@portnet/ui 6.0.1 → 6.0.3

package/dist/esm/v2/utils/fileValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileValidation.js","names":["EXECUTABLE_EXTENSIONS","Set","MIME_BY_EXTENSION","Object","freeze","pdf","png","jpg","jpeg","gif","webp","tif","tiff","txt","csv","doc","docx","xls","xlsx","ppt","pptx","UNRELIABLE_MIME_EXTENSIONS","DEFAULT_EXECUTABLE_MESSAGE","extensionOf","fileName","parts","split","length","toLowerCase","describeAcceptedTypes","extensions","map","ext","toUpperCase","join","toAcceptAttribute","isForbiddenExecutable","file","name","has","isAcceptedFile","policy","getFileRejection","executableMessage","labels","executable","typeMessage","type","reason","message","accepted","some","allowed","mime","trim","expected","undefined","includes","fileValidationApi"],"sources":["../../../../src/lib/v2/utils/fileValidation.ts"],"sourcesContent":["/**\r\n * fileValidation — is this file allowed to be uploaded?\r\n *\r\n *   const POLICY = { extensions: [\"pdf\", \"png\", \"jpg\", \"jpeg\", \"doc\", \"docx\"] };\r\n *\r\n *   const rejection = getFileRejection(file, POLICY);\r\n *   if (rejection) toast(rejection.message, \"error\");\r\n *\r\n *   <Dropzone accept={toAcceptAttribute(POLICY.extensions)} … />\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS BELONGS IN THE LIBRARY (capability gap G-52)\r\n *\r\n * `Dropzone` takes an `accept` attribute and reports `DropzoneRejection`, but it\r\n * validates nothing: the browser's `accept` is a FILE-PICKER FILTER, not a\r\n * control. It is trivially bypassed — drag and drop ignores it, and so does\r\n * \"All files\" in the picker on most platforms. So the library asked every host\r\n * to decide, itself, whether a dropped file is acceptable, and every host wrote:\r\n *\r\n *   - an extension allow-list (business policy — rightly theirs), AND\r\n *   - a deny-list of executables and scripts, AND\r\n *   - an extension↔MIME cross-check with its browser tolerances.\r\n *\r\n * The last two are NOT business policy. They are one security decision, and a\r\n * security decision copied into every module is a security decision that WILL\r\n * drift: the day a file type has to be added to the deny-list, nobody can say\r\n * which of the fifteen GU modules received it. Worse, divergence here is\r\n * SILENT — a module missing an entry looks exactly like a module that has it,\r\n * until something gets uploaded.\r\n *\r\n * So the split this file draws: the HOST owns which extensions its business\r\n * accepts; the LIBRARY owns the executable deny-list and the MIME cross-check.\r\n *\r\n * Raised from `autorisation-admis-pour-conforme-fe` (Area 5), which carried a\r\n * 21-entry executable deny-list and a six-extension MIME table locally.\r\n *\r\n * NOT A SUBSTITUTE FOR SERVER-SIDE VALIDATION, and this must stay written down:\r\n * everything here runs in a browser the user controls. Its purpose is to give a\r\n * CLEAR, IMMEDIATE reason (R-4.1, R-4.4) instead of a server rejection after a\r\n * full upload. The back-end remains the authority.\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n */\r\n\r\n/**\r\n * Executables, scripts and installers — refused whatever the host's policy says.\r\n *\r\n * Checked FIRST, and the order carries meaning: a `.exe` gets a message naming\r\n * it as a dangerous file, not a vague \"unsupported type\", because those are not\r\n * the same information for the person at the screen.\r\n *\r\n * Windows-centric because GU workstations are: PE binaries, the cmd/PowerShell\r\n * script families, installer packages, and the HTML-application and\r\n * control-panel shims that are executable despite innocuous extensions.\r\n */\r\nconst EXECUTABLE_EXTENSIONS: ReadonlySet<string> = new Set([\r\n  \"exe\", \"dll\", \"bat\", \"cmd\", \"com\", \"pif\", \"scr\",\r\n  \"msi\", \"msu\", \"msp\",\r\n  \"vbs\", \"vbe\", \"jse\", \"wsf\", \"wsh\",\r\n  \"ps1\", \"psm1\", \"psc1\",\r\n  \"cpl\", \"msc\", \"hta\",\r\n]);\r\n\r\n/**\r\n * Accepted MIME types per extension.\r\n *\r\n * DELIBERATELY NOT `getMimeType` from ./fileDownload, though both map\r\n * extensions to MIME types. That one answers \"what type should I stamp on this\r\n * Blob\" — ONE canonical value. This one answers \"what types may a browser\r\n * plausibly report for this extension\" — a SET, including variants no canonical\r\n * table would contain (`image/jpg` is not a registered type, and browsers send\r\n * it anyway). Collapsing the two would reject valid files.\r\n */\r\nconst MIME_BY_EXTENSION: Readonly<Record<string, readonly string[]>> =\r\n  Object.freeze({\r\n    pdf: [\"application/pdf\"],\r\n    png: [\"image/png\"],\r\n    jpg: [\"image/jpeg\", \"image/jpg\"],\r\n    jpeg: [\"image/jpeg\", \"image/jpg\"],\r\n    gif: [\"image/gif\"],\r\n    webp: [\"image/webp\"],\r\n    tif: [\"image/tiff\"],\r\n    tiff: [\"image/tiff\"],\r\n    txt: [\"text/plain\"],\r\n    csv: [\"text/csv\", \"application/csv\", \"text/plain\"],\r\n    doc: [\"application/msword\"],\r\n    docx: [\r\n      \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\r\n    ],\r\n    xls: [\"application/vnd.ms-excel\"],\r\n    xlsx: [\r\n      \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\r\n    ],\r\n    ppt: [\"application/vnd.ms-powerpoint\"],\r\n    pptx: [\r\n      \"application/vnd.openxmlformats-officedocument.presentationml.presentation\",\r\n    ],\r\n  });\r\n\r\n/**\r\n * Extensions whose reported MIME type cannot be trusted, so\r\n * `application/octet-stream` is tolerated for them.\r\n *\r\n * WITHOUT THIS TOLERANCE A LEGITIMATE `.docx` IS REFUSED on some machines —\r\n * Office documents are frequently reported as `application/octet-stream`\r\n * depending on browser and OS, and the refusal would be INTERMITTENT, which is\r\n * the hardest kind to diagnose from a support ticket. The extension has already\r\n * been checked against the host's allow-list at that point, so the tolerance\r\n * does not widen what is accepted, only what is believed.\r\n */\r\nconst UNRELIABLE_MIME_EXTENSIONS: ReadonlySet<string> = new Set([\r\n  \"doc\", \"docx\", \"xls\", \"xlsx\", \"ppt\", \"pptx\", \"csv\",\r\n]);\r\n\r\n/** Why a file was refused. `reason` is for branching and logs, not for display. */\r\nexport type FileRejectionReason = \"executable\" | \"extension\" | \"mime\";\r\n\r\nexport interface FileRejection {\r\n  reason: FileRejectionReason;\r\n  /** Ready to render (French, Charter §09.3 — what, and what is accepted). */\r\n  message: string;\r\n}\r\n\r\nexport interface FileAcceptPolicy {\r\n  /**\r\n   * Extensions the HOST's business accepts, without a leading dot,\r\n   * case-insensitive. This is the only part of the decision that belongs to the\r\n   * host — an empty list accepts nothing, which is a programming error rather\r\n   * than a policy, so it is treated as \"refuse everything\" and not as \"allow\".\r\n   */\r\n  extensions: readonly string[];\r\n  /** Overrides for the default messages. Keep them in French, verb + object. */\r\n  labels?:\r\n    | {\r\n        executable?: string | undefined;\r\n        type?: string | undefined;\r\n      }\r\n    | undefined;\r\n}\r\n\r\nconst DEFAULT_EXECUTABLE_MESSAGE =\r\n  \"Les fichiers exécutables, scripts et installeurs ne sont pas autorisés.\";\r\n\r\n/** Lowercased extension of a file name, or `\"\"` when there is none. */\r\nconst extensionOf = (fileName: string | undefined): string => {\r\n  if (!fileName) return \"\";\r\n  const parts = fileName.split(\".\");\r\n  /* A name with no dot has no extension: \"rapport\" must not be read as having\r\n     extension \"rapport\", which a bare `pop()` would do. */\r\n  if (parts.length < 2) return \"\";\r\n  return (parts[parts.length - 1] ?? \"\").toLowerCase();\r\n};\r\n\r\n/**\r\n * Human list of the accepted types — \"PDF, PNG, JPG, JPEG, DOC, DOCX.\"\r\n *\r\n * Order is the host's: the list is read by a person, and a host lists its most\r\n * common format first for a reason. Sorting it here would silently reorder\r\n * copy the host wrote deliberately.\r\n */\r\nexport function describeAcceptedTypes(\r\n  extensions: readonly string[]\r\n): string {\r\n  return `${extensions.map((ext) => ext.toUpperCase()).join(\", \")}.`;\r\n}\r\n\r\n/**\r\n * The `accept` attribute for an input or `Dropzone` — \".pdf,.png,.jpg\".\r\n *\r\n * A picker filter, never a control: see the note on server-side validation in\r\n * the file header.\r\n */\r\nexport function toAcceptAttribute(extensions: readonly string[]): string {\r\n  return extensions.map((ext) => `.${ext.toLowerCase()}`).join(\",\");\r\n}\r\n\r\n/**\r\n * Is this an executable, a script or an installer?\r\n *\r\n * Exported on its own because a host may want to refuse those EARLIER than its\r\n * own policy check — on a bulk drop, for instance, where one dangerous file\r\n * should stop the whole batch rather than be listed among type mismatches.\r\n *\r\n * Permissive parameter type on purpose: callers routinely pass an item pulled\r\n * out of a `FileList` without having checked it.\r\n */\r\nexport function isForbiddenExecutable(file?: File | null | undefined): boolean {\r\n  const ext = extensionOf(file?.name);\r\n  return ext !== \"\" && EXECUTABLE_EXTENSIONS.has(ext);\r\n}\r\n\r\n/** Does the file satisfy `policy` (and the library's own deny-list)? */\r\nexport function isAcceptedFile(\r\n  file: File | null | undefined,\r\n  policy: FileAcceptPolicy\r\n): boolean {\r\n  return getFileRejection(file, policy) === null;\r\n}\r\n\r\n/**\r\n * Why this file cannot be uploaded, or `null` when it can.\r\n *\r\n * Order of checks is load-bearing:\r\n *   1. executable / script / installer — named as such;\r\n *   2. extension against the host's allow-list;\r\n *   3. reported MIME type against the extension.\r\n *\r\n * MIME RULES, both deliberate: an EMPTY type is accepted (some browsers report\r\n * none, and the extension has just been checked), and `application/octet-stream`\r\n * is accepted for the extensions listed in `UNRELIABLE_MIME_EXTENSIONS`. An\r\n * extension with no entry in the MIME table is accepted on its extension alone\r\n * — the table is a cross-check, not a second allow-list, and a host adding a\r\n * format to its policy must not have it refused by a table it cannot see.\r\n */\r\nexport function getFileRejection(\r\n  file: File | null | undefined,\r\n  policy: FileAcceptPolicy\r\n): FileRejection | null {\r\n  const executableMessage =\r\n    policy.labels?.executable ?? DEFAULT_EXECUTABLE_MESSAGE;\r\n  const typeMessage =\r\n    policy.labels?.type ??\r\n    `Types autorisés : ${describeAcceptedTypes(policy.extensions)}`;\r\n\r\n  if (isForbiddenExecutable(file)) {\r\n    return { reason: \"executable\", message: executableMessage };\r\n  }\r\n\r\n  const ext = extensionOf(file?.name);\r\n  if (ext === \"\") return { reason: \"extension\", message: typeMessage };\r\n\r\n  const accepted = policy.extensions.some(\r\n    (allowed) => allowed.toLowerCase() === ext\r\n  );\r\n  if (!accepted) return { reason: \"extension\", message: typeMessage };\r\n\r\n  const mime = (file?.type ?? \"\").trim().toLowerCase();\r\n  if (mime === \"\") return null;\r\n  if (mime === \"application/octet-stream\" && UNRELIABLE_MIME_EXTENSIONS.has(ext)) {\r\n    return null;\r\n  }\r\n\r\n  const expected = MIME_BY_EXTENSION[ext];\r\n  if (expected === undefined) return null;\r\n  if (expected.includes(mime)) return null;\r\n\r\n  return { reason: \"mime\", message: typeMessage };\r\n}\r\n\r\nconst fileValidationApi = {\r\n  isForbiddenExecutable,\r\n  isAcceptedFile,\r\n  getFileRejection,\r\n  describeAcceptedTypes,\r\n  toAcceptAttribute,\r\n};\r\nexport default fileValidationApi;\r\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMA,qBAA0C,GAAG,IAAIC,GAAG,CAAC,CACzD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAC/C,KAAK,EAAE,KAAK,EAAE,KAAK,EACnB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EACjC,KAAK,EAAE,MAAM,EAAE,MAAM,EACrB,KAAK,EAAE,KAAK,EAAE,KAAK,CACpB,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,iBAA8D,GAClEC,MAAM,CAACC,MAAM,CAAC;EACZC,GAAG,EAAE,CAAC,iBAAiB,CAAC;EACxBC,GAAG,EAAE,CAAC,WAAW,CAAC;EAClBC,GAAG,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;EAChCC,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;EACjCC,GAAG,EAAE,CAAC,WAAW,CAAC;EAClBC,IAAI,EAAE,CAAC,YAAY,CAAC;EACpBC,GAAG,EAAE,CAAC,YAAY,CAAC;EACnBC,IAAI,EAAE,CAAC,YAAY,CAAC;EACpBC,GAAG,EAAE,CAAC,YAAY,CAAC;EACnBC,GAAG,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,YAAY,CAAC;EAClDC,GAAG,EAAE,CAAC,oBAAoB,CAAC;EAC3BC,IAAI,EAAE,CACJ,yEAAyE,CAC1E;EACDC,GAAG,EAAE,CAAC,0BAA0B,CAAC;EACjCC,IAAI,EAAE,CACJ,mEAAmE,CACpE;EACDC,GAAG,EAAE,CAAC,+BAA+B,CAAC;EACtCC,IAAI,EAAE,CACJ,2EAA2E;AAE/E,CAAC,CAAC;;AAEJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,0BAA+C,GAAG,IAAIpB,GAAG,CAAC,CAC9D,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CACnD,CAAC;;AAEF;;AA0BA,MAAMqB,0BAA0B,GAC9B,yEAAyE;;AAE3E;AACA,MAAMC,WAAW,GAAIC,QAA4B,IAAa;EAC5D,IAAI,CAACA,QAAQ,EAAE,OAAO,EAAE;EACxB,MAAMC,KAAK,GAAGD,QAAQ,CAACE,KAAK,CAAC,GAAG,CAAC;EACjC;AACF;EACE,IAAID,KAAK,CAACE,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE;EAC/B,OAAO,CAACF,KAAK,CAACA,KAAK,CAACE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,EAAEC,WAAW,CAAC,CAAC;AACtD,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,qBAAqBA,CACnCC,UAA6B,EACrB;EACR,OAAO,GAAGA,UAAU,CAACC,GAAG,CAAEC,GAAG,IAAKA,GAAG,CAACC,WAAW,CAAC,CAAC,CAAC,CAACC,IAAI,CAAC,IAAI,CAAC,GAAG;AACpE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAACL,UAA6B,EAAU;EACvE,OAAOA,UAAU,CAACC,GAAG,CAAEC,GAAG,IAAK,IAAIA,GAAG,CAACJ,WAAW,CAAC,CAAC,EAAE,CAAC,CAACM,IAAI,CAAC,GAAG,CAAC;AACnE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,qBAAqBA,CAACC,IAA8B,EAAW;EAC7E,MAAML,GAAG,GAAGT,WAAW,CAACc,IAAI,EAAEC,IAAI,CAAC;EACnC,OAAON,GAAG,KAAK,EAAE,IAAIhC,qBAAqB,CAACuC,GAAG,CAACP,GAAG,CAAC;AACrD;;AAEA;AACA,OAAO,SAASQ,cAAcA,CAC5BH,IAA6B,EAC7BI,MAAwB,EACf;EACT,OAAOC,gBAAgB,CAACL,IAAI,EAAEI,MAAM,CAAC,KAAK,IAAI;AAChD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,gBAAgBA,CAC9BL,IAA6B,EAC7BI,MAAwB,EACF;EACtB,MAAME,iBAAiB,GACrBF,MAAM,CAACG,MAAM,EAAEC,UAAU,IAAIvB,0BAA0B;EACzD,MAAMwB,WAAW,GACfL,MAAM,CAACG,MAAM,EAAEG,IAAI,IACnB,qBAAqBlB,qBAAqB,CAACY,MAAM,CAACX,UAAU,CAAC,EAAE;EAEjE,IAAIM,qBAAqB,CAACC,IAAI,CAAC,EAAE;IAC/B,OAAO;MAAEW,MAAM,EAAE,YAAY;MAAEC,OAAO,EAAEN;IAAkB,CAAC;EAC7D;EAEA,MAAMX,GAAG,GAAGT,WAAW,CAACc,IAAI,EAAEC,IAAI,CAAC;EACnC,IAAIN,GAAG,KAAK,EAAE,EAAE,OAAO;IAAEgB,MAAM,EAAE,WAAW;IAAEC,OAAO,EAAEH;EAAY,CAAC;EAEpE,MAAMI,QAAQ,GAAGT,MAAM,CAACX,UAAU,CAACqB,IAAI,CACpCC,OAAO,IAAKA,OAAO,CAACxB,WAAW,CAAC,CAAC,KAAKI,GACzC,CAAC;EACD,IAAI,CAACkB,QAAQ,EAAE,OAAO;IAAEF,MAAM,EAAE,WAAW;IAAEC,OAAO,EAAEH;EAAY,CAAC;EAEnE,MAAMO,IAAI,GAAG,CAAChB,IAAI,EAAEU,IAAI,IAAI,EAAE,EAAEO,IAAI,CAAC,CAAC,CAAC1B,WAAW,CAAC,CAAC;EACpD,IAAIyB,IAAI,KAAK,EAAE,EAAE,OAAO,IAAI;EAC5B,IAAIA,IAAI,KAAK,0BAA0B,IAAIhC,0BAA0B,CAACkB,GAAG,CAACP,GAAG,CAAC,EAAE;IAC9E,OAAO,IAAI;EACb;EAEA,MAAMuB,QAAQ,GAAGrD,iBAAiB,CAAC8B,GAAG,CAAC;EACvC,IAAIuB,QAAQ,KAAKC,SAAS,EAAE,OAAO,IAAI;EACvC,IAAID,QAAQ,CAACE,QAAQ,CAACJ,IAAI,CAAC,EAAE,OAAO,IAAI;EAExC,OAAO;IAAEL,MAAM,EAAE,MAAM;IAAEC,OAAO,EAAEH;EAAY,CAAC;AACjD;AAEA,MAAMY,iBAAiB,GAAG;EACxBtB,qBAAqB;EACrBI,cAAc;EACdE,gBAAgB;EAChBb,qBAAqB;EACrBM;AACF,CAAC;AACD,eAAeuB,iBAAiB","ignoreList":[]}

package/dist/esm/v2/utils/fmtDate.js

@@ -0,0 +1,111 @@
+/**
+ * fmtDate / fmtDateTime — render a date for DISPLAY.
+ *
+ *   fmtDate("2026-03-05T14:30:00Z")        → "05/03/2026"
+ *   fmtDateTime("2026-03-05T14:30:00Z")    → "05/03/2026 15:30"   (local time)
+ *   fmtDate(undefined)                     → "—"
+ *   fmtDate("pas une date")                → "—"
+ *   fmtDate(d, { absent: "" })             → "" when there is no date
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS BELONGS IN THE LIBRARY (capability gap G-51)
+ *
+ * The library already owns the money side of the same job — `fmtMoney`, same
+ * folder, same "—" for an absent value, for the same reason: a table cell must
+ * never read "NaN". It owned nothing for dates, which every GU screen renders
+ * far more often than amounts. So every module wrote its own, and the copies
+ * shared one defect:
+ *
+ *     const fullformatDate = (stringDate) => {
+ *       const date = new Date(stringDate);
+ *       const day = formatIntoTwoDigits(date.getDate());
+ *       …
+ *
+ * `new Date(undefined)` is an INVALID DATE whose every accessor returns `NaN`,
+ * so the helper rendered, literally:
+ *
+ *     NaN/NaN/NaN NaN:NaN
+ *
+ * on any optional field — an update date, a visit date, a closure date — which
+ * is most of them. In `autorisation-admis-pour-conforme-fe` the guard had been
+ * added at CALL SITES one lot after another (lots 4 to 7) before being pulled
+ * into the module's own helper: treating the symptom eight times, because the
+ * one place where it cannot be forgotten is the formatter itself. That is the
+ * argument for owning it here rather than in each module.
+ *
+ * Two smaller things the same copies carried, fixed here by construction: a
+ * two-digit helper that returned `"08"` (string) or `12` (number) depending on
+ * the value, and an absent date rendered as an EMPTY string — indistinguishable
+ * from a cell that failed to render, where "—" says "we looked, there is
+ * nothing".
+ *
+ * WHY NO `moment`, THOUGH THE PACKAGE ALREADY DEPENDS ON IT
+ *
+ * `moment` is here for the pickers, and specifically for STRICT parsing against
+ * an explicit format (`patterns/_pickerSerialisation`) — reading
+ * `"31-12-2026"` back without guessing. That is the right use of it.
+ *
+ * Rendering an already-parsed instant as two numbers and a year is not. This
+ * folder is dependency-free on purpose (see `fileDownload`), and
+ * `moment(someString)` with no format falls back to `new Date` WHILE EMITTING A
+ * CONSOLE DEPRECATION WARNING — noise a display helper called once per table
+ * cell must not produce. Native padding has neither cost.
+ *
+ * TIME ZONE, STATED RATHER THAN IMPLIED. The output is in the VIEWER'S local
+ * zone (`getDate`, `getHours`…), which is what the module helpers this replaces
+ * did, and what a user expects of "date de dépôt". An instant sent as
+ * `…T23:30:00Z` therefore reads as the next day in Casablanca. If a screen ever
+ * needs the server's calendar day regardless of the reader, that is a DIFFERENT
+ * function and must be argued for on its own — silently switching this one to
+ * UTC would move dates by a day across the whole platform.
+ * ─────────────────────────────────────────────────────────────────────────────
+ */
+
+/** What a formatter accepts: an API string, an epoch, or a `Date`. */
+
+/** The platform's absence mark — same value `fmtMoney` returns. */
+const ABSENT = "—";
+const pad2 = value => String(value).padStart(2, "0");
+
+/**
+ * Parse an input into a USABLE `Date`, or `null`.
+ *
+ * `null` for every unusable case — absent, empty string, unparseable, or an
+ * Invalid Date — so no caller can accidentally format `NaN`. The empty-string
+ * check is explicit because `new Date("")` is Invalid while `new Date(0)` is a
+ * legitimate instant (1970), and a falsy test would conflate them.
+ */
+const toUsableDate = value => {
+  if (value === null || value === undefined || value === "") return null;
+  const date = value instanceof Date ? value : new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date;
+};
+
+/**
+ * Day, month and year — `DD/MM/YYYY`.
+ *
+ * @param value - API string, epoch, or `Date`. Absent or unparseable → `absent`.
+ */
+export function fmtDate(value, opts = {}) {
+  const date = toUsableDate(value);
+  if (date === null) return opts.absent ?? ABSENT;
+  return `${pad2(date.getDate())}/${pad2(date.getMonth() + 1)}/${date.getFullYear()}`;
+}
+
+/**
+ * Day, month, year, then hours and minutes — `DD/MM/YYYY HH:mm`.
+ *
+ * Seconds are deliberately absent: no GU screen displays them, and a second
+ * shown is a second a reader tries to interpret.
+ */
+export function fmtDateTime(value, opts = {}) {
+  const date = toUsableDate(value);
+  if (date === null) return opts.absent ?? ABSENT;
+  return `${fmtDate(date, opts)} ${pad2(date.getHours())}:${pad2(date.getMinutes())}`;
+}
+const fmtDateApi = {
+  fmtDate,
+  fmtDateTime
+};
+export default fmtDateApi;
+//# sourceMappingURL=fmtDate.js.map

package/dist/esm/v2/utils/fmtDate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fmtDate.js","names":["ABSENT","pad2","value","String","padStart","toUsableDate","undefined","date","Date","Number","isNaN","getTime","fmtDate","opts","absent","getDate","getMonth","getFullYear","fmtDateTime","getHours","getMinutes","fmtDateApi"],"sources":["../../../../src/lib/v2/utils/fmtDate.ts"],"sourcesContent":["/**\r\n * fmtDate / fmtDateTime — render a date for DISPLAY.\r\n *\r\n *   fmtDate(\"2026-03-05T14:30:00Z\")        → \"05/03/2026\"\r\n *   fmtDateTime(\"2026-03-05T14:30:00Z\")    → \"05/03/2026 15:30\"   (local time)\r\n *   fmtDate(undefined)                     → \"—\"\r\n *   fmtDate(\"pas une date\")                → \"—\"\r\n *   fmtDate(d, { absent: \"\" })             → \"\" when there is no date\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS BELONGS IN THE LIBRARY (capability gap G-51)\r\n *\r\n * The library already owns the money side of the same job — `fmtMoney`, same\r\n * folder, same \"—\" for an absent value, for the same reason: a table cell must\r\n * never read \"NaN\". It owned nothing for dates, which every GU screen renders\r\n * far more often than amounts. So every module wrote its own, and the copies\r\n * shared one defect:\r\n *\r\n *     const fullformatDate = (stringDate) => {\r\n *       const date = new Date(stringDate);\r\n *       const day = formatIntoTwoDigits(date.getDate());\r\n *       …\r\n *\r\n * `new Date(undefined)` is an INVALID DATE whose every accessor returns `NaN`,\r\n * so the helper rendered, literally:\r\n *\r\n *     NaN/NaN/NaN NaN:NaN\r\n *\r\n * on any optional field — an update date, a visit date, a closure date — which\r\n * is most of them. In `autorisation-admis-pour-conforme-fe` the guard had been\r\n * added at CALL SITES one lot after another (lots 4 to 7) before being pulled\r\n * into the module's own helper: treating the symptom eight times, because the\r\n * one place where it cannot be forgotten is the formatter itself. That is the\r\n * argument for owning it here rather than in each module.\r\n *\r\n * Two smaller things the same copies carried, fixed here by construction: a\r\n * two-digit helper that returned `\"08\"` (string) or `12` (number) depending on\r\n * the value, and an absent date rendered as an EMPTY string — indistinguishable\r\n * from a cell that failed to render, where \"—\" says \"we looked, there is\r\n * nothing\".\r\n *\r\n * WHY NO `moment`, THOUGH THE PACKAGE ALREADY DEPENDS ON IT\r\n *\r\n * `moment` is here for the pickers, and specifically for STRICT parsing against\r\n * an explicit format (`patterns/_pickerSerialisation`) — reading\r\n * `\"31-12-2026\"` back without guessing. That is the right use of it.\r\n *\r\n * Rendering an already-parsed instant as two numbers and a year is not. This\r\n * folder is dependency-free on purpose (see `fileDownload`), and\r\n * `moment(someString)` with no format falls back to `new Date` WHILE EMITTING A\r\n * CONSOLE DEPRECATION WARNING — noise a display helper called once per table\r\n * cell must not produce. Native padding has neither cost.\r\n *\r\n * TIME ZONE, STATED RATHER THAN IMPLIED. The output is in the VIEWER'S local\r\n * zone (`getDate`, `getHours`…), which is what the module helpers this replaces\r\n * did, and what a user expects of \"date de dépôt\". An instant sent as\r\n * `…T23:30:00Z` therefore reads as the next day in Casablanca. If a screen ever\r\n * needs the server's calendar day regardless of the reader, that is a DIFFERENT\r\n * function and must be argued for on its own — silently switching this one to\r\n * UTC would move dates by a day across the whole platform.\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n */\r\n\r\n/** What a formatter accepts: an API string, an epoch, or a `Date`. */\r\nexport type FmtDateInput = string | number | Date | null | undefined;\r\n\r\nexport type FmtDateOptions = {\r\n  /**\r\n   * Rendered when there is no usable date. Defaults to the em dash used as the\r\n   * platform's absence mark in tables and detail sheets.\r\n   *\r\n   * Pass `\"\"` where an empty cell is the deliberate choice — a DataGrid column\r\n   * that must stay visually quiet, or a value on its way into a search payload,\r\n   * since an em dash travelling to a back-end as a criterion is worse than\r\n   * nothing. Both cases exist in the module this was raised from.\r\n   *\r\n   * NO `separator` OPTION, and that is a correction rather than an omission.\r\n   * The first draft had one, justified by a module helper documented as feeding\r\n   * search criteria \"d'où le séparateur paramétrable\". A grep of the module\r\n   * showed that helper has ZERO importers: the justification was dead code, so\r\n   * the knob was speculative surface on a certified API (§2.8 — minimum API\r\n   * surface). The emitted format is the charter's `DD/MM/YYYY`; a host needing\r\n   * another separator should say why here.\r\n   */\r\n  absent?: string | undefined;\r\n};\r\n\r\n/** The platform's absence mark — same value `fmtMoney` returns. */\r\nconst ABSENT = \"—\";\r\n\r\nconst pad2 = (value: number): string => String(value).padStart(2, \"0\");\r\n\r\n/**\r\n * Parse an input into a USABLE `Date`, or `null`.\r\n *\r\n * `null` for every unusable case — absent, empty string, unparseable, or an\r\n * Invalid Date — so no caller can accidentally format `NaN`. The empty-string\r\n * check is explicit because `new Date(\"\")` is Invalid while `new Date(0)` is a\r\n * legitimate instant (1970), and a falsy test would conflate them.\r\n */\r\nconst toUsableDate = (value: FmtDateInput): Date | null => {\r\n  if (value === null || value === undefined || value === \"\") return null;\r\n  const date = value instanceof Date ? value : new Date(value);\r\n  return Number.isNaN(date.getTime()) ? null : date;\r\n};\r\n\r\n/**\r\n * Day, month and year — `DD/MM/YYYY`.\r\n *\r\n * @param value - API string, epoch, or `Date`. Absent or unparseable → `absent`.\r\n */\r\nexport function fmtDate(value: FmtDateInput, opts: FmtDateOptions = {}): string {\r\n  const date = toUsableDate(value);\r\n  if (date === null) return opts.absent ?? ABSENT;\r\n\r\n  return `${pad2(date.getDate())}/${pad2(\r\n    date.getMonth() + 1\r\n  )}/${date.getFullYear()}`;\r\n}\r\n\r\n/**\r\n * Day, month, year, then hours and minutes — `DD/MM/YYYY HH:mm`.\r\n *\r\n * Seconds are deliberately absent: no GU screen displays them, and a second\r\n * shown is a second a reader tries to interpret.\r\n */\r\nexport function fmtDateTime(\r\n  value: FmtDateInput,\r\n  opts: FmtDateOptions = {}\r\n): string {\r\n  const date = toUsableDate(value);\r\n  if (date === null) return opts.absent ?? ABSENT;\r\n\r\n  return `${fmtDate(date, opts)} ${pad2(date.getHours())}:${pad2(\r\n    date.getMinutes()\r\n  )}`;\r\n}\r\n\r\nconst fmtDateApi = { fmtDate, fmtDateTime };\r\nexport default fmtDateApi;\r\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAwBA;AACA,MAAMA,MAAM,GAAG,GAAG;AAElB,MAAMC,IAAI,GAAIC,KAAa,IAAaC,MAAM,CAACD,KAAK,CAAC,CAACE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;;AAEtE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,YAAY,GAAIH,KAAmB,IAAkB;EACzD,IAAIA,KAAK,KAAK,IAAI,IAAIA,KAAK,KAAKI,SAAS,IAAIJ,KAAK,KAAK,EAAE,EAAE,OAAO,IAAI;EACtE,MAAMK,IAAI,GAAGL,KAAK,YAAYM,IAAI,GAAGN,KAAK,GAAG,IAAIM,IAAI,CAACN,KAAK,CAAC;EAC5D,OAAOO,MAAM,CAACC,KAAK,CAACH,IAAI,CAACI,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,GAAGJ,IAAI;AACnD,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,OAAO,SAASK,OAAOA,CAACV,KAAmB,EAAEW,IAAoB,GAAG,CAAC,CAAC,EAAU;EAC9E,MAAMN,IAAI,GAAGF,YAAY,CAACH,KAAK,CAAC;EAChC,IAAIK,IAAI,KAAK,IAAI,EAAE,OAAOM,IAAI,CAACC,MAAM,IAAId,MAAM;EAE/C,OAAO,GAAGC,IAAI,CAACM,IAAI,CAACQ,OAAO,CAAC,CAAC,CAAC,IAAId,IAAI,CACpCM,IAAI,CAACS,QAAQ,CAAC,CAAC,GAAG,CACpB,CAAC,IAAIT,IAAI,CAACU,WAAW,CAAC,CAAC,EAAE;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,WAAWA,CACzBhB,KAAmB,EACnBW,IAAoB,GAAG,CAAC,CAAC,EACjB;EACR,MAAMN,IAAI,GAAGF,YAAY,CAACH,KAAK,CAAC;EAChC,IAAIK,IAAI,KAAK,IAAI,EAAE,OAAOM,IAAI,CAACC,MAAM,IAAId,MAAM;EAE/C,OAAO,GAAGY,OAAO,CAACL,IAAI,EAAEM,IAAI,CAAC,IAAIZ,IAAI,CAACM,IAAI,CAACY,QAAQ,CAAC,CAAC,CAAC,IAAIlB,IAAI,CAC5DM,IAAI,CAACa,UAAU,CAAC,CAClB,CAAC,EAAE;AACL;AAEA,MAAMC,UAAU,GAAG;EAAET,OAAO;EAAEM;AAAY,CAAC;AAC3C,eAAeG,UAAU","ignoreList":[]}

package/dist/esm/v2/utils/fmtMoney.js

@@ -46,33 +46,31 @@
  * an unmatched-but-valid tag negotiates down to fr-FR instead of to the host.
  * The `try/catch` is still required for genuinely malformed input.
  */
-var FALLBACK_LOCALE = "fr-FR";
-export default function fmtMoney(n) {
-  var currency = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : "";
-  var opts = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+const FALLBACK_LOCALE = "fr-FR";
+export default function fmtMoney(n, currency = "", opts = {}) {
   if (n == null || n === "") return "—";
-  var num = typeof n === "number" ? n : Number(n);
+  const num = typeof n === "number" ? n : Number(n);
   if (!Number.isFinite(num)) return "—";
-  var locale = opts.locale || FALLBACK_LOCALE;
-  var formatOpts = {};
+  const locale = opts.locale || FALLBACK_LOCALE;
+  const formatOpts = {};
   if (opts.minimumFractionDigits != null) {
     formatOpts.minimumFractionDigits = opts.minimumFractionDigits;
   }
   if (opts.maximumFractionDigits != null) {
     formatOpts.maximumFractionDigits = opts.maximumFractionDigits;
   }
-  var formatted;
+  let formatted;
   try {
     /* Requested locale first, fr-FR as the declared next preference — see
      * FALLBACK_LOCALE. A resolvable request ("en-US") still wins outright; an
      * unmatched-but-well-formed tag lands on fr-FR rather than on the host's
      * default locale. */
     formatted = new Intl.NumberFormat([locale, FALLBACK_LOCALE], formatOpts).format(num);
-  } catch (_unused) {
+  } catch {
     /* Reached only for a STRUCTURALLY invalid tag (RangeError) or a non-string
      * value from an untyped host — negotiation cannot help there. */
     formatted = new Intl.NumberFormat(FALLBACK_LOCALE, formatOpts).format(num);
   }
-  return currency ? "".concat(formatted, " ").concat(currency) : formatted;
+  return currency ? `${formatted} ${currency}` : formatted;
 }
 //# sourceMappingURL=fmtMoney.js.map

package/dist/esm/v2/utils/fmtMoney.js.map

@@ -1 +1 @@
-{"version":3,"file":"fmtMoney.js","names":["FALLBACK_LOCALE","fmtMoney","n","currency","arguments","length","undefined","opts","num","Number","isFinite","locale","formatOpts","minimumFractionDigits","maximumFractionDigits","formatted","Intl","NumberFormat","format","_unused","concat"],"sources":["../../../../src/lib/v2/utils/fmtMoney.ts"],"sourcesContent":["/**\r\n * fmtMoney — format a number with locale-aware grouping.\r\n *\r\n * Returns \"—\" for null / empty / non-finite inputs (graceful empty\r\n * cells in tables — never \"NaN\" or \"∞\").\r\n *\r\n * Defaults to \"fr-FR\" for back-compat with v1 callers; pass `locale`\r\n * (BCP-47 tag) to format under any locale supported by the runtime\r\n * Intl.NumberFormat. Currency placement is a trailing suffix in the\r\n * locale-formatted number; future evolution toward `style:\"currency\"`\r\n * (locale-correct symbol position, proper RTL handling) is deliberately\r\n * deferred to avoid breaking consumers that grep on the suffix.\r\n *\r\n *   fmtMoney(1234567.5)                              → \"1 234 567,5\"\r\n *   fmtMoney(1234567.5, \"EUR\")                       → \"1 234 567,5 EUR\"\r\n *   fmtMoney(1234567.5, \"EUR\", { locale: \"en-US\" })  → \"1,234,567.5 EUR\"\r\n *   fmtMoney(1234.5,    \"\",    { minimumFractionDigits: 2 })\r\n *                                                    → \"1 234,50\"\r\n *   fmtMoney(null) / fmtMoney(\"abc\") / fmtMoney(Infinity) → \"—\"\r\n */\r\ntype FmtMoneyOptions = {\r\n  locale?: string;\r\n  minimumFractionDigits?: number;\r\n  maximumFractionDigits?: number;\r\n};\r\n\r\n/**\r\n * The locale every unresolvable request falls back to.\r\n *\r\n * ── WHY THIS IS NEGOTIATED, NOT JUST CAUGHT ─────────────────────────────\r\n *\r\n * The previous implementation relied ONLY on `try/catch`, on the assumption that\r\n * an unusable locale throws `RangeError`. It does not — and the gap was a live\r\n * defect, not a theoretical one:\r\n *\r\n *   `Intl.NumberFormat` throws only on a STRUCTURALLY INVALID tag. A tag that is\r\n *   well-formed but has no data does NOT throw — it negotiates, and with a single\r\n *   unmatched tag the negotiation lands on the RUNTIME DEFAULT LOCALE.\r\n *\r\n * `\"not-a-real-locale\"` is well-formed: `not` parses as a 3-letter language\r\n * subtag and `-a-real-locale` as a singleton `a` extension sequence. So it never\r\n * threw, the `catch` never ran, and the result was formatted in whatever locale\r\n * the host happened to default to. On a German or Spanish host that renders\r\n * `\"1.234,5\"` — dot grouping — inside a French application.\r\n *\r\n * That is a real consistency breach (Charter §09: a French UI formats numbers in\r\n * French), and it is invisible on a French dev machine, which is exactly why it\r\n * survived: the unit test caught it only because CI ran under a non-FR default.\r\n *\r\n * Listing the fallback as the SECOND preference makes the guarantee explicit:\r\n * an unmatched-but-valid tag negotiates down to fr-FR instead of to the host.\r\n * The `try/catch` is still required for genuinely malformed input.\r\n */\r\nconst FALLBACK_LOCALE = \"fr-FR\";\r\n\r\nexport default function fmtMoney(\r\n  n: number | string | null | undefined,\r\n  currency: string = \"\",\r\n  opts: FmtMoneyOptions = {}\r\n): string {\r\n  if (n == null || n === \"\") return \"—\";\r\n  const num = typeof n === \"number\" ? n : Number(n);\r\n  if (!Number.isFinite(num)) return \"—\";\r\n\r\n  const locale = opts.locale || FALLBACK_LOCALE;\r\n\r\n  const formatOpts: Intl.NumberFormatOptions = {};\r\n  if (opts.minimumFractionDigits != null) {\r\n    formatOpts.minimumFractionDigits = opts.minimumFractionDigits;\r\n  }\r\n  if (opts.maximumFractionDigits != null) {\r\n    formatOpts.maximumFractionDigits = opts.maximumFractionDigits;\r\n  }\r\n\r\n  let formatted: string;\r\n  try {\r\n    /* Requested locale first, fr-FR as the declared next preference — see\r\n     * FALLBACK_LOCALE. A resolvable request (\"en-US\") still wins outright; an\r\n     * unmatched-but-well-formed tag lands on fr-FR rather than on the host's\r\n     * default locale. */\r\n    formatted = new Intl.NumberFormat(\r\n      [locale, FALLBACK_LOCALE],\r\n      formatOpts\r\n    ).format(num);\r\n  } catch {\r\n    /* Reached only for a STRUCTURALLY invalid tag (RangeError) or a non-string\r\n     * value from an untyped host — negotiation cannot help there. */\r\n    formatted = new Intl.NumberFormat(FALLBACK_LOCALE, formatOpts).format(num);\r\n  }\r\n\r\n  return currency ? `${formatted} ${currency}` : formatted;\r\n}\r\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMA,eAAe,GAAG,OAAO;AAE/B,eAAe,SAASC,QAAQA,CAC9BC,CAAqC,EAG7B;EAAA,IAFRC,QAAgB,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,EAAE;EAAA,IACrBG,IAAqB,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAE1B,IAAIF,CAAC,IAAI,IAAI,IAAIA,CAAC,KAAK,EAAE,EAAE,OAAO,GAAG;EACrC,IAAMM,GAAG,GAAG,OAAON,CAAC,KAAK,QAAQ,GAAGA,CAAC,GAAGO,MAAM,CAACP,CAAC,CAAC;EACjD,IAAI,CAACO,MAAM,CAACC,QAAQ,CAACF,GAAG,CAAC,EAAE,OAAO,GAAG;EAErC,IAAMG,MAAM,GAAGJ,IAAI,CAACI,MAAM,IAAIX,eAAe;EAE7C,IAAMY,UAAoC,GAAG,CAAC,CAAC;EAC/C,IAAIL,IAAI,CAACM,qBAAqB,IAAI,IAAI,EAAE;IACtCD,UAAU,CAACC,qBAAqB,GAAGN,IAAI,CAACM,qBAAqB;EAC/D;EACA,IAAIN,IAAI,CAACO,qBAAqB,IAAI,IAAI,EAAE;IACtCF,UAAU,CAACE,qBAAqB,GAAGP,IAAI,CAACO,qBAAqB;EAC/D;EAEA,IAAIC,SAAiB;EACrB,IAAI;IACF;AACJ;AACA;AACA;IACIA,SAAS,GAAG,IAAIC,IAAI,CAACC,YAAY,CAC/B,CAACN,MAAM,EAAEX,eAAe,CAAC,EACzBY,UACF,CAAC,CAACM,MAAM,CAACV,GAAG,CAAC;EACf,CAAC,CAAC,OAAAW,OAAA,EAAM;IACN;AACJ;IACIJ,SAAS,GAAG,IAAIC,IAAI,CAACC,YAAY,CAACjB,eAAe,EAAEY,UAAU,CAAC,CAACM,MAAM,CAACV,GAAG,CAAC;EAC5E;EAEA,OAAOL,QAAQ,MAAAiB,MAAA,CAAML,SAAS,OAAAK,MAAA,CAAIjB,QAAQ,IAAKY,SAAS;AAC1D","ignoreList":[]}
+{"version":3,"file":"fmtMoney.js","names":["FALLBACK_LOCALE","fmtMoney","n","currency","opts","num","Number","isFinite","locale","formatOpts","minimumFractionDigits","maximumFractionDigits","formatted","Intl","NumberFormat","format"],"sources":["../../../../src/lib/v2/utils/fmtMoney.ts"],"sourcesContent":["/**\r\n * fmtMoney — format a number with locale-aware grouping.\r\n *\r\n * Returns \"—\" for null / empty / non-finite inputs (graceful empty\r\n * cells in tables — never \"NaN\" or \"∞\").\r\n *\r\n * Defaults to \"fr-FR\" for back-compat with v1 callers; pass `locale`\r\n * (BCP-47 tag) to format under any locale supported by the runtime\r\n * Intl.NumberFormat. Currency placement is a trailing suffix in the\r\n * locale-formatted number; future evolution toward `style:\"currency\"`\r\n * (locale-correct symbol position, proper RTL handling) is deliberately\r\n * deferred to avoid breaking consumers that grep on the suffix.\r\n *\r\n *   fmtMoney(1234567.5)                              → \"1 234 567,5\"\r\n *   fmtMoney(1234567.5, \"EUR\")                       → \"1 234 567,5 EUR\"\r\n *   fmtMoney(1234567.5, \"EUR\", { locale: \"en-US\" })  → \"1,234,567.5 EUR\"\r\n *   fmtMoney(1234.5,    \"\",    { minimumFractionDigits: 2 })\r\n *                                                    → \"1 234,50\"\r\n *   fmtMoney(null) / fmtMoney(\"abc\") / fmtMoney(Infinity) → \"—\"\r\n */\r\ntype FmtMoneyOptions = {\r\n  locale?: string | undefined;\r\n  minimumFractionDigits?: number | undefined;\r\n  maximumFractionDigits?: number | undefined;\r\n};\r\n\r\n/**\r\n * The locale every unresolvable request falls back to.\r\n *\r\n * ── WHY THIS IS NEGOTIATED, NOT JUST CAUGHT ─────────────────────────────\r\n *\r\n * The previous implementation relied ONLY on `try/catch`, on the assumption that\r\n * an unusable locale throws `RangeError`. It does not — and the gap was a live\r\n * defect, not a theoretical one:\r\n *\r\n *   `Intl.NumberFormat` throws only on a STRUCTURALLY INVALID tag. A tag that is\r\n *   well-formed but has no data does NOT throw — it negotiates, and with a single\r\n *   unmatched tag the negotiation lands on the RUNTIME DEFAULT LOCALE.\r\n *\r\n * `\"not-a-real-locale\"` is well-formed: `not` parses as a 3-letter language\r\n * subtag and `-a-real-locale` as a singleton `a` extension sequence. So it never\r\n * threw, the `catch` never ran, and the result was formatted in whatever locale\r\n * the host happened to default to. On a German or Spanish host that renders\r\n * `\"1.234,5\"` — dot grouping — inside a French application.\r\n *\r\n * That is a real consistency breach (Charter §09: a French UI formats numbers in\r\n * French), and it is invisible on a French dev machine, which is exactly why it\r\n * survived: the unit test caught it only because CI ran under a non-FR default.\r\n *\r\n * Listing the fallback as the SECOND preference makes the guarantee explicit:\r\n * an unmatched-but-valid tag negotiates down to fr-FR instead of to the host.\r\n * The `try/catch` is still required for genuinely malformed input.\r\n */\r\nconst FALLBACK_LOCALE = \"fr-FR\";\r\n\r\nexport default function fmtMoney(\r\n  n: number | string | null | undefined,\r\n  currency: string = \"\",\r\n  opts: FmtMoneyOptions = {}\r\n): string {\r\n  if (n == null || n === \"\") return \"—\";\r\n  const num = typeof n === \"number\" ? n : Number(n);\r\n  if (!Number.isFinite(num)) return \"—\";\r\n\r\n  const locale = opts.locale || FALLBACK_LOCALE;\r\n\r\n  const formatOpts: Intl.NumberFormatOptions = {};\r\n  if (opts.minimumFractionDigits != null) {\r\n    formatOpts.minimumFractionDigits = opts.minimumFractionDigits;\r\n  }\r\n  if (opts.maximumFractionDigits != null) {\r\n    formatOpts.maximumFractionDigits = opts.maximumFractionDigits;\r\n  }\r\n\r\n  let formatted: string;\r\n  try {\r\n    /* Requested locale first, fr-FR as the declared next preference — see\r\n     * FALLBACK_LOCALE. A resolvable request (\"en-US\") still wins outright; an\r\n     * unmatched-but-well-formed tag lands on fr-FR rather than on the host's\r\n     * default locale. */\r\n    formatted = new Intl.NumberFormat(\r\n      [locale, FALLBACK_LOCALE],\r\n      formatOpts\r\n    ).format(num);\r\n  } catch {\r\n    /* Reached only for a STRUCTURALLY invalid tag (RangeError) or a non-string\r\n     * value from an untyped host — negotiation cannot help there. */\r\n    formatted = new Intl.NumberFormat(FALLBACK_LOCALE, formatOpts).format(num);\r\n  }\r\n\r\n  return currency ? `${formatted} ${currency}` : formatted;\r\n}\r\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMA,eAAe,GAAG,OAAO;AAE/B,eAAe,SAASC,QAAQA,CAC9BC,CAAqC,EACrCC,QAAgB,GAAG,EAAE,EACrBC,IAAqB,GAAG,CAAC,CAAC,EAClB;EACR,IAAIF,CAAC,IAAI,IAAI,IAAIA,CAAC,KAAK,EAAE,EAAE,OAAO,GAAG;EACrC,MAAMG,GAAG,GAAG,OAAOH,CAAC,KAAK,QAAQ,GAAGA,CAAC,GAAGI,MAAM,CAACJ,CAAC,CAAC;EACjD,IAAI,CAACI,MAAM,CAACC,QAAQ,CAACF,GAAG,CAAC,EAAE,OAAO,GAAG;EAErC,MAAMG,MAAM,GAAGJ,IAAI,CAACI,MAAM,IAAIR,eAAe;EAE7C,MAAMS,UAAoC,GAAG,CAAC,CAAC;EAC/C,IAAIL,IAAI,CAACM,qBAAqB,IAAI,IAAI,EAAE;IACtCD,UAAU,CAACC,qBAAqB,GAAGN,IAAI,CAACM,qBAAqB;EAC/D;EACA,IAAIN,IAAI,CAACO,qBAAqB,IAAI,IAAI,EAAE;IACtCF,UAAU,CAACE,qBAAqB,GAAGP,IAAI,CAACO,qBAAqB;EAC/D;EAEA,IAAIC,SAAiB;EACrB,IAAI;IACF;AACJ;AACA;AACA;IACIA,SAAS,GAAG,IAAIC,IAAI,CAACC,YAAY,CAC/B,CAACN,MAAM,EAAER,eAAe,CAAC,EACzBS,UACF,CAAC,CAACM,MAAM,CAACV,GAAG,CAAC;EACf,CAAC,CAAC,MAAM;IACN;AACJ;IACIO,SAAS,GAAG,IAAIC,IAAI,CAACC,YAAY,CAACd,eAAe,EAAES,UAAU,CAAC,CAACM,MAAM,CAACV,GAAG,CAAC;EAC5E;EAEA,OAAOF,QAAQ,GAAG,GAAGS,SAAS,IAAIT,QAAQ,EAAE,GAAGS,SAAS;AAC1D","ignoreList":[]}

package/dist/esm/v2/utils/formikErrors.js

@@ -0,0 +1,78 @@
+/**
+ * flattenFormikErrors — Formik's nested `errors` → the flat list
+ * `FormErrorSummary` consumes (capability gap G-38).
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS BELONGS IN THE LIBRARY
+ *
+ * The library already owns BOTH ends of the failed-submit recipe that R-FV.2
+ * and R-FV.3 make mandatory:
+ *
+ *   · `FormErrorSummary`  — the banner at the top of the form, whose items are
+ *                           `{ name, message }` and whose `onItemClick` hands
+ *                           back the field NAME;
+ *   · `FormikErrorFocus` / `focusFieldByName` — the counterpart that moves
+ *                           focus, resolving that same name as `[name="…"]`.
+ *
+ * What it never shipped is the step between them. Formik's `errors` mirrors the
+ * shape of `values` — a nested object whose leaves are message strings — and
+ * nothing in the library turned that tree into the flat list both ends speak.
+ * So every Formik host wrote the recursion itself, which is a duplication the
+ * Platform TypeScript Guidelines forbid outright, and which the library invited
+ * by publishing the type (`FormErrorSummaryError`) without the one function
+ * that produces it.
+ *
+ * >>> THE FAILURE MODE IS THE PATH, AND IT IS INVISIBLE TO REVIEW. Every
+ * >>> re-implementation gets `{ name, message }` right and the ACCUMULATED PATH
+ * >>> subtly wrong — a missing separator, a skipped array index, a `[0]`
+ * >>> written where Formik writes `.0`. Nothing throws. The banner renders,
+ * >>> lists the right messages, and its jump button targets a field that does
+ * >>> not exist: `focusFieldByName` finds no node and the click does nothing.
+ * >>> A user staring at a rejected form clicks the one affordance offered to
+ * >>> find the offending field, and it silently fails.
+ * >>>
+ * >>> Promoted from `refonte-frontend` (Area 5), where it had already been
+ * >>> extracted once — out of a single page and into module-common — for
+ * >>> exactly this reason, when a second form needed it. The next module along
+ * >>> would have been the third copy. <<<
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * ARRAY ERRORS ARE TRAVERSED AS OBJECTS, DELIBERATELY. `Yup.array()` produces
+ * errors keyed by index, so the path becomes `beneficiaires.0.nom` — dot,
+ * not bracket. That is the form Formik itself produces and therefore the form
+ * the corresponding field's `name` attribute carries, which is what makes the
+ * path usable by `focusFieldByName` and by `setFieldValue` alike. Rewriting it
+ * as `beneficiaires[0].nom` would read more naturally and match nothing.
+ *
+ * Non-string leaves that are not objects (a `false`, a `null` left by a custom
+ * validator) yield nothing rather than an item with an empty message: a summary
+ * line with no text is worse than one line fewer, since it is clickable, blank,
+ * and lists no reason.
+ *
+ * Usage:
+ *
+ *   <FormErrorSummary
+ *     errors={flattenFormikErrors(formik.errors)}
+ *     onItemClick={focusFieldByName}
+ *   />
+ *
+ * The `FormErrorSummaryError` import is TYPE-ONLY and therefore erased at
+ * build time: this util does not depend on ./patterns at runtime, and the
+ * item shape keeps a single declaration next to the component that renders it
+ * rather than being restated here.
+ */
+export function flattenFormikErrors(errors, prefix = "") {
+  if (!errors || typeof errors !== "object") return [];
+  return Object.entries(errors).flatMap(([key, value]) => {
+    const path = prefix ? `${prefix}.${key}` : key;
+    if (typeof value === "string") {
+      return value.length > 0 ? [{
+        name: path,
+        message: value
+      }] : [];
+    }
+    return flattenFormikErrors(value, path);
+  });
+}
+export default flattenFormikErrors;
+//# sourceMappingURL=formikErrors.js.map

package/dist/esm/v2/utils/formikErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formikErrors.js","names":["flattenFormikErrors","errors","prefix","Object","entries","flatMap","key","value","path","length","name","message"],"sources":["../../../../src/lib/v2/utils/formikErrors.ts"],"sourcesContent":["import type { FormErrorSummaryError } from \"../patterns/FormErrorSummary\";\r\n\r\n/**\r\n * flattenFormikErrors — Formik's nested `errors` → the flat list\r\n * `FormErrorSummary` consumes (capability gap G-38).\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS BELONGS IN THE LIBRARY\r\n *\r\n * The library already owns BOTH ends of the failed-submit recipe that R-FV.2\r\n * and R-FV.3 make mandatory:\r\n *\r\n *   · `FormErrorSummary`  — the banner at the top of the form, whose items are\r\n *                           `{ name, message }` and whose `onItemClick` hands\r\n *                           back the field NAME;\r\n *   · `FormikErrorFocus` / `focusFieldByName` — the counterpart that moves\r\n *                           focus, resolving that same name as `[name=\"…\"]`.\r\n *\r\n * What it never shipped is the step between them. Formik's `errors` mirrors the\r\n * shape of `values` — a nested object whose leaves are message strings — and\r\n * nothing in the library turned that tree into the flat list both ends speak.\r\n * So every Formik host wrote the recursion itself, which is a duplication the\r\n * Platform TypeScript Guidelines forbid outright, and which the library invited\r\n * by publishing the type (`FormErrorSummaryError`) without the one function\r\n * that produces it.\r\n *\r\n * >>> THE FAILURE MODE IS THE PATH, AND IT IS INVISIBLE TO REVIEW. Every\r\n * >>> re-implementation gets `{ name, message }` right and the ACCUMULATED PATH\r\n * >>> subtly wrong — a missing separator, a skipped array index, a `[0]`\r\n * >>> written where Formik writes `.0`. Nothing throws. The banner renders,\r\n * >>> lists the right messages, and its jump button targets a field that does\r\n * >>> not exist: `focusFieldByName` finds no node and the click does nothing.\r\n * >>> A user staring at a rejected form clicks the one affordance offered to\r\n * >>> find the offending field, and it silently fails.\r\n * >>>\r\n * >>> Promoted from `refonte-frontend` (Area 5), where it had already been\r\n * >>> extracted once — out of a single page and into module-common — for\r\n * >>> exactly this reason, when a second form needed it. The next module along\r\n * >>> would have been the third copy. <<<\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n *\r\n * ARRAY ERRORS ARE TRAVERSED AS OBJECTS, DELIBERATELY. `Yup.array()` produces\r\n * errors keyed by index, so the path becomes `beneficiaires.0.nom` — dot,\r\n * not bracket. That is the form Formik itself produces and therefore the form\r\n * the corresponding field's `name` attribute carries, which is what makes the\r\n * path usable by `focusFieldByName` and by `setFieldValue` alike. Rewriting it\r\n * as `beneficiaires[0].nom` would read more naturally and match nothing.\r\n *\r\n * Non-string leaves that are not objects (a `false`, a `null` left by a custom\r\n * validator) yield nothing rather than an item with an empty message: a summary\r\n * line with no text is worse than one line fewer, since it is clickable, blank,\r\n * and lists no reason.\r\n *\r\n * Usage:\r\n *\r\n *   <FormErrorSummary\r\n *     errors={flattenFormikErrors(formik.errors)}\r\n *     onItemClick={focusFieldByName}\r\n *   />\r\n *\r\n * The `FormErrorSummaryError` import is TYPE-ONLY and therefore erased at\r\n * build time: this util does not depend on ./patterns at runtime, and the\r\n * item shape keeps a single declaration next to the component that renders it\r\n * rather than being restated here.\r\n */\r\nexport function flattenFormikErrors(\r\n  errors: unknown,\r\n  prefix = \"\"\r\n): FormErrorSummaryError[] {\r\n  if (!errors || typeof errors !== \"object\") return [];\r\n  return Object.entries(errors as Record<string, unknown>).flatMap(\r\n    ([key, value]) => {\r\n      const path = prefix ? `${prefix}.${key}` : key;\r\n      if (typeof value === \"string\") {\r\n        return value.length > 0 ? [{ name: path, message: value }] : [];\r\n      }\r\n      return flattenFormikErrors(value, path);\r\n    }\r\n  );\r\n}\r\n\r\nexport default flattenFormikErrors;\r\n"],"mappings":"AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,mBAAmBA,CACjCC,MAAe,EACfC,MAAM,GAAG,EAAE,EACc;EACzB,IAAI,CAACD,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE,OAAO,EAAE;EACpD,OAAOE,MAAM,CAACC,OAAO,CAACH,MAAiC,CAAC,CAACI,OAAO,CAC9D,CAAC,CAACC,GAAG,EAAEC,KAAK,CAAC,KAAK;IAChB,MAAMC,IAAI,GAAGN,MAAM,GAAG,GAAGA,MAAM,IAAII,GAAG,EAAE,GAAGA,GAAG;IAC9C,IAAI,OAAOC,KAAK,KAAK,QAAQ,EAAE;MAC7B,OAAOA,KAAK,CAACE,MAAM,GAAG,CAAC,GAAG,CAAC;QAAEC,IAAI,EAAEF,IAAI;QAAEG,OAAO,EAAEJ;MAAM,CAAC,CAAC,GAAG,EAAE;IACjE;IACA,OAAOP,mBAAmB,CAACO,KAAK,EAAEC,IAAI,CAAC;EACzC,CACF,CAAC;AACH;AAEA,eAAeR,mBAAmB","ignoreList":[]}

package/dist/esm/v2/utils/index.js

@@ -1,6 +1,19 @@
 export { cx } from "./cx";
 export { default as fmtMoney } from "./fmtMoney";
 
+// Date rendering for DISPLAY (gap G-51) — the counterpart of fmtMoney, which
+// this folder has owned all along for the same reason: a cell must never read
+// "NaN". Nothing existed for dates, which GU screens render far more often than
+// amounts, so every module wrote it — and every copy fed `new Date(undefined)`
+// straight into `getDate()`, rendering the literal string "NaN/NaN/NaN NaN:NaN"
+// on any optional date field. One module had added the guard at eight CALL
+// SITES across four lots before moving it into its own helper; the formatter is
+// the only place it cannot be forgotten.
+//
+// REMINDER (the G-34 invariant): this barrel is re-exported from lib/index.ts by
+// EXPLICIT NAME LIST, so these two must be added there in the SAME commit or
+// they never reach a consumer.
+export { fmtDate, fmtDateTime } from "./fmtDate";
 // Undefined-safe label merge. Every localisable component used to write
 // `labels ? { ...DEFAULTS, ...labels } : DEFAULTS`, and a spread does NOT skip
 // explicit `undefined` — so an override of `undefined` DELETED the default and
@@ -16,13 +29,25 @@ export { mergeLabels } from "./mergeLabels";
 // is the common call site — qualifying it would only add noise.
 export { downloadBase64File, getMimeType, openBase64FileInTab, downloadBlobFile } from "./fileDownload";
 
+// Upload validation (gap G-52). `Dropzone` takes an `accept` attribute and
+// reports rejections, but validates NOTHING — `accept` is a file-picker filter
+// that drag-and-drop ignores. So every host decided for itself, and each wrote
+// the same two non-business parts alongside its own extension allow-list: a
+// deny-list of executables and scripts, and an extension/MIME cross-check with
+// its browser tolerances. A security decision copied into fifteen modules
+// drifts, and drifts SILENTLY. The host keeps its allow-list; the library owns
+// the deny-list and the cross-check.
+//
+// REMINDER (the G-34 invariant): added to lib/index.ts in the same commit.
+export { isForbiddenExecutable, isAcceptedFile, getFileRejection, describeAcceptedTypes, toAcceptAttribute } from "./fileValidation";
 // WCAG 2.1 contrast utilities. Re-exported under a namespace at
 // the public barrel (v2.contrast.*) so the named API is grouped
 // and self-describing for callers — used to validate runtime
 // brand overrides against WCAG 1.4.3 and to audit dark-mode
 // token pairs (F29).
-import * as _contrast from "./contrast";
-export { _contrast as contrast }; // `unknown`-rejection narrowing. Mandated by the platform's own
+export * as contrast from "./contrast";
+
+// `unknown`-rejection narrowing. Mandated by the platform's own
 // `useUnknownInCatchVariables` flag, which makes `catch (e)` bind `unknown` in
 // every consuming saga while `any` and unsafe assertions stay forbidden — the
 // library previously left no sanctioned route between those two rules, and the
@@ -40,4 +65,12 @@ export { getApiErrorMessage, getApiErrorDetail, getApiErrorStatus, DEFAULT_API_E
 // subscribe/report/clear channel. Raised as capability gap G-03
 // (procuration-portnet-fe Area 5).
 export { networkStatus, createNetworkStatus } from "./networkStatus";
+// Formik's nested `errors` -> the flat `{ name, message }[]` that
+// FormErrorSummary consumes and focusFieldByName resolves. The library owned
+// both ends of the R-FV.2 / R-FV.3 recipe and not the step between them, so
+// every Formik host wrote the recursion — and each copy got the accumulated
+// PATH subtly wrong, which fails silently: the summary lists the right
+// messages and its jump button targets a field that does not exist.
+// Capability gap G-38 (refonte-frontend Area 5).
+export { flattenFormikErrors } from "./formikErrors";
 //# sourceMappingURL=index.js.map

package/dist/esm/v2/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["cx","default","fmtMoney","mergeLabels","downloadBase64File","getMimeType","openBase64FileInTab","downloadBlobFile","_contrast","contrast","getApiErrorMessage","getApiErrorDetail","getApiErrorStatus","DEFAULT_API_ERROR_MESSAGE","networkStatus","createNetworkStatus"],"sources":["../../../../src/lib/v2/utils/index.ts"],"sourcesContent":["export { cx }                  from \"./cx\";\r\nexport { default as fmtMoney } from \"./fmtMoney\";\r\n\r\n// Undefined-safe label merge. Every localisable component used to write\r\n// `labels ? { ...DEFAULTS, ...labels } : DEFAULTS`, and a spread does NOT skip\r\n// explicit `undefined` — so an override of `undefined` DELETED the default and\r\n// the component threw `L.x is not a function` at render. Eleven components\r\n// shipped that hazard; the `?: T` declarations hid it from the compiler by\r\n// asserting the merged value could never be undefined, which was false at\r\n// runtime. Surfaced by the G-14 widening. Latent runtime defect, not cosmetics.\r\nexport { mergeLabels } from \"./mergeLabels\";\r\n\r\n// Base64 → browser download, plus the extension→MIME map it uses.\r\n// Flat named exports (not a namespace like contrast below): two\r\n// independent functions with no shared state, and downloadBase64File\r\n// is the common call site — qualifying it would only add noise.\r\nexport {\r\n  downloadBase64File,\r\n  getMimeType,\r\n  openBase64FileInTab,\r\n  downloadBlobFile,\r\n} from \"./fileDownload\";\r\n\r\n// WCAG 2.1 contrast utilities. Re-exported under a namespace at\r\n// the public barrel (v2.contrast.*) so the named API is grouped\r\n// and self-describing for callers — used to validate runtime\r\n// brand overrides against WCAG 1.4.3 and to audit dark-mode\r\n// token pairs (F29).\r\nexport * as contrast from \"./contrast\";\r\n\r\n// `unknown`-rejection narrowing. Mandated by the platform's own\r\n// `useUnknownInCatchVariables` flag, which makes `catch (e)` bind `unknown` in\r\n// every consuming saga while `any` and unsafe assertions stay forbidden — the\r\n// library previously left no sanctioned route between those two rules, and the\r\n// modules that filled the gap filled it with the forbidden construct.\r\n// Raised as capability gap G-04 (procuration-portnet-fe Area 5).\r\n//\r\n// `getApiErrorDetail` is the LOGGING counterpart added with G-07: since\r\n// `getApiErrorMessage` now suppresses axios transport phrasings so they cannot\r\n// reach a user (Charter §09.3), operators still need the unfiltered string for a\r\n// console or an APM breadcrumb. Display one, log the other.\r\nexport {\r\n  getApiErrorMessage,\r\n  getApiErrorDetail,\r\n  getApiErrorStatus,\r\n  DEFAULT_API_ERROR_MESSAGE,\r\n} from \"./apiError\";\r\n\r\n// The feed behind NetworkErrorBanner. The banner was exported without the\r\n// plumbing that decides when it shows, so every module rebuilt the same\r\n// subscribe/report/clear channel. Raised as capability gap G-03\r\n// (procuration-portnet-fe Area 5).\r\nexport { networkStatus, createNetworkStatus } from \"./networkStatus\";\r\nexport type { NetworkStatus, NetworkStatusListener } from \"./networkStatus\";\r\n"],"mappings":"AAAA,SAASA,EAAE,QAAyB,MAAM;AAC1C,SAASC,OAAO,IAAIC,QAAQ,QAAQ,YAAY;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,WAAW,QAAQ,eAAe;;AAE3C;AACA;AACA;AACA;AACA,SACEC,kBAAkB,EAClBC,WAAW,EACXC,mBAAmB,EACnBC,gBAAgB,QACX,gBAAgB;;AAEvB;AACA;AACA;AACA;AACA;AAAA,YAAAC,SAAA,MAC0B,YAAY;AAAA,SAAAA,SAAA,IAA1BC,QAAQ,IAEpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,iBAAiB,EACjBC,yBAAyB,QACpB,YAAY;;AAEnB;AACA;AACA;AACA;AACA,SAASC,aAAa,EAAEC,mBAAmB,QAAQ,iBAAiB","ignoreList":[]}
+{"version":3,"file":"index.js","names":["cx","default","fmtMoney","fmtDate","fmtDateTime","mergeLabels","downloadBase64File","getMimeType","openBase64FileInTab","downloadBlobFile","isForbiddenExecutable","isAcceptedFile","getFileRejection","describeAcceptedTypes","toAcceptAttribute","contrast","getApiErrorMessage","getApiErrorDetail","getApiErrorStatus","DEFAULT_API_ERROR_MESSAGE","networkStatus","createNetworkStatus","flattenFormikErrors"],"sources":["../../../../src/lib/v2/utils/index.ts"],"sourcesContent":["export { cx }                  from \"./cx\";\r\nexport { default as fmtMoney } from \"./fmtMoney\";\r\n\r\n// Date rendering for DISPLAY (gap G-51) — the counterpart of fmtMoney, which\r\n// this folder has owned all along for the same reason: a cell must never read\r\n// \"NaN\". Nothing existed for dates, which GU screens render far more often than\r\n// amounts, so every module wrote it — and every copy fed `new Date(undefined)`\r\n// straight into `getDate()`, rendering the literal string \"NaN/NaN/NaN NaN:NaN\"\r\n// on any optional date field. One module had added the guard at eight CALL\r\n// SITES across four lots before moving it into its own helper; the formatter is\r\n// the only place it cannot be forgotten.\r\n//\r\n// REMINDER (the G-34 invariant): this barrel is re-exported from lib/index.ts by\r\n// EXPLICIT NAME LIST, so these two must be added there in the SAME commit or\r\n// they never reach a consumer.\r\nexport { fmtDate, fmtDateTime } from \"./fmtDate\";\r\nexport type { FmtDateInput, FmtDateOptions } from \"./fmtDate\";\r\n\r\n// Undefined-safe label merge. Every localisable component used to write\r\n// `labels ? { ...DEFAULTS, ...labels } : DEFAULTS`, and a spread does NOT skip\r\n// explicit `undefined` — so an override of `undefined` DELETED the default and\r\n// the component threw `L.x is not a function` at render. Eleven components\r\n// shipped that hazard; the `?: T` declarations hid it from the compiler by\r\n// asserting the merged value could never be undefined, which was false at\r\n// runtime. Surfaced by the G-14 widening. Latent runtime defect, not cosmetics.\r\nexport { mergeLabels } from \"./mergeLabels\";\r\n\r\n// Base64 → browser download, plus the extension→MIME map it uses.\r\n// Flat named exports (not a namespace like contrast below): two\r\n// independent functions with no shared state, and downloadBase64File\r\n// is the common call site — qualifying it would only add noise.\r\nexport {\r\n  downloadBase64File,\r\n  getMimeType,\r\n  openBase64FileInTab,\r\n  downloadBlobFile,\r\n} from \"./fileDownload\";\r\n\r\n// Upload validation (gap G-52). `Dropzone` takes an `accept` attribute and\r\n// reports rejections, but validates NOTHING — `accept` is a file-picker filter\r\n// that drag-and-drop ignores. So every host decided for itself, and each wrote\r\n// the same two non-business parts alongside its own extension allow-list: a\r\n// deny-list of executables and scripts, and an extension/MIME cross-check with\r\n// its browser tolerances. A security decision copied into fifteen modules\r\n// drifts, and drifts SILENTLY. The host keeps its allow-list; the library owns\r\n// the deny-list and the cross-check.\r\n//\r\n// REMINDER (the G-34 invariant): added to lib/index.ts in the same commit.\r\nexport {\r\n  isForbiddenExecutable,\r\n  isAcceptedFile,\r\n  getFileRejection,\r\n  describeAcceptedTypes,\r\n  toAcceptAttribute,\r\n} from \"./fileValidation\";\r\nexport type {\r\n  FileAcceptPolicy,\r\n  FileRejection,\r\n  FileRejectionReason,\r\n} from \"./fileValidation\";\r\n\r\n// WCAG 2.1 contrast utilities. Re-exported under a namespace at\r\n// the public barrel (v2.contrast.*) so the named API is grouped\r\n// and self-describing for callers — used to validate runtime\r\n// brand overrides against WCAG 1.4.3 and to audit dark-mode\r\n// token pairs (F29).\r\nexport * as contrast from \"./contrast\";\r\n\r\n// `unknown`-rejection narrowing. Mandated by the platform's own\r\n// `useUnknownInCatchVariables` flag, which makes `catch (e)` bind `unknown` in\r\n// every consuming saga while `any` and unsafe assertions stay forbidden — the\r\n// library previously left no sanctioned route between those two rules, and the\r\n// modules that filled the gap filled it with the forbidden construct.\r\n// Raised as capability gap G-04 (procuration-portnet-fe Area 5).\r\n//\r\n// `getApiErrorDetail` is the LOGGING counterpart added with G-07: since\r\n// `getApiErrorMessage` now suppresses axios transport phrasings so they cannot\r\n// reach a user (Charter §09.3), operators still need the unfiltered string for a\r\n// console or an APM breadcrumb. Display one, log the other.\r\nexport {\r\n  getApiErrorMessage,\r\n  getApiErrorDetail,\r\n  getApiErrorStatus,\r\n  DEFAULT_API_ERROR_MESSAGE,\r\n} from \"./apiError\";\r\n\r\n// The feed behind NetworkErrorBanner. The banner was exported without the\r\n// plumbing that decides when it shows, so every module rebuilt the same\r\n// subscribe/report/clear channel. Raised as capability gap G-03\r\n// (procuration-portnet-fe Area 5).\r\nexport { networkStatus, createNetworkStatus } from \"./networkStatus\";\r\nexport type { NetworkStatus, NetworkStatusListener } from \"./networkStatus\";\r\n\r\n// Formik's nested `errors` -> the flat `{ name, message }[]` that\r\n// FormErrorSummary consumes and focusFieldByName resolves. The library owned\r\n// both ends of the R-FV.2 / R-FV.3 recipe and not the step between them, so\r\n// every Formik host wrote the recursion — and each copy got the accumulated\r\n// PATH subtly wrong, which fails silently: the summary lists the right\r\n// messages and its jump button targets a field that does not exist.\r\n// Capability gap G-38 (refonte-frontend Area 5).\r\nexport { flattenFormikErrors } from \"./formikErrors\";\r\n"],"mappings":"AAAA,SAASA,EAAE,QAAyB,MAAM;AAC1C,SAASC,OAAO,IAAIC,QAAQ,QAAQ,YAAY;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,OAAO,EAAEC,WAAW,QAAQ,WAAW;AAGhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,WAAW,QAAQ,eAAe;;AAE3C;AACA;AACA;AACA;AACA,SACEC,kBAAkB,EAClBC,WAAW,EACXC,mBAAmB,EACnBC,gBAAgB,QACX,gBAAgB;;AAEvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEC,qBAAqB,EACrBC,cAAc,EACdC,gBAAgB,EAChBC,qBAAqB,EACrBC,iBAAiB,QACZ,kBAAkB;AAOzB;AACA;AACA;AACA;AACA;AACA,OAAO,KAAKC,QAAQ,MAAM,YAAY;;AAEtC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,iBAAiB,EACjBC,yBAAyB,QACpB,YAAY;;AAEnB;AACA;AACA;AACA;AACA,SAASC,aAAa,EAAEC,mBAAmB,QAAQ,iBAAiB;AAGpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,mBAAmB,QAAQ,gBAAgB","ignoreList":[]}

package/dist/esm/v2/utils/mergeLabels.js

@@ -1,9 +1,3 @@
-function _typeof(obj) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (obj) { return typeof obj; } : function (obj) { return obj && "function" == typeof Symbol && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; }, _typeof(obj); }
-function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
-function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { _defineProperty(target, key, source[key]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } return target; }
-function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
-function _toPropertyKey(arg) { var key = _toPrimitive(arg, "string"); return _typeof(key) === "symbol" ? key : String(key); }
-function _toPrimitive(input, hint) { if (_typeof(input) !== "object" || input === null) return input; var prim = input[Symbol.toPrimitive]; if (prim !== undefined) { var res = prim.call(input, hint || "default"); if (_typeof(res) !== "object") return res; throw new TypeError("@@toPrimitive must return a primitive value."); } return (hint === "string" ? String : Number)(input); }
 /**
  * mergeLabels — Portnet UI v2
  *
@@ -64,11 +58,10 @@ export function mergeLabels(defaults, overrides) {
   // Single documented assertion, guarded by the `!overrides` check above: the
   // mapped parameter type deliberately says nothing about value types, so the
   // only way to read them is through an index signature.
-  var source = overrides;
-  var out;
-  for (var _i = 0, _Object$keys = Object.keys(source); _i < _Object$keys.length; _i++) {
-    var key = _Object$keys[_i];
-    var value = source[key];
+  const source = overrides;
+  let out;
+  for (const key of Object.keys(source)) {
+    const value = source[key];
     // THE point of this helper. `undefined` means "not specified", never
     // "unset the default".
     if (value === undefined) continue;
@@ -77,7 +70,9 @@ export function mergeLabels(defaults, overrides) {
     // LAZILY — only once a real override is found — so the common paths (no
     // overrides at all, or an object whose every value is undefined) return the
     // defaults object itself and stay referentially stable across renders.
-    if (!out) out = _objectSpread({}, defaults);
+    if (!out) out = {
+      ...defaults
+    };
     out[key] = value;
   }
   return out === undefined ? defaults : out;

package/dist/esm/v2/utils/mergeLabels.js.map

@@ -1 +1 @@
-{"version":3,"file":"mergeLabels.js","names":["mergeLabels","defaults","overrides","source","out","_i","_Object$keys","Object","keys","length","key","value","undefined","_objectSpread"],"sources":["../../../../src/lib/v2/utils/mergeLabels.ts"],"sourcesContent":["/**\r\n * mergeLabels — Portnet UI v2\r\n *\r\n * Merges a consumer's partial label overrides onto a component's frozen\r\n * defaults, IGNORING keys whose value is `undefined`.\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS EXISTS (capability gap G-14, latent runtime defect)\r\n *\r\n * Every localisable component in this library merged its labels like this:\r\n *\r\n *     const L = labels ? { ...DEFAULT_LABELS, ...labels } : DEFAULT_LABELS;\r\n *\r\n * A spread does NOT skip explicit `undefined`. `{ ...{a: 1}, ...{a: undefined} }`\r\n * is `{ a: undefined }` — so a consumer writing\r\n *\r\n *     <FilterTab labels={{ countLabel: maybeFn }} />   // maybeFn possibly undefined\r\n *\r\n * silently DELETED the default and the component then threw\r\n * `L.countLabel is not a function` at render time. Eleven components shipped\r\n * that hazard.\r\n *\r\n * It stayed invisible because the label interfaces declared `?: T` rather than\r\n * `?: T | undefined`: under that declaration TypeScript concluded the merged\r\n * value could never be `undefined`, which is false at runtime. Widening the\r\n * optional props (G-14) removed the blindfold and the compiler reported all\r\n * seventeen call sites at once. The types were wrong; the code was wrong; only\r\n * the combination of the two looked right.\r\n *\r\n * The fix restores what every call site already intended: an override REPLACES a\r\n * default, an absent or `undefined` override LEAVES it alone.\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n *\r\n *     const L = mergeLabels(DEFAULT_LABELS, labels);\r\n *     //    ^ every key guaranteed present, typed from the defaults\r\n *\r\n * The return type is the DEFAULTS' type, deliberately: defaults are the\r\n * exhaustive, all-required shape, so the component can call `L.anything()`\r\n * without a null check. That is the whole point.\r\n *\r\n * `overrides` is a mapped type over `keyof TDefaults` with `unknown` values\r\n * rather than `Partial<TDefaults>`. Two reasons, both load-bearing:\r\n *   - a mapped type accepts an INTERFACE argument, whereas `Record<string,\r\n *     unknown>` would not (TypeScript grants implicit index signatures to type\r\n *     aliases, not to interfaces), and most label contracts here are interfaces;\r\n *   - some label interfaces legitimately widen a default's type (`React.ReactNode`\r\n *     where the default is a `string`), which `Partial<TDefaults>` would reject.\r\n *     Value types are already checked at the component's `labels` prop boundary,\r\n *     so nothing is lost by not re-checking them here.\r\n *\r\n * Returns the defaults object ITSELF when there is nothing to override, so the\r\n * common path allocates nothing and stays referentially stable across renders —\r\n * which matters because these results are routinely wrapped in `useMemo`.\r\n */\r\nexport function mergeLabels<TDefaults extends object>(\r\n  defaults: TDefaults,\r\n  overrides?: { readonly [K in keyof TDefaults]?: unknown } | undefined\r\n): TDefaults {\r\n  if (!overrides) return defaults;\r\n\r\n  // Single documented assertion, guarded by the `!overrides` check above: the\r\n  // mapped parameter type deliberately says nothing about value types, so the\r\n  // only way to read them is through an index signature.\r\n  const source = overrides as Record<string, unknown>;\r\n\r\n  let out: Record<string, unknown> | undefined;\r\n\r\n  for (const key of Object.keys(source)) {\r\n    const value = source[key];\r\n    // THE point of this helper. `undefined` means \"not specified\", never\r\n    // \"unset the default\".\r\n    if (value === undefined) continue;\r\n    // Second assertion, same cause: `TDefaults extends object` carries no index\r\n    // signature, so spreading it into a writable record needs one. Allocated\r\n    // LAZILY — only once a real override is found — so the common paths (no\r\n    // overrides at all, or an object whose every value is undefined) return the\r\n    // defaults object itself and stay referentially stable across renders.\r\n    if (!out) out = { ...(defaults as Record<string, unknown>) };\r\n    out[key] = value;\r\n  }\r\n\r\n  return out === undefined ? defaults : (out as TDefaults);\r\n}\r\n\r\nexport default mergeLabels;\r\n"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,WAAWA,CACzBC,QAAmB,EACnBC,SAAqE,EAC1D;EACX,IAAI,CAACA,SAAS,EAAE,OAAOD,QAAQ;;EAE/B;EACA;EACA;EACA,IAAME,MAAM,GAAGD,SAAoC;EAEnD,IAAIE,GAAwC;EAE5C,SAAAC,EAAA,MAAAC,YAAA,GAAkBC,MAAM,CAACC,IAAI,CAACL,MAAM,CAAC,EAAAE,EAAA,GAAAC,YAAA,CAAAG,MAAA,EAAAJ,EAAA,IAAE;IAAlC,IAAMK,GAAG,GAAAJ,YAAA,CAAAD,EAAA;IACZ,IAAMM,KAAK,GAAGR,MAAM,CAACO,GAAG,CAAC;IACzB;IACA;IACA,IAAIC,KAAK,KAAKC,SAAS,EAAE;IACzB;IACA;IACA;IACA;IACA;IACA,IAAI,CAACR,GAAG,EAAEA,GAAG,GAAAS,aAAA,KAASZ,QAAQ,CAA8B;IAC5DG,GAAG,CAACM,GAAG,CAAC,GAAGC,KAAK;EAClB;EAEA,OAAOP,GAAG,KAAKQ,SAAS,GAAGX,QAAQ,GAAIG,GAAiB;AAC1D;AAEA,eAAeJ,WAAW","ignoreList":[]}
+{"version":3,"file":"mergeLabels.js","names":["mergeLabels","defaults","overrides","source","out","key","Object","keys","value","undefined"],"sources":["../../../../src/lib/v2/utils/mergeLabels.ts"],"sourcesContent":["/**\r\n * mergeLabels — Portnet UI v2\r\n *\r\n * Merges a consumer's partial label overrides onto a component's frozen\r\n * defaults, IGNORING keys whose value is `undefined`.\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS EXISTS (capability gap G-14, latent runtime defect)\r\n *\r\n * Every localisable component in this library merged its labels like this:\r\n *\r\n *     const L = labels ? { ...DEFAULT_LABELS, ...labels } : DEFAULT_LABELS;\r\n *\r\n * A spread does NOT skip explicit `undefined`. `{ ...{a: 1}, ...{a: undefined} }`\r\n * is `{ a: undefined }` — so a consumer writing\r\n *\r\n *     <FilterTab labels={{ countLabel: maybeFn }} />   // maybeFn possibly undefined\r\n *\r\n * silently DELETED the default and the component then threw\r\n * `L.countLabel is not a function` at render time. Eleven components shipped\r\n * that hazard.\r\n *\r\n * It stayed invisible because the label interfaces declared `?: T` rather than\r\n * `?: T | undefined`: under that declaration TypeScript concluded the merged\r\n * value could never be `undefined`, which is false at runtime. Widening the\r\n * optional props (G-14) removed the blindfold and the compiler reported all\r\n * seventeen call sites at once. The types were wrong; the code was wrong; only\r\n * the combination of the two looked right.\r\n *\r\n * The fix restores what every call site already intended: an override REPLACES a\r\n * default, an absent or `undefined` override LEAVES it alone.\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n *\r\n *     const L = mergeLabels(DEFAULT_LABELS, labels);\r\n *     //    ^ every key guaranteed present, typed from the defaults\r\n *\r\n * The return type is the DEFAULTS' type, deliberately: defaults are the\r\n * exhaustive, all-required shape, so the component can call `L.anything()`\r\n * without a null check. That is the whole point.\r\n *\r\n * `overrides` is a mapped type over `keyof TDefaults` with `unknown` values\r\n * rather than `Partial<TDefaults>`. Two reasons, both load-bearing:\r\n *   - a mapped type accepts an INTERFACE argument, whereas `Record<string,\r\n *     unknown>` would not (TypeScript grants implicit index signatures to type\r\n *     aliases, not to interfaces), and most label contracts here are interfaces;\r\n *   - some label interfaces legitimately widen a default's type (`React.ReactNode`\r\n *     where the default is a `string`), which `Partial<TDefaults>` would reject.\r\n *     Value types are already checked at the component's `labels` prop boundary,\r\n *     so nothing is lost by not re-checking them here.\r\n *\r\n * Returns the defaults object ITSELF when there is nothing to override, so the\r\n * common path allocates nothing and stays referentially stable across renders —\r\n * which matters because these results are routinely wrapped in `useMemo`.\r\n */\r\nexport function mergeLabels<TDefaults extends object>(\r\n  defaults: TDefaults,\r\n  overrides?: { readonly [K in keyof TDefaults]?: unknown } | undefined\r\n): TDefaults {\r\n  if (!overrides) return defaults;\r\n\r\n  // Single documented assertion, guarded by the `!overrides` check above: the\r\n  // mapped parameter type deliberately says nothing about value types, so the\r\n  // only way to read them is through an index signature.\r\n  const source = overrides as Record<string, unknown>;\r\n\r\n  let out: Record<string, unknown> | undefined;\r\n\r\n  for (const key of Object.keys(source)) {\r\n    const value = source[key];\r\n    // THE point of this helper. `undefined` means \"not specified\", never\r\n    // \"unset the default\".\r\n    if (value === undefined) continue;\r\n    // Second assertion, same cause: `TDefaults extends object` carries no index\r\n    // signature, so spreading it into a writable record needs one. Allocated\r\n    // LAZILY — only once a real override is found — so the common paths (no\r\n    // overrides at all, or an object whose every value is undefined) return the\r\n    // defaults object itself and stay referentially stable across renders.\r\n    if (!out) out = { ...(defaults as Record<string, unknown>) };\r\n    out[key] = value;\r\n  }\r\n\r\n  return out === undefined ? defaults : (out as TDefaults);\r\n}\r\n\r\nexport default mergeLabels;\r\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,WAAWA,CACzBC,QAAmB,EACnBC,SAAqE,EAC1D;EACX,IAAI,CAACA,SAAS,EAAE,OAAOD,QAAQ;;EAE/B;EACA;EACA;EACA,MAAME,MAAM,GAAGD,SAAoC;EAEnD,IAAIE,GAAwC;EAE5C,KAAK,MAAMC,GAAG,IAAIC,MAAM,CAACC,IAAI,CAACJ,MAAM,CAAC,EAAE;IACrC,MAAMK,KAAK,GAAGL,MAAM,CAACE,GAAG,CAAC;IACzB;IACA;IACA,IAAIG,KAAK,KAAKC,SAAS,EAAE;IACzB;IACA;IACA;IACA;IACA;IACA,IAAI,CAACL,GAAG,EAAEA,GAAG,GAAG;MAAE,GAAIH;IAAqC,CAAC;IAC5DG,GAAG,CAACC,GAAG,CAAC,GAAGG,KAAK;EAClB;EAEA,OAAOJ,GAAG,KAAKK,SAAS,GAAGR,QAAQ,GAAIG,GAAiB;AAC1D;AAEA,eAAeJ,WAAW","ignoreList":[]}

package/dist/esm/v2/utils/networkStatus.js

@@ -66,24 +66,24 @@
  * Application code should normally use the `networkStatus` export below.
  */
 export function createNetworkStatus() {
-  var subscribers = new Set();
-  var lastError = null;
-  var channel = {
-    subscribe: function subscribe(listener) {
+  const subscribers = new Set();
+  let lastError = null;
+  const channel = {
+    subscribe(listener) {
       subscribers.add(listener);
       if (lastError !== null) listener(lastError);
-      return function () {
-        subscribers["delete"](listener);
+      return () => {
+        subscribers.delete(listener);
       };
     },
-    report: function report(message) {
-      var next = message || null;
+    report(message) {
+      const next = message || null;
       /* De-duplicated: a flaky link can fail many times per second, and
        * re-notifying an unchanged message would re-render every subscriber for
        * no visible difference. */
       if (lastError === next) return;
       lastError = next;
-      subscribers.forEach(function (listener) {
+      subscribers.forEach(listener => {
         try {
           listener(lastError);
         } catch (e) {
@@ -95,10 +95,10 @@ export function createNetworkStatus() {
         }
       });
     },
-    clear: function clear() {
+    clear() {
       channel.report(null);
     },
-    current: function current() {
+    current() {
       return lastError;
     }
   };
@@ -109,6 +109,6 @@ export function createNetworkStatus() {
  * The shared channel. One per bundle, which is the right granularity: the
  * transport layer and the banner must agree, and both live in the same app.
  */
-export var networkStatus = createNetworkStatus();
+export const networkStatus = createNetworkStatus();
 export default networkStatus;
 //# sourceMappingURL=networkStatus.js.map

package/dist/esm/v2/utils/networkStatus.js.map

@@ -1 +1 @@
-{"version":3,"file":"networkStatus.js","names":["createNetworkStatus","subscribers","Set","lastError","channel","subscribe","listener","add","report","message","next","forEach","e","console","error","clear","current","networkStatus"],"sources":["../../../../src/lib/v2/utils/networkStatus.ts"],"sourcesContent":["/**\r\n * networkStatus — the feed behind `NetworkErrorBanner`.\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS BELONGS IN THE LIBRARY (capability gap G-03)\r\n *\r\n * The library shipped `NetworkErrorBanner` — a presentational component — but\r\n * not the plumbing that decides when it appears. Charter R-A.3 / R-4.3 make the\r\n * banner MANDATORY (\"erreur réseau → bandeau persistant top, bouton\r\n * « Réessayer »\"), so every consuming module had to invent the same\r\n * subscribe / report / clear singleton and the same transport-interceptor\r\n * bridge. Two audited modules (`procuration-portnet-fe`, `procuration-fe`) had\r\n * each written their own.\r\n *\r\n * A presentational component whose trigger contract is left to consumers\r\n * guarantees divergence in precisely the state users encounter least often and\r\n * trust least — the offline path.\r\n *\r\n * NOT a redux slice, deliberately\r\n * -------------------------------\r\n * This state is presentation-only and high-frequency on a flaky link. Crossing a\r\n * dispatch boundary on every retry would slow the alert path for no benefit, and\r\n * would force the library to take an opinion on the host's store.\r\n *\r\n * Late subscribers are hydrated on subscribe, so a banner that mounts after the\r\n * failure (lazy route, remount) still shows the current state instead of missing\r\n * the edge.\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n *\r\n * Wiring (once, at the app root):\r\n *\r\n *   const [netError, setNetError] = useState<string | null>(null);\r\n *   useEffect(() => networkStatus.subscribe(setNetError), []);\r\n *\r\n *   <NetworkErrorBanner\r\n *     visible={Boolean(netError)}\r\n *     message={netError ?? \"\"}\r\n *     onRetry={() => { networkStatus.clear(); window.location.reload(); }}\r\n *   />\r\n *\r\n * And in the transport layer:\r\n *\r\n *   instance.interceptors.response.use(\r\n *     (response) => { networkStatus.clear(); return response; },\r\n *     (error: unknown) => {\r\n *       if (getApiErrorStatus(error) === undefined) {\r\n *         networkStatus.report(\"Connexion perdue. Vérifiez votre réseau, puis réessayez.\");\r\n *       }\r\n *       return Promise.reject(error);\r\n *     }\r\n *   );\r\n *\r\n * A status-less failure is the network case (offline, DNS, ingress timeout); a\r\n * failure WITH a status is a server error and belongs in a toast (R-A.4).\r\n */\r\n\r\n/** Receives the latest banner message, or `null` when the banner should clear. */\r\nexport type NetworkStatusListener = (message: string | null) => void;\r\n\r\n/** Public shape of a network-status channel. */\r\nexport interface NetworkStatus {\r\n  /**\r\n   * Subscribe to changes. The listener is invoked immediately with the current\r\n   * state when that state is non-null, so a late-mounting banner hydrates\r\n   * instead of missing the transition. Returns an unsubscribe function suitable\r\n   * for returning directly from `useEffect`.\r\n   */\r\n  subscribe(listener: NetworkStatusListener): () => void;\r\n  /** Report a global network failure. `null` (or omitted) clears. */\r\n  report(message?: string | null): void;\r\n  /** Clear the banner. Equivalent to `report(null)`. */\r\n  clear(): void;\r\n  /** Current message, or `null`. Useful in tests and for SSR snapshots. */\r\n  current(): string | null;\r\n}\r\n\r\n/**\r\n * Create an independent network-status channel.\r\n *\r\n * Exported alongside the shared singleton so tests can use an isolated instance\r\n * — a module-level singleton shared between test cases leaks state across them.\r\n * Application code should normally use the `networkStatus` export below.\r\n */\r\nexport function createNetworkStatus(): NetworkStatus {\r\n  const subscribers = new Set<NetworkStatusListener>();\r\n  let lastError: string | null = null;\r\n\r\n  const channel: NetworkStatus = {\r\n    subscribe(listener) {\r\n      subscribers.add(listener);\r\n      if (lastError !== null) listener(lastError);\r\n      return () => {\r\n        subscribers.delete(listener);\r\n      };\r\n    },\r\n\r\n    report(message) {\r\n      const next = message || null;\r\n      /* De-duplicated: a flaky link can fail many times per second, and\r\n       * re-notifying an unchanged message would re-render every subscriber for\r\n       * no visible difference. */\r\n      if (lastError === next) return;\r\n      lastError = next;\r\n      subscribers.forEach((listener) => {\r\n        try {\r\n          listener(lastError);\r\n        } catch (e) {\r\n          /* One bad subscriber must not stop the others from being notified,\r\n           * and must not propagate into the transport layer that reported the\r\n           * failure. */\r\n          // eslint-disable-next-line no-console\r\n          console.error(\"[@portnet/ui networkStatus] subscriber threw:\", e);\r\n        }\r\n      });\r\n    },\r\n\r\n    clear() {\r\n      channel.report(null);\r\n    },\r\n\r\n    current() {\r\n      return lastError;\r\n    },\r\n  };\r\n\r\n  return channel;\r\n}\r\n\r\n/**\r\n * The shared channel. One per bundle, which is the right granularity: the\r\n * transport layer and the banner must agree, and both live in the same app.\r\n */\r\nexport const networkStatus: NetworkStatus = createNetworkStatus();\r\n\r\nexport default networkStatus;\r\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAGA;;AAiBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,mBAAmBA,CAAA,EAAkB;EACnD,IAAMC,WAAW,GAAG,IAAIC,GAAG,CAAwB,CAAC;EACpD,IAAIC,SAAwB,GAAG,IAAI;EAEnC,IAAMC,OAAsB,GAAG;IAC7BC,SAAS,WAAAA,UAACC,QAAQ,EAAE;MAClBL,WAAW,CAACM,GAAG,CAACD,QAAQ,CAAC;MACzB,IAAIH,SAAS,KAAK,IAAI,EAAEG,QAAQ,CAACH,SAAS,CAAC;MAC3C,OAAO,YAAM;QACXF,WAAW,UAAO,CAACK,QAAQ,CAAC;MAC9B,CAAC;IACH,CAAC;IAEDE,MAAM,WAAAA,OAACC,OAAO,EAAE;MACd,IAAMC,IAAI,GAAGD,OAAO,IAAI,IAAI;MAC5B;AACN;AACA;MACM,IAAIN,SAAS,KAAKO,IAAI,EAAE;MACxBP,SAAS,GAAGO,IAAI;MAChBT,WAAW,CAACU,OAAO,CAAC,UAACL,QAAQ,EAAK;QAChC,IAAI;UACFA,QAAQ,CAACH,SAAS,CAAC;QACrB,CAAC,CAAC,OAAOS,CAAC,EAAE;UACV;AACV;AACA;UACU;UACAC,OAAO,CAACC,KAAK,CAAC,+CAA+C,EAAEF,CAAC,CAAC;QACnE;MACF,CAAC,CAAC;IACJ,CAAC;IAEDG,KAAK,WAAAA,MAAA,EAAG;MACNX,OAAO,CAACI,MAAM,CAAC,IAAI,CAAC;IACtB,CAAC;IAEDQ,OAAO,WAAAA,QAAA,EAAG;MACR,OAAOb,SAAS;IAClB;EACF,CAAC;EAED,OAAOC,OAAO;AAChB;;AAEA;AACA;AACA;AACA;AACA,OAAO,IAAMa,aAA4B,GAAGjB,mBAAmB,CAAC,CAAC;AAEjE,eAAeiB,aAAa","ignoreList":[]}
+{"version":3,"file":"networkStatus.js","names":["createNetworkStatus","subscribers","Set","lastError","channel","subscribe","listener","add","delete","report","message","next","forEach","e","console","error","clear","current","networkStatus"],"sources":["../../../../src/lib/v2/utils/networkStatus.ts"],"sourcesContent":["/**\r\n * networkStatus — the feed behind `NetworkErrorBanner`.\r\n *\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n * WHY THIS BELONGS IN THE LIBRARY (capability gap G-03)\r\n *\r\n * The library shipped `NetworkErrorBanner` — a presentational component — but\r\n * not the plumbing that decides when it appears. Charter R-A.3 / R-4.3 make the\r\n * banner MANDATORY (\"erreur réseau → bandeau persistant top, bouton\r\n * « Réessayer »\"), so every consuming module had to invent the same\r\n * subscribe / report / clear singleton and the same transport-interceptor\r\n * bridge. Two audited modules (`procuration-portnet-fe`, `procuration-fe`) had\r\n * each written their own.\r\n *\r\n * A presentational component whose trigger contract is left to consumers\r\n * guarantees divergence in precisely the state users encounter least often and\r\n * trust least — the offline path.\r\n *\r\n * NOT a redux slice, deliberately\r\n * -------------------------------\r\n * This state is presentation-only and high-frequency on a flaky link. Crossing a\r\n * dispatch boundary on every retry would slow the alert path for no benefit, and\r\n * would force the library to take an opinion on the host's store.\r\n *\r\n * Late subscribers are hydrated on subscribe, so a banner that mounts after the\r\n * failure (lazy route, remount) still shows the current state instead of missing\r\n * the edge.\r\n * ─────────────────────────────────────────────────────────────────────────────\r\n *\r\n * Wiring (once, at the app root):\r\n *\r\n *   const [netError, setNetError] = useState<string | null>(null);\r\n *   useEffect(() => networkStatus.subscribe(setNetError), []);\r\n *\r\n *   <NetworkErrorBanner\r\n *     visible={Boolean(netError)}\r\n *     message={netError ?? \"\"}\r\n *     onRetry={() => { networkStatus.clear(); window.location.reload(); }}\r\n *   />\r\n *\r\n * And in the transport layer:\r\n *\r\n *   instance.interceptors.response.use(\r\n *     (response) => { networkStatus.clear(); return response; },\r\n *     (error: unknown) => {\r\n *       if (getApiErrorStatus(error) === undefined) {\r\n *         networkStatus.report(\"Connexion perdue. Vérifiez votre réseau, puis réessayez.\");\r\n *       }\r\n *       return Promise.reject(error);\r\n *     }\r\n *   );\r\n *\r\n * A status-less failure is the network case (offline, DNS, ingress timeout); a\r\n * failure WITH a status is a server error and belongs in a toast (R-A.4).\r\n */\r\n\r\n/** Receives the latest banner message, or `null` when the banner should clear. */\r\nexport type NetworkStatusListener = (message: string | null) => void;\r\n\r\n/** Public shape of a network-status channel. */\r\nexport interface NetworkStatus {\r\n  /**\r\n   * Subscribe to changes. The listener is invoked immediately with the current\r\n   * state when that state is non-null, so a late-mounting banner hydrates\r\n   * instead of missing the transition. Returns an unsubscribe function suitable\r\n   * for returning directly from `useEffect`.\r\n   */\r\n  subscribe(listener: NetworkStatusListener): () => void;\r\n  /** Report a global network failure. `null` (or omitted) clears. */\r\n  report(message?: string | null): void;\r\n  /** Clear the banner. Equivalent to `report(null)`. */\r\n  clear(): void;\r\n  /** Current message, or `null`. Useful in tests and for SSR snapshots. */\r\n  current(): string | null;\r\n}\r\n\r\n/**\r\n * Create an independent network-status channel.\r\n *\r\n * Exported alongside the shared singleton so tests can use an isolated instance\r\n * — a module-level singleton shared between test cases leaks state across them.\r\n * Application code should normally use the `networkStatus` export below.\r\n */\r\nexport function createNetworkStatus(): NetworkStatus {\r\n  const subscribers = new Set<NetworkStatusListener>();\r\n  let lastError: string | null = null;\r\n\r\n  const channel: NetworkStatus = {\r\n    subscribe(listener) {\r\n      subscribers.add(listener);\r\n      if (lastError !== null) listener(lastError);\r\n      return () => {\r\n        subscribers.delete(listener);\r\n      };\r\n    },\r\n\r\n    report(message) {\r\n      const next = message || null;\r\n      /* De-duplicated: a flaky link can fail many times per second, and\r\n       * re-notifying an unchanged message would re-render every subscriber for\r\n       * no visible difference. */\r\n      if (lastError === next) return;\r\n      lastError = next;\r\n      subscribers.forEach((listener) => {\r\n        try {\r\n          listener(lastError);\r\n        } catch (e) {\r\n          /* One bad subscriber must not stop the others from being notified,\r\n           * and must not propagate into the transport layer that reported the\r\n           * failure. */\r\n          // eslint-disable-next-line no-console\r\n          console.error(\"[@portnet/ui networkStatus] subscriber threw:\", e);\r\n        }\r\n      });\r\n    },\r\n\r\n    clear() {\r\n      channel.report(null);\r\n    },\r\n\r\n    current() {\r\n      return lastError;\r\n    },\r\n  };\r\n\r\n  return channel;\r\n}\r\n\r\n/**\r\n * The shared channel. One per bundle, which is the right granularity: the\r\n * transport layer and the banner must agree, and both live in the same app.\r\n */\r\nexport const networkStatus: NetworkStatus = createNetworkStatus();\r\n\r\nexport default networkStatus;\r\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAGA;;AAiBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,mBAAmBA,CAAA,EAAkB;EACnD,MAAMC,WAAW,GAAG,IAAIC,GAAG,CAAwB,CAAC;EACpD,IAAIC,SAAwB,GAAG,IAAI;EAEnC,MAAMC,OAAsB,GAAG;IAC7BC,SAASA,CAACC,QAAQ,EAAE;MAClBL,WAAW,CAACM,GAAG,CAACD,QAAQ,CAAC;MACzB,IAAIH,SAAS,KAAK,IAAI,EAAEG,QAAQ,CAACH,SAAS,CAAC;MAC3C,OAAO,MAAM;QACXF,WAAW,CAACO,MAAM,CAACF,QAAQ,CAAC;MAC9B,CAAC;IACH,CAAC;IAEDG,MAAMA,CAACC,OAAO,EAAE;MACd,MAAMC,IAAI,GAAGD,OAAO,IAAI,IAAI;MAC5B;AACN;AACA;MACM,IAAIP,SAAS,KAAKQ,IAAI,EAAE;MACxBR,SAAS,GAAGQ,IAAI;MAChBV,WAAW,CAACW,OAAO,CAAEN,QAAQ,IAAK;QAChC,IAAI;UACFA,QAAQ,CAACH,SAAS,CAAC;QACrB,CAAC,CAAC,OAAOU,CAAC,EAAE;UACV;AACV;AACA;UACU;UACAC,OAAO,CAACC,KAAK,CAAC,+CAA+C,EAAEF,CAAC,CAAC;QACnE;MACF,CAAC,CAAC;IACJ,CAAC;IAEDG,KAAKA,CAAA,EAAG;MACNZ,OAAO,CAACK,MAAM,CAAC,IAAI,CAAC;IACtB,CAAC;IAEDQ,OAAOA,CAAA,EAAG;MACR,OAAOd,SAAS;IAClB;EACF,CAAC;EAED,OAAOC,OAAO;AAChB;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMc,aAA4B,GAAGlB,mBAAmB,CAAC,CAAC;AAEjE,eAAekB,aAAa","ignoreList":[]}