@@ -304,6 +361,9 @@
{claimToast} — view dashboard →
{/if}
+ {#if sharedToast}
+
+ {/if}
{#if chatStore.open}
@@ -491,6 +551,42 @@
border: 2px solid #fff;
box-shadow: 0 0 0 1px #e2e8f0;
}
+ .shared-toggle {
+ width: 40px;
+ height: 40px;
+ border: none;
+ border-radius: 10px;
+ background: #f3f4f6;
+ color: #9ca3af;
+ display: flex;
+ align-items: center;
+ justify-content: center;
+ cursor: pointer;
+ }
+ .shared-toggle:hover {
+ background: #e5e7eb;
+ }
+ .shared-toggle.on {
+ background: #6366f1;
+ color: #fff;
+ box-shadow: 0 0 0 3px rgba(99, 102, 241, 0.25);
+ }
+ .shared-toast {
+ position: fixed;
+ bottom: 1rem;
+ left: 50%;
+ transform: translateX(-50%);
+ background: #1f2937;
+ color: #fff;
+ padding: 0.6rem 1.2rem;
+ border-radius: 12px;
+ font-size: 0.85rem;
+ font-weight: 600;
+ z-index: 96;
+ box-shadow: 0 4px 14px rgba(0, 0, 0, 0.3);
+ max-width: min(92vw, 560px);
+ text-align: center;
+ }
.picker-stage {
min-height: 100vh;
width: 100%;
diff --git a/frontend/src/routes/[fam]/switch/+page.server.ts b/frontend/src/routes/[fam]/switch/+page.server.ts
new file mode 100644
index 0000000..d3f1780
--- /dev/null
+++ b/frontend/src/routes/[fam]/switch/+page.server.ts
@@ -0,0 +1,13 @@
+import { redirect } from '@sveltejs/kit';
+
+// The fam layout renders the shared-device picker when child sessions exist
+// but none is active. With an active session this route just sends you home.
+export async function load(event) {
+ const session = event.locals.user;
+ if (session) {
+ const fam = event.params.fam;
+ if (session.role === 'parent') throw redirect(303, `/${fam}`);
+ throw redirect(303, `/${fam}/${encodeURIComponent(session.username || '')}`);
+ }
+ return {};
+}
diff --git a/frontend/src/routes/[fam]/switch/+page.svelte b/frontend/src/routes/[fam]/switch/+page.svelte
new file mode 100644
index 0000000..08f21a8
--- /dev/null
+++ b/frontend/src/routes/[fam]/switch/+page.svelte
@@ -0,0 +1,4 @@
+
+
diff --git a/frontend/src/routes/api/device/remove/+server.ts b/frontend/src/routes/api/device/remove/+server.ts
new file mode 100644
index 0000000..0720624
--- /dev/null
+++ b/frontend/src/routes/api/device/remove/+server.ts
@@ -0,0 +1,23 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestEvent } from '@sveltejs/kit';
+import {
+ ACTIVE_COOKIE,
+ childSessionCookie,
+ clearChildSession,
+ clearActiveChild
+} from '$lib/server/session';
+
+// Remove ONE child profile from this device (picker ✕). Device-local cookie
+// surgery only — no PB writes, no session required (the picker is reachable
+// with no active user).
+export async function POST(event: RequestEvent) {
+ const body = await event.request.json().catch(() => ({}));
+ const { userId } = body as { userId?: string };
+ if (!userId) throw error(400, 'Missing userId');
+ if (!event.cookies.get(childSessionCookie(userId))) {
+ throw error(400, 'No session on this device');
+ }
+ clearChildSession(event.cookies, userId);
+ if (event.cookies.get(ACTIVE_COOKIE) === userId) clearActiveChild(event.cookies);
+ return json({ ok: true });
+}
diff --git a/frontend/src/routes/api/pins/+server.ts b/frontend/src/routes/api/pins/+server.ts
new file mode 100644
index 0000000..7b3b2d2
--- /dev/null
+++ b/frontend/src/routes/api/pins/+server.ts
@@ -0,0 +1,74 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestEvent } from '@sveltejs/kit';
+import { getPin, setPin, verifyPin, hasPin, PIN_RE } from '$lib/server/pins';
+import { createPbClient } from '$lib/server/pocketbase';
+
+// PIN status for the shared-device toggle reminders. Never reveals values:
+// - child → whether THEIR OWN pin is set (about self only);
+// - parent → per-child set/unset roster (names + booleans, no PIN values;
+// actual values stay behind the settings revealPin action).
+export async function GET(event: RequestEvent) {
+ const u = event.locals.user;
+ if (!u || !event.locals.pbToken) throw error(401, 'Unauthorized');
+ if (u.role === 'child') {
+ return json({ hasPin: await hasPin(u.id) });
+ }
+ if (u.role !== 'parent') throw error(403, 'Forbidden');
+ const pb = createPbClient(event.locals.pbToken);
+ const kids: any[] = await pb
+ .collection('users')
+ .getFullList({ filter: `famId = '${u.famId}' && role = 'child'` })
+ .catch(() => []);
+ const children = await Promise.all(
+ kids.map(async (k: any) => ({
+ userId: k.id,
+ name: k.name || '?',
+ hasPin: await hasPin(k.id)
+ }))
+ );
+ return json({ children });
+}
+
+// Child PIN management. Session-role checked here (PB rules are superuser-only
+// on `pins`): only the child themselves can set/change their own PIN.
+export async function POST(event: RequestEvent) {
+ const u = event.locals.user;
+ if (!u) throw error(401, 'Unauthorized');
+ if (u.role !== 'child') throw error(403, 'Only children use PINs');
+
+ const body = await event.request.json().catch(() => ({}));
+ const { action, pin, currentPin } = body as {
+ action?: string;
+ pin?: string;
+ currentPin?: string;
+ };
+ if (!action || !pin || !PIN_RE.test(pin)) {
+ throw error(400, 'PIN must be exactly 3 digits');
+ }
+
+ if (action === 'set') {
+ if (await getPin(u.id)) throw error(400, 'PIN already set');
+ await setPin(u.famId, u.id, pin);
+ return json({ ok: true });
+ }
+
+ // Join wizard: assign the PIN on THIS device without touching an existing
+ // one (a kid joining a second shared device already has a PIN — their pin
+ // works everywhere; nobody can silently reassign it).
+ if (action === 'ensure') {
+ if (!(await getPin(u.id))) await setPin(u.famId, u.id, pin);
+ return json({ ok: true });
+ }
+
+ if (action === 'change') {
+ const existing = await getPin(u.id);
+ if (!existing) throw error(400, 'No PIN set yet');
+ if (!currentPin || !(await verifyPin(u.id, currentPin))) {
+ throw error(401, 'Current PIN is wrong');
+ }
+ await setPin(u.famId, u.id, pin);
+ return json({ ok: true });
+ }
+
+ throw error(400, 'Unknown action');
+}
diff --git a/frontend/src/routes/api/switch-user/+server.ts b/frontend/src/routes/api/switch-user/+server.ts
new file mode 100644
index 0000000..3394e4d
--- /dev/null
+++ b/frontend/src/routes/api/switch-user/+server.ts
@@ -0,0 +1,84 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestEvent } from '@sveltejs/kit';
+import { createPbClient, createSuperClient } from '$lib/server/pocketbase';
+import { childSessionCookie, setChildSessionCookie, setActiveChild } from '$lib/server/session';
+import { verifyPin } from '$lib/server/pins';
+import { derivePassword } from '$lib/server/member-otp';
+import { famUsername } from '@shared/slugify';
+
+// Shared-device PIN switch. The PIN *selects* among sessions that already
+// exist on this device — it is not a credential that mints anything on a
+// fresh device. The target must have a pb_token_