ContentLevelState | null>(null)\n  const [levelSaving, setLevelSaving] = useState(false)\n\n  // One flag for the whole prefetch, not one per request — the panel body\n  // reveals when everything has settled, so nothing pops in a beat late. In\n  // practice the user never sees it: the prefetch starts at mount and is long\n  // done by the time the gear is clicked. It only shows if they click within\n  // the first moments of the page.\n  const [resolving, setResolving] = useState(true)\n\n  // Everyone who is SIGNED IN, expressed as \"not public\" rather than as a list\n  // of tiers. The list form (`=== 'admin' || === 'friend' || === 'service'`)\n  // is an exact-match allowlist: it silently excluded `wife` the moment that\n  // tier existed, which is the failure the rank model is meant to prevent.\n  // There is no rank helper in this bundle, but \"above public\" needs none.\n  const showContentPill = userType !== 'public'\n\n  // Signed in on a key with no passkey: the gear carries a dot and Save passkey\n  // is the primary action until one is saved. Unknown counts never prompt.\n  const needsPasskey =\n    !resolving &&\n    userType !== 'public' &&\n    passkeyCount === 0 &&\n    !passkeySaved &&\n    passkeysSupported()\n\n  // Keep local identity in sync when the host controls it via props.\n  useEffect(() => {\n    if (userTypeProp !== undefined) setUserType(userTypeProp)\n  }, [userTypeProp])\n  useEffect(() => {\n    if (nameProp !== undefined) {\n      setResolvedName(nameProp)\n      setLocalName(nameProp)\n      setNameDraft(nameProp ?? '')\n    }\n  }, [nameProp])\n\n  // Resolve everything the panel shows AT MOUNT — not on open.\n  //\n  // This used to be gated on `open`, which made the gear the trigger for\n  // whoami + content-level (167ms / 186ms on prod, concurrent) — a round trip\n  // the user waited out with the panel already on screen and blank. Nothing\n  // about that data depends on the click:\n  // it's the signed-in user's own identity, settled at boot and unchanged for\n  // the life of the page. So it rides along with the app's boot traffic, and\n  // clicking the gear costs zero requests. `e2e/settings-prefetch.spec.ts` in\n  // hadoku-task pins that.\n  //\n  // The client memoises across callers, so mounting this in several places (or\n  // remounting it) does not multiply requests, and on hadoku.me the identity\n  // half is free — it awaits the whoami the shell already had in flight.\n  useEffect(() => {\n    let live = true\n    prefetchSettings({ userType: userTypeProp, name: nameProp })\n      .then(({ identity, content: state, passkeys }) => {\n        if (!live) return\n        setPasskeyCount(passkeys)\n        // Props stay authoritative: the host passed them because it can see an\n        // identity this component can't resolve for itself.\n        if (userTypeProp === undefined) {\n          setUserType(identity.userType)\n          setResolvedName(identity.name)\n          setLocalName(identity.name)\n          setNameDraft(identity.name ?? '')\n        }\n        if (state) setContent(state)\n      })\n      .catch(reportErr)\n      .finally(() => {\n        if (live) setResolving(false)\n      })\n    return () => {\n      live = false\n    }\n    // Hints are read once, on the first mount that gets there — the prefetch is\n    // page-scoped and a later prop change cannot un-issue it. Identity changes\n    // arrive through the sync effects above, and a key swap reloads the page.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [])\n\n  // Escape closes.\n  useEffect(() => {\n    if (!open) return\n    const onKey = (e: KeyboardEvent) => {\n      if (e.key === 'Escape') setOpen(false)\n    }\n    window.addEventListener('keydown', onKey)\n    return () => window.removeEventListener('keydown', onKey)\n  }, [open])\n\n  const saveName = useCallback(async () => {\n    const trimmed = nameDraft.trim()\n    if (!trimmed || trimmed === displayName) {\n      setEditingName(false)\n      return\n    }\n    setNameSaving(true)\n    const stored = await setDisplayName(trimmed)\n    setNameSaving(false)\n    if (stored !== null) {\n      setLocalName(stored)\n      setNameDraft(stored)\n      onNameChange?.(stored)\n    }\n    setEditingName(false)\n  }, [nameDraft, displayName, onNameChange])\n\n  // Open the form AND start loading the site's sign-in client, which begins its\n  // fingerprint collection as it evaluates — so it is ready by submit. Where the\n  // client cannot load at all (not on hadoku.me), the page-level /auth flow is\n  // the only way to sign in, so go there.\n  const openKeyForm = useCallback(() => {\n    setKeyFormOpen(true)\n    setKeyError(null)\n    loadSignIn()\n      .then(signIn => {\n        if (!signIn) window.location.assign(switchKeyHref())\n      })\n      .catch(reportErr)\n  }, [])\n\n  const submitKey = useCallback(async () => {\n    setKeyBusy(true)\n    setKeyError(null)\n    const signIn = await loadSignIn()\n    if (!signIn) {\n      window.location.assign(switchKeyHref())\n      return\n    }\n    try {\n      await signIn(keyDraft)\n    } catch (err) {\n      // A refused key is an inline error, never a redirect.\n      setKeyError((err as Error)?.message || 'Invalid key')\n      setKeyBusy(false)\n      return\n    }\n    // The page now acts for a different identity: everything must re-mount.\n    // Busy stays on through the reload so the form can't be resubmitted.\n    window.location.reload()\n  }, [keyDraft])\n\n  const savePasskey = useCallback(async () => {\n    const ctl = new AbortController()\n    passkeyCtl.current = ctl\n    setPasskeyMode('save')\n    setPasskeyError(null)\n    try {\n      const client = await Promise.race([loadSignInClient(), untilAborted(ctl.signal)])\n      if (!client?.addPasskey) {\n        window.location.assign(passkeyHref('add'))\n        return\n      }\n      await Promise.race([client.addPasskey({ signal: ctl.signal }), untilAborted(ctl.signal)])\n      setPasskeySaved(true)\n    } catch (err) {\n      if (ctl.signal.reason !== CLOSED) {\n        setPasskeyError(\n          ctl.signal.aborted ? 'Passkey not saved' : (err as Error)?.message || 'Passkey not saved'\n        )\n      }\n    } finally {\n      if (passkeyCtl.current === ctl) passkeyCtl.current = null\n      setPasskeyMode(null)\n    }\n  }, [])\n\n  const signInWithPasskey = useCallback(async () => {\n    const ctl = new AbortController()\n    passkeyCtl.current = ctl\n    setPasskeyMode('signin')\n    setKeyBusy(true)\n    setKeyError(null)\n    let leaving = false\n    try {\n      const client = await Promise.race([loadSignInClient(), untilAborted(ctl.signal)])\n      if (!client?.signInWithPasskey) {\n        leaving = true\n        window.location.assign(passkeyHref('signin'))\n        return\n      }\n      await Promise.race([\n        client.signInWithPasskey({ signal: ctl.signal }),\n        untilAborted(ctl.signal)\n      ])\n      // The page now acts for a different identity: everything must re-mount.\n      // Busy stays on through the reload so nothing can be resubmitted.\n      leaving = true\n      window.location.reload()\n    } catch (err) {\n      if (ctl.signal.reason !== CLOSED) {\n        setKeyError(\n          ctl.signal.aborted\n            ? 'Passkey sign-in cancelled'\n            : (err as Error)?.message || 'Passkey sign-in cancelled'\n        )\n      }\n    } finally {\n      if (passkeyCtl.current === ctl) passkeyCtl.current = null\n      if (!leaving) {\n        setPasskeyMode(null)\n        setKeyBusy(false)\n      }\n    }\n  }, [])\n\n  // Closing the popout (or leaving the page) abandons an open prompt.\n  useEffect(() => {\n    if (!open) cancelPasskey(CLOSED)\n  }, [open, cancelPasskey])\n  useEffect(() => () => cancelPasskey(CLOSED), [cancelPasskey])\n\n  const pickLevel = useCallback(\n    async (level: number) => {\n      if (!content || level === content.level || levelSaving) return\n      const prev = content\n      setContent({ ...content, level }) // optimistic\n      setLevelSaving(true)\n      const result = await setContentLevel(level)\n      setLevelSaving(false)\n      setContent(result ?? prev) // adopt server truth, or revert\n    },\n    [content, levelSaving]\n  )\n\n  // No caller-supplied class on the root. The four rows below are the\n  // platform's, not the app's, and a className here is enough to restyle or\n  // hide any of them — which is the drift this component exists to prevent.\n  // Apps extend via `children`, never by reaching into this markup.\n  return (\n    <div className=\"settings-popout\" ref={rootRef}>\n      <button\n        type=\"button\"\n        className=\"app-header__icon-btn settings-toggle-btn\"\n        aria-label={needsPasskey ? 'User settings, no passkey saved' : 'User settings'}\n        style={needsPasskey ? { position: 'relative' } : undefined}\n        aria-expanded={open}\n        onClick={() => setOpen(v => !v)}\n      >\n        <SettingsIcon />\n        {needsPasskey && (\n          <span className=\"settings-toggle-btn__dot\" style={PASSKEY_DOT} aria-hidden=\"true\" />\n        )}\n      </button>\n\n      {open && <div className=\"settings-popout__overlay\" onClick={() => setOpen(false)} />}\n\n      {open && (\n        <div className=\"settings-popout__panel\" role=\"dialog\" aria-label=\"User settings\">\n          <div className=\"settings-popout__header\">Settings</div>\n\n          {/* Access tier. While resolving, the state still says 'public' —\n              rendering \"Guest\" there would be a wrong answer that corrects\n              itself a moment later, which reads exactly like the lag this\n              placeholder exists to remove. */}\n          <section className=\"settings-popout__row\">\n            <span className=\"settings-popout__label\">Access tier</span>\n            {resolving ? (\n              <span className=\"settings-popout__value\">…</span>\n            ) : (\n              <span className={`settings-popout__tier settings-popout__tier--${userType}`}>\n                {TIER_LABEL[userType]}\n              </span>\n            )}\n          </section>\n\n          {/* Display name */}\n          <section className=\"settings-popout__row\">\n            <span className=\"settings-popout__label\">Display name</span>\n            {resolving ? (\n              <span className=\"settings-popout__value\">…</span>\n            ) : editingName ? (\n              <span className=\"settings-popout__inline\">\n                <input\n                  className=\"settings-popout__input\"\n                  value={nameDraft}\n                  maxLength={64}\n                  autoFocus\n                  disabled={nameSaving}\n                  onChange={e => setNameDraft(e.target.value)}\n                  onKeyDown={e => {\n                    if (e.key === 'Enter') {\n                      saveName().catch(reportErr)\n                    }\n                    if (e.key === 'Escape') {\n                      // The edit's Escape, not the popout's (window listener).\n                      e.stopPropagation()\n                      setEditingName(false)\n                      setNameDraft(displayName ?? '')\n                    }\n                  }}\n                />\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn settings-popout__btn--primary\"\n                  disabled={nameSaving}\n                  onClick={() => {\n                    saveName().catch(reportErr)\n                  }}\n                >\n                  {nameSaving ? '…' : 'Save'}\n                </button>\n              </span>\n            ) : (\n              <button\n                type=\"button\"\n                className=\"settings-popout__value settings-popout__value--editable\"\n                aria-label=\"Edit display name\"\n                onClick={() => {\n                  setNameDraft(displayName ?? '')\n                  setEditingName(true)\n                }}\n              >\n                {displayName || 'Unnamed'}\n              </button>\n            )}\n          </section>\n\n          {/* Content visibility level. Held back until the first-open fetch\n              settles, so it lands in the same paint as the tier and name\n              rather than a round trip behind them. `content` is fetched\n              concurrently with whoami(), so by then it is already here. */}\n          {!resolving && showContentPill && (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <span className=\"settings-popout__label\">Content visibility</span>\n              {content ? (\n                <>\n                  <div\n                    className=\"settings-popout__pill\"\n                    role=\"radiogroup\"\n                    aria-label=\"Content visibility level\"\n                  >\n                    {Array.from({ length: content.maxLevel }, (_, i) => i + 1).map(lvl => (\n                      <button\n                        key={lvl}\n                        type=\"button\"\n                        role=\"radio\"\n                        aria-checked={lvl === content.level}\n                        aria-label={`Level ${lvl}`}\n                        className={`settings-popout__seg${\n                          lvl <= content.level ? ' settings-popout__seg--filled' : ''\n                        }`}\n                        disabled={levelSaving}\n                        onClick={() => {\n                          pickLevel(lvl).catch(reportErr)\n                        }}\n                      >\n                        {lvl}\n                      </button>\n                    ))}\n                  </div>\n                  <span className=\"settings-popout__hint\">\n                    Higher levels reveal more mature content across apps. Level 1 is\n                    safe-for-everyone.\n                  </span>\n                </>\n              ) : (\n                // Not \"Loading…\" — the fetch has already settled by the time\n                // this section renders at all, so a null here means it failed.\n                <span className=\"settings-popout__hint\">Currently unavailable.</span>\n              )}\n            </section>\n          )}\n\n          {/* Switch key. Signs in inline through the SITE's sign-in client\n              (the /auth page's own code path), never a post of ours. A real\n              <form> with a username + current-password pair, so password\n              managers offer and save the key. */}\n          {keyFormOpen ? (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <form\n                className=\"settings-popout__key-form\"\n                onSubmit={e => {\n                  e.preventDefault()\n                  submitKey().catch(reportErr)\n                }}\n              >\n                <input\n                  type=\"text\"\n                  name=\"username\"\n                  autoComplete=\"username\"\n                  value=\"hadoku\"\n                  readOnly\n                  hidden\n                />\n                <label className=\"settings-popout__label\" htmlFor=\"settings-popout-key\">\n                  Access key\n                </label>\n                <span className=\"settings-popout__inline\">\n                  <input\n                    id=\"settings-popout-key\"\n                    className=\"settings-popout__input\"\n                    type=\"password\"\n                    name=\"password\"\n                    autoComplete=\"current-password\"\n                    autoCapitalize=\"none\"\n                    spellCheck={false}\n                    autoFocus\n                    value={keyDraft}\n                    disabled={keyBusy}\n                    aria-invalid={keyError !== null}\n                    aria-describedby={keyError ? 'settings-popout-key-error' : undefined}\n                    onChange={e => setKeyDraft(e.target.value)}\n                  />\n                  <button\n                    type=\"submit\"\n                    className=\"settings-popout__btn settings-popout__btn--primary\"\n                    disabled={keyBusy}\n                  >\n                    {keyBusy ? 'Signing in…' : 'Sign in'}\n                  </button>\n                </span>\n                {passkeysSupported() && (\n                  <span className=\"settings-popout__inline\">\n                    <button\n                      type=\"button\"\n                      className=\"settings-popout__btn\"\n                      disabled={keyBusy}\n                      onClick={() => {\n                        signInWithPasskey().catch(reportErr)\n                      }}\n                    >\n                      {passkeyMode === 'signin' ? 'Waiting for passkey…' : 'Use a passkey'}\n                    </button>\n                  </span>\n                )}\n                {/* Cancel on a line of its own: in the row it would slide under\n                    the pointer, and a double click would cancel what it started. */}\n                {passkeyMode === 'signin' && (\n                  <span className=\"settings-popout__inline\">\n                    <button\n                      type=\"button\"\n                      className=\"settings-popout__btn\"\n                      onClick={() => cancelPasskey()}\n                    >\n                      Cancel\n                    </button>\n                  </span>\n                )}\n                {keyError && (\n                  <span\n                    id=\"settings-popout-key-error\"\n                    className=\"settings-popout__error\"\n                    role=\"alert\"\n                  >\n                    {keyError}\n                  </span>\n                )}\n              </form>\n            </section>\n          ) : (\n            <section className=\"settings-popout__row settings-popout__row--stack\">\n              <span className=\"settings-popout__inline\">\n                <span className=\"settings-popout__label settings-popout__label--grow\">\n                  Access key\n                </span>\n                {/* Signed-in people only: the site refuses to save one for anyone else. */}\n                {!resolving && userType !== 'public' && passkeysSupported() && (\n                  <button\n                    type=\"button\"\n                    className={`settings-popout__btn${needsPasskey ? ' settings-popout__btn--primary' : ''}`}\n                    disabled={passkeyMode !== null || passkeySaved}\n                    onClick={() => {\n                      savePasskey().catch(reportErr)\n                    }}\n                  >\n                    {passkeySaved\n                      ? 'Passkey saved'\n                      : passkeyMode === 'save'\n                        ? 'Saving…'\n                        : 'Save passkey'}\n                  </button>\n                )}\n                <button\n                  type=\"button\"\n                  className=\"settings-popout__btn\"\n                  disabled={passkeyMode === 'save'}\n                  onClick={openKeyForm}\n                >\n                  Switch key\n                </button>\n              </span>\n              {/* Its own line, so nothing moves under a double click. */}\n              {passkeyMode === 'save' && (\n                <span className=\"settings-popout__inline\">\n                  <button\n                    type=\"button\"\n                    className=\"settings-popout__btn\"\n                    onClick={() => cancelPasskey()}\n                  >\n                    Cancel\n                  </button>\n                </span>\n              )}\n              {passkeyError && (\n                <span className=\"settings-popout__error\" role=\"alert\">\n                  {passkeyError}\n                </span>\n              )}\n            </section>\n          )}\n\n          {/* App-specific settings (optional) — same popout, one gear. */}\n          {children && (\n            <section className=\"settings-popout__row settings-popout__row--stack settings-popout__app\">\n              {children}\n            </section>\n          )}\n        </div>\n      )}\n    </div>\n  )\n}\n"],"names":[],"mappings":";;;;;AAmEA,SAAS,aAAa,QAAqC;AACzD,SAAO,IAAI,QAAQ,CAAC,GAAG,WAAW;AAChC,UAAM,OAAO,MAAM,OAAO,IAAI,MAAM,WAAW,CAAC;AAChD,QAAI,OAAO,QAAS,MAAA;AAAA,gBACR,iBAAiB,SAAS,MAAM,EAAE,MAAM,MAAM;AAAA,EAC5D,CAAC;AACH;AAGA,MAAM,SAAS;AAKf,SAAS,UAAU,KAAc;AAE/B,UAAQ,MAAM,qCAAsC,KAAe,WAAW,GAAG;AACnF;AAKA,MAAM,cAAmC;AAAA,EACvC,UAAU;AAAA,EACV,KAAK;AAAA,EACL,OAAO;AAAA,EACP,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,eAAe;AACjB;AAEA,MAAM,aAAmC;AAAA,EACvC,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,kBAAkB;AAAA,EAChC,UAAU;AAAA,EACV,MAAM;AAAA,EACN;AAAA,EACA;AACF,GAA2B;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,UAAU,OAAuB,IAAI;AAG3C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAe,gBAAgB,QAAQ;AACvE,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,YAAY,IAAI;AAGhF,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,gBAAgB,EAAE;AAC7D,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,aAAa,YAAY,IAAI,SAAwB,YAAY;AAIxE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAO5D,QAAM,CAAC,aAAa,cAAc,IAAI,SAAmC,IAAI;AAC7E,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,KAAK;AAEtD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,IAAI;AACpE,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,IAAI;AACpE,QAAM,aAAa,OAA+B,IAAI;AACtD,QAAM,gBAAgB,YAAY,CAAC,WAAoB,WAAW,SAAS,MAAM,MAAM,GAAG,EAAE;AAG5F,QAAM,CAAC,SAAS,UAAU,IAAI,SAAmC,IAAI;AACrE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AAOpD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAO/C,QAAM,kBAAkB,aAAa;AAIrC,QAAM,eACJ,CAAC,aACD,aAAa,YACb,iBAAiB,KACjB,CAAC,gBACD,kBAAA;AAGF,YAAU,MAAM;AACd,QAAI,iBAAiB,OAAW,aAAY,YAAY;AAAA,EAC1D,GAAG,CAAC,YAAY,CAAC;AACjB,YAAU,MAAM;AACd,QAAI,aAAa,QAAW;AAC1B,sBAAgB,QAAQ;AACxB,mBAAa,QAAQ;AACrB,mBAAa,YAAY,EAAE;AAAA,IAC7B;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAgBb,YAAU,MAAM;AACd,QAAI,OAAO;AACX,qBAAiB,EAAE,UAAU,cAAc,MAAM,UAAU,EACxD,KAAK,CAAC,EAAE,UAAU,SAAS,OAAO,eAAe;AAChD,UAAI,CAAC,KAAM;AACX,sBAAgB,QAAQ;AAGxB,UAAI,iBAAiB,QAAW;AAC9B,oBAAY,SAAS,QAAQ;AAC7B,wBAAgB,SAAS,IAAI;AAC7B,qBAAa,SAAS,IAAI;AAC1B,qBAAa,SAAS,QAAQ,EAAE;AAAA,MAClC;AACA,UAAI,kBAAkB,KAAK;AAAA,IAC7B,CAAC,EACA,MAAM,SAAS,EACf,QAAQ,MAAM;AACb,UAAI,mBAAmB,KAAK;AAAA,IAC9B,CAAC;AACH,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EAKF,GAAG,CAAA,CAAE;AAGL,YAAU,MAAM;AACd,QAAI,CAAC,KAAM;AACX,UAAM,QAAQ,CAAC,MAAqB;AAClC,UAAI,EAAE,QAAQ,SAAU,SAAQ,KAAK;AAAA,IACvC;AACA,WAAO,iBAAiB,WAAW,KAAK;AACxC,WAAO,MAAM,OAAO,oBAAoB,WAAW,KAAK;AAAA,EAC1D,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,WAAW,YAAY,YAAY;AACvC,UAAM,UAAU,UAAU,KAAA;AAC1B,QAAI,CAAC,WAAW,YAAY,aAAa;AACvC,qBAAe,KAAK;AACpB;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,UAAM,SAAS,MAAM,eAAe,OAAO;AAC3C,kBAAc,KAAK;AACnB,QAAI,WAAW,MAAM;AACnB,mBAAa,MAAM;AACnB,mBAAa,MAAM;AACnB,qBAAe,MAAM;AAAA,IACvB;AACA,mBAAe,KAAK;AAAA,EACtB,GAAG,CAAC,WAAW,aAAa,YAAY,CAAC;AAMzC,QAAM,cAAc,YAAY,MAAM;AACpC,mBAAe,IAAI;AACnB,gBAAY,IAAI;AAChB,eAAA,EACG,KAAK,CAAA,WAAU;AACd,UAAI,CAAC,OAAQ,QAAO,SAAS,OAAO,eAAe;AAAA,IACrD,CAAC,EACA,MAAM,SAAS;AAAA,EACpB,GAAG,CAAA,CAAE;AAEL,QAAM,YAAY,YAAY,YAAY;AACxC,eAAW,IAAI;AACf,gBAAY,IAAI;AAChB,UAAM,SAAS,MAAM,WAAA;AACrB,QAAI,CAAC,QAAQ;AACX,aAAO,SAAS,OAAO,eAAe;AACtC;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,QAAQ;AAAA,IACvB,SAAS,KAAK;AAEZ,kBAAa,KAAe,WAAW,aAAa;AACpD,iBAAW,KAAK;AAChB;AAAA,IACF;AAGA,WAAO,SAAS,OAAA;AAAA,EAClB,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,cAAc,YAAY,YAAY;AAC1C,UAAM,MAAM,IAAI,gBAAA;AAChB,eAAW,UAAU;AACrB,mBAAe,MAAM;AACrB,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,iBAAA,GAAoB,aAAa,IAAI,MAAM,CAAC,CAAC;AAChF,UAAI,CAAC,QAAQ,YAAY;AACvB,eAAO,SAAS,OAAO,YAAY,KAAK,CAAC;AACzC;AAAA,MACF;AACA,YAAM,QAAQ,KAAK,CAAC,OAAO,WAAW,EAAE,QAAQ,IAAI,OAAA,CAAQ,GAAG,aAAa,IAAI,MAAM,CAAC,CAAC;AACxF,sBAAgB,IAAI;AAAA,IACtB,SAAS,KAAK;AACZ,UAAI,IAAI,OAAO,WAAW,QAAQ;AAChC;AAAA,UACE,IAAI,OAAO,UAAU,sBAAuB,KAAe,WAAW;AAAA,QAAA;AAAA,MAE1E;AAAA,IACF,UAAA;AACE,UAAI,WAAW,YAAY,IAAK,YAAW,UAAU;AACrD,qBAAe,IAAI;AAAA,IACrB;AAAA,EACF,GAAG,CAAA,CAAE;AAEL,QAAM,oBAAoB,YAAY,YAAY;AAChD,UAAM,MAAM,IAAI,gBAAA;AAChB,eAAW,UAAU;AACrB,mBAAe,QAAQ;AACvB,eAAW,IAAI;AACf,gBAAY,IAAI;AAChB,QAAI,UAAU;AACd,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,iBAAA,GAAoB,aAAa,IAAI,MAAM,CAAC,CAAC;AAChF,UAAI,CAAC,QAAQ,mBAAmB;AAC9B,kBAAU;AACV,eAAO,SAAS,OAAO,YAAY,QAAQ,CAAC;AAC5C;AAAA,MACF;AACA,YAAM,QAAQ,KAAK;AAAA,QACjB,OAAO,kBAAkB,EAAE,QAAQ,IAAI,QAAQ;AAAA,QAC/C,aAAa,IAAI,MAAM;AAAA,MAAA,CACxB;AAGD,gBAAU;AACV,aAAO,SAAS,OAAA;AAAA,IAClB,SAAS,KAAK;AACZ,UAAI,IAAI,OAAO,WAAW,QAAQ;AAChC;AAAA,UACE,IAAI,OAAO,UACP,8BACC,KAAe,WAAW;AAAA,QAAA;AAAA,MAEnC;AAAA,IACF,UAAA;AACE,UAAI,WAAW,YAAY,IAAK,YAAW,UAAU;AACrD,UAAI,CAAC,SAAS;AACZ,uBAAe,IAAI;AACnB,mBAAW,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,EACF,GAAG,CAAA,CAAE;AAGL,YAAU,MAAM;AACd,QAAI,CAAC,KAAM,eAAc,MAAM;AAAA,EACjC,GAAG,CAAC,MAAM,aAAa,CAAC;AACxB,YAAU,MAAM,MAAM,cAAc,MAAM,GAAG,CAAC,aAAa,CAAC;AAE5D,QAAM,YAAY;AAAA,IAChB,OAAO,UAAkB;AACvB,UAAI,CAAC,WAAW,UAAU,QAAQ,SAAS,YAAa;AACxD,YAAM,OAAO;AACb,iBAAW,EAAE,GAAG,SAAS,OAAO;AAChC,qBAAe,IAAI;AACnB,YAAM,SAAS,MAAM,gBAAgB,KAAK;AAC1C,qBAAe,KAAK;AACpB,iBAAW,UAAU,IAAI;AAAA,IAC3B;AAAA,IACA,CAAC,SAAS,WAAW;AAAA,EAAA;AAOvB,SACE,qBAAC,OAAA,EAAI,WAAU,mBAAkB,KAAK,SACpC,UAAA;AAAA,IAAA;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,MAAK;AAAA,QACL,WAAU;AAAA,QACV,cAAY,eAAe,oCAAoC;AAAA,QAC/D,OAAO,eAAe,EAAE,UAAU,eAAe;AAAA,QACjD,iBAAe;AAAA,QACf,SAAS,MAAM,QAAQ,CAAA,MAAK,CAAC,CAAC;AAAA,QAE9B,UAAA;AAAA,UAAA,oBAAC,cAAA,EAAa;AAAA,UACb,oCACE,QAAA,EAAK,WAAU,4BAA2B,OAAO,aAAa,eAAY,OAAA,CAAO;AAAA,QAAA;AAAA,MAAA;AAAA,IAAA;AAAA,IAIrF,4BAAS,OAAA,EAAI,WAAU,4BAA2B,SAAS,MAAM,QAAQ,KAAK,GAAG;AAAA,IAEjF,6BACE,OAAA,EAAI,WAAU,0BAAyB,MAAK,UAAS,cAAW,iBAC/D,UAAA;AAAA,MAAA,oBAAC,OAAA,EAAI,WAAU,2BAA0B,UAAA,YAAQ;AAAA,MAMjD,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,eAAW;AAAA,QACnD,YACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,IAAA,CAAC,IAE1C,oBAAC,QAAA,EAAK,WAAW,gDAAgD,QAAQ,IACtE,UAAA,WAAW,QAAQ,EAAA,CACtB;AAAA,MAAA,GAEJ;AAAA,MAGA,qBAAC,WAAA,EAAQ,WAAU,wBACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,gBAAY;AAAA,QACpD,YACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,IAAA,CAAC,IACxC,cACF,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,WAAU;AAAA,cACV,OAAO;AAAA,cACP,WAAW;AAAA,cACX,WAAS;AAAA,cACT,UAAU;AAAA,cACV,UAAU,CAAA,MAAK,aAAa,EAAE,OAAO,KAAK;AAAA,cAC1C,WAAW,CAAA,MAAK;AACd,oBAAI,EAAE,QAAQ,SAAS;AACrB,2BAAA,EAAW,MAAM,SAAS;AAAA,gBAC5B;AACA,oBAAI,EAAE,QAAQ,UAAU;AAEtB,oBAAE,gBAAA;AACF,iCAAe,KAAK;AACpB,+BAAa,eAAe,EAAE;AAAA,gBAChC;AAAA,cACF;AAAA,YAAA;AAAA,UAAA;AAAA,UAEF;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,UAAU;AAAA,cACV,SAAS,MAAM;AACb,yBAAA,EAAW,MAAM,SAAS;AAAA,cAC5B;AAAA,cAEC,uBAAa,MAAM;AAAA,YAAA;AAAA,UAAA;AAAA,QACtB,EAAA,CACF,IAEA;AAAA,UAAC;AAAA,UAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,cAAW;AAAA,YACX,SAAS,MAAM;AACb,2BAAa,eAAe,EAAE;AAC9B,6BAAe,IAAI;AAAA,YACrB;AAAA,YAEC,UAAA,eAAe;AAAA,UAAA;AAAA,QAAA;AAAA,MAClB,GAEJ;AAAA,MAMC,CAAC,aAAa,mBACb,qBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAA,oBAAC,QAAA,EAAK,WAAU,0BAAyB,UAAA,sBAAkB;AAAA,QAC1D,UACC,qBAAA,UAAA,EACE,UAAA;AAAA,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,WAAU;AAAA,cACV,MAAK;AAAA,cACL,cAAW;AAAA,cAEV,UAAA,MAAM,KAAK,EAAE,QAAQ,QAAQ,SAAA,GAAY,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,IAAI,CAAA,QAC7D;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBAEC,MAAK;AAAA,kBACL,MAAK;AAAA,kBACL,gBAAc,QAAQ,QAAQ;AAAA,kBAC9B,cAAY,SAAS,GAAG;AAAA,kBACxB,WAAW,uBACT,OAAO,QAAQ,QAAQ,kCAAkC,EAC3D;AAAA,kBACA,UAAU;AAAA,kBACV,SAAS,MAAM;AACb,8BAAU,GAAG,EAAE,MAAM,SAAS;AAAA,kBAChC;AAAA,kBAEC,UAAA;AAAA,gBAAA;AAAA,gBAbI;AAAA,cAAA,CAeR;AAAA,YAAA;AAAA,UAAA;AAAA,UAEH,oBAAC,QAAA,EAAK,WAAU,yBAAwB,UAAA,sFAAA,CAGxC;AAAA,QAAA,GACF;AAAA;AAAA;AAAA,UAIA,oBAAC,QAAA,EAAK,WAAU,yBAAwB,UAAA,yBAAA,CAAsB;AAAA;AAAA,MAAA,GAElE;AAAA,MAOD,cACC,oBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAC;AAAA,QAAA;AAAA,UACC,WAAU;AAAA,UACV,UAAU,CAAA,MAAK;AACb,cAAE,eAAA;AACF,sBAAA,EAAY,MAAM,SAAS;AAAA,UAC7B;AAAA,UAEA,UAAA;AAAA,YAAA;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,MAAK;AAAA,gBACL,cAAa;AAAA,gBACb,OAAM;AAAA,gBACN,UAAQ;AAAA,gBACR,QAAM;AAAA,cAAA;AAAA,YAAA;AAAA,gCAEP,SAAA,EAAM,WAAU,0BAAyB,SAAQ,uBAAsB,UAAA,cAExE;AAAA,YACA,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,cAAA;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBACC,IAAG;AAAA,kBACH,WAAU;AAAA,kBACV,MAAK;AAAA,kBACL,MAAK;AAAA,kBACL,cAAa;AAAA,kBACb,gBAAe;AAAA,kBACf,YAAY;AAAA,kBACZ,WAAS;AAAA,kBACT,OAAO;AAAA,kBACP,UAAU;AAAA,kBACV,gBAAc,aAAa;AAAA,kBAC3B,oBAAkB,WAAW,8BAA8B;AAAA,kBAC3D,UAAU,CAAA,MAAK,YAAY,EAAE,OAAO,KAAK;AAAA,gBAAA;AAAA,cAAA;AAAA,cAE3C;AAAA,gBAAC;AAAA,gBAAA;AAAA,kBACC,MAAK;AAAA,kBACL,WAAU;AAAA,kBACV,UAAU;AAAA,kBAET,oBAAU,gBAAgB;AAAA,gBAAA;AAAA,cAAA;AAAA,YAC7B,GACF;AAAA,YACC,kBAAA,KACC,oBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,UAAU;AAAA,gBACV,SAAS,MAAM;AACb,oCAAA,EAAoB,MAAM,SAAS;AAAA,gBACrC;AAAA,gBAEC,UAAA,gBAAgB,WAAW,yBAAyB;AAAA,cAAA;AAAA,YAAA,GAEzD;AAAA,YAID,gBAAgB,YACf,oBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,SAAS,MAAM,cAAA;AAAA,gBAChB,UAAA;AAAA,cAAA;AAAA,YAAA,GAGH;AAAA,YAED,YACC;AAAA,cAAC;AAAA,cAAA;AAAA,gBACC,IAAG;AAAA,gBACH,WAAU;AAAA,gBACV,MAAK;AAAA,gBAEJ,UAAA;AAAA,cAAA;AAAA,YAAA;AAAA,UACH;AAAA,QAAA;AAAA,MAAA,EAEJ,CACF,IAEA,qBAAC,WAAA,EAAQ,WAAU,oDACjB,UAAA;AAAA,QAAA,qBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAA,oBAAC,QAAA,EAAK,WAAU,uDAAsD,UAAA,cAEtE;AAAA,UAEC,CAAC,aAAa,aAAa,YAAY,uBACtC;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAW,uBAAuB,eAAe,mCAAmC,EAAE;AAAA,cACtF,UAAU,gBAAgB,QAAQ;AAAA,cAClC,SAAS,MAAM;AACb,4BAAA,EAAc,MAAM,SAAS;AAAA,cAC/B;AAAA,cAEC,UAAA,eACG,kBACA,gBAAgB,SACd,YACA;AAAA,YAAA;AAAA,UAAA;AAAA,UAGV;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,UAAU,gBAAgB;AAAA,cAC1B,SAAS;AAAA,cACV,UAAA;AAAA,YAAA;AAAA,UAAA;AAAA,QAED,GACF;AAAA,QAEC,gBAAgB,UACf,oBAAC,QAAA,EAAK,WAAU,2BACd,UAAA;AAAA,UAAC;AAAA,UAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM,cAAA;AAAA,YAChB,UAAA;AAAA,UAAA;AAAA,QAAA,GAGH;AAAA,QAED,gBACC,oBAAC,QAAA,EAAK,WAAU,0BAAyB,MAAK,SAC3C,UAAA,aAAA,CACH;AAAA,MAAA,GAEJ;AAAA,MAID,YACC,oBAAC,WAAA,EAAQ,WAAU,yEAChB,SAAA,CACH;AAAA,IAAA,EAAA,CAEJ;AAAA,EAAA,GAEJ;AAEJ;"}

package/dist/lib/settingsClient.d.ts

@@ -118,6 +118,8 @@ export interface SettingsSnapshot {
     identity: Identity;
     /** null = public caller (no pill) or the request failed. */
     content: ContentLevelState | null;
+    /** Passkeys that sign this person in; null = unknown (older edge, host-supplied identity). */
+    passkeys: number | null;
 }
 /** Identity the host already knows, so we don't ask the server for it again. */
 export interface SettingsPrefetchHints {

package/dist/lib/settingsClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settingsClient.d.ts","sourceRoot":"","sources":["../../src/lib/settingsClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAmDH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAYzE;AAED;uEACuE;AACvE,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAgBtF;AAED;gFACgF;AAChF,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;AAErE,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,IAAI,CAAA;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAyBD;;;;GAIG;AACH,wBAAsB,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAShD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;uEACuE;AACvE,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAyB3D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd;4CACwC;IACxC,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9E,sFAAsF;IACtF,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChG;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAuB/D;AAED,wBAAgB,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnD;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAM1D;AAMD,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAA;IAClB,4DAA4D;IAC5D,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAClC;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,IAAI,CAAA;IACf,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,qBAA0B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAG7F"}
+{"version":3,"file":"settingsClient.d.ts","sourceRoot":"","sources":["../../src/lib/settingsClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAuDH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAYzE;AAED;uEACuE;AACvE,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAgBtF;AAED;gFACgF;AAChF,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;AAErE,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,IAAI,CAAA;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAyBD;;;;GAIG;AACH,wBAAsB,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAShD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;uEACuE;AACvE,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAyB3D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd;4CACwC;IACxC,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9E,sFAAsF;IACtF,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChG;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAuB/D;AAED,wBAAgB,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnD;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAM1D;AAMD,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAA;IAClB,4DAA4D;IAC5D,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACjC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,IAAI,CAAA;IACf,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,qBAA0B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAG7F"}

package/dist/lib/settingsClient.js

@@ -116,14 +116,21 @@ async function resolveSettings(hints) {
   const selfResolving = hints.userType === void 0 && typeof window !== "undefined";
   const bodyPromise = selfResolving ? sharedWhoami() : Promise.resolve(null);
   const identityPromise = hints.userType !== void 0 ? Promise.resolve({ userType: hints.userType, name: hints.name ?? null }) : whoami();
-  const contentPromise = bodyPromise.then((body) => {
-    const carried = contentFromWhoami(body);
+  const contentPromise = bodyPromise.then((body2) => {
+    const carried = contentFromWhoami(body2);
     if (carried) return carried;
     if (looksSignedIn(hints.userType)) return getContentLevel();
     return identityPromise.then((id) => id.userType === "public" ? null : getContentLevel());
   });
-  const [identity, content] = await Promise.all([identityPromise, contentPromise]);
-  return { identity, content };
+  const [identity, content, body] = await Promise.all([
+    identityPromise,
+    contentPromise,
+    bodyPromise
+  ]);
+  return { identity, content, passkeys: passkeysFromWhoami(body) };
+}
+function passkeysFromWhoami(body) {
+  return body?.valid && typeof body.passkeys === "number" ? body.passkeys : null;
 }
 function contentFromWhoami(body) {
   if (!body?.valid) return null;

package/dist/lib/settingsClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"settingsClient.js","sources":["../../src/lib/settingsClient.ts"],"sourcesContent":["/**\n * Client for the unified user-settings modal (ConnectedSettings).\n *\n * Two concerns, both cookie-authed against the hadoku.me edge-router, which\n * resolves the `hadoku_session` cookie / `X-Session-Id` header → X-User-Key +\n * X-User-Id for the backend:\n *   - display name  → POST /session/name                   (edge-router, self rename)\n *   - content level → GET/PUT /prefs/api/v1/content-level  (prefs-api)\n *\n * Switching keys goes through the SITE's sign-in client, never a call of ours:\n * see `loadSignIn()`, with `switchKeyHref()` as the fallback.\n *\n * These are same-origin relative paths, so ConnectedSettings is portable to any\n * app served under hadoku.me with zero wiring. Off-origin (e.g. a Storybook or\n * a non-hadoku host) every call resolves to null and the UI degrades to a\n * read-only shell — it never throws.\n *\n * The raw key is never held in the browser (the auth page deliberately drops\n * it), so name + content-level changes go through session identity, not a key\n * header, and no app ever asks for a key at all.\n *\n * WHEN THESE RUN\n * --------------\n * Everything the popout displays is resolved at PAGE LOAD, not on gear-click —\n * see `prefetchSettings()`. Opening settings must cost zero requests. Pinned by\n * `e2e/settings-prefetch.spec.ts` in hadoku-task.\n */\n\n/** Edge-router / prefs-api endpoints (same-origin relative). */\nconst CONTENT_LEVEL_PATH = '/prefs/api/v1/content-level'\nconst SESSION_NAME = '/session/name'\nconst SESSION_WHOAMI = '/session/whoami'\n\n/**\n * The ecosystem's shared boot-whoami promise. hadoku_site's `mf-loader.js`\n * kicks `GET /session/whoami` in parallel with the micro-frontend's module\n * import and parks the promise here precisely so the app it loads doesn't\n * resolve identity a second time; @wolffm/prefs-client already consumes it\n * under the same name. Reading it is what makes settings' identity free.\n *\n * Absent outside that shell (standalone vite, Capacitor, Storybook) — there we\n * fetch, and publish the result under the same key so the next reader is free\n * too.\n */\nconst WHOAMI_GLOBAL = '__hadokuWhoami'\n\n/**\n * Raw whoami body, as both mf-loader and this module see it off the wire.\n *\n * `contentLevel` / `maxContentLevel` are OPTIONAL because the shape is\n * versioned by whatever edge-router is deployed, not by this bundle. They\n * arrive from edge-router ≥ the 2026-08-07 change, which reports the level\n * `authGate` had already resolved to stamp X-Hadoku-Content-Level. When they\n * are absent we fall back to the standalone GET — see resolveSettings.\n */\ninterface WhoamiBody {\n  valid?: boolean\n  userType?: Tier\n  name?: string | null\n  contentLevel?: number\n  maxContentLevel?: number\n}\n\n// Hard timeout on every settings request. Without it, a request throttled by\n// the browser (e.g. the tab going to the background) leaves the caller's\n// \"saving\" flag stuck true — which disabled the content-level pills until the\n// tab regained focus. AbortSignal.timeout guarantees the promise settles.\nconst REQUEST_TIMEOUT_MS = 8000\n\n/** Session-id header the same way whoami() sends it (cookie is the fallback). */\nfunction sessionHeaders(extra?: Record<string, string>): Record<string, string> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json', ...extra }\n  const sid = typeof window !== 'undefined' ? localStorage.getItem('hadoku_session_id') : null\n  if (sid) headers['X-Session-Id'] = sid\n  return headers\n}\n\nexport interface ContentLevelState {\n  /** Current global content-visibility level (1 = safest default). */\n  level: number\n  /** Highest level this caller's tier may select (friend=3, admin=4). */\n  maxLevel: number\n}\n\n/** GET the caller's current content level + tier ceiling. null on error. */\nexport async function getContentLevel(): Promise<ContentLevelState | null> {\n  try {\n    const res = await fetch(CONTENT_LEVEL_PATH, {\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    return (await res.json()) as ContentLevelState\n  } catch {\n    return null\n  }\n}\n\n/** PUT a new content level. Server clamps to the tier ceiling → 400 if out of\n *  range. Returns the stored state on success, null on any failure. */\nexport async function setContentLevel(level: number): Promise<ContentLevelState | null> {\n  try {\n    const res = await fetch(CONTENT_LEVEL_PATH, {\n      method: 'PUT',\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      body: JSON.stringify({ level }),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    const stored = (await res.json()) as ContentLevelState\n    patchSnapshot(prev => ({ ...prev, content: stored }))\n    return stored\n  } catch {\n    return null\n  }\n}\n\n/** POST a new display name for the signed-in user. Returns the stored name\n *  (may differ from the request for wp-* protected keys) or null on failure. */\nexport async function setDisplayName(name: string): Promise<string | null> {\n  try {\n    const res = await fetch(SESSION_NAME, {\n      method: 'POST',\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      body: JSON.stringify({ name }),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    const body = (await res.json()) as { ok: boolean; name: string | null }\n    patchSnapshot(prev => ({ ...prev, identity: { ...prev.identity, name: body.name } }))\n    return body.name\n  } catch {\n    return null\n  }\n}\n\n/**\n * The hadoku tier ladder, LOW to HIGH: `public < friend < service < wife < admin`.\n * Mirrors TIER_RANK in @wolffm/worker-utils, which this browser bundle cannot\n * import (it would pull hono into the client). A tier missing here does not\n * error — it fails the union and, worse, drops out of every `Record<Tier, …>`\n * lookup, so the caller renders as if unrecognised. Keep it complete.\n */\nexport type Tier = 'public' | 'friend' | 'service' | 'wife' | 'admin'\n\nexport interface Identity {\n  userType: Tier\n  name: string | null\n}\n\n/**\n * The page's one whoami body, resolved at most once no matter how many callers.\n *\n * Under the hadoku.me shell this costs NO request: mf-loader kicks whoami in\n * parallel with the micro-frontend's module import and parks the promise on\n * WHOAMI_GLOBAL for exactly this reason (@wolffm/prefs-client reads the same\n * key). Elsewhere — standalone vite, Capacitor, Storybook — we fetch once and\n * publish under the same key so the next reader is free too.\n *\n * Resolves to null rather than throwing on any failure.\n */\nfunction sharedWhoami(): Promise<WhoamiBody | null> {\n  const g = globalThis as { [WHOAMI_GLOBAL]?: Promise<WhoamiBody | null> }\n  g[WHOAMI_GLOBAL] ??= fetch(SESSION_WHOAMI, {\n    credentials: 'same-origin',\n    headers: sessionHeaders(),\n    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n  })\n    .then(res => (res.ok ? (res.json() as Promise<WhoamiBody>) : null))\n    .catch(() => null)\n  return g[WHOAMI_GLOBAL]\n}\n\n/**\n * Resolve the signed-in caller's tier + display name from the edge-router.\n * Returns { userType: 'public', name: null } for anonymous / off-origin / any\n * failure — never throws, so ConnectedSettings can render unconditionally.\n */\nexport async function whoami(): Promise<Identity> {\n  if (typeof window === 'undefined') return { userType: 'public', name: null }\n  try {\n    const body = await sharedWhoami()\n    if (!body?.valid) return { userType: 'public', name: null }\n    return { userType: body.userType ?? 'public', name: body.name ?? null }\n  } catch {\n    return { userType: 'public', name: null }\n  }\n}\n\n/**\n * Where a \"Switch key\" control sends the user when the inline sign-in client\n * (`loadSignIn()`) can't be loaded: the site's sign-in page, which brings them\n * back here afterwards.\n *\n * A browser session is created ONLY by /auth (hadoku_site, 2026-10-25): every\n * render of that page carries an edge-signed funnel token and the device\n * fingerprint, and /session/create alerts on — and will refuse — a sign-in\n * without them. So an app never posts a key itself.\n *\n * `switch=1` stops /auth from sending an already signed-in visitor straight\n * back, which would make switching impossible. `return` is this page's path,\n * query and hash; /auth redirects there with the new session cookie, and the\n * shell's mf-loader resyncs the localStorage mirror (hadoku_session_id /\n * hadoku_user_type) from /session/whoami on that load, so nothing here writes it.\n */\nexport function switchKeyHref(): string {\n  return (\n    '/auth?switch=1&return=' +\n    encodeURIComponent(window.location.pathname + window.location.search + window.location.hash)\n  )\n}\n\n/** What the site's sign-in client resolves to on success. */\nexport interface SignInResult {\n  valid: boolean\n  userType?: string\n  sessionId?: string\n}\n\n/** `signIn` from hadoku.me's `/auth/sign-in.js`. Resolves on success; throws an\n *  `Error` carrying the server's message on a refused or empty key. */\nexport type SignIn = (key: string) => Promise<SignInResult>\n\n/**\n * The site serves its sign-in page's own client as a module, so an app can sign\n * in INLINE on the same code path as /auth: a fresh funnel token per call, the\n * device fingerprint, and the `/session/create` post that sets the cookie (and\n * writes the hadoku_session_id / hadoku_user_type mirror). This package never\n * posts /session/create itself — a direct post would skip the fingerprint and\n * read as off-funnel — and it does not vendor a copy.\n *\n * The specifier is a VARIABLE on purpose. A literal `import('/auth/sign-in.js')`\n * would have every bundler that re-bundles this package (hadoku_site's build\n * among them) try to resolve the path at build time; this one is only ever\n * resolved by the browser, against whatever origin the page is on. For the\n * same reason it is typed here (`SignIn`) rather than by an ambient module\n * declaration, which only a literal specifier would pick up.\n *\n * The module starts collecting the fingerprint as soon as it evaluates, so call\n * this when a sign-in form OPENS, not when it submits. Memoised; resolves to\n * null when the module can't be loaded (a dev server that isn't hadoku.me),\n * which is the caller's cue to fall back to `switchKeyHref()`.\n */\nconst SIGN_IN_MODULE = '/auth/sign-in.js'\nlet signInModule: Promise<SignInClient | null> | null = null\n\n/**\n * The whole sign-in client. The passkey half is optional: a site build from\n * before it exports only `signIn`, and the passkey controls then fall back to\n * the /auth page (`passkeyHref()`), as a missing module does.\n */\nexport interface SignInClient {\n  signIn: SignIn\n  /** Like `signIn`, with a passkey in place of the key. Throws Error(message).\n   *  `signal` cancels the open prompt. */\n  signInWithPasskey?: (opts?: { signal?: AbortSignal }) => Promise<SignInResult>\n  /** Saves a passkey for the signed-in person on this device. Throws Error(message). */\n  addPasskey?: (opts?: { signal?: AbortSignal }) => Promise<{ saved: boolean; passkeys: number }>\n}\n\nexport function loadSignInClient(): Promise<SignInClient | null> {\n  signInModule ??= import(/* @vite-ignore */ SIGN_IN_MODULE).then(\n    (m: Partial<Record<keyof SignInClient, unknown>>) =>\n      typeof m.signIn === 'function'\n        ? {\n            signIn: m.signIn as SignIn,\n            signInWithPasskey:\n              typeof m.signInWithPasskey === 'function'\n                ? (m.signInWithPasskey as SignInClient['signInWithPasskey'])\n                : undefined,\n            addPasskey:\n              typeof m.addPasskey === 'function'\n                ? (m.addPasskey as SignInClient['addPasskey'])\n                : undefined\n          }\n        : null,\n    () => {\n      // Let a later open retry: a failed fetch is not cached by the browser.\n      signInModule = null\n      return null\n    }\n  )\n  return signInModule\n}\n\nexport function loadSignIn(): Promise<SignIn | null> {\n  return loadSignInClient().then(c => c?.signIn ?? null)\n}\n\n/** Whether this browser can use a passkey at all (WebAuthn present). */\nexport function passkeysSupported(): boolean {\n  return typeof window !== 'undefined' && 'PublicKeyCredential' in window\n}\n\n/**\n * The /auth page's passkey flows, for when the sign-in client can't be\n * loaded: `add` saves one for the signed-in visitor, `signin` is the page with\n * its passkey button. Both come back here afterwards.\n */\nexport function passkeyHref(mode: 'add' | 'signin'): string {\n  if (mode === 'signin') return switchKeyHref()\n  return (\n    '/auth?passkey=add&return=' +\n    encodeURIComponent(window.location.pathname + window.location.search + window.location.hash)\n  )\n}\n\n/* ------------------------------------------------------------------ *\n * Prefetch\n * ------------------------------------------------------------------ */\n\n/** Everything the settings popout displays, resolved together. */\nexport interface SettingsSnapshot {\n  identity: Identity\n  /** null = public caller (no pill) or the request failed. */\n  content: ContentLevelState | null\n}\n\n/** Identity the host already knows, so we don't ask the server for it again. */\nexport interface SettingsPrefetchHints {\n  /** Caller's tier. When supplied, whoami is skipped entirely. */\n  userType?: Tier\n  /** Caller's display name. Only meaningful alongside `userType`. */\n  name?: string | null\n}\n\nlet snapshot: Promise<SettingsSnapshot> | null = null\n\n/**\n * Resolve — once per page load — everything the settings popout shows.\n *\n * This is THE entry point, and it is called from ConnectedSettings' MOUNT, not\n * from its open handler. Settings data is user identity: it is known at boot,\n * it doesn't change while the page is up, and making the gear the trigger left\n * the panel on screen but blank for a round trip (measured on prod: whoami\n * 167ms and content-level 186ms, issued concurrently). It now rides along with\n * the app's own boot traffic and the click costs nothing.\n *\n * Idempotent and shared: every caller after the first gets the same promise, so\n * N mounted consumers still produce at most one whoami for the whole page.\n * Mutations below write through to it rather than invalidating, so a remount\n * never shows a value the user just changed.\n *\n * Against a current edge-router this issues NO requests of its own at all — the\n * level rides on the whoami the shell already had in flight. See\n * resolveSettings for the fallback when it doesn't.\n */\nexport function prefetchSettings(hints: SettingsPrefetchHints = {}): Promise<SettingsSnapshot> {\n  snapshot ??= resolveSettings(hints)\n  return snapshot\n}\n\nasync function resolveSettings(hints: SettingsPrefetchHints): Promise<SettingsSnapshot> {\n  // The whoami body, not just the adapted identity — edge-router carries the\n  // content level on it (see below), and reading the raw body is how we get at\n  // it without a second request.\n  //\n  // Skipped entirely when the host supplied identity: that prop exists for apps\n  // that CANNOT reach /session/whoami (conjure sits behind a path-prefixed shim\n  // where it 404s), so asking anyway would spend a request to learn nothing.\n  const selfResolving = hints.userType === undefined && typeof window !== 'undefined'\n  const bodyPromise = selfResolving ? sharedWhoami() : Promise.resolve(null)\n\n  const identityPromise: Promise<Identity> =\n    hints.userType !== undefined\n      ? Promise.resolve({ userType: hints.userType, name: hints.name ?? null })\n      : whoami()\n\n  // PREFERRED PATH: take the level straight off whoami.\n  //\n  // edge-router's authGate has already resolved it (registry key → userId →\n  // prefs D1) to stamp X-Hadoku-Content-Level, so reporting it on whoami costs\n  // it nothing — and it saves us a proxied round trip to prefs-api that\n  // measured 132-420ms against prod. Better still, whoami is in flight before\n  // this bundle has even loaded, so the value is here the moment we ask.\n  //\n  // FALLBACK: the standalone GET, for any edge-router older than the\n  // 2026-08-07 change, and for callers not behind it at all (Capacitor,\n  // Storybook, a non-hadoku host). Gated on identity because the pill is\n  // hidden for public callers — fetching an anonymous visitor's level is a\n  // guaranteed-wasted request on every page view. `hadoku_user_type` is\n  // written by the loader before anything mounts, so where it already says\n  // \"signed in\" the fallback goes out concurrently rather than behind whoami.\n  const contentPromise = bodyPromise.then(body => {\n    const carried = contentFromWhoami(body)\n    if (carried) return carried\n    if (looksSignedIn(hints.userType)) return getContentLevel()\n    return identityPromise.then(id => (id.userType === 'public' ? null : getContentLevel()))\n  })\n\n  const [identity, content] = await Promise.all([identityPromise, contentPromise])\n  return { identity, content }\n}\n\n/**\n * Adapt the content level off a whoami body, or null if that edge-router\n * doesn't report it.\n *\n * Both fields are required, and both must be numbers: a body carrying a level\n * without its ceiling would render a pill with zero segments — worse than the\n * fallback fetch, because it looks like a working control that offers nothing.\n */\nfunction contentFromWhoami(body: WhoamiBody | null): ContentLevelState | null {\n  if (!body?.valid) return null\n  const { contentLevel, maxContentLevel } = body\n  if (typeof contentLevel !== 'number' || typeof maxContentLevel !== 'number') return null\n  if (maxContentLevel < 1) return null\n  return { level: contentLevel, maxLevel: maxContentLevel }\n}\n\n/** Best-effort \"is this caller signed in?\" from state available synchronously. */\nfunction looksSignedIn(hinted?: Tier): boolean {\n  if (hinted !== undefined) return hinted !== 'public'\n  if (typeof window === 'undefined') return false\n  const cached = localStorage.getItem('hadoku_user_type')\n  return cached !== null && cached !== 'public'\n}\n\n/** Keep the prefetched snapshot in step with a successful mutation. */\nfunction patchSnapshot(patch: (prev: SettingsSnapshot) => SettingsSnapshot) {\n  if (!snapshot) return\n  snapshot = snapshot.then(patch)\n}\n"],"names":[],"mappings":"AA6BA,MAAM,qBAAqB;AAC3B,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAavB,MAAM,gBAAgB;AAuBtB,MAAM,qBAAqB;AAG3B,SAAS,eAAe,OAAwD;AAC9E,QAAM,UAAkC,EAAE,gBAAgB,oBAAoB,GAAG,MAAA;AACjF,QAAM,MAAM,OAAO,WAAW,cAAc,aAAa,QAAQ,mBAAmB,IAAI;AACxF,MAAI,IAAK,SAAQ,cAAc,IAAI;AACnC,SAAO;AACT;AAUA,eAAsB,kBAAqD;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB;AAAA,MAC1C,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAA;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,gBAAgB,OAAkD;AACtF,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB;AAAA,MAC1C,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,OAAO;AAAA,MAC9B,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,SAAU,MAAM,IAAI,KAAA;AAC1B,kBAAc,WAAS,EAAE,GAAG,MAAM,SAAS,SAAS;AACpD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,eAAe,MAAsC;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,cAAc;AAAA,MACpC,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,MAAM;AAAA,MAC7B,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAA;AACxB,kBAAc,CAAA,UAAS,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,KAAK,UAAU,MAAM,KAAK,KAAA,IAAS;AACpF,WAAO,KAAK;AAAA,EACd,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA2BA,SAAS,eAA2C;AAClD,QAAM,IAAI;AACV,IAAE,aAAa,MAAM,MAAM,gBAAgB;AAAA,IACzC,aAAa;AAAA,IACb,SAAS,eAAA;AAAA,IACT,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,EAAA,CAC/C,EACE,KAAK,CAAA,QAAQ,IAAI,KAAM,IAAI,KAAA,IAAiC,IAAK,EACjE,MAAM,MAAM,IAAI;AACnB,SAAO,EAAE,aAAa;AACxB;AAOA,eAAsB,SAA4B;AAChD,MAAI,OAAO,WAAW,YAAa,QAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AACtE,MAAI;AACF,UAAM,OAAO,MAAM,aAAA;AACnB,QAAI,CAAC,MAAM,MAAO,QAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AACrD,WAAO,EAAE,UAAU,KAAK,YAAY,UAAU,MAAM,KAAK,QAAQ,KAAA;AAAA,EACnE,QAAQ;AACN,WAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AAAA,EACrC;AACF;AAkBO,SAAS,gBAAwB;AACtC,SACE,2BACA,mBAAmB,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,IAAI;AAE/F;AAiCA,MAAM,iBAAiB;AACvB,IAAI,eAAoD;AAgBjD,SAAS,mBAAiD;AAC/D,mBAAiB;AAAA;AAAA,IAA0B;AAAA,IAAgB;AAAA,IACzD,CAAC,MACC,OAAO,EAAE,WAAW,aAChB;AAAA,MACE,QAAQ,EAAE;AAAA,MACV,mBACE,OAAO,EAAE,sBAAsB,aAC1B,EAAE,oBACH;AAAA,MACN,YACE,OAAO,EAAE,eAAe,aACnB,EAAE,aACH;AAAA,IAAA,IAER;AAAA,IACN,MAAM;AAEJ,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EAAA;AAEF,SAAO;AACT;AAEO,SAAS,aAAqC;AACnD,SAAO,mBAAmB,KAAK,CAAA,MAAK,GAAG,UAAU,IAAI;AACvD;AAGO,SAAS,oBAA6B;AAC3C,SAAO,OAAO,WAAW,eAAe,yBAAyB;AACnE;AAOO,SAAS,YAAY,MAAgC;AAC1D,MAAI,SAAS,SAAU,QAAO,cAAA;AAC9B,SACE,8BACA,mBAAmB,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,IAAI;AAE/F;AAqBA,IAAI,WAA6C;AAqB1C,SAAS,iBAAiB,QAA+B,IAA+B;AAC7F,eAAa,gBAAgB,KAAK;AAClC,SAAO;AACT;AAEA,eAAe,gBAAgB,OAAyD;AAQtF,QAAM,gBAAgB,MAAM,aAAa,UAAa,OAAO,WAAW;AACxE,QAAM,cAAc,gBAAgB,aAAA,IAAiB,QAAQ,QAAQ,IAAI;AAEzE,QAAM,kBACJ,MAAM,aAAa,SACf,QAAQ,QAAQ,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,QAAQ,KAAA,CAAM,IACtE,OAAA;AAiBN,QAAM,iBAAiB,YAAY,KAAK,CAAA,SAAQ;AAC9C,UAAM,UAAU,kBAAkB,IAAI;AACtC,QAAI,QAAS,QAAO;AACpB,QAAI,cAAc,MAAM,QAAQ,UAAU,gBAAA;AAC1C,WAAO,gBAAgB,KAAK,CAAA,OAAO,GAAG,aAAa,WAAW,OAAO,iBAAkB;AAAA,EACzF,CAAC;AAED,QAAM,CAAC,UAAU,OAAO,IAAI,MAAM,QAAQ,IAAI,CAAC,iBAAiB,cAAc,CAAC;AAC/E,SAAO,EAAE,UAAU,QAAA;AACrB;AAUA,SAAS,kBAAkB,MAAmD;AAC5E,MAAI,CAAC,MAAM,MAAO,QAAO;AACzB,QAAM,EAAE,cAAc,gBAAA,IAAoB;AAC1C,MAAI,OAAO,iBAAiB,YAAY,OAAO,oBAAoB,SAAU,QAAO;AACpF,MAAI,kBAAkB,EAAG,QAAO;AAChC,SAAO,EAAE,OAAO,cAAc,UAAU,gBAAA;AAC1C;AAGA,SAAS,cAAc,QAAwB;AAC7C,MAAI,WAAW,OAAW,QAAO,WAAW;AAC5C,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,SAAS,aAAa,QAAQ,kBAAkB;AACtD,SAAO,WAAW,QAAQ,WAAW;AACvC;AAGA,SAAS,cAAc,OAAqD;AAC1E,MAAI,CAAC,SAAU;AACf,aAAW,SAAS,KAAK,KAAK;AAChC;"}
+{"version":3,"file":"settingsClient.js","sources":["../../src/lib/settingsClient.ts"],"sourcesContent":["/**\n * Client for the unified user-settings modal (ConnectedSettings).\n *\n * Two concerns, both cookie-authed against the hadoku.me edge-router, which\n * resolves the `hadoku_session` cookie / `X-Session-Id` header → X-User-Key +\n * X-User-Id for the backend:\n *   - display name  → POST /session/name                   (edge-router, self rename)\n *   - content level → GET/PUT /prefs/api/v1/content-level  (prefs-api)\n *\n * Switching keys goes through the SITE's sign-in client, never a call of ours:\n * see `loadSignIn()`, with `switchKeyHref()` as the fallback.\n *\n * These are same-origin relative paths, so ConnectedSettings is portable to any\n * app served under hadoku.me with zero wiring. Off-origin (e.g. a Storybook or\n * a non-hadoku host) every call resolves to null and the UI degrades to a\n * read-only shell — it never throws.\n *\n * The raw key is never held in the browser (the auth page deliberately drops\n * it), so name + content-level changes go through session identity, not a key\n * header, and no app ever asks for a key at all.\n *\n * WHEN THESE RUN\n * --------------\n * Everything the popout displays is resolved at PAGE LOAD, not on gear-click —\n * see `prefetchSettings()`. Opening settings must cost zero requests. Pinned by\n * `e2e/settings-prefetch.spec.ts` in hadoku-task.\n */\n\n/** Edge-router / prefs-api endpoints (same-origin relative). */\nconst CONTENT_LEVEL_PATH = '/prefs/api/v1/content-level'\nconst SESSION_NAME = '/session/name'\nconst SESSION_WHOAMI = '/session/whoami'\n\n/**\n * The ecosystem's shared boot-whoami promise. hadoku_site's `mf-loader.js`\n * kicks `GET /session/whoami` in parallel with the micro-frontend's module\n * import and parks the promise here precisely so the app it loads doesn't\n * resolve identity a second time; @wolffm/prefs-client already consumes it\n * under the same name. Reading it is what makes settings' identity free.\n *\n * Absent outside that shell (standalone vite, Capacitor, Storybook) — there we\n * fetch, and publish the result under the same key so the next reader is free\n * too.\n */\nconst WHOAMI_GLOBAL = '__hadokuWhoami'\n\n/**\n * Raw whoami body, as both mf-loader and this module see it off the wire.\n *\n * `contentLevel` / `maxContentLevel` are OPTIONAL because the shape is\n * versioned by whatever edge-router is deployed, not by this bundle. They\n * arrive from edge-router ≥ the 2026-08-07 change, which reports the level\n * `authGate` had already resolved to stamp X-Hadoku-Content-Level. When they\n * are absent we fall back to the standalone GET — see resolveSettings.\n *\n * `passkeys` (edge-router ≥ 2026-10-28) counts the passkeys that sign this\n * session in. Absent means unknown, never none.\n */\ninterface WhoamiBody {\n  valid?: boolean\n  userType?: Tier\n  name?: string | null\n  contentLevel?: number\n  maxContentLevel?: number\n  passkeys?: number\n}\n\n// Hard timeout on every settings request. Without it, a request throttled by\n// the browser (e.g. the tab going to the background) leaves the caller's\n// \"saving\" flag stuck true — which disabled the content-level pills until the\n// tab regained focus. AbortSignal.timeout guarantees the promise settles.\nconst REQUEST_TIMEOUT_MS = 8000\n\n/** Session-id header the same way whoami() sends it (cookie is the fallback). */\nfunction sessionHeaders(extra?: Record<string, string>): Record<string, string> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json', ...extra }\n  const sid = typeof window !== 'undefined' ? localStorage.getItem('hadoku_session_id') : null\n  if (sid) headers['X-Session-Id'] = sid\n  return headers\n}\n\nexport interface ContentLevelState {\n  /** Current global content-visibility level (1 = safest default). */\n  level: number\n  /** Highest level this caller's tier may select (friend=3, admin=4). */\n  maxLevel: number\n}\n\n/** GET the caller's current content level + tier ceiling. null on error. */\nexport async function getContentLevel(): Promise<ContentLevelState | null> {\n  try {\n    const res = await fetch(CONTENT_LEVEL_PATH, {\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    return (await res.json()) as ContentLevelState\n  } catch {\n    return null\n  }\n}\n\n/** PUT a new content level. Server clamps to the tier ceiling → 400 if out of\n *  range. Returns the stored state on success, null on any failure. */\nexport async function setContentLevel(level: number): Promise<ContentLevelState | null> {\n  try {\n    const res = await fetch(CONTENT_LEVEL_PATH, {\n      method: 'PUT',\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      body: JSON.stringify({ level }),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    const stored = (await res.json()) as ContentLevelState\n    patchSnapshot(prev => ({ ...prev, content: stored }))\n    return stored\n  } catch {\n    return null\n  }\n}\n\n/** POST a new display name for the signed-in user. Returns the stored name\n *  (may differ from the request for wp-* protected keys) or null on failure. */\nexport async function setDisplayName(name: string): Promise<string | null> {\n  try {\n    const res = await fetch(SESSION_NAME, {\n      method: 'POST',\n      credentials: 'same-origin',\n      headers: sessionHeaders(),\n      body: JSON.stringify({ name }),\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n    })\n    if (!res.ok) return null\n    const body = (await res.json()) as { ok: boolean; name: string | null }\n    patchSnapshot(prev => ({ ...prev, identity: { ...prev.identity, name: body.name } }))\n    return body.name\n  } catch {\n    return null\n  }\n}\n\n/**\n * The hadoku tier ladder, LOW to HIGH: `public < friend < service < wife < admin`.\n * Mirrors TIER_RANK in @wolffm/worker-utils, which this browser bundle cannot\n * import (it would pull hono into the client). A tier missing here does not\n * error — it fails the union and, worse, drops out of every `Record<Tier, …>`\n * lookup, so the caller renders as if unrecognised. Keep it complete.\n */\nexport type Tier = 'public' | 'friend' | 'service' | 'wife' | 'admin'\n\nexport interface Identity {\n  userType: Tier\n  name: string | null\n}\n\n/**\n * The page's one whoami body, resolved at most once no matter how many callers.\n *\n * Under the hadoku.me shell this costs NO request: mf-loader kicks whoami in\n * parallel with the micro-frontend's module import and parks the promise on\n * WHOAMI_GLOBAL for exactly this reason (@wolffm/prefs-client reads the same\n * key). Elsewhere — standalone vite, Capacitor, Storybook — we fetch once and\n * publish under the same key so the next reader is free too.\n *\n * Resolves to null rather than throwing on any failure.\n */\nfunction sharedWhoami(): Promise<WhoamiBody | null> {\n  const g = globalThis as { [WHOAMI_GLOBAL]?: Promise<WhoamiBody | null> }\n  g[WHOAMI_GLOBAL] ??= fetch(SESSION_WHOAMI, {\n    credentials: 'same-origin',\n    headers: sessionHeaders(),\n    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)\n  })\n    .then(res => (res.ok ? (res.json() as Promise<WhoamiBody>) : null))\n    .catch(() => null)\n  return g[WHOAMI_GLOBAL]\n}\n\n/**\n * Resolve the signed-in caller's tier + display name from the edge-router.\n * Returns { userType: 'public', name: null } for anonymous / off-origin / any\n * failure — never throws, so ConnectedSettings can render unconditionally.\n */\nexport async function whoami(): Promise<Identity> {\n  if (typeof window === 'undefined') return { userType: 'public', name: null }\n  try {\n    const body = await sharedWhoami()\n    if (!body?.valid) return { userType: 'public', name: null }\n    return { userType: body.userType ?? 'public', name: body.name ?? null }\n  } catch {\n    return { userType: 'public', name: null }\n  }\n}\n\n/**\n * Where a \"Switch key\" control sends the user when the inline sign-in client\n * (`loadSignIn()`) can't be loaded: the site's sign-in page, which brings them\n * back here afterwards.\n *\n * A browser session is created ONLY by /auth (hadoku_site, 2026-10-25): every\n * render of that page carries an edge-signed funnel token and the device\n * fingerprint, and /session/create alerts on — and will refuse — a sign-in\n * without them. So an app never posts a key itself.\n *\n * `switch=1` stops /auth from sending an already signed-in visitor straight\n * back, which would make switching impossible. `return` is this page's path,\n * query and hash; /auth redirects there with the new session cookie, and the\n * shell's mf-loader resyncs the localStorage mirror (hadoku_session_id /\n * hadoku_user_type) from /session/whoami on that load, so nothing here writes it.\n */\nexport function switchKeyHref(): string {\n  return (\n    '/auth?switch=1&return=' +\n    encodeURIComponent(window.location.pathname + window.location.search + window.location.hash)\n  )\n}\n\n/** What the site's sign-in client resolves to on success. */\nexport interface SignInResult {\n  valid: boolean\n  userType?: string\n  sessionId?: string\n}\n\n/** `signIn` from hadoku.me's `/auth/sign-in.js`. Resolves on success; throws an\n *  `Error` carrying the server's message on a refused or empty key. */\nexport type SignIn = (key: string) => Promise<SignInResult>\n\n/**\n * The site serves its sign-in page's own client as a module, so an app can sign\n * in INLINE on the same code path as /auth: a fresh funnel token per call, the\n * device fingerprint, and the `/session/create` post that sets the cookie (and\n * writes the hadoku_session_id / hadoku_user_type mirror). This package never\n * posts /session/create itself — a direct post would skip the fingerprint and\n * read as off-funnel — and it does not vendor a copy.\n *\n * The specifier is a VARIABLE on purpose. A literal `import('/auth/sign-in.js')`\n * would have every bundler that re-bundles this package (hadoku_site's build\n * among them) try to resolve the path at build time; this one is only ever\n * resolved by the browser, against whatever origin the page is on. For the\n * same reason it is typed here (`SignIn`) rather than by an ambient module\n * declaration, which only a literal specifier would pick up.\n *\n * The module starts collecting the fingerprint as soon as it evaluates, so call\n * this when a sign-in form OPENS, not when it submits. Memoised; resolves to\n * null when the module can't be loaded (a dev server that isn't hadoku.me),\n * which is the caller's cue to fall back to `switchKeyHref()`.\n */\nconst SIGN_IN_MODULE = '/auth/sign-in.js'\nlet signInModule: Promise<SignInClient | null> | null = null\n\n/**\n * The whole sign-in client. The passkey half is optional: a site build from\n * before it exports only `signIn`, and the passkey controls then fall back to\n * the /auth page (`passkeyHref()`), as a missing module does.\n */\nexport interface SignInClient {\n  signIn: SignIn\n  /** Like `signIn`, with a passkey in place of the key. Throws Error(message).\n   *  `signal` cancels the open prompt. */\n  signInWithPasskey?: (opts?: { signal?: AbortSignal }) => Promise<SignInResult>\n  /** Saves a passkey for the signed-in person on this device. Throws Error(message). */\n  addPasskey?: (opts?: { signal?: AbortSignal }) => Promise<{ saved: boolean; passkeys: number }>\n}\n\nexport function loadSignInClient(): Promise<SignInClient | null> {\n  signInModule ??= import(/* @vite-ignore */ SIGN_IN_MODULE).then(\n    (m: Partial<Record<keyof SignInClient, unknown>>) =>\n      typeof m.signIn === 'function'\n        ? {\n            signIn: m.signIn as SignIn,\n            signInWithPasskey:\n              typeof m.signInWithPasskey === 'function'\n                ? (m.signInWithPasskey as SignInClient['signInWithPasskey'])\n                : undefined,\n            addPasskey:\n              typeof m.addPasskey === 'function'\n                ? (m.addPasskey as SignInClient['addPasskey'])\n                : undefined\n          }\n        : null,\n    () => {\n      // Let a later open retry: a failed fetch is not cached by the browser.\n      signInModule = null\n      return null\n    }\n  )\n  return signInModule\n}\n\nexport function loadSignIn(): Promise<SignIn | null> {\n  return loadSignInClient().then(c => c?.signIn ?? null)\n}\n\n/** Whether this browser can use a passkey at all (WebAuthn present). */\nexport function passkeysSupported(): boolean {\n  return typeof window !== 'undefined' && 'PublicKeyCredential' in window\n}\n\n/**\n * The /auth page's passkey flows, for when the sign-in client can't be\n * loaded: `add` saves one for the signed-in visitor, `signin` is the page with\n * its passkey button. Both come back here afterwards.\n */\nexport function passkeyHref(mode: 'add' | 'signin'): string {\n  if (mode === 'signin') return switchKeyHref()\n  return (\n    '/auth?passkey=add&return=' +\n    encodeURIComponent(window.location.pathname + window.location.search + window.location.hash)\n  )\n}\n\n/* ------------------------------------------------------------------ *\n * Prefetch\n * ------------------------------------------------------------------ */\n\n/** Everything the settings popout displays, resolved together. */\nexport interface SettingsSnapshot {\n  identity: Identity\n  /** null = public caller (no pill) or the request failed. */\n  content: ContentLevelState | null\n  /** Passkeys that sign this person in; null = unknown (older edge, host-supplied identity). */\n  passkeys: number | null\n}\n\n/** Identity the host already knows, so we don't ask the server for it again. */\nexport interface SettingsPrefetchHints {\n  /** Caller's tier. When supplied, whoami is skipped entirely. */\n  userType?: Tier\n  /** Caller's display name. Only meaningful alongside `userType`. */\n  name?: string | null\n}\n\nlet snapshot: Promise<SettingsSnapshot> | null = null\n\n/**\n * Resolve — once per page load — everything the settings popout shows.\n *\n * This is THE entry point, and it is called from ConnectedSettings' MOUNT, not\n * from its open handler. Settings data is user identity: it is known at boot,\n * it doesn't change while the page is up, and making the gear the trigger left\n * the panel on screen but blank for a round trip (measured on prod: whoami\n * 167ms and content-level 186ms, issued concurrently). It now rides along with\n * the app's own boot traffic and the click costs nothing.\n *\n * Idempotent and shared: every caller after the first gets the same promise, so\n * N mounted consumers still produce at most one whoami for the whole page.\n * Mutations below write through to it rather than invalidating, so a remount\n * never shows a value the user just changed.\n *\n * Against a current edge-router this issues NO requests of its own at all — the\n * level rides on the whoami the shell already had in flight. See\n * resolveSettings for the fallback when it doesn't.\n */\nexport function prefetchSettings(hints: SettingsPrefetchHints = {}): Promise<SettingsSnapshot> {\n  snapshot ??= resolveSettings(hints)\n  return snapshot\n}\n\nasync function resolveSettings(hints: SettingsPrefetchHints): Promise<SettingsSnapshot> {\n  // The whoami body, not just the adapted identity — edge-router carries the\n  // content level on it (see below), and reading the raw body is how we get at\n  // it without a second request.\n  //\n  // Skipped entirely when the host supplied identity: that prop exists for apps\n  // that CANNOT reach /session/whoami (conjure sits behind a path-prefixed shim\n  // where it 404s), so asking anyway would spend a request to learn nothing.\n  const selfResolving = hints.userType === undefined && typeof window !== 'undefined'\n  const bodyPromise = selfResolving ? sharedWhoami() : Promise.resolve(null)\n\n  const identityPromise: Promise<Identity> =\n    hints.userType !== undefined\n      ? Promise.resolve({ userType: hints.userType, name: hints.name ?? null })\n      : whoami()\n\n  // PREFERRED PATH: take the level straight off whoami.\n  //\n  // edge-router's authGate has already resolved it (registry key → userId →\n  // prefs D1) to stamp X-Hadoku-Content-Level, so reporting it on whoami costs\n  // it nothing — and it saves us a proxied round trip to prefs-api that\n  // measured 132-420ms against prod. Better still, whoami is in flight before\n  // this bundle has even loaded, so the value is here the moment we ask.\n  //\n  // FALLBACK: the standalone GET, for any edge-router older than the\n  // 2026-08-07 change, and for callers not behind it at all (Capacitor,\n  // Storybook, a non-hadoku host). Gated on identity because the pill is\n  // hidden for public callers — fetching an anonymous visitor's level is a\n  // guaranteed-wasted request on every page view. `hadoku_user_type` is\n  // written by the loader before anything mounts, so where it already says\n  // \"signed in\" the fallback goes out concurrently rather than behind whoami.\n  const contentPromise = bodyPromise.then(body => {\n    const carried = contentFromWhoami(body)\n    if (carried) return carried\n    if (looksSignedIn(hints.userType)) return getContentLevel()\n    return identityPromise.then(id => (id.userType === 'public' ? null : getContentLevel()))\n  })\n\n  const [identity, content, body] = await Promise.all([\n    identityPromise,\n    contentPromise,\n    bodyPromise\n  ])\n  return { identity, content, passkeys: passkeysFromWhoami(body) }\n}\n\nfunction passkeysFromWhoami(body: WhoamiBody | null): number | null {\n  return body?.valid && typeof body.passkeys === 'number' ? body.passkeys : null\n}\n\n/**\n * Adapt the content level off a whoami body, or null if that edge-router\n * doesn't report it.\n *\n * Both fields are required, and both must be numbers: a body carrying a level\n * without its ceiling would render a pill with zero segments — worse than the\n * fallback fetch, because it looks like a working control that offers nothing.\n */\nfunction contentFromWhoami(body: WhoamiBody | null): ContentLevelState | null {\n  if (!body?.valid) return null\n  const { contentLevel, maxContentLevel } = body\n  if (typeof contentLevel !== 'number' || typeof maxContentLevel !== 'number') return null\n  if (maxContentLevel < 1) return null\n  return { level: contentLevel, maxLevel: maxContentLevel }\n}\n\n/** Best-effort \"is this caller signed in?\" from state available synchronously. */\nfunction looksSignedIn(hinted?: Tier): boolean {\n  if (hinted !== undefined) return hinted !== 'public'\n  if (typeof window === 'undefined') return false\n  const cached = localStorage.getItem('hadoku_user_type')\n  return cached !== null && cached !== 'public'\n}\n\n/** Keep the prefetched snapshot in step with a successful mutation. */\nfunction patchSnapshot(patch: (prev: SettingsSnapshot) => SettingsSnapshot) {\n  if (!snapshot) return\n  snapshot = snapshot.then(patch)\n}\n"],"names":["body"],"mappings":"AA6BA,MAAM,qBAAqB;AAC3B,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAavB,MAAM,gBAAgB;AA2BtB,MAAM,qBAAqB;AAG3B,SAAS,eAAe,OAAwD;AAC9E,QAAM,UAAkC,EAAE,gBAAgB,oBAAoB,GAAG,MAAA;AACjF,QAAM,MAAM,OAAO,WAAW,cAAc,aAAa,QAAQ,mBAAmB,IAAI;AACxF,MAAI,IAAK,SAAQ,cAAc,IAAI;AACnC,SAAO;AACT;AAUA,eAAsB,kBAAqD;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB;AAAA,MAC1C,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAA;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,gBAAgB,OAAkD;AACtF,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB;AAAA,MAC1C,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,OAAO;AAAA,MAC9B,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,SAAU,MAAM,IAAI,KAAA;AAC1B,kBAAc,WAAS,EAAE,GAAG,MAAM,SAAS,SAAS;AACpD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,eAAe,MAAsC;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,cAAc;AAAA,MACpC,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,eAAA;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,MAAM;AAAA,MAC7B,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,IAAA,CAC/C;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAA;AACxB,kBAAc,CAAA,UAAS,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,KAAK,UAAU,MAAM,KAAK,KAAA,IAAS;AACpF,WAAO,KAAK;AAAA,EACd,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA2BA,SAAS,eAA2C;AAClD,QAAM,IAAI;AACV,IAAE,aAAa,MAAM,MAAM,gBAAgB;AAAA,IACzC,aAAa;AAAA,IACb,SAAS,eAAA;AAAA,IACT,QAAQ,YAAY,QAAQ,kBAAkB;AAAA,EAAA,CAC/C,EACE,KAAK,CAAA,QAAQ,IAAI,KAAM,IAAI,KAAA,IAAiC,IAAK,EACjE,MAAM,MAAM,IAAI;AACnB,SAAO,EAAE,aAAa;AACxB;AAOA,eAAsB,SAA4B;AAChD,MAAI,OAAO,WAAW,YAAa,QAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AACtE,MAAI;AACF,UAAM,OAAO,MAAM,aAAA;AACnB,QAAI,CAAC,MAAM,MAAO,QAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AACrD,WAAO,EAAE,UAAU,KAAK,YAAY,UAAU,MAAM,KAAK,QAAQ,KAAA;AAAA,EACnE,QAAQ;AACN,WAAO,EAAE,UAAU,UAAU,MAAM,KAAA;AAAA,EACrC;AACF;AAkBO,SAAS,gBAAwB;AACtC,SACE,2BACA,mBAAmB,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,IAAI;AAE/F;AAiCA,MAAM,iBAAiB;AACvB,IAAI,eAAoD;AAgBjD,SAAS,mBAAiD;AAC/D,mBAAiB;AAAA;AAAA,IAA0B;AAAA,IAAgB;AAAA,IACzD,CAAC,MACC,OAAO,EAAE,WAAW,aAChB;AAAA,MACE,QAAQ,EAAE;AAAA,MACV,mBACE,OAAO,EAAE,sBAAsB,aAC1B,EAAE,oBACH;AAAA,MACN,YACE,OAAO,EAAE,eAAe,aACnB,EAAE,aACH;AAAA,IAAA,IAER;AAAA,IACN,MAAM;AAEJ,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EAAA;AAEF,SAAO;AACT;AAEO,SAAS,aAAqC;AACnD,SAAO,mBAAmB,KAAK,CAAA,MAAK,GAAG,UAAU,IAAI;AACvD;AAGO,SAAS,oBAA6B;AAC3C,SAAO,OAAO,WAAW,eAAe,yBAAyB;AACnE;AAOO,SAAS,YAAY,MAAgC;AAC1D,MAAI,SAAS,SAAU,QAAO,cAAA;AAC9B,SACE,8BACA,mBAAmB,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,IAAI;AAE/F;AAuBA,IAAI,WAA6C;AAqB1C,SAAS,iBAAiB,QAA+B,IAA+B;AAC7F,eAAa,gBAAgB,KAAK;AAClC,SAAO;AACT;AAEA,eAAe,gBAAgB,OAAyD;AAQtF,QAAM,gBAAgB,MAAM,aAAa,UAAa,OAAO,WAAW;AACxE,QAAM,cAAc,gBAAgB,aAAA,IAAiB,QAAQ,QAAQ,IAAI;AAEzE,QAAM,kBACJ,MAAM,aAAa,SACf,QAAQ,QAAQ,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,QAAQ,KAAA,CAAM,IACtE,OAAA;AAiBN,QAAM,iBAAiB,YAAY,KAAK,CAAAA,UAAQ;AAC9C,UAAM,UAAU,kBAAkBA,KAAI;AACtC,QAAI,QAAS,QAAO;AACpB,QAAI,cAAc,MAAM,QAAQ,UAAU,gBAAA;AAC1C,WAAO,gBAAgB,KAAK,CAAA,OAAO,GAAG,aAAa,WAAW,OAAO,iBAAkB;AAAA,EACzF,CAAC;AAED,QAAM,CAAC,UAAU,SAAS,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,CACD;AACD,SAAO,EAAE,UAAU,SAAS,UAAU,mBAAmB,IAAI,EAAA;AAC/D;AAEA,SAAS,mBAAmB,MAAwC;AAClE,SAAO,MAAM,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAC5E;AAUA,SAAS,kBAAkB,MAAmD;AAC5E,MAAI,CAAC,MAAM,MAAO,QAAO;AACzB,QAAM,EAAE,cAAc,gBAAA,IAAoB;AAC1C,MAAI,OAAO,iBAAiB,YAAY,OAAO,oBAAoB,SAAU,QAAO;AACpF,MAAI,kBAAkB,EAAG,QAAO;AAChC,SAAO,EAAE,OAAO,cAAc,UAAU,gBAAA;AAC1C;AAGA,SAAS,cAAc,QAAwB;AAC7C,MAAI,WAAW,OAAW,QAAO,WAAW;AAC5C,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,SAAS,aAAa,QAAQ,kBAAkB;AACtD,SAAO,WAAW,QAAQ,WAAW;AACvC;AAGA,SAAS,cAAc,OAAqD;AAC1E,MAAI,CAAC,SAAU;AACf,aAAW,SAAS,KAAK,KAAK;AAChC;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadoku/task-ui-components",
-  "version": "4.20.5",
+  "version": "4.20.7",
   "description": "Reusable UI components with Bento grid and metallic gradient support",
   "type": "module",
   "main": "dist/index.js",

package/src/components/ConnectedSettings.tsx

@@ -84,6 +84,20 @@ function reportErr(err: unknown) {
   console.error('[ConnectedSettings] action failed', (err as Error)?.message ?? err)
 }
 
+/** Inline, not in app-header.css: every app runs this component from the
+ *  site's shared vendor module, but compiles app-header.css into its own
+ *  stylesheet at ITS build, so a new rule reaches an app only when it rebuilds. */
+const PASSKEY_DOT: React.CSSProperties = {
+  position: 'absolute',
+  top: 2,
+  right: 2,
+  width: 8,
+  height: 8,
+  borderRadius: '50%',
+  background: 'var(--color-primary)',
+  pointerEvents: 'none'
+}
+
 const TIER_LABEL: Record<Tier, string> = {
   admin: 'Administrator',
   wife: 'Wife',
@@ -125,6 +139,8 @@ export function ConnectedSettings({
   // time limit each end the wait.
   const [passkeyMode, setPasskeyMode] = useState<'save' | 'signin' | null>(null)
   const [passkeySaved, setPasskeySaved] = useState(false)
+  // How many passkeys sign this person in, from whoami; null = unknown.
+  const [passkeyCount, setPasskeyCount] = useState<number | null>(null)
   const [passkeyError, setPasskeyError] = useState<string | null>(null)
   const passkeyCtl = useRef<AbortController | null>(null)
   const cancelPasskey = useCallback((reason?: string) => passkeyCtl.current?.abort(reason), [])
@@ -147,6 +163,15 @@ export function ConnectedSettings({
   // There is no rank helper in this bundle, but "above public" needs none.
   const showContentPill = userType !== 'public'
 
+  // Signed in on a key with no passkey: the gear carries a dot and Save passkey
+  // is the primary action until one is saved. Unknown counts never prompt.
+  const needsPasskey =
+    !resolving &&
+    userType !== 'public' &&
+    passkeyCount === 0 &&
+    !passkeySaved &&
+    passkeysSupported()
+
   // Keep local identity in sync when the host controls it via props.
   useEffect(() => {
     if (userTypeProp !== undefined) setUserType(userTypeProp)
@@ -176,8 +201,9 @@ export function ConnectedSettings({
   useEffect(() => {
     let live = true
     prefetchSettings({ userType: userTypeProp, name: nameProp })
-      .then(({ identity, content: state }) => {
+      .then(({ identity, content: state, passkeys }) => {
         if (!live) return
+        setPasskeyCount(passkeys)
         // Props stay authoritative: the host passed them because it can see an
         // identity this component can't resolve for itself.
         if (userTypeProp === undefined) {
@@ -355,11 +381,15 @@ export function ConnectedSettings({
       <button
         type="button"
         className="app-header__icon-btn settings-toggle-btn"
-        aria-label="User settings"
+        aria-label={needsPasskey ? 'User settings, no passkey saved' : 'User settings'}
+        style={needsPasskey ? { position: 'relative' } : undefined}
         aria-expanded={open}
         onClick={() => setOpen(v => !v)}
       >
         <SettingsIcon />
+        {needsPasskey && (
+          <span className="settings-toggle-btn__dot" style={PASSKEY_DOT} aria-hidden="true" />
+        )}
       </button>
 
       {open && <div className="settings-popout__overlay" onClick={() => setOpen(false)} />}
@@ -577,7 +607,7 @@ export function ConnectedSettings({
                 {!resolving && userType !== 'public' && passkeysSupported() && (
                   <button
                     type="button"
-                    className="settings-popout__btn"
+                    className={`settings-popout__btn${needsPasskey ? ' settings-popout__btn--primary' : ''}`}
                     disabled={passkeyMode !== null || passkeySaved}
                     onClick={() => {
                       savePasskey().catch(reportErr)

package/src/lib/settingsClient.ts

@@ -52,6 +52,9 @@ const WHOAMI_GLOBAL = '__hadokuWhoami'
  * arrive from edge-router ≥ the 2026-08-07 change, which reports the level
  * `authGate` had already resolved to stamp X-Hadoku-Content-Level. When they
  * are absent we fall back to the standalone GET — see resolveSettings.
+ *
+ * `passkeys` (edge-router ≥ 2026-10-28) counts the passkeys that sign this
+ * session in. Absent means unknown, never none.
  */
 interface WhoamiBody {
   valid?: boolean
@@ -59,6 +62,7 @@ interface WhoamiBody {
   name?: string | null
   contentLevel?: number
   maxContentLevel?: number
+  passkeys?: number
 }
 
 // Hard timeout on every settings request. Without it, a request throttled by
@@ -317,6 +321,8 @@ export interface SettingsSnapshot {
   identity: Identity
   /** null = public caller (no pill) or the request failed. */
   content: ContentLevelState | null
+  /** Passkeys that sign this person in; null = unknown (older edge, host-supplied identity). */
+  passkeys: number | null
 }
 
 /** Identity the host already knows, so we don't ask the server for it again. */
@@ -391,8 +397,16 @@ async function resolveSettings(hints: SettingsPrefetchHints): Promise<SettingsSn
     return identityPromise.then(id => (id.userType === 'public' ? null : getContentLevel()))
   })
 
-  const [identity, content] = await Promise.all([identityPromise, contentPromise])
-  return { identity, content }
+  const [identity, content, body] = await Promise.all([
+    identityPromise,
+    contentPromise,
+    bodyPromise
+  ])
+  return { identity, content, passkeys: passkeysFromWhoami(body) }
+}
+
+function passkeysFromWhoami(body: WhoamiBody | null): number | null {
+  return body?.valid && typeof body.passkeys === 'number' ? body.passkeys : null
 }
 
 /**