@aooth/auth-moost 0.1.9 → 0.1.11

package/dist/atscript/index.d.mts

@@ -1,2 +1,2 @@
-import { C as SetPasswordForm, E as WithInlineConsentForm, S as Select2faForm, T as TermsBumpForm, _ as ProveControlForm, a as EmailIdentifierForm, b as RecoveryModeSelectForm, c as EnrollPickMethodForm, d as LoginCredentialsForm, f as MagicLinkRequestForm, g as PincodeForm, h as PasswordReauthForm, i as ConcurrencyLimitForm, l as EnrollTotpQrForm, m as MfaCodeForm, n as AskPhoneForm, o as EnrollAddressForm, p as ManageMfaForm, r as ChangePasswordForm, s as EnrollConfirmForm, t as AskEmailForm, u as InviteForm, v as ProveControlOtpForm, w as SignupForm, x as RemoveMfaConfirmForm, y as RecoveryFactorForm } from "../forms-DV4UcC29.mjs";
+import { C as SetPasswordForm, E as WithInlineConsentForm, S as Select2faForm, T as TermsBumpForm, _ as ProveControlForm, a as EmailIdentifierForm, b as RecoveryModeSelectForm, c as EnrollPickMethodForm, d as LoginCredentialsForm, f as MagicLinkRequestForm, g as PincodeForm, h as PasswordReauthForm, i as ConcurrencyLimitForm, l as EnrollTotpQrForm, m as MfaCodeForm, n as AskPhoneForm, o as EnrollAddressForm, p as ManageMfaForm, r as ChangePasswordForm, s as EnrollConfirmForm, t as AskEmailForm, u as InviteForm, v as ProveControlOtpForm, w as SignupForm, x as RemoveMfaConfirmForm, y as RecoveryFactorForm } from "../forms-11EDZgS1.mjs";
 export { AskEmailForm, AskPhoneForm, ChangePasswordForm, ConcurrencyLimitForm, EmailIdentifierForm, EnrollAddressForm, EnrollConfirmForm, EnrollPickMethodForm, EnrollTotpQrForm, InviteForm, LoginCredentialsForm, MagicLinkRequestForm, ManageMfaForm, MfaCodeForm, PasswordReauthForm, PincodeForm, ProveControlForm, ProveControlOtpForm, RecoveryFactorForm, RecoveryModeSelectForm, RemoveMfaConfirmForm, Select2faForm, SetPasswordForm, SignupForm, TermsBumpForm, WithInlineConsentForm };

package/dist/atscript/index.mjs

@@ -1,2 +1,2 @@
-import { C as SetPasswordForm, E as WithInlineConsentForm, S as Select2faForm, T as TermsBumpForm, _ as ProveControlForm, a as EmailIdentifierForm, b as RecoveryModeSelectForm, c as EnrollPickMethodForm, d as LoginCredentialsForm, f as MagicLinkRequestForm, g as PincodeForm, h as PasswordReauthForm, i as ConcurrencyLimitForm, l as EnrollTotpQrForm, m as MfaCodeForm, n as AskPhoneForm, o as EnrollAddressForm, p as ManageMfaForm, r as ChangePasswordForm, s as EnrollConfirmForm, t as AskEmailForm, u as InviteForm, v as ProveControlOtpForm, w as SignupForm, x as RemoveMfaConfirmForm, y as RecoveryFactorForm } from "../forms-DV4UcC29.mjs";
+import { C as SetPasswordForm, E as WithInlineConsentForm, S as Select2faForm, T as TermsBumpForm, _ as ProveControlForm, a as EmailIdentifierForm, b as RecoveryModeSelectForm, c as EnrollPickMethodForm, d as LoginCredentialsForm, f as MagicLinkRequestForm, g as PincodeForm, h as PasswordReauthForm, i as ConcurrencyLimitForm, l as EnrollTotpQrForm, m as MfaCodeForm, n as AskPhoneForm, o as EnrollAddressForm, p as ManageMfaForm, r as ChangePasswordForm, s as EnrollConfirmForm, t as AskEmailForm, u as InviteForm, v as ProveControlOtpForm, w as SignupForm, x as RemoveMfaConfirmForm, y as RecoveryFactorForm } from "../forms-11EDZgS1.mjs";
 export { AskEmailForm, AskPhoneForm, ChangePasswordForm, ConcurrencyLimitForm, EmailIdentifierForm, EnrollAddressForm, EnrollConfirmForm, EnrollPickMethodForm, EnrollTotpQrForm, InviteForm, LoginCredentialsForm, MagicLinkRequestForm, ManageMfaForm, MfaCodeForm, PasswordReauthForm, PincodeForm, ProveControlForm, ProveControlOtpForm, RecoveryFactorForm, RecoveryModeSelectForm, RemoveMfaConfirmForm, Select2faForm, SetPasswordForm, SignupForm, TermsBumpForm, WithInlineConsentForm };

package/dist/{forms-DV4UcC29.mjs → forms-11EDZgS1.mjs}

@@ -345,14 +345,14 @@ defineAnnotatedType("object", EnrollPickMethodForm).prop("method", defineAnnotat
 }).annotate("ui.form.fn.hidden", "(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== \"optional\"").optional().$type).prop("cancel", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "cancel",
 	label: "Cancel"
-}).annotate("ui.form.fn.hidden", "(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== \"manage\"").optional().$type).annotate("meta.label", "Set up two-factor authentication").annotate("meta.description", "Pick a method to receive your verification codes.").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Continue");
-defineAnnotatedType("object", EnrollAddressForm).prop("address", defineAnnotatedType().designType("string").tags("string").annotate("ui.form.order", 10).annotate("ui.form.type", "text").annotate("meta.label", "Address").annotate("meta.required", {}).annotate("ui.form.validate", "(v, _d, ctx) => ctx.public?.mfaEnroll?.method !== \"email\" || /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(v) || \"Enter a valid email address\"", true).$type).prop("skip", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
+}).annotate("ui.form.fn.hidden", "() => true").optional().$type).annotate("meta.label", "Set up two-factor authentication").annotate("meta.description", "Pick a method to receive your verification codes.").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Continue");
+defineAnnotatedType("object", EnrollAddressForm).prop("address", defineAnnotatedType().designType("string").tags("string").annotate("ui.form.order", 10).annotate("ui.form.type", "text").annotate("meta.label", "Address").annotate("ui.form.fn.label", "(_, _d, ctx) => ctx.public?.mfaEnroll?.method === \"sms\" ? \"Phone number\" : ctx.public?.mfaEnroll?.method === \"email\" ? \"Email address\" : \"Address\"").annotate("meta.required", {}).annotate("ui.form.validate", "(v, _d, ctx) => ctx.public?.mfaEnroll?.method !== \"email\" || /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(v) || \"Enter a valid email address\"", true).$type).prop("skip", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "skip",
 	label: "Skip for now"
 }).annotate("ui.form.fn.hidden", "(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== \"optional\"").optional().$type).prop("cancel", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "cancel",
 	label: "Cancel"
-}).annotate("ui.form.fn.hidden", "(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== \"manage\"").optional().$type).prop("useDifferentMethod", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
+}).annotate("ui.form.fn.hidden", "() => true").optional().$type).prop("useDifferentMethod", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "useDifferentMethod",
 	label: "Use a different method"
 }).annotate("ui.form.fn.hidden", "(_, _d, ctx) => (ctx.public?.mfaEnroll?.availableTransports?.length ?? 0) < 2 || ctx.public?.mfaEnroll?.mode === \"manage\"").optional().$type).annotate("ui.form.fn.title", "(_, _d, ctx) => ctx.public?.mfaEnroll?.method === \"sms\" ? \"Add your phone number\" : \"Add your email\"").annotate("meta.description", "We will send you a one-time code to confirm.").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Send code");
@@ -368,7 +368,7 @@ defineAnnotatedType("object", EnrollConfirmForm).prop("transportHint", defineAnn
 }).annotate("ui.form.fn.hidden", "(_, _d, ctx) => (ctx.public?.mfaEnroll?.availableTransports?.length ?? 0) < 2 || ctx.public?.mfaEnroll?.mode === \"manage\"").optional().$type).prop("cancel", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "cancel",
 	label: "Cancel"
-}).annotate("ui.form.fn.hidden", "(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== \"manage\"").optional().$type).prop("skip", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
+}).annotate("ui.form.fn.hidden", "() => true").optional().$type).prop("skip", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "skip",
 	label: "Skip for now"
 }).annotate("ui.form.fn.hidden", "(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== \"optional\"").optional().$type).annotate("meta.label", "Confirm your verification code").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Confirm");
@@ -381,22 +381,22 @@ defineAnnotatedType("object", EnrollTotpQrForm).prop("qrCode", defineAnnotatedTy
 }).annotate("ui.form.fn.hidden", "(_, _d, ctx) => (ctx.public?.mfaEnroll?.availableTransports?.length ?? 0) < 2 || ctx.public?.mfaEnroll?.mode === \"manage\"").optional().$type).prop("cancel", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "cancel",
 	label: "Cancel"
-}).annotate("ui.form.fn.hidden", "(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== \"manage\"").optional().$type).prop("skip", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
+}).annotate("ui.form.fn.hidden", "() => true").optional().$type).prop("skip", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "skip",
 	label: "Skip for now"
 }).annotate("ui.form.fn.hidden", "(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== \"optional\"").optional().$type).annotate("meta.label", "Scan this QR code").annotate("meta.description", "Open your authenticator app and scan the code (or enter the key manually), then continue to enter the code it shows.").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Continue");
 defineAnnotatedType("object", ManageMfaForm).prop("lockedNote", defineAnnotatedType().designType("phantom").tags("paragraph", "ui").annotate("ui.form.order", 5).annotate("ui.form.fn.value", "(_, _d, ctx) => (ctx.public?.manage?.locked?.length ?? 0) > 0 ? \"Some methods are also used to sign in and can’t be changed here.\" : \"\"").annotate("ui.form.fn.hidden", "(_, _d, ctx) => (ctx.public?.manage?.locked?.length ?? 0) === 0").$type).prop("operation", defineAnnotatedType().designType("string").tags("string").annotate("ui.form.order", 10).annotate("ui.form.type", "radio").annotate("ui.form.fn.options", "(_, _d, ctx) => { const lbl = (t) => t === \"totp\" ? \"authenticator app\" : t === \"sms\" ? \"SMS\" : t === \"email\" ? \"email\" : t; const locked = ctx.public?.manage?.locked ?? []; const out = []; for (const t of (ctx.public?.manage?.candidates ?? [])) out.push({ key: \"add:\" + t, label: \"Add \" + lbl(t) }); for (const m of (ctx.public?.mfa?.enrolledMethods ?? [])) { if (locked.includes(m.kind)) continue; out.push({ key: \"replace:\" + m.kind, label: \"Change \" + lbl(m.kind) + (m.masked ? \" (\" + m.masked + \")\" : \"\") }); out.push({ key: \"remove:\" + m.kind, label: \"Remove \" + lbl(m.kind) }); } return out; }").annotate("meta.label", "What would you like to do?").annotate("meta.required", {}).$type).prop("cancel", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "cancel",
 	label: "Cancel"
-}).optional().$type).annotate("meta.label", "Manage two-factor authentication").annotate("meta.description", "Add, change, or remove a verification method.").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Continue");
+}).annotate("ui.form.fn.hidden", "() => true").optional().$type).annotate("meta.label", "Manage two-factor authentication").annotate("meta.description", "Add, change, or remove a verification method.").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Continue");
 defineAnnotatedType("object", RemoveMfaConfirmForm).prop("notice", defineAnnotatedType().designType("phantom").tags("paragraph", "ui").annotate("ui.form.order", 1).annotate("ui.form.fn.value", "(_, _d, ctx) => { const t = ctx.public?.mfaEnroll?.method; const lbl = t === \"totp\" ? \"your authenticator app\" : t === \"sms\" ? \"SMS codes\" : t === \"email\" ? \"email codes\" : \"this method\"; return \"Remove \" + lbl + \" as a two-factor method? You can set it up again later.\"; }").$type).prop("cancel", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "cancel",
 	label: "Cancel"
-}).optional().$type).annotate("meta.label", "Remove this method?").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Remove");
+}).annotate("ui.form.fn.hidden", "() => true").optional().$type).annotate("meta.label", "Remove this method?").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Remove");
 defineAnnotatedType("object", PasswordReauthForm).prop("password", defineAnnotatedType().designType("string").tags("string").annotate("ui.form.order", 10).annotate("ui.form.type", "password").annotate("meta.label", "Password").annotate("ui.form.autocomplete", "current-password").annotate("meta.sensitive", true).annotate("meta.required", {}).annotate("expect.minLength", { length: 1 }).$type).prop("cancel", defineAnnotatedType().designType("phantom").tags("action", "ui").annotate("ui.form.action", {
 	id: "cancel",
 	label: "Cancel"
-}).optional().$type).annotate("meta.label", "Confirm your password").annotate("meta.description", "Re-enter your account password to manage your two-factor methods.").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Verify");
+}).annotate("ui.form.fn.hidden", "() => true").optional().$type).annotate("meta.label", "Confirm your password").annotate("meta.description", "Re-enter your account password to manage your two-factor methods.").annotate("wf.context.pass", "public", true).annotate("ui.form.submit.text", "Verify");
 defineAnnotatedType("object", TermsBumpForm).prop("consents", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("meta.label", "Pending consents").annotate("ui.form.component", "AsConsentArray").annotate("ui.form.fn.attr", {
 	name: "pendingConsents",
 	fn: "(_, _d, ctx) => ctx.public?.consents?.pending"

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { C as SetPasswordForm, S as Select2faForm, T as TermsBumpForm, _ as ProveControlForm, a as EmailIdentifierForm, c as EnrollPickMethodForm, d as LoginCredentialsForm, g as PincodeForm, h as PasswordReauthForm, i as ConcurrencyLimitForm, l as EnrollTotpQrForm, m as MfaCodeForm, n as AskPhoneForm, o as EnrollAddressForm, p as ManageMfaForm, r as ChangePasswordForm, s as EnrollConfirmForm, t as AskEmailForm, u as InviteForm, v as ProveControlOtpForm, w as SignupForm, x as RemoveMfaConfirmForm } from "./forms-DV4UcC29.mjs";
+import { C as SetPasswordForm, S as Select2faForm, T as TermsBumpForm, _ as ProveControlForm, a as EmailIdentifierForm, c as EnrollPickMethodForm, d as LoginCredentialsForm, g as PincodeForm, h as PasswordReauthForm, i as ConcurrencyLimitForm, l as EnrollTotpQrForm, m as MfaCodeForm, n as AskPhoneForm, o as EnrollAddressForm, p as ManageMfaForm, r as ChangePasswordForm, s as EnrollConfirmForm, t as AskEmailForm, u as InviteForm, v as ProveControlOtpForm, w as SignupForm, x as RemoveMfaConfirmForm } from "./forms-11EDZgS1.mjs";
 import { Controller, HandlerPaths, Inherit, Inject, InjectMoostLogger, Injectable, Intercept, MoostInit, Optional, Param, Resolve, TInterceptorPriority, defineAfterInterceptor, defineBeforeInterceptor, getMoostMate, useControllerContext } from "moost";
 import { AuthCredential, AuthError, generateMagicLinkToken } from "@aooth/auth";
 import { current, defineWook, eventTypeKey, key } from "@wooksjs/event-core";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/auth-moost",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Moost auth integration for aoothjs — AuthGuard interceptor, useAuth composable, REST endpoints, workflows",
   "keywords": [
     "aoothjs",
@@ -57,33 +57,33 @@
     "access": "public"
   },
   "dependencies": {
-    "@atscript/moost-wf": "^0.1.90",
+    "@atscript/moost-wf": "^0.1.92",
     "@wooksjs/http-body": "^0.7.17",
-    "@aooth/arbac-moost": "^0.1.9",
-    "@aooth/idp": "0.1.9",
-    "@aooth/auth": "0.1.9",
-    "@aooth/user": "0.1.9"
+    "@aooth/auth": "0.1.11",
+    "@aooth/idp": "0.1.11",
+    "@aooth/user": "0.1.11",
+    "@aooth/arbac-moost": "^0.1.11"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.70",
-    "@atscript/typescript": "^0.1.70",
-    "@atscript/ui": "^0.1.90",
-    "@atscript/ui-fns": "^0.1.90",
-    "@moostjs/event-http": "^0.6.23",
-    "@moostjs/event-wf": "^0.6.23",
-    "moost": "^0.6.23",
-    "unplugin-atscript": "^0.1.70",
+    "@atscript/core": "^0.1.71",
+    "@atscript/typescript": "^0.1.71",
+    "@atscript/ui": "^0.1.92",
+    "@atscript/ui-fns": "^0.1.92",
+    "@moostjs/event-http": "^0.6.24",
+    "@moostjs/event-wf": "^0.6.24",
+    "moost": "^0.6.24",
+    "unplugin-atscript": "^0.1.71",
     "wooks": "^0.7.17"
   },
   "peerDependencies": {
-    "@atscript/moost-wf": "^0.1.90",
-    "@atscript/typescript": "^0.1.70",
-    "@moostjs/event-http": "^0.6.23",
-    "@moostjs/event-wf": "^0.6.23",
+    "@atscript/moost-wf": "^0.1.92",
+    "@atscript/typescript": "^0.1.71",
+    "@moostjs/event-http": "^0.6.24",
+    "@moostjs/event-wf": "^0.6.24",
     "@wooksjs/event-core": "^0.7.17",
     "@wooksjs/event-http": "^0.7.17",
     "@wooksjs/http-body": "^0.7.17",
-    "moost": "^0.6.23"
+    "moost": "^0.6.24"
   },
   "peerDependenciesMeta": {
     "@atscript/typescript": {

package/src/atscript/models/forms.as

@@ -521,9 +521,11 @@ export interface EnrollPickMethodForm {
     skip?: ui.action
 
     // Manage-MFA only: the user opened this on purpose, so "Skip" makes no
-    // sense — offer a clean cancel instead.
+    // sense — a `cancel` action is declared instead (host-rendered, see below).
+    // Built-in cancel hidden but kept whitelisted so a host can fire it — see
+    // auth-moost CLAUDE.md "Manage-MFA host cancel" (consumer renders its own).
     @ui.form.action 'cancel', 'Cancel'
-    @ui.form.fn.hidden '(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== "manage"'
+    @ui.form.fn.hidden '() => true'
     cancel?: ui.action
 }
 
@@ -542,7 +544,13 @@ export interface EnrollPickMethodForm {
 export interface EnrollAddressForm {
     @ui.form.order 10
     @ui.form.type 'text'
+    // Transport-aware label: this single field collects either a phone number
+    // (sms) or an email (email), so the label reads the chosen transport off
+    // `ctx.public.mfaEnroll.method`. `@meta.label 'Address'` is the static
+    // fallback when `@atscript/ui-fns` is absent (the fn key overrides it when
+    // present — fn wins over static, else static is the fallback).
     @meta.label 'Address'
+    @ui.form.fn.label '(_, _d, ctx) => ctx.public?.mfaEnroll?.method === "sms" ? "Phone number" : ctx.public?.mfaEnroll?.method === "email" ? "Email address" : "Address"'
     @meta.required
     // Client-side format hint — email branch must look like an email; the SMS
     // branch stays free-form (server-side E.164 normalization). The robust
@@ -554,8 +562,10 @@ export interface EnrollAddressForm {
     @ui.form.fn.hidden '(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== "optional"'
     skip?: ui.action
 
+    // Built-in cancel hidden but kept whitelisted so a host can fire it — see
+    // auth-moost CLAUDE.md "Manage-MFA host cancel" (consumer renders its own).
     @ui.form.action 'cancel', 'Cancel'
-    @ui.form.fn.hidden '(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== "manage"'
+    @ui.form.fn.hidden '() => true'
     cancel?: ui.action
 
     @ui.form.action 'useDifferentMethod', 'Use a different method'
@@ -601,8 +611,10 @@ export interface EnrollConfirmForm {
     @ui.form.fn.hidden '(_, _d, ctx) => (ctx.public?.mfaEnroll?.availableTransports?.length ?? 0) < 2 || ctx.public?.mfaEnroll?.mode === "manage"'
     useDifferentMethod?: ui.action
 
+    // Built-in cancel hidden but kept whitelisted so a host can fire it — see
+    // auth-moost CLAUDE.md "Manage-MFA host cancel" (consumer renders its own).
     @ui.form.action 'cancel', 'Cancel'
-    @ui.form.fn.hidden '(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== "manage"'
+    @ui.form.fn.hidden '() => true'
     cancel?: ui.action
 
     @ui.form.action 'skip', 'Skip for now'
@@ -636,8 +648,10 @@ export interface EnrollTotpQrForm {
     @ui.form.fn.hidden '(_, _d, ctx) => (ctx.public?.mfaEnroll?.availableTransports?.length ?? 0) < 2 || ctx.public?.mfaEnroll?.mode === "manage"'
     useDifferentMethod?: ui.action
 
+    // Built-in cancel hidden but kept whitelisted so a host can fire it — see
+    // auth-moost CLAUDE.md "Manage-MFA host cancel" (consumer renders its own).
     @ui.form.action 'cancel', 'Cancel'
-    @ui.form.fn.hidden '(_, _d, ctx) => ctx.public?.mfaEnroll?.mode !== "manage"'
+    @ui.form.fn.hidden '() => true'
     cancel?: ui.action
 
     @ui.form.action 'skip', 'Skip for now'
@@ -675,7 +689,10 @@ export interface ManageMfaForm {
     @meta.required
     operation: string
 
+    // Hidden built-in cancel — host renders its own and fires `cancel` on
+    // abandon (so the durable wf-state row is cleaned, not left to expire).
     @ui.form.action 'cancel', 'Cancel'
+    @ui.form.fn.hidden '() => true'
     cancel?: ui.action
 }
 
@@ -693,7 +710,10 @@ export interface RemoveMfaConfirmForm {
     @ui.form.fn.value '(_, _d, ctx) => { const t = ctx.public?.mfaEnroll?.method; const lbl = t === "totp" ? "your authenticator app" : t === "sms" ? "SMS codes" : t === "email" ? "email codes" : "this method"; return "Remove " + lbl + " as a two-factor method? You can set it up again later."; }'
     notice: ui.paragraph
 
+    // Hidden built-in cancel — host renders its own and fires `cancel` on
+    // abandon (so the durable wf-state row is cleaned, not left to expire).
     @ui.form.action 'cancel', 'Cancel'
+    @ui.form.fn.hidden '() => true'
     cancel?: ui.action
 }
 
@@ -718,7 +738,10 @@ export interface PasswordReauthForm {
     @expect.minLength 1
     password: string
 
+    // Hidden built-in cancel — host renders its own and fires `cancel` on
+    // abandon (so the durable wf-state row is cleaned, not left to expire).
     @ui.form.action 'cancel', 'Cancel'
+    @ui.form.fn.hidden '() => true'
     cancel?: ui.action
 }
 

package/src/atscript/models/forms.as.d.ts

@@ -227,7 +227,7 @@ export declare class EnrollPickMethodForm {
 
 /**
  * Atscript interface **EnrollAddressForm**
- * @see {@link ./forms.as:542:18}
+ * @see {@link ./forms.as:544:18}
  */
 export declare class EnrollAddressForm {
   address: string
@@ -246,7 +246,7 @@ export declare class EnrollAddressForm {
 
 /**
  * Atscript interface **EnrollConfirmForm**
- * @see {@link ./forms.as:580:18}
+ * @see {@link ./forms.as:590:18}
  */
 export declare class EnrollConfirmForm {
   // transportHint: ui.paragraph
@@ -267,7 +267,7 @@ export declare class EnrollConfirmForm {
 
 /**
  * Atscript interface **EnrollTotpQrForm**
- * @see {@link ./forms.as:628:18}
+ * @see {@link ./forms.as:640:18}
  */
 export declare class EnrollTotpQrForm {
   // qrCode: ui.paragraph
@@ -286,7 +286,7 @@ export declare class EnrollTotpQrForm {
 
 /**
  * Atscript interface **ManageMfaForm**
- * @see {@link ./forms.as:665:18}
+ * @see {@link ./forms.as:679:18}
  */
 export declare class ManageMfaForm {
   // lockedNote: ui.paragraph
@@ -304,7 +304,7 @@ export declare class ManageMfaForm {
 
 /**
  * Atscript interface **RemoveMfaConfirmForm**
- * @see {@link ./forms.as:691:18}
+ * @see {@link ./forms.as:708:18}
  */
 export declare class RemoveMfaConfirmForm {
   // notice: ui.paragraph
@@ -321,7 +321,7 @@ export declare class RemoveMfaConfirmForm {
 
 /**
  * Atscript interface **PasswordReauthForm**
- * @see {@link ./forms.as:711:18}
+ * @see {@link ./forms.as:731:18}
  */
 export declare class PasswordReauthForm {
   password: string
@@ -338,7 +338,7 @@ export declare class PasswordReauthForm {
 
 /**
  * Atscript interface **TermsBumpForm**
- * @see {@link ./forms.as:737:18}
+ * @see {@link ./forms.as:760:18}
  */
 export declare class TermsBumpForm extends WithInlineConsentForm {
   static __is_atscript_annotated_type: true
@@ -353,7 +353,7 @@ export declare class TermsBumpForm extends WithInlineConsentForm {
 
 /**
  * Atscript interface **ConcurrencyLimitForm**
- * @see {@link ./forms.as:750:18}
+ * @see {@link ./forms.as:773:18}
  */
 export declare class ConcurrencyLimitForm {
   static __is_atscript_annotated_type: true
@@ -368,7 +368,7 @@ export declare class ConcurrencyLimitForm {
 
 /**
  * Atscript interface **MagicLinkRequestForm**
- * @see {@link ./forms.as:760:18}
+ * @see {@link ./forms.as:783:18}
  */
 export declare class MagicLinkRequestForm {
   identifier: string
@@ -384,7 +384,7 @@ export declare class MagicLinkRequestForm {
 
 /**
  * Atscript interface **RecoveryModeSelectForm**
- * @see {@link ./forms.as:775:18}
+ * @see {@link ./forms.as:798:18}
  */
 export declare class RecoveryModeSelectForm {
   mode: string
@@ -400,7 +400,7 @@ export declare class RecoveryModeSelectForm {
 
 /**
  * Atscript interface **RecoveryFactorForm**
- * @see {@link ./forms.as:798:18}
+ * @see {@link ./forms.as:821:18}
  */
 export declare class RecoveryFactorForm {
   factor: string
@@ -417,7 +417,7 @@ export declare class RecoveryFactorForm {
 
 /**
  * Atscript interface **ChangePasswordForm**
- * @see {@link ./forms.as:832:18}
+ * @see {@link ./forms.as:855:18}
  */
 export declare class ChangePasswordForm {
   // intro: ui.paragraph
@@ -437,7 +437,7 @@ export declare class ChangePasswordForm {
 
 /**
  * Atscript interface **ProveControlForm**
- * @see {@link ./forms.as:897:18}
+ * @see {@link ./forms.as:920:18}
  */
 export declare class ProveControlForm {
   // intro: ui.paragraph
@@ -455,7 +455,7 @@ export declare class ProveControlForm {
 
 /**
  * Atscript interface **ProveControlOtpForm**
- * @see {@link ./forms.as:932:18}
+ * @see {@link ./forms.as:955:18}
  */
 export declare class ProveControlOtpForm {
   // intro: ui.paragraph