@tinytars/frame 0.1.0

package/account-methods.svelte.ts

@@ -0,0 +1,321 @@
+// The Account panel: who this account is, and every way there is into it.
+//
+// App's fourth controller extraction. Adding and removing sign-in methods is the only
+// cluster in the component that can lock a person out of their own health record, and the rule that
+// stops it — never remove the last way in — lived in a `disabled` attribute on a button. The server
+// enforces it too (functions/api/account/methods.ts:126), so this was never a hole; it was an
+// invariant with no name and no test, expressed as a UI affordance. It has one of each now.
+//
+// Same getter-parameterized factory shape as vault-principals.svelte.ts, recovery-controller.svelte.ts
+// and support-access.svelte.ts. What stays with App is what App owns: the vault principals and access
+// events the owner-only blocks render, and the unit system every tab reads.
+
+import { getMyAccount, addPasskeyMethod, addGoogleMethod } from "@tinytars/vault/auth-client";
+import { listMethods, updateProfile, addPasswordMethod, removeMethod, type LoginMethod } from "@tinytars/vault/auth-recovery";
+
+export type RemovableMethod = "password" | "passkey" | "google";
+
+export interface AccountInfo {
+  email: string | null;
+  displayName: string;
+  emailConfirmed: boolean;
+}
+
+export interface AccountMethodsDeps {
+  /**
+   * The in-memory account private key — `session.ownerKey ?? session.providerKey`, read fresh because
+   * a resume replaces it. Every add re-wraps it, which is why extractability decides the whole panel.
+   */
+  getPrivateKey: () => CryptoKey | null;
+  /** A provider session has no vault of its own, so it gets no recovery or access-log blocks. */
+  isProviderSession: () => boolean;
+  /** The unit system rides on the account payload but belongs to the shell — every tab reads it. */
+  applyUnitSystem: (u: "metric" | "imperial") => void;
+  /** Vault principals + access events. App's, because App owns the recovery controller they feed. */
+  loadOwnerBlocks: () => Promise<void>;
+}
+
+export interface AccountMethods {
+  readonly open: boolean;
+  readonly busy: boolean;
+  readonly error: string | null;
+  readonly info: AccountInfo | null;
+  readonly methods: LoginMethod[];
+  /** The verify-email banner's transient note. The persistent state is `info.emailConfirmed`. */
+  emailVerifyNote: "ok" | "invalid" | "sent" | null;
+  /** Bound to the profile form. */
+  editEmail: string;
+  editDisplayName: string;
+  /** Bound to the add-password field. */
+  newPassword: string;
+
+  /** Methods that can actually sign someone in — recovery is a way back, not a way in. */
+  readonly loginMethods: LoginMethod[];
+  readonly hasPassword: boolean;
+  readonly hasPasskey: boolean;
+  readonly hasGoogle: boolean;
+  readonly hasRecovery: boolean;
+  /**
+   * Why this method cannot be removed, or null when it can. A string rather than a boolean because
+   * the button needs the sentence for its tooltip, and one source beats a parallel condition.
+   */
+  removeBlockedReason(method: RemovableMethod): string | null;
+
+  /**
+   * After a plain-refresh resume the account key is the non-extractable copy restored from
+   * IndexedDB, so it cannot be re-wrapped under a new KEK. Adding or changing a login method needs a
+   * fresh sign-in; everything else works unchanged. Public because the recovery ladder re-wraps too.
+   */
+  ensureExtractableKey(): CryptoKey | null;
+
+  openPanel(): Promise<void>;
+  closePanel(): void;
+  /** Re-reads account and methods from the server. Every mutation below ends here. */
+  refresh(): Promise<void>;
+  resendVerification(): Promise<void>;
+  saveProfile(): Promise<void>;
+  addPassword(): Promise<void>;
+  addPasskey(): Promise<void>;
+  remove(method: RemovableMethod): Promise<void>;
+  /** Runs the Google link popup and finishes the link when it reports back. */
+  connectGoogle(): void;
+  /** Reports through this panel's error line — the popup's failures are the panel's. */
+  setError(message: string | null): void;
+  setBusy(busy: boolean): void;
+  reset(): void;
+}
+
+export function createAccountMethods(deps: AccountMethodsDeps): AccountMethods {
+  let open = $state(false);
+  let busy = $state(false);
+  let error = $state<string | null>(null);
+  let info = $state<AccountInfo | null>(null);
+  let methods = $state<LoginMethod[]>([]);
+  let editEmail = $state("");
+  let editDisplayName = $state("");
+  let newPassword = $state("");
+  let emailVerifyNote = $state<"ok" | "invalid" | "sent" | null>(null);
+
+  const loginMethods = $derived(methods.filter((m) => !m.isRecovery && m.method !== "recovery"));
+  const hasPassword = $derived(loginMethods.some((m) => m.method === "password"));
+  const hasPasskey = $derived(loginMethods.some((m) => m.method === "passkey"));
+  const hasGoogle = $derived(loginMethods.some((m) => m.method === "google"));
+  const hasRecovery = $derived(methods.some((m) => m.isRecovery || m.method === "recovery"));
+
+  function ensureExtractableKey(): CryptoKey | null {
+    const pk = deps.getPrivateKey();
+    if (!pk) return null;
+    if (!pk.extractable) {
+      error = "For your security, sign out and sign in again to add or change a login method.";
+      return null;
+    }
+    return pk;
+  }
+
+  async function refresh(): Promise<void> {
+    const [account, list] = await Promise.all([getMyAccount(), listMethods()]);
+    info = { email: account.email, displayName: account.displayName, emailConfirmed: account.emailConfirmed };
+    methods = list;
+    deps.applyUnitSystem(account.unitSystem ?? "imperial");
+  }
+
+  /** The busy/error envelope every mutation shares. Each one ends by re-reading the server. */
+  async function mutate(body: () => Promise<void>): Promise<void> {
+    busy = true;
+    try {
+      await body();
+      await refresh();
+    } catch (e) {
+      error = (e as Error).message;
+    } finally {
+      busy = false;
+    }
+  }
+
+  function removeBlockedReason(method: RemovableMethod): string | null {
+    if (!loginMethods.some((m) => m.method === method)) return null;
+    // The server refuses this too. Both are the invariant: the server so a crafted request cannot
+    // do it, and here so the person is told before they try rather than after.
+    return loginMethods.length <= 1 ? "You can't remove your only sign-in method" : null;
+  }
+
+  return {
+    get open() {
+      return open;
+    },
+    get busy() {
+      return busy;
+    },
+    get error() {
+      return error;
+    },
+    get info() {
+      return info;
+    },
+    get methods() {
+      return methods;
+    },
+    get emailVerifyNote() {
+      return emailVerifyNote;
+    },
+    set emailVerifyNote(v: "ok" | "invalid" | "sent" | null) {
+      emailVerifyNote = v;
+    },
+    get editEmail() {
+      return editEmail;
+    },
+    set editEmail(v: string) {
+      editEmail = v;
+    },
+    get editDisplayName() {
+      return editDisplayName;
+    },
+    set editDisplayName(v: string) {
+      editDisplayName = v;
+    },
+    get newPassword() {
+      return newPassword;
+    },
+    set newPassword(v: string) {
+      newPassword = v;
+    },
+    get loginMethods() {
+      return loginMethods;
+    },
+    get hasPassword() {
+      return hasPassword;
+    },
+    get hasPasskey() {
+      return hasPasskey;
+    },
+    get hasGoogle() {
+      return hasGoogle;
+    },
+    get hasRecovery() {
+      return hasRecovery;
+    },
+
+    removeBlockedReason,
+    ensureExtractableKey,
+
+    async openPanel() {
+      open = true;
+      error = null;
+      try {
+        const [account, list] = await Promise.all([getMyAccount(), listMethods()]);
+        info = { email: account.email, displayName: account.displayName, emailConfirmed: account.emailConfirmed };
+        methods = list;
+        editEmail = account.email ?? "";
+        editDisplayName = account.displayName;
+        // The recovery and access-log blocks only apply to an owned vault; a provider
+        // session has none, and asking for principals it does not have is a 403 on every open.
+        if (!deps.isProviderSession()) await deps.loadOwnerBlocks();
+      } catch (e) {
+        error = (e as Error).message;
+      }
+    },
+
+    closePanel() {
+      open = false;
+    },
+
+    refresh,
+
+    // Best-effort by design: verification never gates the app, so a failure to send is not
+    // worth a red line across a panel the person opened to do something else.
+    async resendVerification() {
+      try {
+        await fetch("/api/account/email/send-verification", { method: "POST" });
+        emailVerifyNote = "sent";
+      } catch {
+        /* best-effort */
+      }
+    },
+
+    async saveProfile() {
+      error = null;
+      await mutate(() => updateProfile({ email: editEmail.trim() || undefined, displayName: editDisplayName.trim() || undefined }));
+    },
+
+    async addPassword() {
+      if (!newPassword) return;
+      error = null;
+      const pk = ensureExtractableKey();
+      if (!pk) return;
+      const password = newPassword;
+      await mutate(async () => {
+        await addPasswordMethod(pk, password);
+        // Cleared inside the try: a rejected password (too short, step-up refused) must stay in the
+        // field, or the retry is a re-entry of something the person already typed once.
+        newPassword = "";
+      });
+    },
+
+    async addPasskey() {
+      error = null;
+      const pk = ensureExtractableKey();
+      if (!pk) return;
+      await mutate(() => addPasskeyMethod(pk));
+    },
+
+    async remove(method: RemovableMethod) {
+      error = null;
+      const blocked = removeBlockedReason(method);
+      if (blocked) {
+        error = blocked;
+        return;
+      }
+      await mutate(() => removeMethod(method));
+    },
+
+    // OAuth runs in a POPUP so this SPA (and the in-memory key the server needs to wrap)
+    // survives; the popup postMessages back once the signed link cookie is set, and only then do we
+    // hand the server the private key to finish the link.
+    connectGoogle() {
+      error = null;
+      const pk = ensureExtractableKey();
+      if (!pk) return;
+      const popup = window.open("/api/auth/google/start?mode=link", "hd-google", "popup,width=520,height=640");
+      if (!popup) {
+        error = "Enable pop-ups for this site to connect Google.";
+        return;
+      }
+      const onMessage = async (ev: MessageEvent) => {
+        if (ev.origin !== window.location.origin) return;
+        const data = ev.data as { type?: string; error?: string };
+        if (data?.type !== "hd-google-linked" && data?.type !== "hd-google-error") return;
+        window.removeEventListener("message", onMessage);
+        if (data.type === "hd-google-error") {
+          error =
+            data.error === "linked_elsewhere"
+              ? "That Google account is already linked to another account."
+              : data.error === "not_signed_in"
+                ? "Your session expired — sign in again."
+                : "Google sign-in failed.";
+          return;
+        }
+        await mutate(() => addGoogleMethod(pk));
+      };
+      window.addEventListener("message", onMessage);
+    },
+
+    setError(message: string | null) {
+      error = message;
+    },
+
+    setBusy(b: boolean) {
+      busy = b;
+    },
+
+    reset() {
+      open = false;
+      busy = false;
+      error = null;
+      info = null;
+      methods = [];
+      editEmail = "";
+      editDisplayName = "";
+      newPassword = "";
+    },
+  };
+}

package/anchored-menu.svelte.ts

@@ -0,0 +1,208 @@
+// Shared collision-aware positioning for popover panels (LeafActionMenu, AccountMenu).
+// Both used to be `position: absolute` with a hard-coded direction (`top: 100%` / `bottom: 100%`),
+// so a trigger inside a sticky-bottom container (the chat composer) opened its menu straight off the
+// bottom of the viewport. This action portals the panel to <body> (so no ancestor's `overflow` or
+// `sticky`/`transform` can clip it) and keeps it positioned in `position: fixed` space, flipping to
+// whichever side has room and clamping into the viewport when neither side fully fits.
+
+export interface Rect {
+  top: number;
+  left: number;
+  right: number;
+  bottom: number;
+}
+export interface PanelSize {
+  width: number;
+  height: number;
+}
+export interface Viewport {
+  width: number;
+  height: number;
+}
+export interface MenuPlacement {
+  top: number;
+  left: number;
+  maxHeight?: number;
+}
+
+const GAP = 4;
+const MARGIN = 8;
+
+// Pure so it's unit-testable without a DOM: prefers below-and-right-aligned (the panel's original
+// static behavior), flips above when below doesn't fit and above has more room, and as a last
+// resort clamps to whichever side has more room with a max-height + scroll instead of ever
+// letting either edge escape the viewport.
+export function placeMenu(trigger: Rect, panel: PanelSize, viewport: Viewport): MenuPlacement {
+  const spaceBelow = viewport.height - trigger.bottom - GAP;
+  const spaceAbove = trigger.top - GAP;
+  const fitsBelow = panel.height <= spaceBelow;
+  const fitsAbove = panel.height <= spaceAbove;
+
+  let top: number;
+  let maxHeight: number | undefined;
+
+  if (fitsBelow || (!fitsAbove && spaceBelow >= spaceAbove)) {
+    top = trigger.bottom + GAP;
+    if (!fitsBelow) maxHeight = Math.max(spaceBelow - MARGIN, 80);
+  } else if (fitsAbove) {
+    top = trigger.top - GAP - panel.height;
+  } else {
+    top = MARGIN;
+    maxHeight = Math.max(spaceAbove - MARGIN, 80);
+  }
+
+  // The 80px floors above are a readability minimum — a 20px-tall scrolling menu is useless — but
+  // they are applied to a max-height, and nothing was stopping `top + height` from landing past the
+  // viewport's bottom edge. On a short viewport with a tall menu (both `!fitsBelow` and `!fitsAbove`,
+  // with more room below) the floor won and the panel's last item sat off-screen: visible, enabled
+  // and stable to Playwright, and permanently unclickable — "element is outside of the viewport",
+  // retried until the test timed out. The header comment claimed this could not happen; now it holds.
+  const height = Math.min(panel.height, maxHeight ?? panel.height);
+  top = Math.min(top, viewport.height - MARGIN - height);
+  top = Math.max(top, MARGIN);
+
+  let left = trigger.right - panel.width;
+  left = Math.min(left, viewport.width - panel.width - MARGIN);
+  left = Math.max(left, MARGIN);
+
+  return { top, left, maxHeight };
+}
+
+interface AnchoredMenuParams {
+  anchor: HTMLElement;
+  open: boolean;
+}
+
+// Svelte action for the panel element. `anchor` is the trigger button; `open` mirrors the caller's
+// own open state (the action doesn't own visibility — the {#if} around the panel does — it only
+// needs `open` to know when to (re)compute a placement).
+export function anchoredMenu(node: HTMLElement, params: AnchoredMenuParams) {
+  let anchor = params.anchor;
+  let open = params.open;
+  let rafId: number | null = null;
+
+  node.style.position = "fixed";
+  node.style.margin = "0";
+  document.body.appendChild(node);
+
+  function reposition() {
+    if (!open) return;
+    const panelRect = node.getBoundingClientRect();
+    // `scrollHeight` is the panel's CONTENT height, so it ignores the max-height this function may
+    // have set on an earlier pass. Reading the box back instead would feed each placement its own
+    // clamped output and ratchet the panel smaller every time it re-ran — harmless while the only
+    // triggers were scroll and resize, but not once the observer below re-runs it on our own write.
+    const height = Math.max(node.scrollHeight, panelRect.height);
+    // A zero measurement is not a small panel, it is one that has not been laid out yet, and placing
+    // on it is worse than not placing at all: placeMenu clamps against the height it is GIVEN, so a
+    // height of 0 parks the panel flush against the bottom edge and the real content then renders
+    // past the fold. Wait for the observer instead.
+    if (height === 0 || panelRect.width === 0) return;
+    const placement = placeMenu(
+      anchor.getBoundingClientRect(),
+      { width: panelRect.width, height },
+      { width: window.innerWidth, height: window.innerHeight },
+    );
+    node.style.top = `${placement.top}px`;
+    node.style.left = `${placement.left}px`;
+    node.style.maxHeight = placement.maxHeight != null ? `${placement.maxHeight}px` : "";
+    node.style.overflowY = placement.maxHeight != null ? "auto" : "";
+  }
+
+  // rAF-throttled: scroll/resize can fire many times per frame, and the composer's sticky-bottom
+  // scroll is exactly the case this exists to keep smooth. Deliberately does NOT close the menu on
+  // scroll — the chat composer's page scrolls under an open menu routinely.
+  function scheduleReposition() {
+    if (rafId != null) return;
+    rafId = requestAnimationFrame(() => {
+      rafId = null;
+      reposition();
+    });
+  }
+
+  // Keyboard access. The reparent into <body> above is what broke it: the panel emits correct
+  // role="menu" / role="menuitem" markup, but once it lives at the end of <body> a Tab from the
+  // trigger goes to the NEXT HEADER BUTTON, not into the menu — so the app's primary Delete / Edit /
+  // Chat / Translate surface could be opened by keyboard and then not used. Nothing moved focus in,
+  // and only Escape was handled.
+  //
+  // Fixed here, once, rather than in AccountMenu and LeafActionMenu separately: both consumers use
+  // this action, so both inherit it, and a third would too.
+  const items = (): HTMLElement[] => Array.from(node.querySelectorAll<HTMLElement>('[role="menuitem"]:not([disabled])'));
+
+  function focusItem(i: number): void {
+    const list = items();
+    if (list.length === 0) return;
+    list[(i + list.length) % list.length].focus();
+  }
+
+  function onMenuKeydown(e: KeyboardEvent) {
+    const list = items();
+    if (list.length === 0) return;
+    const at = list.indexOf(document.activeElement as HTMLElement);
+    if (e.key === "ArrowDown") { e.preventDefault(); focusItem(at + 1); }
+    else if (e.key === "ArrowUp") { e.preventDefault(); focusItem(at - 1); }
+    else if (e.key === "Home") { e.preventDefault(); focusItem(0); }
+    else if (e.key === "End") { e.preventDefault(); focusItem(list.length - 1); }
+    else if (e.key === "Tab") {
+      // Trap: with the panel in <body>, letting Tab through would land the user in the page behind
+      // the menu with no way back, which is worse than not opening it.
+      e.preventDefault();
+      focusItem(e.shiftKey ? at - 1 : at + 1);
+    }
+  }
+
+  /**
+   * Send focus back where it came from.
+   *
+   * Mandatory, not a nicety: the panel is removed from <body> on close, so without this the browser
+   * has nowhere sensible to put focus and drops it to <body> — leaving a keyboard user at the top of
+   * the document after every menu action.
+   */
+  function restoreFocus(): void {
+    if (node.contains(document.activeElement)) anchor.focus();
+  }
+
+  node.addEventListener("keydown", onMenuKeydown);
+
+  if (open) { reposition(); focusItem(0); }
+  window.addEventListener("scroll", scheduleReposition, { capture: true, passive: true });
+  window.addEventListener("resize", scheduleReposition);
+
+  // Placement was computed ONCE, at mount, and revisited only if the user scrolled or resized.
+  // That made an under-measurement permanent rather than transient: measure the panel before its
+  // webfont has reflowed it, and placeMenu clamps against a height that is too small, parking the
+  // panel low enough that the real content lands past the bottom of the viewport. Playwright then
+  // reported the last menu item as "visible, enabled and stable" AND "outside of the viewport", and
+  // retried it for the full 30s test timeout — twice in CI, never reproducibly on an M3, because the
+  // measurement is only wrong when layout is slow enough to lose the race. Observing the panel closes
+  // the class rather than that one cause: whatever settles late
+  // — fonts, async content, a scrollbar appearing — re-places it on the next frame.
+  const sizeObserver = new ResizeObserver(scheduleReposition);
+  sizeObserver.observe(node);
+
+  return {
+    update(newParams: AnchoredMenuParams) {
+      anchor = newParams.anchor;
+      const wasOpen = open;
+      open = newParams.open;
+      if (open && !wasOpen) { reposition(); focusItem(0); }
+      if (!open && wasOpen) restoreFocus();
+    },
+    destroy() {
+      restoreFocus(); // before the node goes, or focus lands on <body>
+      node.removeEventListener("keydown", onMenuKeydown);
+      sizeObserver.disconnect();
+      window.removeEventListener("scroll", scheduleReposition, true);
+      window.removeEventListener("resize", scheduleReposition);
+      if (rafId != null) cancelAnimationFrame(rafId);
+      // The mount-time appendChild above reparents `node` into <body>, putting it outside the
+      // marker range Svelte tears the surrounding {#if} down by — so Svelte cannot remove it and
+      // the panel is orphaned there, still rendered at its last position with its last content and
+      // its menuitems still in the accessibility tree. That is how two "Delete" items could both
+      // resolve at once (menu-exclusivity.spec.ts) after deleting the rows owning them. Having
+      // appended the node, this action must remove it; `remove()` is a no-op if something already did.
+      node.remove();
+    },
+  };
+}

package/attach-controller.ts

@@ -0,0 +1,27 @@
+// One shared "open the native file picker" registry, mirroring menu-registry.svelte.ts's singleton
+// shape: a single hidden <input type=file> (AttachPicker.svelte, mounted once in App) is driven by
+// whichever leaf's "Attach" action last called openAttachPicker, instead of every leaf owning its
+// own hidden input.
+export type AttachMode = "camera" | "library" | "files";
+
+// Everything. A leaf's Attach is storage, not import: whatever you attach is kept, shown, and — if
+// it is a PDF or a text file — read so LexiTar can quote it. Anything else simply attaches and sits
+// there, which is strictly better than a file picker that greys the file out with no explanation.
+//
+// The narrow "image/*,application/pdf,.xlsx,.xls" this replaces meant a .docx, a .csv or a .heic
+// could not even be SELECTED from any leaf. **Reports is the one surface that refuses a file** — and
+// it refuses on what the document turns out to be (report-extract.ts's isMedicalReport gate), not on
+// its extension, which is a judgement a file picker cannot make.
+export const DEFAULT_ATTACH_ACCEPT = "*/*";
+
+type Opener = (mode: AttachMode, onFiles: (files: File[]) => void, accept?: string) => void;
+
+let opener: Opener | null = null;
+
+export function registerAttachPicker(fn: Opener): void {
+  opener = fn;
+}
+
+export function openAttachPicker(mode: AttachMode, onFiles: (files: File[]) => void, accept?: string): void {
+  opener?.(mode, onFiles, accept);
+}

package/brand.ts

@@ -0,0 +1,8 @@
+// Domain-neutral half of the brand split: the {path,label} -> absolute-link derivation, usable
+// by any consuming app's own brand constants. The LexiTar-specific values (PRODUCT_NAME,
+// MEDICAL_DISCLAIMER, ...) stay in packages/brand, which is not a dependency any other app takes.
+export type LegalLink = { path: string; label: string };
+
+export function deriveLegalLinks(base: string, paths: LegalLink[]): { href: string; label: string }[] {
+  return paths.map((l) => ({ href: `${base}${l.path}`, label: l.label }));
+}

package/menu-items.ts

@@ -0,0 +1,17 @@
+// The shape of one item in a LeafActionMenu, as a plain .ts module.
+//
+// Same reason as sidebar-rows.ts and sidebar-labels.ts: a type exported from a .svelte file is
+// resolvable only by svelte-check, so declaring it inside LeafActionMenu.svelte put every pure
+// module that builds menus (leaf-actions.ts, and through it every Node-side importer) beyond the
+// reach of a plain `tsc`. The component keeps the menu; the shape lives here.
+export interface LeafMenuItem {
+  // Defaults to `title ?? label` (a caller only needs to set this explicitly if two items in the
+  // same menu would otherwise share both).
+  key?: string;
+  label: string;
+  icon?: string;
+  onClick: () => void;
+  danger?: boolean;
+  disabled?: boolean;
+  title?: string;
+}

package/menu-registry.svelte.ts

@@ -0,0 +1,18 @@
+// The one shared "which popover is open" registry every menu-style popover
+// (LeafActionMenu, AccountMenu) consults, so opening any one closes any other open one anywhere in
+// the app. First true singleton runes module in this codebase (most other modules here are
+// per-call-site factories, not singletons — this module's state is created once, at import time,
+// and shared by every caller).
+const state = $state<{ openId: string | null }>({ openId: null });
+
+export const menuRegistry = {
+  isOpen(id: string): boolean {
+    return state.openId === id;
+  },
+  open(id: string): void {
+    state.openId = id;
+  },
+  close(id: string): void {
+    if (state.openId === id) state.openId = null;
+  },
+};

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@tinytars/frame",
+  "version": "0.1.0",
+  "description": "Domain-neutral Svelte app-shell: session/auth controllers, account chrome, and menu/card/modal primitives built on @tinytars/vault.",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tinytars/lexi",
+    "directory": "packages/frame"
+  },
+  "homepage": "https://github.com/tinytars/lexi",
+  "bugs": "https://github.com/tinytars/lexi/issues",
+  "keywords": [
+    "svelte",
+    "auth",
+    "session",
+    "app-shell",
+    "encryption"
+  ],
+  "engines": {
+    "node": ">=19"
+  },
+  "files": [
+    "*.ts",
+    "*.svelte"
+  ],
+  "exports": {
+    "./account-methods.svelte": "./account-methods.svelte.ts",
+    "./AccountMenu.svelte": "./AccountMenu.svelte",
+    "./anchored-menu.svelte": "./anchored-menu.svelte.ts",
+    "./attach-controller": "./attach-controller.ts",
+    "./AttachPicker.svelte": "./AttachPicker.svelte",
+    "./brand": "./brand.ts",
+    "./Diagnostics.svelte": "./Diagnostics.svelte",
+    "./ExportTab.svelte": "./ExportTab.svelte",
+    "./LeafActionMenu.svelte": "./LeafActionMenu.svelte",
+    "./LeafCard.svelte": "./LeafCard.svelte",
+    "./LoginScreen.svelte": "./LoginScreen.svelte",
+    "./menu-items": "./menu-items.ts",
+    "./menu-registry.svelte": "./menu-registry.svelte.ts",
+    "./Onboarding.svelte": "./Onboarding.svelte",
+    "./recovery-controller.svelte": "./recovery-controller.svelte.ts",
+    "./roster-session.svelte": "./roster-session.svelte.ts",
+    "./support-access.svelte": "./support-access.svelte.ts",
+    "./vault-principals.svelte": "./vault-principals.svelte.ts",
+    "./vault-session.svelte": "./vault-session.svelte.ts",
+    "./VisibilitySettings.svelte": "./VisibilitySettings.svelte"
+  },
+  "scripts": {
+    "typecheck": "svelte-check --tsconfig ./tsconfig.json --threshold error"
+  },
+  "dependencies": {
+    "@tinytars/vault": "^0.1.15"
+  },
+  "peerDependencies": {
+    "svelte": "^5.0.0"
+  },
+  "devDependencies": {
+    "@tsconfig/svelte": "^5.0.8",
+    "svelte": "^5.55.5",
+    "svelte-check": "^4.4.8",
+    "typescript": "~6.0.2"
+  }
+}