@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.109.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.105.2",
+  "version": "0.109.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,6 +77,8 @@
     "./secrets": "./src/secrets/index.ts",
     "./sessions": "./src/sessions/index.ts",
     "./sessions/testing": "./src/sessions/testing.ts",
+    "./personal-access-tokens": "./src/personal-access-tokens/index.ts",
+    "./personal-access-tokens/web": "./src/personal-access-tokens/web/index.ts",
     "./feature-toggles": "./src/feature-toggles/index.ts",
     "./text-content": "./src/text-content/index.ts",
     "./text-content/seeding": "./src/text-content/seeding.ts",
@@ -93,11 +95,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.105.2",
-    "@cosmicdrift/kumiko-framework": "0.105.2",
-    "@cosmicdrift/kumiko-headless": "0.105.2",
-    "@cosmicdrift/kumiko-renderer": "0.105.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.105.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.109.0",
+    "@cosmicdrift/kumiko-framework": "0.109.0",
+    "@cosmicdrift/kumiko-headless": "0.109.0",
+    "@cosmicdrift/kumiko-renderer": "0.109.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.109.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/auth-claims.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -12,6 +12,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -119,7 +120,7 @@ async function seedUser(email: string, password: string): Promise<string> {
 }
 
 async function addMembership(userId: string, tenantId: TenantId, roles: string[]): Promise<void> {
-  await insertOne(stack.db, tenantMembershipsTable, {
+  await seedRow(stack.db, tenantMembershipsTable, {
     userId,
     tenantId,
     roles: JSON.stringify(roles),

package/src/auth-email-password/__tests__/email-verification.integration.test.ts

@@ -1,11 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import {
-  asRawClient,
-  insertOne,
-  selectMany,
-  updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -15,6 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -146,7 +142,7 @@ async function seedUser(opts: {
   // it directly via SQL after create. Row.version is left at 1; no
   // subsequent event-store writes happen on this row in these tests.
   if (opts.emailVerified === true) {
-    await updateMany(stack.db, userTable, { emailVerified: true }, { id: created.id });
+    await updateRows(stack.db, userTable, { emailVerified: true }, { id: created.id });
   }
   const tenantId = opts.tenantId ?? "00000000-0000-4000-8000-000000000001";
   await seedTenantMembership(stack.db, {
@@ -252,7 +248,7 @@ describe("POST /auth/verify-email", () => {
     const firstAttempt = await post("/api/auth/verify-email", { token });
     expect(firstAttempt.status).toBe(422);
 
-    await insertOne(stack.db, userTable, userRow);
+    await seedRow(stack.db, userTable, userRow);
 
     const secondAttempt = await post("/api/auth/verify-email", { token });
     expect(secondAttempt.status).toBe(200);
@@ -296,7 +292,7 @@ describe("POST /auth/verify-email", () => {
     await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
 
     const orphanId = "00000000-0000-4000-8000-0000000000ff";
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       ...donorRow,
       id: orphanId,
       email: "orphan@example.com",

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -15,7 +15,7 @@
 //   5. DB-State + Membership + Cookies/JWT verifizieren
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createSystemUser,
   type SessionUser,
@@ -28,6 +28,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -421,7 +422,7 @@ describe("invite-accept defense-in-depth (assertAssignableMembershipRoles)", ()
     // (which already validates at request time — see "privilege escalation"
     // below). A DB migration or direct write is the only realistic vector.
     const fakeInvitationId = crypto.randomUUID();
-    await insertOne(stack.db, tenantInvitationsTable, {
+    await seedRow(stack.db, tenantInvitationsTable, {
       id: fakeInvitationId,
       tenantId: TENANT_A_ID,
       email: BOB_EMAIL,

package/src/auth-email-password/__tests__/multi-roles.integration.test.ts

@@ -9,7 +9,7 @@
 // (nur tenant-membership-roles in der Session).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -19,6 +19,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -102,7 +103,7 @@ async function addMembership(
   tenantId: TenantId,
   roles: readonly string[],
 ): Promise<void> {
-  await insertOne(stack.db, tenantMembershipsTable, {
+  await seedRow(stack.db, tenantMembershipsTable, {
     userId,
     tenantId,
     roles: JSON.stringify(roles),

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -10,6 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -302,7 +303,7 @@ describe("POST /auth/reset-password", () => {
 
     // Re-insert the captured row verbatim. Same userId, same version, same
     // token still valid.
-    await insertOne(stack.db, userTable, userRow);
+    await seedRow(stack.db, userTable, userRow);
 
     const secondAttempt = await post("/api/auth/reset-password", {
       token,
@@ -357,7 +358,7 @@ describe("POST /auth/reset-password", () => {
     await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
 
     const orphanId = "00000000-0000-4000-8000-0000000000ff";
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       ...donorRow,
       id: orphanId,
       email: "orphan@example.com",

package/src/auth-email-password/handlers/change-password.write.ts

@@ -1,7 +1,11 @@
-import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  access,
+  createSystemUser,
+  defineWriteHandler,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
-import { USER_FEATURE, UserHandlers, UserQueries } from "../../user";
+import { UserHandlers, UserQueries } from "../../user";
 import { invalidCredentials } from "../errors";
 import { hashPassword, verifyPassword } from "../password-hashing";
 
@@ -35,14 +39,10 @@ export const changePasswordWrite = defineWriteHandler({
 
     const newHash = await hashPassword(event.payload.newPassword);
 
-    // The user aggregate is r.systemScope(): its event stream can live in a
-    // tenant that isn't the session tenant (a platform operator's stream sits
-    // in the seed executor's tenant, not their membership). Write against the
-    // real stream tenant so optimistic locking targets the right stream instead
-    // of version_conflict-ing against an empty one. Falls back to the session
-    // tenant when the lookup finds nothing (fresh/unknown stream).
-    const streamTenant = await getAggregateStreamTenant(ctx.db.raw, event.user.id, USER_FEATURE);
-    const writer = createSystemUser(streamTenant ?? event.user.tenantId);
+    // The user aggregate is systemStream (#497): its event stream lives on
+    // SYSTEM_TENANT_ID deterministically. Pre-#497 scattered streams need the
+    // one-time backfillUserStreamTenants migration (#762).
+    const writer = createSystemUser(SYSTEM_TENANT_ID);
 
     // Apply via user feature's update handler — writeAs(system) satisfies
     // the privileged-only write rule on passwordHash. Pass the current version

package/src/auth-email-password/handlers/confirm-token-flow.ts

@@ -5,9 +5,8 @@
 //   1. Redis check + burn (single-use enforcement)
 //   2. Load user + deleted/missing/no-version guard
 //   3. Optional idempotent short-circuit (verify-email when already done)
-//   4. Resolve memberships → tenant-order for stream-matching
-//   5. Try each tenant's stream with the handler-specific `changes`
-//   6. Release the burn on ANY non-success path so a legit retry isn't
+//   4. Apply the handler-specific `changes` on the user's SYSTEM stream
+//   5. Release the burn on ANY non-success path so a legit retry isn't
 //      locked out by a stale marker
 //
 // The top-level `runConfirmTokenFlow` orchestrates and owns the
@@ -15,26 +14,26 @@
 // burn (success, already-done) flips `committed = true`; everything
 // else — including future branches a maintainer adds — releases
 // automatically.
+//
+// The user aggregate is systemStream (#497): its event stream lives on
+// SYSTEM_TENANT_ID deterministically, so the write targets exactly one
+// stream. The former membership-probing (`tryWriteAcrossTenants`) existed
+// for pre-#497 scattered streams; those need the one-time
+// backfillUserStreamTenants migration (#762) — probing them stopped working
+// the moment the executor's stream choke-point landed anyway.
 
 import {
   createSystemUser,
   type HandlerContext,
   type SessionUser,
   SYSTEM_TENANT_ID,
-  type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  InternalError,
-  type WriteFailure,
-  writeFailure,
-} from "@cosmicdrift/kumiko-framework/errors";
-import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type Redis from "ioredis";
-import { USER_FEATURE, UserHandlers, UserQueries } from "../../user";
+import { UserHandlers, UserQueries } from "../../user";
 import type { AuthUserRow } from "../auth-user-row";
 import { parseAuthUserRow } from "../auth-user-row";
-import { orderTenantsByPreference } from "../stream-tenant";
 import { burnToken, unburnToken } from "../token-burn-store";
 
 export type ConfirmTokenFlowSpec<TSuccessData> = {
@@ -46,13 +45,11 @@ export type ConfirmTokenFlowSpec<TSuccessData> = {
   // is misconfigured, not the caller's fault.
   readonly redisRequiredMessage: string;
   // Standard failure returned for every "token can't be consumed" path
-  // (bad state, missing memberships, every tenant rejected). The route
-  // layer returns 422 with a uniform code so the caller can't tell which
-  // branch fired.
+  // (bad state, version conflict on the stream). The route layer returns
+  // 422 with a uniform code so the caller can't tell which branch fired.
   readonly invalidToken: () => ReturnType<typeof writeFailure>;
-  // Handler-specific payload for user:update. Runs once per token — the
-  // result is shared across every tenant-stream attempt. Can be async
-  // (password-reset hashes here).
+  // Handler-specific payload for user:update. Runs once per token. Can be
+  // async (password-reset hashes here).
   readonly buildChanges: (me: AuthUserRow) => Promise<Record<string, unknown>>;
   // Returned verbatim on a successful write.
   readonly successData: TSuccessData;
@@ -96,20 +93,21 @@ export async function runConfirmTokenFlow<TSuccessData>(
       return { isSuccess: true, data: spec.alreadyDone.data };
     }
 
-    const tenantOrder = await resolveStreamTenants(ctx, systemUser, me);
-    if (tenantOrder.length === 0) return spec.invalidToken();
-
     const changes = await spec.buildChanges(me);
-    const writeResult = await tryWriteAcrossTenants(ctx, me, tenantOrder, changes);
-    if (writeResult.isSuccess) {
+    const writeRes = await ctx.writeAs(systemUser, UserHandlers.update, {
+      id: me.id,
+      version: me.version,
+      changes,
+    });
+    if (writeRes.isSuccess) {
       committed = true;
       return { isSuccess: true, data: spec.successData };
     }
-    // `all_conflicts` = every tenant returned version_conflict → token-level
-    // failure. `hard_failure` = a real write error (DB down, access
-    // denied) that bubbles unchanged.
-    if (writeResult.reason === "all_conflicts") return spec.invalidToken();
-    return writeResult.failure;
+    // version_conflict = concurrent modification (or an un-migrated pre-#497
+    // stream, see header) → token-level failure. Anything else (DB down,
+    // access denied) bubbles unchanged so ops sees the real failure class.
+    if (writeRes.error.code === "version_conflict") return spec.invalidToken();
+    return writeRes;
   } finally {
     // committed===false covers EVERY failure path — including branches a
     // future maintainer adds without reading this file. The original
@@ -121,14 +119,13 @@ export async function runConfirmTokenFlow<TSuccessData>(
   }
 }
 
-// --- Private helpers ------------------------------------------------------
-
 // Fetches the user row via the privileged findForAuth query and validates
-// it's usable for a write: not deleted, has a row.version (the version
-// column is a findForAuth contract field — absence is a schema bug, but
-// we still handle it gracefully rather than throwing past the burn).
-// Return type narrows `version` to `number` so the write-callsite doesn't
-// need a `?? 0` fallback — the guard lives here, not at every callsite.
+// it's usable for a write: not deleted, has a row.version >= 1 (a row
+// without any event stream — e.g. inserted straight into read_users — must
+// not be confirmable: the write would otherwise seed a fresh stream with a
+// bare user.updated). Return type narrows `version` to `number` so the
+// write-callsite doesn't need a `?? 0` fallback — the guard lives here,
+// not at every callsite.
 async function loadValidatedUser(
   ctx: HandlerContext,
   systemUser: SessionUser,
@@ -137,74 +134,6 @@ async function loadValidatedUser(
   const me = parseAuthUserRow(
     await ctx.queryAs(systemUser, UserQueries.findForAuth, { id: userId }),
   );
-  if (!me || me.isDeleted || me.version === undefined) return null;
+  if (!me || me.isDeleted || me.version === undefined || me.version < 1) return null;
   return { ...me, version: me.version };
 }
-
-// Loads the user's memberships and returns a prioritised tenant list, with the
-// aggregate's real stream tenant recovered from the event log prepended.
-//
-// Empty only when the user has NO memberships AND no recoverable stream tenant
-// — the caller treats that as invalid_token. A zero-membership systemScope user
-// whose stream lives outside any membership (a platform operator seeded under a
-// fixture/SYSTEM tenant) still resolves, because the stream-tenant lookup runs
-// before the empty check rather than being short-circuited by it.
-async function resolveStreamTenants(
-  ctx: HandlerContext,
-  systemUser: SessionUser,
-  me: AuthUserRow,
-): Promise<readonly TenantId[]> {
-  const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
-    userId: me.id,
-  })) as Array<{ tenantId: TenantId }>; // @cast-boundary db-runner
-  const ordered = orderTenantsByPreference(memberships, me.lastActiveTenantId);
-
-  // The user aggregate is r.systemScope(): its event stream lives in whichever
-  // tenant the creating executor used, which need NOT be a membership tenant.
-  // A platform operator seeded under a fixture/platform tenant is the live case
-  // — its stream tenant is absent from `ordered`, so a membership-only search
-  // rejects every write and collapses to invalid_token. Recover the real stream
-  // tenant from the event log and try it first; memberships stay as fallback.
-  // Pulled BEFORE the empty-membership check so a zero-membership operator whose
-  // stream lives in SYSTEM_TENANT is recoverable instead of collapsing to
-  // invalid_token — mirrors change-password.write.ts's unconditional recovery.
-  const streamTenant = await getAggregateStreamTenant(ctx.db.raw, me.id, USER_FEATURE);
-  if (streamTenant && !ordered.includes(streamTenant)) {
-    return [streamTenant, ...ordered];
-  }
-  return ordered;
-}
-
-// Discriminated result for the write-across-tenants loop.
-//   all_conflicts → every candidate rejected with version_conflict →
-//                   token-level failure; caller returns invalidToken.
-//   hard_failure  → a non-conflict error that should bubble unchanged
-//                   (DB down, access denied, …); caller returns it as-is.
-type TenantWriteResult =
-  | { isSuccess: true }
-  | { isSuccess: false; reason: "all_conflicts" }
-  | { isSuccess: false; reason: "hard_failure"; failure: WriteFailure };
-
-// Attempts the update against each candidate stream. memberships-query
-// has no deterministic ORDER BY, so the matching stream is discovered by
-// attempt: version_conflict → try the next candidate, anything else →
-// bubble immediately so ops sees the real failure class.
-async function tryWriteAcrossTenants(
-  ctx: HandlerContext,
-  me: AuthUserRow & { version: number },
-  tenantOrder: readonly TenantId[],
-  changes: Record<string, unknown>,
-): Promise<TenantWriteResult> {
-  for (const tenantId of tenantOrder) {
-    const writeRes = await ctx.writeAs(createSystemUser(tenantId), UserHandlers.update, {
-      id: me.id,
-      version: me.version,
-      changes,
-    });
-    if (writeRes.isSuccess) return { isSuccess: true };
-    if (writeRes.error.code !== "version_conflict") {
-      return { isSuccess: false, reason: "hard_failure", failure: writeRes };
-    }
-  }
-  return { isSuccess: false, reason: "all_conflicts" };
-}

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -0,0 +1,44 @@
+// InviteAcceptScreen is a public route — anon invite-links are the
+// documented use case (no <SessionProvider> ancestor). Regression 632/1:
+// useSession() throws without a provider, so any consumer mounting this
+// screen on a public route outside SessionAuthGate crashed at runtime.
+
+import { describe, expect, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { render, screen } from "@testing-library/react";
+import { defaultTranslations } from "../../i18n";
+import { InviteAcceptScreen } from "../invite-accept-screen";
+
+const resolver = createStaticLocaleResolver({ locale: "de" });
+
+function renderWithoutSessionProvider(token: string) {
+  return render(
+    <PrimitivesProvider value={defaultPrimitives}>
+      <LocaleProvider resolver={resolver} fallbackBundles={[defaultTranslations]}>
+        <InviteAcceptScreen token={token} />
+      </LocaleProvider>
+    </PrimitivesProvider>,
+  );
+}
+
+describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {
+  test("renders the anonymous accept-form instead of throwing", () => {
+    renderWithoutSessionProvider("tok-123");
+    expect(screen.getByText("Einladung annehmen")).toBeTruthy();
+    expect(screen.getByLabelText(/^Passwort/)).toBeTruthy();
+    // Anon default mode is "anon-existing" — email field is shown too.
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+  });
+
+  test("missing token still renders (no session access needed for that branch)", () => {
+    renderWithoutSessionProvider("");
+    expect(
+      screen.getByText("Der Einladungs-Link enthält keinen Token oder ist ungültig."),
+    ).toBeTruthy();
+  });
+});

package/src/auth-email-password/web/__tests__/user-menu.test.tsx

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { SidebarProvider } from "@cosmicdrift/kumiko-renderer-web";
-import { screen } from "@testing-library/react";
+import { screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { UserMenu } from "../user-menu";
 import { makeSessionApi, renderWithProviders } from "./test-utils";
@@ -31,6 +31,19 @@ describe("UserMenu", () => {
     // Trim "" → leerer displayName → fallback auf email → erste 2 Chars
     expect(screen.getByText("BO")).toBeTruthy();
   });
+  test("no displayName → dropdown label shows the email exactly once (not duplicated)", async () => {
+    const user = userEvent.setup();
+    const session = makeSessionApi({
+      user: { id: "u1", email: "bob@example.com", displayName: "", globalRoles: [] },
+    });
+    renderWithProviders(<UserMenu />, { session });
+    await user.click(screen.getByRole("button", { name: /bob@example.com/ }));
+    const menu = within(screen.getByRole("menu"));
+    // getByText throws if the email appears more than once inside the
+    // dropdown panel — displayName falls back to the email, so without the
+    // hasName guard the second (redundant) email line would duplicate it.
+    expect(menu.getByText("bob@example.com")).toBeTruthy();
+  });
   test("opens dropdown on click and shows logout button", async () => {
     const user = userEvent.setup();
     const session = makeSessionApi();

package/src/auth-email-password/web/auth-gate.tsx

@@ -32,10 +32,9 @@ export function makeAuthGate(
   return AuthGate;
 }
 
-/** SessionProvider + AuthGate als ein Gate — damit öffentliche Gates davor
- *  (z.B. /rechner) den Session-Bootstrap nicht mounten. createKumikoApp
- *  stackt providers außerhalb aller gates; SessionProvider darf deshalb
- *  kein provider mehr sein. */
+// SessionProvider + AuthGate as one gate, so a public gate in front (e.g.
+// /calculator) doesn't mount the session bootstrap — createKumikoApp stacks
+// providers outside all gates, so SessionProvider can't be a provider anymore.
 export function makeSessionAuthGate(
   LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
   loginProps?: LoginScreenProps,

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -17,10 +17,10 @@
 // auch zu loggedInHref damit der invitee in seinem neuen Tenant landet.
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
-import { type FormEvent, type ReactNode, useState } from "react";
+import { type FormEvent, type ReactNode, useContext, useState } from "react";
 import { csrfHeader } from "./auth-client";
 import { AuthCard, authMutedLinkClass, parseUrlToken } from "./auth-form-primitives";
-import { useSession } from "./session";
+import { SessionContext, UNAUTHENTICATED } from "./session";
 
 export type InviteAcceptScreenProps = {
   readonly title?: string;
@@ -42,7 +42,11 @@ export function InviteAcceptScreen({
 }: InviteAcceptScreenProps): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner } = usePrimitives();
-  const session = useSession();
+  // NOT useSession(): InviteAcceptScreen is a public route (anon invite-links
+  // are the documented use case) — useSession() throws without a
+  // <SessionProvider> ancestor. Read the context directly and fall back to
+  // the anonymous state when no provider wraps this screen (632/1).
+  const session = useContext(SessionContext) ?? UNAUTHENTICATED;
   const [token] = useState(() => tokenProp ?? parseUrlToken());
   const [mode, setMode] = useState<Mode>(() =>
     session.status === "authenticated" ? "loggedin" : "anon-existing",

package/src/auth-email-password/web/session.tsx

@@ -44,7 +44,11 @@ export type SessionApi = SessionState & {
   readonly switchTenant: (tenantId: string) => Promise<void>;
 };
 
-const UNAUTHENTICATED: SessionState = {
+// Exported so screens that render on BOTH authenticated and anonymous public
+// routes (e.g. InviteAcceptScreen) can read `.status` without requiring a
+// <SessionProvider> ancestor — see useContext(SessionContext) ?? UNAUTHENTICATED
+// in invite-accept-screen.tsx (632/1).
+export const UNAUTHENTICATED: SessionState = {
   status: "unauthenticated",
   user: null,
   activeTenantId: null,

package/src/auth-email-password/web/user-menu.tsx

@@ -64,7 +64,7 @@ export function UserMenu({ children, variant = "pill" }: UserMenuProps): ReactNo
     <DropdownMenuContent align="end" aria-label={t("auth.user.menu.label")}>
       <DropdownMenuLabel className="text-xs">
         <div className="font-medium text-foreground truncate">{displayName}</div>
-        <div className="truncate">{user.email}</div>
+        {hasName && <div className="truncate">{user.email}</div>}
       </DropdownMenuLabel>
       <DropdownMenuSeparator />
       {children}

package/src/config/__tests__/deserialize-value.test.ts

@@ -1,12 +1,9 @@
 import { describe, expect, test } from "bun:test";
 import { deserializeValue } from "../resolver";
 
-// deserializeValue is the read boundary for every config value: the DB stores
-// the JSON-encoded raw string, this turns it back into a typed primitive per the
-// key's declared `type`. The coercion has non-obvious paths worth pinning so a
-// refactor can't quietly change them: a stored value whose JSON type disagrees
-// with the declared type is NOT rejected — it is coerced (number via Number(),
-// boolean only via literal true / the string "true", text via String()).
+// Type mismatches are coerced, not rejected (number via Number(), boolean
+// only via literal true/"true", text via String()) — pinned so a refactor
+// can't quietly change that.
 
 describe("deserializeValue", () => {
   test("null raw short-circuits to undefined before any parse", () => {