{{ __('auth.recovery_heading') }}

{{ __('auth.recovery_subtitle') }}

{{-- Revealed panel: shown only once codes arrive via the transient `reveal-codes` event. The codes live in Alpine JS memory (x-for) and are never in the server HTML/snapshot. --}}

{{ __('auth.recovery_warning') }}

{{-- POST + @csrf: consuming the one-time grant is a state change, so a cross-site request cannot burn the grant. Behaves identically to a download link. --}}
@csrf {{ __('auth.recovery_download') }}
{{ __('common.close') }}
{{-- Hidden notice: the default state (no codes in memory) — manage view, or any replayed snapshot, which fires no event and therefore never populates `codes`. --}}

{{ __('auth.recovery_hidden_notice') }}

{{ __('auth.recovery_regenerate') }} {{ __('common.close') }}