---

## AccountSettings
**Stability:** beta — the API shape is settled and documented; behaviour-level fixes may still land as breaking changes in a minor.
Self-service account-settings panel: change name, email and
password, and delete the account. Each section talks to `apiPath` (default
`/api/auth/account`); pair them with the server handlers
`createUpdateProfileHandler`, `createChangeEmailHandler`,
`createChangePasswordHandler` and `createDeleteAccountHandler`. The new-password
field gates against the server's policy, read from `policyPath`
(`createPasswordPolicyHandler`).

**Import:** `import { AccountSettings } from '@urbicon-ui/auth';`

### Examples
```svelte
<AccountSettings {user} onProfileUpdated={(u) => (auth.user = u)} onDeleted={() => goto('/')} />
```

### Api
| Prop | Type | Required | Default | Description |
| --- | --- | :---: | --- | --- |
| user | `AuthUser | null` | yes |  | The current authenticated user: its `name` pre-fills the profile field and its `email` is shown as the current address. Pass `locals.user` / your auth store's user. While `null` nothing renders. |
| apiPath | `string` | no | '/api/auth/account' | API base path for the account endpoints. |
| class | `string` | no |  | Extra classes on the root element. In the same Tailwind bucket `class` wins over the `slotClasses` entry for the element it lands on. Presets and provider defaults sit below both. |
| csrf | `CsrfClientOptions` | no |  | CSRF cookie/header names. Only needed when the server overrides the defaults via `config.csrf`. Mutating requests echo the token automatically. |
| fetcher | `typeof globalThis.fetch` | no |  | Custom fetch implementation for all API calls. Defaults to the global `fetch`. Useful for mock backends in demos/tests or custom retry/auth layers. |
| onDeleted | `() => void` | no |  | Called after the account has been deleted (e.g. redirect to a goodbye page). |
| onProfileUpdated | `(user: AuthUser) => void` | no |  | Called with the refreshed user after a successful profile change (update your store here). |
| passwordPolicy | `PasswordPolicy` | no |  | The password policy the new-password field gates against, when you already have it server-side (`resolvePasswordPolicy(config.password)`). Supplying it skips the `policyPath` request. |
| policyPath | `string | null` | no | '/api/auth/password-policy' | Endpoint serving `createPasswordPolicyHandler`, read once on mount so the checklist and the submit gate match what the server enforces. `null` disables the request and falls back to the package defaults (min 8, no character classes). |
| preset | `string` | no |  | Apply a named preset registered via `<BlocksProvider presets={{ AccountSettings: { … } }}>`. Resolves after the provider defaults and before this instance's own `slotClasses`, so a project-wide look lives in one place instead of being repeated at every usage site. |
| showRequirements | `boolean` | no | true | Show the real-time password requirements checklist under the new password. |
| slotClasses | `Partial<Record<'root' | 'title' | 'section' | 'sectionTitle' | 'field' | 'requirements' | 'submit' | 'danger', string>>` | no |  | Per-slot class overrides. In the same Tailwind bucket `class` wins over the `slotClasses` entry for the element it lands on. Presets and provider defaults sit below both. |
| t | `PartialAuthLocale` | no |  | Locale overrides, deep-merged over the bundle registered for the active locale — English unless `registerAuthLocale` ran for it. Pass any subset, from a single string to a whole tree. |
| unstyled | `boolean` | no |  | Strip all default styling. |

### Types
```ts
type PartialAuthLocale = DeepPartial<AuthLocale>
```

```ts
interface PasswordPolicy {
/** Minimum length. @default 8 */
  minLength: number;
  /** Require at least one `A-Z`. @default false */
  requireUppercase: boolean;
  /** Require at least one `a-z`. @default false */
  requireLowercase: boolean;
  /** Require at least one `0-9`. @default false */
  requireDigit: boolean;
  /** Require at least one character outside `A-Za-z0-9`. @default false */
  requireSpecial: boolean;
}
```

```ts
interface AuthUser {
id: string;
  email: string;
  name: string;
  role: R;
  emailVerified: boolean;
  /**
   * Whether TOTP two-factor authentication is active on the account. A public
   * account-status flag in the same spirit as `emailVerified` — it drives the
   * `TwoFactorManager` UI and the login two-step, and never carries the secret
   * itself. `false` for every user until they finish 2FA setup, and for
   * consumers who don't wire 2FA at all (the adapter defaults a missing column
   * to `false`).
   */
  totpEnabled: boolean;
}
```

```ts
interface CsrfClientOptions {
cookieName?: string;
  headerName?: string;
  /**
   * Match the server's `csrf.useHostPrefix` — read the token from the
   * `__Host-`-prefixed cookie name. Leave `false` (default) unless the server
   * sets `useHostPrefix: true`.
   */
  useHostPrefix?: boolean;
}
```

```ts
type DeepPartial = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T
```

- `interface AuthLocale` — 8 members, definition omitted (387 lines; full definition: packages/auth/src/lib/i18n/keys.ts)

### Slots (slotClasses keys)
`root`, `title`, `section`, `sectionTitle`, `field`, `requirements`, `submit`, `danger`