@cosmicdrift/kumiko-bundled-features 0.1.0

package/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -0,0 +1,170 @@
+// Magic-Link-Signup, Step 2 (confirm).
+//
+// Token aus URL + Password vom User → wir lösen den Token in Redis ein
+// und legen Tenant + User + Admin-Membership atomar an. emailVerified
+// wird sofort auf true gesetzt — der Magic-Link IST der Beweis.
+//
+// Pipeline:
+//   1. Redis check: token → email lookup
+//   2. Single-Use-Burn (SETNX) — gleichzeitiger Klick aus zwei Tabs
+//      gewinnt nur einer
+//   3. Tenant-Key generieren (generateUniqueName mit DB-isAvailable-
+//      check gegen tenants.key)
+//   4. provisionSignupAccount: Tenant + User + Membership in einem
+//      Rutsch (durch event-store-executor; events + projection +
+//      MSPs sehen das wie einen regulären create)
+//   5. Token-Keys löschen (burn-key bleibt für TTL-Replay-Protection)
+//
+// Failure-Recovery: jeder Pfad nach dem burn checked `committed`-Flag;
+// bei !committed wird der burn released damit ein legitimer Retry
+// nicht durch einen stale Marker geblockt wird (wie reset/verify).
+
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  defineWriteHandler,
+  type SessionUser,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  InternalError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { eq } from "drizzle-orm";
+import { z } from "zod";
+// kumiko-lint-ignore cross-feature-import signup-confirm reads tenants.key for slug-uniqueness check (TOCTOU + DB-unique-index zusammen)
+import { tenantTable } from "../../tenant/schema/tenant";
+import { AuthErrors } from "../constants";
+// kumiko-lint-ignore cross-feature-import provisioning needs cross-feature seeding helpers
+import { INITIAL_SIGNUP_ROLES, provisionSignupAccount } from "../seeding";
+import {
+  burnSignupToken,
+  deleteSignupToken,
+  getEmailForSignupToken,
+  unburnSignupToken,
+} from "../signup-token-store";
+
+const SignupConfirmSchema = z.object({
+  token: z.string().min(8),
+  password: z.string().min(8).max(200),
+});
+
+// Mirror der login-handler-Shape (kind: "auth-session", session: SessionUser)
+// damit die Route-Layer den signup-confirm-success genauso behandeln kann
+// wie einen erfolgreichen login: JWT-Mint, Cookies setzen, Session-Body
+// returnen. Der zusätzliche tenantKey landet als sibling am data-objekt
+// (NICHT in SessionUser — der ist generic, tenantKey ist signup-spezifisch
+// für den Post-Signup-Redirect zu /<tenantKey>/).
+export type SignupConfirmData = {
+  readonly kind: "auth-session";
+  readonly session: SessionUser;
+  readonly tenantKey: string;
+};
+
+function invalidSignupToken() {
+  return writeFailure(
+    new UnprocessableError(AuthErrors.invalidSignupToken, {
+      i18nKey: "auth.errors.invalidSignupToken",
+    }),
+  );
+}
+
+export function createSignupConfirmHandler() {
+  return defineWriteHandler<"signup-confirm", typeof SignupConfirmSchema, SignupConfirmData>({
+    name: "signup-confirm",
+    schema: SignupConfirmSchema,
+    access: { roles: ["all"] },
+    handler: async (event, ctx) => {
+      if (!ctx.redis) {
+        return writeFailure(
+          new InternalError({
+            message: "signup-confirm requires ctx.redis for token consumption",
+          }),
+        );
+      }
+
+      // Token-Lookup: nicht-existent / abgelaufen / schon konsumiert →
+      // alle collapsen auf invalid_signup_token. Anti-enumeration.
+      const email = await getEmailForSignupToken(ctx.redis, event.payload.token);
+      if (!email) return invalidSignupToken();
+
+      // Single-Use-Burn: zwei parallele Confirms aus verschiedenen
+      // Tabs — einer wins, der andere kriegt invalid_signup_token.
+      const burn = await burnSignupToken(ctx.redis, event.payload.token);
+      if (burn === "already-used") return invalidSignupToken();
+
+      let committed = false;
+      try {
+        // Tenant-Key: 2-Wort-Slug aus framework/random, mit DB-Conflict-
+        // Check gegen tenants.key. 22.500 Default-Combos + Suffix-
+        // Fallback bei Kollision (siehe generateUniqueName).
+        // @cast-boundary db-runner — TenantDb.raw is DbRunner (Connection|Tx);
+        // provisioning helpers operate on plain drizzle-API that both shapes
+        // expose identically. Inside an event-store transaction the cast lands
+        // on the Tx flavor — same drizzle calls, same behavior.
+        const dbConn = ctx.db.raw as DbConnection;
+
+        const tenantKey = await generateUniqueName({
+          isAvailable: async (slug) => {
+            const existing = await dbConn
+              .select({ id: tenantTable.id })
+              .from(tenantTable)
+              .where(eq(tenantTable.key, slug))
+              .limit(1);
+            return existing.length === 0;
+          },
+        });
+
+        const tenantId = generateId() as TenantId;
+        // Display-Name aus email-prefix als sinnvolles Default; User kann
+        // den Tenant-Namen + sein eigenes displayName später ändern.
+        const displayName = email.split("@")[0] ?? email;
+
+        const provisioned = await provisionSignupAccount(dbConn, {
+          email,
+          password: event.payload.password,
+          displayName,
+          tenantId,
+          tenantKey,
+          // Tenant-Display-Name als Default = Email. User wechselt das im
+          // Settings-Screen. Konzept "Tenant" leakt nicht in die Signup-UI.
+          tenantName: email,
+        });
+
+        // Cleanup beider Token-Lookup-Keys. Burn-Key bleibt für die
+        // restliche Burn-TTL als Replay-Schutz.
+        await deleteSignupToken(ctx.redis, { email, token: event.payload.token });
+
+        // SessionUser für JWT-Mint. Roles aus INITIAL_SIGNUP_ROLES
+        // damit DB-write (provisionSignupAccount) und Session-claim
+        // dieselbe Quelle teilen — sonst hätten zwei Stellen "Admin"
+        // hardcoded und ein Refactor würde role-mismatch zwischen DB
+        // und JWT erzeugen.
+        const session: SessionUser = {
+          id: provisioned.userId,
+          tenantId: provisioned.tenantId,
+          roles: [...INITIAL_SIGNUP_ROLES],
+        };
+
+        committed = true;
+        return {
+          isSuccess: true,
+          data: {
+            kind: "auth-session",
+            session,
+            tenantKey,
+          },
+        };
+      } finally {
+        if (!committed && ctx.redis) {
+          // Burn-release damit ein retry nach DB-Hiccup nicht blockt.
+          // Token-Lookup-Keys bleiben — der User kann seinen Mail-Link
+          // erneut klicken.
+          await unburnSignupToken(ctx.redis, event.payload.token);
+        }
+      }
+    },
+  });
+}

package/src/auth-email-password/handlers/signup-request.write.ts

@@ -0,0 +1,104 @@
+// Magic-Link-Signup, Step 1 (request).
+//
+// User gibt Email ein → wir minten einen opaken Random-Token, speichern
+// ihn bidirektional in Redis (token↔email), und der Route-Layer schickt
+// die Activation-Mail. Anders als reset/verify-Flows existiert der User
+// HIER NOCH NICHT — daher kein userId-lookup, kein HMAC-signing (wofür
+// gäbe es kein Subject), kein "skip if user already exists in DB"-pattern.
+//
+// Resend-Idempotenz: wenn für die Email bereits ein lebender Token in
+// Redis liegt, geben wir denselben Token zurück (und refreshen TTL auf
+// beiden Keys). Der User bekommt dann eine zweite Mail mit dem GLEICHEN
+// Activation-Link. Erste Mail bleibt gültig — kein "old link broken"-
+// annoyance.
+//
+// Always-200 (enumeration-safe): das Response sieht für jede Email
+// gleich aus, egal ob sie schon registriert ist oder nicht. Anders als
+// reset (das ein "no-op" zurückgibt wenn User nicht existiert) gibt's
+// hier nichts zu enumerieren — eine Email kann nicht "schon registriert
+// sein" weil bei Magic-Link der User-Row erst beim Confirm entsteht.
+// Was es geben könnte: dieselbe Email versucht es zum N-ten Mal —
+// Resend-Pfad ist by-design idempotent.
+
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { Temporal } from "temporal-polyfill";
+import { z } from "zod";
+import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "../constants";
+import { getTokenForSignupEmail, normalizeEmail, storeSignupToken } from "../signup-token-store";
+
+const SignupRequestSchema = z.object({
+  email: z.email(),
+});
+
+export type SignupRequestData =
+  | {
+      readonly kind: "signup-requested";
+      readonly email: string;
+      readonly token: string;
+      readonly expiresAt: string;
+    }
+  | { readonly kind: "no-op" };
+
+export type SignupRequestOptions = {
+  /** TTL für den Activation-Token. Default 24 h — lang genug damit User
+   *  "morgen aktivieren" können ohne Resend-Spam. */
+  readonly tokenTtlMinutes?: number;
+};
+
+export function createSignupRequestHandler(opts: SignupRequestOptions = {}) {
+  const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_SIGNUP_DEFAULT_TTL_MINUTES;
+  const ttlSeconds = ttlMinutes * 60;
+
+  return defineWriteHandler<"signup-request", typeof SignupRequestSchema, SignupRequestData>({
+    name: "signup-request",
+    schema: SignupRequestSchema,
+    access: { roles: ["all"] },
+    handler: async (event, ctx) => {
+      if (!ctx.redis) {
+        return writeFailure(
+          new InternalError({
+            message: "signup-request requires ctx.redis for the activation-token store",
+          }),
+        );
+      }
+
+      // Email-Normalisierung lebt im Store (signup-token-store). Der
+      // Handler reicht die raw email durch — eine Quelle, kein Drift
+      // zwischen Lookup-Pfaden die unterschiedlich (oder gar nicht)
+      // lowercased haben.
+      const email = event.payload.email;
+
+      // Resend-Idempotenz: wenn ein Token für diese Email noch lebt,
+      // re-use ihn und refreshe beide Keys. Der User kriegt eine zweite
+      // Mail mit dem GLEICHEN Link.
+      const existingToken = await getTokenForSignupEmail(ctx.redis, email);
+      // 32 random bytes = 256 bits unguessable randomness, base64url
+      // encoded zu 43 chars. Math.random war früher ein Bug:
+      // xorshift128+ hat ~128 Bit State der nach ~5 beobachteten
+      // Outputs rekonstruierbar ist — Angreifer könnte eigene
+      // signup-requests triggern und die Tokens fremder User
+      // vorhersagen. generateToken nutzt randomBytes aus node:crypto,
+      // dieselbe Quelle wie CSRF/Session-Tokens.
+      const token = existingToken ?? generateToken();
+
+      const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+
+      await storeSignupToken(ctx.redis, { email, token, ttlSeconds });
+
+      return {
+        isSuccess: true,
+        data: {
+          kind: "signup-requested",
+          // normalizeEmail aus dem Store — eine Quelle für die
+          // Normalisierungs-Verantwortung; Mail-Callback kriegt
+          // konsistent das gleiche Format wie der Lookup-Pfad.
+          email: normalizeEmail(email),
+          token,
+          expiresAt: expiresAt.toString(),
+        },
+      };
+    },
+  });
+}

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -0,0 +1,114 @@
+// Shared factory for the request-side of out-of-band token flows
+// (password-reset, email-verification). Both follow the same shape:
+//
+//   POST email
+//     → resolve user (system-scoped query)
+//     → skip silently if user doesn't exist / is deleted / already done
+//     → mint an HMAC-signed token
+//     → return { kind: <successKind>, email, token, expiresAt }
+//
+// Differences between the flows are four parameters (successKind, sign fn,
+// default TTL, extra skip condition) + two error codes — encoded on the
+// spec rather than duplicated across two near-identical handler bodies.
+
+import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { Temporal } from "temporal-polyfill";
+import { z } from "zod";
+import { UserQueries } from "../../user";
+import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";
+
+const RequestTokenSchema = z.object({
+  email: z.email(),
+});
+
+// What the route layer reads off `result.data` after dispatching. Identical
+// shape for both flows; only the `kind` discriminator differs so the route
+// knows whether to forward to sendResetEmail or sendVerificationEmail.
+export type TokenRequestSuccess<K extends string> = {
+  readonly kind: K;
+  readonly email: string;
+  readonly token: string;
+  readonly expiresAt: string;
+};
+
+export type TokenRequestNoOp = { readonly kind: "no-op" };
+
+export type TokenRequestData<K extends string> = TokenRequestSuccess<K> | TokenRequestNoOp;
+
+export type TokenRequestSpec<TName extends string, TSuccessKind extends string> = {
+  readonly handlerName: TName;
+  readonly successKind: TSuccessKind;
+  readonly defaultTtlMinutes: number;
+  // Feature-specific sign function. Signature matches both signResetToken
+  // and signVerificationToken (thin wrappers over signed-token.ts).
+  readonly sign: (
+    userId: string,
+    ttlMinutes: number,
+    secret: string,
+  ) => { token: string; expiresAt: Temporal.Instant };
+  // Error code + i18nKey returned when the feature-factory wasn't given a
+  // working hmacSecret. Should never happen — feature-factory validates at
+  // boot — but defensive coverage for lazy secret-providers.
+  readonly notConfiguredError: string;
+  readonly notConfiguredI18nKey: string;
+  // Extra silent-skip predicate on top of "user doesn't exist or is
+  // soft-deleted". Verification skips when emailVerified is already true;
+  // password-reset has no extra condition (returns false).
+  readonly extraSilentSkip: (user: AuthUserRow) => boolean;
+};
+
+export type TokenRequestOptions = {
+  readonly hmacSecret: string;
+  readonly tokenTtlMinutes?: number;
+};
+
+export function createTokenRequestHandler<TName extends string, TSuccessKind extends string>(
+  spec: TokenRequestSpec<TName, TSuccessKind>,
+  opts: TokenRequestOptions,
+) {
+  const ttl = opts.tokenTtlMinutes ?? spec.defaultTtlMinutes;
+
+  return defineWriteHandler<TName, typeof RequestTokenSchema, TokenRequestData<TSuccessKind>>({
+    name: spec.handlerName,
+    schema: RequestTokenSchema,
+    access: { roles: ["all"] },
+    handler: async (event, ctx) => {
+      if (!opts.hmacSecret) {
+        // Feature-factory guards this at boot; defensive here for lazy-
+        // provided secrets that show up empty at runtime.
+        return writeFailure(
+          new UnprocessableError(spec.notConfiguredError, {
+            i18nKey: spec.notConfiguredI18nKey,
+          }),
+        );
+      }
+
+      const systemUser = createSystemUser(event.user.tenantId);
+
+      const user = parseAuthUserRow(
+        await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+          email: event.payload.email,
+        }),
+      );
+
+      // Silent-success branches all return the SAME shape with kind="no-op".
+      // Response-level timing stays uniform (200 / isSuccess: true); the
+      // small difference in handler-internal work is accepted — no probing
+      // client can observe it through the HTTP surface.
+      if (!user || user.isDeleted || !user.email || spec.extraSilentSkip(user)) {
+        const data: TokenRequestData<TSuccessKind> = { kind: "no-op" };
+        return { isSuccess: true, data };
+      }
+
+      const { token, expiresAt } = spec.sign(user.id, ttl, opts.hmacSecret);
+      const data: TokenRequestData<TSuccessKind> = {
+        kind: spec.successKind,
+        email: user.email,
+        token,
+        expiresAt: expiresAt.toString(),
+      };
+      return { isSuccess: true, data };
+    },
+  });
+}

package/src/auth-email-password/handlers/verify-email.write.ts

@@ -0,0 +1,62 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { z } from "zod";
+import { AuthErrors } from "../constants";
+import { verifyVerificationToken } from "../verification-token";
+import { runConfirmTokenFlow } from "./confirm-token-flow";
+
+export type VerifyEmailOptions = {
+  readonly hmacSecret: string;
+};
+
+const VerifyEmailSchema = z.object({
+  token: z.string().min(1),
+});
+
+export type VerifyEmailData = { readonly kind: "verified" } | { readonly kind: "already-verified" };
+
+function invalidToken() {
+  return writeFailure(
+    new UnprocessableError(AuthErrors.invalidVerificationToken, {
+      i18nKey: "auth.errors.invalidVerificationToken",
+    }),
+  );
+}
+
+// Sets user.emailVerified = true on a valid token. Idempotent via the
+// `alreadyDone` short-circuit — when the row already reads verified
+// (reached through another flow), we skip the write but keep the burn
+// so replays still see invalid_verification_token on the burn check.
+// Sessions are NOT revoked on verification — no security reason to
+// nuke active logins when a user finally confirms their address.
+export function createVerifyEmailHandler(opts: VerifyEmailOptions) {
+  return defineWriteHandler<"verify-email", typeof VerifyEmailSchema, VerifyEmailData>({
+    name: "verify-email",
+    schema: VerifyEmailSchema,
+    access: { roles: ["all"] },
+    handler: async (event, ctx) => {
+      if (!opts.hmacSecret) {
+        return writeFailure(
+          new UnprocessableError(AuthErrors.verificationNotConfigured, {
+            i18nKey: "auth.errors.verificationNotConfigured",
+          }),
+        );
+      }
+
+      const verify = verifyVerificationToken(event.payload.token, opts.hmacSecret);
+      if (!verify.ok) return invalidToken();
+
+      return runConfirmTokenFlow<VerifyEmailData>(ctx, verify.userId, verify.expiresAtMs, {
+        purpose: "verify",
+        redisRequiredMessage: "email-verification requires ctx.redis to enforce token single-use",
+        invalidToken,
+        buildChanges: async () => ({ emailVerified: true }),
+        successData: { kind: "verified" },
+        alreadyDone: {
+          check: (me) => me.emailVerified === true,
+          data: { kind: "already-verified" },
+        },
+      });
+    },
+  });
+}

package/src/auth-email-password/i18n.ts

@@ -0,0 +1,211 @@
+// @runtime client
+// Default-Bundles für die Feature-UI. Werden vom emailPasswordClient()
+// als Fallback-Bundle in den LocaleProvider gehängt — Apps können
+// einzelne Keys via `emailPasswordClient({ translations: { de: { ... } } })`
+// überschreiben, ohne das ganze Bundle kopieren zu müssen.
+//
+// Keys folgen dem Schema `auth.<area>.<slug>` — `auth.login.*` für die
+// Formular-UI, `auth.errors.*` für Reason-Codes aus dem Login-Handler
+// (1:1 gespiegelt zu AuthErrors im server-side Feature).
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  de: {
+    "auth.login.title": "Anmelden",
+    "auth.login.email": "E-Mail",
+    "auth.login.password": "Passwort",
+    "auth.login.submit": "Einloggen",
+    "auth.login.submitting": "…",
+    "auth.login.forgotPassword": "Passwort vergessen?",
+    "auth.errors.invalidCredentials": "E-Mail oder Passwort falsch.",
+    "auth.errors.noMembership": "Dieses Konto hat keinen Tenant-Zugang.",
+    "auth.errors.accountLocked": "Konto vorübergehend gesperrt.",
+    "auth.errors.accountLockedRetry": "Konto gesperrt. Neuer Versuch in {minutes} Minuten.",
+    "auth.errors.emailNotVerified": "E-Mail-Adresse noch nicht bestätigt.",
+    "auth.errors.rateLimited": "Zu viele Login-Versuche. Bitte kurz warten.",
+    "auth.errors.invalidBody": "Ungültige Eingabe.",
+    "auth.errors.loginFailed": "Login fehlgeschlagen.",
+    "auth.errors.invalidResetToken":
+      "Der Link ist ungültig oder abgelaufen. Bitte fordere einen neuen an.",
+    "auth.errors.invalidVerificationToken": "Der Bestätigungs-Link ist ungültig oder abgelaufen.",
+    "auth.errors.invalidSignupToken":
+      "Der Aktivierungs-Link ist ungültig oder abgelaufen. Bitte fordere einen neuen an.",
+    "auth.errors.unknownError": "Etwas ist schief gegangen. Bitte erneut versuchen.",
+    "auth.forgotPassword.title": "Passwort zurücksetzen",
+    "auth.forgotPassword.intro":
+      "Gib deine E-Mail-Adresse ein. Falls ein Konto existiert, schicken wir dir einen Reset-Link.",
+    "auth.forgotPassword.email": "E-Mail",
+    "auth.forgotPassword.submit": "Link anfordern",
+    "auth.forgotPassword.submitting": "…",
+    "auth.forgotPassword.successTitle": "Mail gesendet",
+    "auth.forgotPassword.successBody":
+      "Falls die E-Mail in unserem System existiert, ist eine Nachricht mit einem Reset-Link unterwegs. Bitte schau in deinen Posteingang.",
+    "auth.forgotPassword.backToLogin": "Zurück zum Login",
+    "auth.resetPassword.title": "Neues Passwort setzen",
+    "auth.resetPassword.intro": "Wähle ein neues Passwort (mindestens 8 Zeichen).",
+    "auth.resetPassword.newPassword": "Neues Passwort",
+    "auth.resetPassword.confirmPassword": "Passwort bestätigen",
+    "auth.resetPassword.mismatch": "Die Passwörter stimmen nicht überein.",
+    "auth.resetPassword.tooShort": "Passwort muss mindestens 8 Zeichen lang sein.",
+    "auth.resetPassword.submit": "Passwort speichern",
+    "auth.resetPassword.submitting": "…",
+    "auth.resetPassword.successTitle": "Passwort gesetzt",
+    "auth.resetPassword.successBody": "Du kannst dich jetzt mit deinem neuen Passwort anmelden.",
+    "auth.resetPassword.goToLogin": "Zum Login",
+    "auth.resetPassword.missingToken":
+      "Der Reset-Link enthält keinen Token. Bitte fordere einen neuen an.",
+    "auth.verifyEmail.verifying": "E-Mail wird bestätigt …",
+    "auth.verifyEmail.successTitle": "E-Mail bestätigt",
+    "auth.verifyEmail.successBody": "Danke! Du kannst dich jetzt anmelden.",
+    "auth.verifyEmail.errorTitle": "Bestätigung fehlgeschlagen",
+    "auth.verifyEmail.errorBody":
+      "Der Link ist ungültig oder abgelaufen. Bitte fordere eine neue Bestätigungs-Mail an.",
+    "auth.verifyEmail.goToLogin": "Zum Login",
+    "auth.verifyEmail.missingToken": "Der Bestätigungs-Link enthält keinen Token.",
+    "auth.signup.title": "Account erstellen",
+    "auth.signup.intro":
+      "Gib deine E-Mail-Adresse ein. Wir schicken dir einen Aktivierungs-Link, mit dem du dein Passwort setzt.",
+    "auth.signup.email": "E-Mail",
+    "auth.signup.submit": "Aktivierungs-Link senden",
+    "auth.signup.submitting": "…",
+    "auth.signup.successTitle": "Mail gesendet",
+    "auth.signup.successBody":
+      "Wir haben dir einen Aktivierungs-Link an deine E-Mail-Adresse geschickt. Klicke ihn an, um dein Passwort zu setzen und dich einzuloggen.",
+    "auth.signup.resend": "Mail erneut senden",
+    "auth.signup.haveAccount": "Bereits einen Account? Anmelden",
+    "auth.signupComplete.title": "Passwort setzen",
+    "auth.signupComplete.intro":
+      "Wähle ein Passwort (mindestens 8 Zeichen) für deinen neuen Account.",
+    "auth.signupComplete.password": "Passwort",
+    "auth.signupComplete.confirmPassword": "Passwort bestätigen",
+    "auth.signupComplete.tooShort": "Passwort muss mindestens 8 Zeichen lang sein.",
+    "auth.signupComplete.mismatch": "Die Passwörter stimmen nicht überein.",
+    "auth.signupComplete.submit": "Account aktivieren",
+    "auth.signupComplete.submitting": "…",
+    "auth.signupComplete.missingToken":
+      "Der Aktivierungs-Link enthält keinen Token. Bitte fordere einen neuen an.",
+    "auth.inviteAccept.title": "Einladung annehmen",
+    "auth.inviteAccept.intro":
+      "Du wurdest zu einem Workspace eingeladen. Klicke auf 'Annehmen' um Mitglied zu werden.",
+    "auth.inviteAccept.loggedInAs": "Du bist eingeloggt — klicke 'Annehmen' um Mitglied zu werden.",
+    "auth.inviteAccept.email": "E-Mail",
+    "auth.inviteAccept.password": "Passwort",
+    "auth.inviteAccept.acceptButton": "Annehmen",
+    "auth.inviteAccept.submit": "Annehmen + Anmelden",
+    "auth.inviteAccept.submitting": "…",
+    "auth.inviteAccept.useOtherAccount": "Mit anderem Account anmelden",
+    "auth.inviteAccept.toggleNew": "Ich habe noch keinen Account",
+    "auth.inviteAccept.toggleExisting": "Ich habe schon einen Account",
+    "auth.inviteAccept.missingToken": "Der Einladungs-Link enthält keinen Token oder ist ungültig.",
+    "auth.inviteAccept.goToLogin": "Zum Login",
+    "auth.user.menu.label": "Konto",
+    "auth.user.menu.logout": "Abmelden",
+    "auth.tenant.switcher.label": "Tenant",
+    "auth.tenant.switcher.none": "Kein Tenant",
+  },
+  en: {
+    "auth.login.title": "Sign in",
+    "auth.login.email": "Email",
+    "auth.login.password": "Password",
+    "auth.login.submit": "Sign in",
+    "auth.login.submitting": "…",
+    "auth.login.forgotPassword": "Forgot password?",
+    "auth.errors.invalidCredentials": "Invalid email or password.",
+    "auth.errors.noMembership": "This account has no tenant access.",
+    "auth.errors.accountLocked": "Account temporarily locked.",
+    "auth.errors.accountLockedRetry": "Account locked. Try again in {minutes} minutes.",
+    "auth.errors.emailNotVerified": "Email address not yet verified.",
+    "auth.errors.rateLimited": "Too many login attempts. Please wait briefly.",
+    "auth.errors.invalidBody": "Invalid input.",
+    "auth.errors.loginFailed": "Login failed.",
+    "auth.errors.invalidResetToken": "Link is invalid or expired. Please request a new one.",
+    "auth.errors.invalidVerificationToken": "Verification link is invalid or expired.",
+    "auth.errors.invalidSignupToken":
+      "Activation link is invalid or expired. Please request a new one.",
+    "auth.errors.unknownError": "Something went wrong. Please try again.",
+    "auth.forgotPassword.title": "Reset password",
+    "auth.forgotPassword.intro":
+      "Enter your email. If an account exists, we'll send you a reset link.",
+    "auth.forgotPassword.email": "Email",
+    "auth.forgotPassword.submit": "Request link",
+    "auth.forgotPassword.submitting": "…",
+    "auth.forgotPassword.successTitle": "Email sent",
+    "auth.forgotPassword.successBody":
+      "If your email exists in our system, a reset link is on its way. Please check your inbox.",
+    "auth.forgotPassword.backToLogin": "Back to sign in",
+    "auth.resetPassword.title": "Set new password",
+    "auth.resetPassword.intro": "Choose a new password (at least 8 characters).",
+    "auth.resetPassword.newPassword": "New password",
+    "auth.resetPassword.confirmPassword": "Confirm password",
+    "auth.resetPassword.mismatch": "Passwords do not match.",
+    "auth.resetPassword.tooShort": "Password must be at least 8 characters.",
+    "auth.resetPassword.submit": "Save password",
+    "auth.resetPassword.submitting": "…",
+    "auth.resetPassword.successTitle": "Password set",
+    "auth.resetPassword.successBody": "You can now sign in with your new password.",
+    "auth.resetPassword.goToLogin": "Go to sign in",
+    "auth.resetPassword.missingToken": "Reset link is missing a token. Please request a new one.",
+    "auth.verifyEmail.verifying": "Verifying email …",
+    "auth.verifyEmail.successTitle": "Email verified",
+    "auth.verifyEmail.successBody": "Thanks! You can sign in now.",
+    "auth.verifyEmail.errorTitle": "Verification failed",
+    "auth.verifyEmail.errorBody":
+      "Link is invalid or expired. Please request a new verification email.",
+    "auth.verifyEmail.goToLogin": "Go to sign in",
+    "auth.verifyEmail.missingToken": "Verification link is missing a token.",
+    "auth.signup.title": "Create account",
+    "auth.signup.intro":
+      "Enter your email. We'll send you an activation link to set your password.",
+    "auth.signup.email": "Email",
+    "auth.signup.submit": "Send activation link",
+    "auth.signup.submitting": "…",
+    "auth.signup.successTitle": "Email sent",
+    "auth.signup.successBody":
+      "We've sent you an activation link. Click it to set your password and sign in.",
+    "auth.signup.resend": "Send email again",
+    "auth.signup.haveAccount": "Already have an account? Sign in",
+    "auth.signupComplete.title": "Set password",
+    "auth.signupComplete.intro": "Choose a password (at least 8 characters) for your new account.",
+    "auth.signupComplete.password": "Password",
+    "auth.signupComplete.confirmPassword": "Confirm password",
+    "auth.signupComplete.tooShort": "Password must be at least 8 characters.",
+    "auth.signupComplete.mismatch": "Passwords do not match.",
+    "auth.signupComplete.submit": "Activate account",
+    "auth.signupComplete.submitting": "…",
+    "auth.signupComplete.missingToken":
+      "Activation link is missing a token. Please request a new one.",
+    "auth.inviteAccept.title": "Accept invitation",
+    "auth.inviteAccept.intro": "You've been invited to a workspace. Click 'Accept' to join.",
+    "auth.inviteAccept.loggedInAs": "Signed in as {email}",
+    "auth.inviteAccept.email": "Email",
+    "auth.inviteAccept.password": "Password",
+    "auth.inviteAccept.acceptButton": "Accept",
+    "auth.inviteAccept.submit": "Accept + sign in",
+    "auth.inviteAccept.submitting": "…",
+    "auth.inviteAccept.useOtherAccount": "Sign in with a different account",
+    "auth.inviteAccept.toggleNew": "I don't have an account yet",
+    "auth.inviteAccept.toggleExisting": "I already have an account",
+    "auth.inviteAccept.missingToken": "The invitation link is missing or invalid.",
+    "auth.inviteAccept.goToLogin": "Go to sign in",
+    "auth.user.menu.label": "Account",
+    "auth.user.menu.logout": "Sign out",
+    "auth.tenant.switcher.label": "Tenant",
+    "auth.tenant.switcher.none": "No tenant",
+  },
+};
+
+/** Merged zwei TranslationsByLocale-Maps — der override gewinnt pro Key,
+ *  die Locales werden zusammengeführt. Wird von emailPasswordClient()
+ *  benutzt, um App-Overrides über die Defaults zu legen. */
+export function mergeTranslations(
+  base: TranslationsByLocale,
+  override: TranslationsByLocale,
+): TranslationsByLocale {
+  const locales = new Set([...Object.keys(base), ...Object.keys(override)]);
+  const merged: Record<string, Record<string, string>> = {};
+  for (const locale of locales) {
+    merged[locale] = { ...(base[locale] ?? {}), ...(override[locale] ?? {}) };
+  }
+  return merged;
+}