@semics-tech/emdash-esign 0.0.0-bootstrap.0 → 1.0.0-rc.0

package/src/client/index.ts

@@ -0,0 +1,5 @@
+/**
+ * Browser helpers for the `/verify` page (SU-FR-02, ES-US-6). The implementation is plain
+ * JavaScript (`verify.js`) because the page inlines its exact text under a hashed CSP.
+ */
+export { enhanceVerify, sha256Hex } from "./verify.js";

package/src/client/pad.d.ts

@@ -0,0 +1,24 @@
+// Types for pad.js, which is plain JavaScript so the page can inline its exact text (CSP hash).
+export type Point = [number, number];
+export interface PadSize {
+	w: number;
+	h: number;
+}
+
+export function padPoint(
+	event: { clientX: number; clientY: number },
+	rect: { left: number; top: number; width: number; height: number },
+	size: PadSize,
+): Point;
+
+export function createPad(size: PadSize): {
+	start(x: number, y: number): void;
+	move(x: number, y: number): void;
+	end(): void;
+	undo(): void;
+	clear(): void;
+	strokes(): Point[][];
+	value(): string;
+};
+
+export function enhancePads(root: Document): void;

package/src/client/pad.js

@@ -0,0 +1,232 @@
+// @ts-check
+/**
+ * The signature pad (SU-FR-05). Progressive enhancement for the `[data-esign-pad-slot]` in
+ * <SigningCeremony>: without this script the signer types their name; with it they may also draw.
+ *
+ * The drawing is kept as vectors, never pixels: `{ v: 1, w, h, strokes }` where each stroke is a
+ * list of whole-pixel `[x, y]` points in pad coordinates (y down), written as JSON to the hidden
+ * `signatureStrokes` input, followed by a bubbling `input` event. The canvas is only a view of those
+ * strokes; nothing reads it back. Pointer events cover mouse, touch and pen. Clear and Undo are real
+ * buttons, so they work from the keyboard; the typed name stays the accessible way to sign.
+ *
+ * Plain JavaScript, no imports: the page inlines this file's exact text and allows it by its
+ * SHA-256 in the Content-Security-Policy (src/astro/lib/csp.ts), so it must not be transformed.
+ * No HTML is ever built from strings; look comes from classes in the ceremony stylesheet.
+ */
+
+/** At most this many strokes and points, so the JSON always fits `public/submit` (64 strokes, 32 KB). */
+const MAX_STROKES = 64;
+const MAX_POINTS = 1500;
+
+/**
+ * @typedef {[number, number]} Point
+ * @typedef {{ w: number; h: number }} PadSize
+ */
+
+/**
+ * A pointer's position in pad coordinates, clamped to the pad.
+ * @param {{ clientX: number; clientY: number }} event
+ * @param {{ left: number; top: number; width: number; height: number }} rect the canvas's box on screen
+ * @param {PadSize} size
+ * @returns {Point}
+ */
+export function padPoint(event, rect, size) {
+	const clamp = (/** @type {number} */ n, /** @type {number} */ max) => Math.min(max, Math.max(0, n));
+	return [
+		Math.round(clamp(((event.clientX - rect.left) * size.w) / rect.width, size.w)),
+		Math.round(clamp(((event.clientY - rect.top) * size.h) / rect.height, size.h)),
+	];
+}
+
+/**
+ * The strokes drawn so far.
+ * @param {PadSize} size
+ */
+export function createPad(size) {
+	/** @type {Point[][]} */
+	const strokes = [];
+	/** @type {Point[] | undefined} */
+	let current;
+	let points = 0;
+	const round = (/** @type {number} */ n) => Math.round(n);
+	return {
+		/** Begins a stroke; ignored once the stroke limit is reached. */
+		start(/** @type {number} */ x, /** @type {number} */ y) {
+			if (strokes.length >= MAX_STROKES) return;
+			current = [[round(x), round(y)]];
+			strokes.push(current);
+			points++;
+		},
+		/** Extends the current stroke; repeated points and points over the limit are dropped. */
+		move(/** @type {number} */ x, /** @type {number} */ y) {
+			if (!current || points >= MAX_POINTS) return;
+			const last = current[current.length - 1];
+			const point = /** @type {Point} */ ([round(x), round(y)]);
+			if (last && last[0] === point[0] && last[1] === point[1]) return;
+			current.push(point);
+			points++;
+		},
+		end() {
+			current = undefined;
+		},
+		undo() {
+			const removed = strokes.pop();
+			if (removed) points -= removed.length;
+			current = undefined;
+		},
+		clear() {
+			strokes.length = 0;
+			points = 0;
+			current = undefined;
+		},
+		strokes: () => strokes,
+		/** The JSON for the hidden input, or "" when nothing is drawn. */
+		value: () => (strokes.length === 0 ? "" : JSON.stringify({ v: 1, w: size.w, h: size.h, strokes })),
+	};
+}
+
+/** The pad's own coordinate space; the canvas scales to its container. */
+const SIZE = { w: 600, h: 200 };
+
+/**
+ * @param {Document} doc
+ * @param {string} tag
+ * @param {Record<string, string>} attrs
+ * @param {string} [text]
+ */
+function make(doc, tag, attrs, text) {
+	const el = doc.createElement(tag);
+	for (const [k, v] of Object.entries(attrs)) el.setAttribute(k, v);
+	if (text) el.textContent = text;
+	return el;
+}
+
+/**
+ * Adds a pad to one slot.
+ * @param {HTMLElement} slot
+ */
+function enhanceSlot(slot) {
+	const doc = slot.ownerDocument;
+	const input = /** @type {HTMLInputElement | null} */ (slot.querySelector('input[name="signatureStrokes"]'));
+	if (!input || slot.querySelector("[data-esign-pad]")) return;
+	const pad = createPad(SIZE);
+	// The pad's messages in the page's language, rendered by the component (T102): no text of its own.
+	/** @type {Record<string, string>} */
+	let m = {};
+	try {
+		m = JSON.parse(slot.dataset.messages ?? "{}");
+	} catch {
+		// No messages: the pad shows their keys.
+	}
+	const say = (/** @type {string} */ key, /** @type {number} */ count = 0) =>
+		(m[key] ?? key).replace("{count}", new Intl.NumberFormat(doc.documentElement.lang || undefined).format(count));
+	const rules = new Intl.PluralRules(doc.documentElement.lang || undefined);
+
+	const wrap = make(doc, "div", { class: "semics-pad", "data-esign-pad": "" });
+	const canvas = /** @type {HTMLCanvasElement} */ (
+		make(doc, "canvas", {
+			class: "semics-pad-canvas",
+			role: "img",
+			"aria-label": say("canvas"),
+			"data-testid": "sign-pad",
+		})
+	);
+	canvas.width = SIZE.w;
+	canvas.height = SIZE.h;
+	const undo = make(doc, "button", { type: "button", "data-esign-pad-undo": "" }, say("undo"));
+	const clear = make(doc, "button", { type: "button", "data-esign-pad-clear": "" }, say("clear"));
+	const status = make(doc, "p", { class: "semics-note", "aria-live": "polite", "data-esign-pad-status": "" });
+	const bar = make(doc, "div", { class: "semics-pad-bar" });
+	bar.append(undo, clear);
+	const label = make(doc, "p", { class: "semics-note" }, say("intro"));
+	wrap.append(label, canvas, bar, status);
+	slot.insertBefore(wrap, input);
+
+	const ctx = canvas.getContext("2d");
+	const paint = () => {
+		const strokes = pad.strokes();
+		if (ctx) {
+			ctx.clearRect(0, 0, SIZE.w, SIZE.h);
+			ctx.lineWidth = 2.5;
+			ctx.lineCap = "round";
+			ctx.lineJoin = "round";
+			ctx.strokeStyle = getComputedStyle(canvas).color;
+			ctx.fillStyle = ctx.strokeStyle;
+			for (const stroke of strokes) {
+				const first = stroke[0];
+				if (!first) continue;
+				if (stroke.length === 1) {
+					ctx.beginPath();
+					ctx.arc(first[0], first[1], 1.5, 0, Math.PI * 2);
+					ctx.fill();
+					continue;
+				}
+				ctx.beginPath();
+				ctx.moveTo(first[0], first[1]);
+				for (const p of stroke.slice(1)) ctx.lineTo(p[0], p[1]);
+				ctx.stroke();
+			}
+		}
+		const empty = strokes.length === 0;
+		undo.toggleAttribute("disabled", empty);
+		clear.toggleAttribute("disabled", empty);
+	};
+	const publish = (/** @type {string} */ note) => {
+		paint();
+		input.value = pad.value();
+		status.textContent = note;
+		input.dispatchEvent(new Event("input", { bubbles: true }));
+	};
+
+	/** @type {number | undefined} */
+	let activePointer;
+	const at = (/** @type {PointerEvent} */ e) => padPoint(e, canvas.getBoundingClientRect(), SIZE);
+	canvas.addEventListener("pointerdown", (e) => {
+		if (activePointer !== undefined || (e.pointerType === "mouse" && e.button !== 0)) return;
+		activePointer = e.pointerId;
+		try {
+			canvas.setPointerCapture(e.pointerId);
+		} catch {
+			// A pointer the browser no longer tracks: the stroke still draws while it stays over the pad.
+		}
+		e.preventDefault();
+		pad.start(...at(e));
+		paint();
+	});
+	canvas.addEventListener("pointermove", (e) => {
+		if (e.pointerId !== activePointer) return;
+		e.preventDefault();
+		// Coalesced events keep fast strokes smooth.
+		for (const c of e.getCoalescedEvents?.() ?? [e]) pad.move(...at(c));
+		paint();
+	});
+	const finish = (/** @type {PointerEvent} */ e) => {
+		if (e.pointerId !== activePointer) return;
+		activePointer = undefined;
+		pad.end();
+		const count = pad.strokes().length;
+		const form = `drawn.${rules.select(count)}`;
+		publish(say(m[form] === undefined ? "drawn.other" : form, count));
+	};
+	canvas.addEventListener("pointerup", finish);
+	canvas.addEventListener("pointercancel", finish);
+	undo.addEventListener("click", () => {
+		pad.undo();
+		publish(say("undone"));
+	});
+	clear.addEventListener("click", () => {
+		pad.clear();
+		publish(say("cleared"));
+	});
+	paint();
+}
+
+/**
+ * Wires every pad slot on the page.
+ * @param {Document} root
+ */
+export function enhancePads(root) {
+	for (const slot of root.querySelectorAll("[data-esign-pad-slot]")) enhanceSlot(/** @type {HTMLElement} */ (slot));
+}
+
+if (typeof document !== "undefined") enhancePads(document);

package/src/client/verify.d.ts

@@ -0,0 +1,3 @@
+// Types for verify.js, which is plain JavaScript so the page can inline its exact text (CSP hash).
+export function sha256Hex(bytes: ArrayBuffer): Promise<string>;
+export function enhanceVerify(root: Pick<Document, "querySelectorAll" | "getElementById">): void;

package/src/client/verify.js

@@ -0,0 +1,88 @@
+// @ts-check
+/**
+ * Progressive enhancement for the `/verify` page (SU-FR-02, ES-US-6). The form works without this
+ * script (the visitor pastes the SHA-256). With it, choosing or dropping the signed PDF hashes it
+ * in the browser with WebCrypto, fills the fingerprint field and submits the form. Only the hash
+ * is ever posted: the file control has no `name`, and this script has no network code at all.
+ *
+ * Plain JavaScript, no imports: the page inlines this file's exact text and allows it by its
+ * SHA-256 in the Content-Security-Policy (src/astro/lib/csp.ts), so it must not be transformed.
+ * Text only ever goes in through `textContent` and `value`.
+ */
+
+/**
+ * Lower-case hex SHA-256 of `bytes`.
+ * @param {ArrayBuffer} bytes
+ * @returns {Promise<string>}
+ */
+export async function sha256Hex(bytes) {
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+/**
+ * Hashes `chosen` into `target`, says what happened in `status`, and submits `form`.
+ * @param {{ name?: string; arrayBuffer(): Promise<ArrayBuffer> }} chosen
+ * @param {{ value: string }} target
+ * @param {{ textContent: string | null } | null} status
+ * @param {{ requestSubmit(): void } | null} form
+ * @param {Record<string, string>} m the page's messages (keys without `verify.`, T102)
+ */
+async function hashInto(chosen, target, status, form, m) {
+	/** @param {string} key @param {string} [name] */
+	const say = (key, name = "") => {
+		if (status) status.textContent = (m[key] ?? key).replace("{name}", name);
+	};
+	say("reading");
+	let hash;
+	try {
+		hash = await sha256Hex(await chosen.arrayBuffer());
+	} catch {
+		say("unreadable");
+		return;
+	}
+	target.value = hash;
+	say("done", chosen.name || (m.theFile ?? "theFile"));
+	form?.requestSubmit();
+}
+
+/**
+ * Wires every `input[data-esign-file]` (and each `[data-esign-drop]` zone) to the text input named
+ * by the file input's `data-target` id.
+ * @param {Pick<Document, "querySelectorAll" | "getElementById">} root
+ */
+export function enhanceVerify(root) {
+	for (const file of /** @type {NodeListOf<HTMLInputElement>} */ (root.querySelectorAll("input[data-esign-file]"))) {
+		file.hidden = false;
+		const target = /** @type {HTMLInputElement | null} */ (root.getElementById(file.dataset.target ?? ""));
+		const status = root.getElementById(file.dataset.status ?? "");
+		const form = file.closest("form");
+		if (!target) continue;
+		/** @type {Record<string, string>} */
+		let m = {};
+		try {
+			m = JSON.parse(file.dataset.messages ?? "{}");
+		} catch {
+			// No messages: the status line shows their keys.
+		}
+		file.addEventListener("change", async () => {
+			const chosen = file.files?.[0];
+			if (chosen) await hashInto(chosen, target, status, form, m);
+		});
+		for (const zone of /** @type {NodeListOf<HTMLElement>} */ (root.querySelectorAll("[data-esign-drop]"))) {
+			zone.addEventListener("dragover", (event) => {
+				event.preventDefault();
+				zone.classList.toggle("is-over", true);
+			});
+			zone.addEventListener("dragleave", () => zone.classList.toggle("is-over", false));
+			zone.addEventListener("drop", async (event) => {
+				event.preventDefault();
+				zone.classList.toggle("is-over", false);
+				const dropped = /** @type {DragEvent} */ (event).dataTransfer?.files?.[0];
+				if (dropped) await hashInto(dropped, target, status, form, m);
+			});
+		}
+	}
+}
+
+if (typeof document !== "undefined") enhanceVerify(document);

package/src/i18n/ar.ts

@@ -0,0 +1,132 @@
+import type { Messages } from "./index.ts";
+
+/** Arabic (right to left). Plural forms follow `Intl.PluralRules("ar")`: zero, one, two, few, many, other. */
+export const ar: Messages = {
+	"error.SIGNING_TOKEN_INVALID": "رابط التوقيع هذا غير صالح. تأكد من أنك فتحت أحدث رابط في بريدك الإلكتروني.",
+	"error.SIGNING_TOKEN_EXPIRED": "انتهت صلاحية رابط التوقيع هذا. اطلب من المرسل رابطًا جديدًا.",
+	"error.ENVELOPE_CLOSED": "لم يعد من الممكن توقيع هذا المستند.",
+	"error.ENVELOPE_NOT_FOUND": "تعذّر العثور على هذا المستند.",
+	"error.RATE_LIMITED": "محاولات كثيرة جدًا. يُرجى الانتظار بضع دقائق ثم المحاولة مرة أخرى.",
+	"error.TOKEN_IN_QUERY": "هذا الرابط غير صالح. افتح الرابط من بريدك الإلكتروني.",
+	"error.SESSION_REQUIRED": "يُرجى إعادة تحميل الصفحة والمحاولة مرة أخرى.",
+	"error.BAD_REQUEST": "يُرجى مراجعة النموذج والمحاولة مرة أخرى.",
+	"error.SIGNING_OUT_OF_TURN": "يجب أن يوقّع موقّع آخر أولًا. ستصلك رسالة بالبريد الإلكتروني عندما يحين دورك.",
+	"error.OTP_REQUIRED": "أدخل الرمز الذي أرسلناه إلى بريدك الإلكتروني قبل التوقيع.",
+	"error.OTP_INVALID": "هذا الرمز غير صحيح. راجع أحدث رسالة وحاول مرة أخرى.",
+	"error.OTP_EXPIRED": "انتهت صلاحية هذا الرمز. اطلب رمزًا جديدًا.",
+	"error.OTP_LOCKED": "رموز خاطئة كثيرة جدًا. اطلب رمزًا جديدًا.",
+	"error.OTP_WAIT": "أُرسل رمز قبل لحظات. يُرجى الانتظار قبل طلب رمز آخر.",
+	"error.OTP_SEND_FAILED": "تعذّر علينا إرسال رمز بالبريد الإلكتروني. يُرجى المحاولة مرة أخرى بعد قليل.",
+	"error.STROKES_TOO_LARGE": "توقيعك المرسوم مفصّل أكثر من اللازم. امسحه ووقّع مرة أخرى بشكل أبسط.",
+	"error.INTERNAL": "حدث خطأ ما. يُرجى المحاولة مرة أخرى.",
+
+	"sign.title": "توقيع مستند",
+	"sign.closed.completed": "تم توقيع هذا المستند.",
+	"sign.closed.declined": "رُفض هذا المستند.",
+	"sign.closed.other": "لم يعد من الممكن توقيع هذا المستند.",
+	"sign.download": "نزّل ملف PDF الموقّع",
+	"sign.preparingShort": "جارٍ تجهيز ملف PDF الموقّع؛ أعد التحميل بعد دقيقة.",
+	"sign.preparing": "جارٍ تجهيز ملف PDF الموقّع. أعد تحميل هذه الصفحة بعد دقيقة للحصول على رابط التنزيل.",
+	"sign.return": "العودة إلى الموقع",
+	"sign.waiting.titled": "لقد وقّعت «{title}». ننتظر بقية الموقّعين.",
+	"sign.waiting.untitled": "لقد وقّعت هذا المستند. ننتظر بقية الموقّعين.",
+	"sign.waiting.email": "عندما يوقّع الجميع، ستصلك رسالة بالبريد الإلكتروني فيها رابط إلى النسخة الموقّعة.",
+	"sign.thanks": "شكرًا لك. سُجّل توقيعك.",
+	"sign.othersToSign":
+		"ما زال على آخرين أن يوقّعوا. عندما يوقّع الجميع، ستصلك رسالة بالبريد الإلكتروني فيها رابط إلى النسخة الموقّعة.",
+	"sign.declined": "لقد رفضت التوقيع. أُبلغ المرسل بذلك.",
+	"sign.signingAs": "التوقيع باسم {name}",
+	"sign.signingAsRole": "التوقيع باسم {name} ({role})",
+	"sign.document": "المستند المطلوب توقيعه",
+	"sign.pdf.intro": "المستند ملف PDF: {name} ({pages}، {size}). اقرأه قبل أن توقّع.",
+	"sign.pdf.pages.one": "صفحة واحدة",
+	"sign.pdf.pages.two": "صفحتان",
+	"sign.pdf.pages.few": "{count} صفحات",
+	"sign.pdf.pages.other": "{count} صفحة",
+	"sign.pdf.kb": "{n} كيلوبايت",
+	"sign.pdf.mb": "{n} ميغابايت",
+	"sign.pdf.links": "{open} أو {download}",
+	"sign.pdf.open": "افتح ملف PDF",
+	"sign.pdf.download": "نزّله",
+	"sign.pdf.unavailable": "لا يمكن عرض ملف PDF هذا الآن، لذا لا يمكن توقيعه بعد. يُرجى المحاولة لاحقًا.",
+	"sign.pdf.fingerprint": "بصمة SHA-256 لملف PDF الذي توقّعه: {hash}",
+	"sign.exact.summary": "النص الدقيق الذي توقّعه",
+	"sign.exact.fingerprint": "بصمة SHA-256: {hash}",
+	"sign.otp.label": "رمز البريد الإلكتروني",
+	"sign.otp.intro": "للتوقيع، أدخل أولًا الرمز الذي نرسله إلى بريدك الإلكتروني.",
+	"sign.otp.sent": "أرسلنا إليك رمزًا بالبريد الإلكتروني. تنتهي صلاحيته بعد 10 دقائق.",
+	"sign.otp.send": "أرسل إليّ رمزًا بالبريد الإلكتروني",
+	"sign.otp.code": "الرمز",
+	"sign.otp.hint": "الرمز المكوّن من 6 أرقام في الرسالة التي أرسلناها إليك.",
+	"sign.otp.verify": "تحقق من الرمز",
+	"sign.details": "بياناتك",
+	"sign.required": "{label} (مطلوب)",
+	"sign.signature": "توقيعك",
+	"sign.typedName": "اكتب اسمك الكامل للتوقيع",
+	"sign.agree": "أقصد أن يكون التوقيع أعلاه توقيعي على هذا المستند.",
+	"sign.submit": "وقّع المستند",
+	"sign.decline.label": "أو ارفض التوقيع (السبب اختياري)",
+	"sign.decline.button": "رفض",
+
+	"ceremony.missing": "للتوقيع، يُرجى {items}.",
+	"ceremony.separator": "، ",
+	"ceremony.need.typedName": "كتابة اسمك الكامل",
+	"ceremony.need.consent": "تحديد مربع الموافقة",
+	"ceremony.need.agree": "تأكيد أنك تقصد التوقيع",
+	"ceremony.need.field": "تعبئة {label}",
+	"ceremony.need.fields": "الحقول المطلوبة",
+	"ceremony.download": "نزّل ملف PDF الموقّع",
+	"ceremony.slow": "يستغرق تجهيز ملف PDF الموقّع وقتًا أطول من المعتاد. أعد تحميل هذه الصفحة بعد بضع دقائق.",
+
+	"pad.canvas": "مساحة رسم التوقيع. اختياري: ارسم بإصبعك أو بقلم أو بالفأرة. كتابة اسمك تكفي للتوقيع.",
+	"pad.intro": "اختياري: ارسم توقيعك أدناه. كتابة اسمك تبقى مطلوبة.",
+	"pad.undo": "تراجع",
+	"pad.clear": "مسح",
+	"pad.drawn.zero": "رُسم التوقيع: لا خطوط.",
+	"pad.drawn.one": "رُسم التوقيع: خط واحد.",
+	"pad.drawn.two": "رُسم التوقيع: خطان.",
+	"pad.drawn.few": "رُسم التوقيع: {count} خطوط.",
+	"pad.drawn.other": "رُسم التوقيع: {count} خطًا.",
+	"pad.undone": "أُزيل آخر خط.",
+	"pad.cleared": "مُسح التوقيع.",
+
+	"signed.title": "نسختك الموقّعة",
+	"signed.unsigned": "لم يُوقّع هذا المستند بعد. {link}.",
+	"signed.openLink": "افتح صفحة التوقيع",
+
+	"verify.title": "تحقق من مستند موقّع",
+	"verify.intro":
+		"تحقق من أن ملف PDF الموقّع هو الذي أصدرناه وأن سجل التدقيق الخاص به سليم. اختر ملف PDF أو أفلته هنا، أو أدخل بصمة SHA-256 الخاصة به (الظاهرة في صفحة الشهادة). يبقى الملف على جهازك: تُرسل بصمته فقط. يؤكد هذا السجل فقط؛ ولا يحدد هوية أي شخص.",
+	"verify.file": "ملف PDF الموقّع",
+	"verify.sha": "بصمة SHA-256 للمستند",
+	"verify.button": "تحقق",
+	"verify.issued": "صدر هنا مستند موقّع بهذه البصمة.",
+	"verify.issuedOn": "صدر هنا مستند موقّع بهذه البصمة واكتمل في {date}.",
+	"verify.chain.ok": "سجل التدقيق الخاص به سليم.",
+	"verify.chain.bad": "تحذير: سجل التدقيق الخاص به لا يجتاز التحقق.",
+	"verify.chain.long": "سجل التدقيق الخاص به أطول من أن يُتحقق منه عبر الإنترنت.",
+	"verify.none": "لم يُعثر على مستند موقّع بهذه البصمة.",
+	"verify.retention": "تُحذف السجلات الموقّعة عند انتهاء مدة الاحتفاظ بها، لذا قد لا يظهر مستند وُقّع منذ زمن طويل.",
+	"verify.error.BAD_REQUEST": "أدخل الأحرف الست عشرية الأربعة والستين لبصمة SHA-256 الخاصة بالمستند.",
+	"verify.reading": "جارٍ حساب البصمة في متصفحك. لا يُرفع الملف.",
+	"verify.unreadable": "تعذّرت قراءة هذا الملف. الصق بصمة SHA-256 الخاصة به بدلًا من ذلك.",
+	"verify.done": "حُسبت بصمة {name} في متصفحك. جارٍ التحقق.",
+	"verify.theFile": "الملف",
+
+	"selfServe.heading": "وقّع هذا المستند",
+	"selfServe.unavailable": "هذا النموذج غير متاح الآن.",
+	"selfServe.sent": "تحقق من بريدك الإلكتروني. أرسلنا رابطًا إلى العنوان الذي أدخلته؛ افتحه لقراءة المستند وتوقيعه.",
+	"selfServe.name": "اسمك",
+	"selfServe.email": "بريدك الإلكتروني",
+	"selfServe.honeypot": "اترك هذا الحقل فارغًا",
+	"selfServe.needsJs": "يستخدم هذا النموذج تحققًا أمنيًا يتطلب JavaScript.",
+	"selfServe.note": "سنرسل إليك رابطًا للتوقيع بالبريد الإلكتروني. لا يستطيع التوقيع إلا من يستطيع فتح تلك الرسالة.",
+	"selfServe.button": "أرسل إليّ الرابط",
+	"selfServe.error.TURNSTILE_FAILED": "لم ينجح التحقق الأمني. يُرجى المحاولة مرة أخرى.",
+	"selfServe.error.RATE_LIMITED": "محاولات كثيرة جدًا. يُرجى الانتظار بضع دقائق ثم المحاولة مرة أخرى.",
+	"selfServe.error.SELF_SERVE_FULL": "بلغ هذا النموذج حدّه لهذا اليوم. يُرجى المحاولة غدًا.",
+	"selfServe.error.BAD_REQUEST": "يُرجى مراجعة اسمك وبريدك الإلكتروني والبيانات الأخرى، ثم المحاولة مرة أخرى.",
+	"selfServe.error.TEMPLATE_NOT_FOUND": "هذا النموذج غير متاح الآن.",
+	"selfServe.error.SITE_URL_MISSING": "هذا النموذج غير متاح الآن.",
+	"selfServe.error.INTERNAL": "حدث خطأ ما. يُرجى المحاولة لاحقًا.",
+};

package/src/i18n/en.ts

@@ -0,0 +1,136 @@
+/**
+ * English, the source language of the E-sign UI kit (T102, SU-NFR-06). Every other language in this
+ * folder must have exactly these keys (a test checks), with the same `{placeholders}`. A key ending in
+ * `.one` / `.other` is a plural: other languages may add the `Intl.PluralRules` forms they need
+ * (`.zero`, `.two`, `.few`, `.many`). The consent wording is the site's own setting, not a message here.
+ * See `docs/i18n.md`.
+ */
+export const en = {
+	"error.SIGNING_TOKEN_INVALID": "This signing link is not valid. Check you opened the latest link from your email.",
+	"error.SIGNING_TOKEN_EXPIRED": "This signing link has expired. Ask the sender for a new one.",
+	"error.ENVELOPE_CLOSED": "This document can no longer be signed.",
+	"error.ENVELOPE_NOT_FOUND": "This document could not be found.",
+	"error.RATE_LIMITED": "Too many attempts. Please wait a few minutes and try again.",
+	"error.TOKEN_IN_QUERY": "This link is not valid. Open the link from your email.",
+	"error.SESSION_REQUIRED": "Please reload the page and try again.",
+	"error.BAD_REQUEST": "Please check the form and try again.",
+	"error.SIGNING_OUT_OF_TURN": "Another signer has to sign first. You will get an email when it is your turn.",
+	"error.OTP_REQUIRED": "Enter the code we emailed you before signing.",
+	"error.OTP_INVALID": "That code is not right. Check the latest email and try again.",
+	"error.OTP_EXPIRED": "That code has expired. Ask for a new code.",
+	"error.OTP_LOCKED": "Too many wrong codes. Ask for a new code.",
+	"error.OTP_WAIT": "A code was sent a moment ago. Please wait before asking for another.",
+	"error.OTP_SEND_FAILED": "We could not email a code. Please try again shortly.",
+	"error.STROKES_TOO_LARGE": "Your drawn signature is too detailed. Clear it and sign again more simply.",
+	"error.INTERNAL": "Something went wrong. Please try again.",
+
+	"sign.title": "Sign a document",
+	"sign.closed.completed": "This document has been signed.",
+	"sign.closed.declined": "This document was declined.",
+	"sign.closed.other": "This document can no longer be signed.",
+	"sign.download": "Download the signed PDF",
+	"sign.preparingShort": "The signed PDF is being prepared; reload in a minute.",
+	"sign.preparing": "The signed PDF is being prepared. Reload this page in a minute for the download link.",
+	"sign.return": "Return to the site",
+	"sign.waiting.titled": 'You have signed "{title}". We are waiting for the other signers.',
+	"sign.waiting.untitled": "You have signed this document. We are waiting for the other signers.",
+	"sign.waiting.email": "When everyone has signed, you will get an email with a link to the signed copy.",
+	"sign.thanks": "Thank you. Your signature has been recorded.",
+	"sign.othersToSign":
+		"Other people still have to sign. When everyone has signed, you will get an email with a link to the signed copy.",
+	"sign.declined": "You declined to sign. The sender has been told.",
+	"sign.signingAs": "Signing as {name}",
+	"sign.signingAsRole": "Signing as {name} ({role})",
+	"sign.document": "Document to sign",
+	"sign.pdf.intro": "The document is a PDF file: {name} ({pages}, {size}). Read it before you sign.",
+	"sign.pdf.pages.one": "{count} page",
+	"sign.pdf.pages.other": "{count} pages",
+	"sign.pdf.kb": "{n} KB",
+	"sign.pdf.mb": "{n} MB",
+	"sign.pdf.links": "{open} or {download}",
+	"sign.pdf.open": "Open the PDF",
+	"sign.pdf.download": "download it",
+	"sign.pdf.unavailable": "This PDF cannot be shown right now, so it cannot be signed yet. Please try again later.",
+	"sign.pdf.fingerprint": "SHA-256 fingerprint of the PDF file you are signing: {hash}",
+	"sign.exact.summary": "Exact text you are signing",
+	"sign.exact.fingerprint": "SHA-256 fingerprint: {hash}",
+	"sign.otp.label": "Email code",
+	"sign.otp.intro": "To sign, first enter the code we email to you.",
+	"sign.otp.sent": "We emailed you a code. It expires in 10 minutes.",
+	"sign.otp.send": "Email me a code",
+	"sign.otp.code": "Code",
+	"sign.otp.hint": "The 6-digit code from the email we sent you.",
+	"sign.otp.verify": "Verify code",
+	"sign.details": "Your details",
+	"sign.required": "{label} (required)",
+	"sign.signature": "Your signature",
+	"sign.typedName": "Type your full name to sign",
+	"sign.agree": "I intend the signature above to be my signature on this document.",
+	"sign.submit": "Sign document",
+	"sign.decline.label": "Or decline to sign (optional reason)",
+	"sign.decline.button": "Decline",
+
+	"ceremony.missing": "To sign, please {items}.",
+	"ceremony.separator": ", ",
+	"ceremony.need.typedName": "type your full name",
+	"ceremony.need.consent": "tick the consent box",
+	"ceremony.need.agree": "confirm you intend to sign",
+	"ceremony.need.field": "fill in {label}",
+	"ceremony.need.fields": "the required fields",
+	"ceremony.download": "Download the signed PDF",
+	"ceremony.slow": "The signed PDF is taking longer than usual. Reload this page in a few minutes.",
+
+	"pad.canvas":
+		"Signature drawing area. Optional: draw with a finger, pen or mouse. Typing your name is enough to sign.",
+	"pad.intro": "Optional: draw your signature below. Your typed name is still required.",
+	"pad.undo": "Undo",
+	"pad.clear": "Clear",
+	"pad.drawn.one": "Signature drawn: {count} stroke.",
+	"pad.drawn.other": "Signature drawn: {count} strokes.",
+	"pad.undone": "Last stroke removed.",
+	"pad.cleared": "Signature cleared.",
+
+	"signed.title": "Your signed copy",
+	"signed.unsigned": "This document has not been signed yet. {link}.",
+	"signed.openLink": "Open the signing page",
+
+	"verify.title": "Verify a signed document",
+	"verify.intro":
+		"Check that a signed PDF is the one we issued and that its audit trail is intact. Choose or drop the PDF, or enter its SHA-256 fingerprint (shown on the certificate page). The file stays on your device: only its fingerprint is sent. This confirms the record only; it does not identify anyone.",
+	"verify.file": "Signed PDF",
+	"verify.sha": "Document SHA-256",
+	"verify.button": "Verify",
+	"verify.issued": "A signed document with this fingerprint was issued here.",
+	"verify.issuedOn": "A signed document with this fingerprint was issued here and completed on {date}.",
+	"verify.chain.ok": "Its audit trail is intact.",
+	"verify.chain.bad": "Warning: its audit trail does not verify.",
+	"verify.chain.long": "Its audit trail is too long to check online.",
+	"verify.none": "No signed document with that fingerprint was found.",
+	"verify.retention":
+		"Signed records are deleted when their retention period ends, so a document signed long ago may no longer be listed.",
+	"verify.error.BAD_REQUEST": "Enter the 64 hexadecimal characters of the document's SHA-256.",
+	"verify.reading": "Fingerprinting in your browser. The file is not uploaded.",
+	"verify.unreadable": "Could not read that file. Paste its SHA-256 instead.",
+	"verify.done": "Fingerprinted {name} in your browser. Checking.",
+	"verify.theFile": "the file",
+
+	"selfServe.heading": "Sign this document",
+	"selfServe.unavailable": "This form is not available right now.",
+	"selfServe.sent":
+		"Check your email. We have sent a link to the address you gave; open it to read and sign the document.",
+	"selfServe.name": "Your name",
+	"selfServe.email": "Your email",
+	"selfServe.honeypot": "Leave this empty",
+	"selfServe.needsJs": "This form uses a security check that needs JavaScript.",
+	"selfServe.note": "We will email you a link to sign. Only someone who can open that email can sign.",
+	"selfServe.button": "Email me the link",
+	"selfServe.error.TURNSTILE_FAILED": "The security check did not pass. Please try again.",
+	"selfServe.error.RATE_LIMITED": "Too many attempts. Please wait a few minutes and try again.",
+	"selfServe.error.SELF_SERVE_FULL": "This form has reached its limit for today. Please try again tomorrow.",
+	"selfServe.error.BAD_REQUEST": "Please check your name, email address and the other details, then try again.",
+	"selfServe.error.TEMPLATE_NOT_FOUND": "This form is not available right now.",
+	"selfServe.error.SITE_URL_MISSING": "This form is not available right now.",
+	"selfServe.error.INTERNAL": "Something went wrong. Please try again later.",
+};
+
+export type MessageKey = keyof typeof en;