@jimhoyd/urlcode-auth 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/presentation.js

@@ -0,0 +1,458 @@
+import { createPresentation as createUiPresentation } from '@jimhoyd/urlcode-ui';
+export const englishCatalogue = Object.freeze({
+    "users.exportAll": "Export all matching accounts as CSV",
+    "users.exportLimits": "Complete export: at most 5,000 accounts, 4 MiB and 5 seconds. Narrow filters if the limit is exceeded.",
+    "abuse.required": "Challenge required. Return to the form and try again.",
+    "abuse.title": "Verification required",
+    "abuse.retry": "Try again",
+    "adminOps.title": "Account administration",
+    "adminOps.bulkInfo": "Apply role assignment or resend verification to at most 50 accounts. Delivery must succeed before changes apply.",
+    "adminOps.ids": "Account IDs (comma-separated, maximum 50)",
+    "adminOps.actionLabel": "Action",
+    "adminOps.roles": "Roles (comma-separated)",
+    "adminOps.reason": "Reason",
+    "adminOps.confirm": "Type {value} to confirm",
+    "adminOps.bulkConfirm": "Type ACTION COUNT (for example ASSIGN-ROLES 2)",
+    "adminOps.apply": "Deliver notices and apply",
+    "adminOps.info": "Actions require fresh administrator authentication and a reason. Notification delivery occurs before changes apply.",
+    "adminOps.password": "Password configured",
+    "adminOps.totp": "Authenticator configured",
+    "adminOps.yes": "Yes",
+    "adminOps.no": "No",
+    "adminOps.passkey": "Passkey",
+    "adminOps.secondFactor": "Enrolled second factor",
+    "adminOps.factorCase": "Reset factors through a two-administrator case",
+    "adminOps.email": "Requested new email address",
+    "adminOps.completed": "Account administration completed",
+    "adminOps.affected": "{count} accounts updated",
+    "adminOps.action.verifyEmail": "Verify email by human review",
+    "adminOps.action.forcePasswordReset": "Invalidate password and send setup link",
+    "adminOps.action.scheduleDeletion": "Schedule deletion with cancellation notice",
+    "adminOps.action.cancelDeletion": "Cancel scheduled deletion",
+    "adminOps.action.removePasskey": "Remove passkey",
+    "adminOps.action.removeExternal": "Remove external sign-in method",
+    "adminOps.action.requestEmailChange": "Request email change with 24-hour delay",
+    "adminOps.action.assignRoles": "Assign roles",
+    "adminOps.action.resendVerification": "Resend verification",
+    "users.filter.storedMethod": "Stored credential method",
+    "users.filter.anyStoredMethod": "Any stored credential method",
+    "users.filter.search": "Search email, masked email, name or account ID",
+    "users.filter.anyStatus": "Any status",
+    "users.filter.active": "Active",
+    "users.filter.locked": "Locked",
+    "users.filter.pendingDelete": "Pending deletion",
+    "users.filter.external": "External identity",
+    "users.filter.method": "Sign-in method",
+    "users.filter.verification": "Email verification",
+    "users.filter.anyVerification": "Any verification",
+    "users.filter.verified": "Verified",
+    "users.filter.unverified": "Unverified",
+    "users.filter.locale": "Locale",
+    "users.filter.createdFrom": "Created from UTC",
+    "users.filter.createdTo": "Created to UTC",
+    "users.filter.seenFrom": "Last seen from UTC",
+    "users.filter.seenTo": "Last seen to UTC",
+    "users.filter.sort": "Sort by",
+    "users.filter.direction": "Direction",
+    "users.filter.ascending": "Ascending",
+    "users.filter.descending": "Descending",
+    "users.filter.displayName": "Display name",
+    "users.filter.lastSeen": "Last seen",
+    "users.filter.apply": "Apply filters",
+    "users.filter.activityCaveat": "Last seen uses retained device and session activity; it is not a complete activity history.",
+    "mfa.passkeySignIn": "Passkey sign-in",
+    "mfa.primaryOrder": "If your account uses a second factor, confirm it before choosing your sign-in passkey.",
+    "manualRecovery.title": "Manual account recovery",
+    "manualRecovery.restoreTitle": "Restore account access",
+    "manualRecovery.restoreIntro": "This link was approved by two administrators after a manual identity review. Choose a new password, then enroll a second factor. Existing sign-in methods and sessions will be revoked.",
+    "manualRecovery.replace": "Replace credentials and enroll a second factor",
+    "manualRecovery.intro": "Internal human review only. Do not enter passwords, tokens, identity document images or other unnecessary sensitive data. A distinct authorized administrator must independently review the evidence. References are plain text and are never fetched.",
+    "manualRecovery.account": "Account",
+    "manualRecovery.address": "Approved replacement address",
+    "manualRecovery.status": "Status",
+    "manualRecovery.evidence": "Evidence assessment",
+    "manualRecovery.reference": "Internal evidence reference",
+    "manualRecovery.none": "None",
+    "manualRecovery.note": "Internal case note",
+    "manualRecovery.addNote": "Add note",
+    "manualRecovery.closure": "Closure reason",
+    "manualRecovery.close": "Close without restoring access",
+    "manualRecovery.approval": "Independent approval reason",
+    "manualRecovery.confirmation": "Type RESTORE to confirm",
+    "manualRecovery.approve": "Approve and send restoration link",
+    "manualRecovery.accountId": "Account ID",
+    "manualRecovery.verifiedAddress": "Human-verified replacement email",
+    "manualRecovery.boundedEvidence": "Evidence assessment (maximum 2000 characters)",
+    "manualRecovery.reason": "Reason",
+    "manualRecovery.create": "Open case for independent review",
+    "manualRecovery.newPassword": "New password",
+    "manualRecovery.state.review": "Awaiting independent review",
+    "manualRecovery.state.delivery": "Awaiting delivery",
+    "manualRecovery.state.ready": "Ready for restoration",
+    "manualRecovery.state.redeemed": "Restored",
+    "manualRecovery.state.cancelled": "Cancelled",
+    "page.secondFactors": "Second factors",
+    "page.trustedDevices": "Remembered devices",
+    "mfa.distinctKey": "A second-factor passkey must be different from the passkey used for primary sign-in.",
+    "mfa.setupPasskey": "Set up a passkey second factor",
+    "mfa.enablePasskey": "Enable passkey second factor",
+    "mfa.disablePasskey": "Disable passkey second factor",
+    "mfa.invalidSetting": "Invalid factor setting",
+    "device.rememberExplanation": "Remembering a device requires a real second factor. Sensitive actions still require fresh verification.",
+    "device.label": "Device label",
+    "device.remember": "Remember this device",
+    "device.forget": "Forget device",
+    "recovery.title": "Recover your authenticator",
+    "recovery.intro": "This optional email recovery process requires proof from your verified email address, a 24-hour cancellation period, and enrollment of a new authenticator. Existing authentication methods remain unchanged until recovery completes.",
+    "recovery.send": "Send recovery instructions",
+    "recovery.cancelTitle": "Cancel authenticator recovery",
+    "recovery.cancel": "Cancel recovery",
+    "recovery.confirmTitle": "Confirm authenticator recovery",
+    "recovery.confirmInfo": "Confirming email possession starts a 24-hour waiting period. Return in this same browser after the waiting period. Completing recovery signs out all sessions and requires enrollment of a new authenticator before application access.",
+    "recovery.confirm": "Confirm email and show recovery time",
+    "recovery.complete": "Complete recovery after waiting period",
+    "recovery.waitTitle": "Authenticator recovery waiting period",
+    "recovery.waitInfo": "Recovery becomes available at {time}. Keep the email and return using this browser. You can cancel using the separate link in that email.",
+    "recovery.lost": "Lost your authenticator?",
+    "action.exportAudit": "Export audit range as JSON",
+    "mfa.usePasskey": "Use a passkey as your second factor",
+    "mfa.passkeyConfirmed": "Passkey confirmed. Continue signing in.",
+    "page.health": "Service health",
+    "health.component": "Component",
+    "health.status": "Status",
+    "health.updated": "Last checked",
+    "health.version": "Runtime version",
+    "health.routes": "Routes",
+    "health.unavailable": "No operator health integration is configured.",
+    "health.runtime": "Runtime",
+    "health.readiness": "Readiness",
+    "health.healthy": "Healthy",
+    "health.degraded": "Degraded",
+    "health.unavailableStatus": "Unavailable",
+    "health.unknown": "Unknown",
+    "health.sender": "Email delivery",
+    "health.provider": "Identity provider",
+    "health.alerts": "Alerts",
+    "signup.pending": "Your request has been received. If eligible, an administrator will review it before you can sign in.",
+    "signup.checkEmail": "Check your email for a signup code. Enter it to continue.",
+    "signup.createPasskey": "Create a passkey",
+    "signup.restart": "Start again",
+    "signup.browserRequired": "Signup browser binding required",
+    "signup.restartRequired": "Restart signup",
+    "signup.previousStep": "Complete the previous signup step",
+    "signup.verifiedRequired": "Complete verified signup first",
+    "notice.emailCodeEligible": "If this account is eligible, a sign-in code will be sent.",
+    "notice.passwordResetEligible": "If this account is eligible, a reset message will be sent.",
+    "notice.verificationEligible": "If this account is eligible, a verification message will be sent.",
+    "action.selectAccount": "Select {account}",
+    "error.httpInvalidRequestEncoding": "Invalid request encoding",
+    "error.httpInvalidJSONBody": "Invalid JSON body",
+    "error.httpExpectedAnObject": "Expected an object",
+    "error.httpUseJSONOrFormData": "Use JSON or form data",
+    "error.httpTooManyFields": "Too many fields",
+    "error.httpInvalidRequestField": "Invalid request field",
+    "error.httpInvalidCookies": "Invalid cookies",
+    "error.httpDuplicateSessionCookie": "Duplicate session cookie",
+    "error.httpInvalidSessionCookie": "Invalid session cookie",
+    "error.httpSameOriginRequestRequired": "Same-origin request required",
+    "error.httpInvalidCSRFToken": "Invalid CSRF token",
+    "error.httpExportExceedsOnePage": "Export exceeds one page",
+    "error.httpDuplicateFilter": "Duplicate filter",
+    "error.httpUseAUTCDateAndTimeEndingInZ": "Use a UTC date and time ending in Z",
+    "error.httpInvalidAuditTime": "Invalid audit time",
+    "error.httpInvalidTimeRange": "Invalid time range",
+    "error.httpInvalidEncoding": "Invalid encoding",
+    "error.httpInvalidJSON": "Invalid JSON",
+    "error.httpInvalidSelection": "Invalid selection",
+    "error.httpUseOneSelectionFormat": "Use one selection format",
+    "error.httpSelectBetweenOneAndFiftyDistinctAccounts": "Select between one and fifty distinct accounts",
+    "message.accountState": "Email: {email}. Authenticator: {authenticator}.",
+    "state.verified": "verified",
+    "state.unverified": "not yet verified",
+    "state.enabled": "enabled",
+    "state.disabled": "not enabled",
+    "message.sessionStarted": "Started {created}; expires {expires}",
+    "message.deletionGrace": "Deletion signs out all sessions immediately. A cancellation link will be emailed, valid for {days} days before permanent removal. Confirm your identity first.",
+    "message.adminTotals": "{users} accounts; {locked} locked; {pending} pending deletion; {sessions} sessions; {waitlist} waiting for approval.",
+    "message.sessionsOnPage": { "one": "{count} session on this page.", "other": "{count} sessions on this page." },
+    "message.bulkUpdated": { "one": "{count} account updated.", "other": "{count} accounts updated." },
+    "message.sessionAccountDetail": "Account {account}; started {created}; expires {expires}",
+    "message.caseSummary": "{action} for {account} \u2014 {status}",
+    "common.yes": "Yes",
+    "common.no": "No",
+    "provider.link": "Link {provider}",
+    "provider.signIn": "Sign in with {provider}",
+    "number.value": "{value}",
+    "error.serviceUnavailable": "Service unavailable",
+    "error.passkeyUnavailable": "Passkeys are unavailable in this browser. Use another sign-in method.",
+    "error.passkeyFailed": "Passkey request failed",
+    "error.passkeyCancelled": "Passkey ceremony cancelled",
+    "field.booleanHint": "true or false",
+    "message.acceptTerms": "I accept terms version {version}",
+    "error.invalidNumericMetadata": "Invalid numeric metadata",
+    "error.invalidBooleanMetadata": "Invalid boolean metadata",
+    "error.emailDeliveryIsNotConfigured": "Email delivery is not configured",
+    "error.verifyYourEmailBeforeEnrollingAnAuthenticator": "Verify your email before enrolling an authenticator",
+    "action.continue": "Continue",
+    "copy.emailSignIn": "Email sign in",
+    "error.invalidInvitation": "Invalid invitation",
+    "error.notFound": "Not found",
+    "copy.leaveEmpty": "Leave empty",
+    "error.invalidEmailFlow": "Invalid email flow",
+    "error.aSingleTokenIsRequired": "A single token is required",
+    "action.confirmOperation": "Confirm",
+    "copy.confirmOnlyAnAccountYouCreatedVerificationConfirmsThisEmailAddressItDoesNotSetOrResetAPassword": "Confirm only an account you created. Verification confirms this email address; it does not set or reset a password.",
+    "page.completeAccountEnrollment": "Complete account enrollment",
+    "copy.applicationAccessRemainsBlockedUntilAllRequiredEnrollmentStepsAreComplete": "Application access remains blocked until all required enrollment steps are complete.",
+    "copy.verifyYourEmailFirst": "Verify your email first",
+    "copy.emailDeliveryIsUnavailableContactTheSiteOperator": "Email delivery is unavailable. Contact the site operator.",
+    "copy.enrollAnAuthenticator": "Enroll an authenticator",
+    "copy.ifYourRecentSignInHasExpired": "if your recent sign-in has expired.",
+    "copy.youAreViewingThisAccountAsASupportAdministratorAccountSecurityChangesAreDisabledEndImpersonationToSignInAsYour": "You are viewing this account as a support administrator. Account security changes are disabled. End impersonation to sign in as yourself.",
+    "action.requestEmailChange24HourCoolingPeriod": "Request email change (24-hour cooling period)",
+    "action.revokeThisSession": "Revoke this session",
+    "page.signInMethods": "Sign-in methods",
+    "copy.passkeys": "Passkeys",
+    "action.removePasskey": "Remove passkey",
+    "copy.linkedProviders": "Linked providers",
+    "action.unlinkProvider": "Unlink provider",
+    "copy.theLastSignInMethodCannotBeRemoved": "The last sign-in method cannot be removed.",
+    "error.enterAnEmailAddress": "Enter an email address",
+    "error.securityChangesAreDisabledDuringImpersonation": "Security changes are disabled during impersonation",
+    "error.emailDeliveryRequired": "Email delivery required",
+    "error.emailDeliveryFailedChangeCancelled": "Email delivery failed; change cancelled",
+    "error.emailDeliveryIsRequiredForDeletionRecovery": "Email delivery is required for deletion recovery",
+    "error.deletionConfirmationRequired": "Deletion confirmation required",
+    "copy.addThisKeyToYourAuthenticator": "Add this key to your authenticator:",
+    "copy.storeTheseCodesSecurelyEachCanBeUsedOnce": "Store these codes securely. Each can be used once.",
+    "copy.continueToYourAccount": "Continue to your account",
+    "error.invalidAuthenticationFlow": "Invalid authentication flow",
+    "error.authenticationFlowBelongsToAnotherBrowser": "Authentication flow belongs to another browser",
+    "error.requestBodyTooLarge": "Request body too large",
+    "error.jSONRequired": "JSON required",
+    "error.invalidAuthenticationPayload": "Invalid authentication payload",
+    "error.confirmYourIdentityFirst": "Confirm your identity first",
+    "error.pOSTRequired": "POST required",
+    "error.invalidProviderResponse": "Invalid provider response",
+    "error.gETOrPOSTRequired": "GET or POST required",
+    "error.formCallbackRequired": "Form callback required",
+    "error.invalidProviderState": "Invalid provider state",
+    "error.providerFlowMismatch": "Provider flow mismatch",
+    "error.invalidIdentityIssuer": "Invalid identity issuer",
+    "error.anExistingLinkedAccountIsRequired": "An existing linked account is required",
+    "page.completeYourAccount": "Complete your account",
+    "error.identityChangedDuringSignIn": "Identity changed during sign in",
+    "error.invalidEnrollment": "Invalid enrollment",
+    "error.identityChangedDuringEnrollment": "Identity changed during enrollment",
+    "error.unknownAuthenticationField": "Unknown authentication field",
+    "error.browserFlowRequired": "Browser flow required",
+    "error.flowIDRequired": "Flow ID required",
+    "error.invalidChallenge": "Invalid challenge",
+    "error.invalidCredential": "Invalid credential",
+    "error.accountChangedDuringCeremony": "Account changed during ceremony",
+    "error.passkeyAuthenticationFailed": "Passkey authentication failed",
+    "error.passkeyBelongsToAnotherAccount": "Passkey belongs to another account",
+    "error.invalidSecondFactor": "Invalid second factor",
+    "action.startTenMinuteSupportImpersonation": "Start ten-minute support impersonation",
+    "copy.selectASectionOnlyPermittedOperationsAreShownConfigurationRemainsInVersionControlledProjectFiles": "Select a section. Only permitted operations are shown. Configuration remains in version-controlled project files.",
+    "copy.authenticationActivityLast30UTCDays": "Authentication activity: last 30 UTC days",
+    "copy.recordedAccountCreationsSuccessfulSignInsAndFailedSignInsTheseFiguresDescribeAuthenticationActivityDeploymentH": "Recorded account creations, successful sign-ins and failed sign-ins. These figures describe authentication activity; deployment health is not measured here.",
+    "copy.dailyAuthenticationCounts": "Daily authentication counts",
+    "copy.uTCDay": "UTC day",
+    "copy.signUps": "Sign-ups",
+    "copy.signIns": "Sign-ins",
+    "copy.failedSignIns": "Failed sign-ins",
+    "copy.authenticationMethodsOverTheSame30Days": "Authentication methods over the same 30 days",
+    "copy.method": "Method",
+    "copy.recentEvents": "Recent events",
+    "page.supportCases": "Support cases",
+    "action.closeWithoutApplying": "Close without applying",
+    "action.approveAndApply": "Approve and apply",
+    "action.createCaseForASecondAdministrator": "Create case for a second administrator",
+    "action.approveAccount": "Approve account",
+    "action.sendInvitation": "Send invitation",
+    "error.accountNotFound": "Account not found",
+    "page.accountDetails": "Account details",
+    "copy.email": "Email",
+    "copy.status": "Status",
+    "copy.emailVerified": "Email verified",
+    "copy.authenticatorEnabled": "Authenticator enabled",
+    "copy.created": "Created",
+    "copy.language": "Language",
+    "copy.termsVersion": "Terms version",
+    "copy.recentAccountActivity": "Recent account activity",
+    "copy.viewAccountAudit": "View account audit",
+    "action.createAccountAndSendSetupLink": "Create account and send setup link",
+    "copy.filterUsers": "Filter users",
+    "action.exportThisPageAsCSV": "Export this page as CSV",
+    "copy.exportThisFilteredPageOnlyAtMost50AccountsEmailAddressesStayMasked": "Export this filtered page only, at most 50 accounts. Email addresses stay masked.",
+    "copy.bulkAction": "Bulk action",
+    "copy.lock": "Lock",
+    "copy.unlock": "Unlock",
+    "field.typeLOCKUNLOCKOrREVOKESESSIONSFollowedByASpaceAndTheSelectedCount": "Type LOCK, UNLOCK or REVOKE-SESSIONS followed by a space and the selected count",
+    "copy.selectAccountsInTheTableAllSelectedAccountsMustBePermittedOtherwiseNoneAreChanged": "Select accounts in the table. All selected accounts must be permitted; otherwise none are changed.",
+    "copy.applyBulkAction": "Apply bulk action",
+    "copy.accountsEmailAddressesMasked": "Accounts (email addresses masked)",
+    "copy.select": "Select",
+    "copy.actions": "Actions",
+    "copy.roleDefinitionsAreReadOnlyHere": "Role definitions are read-only here.",
+    "action.revokeAllSessions": "Revoke all sessions",
+    "field.fromUTC20260101T0000Z": "From UTC (2026-01-01T00:00Z)",
+    "field.toUTC20260102T0000Z": "To UTC (2026-01-02T00:00Z)",
+    "copy.filterAudit": "Filter audit",
+    "copy.recentSecurityEvents": "Recent security events",
+    "copy.time": "Time",
+    "copy.action": "Action",
+    "copy.actor": "Actor",
+    "copy.subject": "Subject",
+    "error.aReasonIsRequired": "A reason is required",
+    "error.confirmYourIdentityBeforeThisAction": "Confirm your identity before this action",
+    "error.invalidBulkAction": "Invalid bulk action",
+    "error.typedConfirmationMustMatchTheActionAndSelectedCount": "Typed confirmation must match the action and selected count",
+    "page.bulkUpdateCompleted": "Bulk update completed",
+    "error.setupDeliveryUnavailable": "Setup delivery unavailable",
+    "error.invalidCaseAction": "Invalid case action",
+    "error.impersonationNotificationIsRequired": "Impersonation notification is required",
+    "error.invitationDeliveryUnavailable": "Invitation delivery unavailable",
+    "error.invalidStatus": "Invalid status",
+    "field.currentPassword": "Current password",
+    "field.currentPasswordOptional": "Current password (if configured)",
+    "field.displayName": "Display name",
+    "field.invitation": "Invitation token",
+    "field.newEmail": "New email address",
+    "field.passwordMinimum": "Password (at least 15 characters)",
+    "field.passwordOptional": "Password (if configured)",
+    "field.locale": "Preferred language",
+    "field.recoveryAlternative": "Recovery code (instead of authenticator code)",
+    "field.totpOptional": "Authenticator code (if enabled)",
+    "field.emailCode": "Six-digit email code",
+    "field.deleteConfirmation": "Type DELETE to confirm",
+    "field.accountId": "Account ID",
+    "field.caseAction": "Action: reset-factors, lock, unlock or roles",
+    "field.approvalReason": "Approval reason",
+    "field.caseNote": "Case note",
+    "field.closureReason": "Closure reason",
+    "field.emailFilter": "Email contains",
+    "field.role": "Role name",
+    "field.roles": "Role names separated by commas",
+    "field.caseRoles": "Roles (for roles action)",
+    "field.status": "Status: active, locked or pending-delete",
+    "page.passwordReset": "Reset password",
+    "page.newPassword": "Choose a new password",
+    "page.emailVerification": "Verify email",
+    "page.emailCode": "Sign in by email",
+    "page.enterEmailCode": "Enter your email code",
+    "page.deletionCancellation": "Cancel account deletion",
+    "page.totpSetup": "Set up authenticator",
+    "page.recoveryCodes": "Save your recovery codes",
+    "page.supportImpersonation": "Support impersonation",
+    "page.registrationRequest": "Request an account",
+    "page.verifyEmailChange": "Verify email change",
+    "page.cancelEmailChange": "Cancel email change",
+    "page.secondFactor": "Confirm second factor",
+    "page.users": "Users",
+    "page.roles": "Roles",
+    "page.audit": "Audit",
+    "page.cases": "Cases",
+    "page.registrations": "Registration requests",
+    "page.updateCompleted": "Update completed",
+    "page.completeRegistration": "Complete registration",
+    "action.sendEmailCode": "Send sign-in code",
+    "action.keepAccount": "Keep my account",
+    "action.sendVerification": "Send verification email",
+    "action.setupTotp": "Set up authenticator",
+    "action.disableTotp": "Disable authenticator",
+    "action.confirmTotp": "Confirm authenticator",
+    "action.updateProfile": "Update profile",
+    "action.changePassword": "Change password and sign out all sessions",
+    "action.exportData": "Export account data",
+    "action.scheduleDeletion": "Schedule account deletion",
+    "action.signOutAll": "Sign out all sessions",
+    "action.endImpersonation": "End impersonation",
+    "action.requestAccount": "Request account",
+    "action.completeSignIn": "Complete sign in",
+    "action.sendReset": "Send reset link",
+    "action.findSessions": "Find sessions",
+    "action.revokeSessions": "Revoke sessions",
+    "action.assignRoles": "Assign roles",
+    "action.lock": "Lock account",
+    "action.unlock": "Unlock account",
+    "action.addPasskey": "Add a passkey",
+    "action.signInPasskey": "Sign in with a passkey",
+    "action.changeEmail": "Change email address",
+    "action.approveCase": "Approve case",
+    "action.closeCase": "Close case",
+    "action.addNote": "Add note",
+    "action.search": "Search",
+    "nav.overview": "Overview",
+    "nav.users": "Users",
+    "nav.roles": "Roles",
+    "nav.audit": "Audit",
+    "nav.cases": "Cases",
+    "nav.registration": "Registration",
+    "nav.forgotPassword": "Forgot password",
+    "message.operationCompleted": "The operation completed.",
+    "message.registrationReceived": "Registration request received.",
+    "message.noSession": "Sign in required",
+    "message.permissionRequired": "Permission required",
+    "page.requestCancelled": "Request cancelled",
+    "ux.requestCancelled": "Your request has been cancelled.",
+    "page.emailVerified": "Email verified",
+    "ux.emailVerified": "Your email address has been verified.",
+    "ux.emailChangeRequested": "Check your new email for confirmation instructions. The change can only finish after the 24-hour cooling period.",
+    "page.sessionSignedOut": "Session signed out",
+    "ux.sessionSignedOut": "The selected session has been signed out.",
+    "page.deletionScheduled": "Account deletion scheduled",
+    "ux.deletionScheduled": "Your account deletion is scheduled. Check your email for cancellation instructions if you change your mind.",
+    "ux.disableAuthenticator": "Disable authenticator",
+    "ux.signupProgress": "Step {current} of {total}",
+    "ux.credentialChoiceShort": "Use a password or passkey.",
+    "ux.passwordHintShort": "At least 15 characters. Use a unique password.",
+    "ux.waitlistShort": "An administrator must approve your request.",
+    "ux.signInFailed": "Sign-in failed. Check your password and any required verification code.",
+    "ux.tryAgain": "Try again",
+    "ux.twoStep": "Two-step verification (if enabled)",
+    "ux.twoStepHelp": "If your account uses two-step verification, enter an authenticator code or a recovery code. Otherwise, leave this section closed.",
+    "ux.change": "Change",
+    "ux.passwordIntro": "Enter the password for this account.",
+    "ux.resetIntro": "Enter your account email. If it is eligible, we will send a password reset link.",
+    "ux.resetSent": "If this account is eligible, a reset message will be sent. Check your inbox and spam folder, then follow the link to choose a new password.",
+    "ux.backSignIn": "Back to sign in",
+    "ux.passwordUpdated": "Your password has been updated. Sign in with your new password.",
+    "page.enterPassword": "Enter your password",
+    "page.checkEmail": "Check your email",
+    "page.passwordUpdated": "Password updated",
+    "page.secureAccount": "Secure your account",
+    "page.createPassword": "Create a password",
+    "page.yourDetails": "Your details",
+    "ux.setupProgress": "Account setup progress",
+    "ux.alreadyAccount": "Already have an account?",
+    "ux.signupVerifiedIntro": "Start with your email. We will verify it before you choose how to sign in.",
+    "ux.signupIntro": "Start with your email, then choose how to sign in.",
+    "ux.signupCheckEmail": "If this address is eligible, a signup code has been sent. Enter the code to continue.",
+    "ux.signupCredentialChoice": "Choose a password or create a passkey. You only need one sign-in method to continue.",
+    "ux.signupPasswordIntro": "Choose a password with at least 15 characters. A long, unique passphrase works well.",
+    "ux.passwordRules": "Use at least 15 characters. Avoid passwords you use elsewhere.",
+    "ux.signupWaitlistIntro": "Review your details and submit your request. An administrator must approve it before you can sign in.",
+    "ux.signupProfileIntro": "Add your details and review any required terms to finish creating your account.",
+    "ux.signupRestartHelp": "Starting again clears this signup progress. No account is created until you finish.",
+    "ux.factorRecoverySent": "If this account is eligible, recovery instructions will be sent. Continue in this browser.",
+    "page.recoveryCancelled": "Recovery cancelled",
+    "ux.recoveryCancelled": "This recovery request has been cancelled. Your existing sign-in methods are unchanged.",
+    'copy.signInIntro': 'Enter your email to continue to your account.', 'action.differentEmail': 'Use a different email address',
+    'section.profile': 'Profile', 'section.authenticator': 'Authenticator', 'section.accountData': 'Account data', 'section.deleteAccount': 'Delete account',
+    'page.signIn': 'Sign in', 'page.register': 'Create account', 'page.account': 'Your account', 'page.sessions': 'Your sessions', 'page.stepUp': 'Confirm your identity', 'page.error': 'Request could not be completed', 'page.admin': 'Administration',
+    'field.email': 'Email address', 'field.password': 'Password', 'field.newPassword': 'New password', 'field.reason': 'Reason', 'field.totp': 'Authenticator code', 'field.recoveryCode': 'Recovery code',
+    'action.signIn': 'Sign in', 'action.register': 'Create account', 'action.signOut': 'Sign out', 'action.confirm': 'Confirm identity', 'action.resetPassword': 'Reset password', 'action.save': 'Save changes', 'action.next': 'Next page',
+    'nav.account': 'Account', 'nav.sessions': 'Sessions', 'nav.security': 'Security', 'nav.admin': 'Administration', 'nav.skip': 'Skip to content',
+    'message.sessionCount': Object.freeze({ one: '{count} session', other: '{count} sessions' }),
+    'message.accessDenied': 'Access denied', 'message.requestFailed': 'Request could not be completed', 'message.csrfRequired': 'Reload the page before submitting again.',
+});
+/** Legacy auth theme names are adapted here; the shared UI package knows no auth fields. */
+export function createPresentation(options = {}) {
+    const theme = options.theme;
+    if (theme !== undefined && (!theme || typeof theme !== 'object' || Array.isArray(theme) || Object.keys(theme).length > 10))
+        throw new Error('Invalid presentation theme');
+    const translated = theme ? Object.fromEntries(Object.entries(theme).map(([name, value]) => [name.startsWith('--auth-') ? name.replace('--auth-', '--ui-') : name, value])) : undefined;
+    return createUiPresentation({ ...options, ...(translated ? { theme: translated } : {}), defaults: englishCatalogue });
+}

package/dist/presets.d.ts

@@ -0,0 +1,18 @@
+import type { AuthOptions } from './auth-core.ts';
+import type { AuthExtensionOptions } from './auth.ts';
+import type { EmailSender } from './senders.ts';
+export interface AuthPresetOptions {
+    preset?: 'standard' | 'hardened';
+    origin: string;
+    rpName: string;
+    sender?: EmailSender;
+    checkPassword?: AuthOptions['checkPassword'];
+}
+export interface AuthPreset {
+    service: Pick<AuthOptions, 'sessionTtlMs' | 'sessionIdleMs' | 'requireEmailVerification' | 'requireMfa' | 'deletionGraceMs' | 'checkPassword'>;
+    extension: Pick<AuthExtensionOptions, 'passkeys' | 'sendToken' | 'sendEmailCode' | 'sendSignupCode' | 'sendFactorRecovery' | 'sendNotice'>;
+    notices: readonly string[];
+}
+/** Operator defaults, not project capabilities. Spread these defaults before explicit configuration.
+ * Hardened requires actual email and password-screening adapters and restricted enrollment. */
+export declare function createAuthPreset(options: AuthPresetOptions): AuthPreset;

package/dist/presets.js

@@ -0,0 +1,17 @@
+import { createPasskeyProvider } from "./passkeys.js";
+/** Operator defaults, not project capabilities. Spread these defaults before explicit configuration.
+ * Hardened requires actual email and password-screening adapters and restricted enrollment. */
+export function createAuthPreset(options) {
+    const preset = options.preset ?? 'standard';
+    if (preset !== 'standard' && preset !== 'hardened')
+        throw new Error('Unknown auth preset');
+    const hardened = preset === 'hardened';
+    if (options.sender && (typeof options.sender !== 'function' || typeof options.sender.notify !== 'function' || typeof options.sender.sendEmailCode !== 'function' || typeof options.sender.sendSignupCode !== 'function' || typeof options.sender.sendFactorRecovery !== 'function'))
+        throw new Error('Invalid email sender');
+    if (hardened && (!options.sender || typeof options.checkPassword !== 'function'))
+        throw new Error('Hardened auth requires email delivery and password breach screening');
+    const passkeys = createPasskeyProvider({ origin: options.origin, rpId: new URL(options.origin).hostname, rpName: options.rpName });
+    const service = { sessionTtlMs: hardened ? 8 * 60 * 60 * 1000 : 24 * 60 * 60 * 1000, sessionIdleMs: hardened ? 15 * 60 * 1000 : 30 * 60 * 1000, requireEmailVerification: hardened, requireMfa: hardened, deletionGraceMs: (hardened ? 30 : 7) * 86400000, ...(options.checkPassword ? { checkPassword: options.checkPassword } : {}) };
+    const sender = options.sender;
+    return { service: Object.freeze(service), extension: Object.freeze({ passkeys, ...(sender ? { sendToken: sender, sendFactorRecovery: sender.sendFactorRecovery.bind(sender), sendSignupCode: sender.sendSignupCode.bind(sender), sendEmailCode: sender.sendEmailCode.bind(sender), sendNotice: sender.notify.bind(sender) } : {}) }), notices: Object.freeze(sender ? [] : ['Email verification, recovery and notices are unavailable until an operator sender is configured.']) };
+}

package/dist/providers.d.ts

@@ -0,0 +1,13 @@
+import type { OidcProvider, OidcProviderOptions } from './oidc.ts';
+export type GoogleProviderOptions = Pick<OidcProviderOptions, 'clientId' | 'clientSecret' | 'redirectUri' | 'fetch'>;
+export declare function createGoogleProvider(options: GoogleProviderOptions): Promise<OidcProvider>;
+export interface AppleProviderOptions {
+    teamId: string;
+    keyId: string;
+    clientId: string;
+    privateKey: string;
+    redirectUri: string;
+    fetch?: typeof globalThis.fetch;
+}
+/** Operator-owned signing key; no Apple key or client secret enters project YAML. */
+export declare function createAppleProvider(options: AppleProviderOptions): Promise<OidcProvider>;

package/dist/providers.js

@@ -0,0 +1,15 @@
+import { SignJWT, importPKCS8 } from 'jose';
+import { createOidcProvider } from "./oidc.js";
+export function createGoogleProvider(options) { return createOidcProvider({ ...options, issuer: 'https://accounts.google.com' }); }
+/** Operator-owned signing key; no Apple key or client secret enters project YAML. */
+export async function createAppleProvider(options) {
+    if (!/^[A-Z0-9]{10}$/.test(options.teamId) || !/^[A-Z0-9]{10}$/.test(options.keyId) || !/^[A-Za-z0-9.-]{1,255}$/.test(options.clientId) || options.privateKey.length > 16384)
+        throw new Error('Invalid Apple operator configuration');
+    const key = await importPKCS8(options.privateKey, 'ES256');
+    // A fresh five-minute credential for each protocol exchange avoids long-lived
+    // client-secret expiry silently disabling a running deployment.
+    const client = async () => createOidcProvider({ issuer: 'https://appleid.apple.com', clientId: options.clientId, clientSecret: await new SignJWT({}).setProtectedHeader({ alg: 'ES256', kid: options.keyId }).setIssuer(options.teamId).setSubject(options.clientId).setAudience('https://appleid.apple.com').setIssuedAt().setExpirationTime('5m').sign(key), redirectUri: options.redirectUri, scope: 'name email', responseMode: 'form_post', appleEmailClaim: true, ...(options.fetch ? { fetch: options.fetch } : {}) });
+    // Validate discovery during operator activation, not after rendering a button.
+    await client();
+    return { async start() { return (await client()).start(); }, async complete(callback, flow) { return (await client()).complete(callback, flow); } };
+}

package/dist/registration.d.ts

@@ -0,0 +1,45 @@
+/** Registration data is descriptive, never authority. Roles, grants and session state are separate service operations. */
+export type MetadataValue = string | number | boolean;
+export interface MetadataField {
+    type: 'string' | 'number' | 'boolean';
+    scope: 'public' | 'private' | 'unsafe';
+    required?: boolean;
+    default?: MetadataValue;
+    enum?: MetadataValue[];
+    maxLength?: number;
+    minimum?: number;
+    maximum?: number;
+}
+export interface RegistrationOptions {
+    termsVersion?: string;
+    metadata?: Record<string, MetadataField>;
+    locales?: string[];
+}
+export interface RegistrationInput {
+    displayName?: string;
+    locale?: string;
+    metadata?: Record<string, MetadataValue>;
+    termsAccepted?: boolean;
+}
+export interface RegistrationProfile {
+    displayName?: string;
+    locale?: string;
+    metadata: Record<string, MetadataValue>;
+    terms?: {
+        version: string;
+        acceptedAt: number;
+    };
+}
+export interface RegistrationPolicy {
+    publicSchema(): RegistrationOptions;
+    validate(input: RegistrationInput, context: {
+        now: number;
+        existing?: RegistrationProfile;
+        operator?: boolean;
+    }): RegistrationProfile;
+    /** Public and unsafe metadata remain untrusted user content. Private metadata never leaves this projection. */
+    publicProfile(profile: RegistrationProfile): RegistrationProfile;
+}
+export declare function createRegistrationPolicy(options?: RegistrationOptions): RegistrationPolicy;
+/** Quiet refusal is an HTTP integration decision; this helper never creates a fake account or session. */
+export declare function isHoneypotFilled(value: unknown): boolean;