@cosmicdrift/kumiko-bundled-features 0.130.1 → 0.131.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.130.1",
+  "version": "0.131.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -107,11 +107,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.130.1",
-    "@cosmicdrift/kumiko-framework": "0.130.1",
-    "@cosmicdrift/kumiko-headless": "0.130.1",
-    "@cosmicdrift/kumiko-renderer": "0.130.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.130.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.131.0",
+    "@cosmicdrift/kumiko-framework": "0.131.0",
+    "@cosmicdrift/kumiko-headless": "0.131.0",
+    "@cosmicdrift/kumiko-renderer": "0.131.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.131.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/admin-shell/__tests__/admin-shell.boot.test.ts

@@ -5,6 +5,7 @@ import { createConfigFeature } from "../../config/feature";
 import { createJobsFeature } from "../../jobs/feature";
 import { createTenantFeature } from "../../tenant/feature";
 import { tierEngineFeature } from "../../tier-engine/feature";
+import { createUserFeature } from "../../user/feature";
 import {
   ADMIN_SHELL_FEATURE,
   DEFAULT_PLATFORM_WORKSPACE_ID,
@@ -14,6 +15,7 @@ import { createAdminShellFeature } from "../feature";
 
 const features = [
   createConfigFeature(),
+  createUserFeature(),
   createTenantFeature(),
   createAuditFeature(),
   createJobsFeature(),
@@ -22,10 +24,22 @@ const features = [
 ];
 
 describe("admin-shell boot + workspace composition", () => {
-  test("validateBoot with tenant, audit, jobs, tier-engine", () => {
+  test("validateBoot with user, tenant, audit, jobs, tier-engine", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("validateBoot fails without user (platform-overview user-count requires it)", () => {
+    const withoutUser = [
+      createConfigFeature(),
+      createTenantFeature(),
+      createAuditFeature(),
+      createJobsFeature(),
+      tierEngineFeature,
+      createAdminShellFeature(),
+    ];
+    expect(() => validateBoot(withoutUser)).toThrow();
+  });
+
   test("registers tenant + platform workspaces with qualified ids", () => {
     const registry = createRegistry(features);
     expect(
@@ -82,6 +96,7 @@ describe("admin-shell boot + workspace composition", () => {
     });
     const registry = createRegistry([
       createConfigFeature(),
+      createUserFeature(),
       createTenantFeature(),
       createAuditFeature(),
       createJobsFeature(),
@@ -103,6 +118,7 @@ describe("admin-shell boot + workspace composition", () => {
     });
     const registry = createRegistry([
       createConfigFeature(),
+      createUserFeature(),
       createTenantFeature(),
       createAuditFeature(),
       createJobsFeature(),

package/src/admin-shell/__tests__/overview-allowlist.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import { JobQueries } from "../../jobs/constants";
 import { TenantQueries } from "../../tenant/constants";
+import { UserQueries } from "../../user/constants";
 import {
   isOverviewQueryAllowed,
   PLATFORM_OVERVIEW_ALLOWED_QUERIES,
@@ -22,8 +23,16 @@ describe("overview query allowlist", () => {
     expect(TENANT_OVERVIEW_ALLOWED_QUERIES).toContain("config:query:readiness");
   });
 
-  test("platform allowlist is tenant:list + jobs:list only", () => {
-    expect(PLATFORM_OVERVIEW_ALLOWED_QUERIES).toEqual([TenantQueries.list, JobQueries.list]);
+  test("platform allowlist is tenant:list + jobs:list + user:list", () => {
+    expect(PLATFORM_OVERVIEW_ALLOWED_QUERIES).toEqual([
+      TenantQueries.list,
+      JobQueries.list,
+      UserQueries.list,
+    ]);
+  });
+
+  test("platform overview allows the user-count query (fw#891 regression)", () => {
+    expect(isOverviewQueryAllowed("platform", UserQueries.list)).toBe(true);
   });
 
   test("platform queries are not tenant-allowlisted", () => {

package/src/admin-shell/__tests__/overview-screens.boot.test.ts

@@ -5,11 +5,13 @@ import { createConfigFeature } from "../../config/feature";
 import { createJobsFeature } from "../../jobs/feature";
 import { createTenantFeature } from "../../tenant/feature";
 import { tierEngineFeature } from "../../tier-engine/feature";
+import { createUserFeature } from "../../user/feature";
 import { PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID } from "../constants";
 import { createAdminShellFeature } from "../feature";
 
 const features = [
   createConfigFeature(),
+  createUserFeature(),
   createTenantFeature(),
   createAuditFeature(),
   createJobsFeature(),

package/src/admin-shell/feature.ts

@@ -36,13 +36,14 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
 
   return defineFeature(ADMIN_SHELL_FEATURE, (r) => {
     r.describe(
-      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`). Mount after tenant, audit, and jobs; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
+      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`). Mount after user, tenant, audit, and jobs; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
     );
     r.uiHints({
       displayLabel: "Admin Shell",
       category: "operations",
       recommended: false,
     });
+    r.requires("user");
     r.requires("tenant");
     r.requires("audit");
     r.requires("jobs");

package/src/admin-shell/i18n.ts

@@ -30,6 +30,7 @@ export const ADMIN_SHELL_I18N: Readonly<Record<string, LocalizedString>> = {
     en: "Check required settings",
   },
   "admin-shell:overview.tenants": { de: "Mandanten", en: "Tenants" },
+  "admin-shell:overview.users": { de: "Benutzer", en: "Users" },
   "admin-shell:overview.failedJobs": { de: "Fehlgeschlagene Jobs", en: "Failed jobs" },
   "admin-shell:overview.failedJobsHint": { de: "Job-Runs prüfen", en: "Review job runs" },
 };

package/src/admin-shell/overview-allowlist.ts

@@ -13,7 +13,11 @@ export const TENANT_OVERVIEW_ALLOWED_QUERIES = [
 ] as const;
 
 /** Platform workspace overview may only call these queries. */
-export const PLATFORM_OVERVIEW_ALLOWED_QUERIES = ["tenant:query:list", "jobs:query:list"] as const;
+export const PLATFORM_OVERVIEW_ALLOWED_QUERIES = [
+  "tenant:query:list",
+  "jobs:query:list",
+  "user:query:user:list",
+] as const;
 
 /** Regression guard — TenantAdmin overview must never touch these (HTTP 403). */
 export const TENANT_OVERVIEW_FORBIDDEN_QUERIES = [

package/src/admin-shell/web/platform-overview-screen.tsx

@@ -4,6 +4,7 @@ import { useDispatcher, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useEffect, useState } from "react";
 import { JobQueries } from "../../jobs/constants";
 import { TenantQueries } from "../../tenant/constants";
+import { UserQueries } from "../../user/constants";
 import { OverviewLayout, type OverviewState } from "./overview-layout";
 import { overviewQuery } from "./overview-query";
 
@@ -27,6 +28,18 @@ export function PlatformOverviewScreen(): ReactNode {
         return;
       }
 
+      const usersRes = await overviewQuery<{ readonly rows: readonly unknown[] }>(
+        "platform",
+        dispatcher,
+        UserQueries.list,
+        {},
+      );
+      if (cancelled) return;
+      if (!usersRes.isSuccess) {
+        setState({ kind: "error", message: usersRes.error.message });
+        return;
+      }
+
       const failedJobsRes = await overviewQuery<{ readonly rows: readonly unknown[] }>(
         "platform",
         dispatcher,
@@ -46,6 +59,10 @@ export function PlatformOverviewScreen(): ReactNode {
             label: t("admin-shell:overview.tenants"),
             value: String(tenantsRes.data.rows.length),
           },
+          {
+            label: t("admin-shell:overview.users"),
+            value: String(usersRes.data.rows.length),
+          },
           {
             label: t("admin-shell:overview.failedJobs"),
             value: String(failedJobsRes.data.rows.length),
@@ -69,7 +86,7 @@ export function PlatformOverviewScreen(): ReactNode {
       title={t("admin-shell:overview.platformTitle")}
       state={state}
       loadingLabel={t("admin-shell:overview.loading")}
-      columns={2}
+      columns={3}
     />
   );
 }

package/src/auth-email-password/web/auth-form-primitives.tsx

@@ -9,14 +9,13 @@
 //                         (full-screen, zentriert, max-w-sm). Web-only;
 //                         eine Native-Variante landet bei Bedarf
 //                         daneben (z.B. SafeArea + ScrollView).
-//   authButtonClass     — Tailwind-Class für anchor-styled-as-button
-//                         (z.B. "Zum Login"-Link nach Reset-Success).
-//                         Nur dort, wo ein <a>-Tag rendert.
-//   authMutedLinkClass  — Subtle-Link-Style.
 //   parseUrlToken       — URL-Param-Helper (window.location.search).
+//
+// Link-Styles laufen über das Link-Primitive (variant="button"/"muted") —
+// die früheren authButtonClass/authMutedLinkClass sind dorthin gewandert.
 
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
-import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer-web";
+import { BareFormProvider } from "@cosmicdrift/kumiko-renderer-web";
 import { createContext, type ReactNode, useContext, useEffect, useState } from "react";
 
 // Wrappt die zentrierte Auth-Card in ihre Umgebung. Default = Fullscreen-
@@ -80,20 +79,6 @@ export function AuthCard({ title, subtitle, children }: AuthCardProps): ReactNod
   return shell(card);
 }
 
-// Primary-button-Style für anchor-Tags die wie ein Button aussehen
-// (z.B. "Zum Login"-Link nach Reset-Success — kein <Button> weil <a>).
-export const authButtonClass = cn(
-  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors",
-  "focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
-  "disabled:pointer-events-none disabled:opacity-50",
-  "bg-primary text-primary-foreground shadow hover:bg-primary/90 h-9 px-4 py-2",
-);
-
-// Subtle-Link-Style (für "Zurück zum Login"-Anchors). Fixed margin/
-// alignment-classes lassen wir den Caller setzen — nur Farbe + hover.
-export const authMutedLinkClass =
-  "text-sm text-muted-foreground hover:text-foreground underline-offset-4 hover:underline";
-
 // Liest `?<paramName>=<value>` aus der aktuellen URL — typisches
 // Pattern für Token-bearing Pages (reset, verify). Returnt "" wenn der
 // Browser nicht da ist (SSR-safety) oder der Parameter fehlt.

package/src/auth-email-password/web/forgot-password-screen.tsx

@@ -12,7 +12,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { requestPasswordReset } from "./auth-client";
-import { AuthCard, authMutedLinkClass } from "./auth-form-primitives";
+import { AuthCard } from "./auth-form-primitives";
 
 export type ForgotPasswordScreenProps = {
   readonly title?: string;
@@ -28,7 +28,7 @@ export function ForgotPasswordScreen({
   loginHref = "/login",
 }: ForgotPasswordScreenProps): ReactNode {
   const t = useTranslation();
-  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
   const [email, setEmail] = useState("");
   const [submitting, setSubmitting] = useState(false);
   const [done, setDone] = useState(false);
@@ -77,9 +77,9 @@ export function ForgotPasswordScreen({
             <p className="font-medium text-foreground">{t("auth.forgotPassword.successTitle")}</p>
             <p className="mt-1">{t("auth.forgotPassword.successBody")}</p>
           </Banner>
-          <a href={loginHref} className={authMutedLinkClass}>
+          <Link href={loginHref} variant="muted">
             {t("auth.forgotPassword.backToLogin")}
-          </a>
+          </Link>
         </div>
       ) : (
         <div className="p-6 pt-0 flex flex-col gap-4">
@@ -101,9 +101,9 @@ export function ForgotPasswordScreen({
               {submitting ? t("auth.forgotPassword.submitting") : t("auth.forgotPassword.submit")}
             </Button>
           </Form>
-          <a href={loginHref} className={`${authMutedLinkClass} self-center`}>
+          <Link href={loginHref} variant="muted" className="self-center">
             {t("auth.forgotPassword.backToLogin")}
-          </a>
+          </Link>
         </div>
       )}
     </AuthCard>

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -19,7 +19,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useContext, useState } from "react";
 import { csrfHeader } from "./auth-client";
-import { AuthCard, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
+import { AuthCard, useUrlToken } from "./auth-form-primitives";
 import { SessionContext, UNAUTHENTICATED } from "./session";
 
 export type InviteAcceptScreenProps = {
@@ -41,7 +41,7 @@ export function InviteAcceptScreen({
   loginHref = "/login",
 }: InviteAcceptScreenProps): ReactNode {
   const t = useTranslation();
-  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
   // NOT useSession(): InviteAcceptScreen is a public route (anon invite-links
   // are the documented use case) — useSession() throws without a
   // <SessionProvider> ancestor. Read the context directly and fall back to
@@ -142,9 +142,9 @@ export function InviteAcceptScreen({
       <AuthCard title={effectiveTitle}>
         <div className="p-6 pt-0 flex flex-col gap-4">
           <p className="text-sm text-muted-foreground">{t("auth.inviteAccept.missingToken")}</p>
-          <a href={loginHref} className={authMutedLinkClass}>
+          <Link href={loginHref} variant="muted">
             {t("auth.inviteAccept.goToLogin")}
-          </a>
+          </Link>
         </div>
       </AuthCard>
     );

package/src/auth-email-password/web/login-screen.tsx

@@ -12,7 +12,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { type LoginFailure, requestEmailVerification } from "./auth-client";
-import { AuthCard, authMutedLinkClass } from "./auth-form-primitives";
+import { AuthCard } from "./auth-form-primitives";
 import { useSession } from "./session";
 
 // Resend-Status für den "Bestätigungs-Mail erneut senden"-Flow, der bei
@@ -92,7 +92,7 @@ export function LoginScreen({
   legalLinks,
 }: LoginScreenProps): ReactNode {
   const t = useTranslation();
-  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
   const session = useSession();
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
@@ -186,17 +186,17 @@ export function LoginScreen({
                 {error.reason === "email_not_verified" &&
                   email.trim().length > 0 &&
                   email === failedLoginEmail && (
-                    // kumiko-lint-ignore primitives-discipline Inline-Link im Banner (UX-Choice); Button-Primitive hat keinen link-Variant
-                    <button
-                      type="button"
-                      onClick={() => void onResend()}
-                      disabled={resendStatus.kind === "sending"}
-                      className={`${authMutedLinkClass} self-start text-left disabled:opacity-50`}
-                    >
-                      {resendStatus.kind === "sending"
-                        ? t("auth.login.submitting")
-                        : t("auth.login.resendVerification")}
-                    </button>
+                    <span className="self-start">
+                      <Button
+                        variant="link"
+                        onClick={() => void onResend()}
+                        disabled={resendStatus.kind === "sending"}
+                      >
+                        {resendStatus.kind === "sending"
+                          ? t("auth.login.submitting")
+                          : t("auth.login.resendVerification")}
+                      </Button>
+                    </span>
                   )}
                 {resendStatus.kind === "rateLimited" && (
                   <span className="text-xs">{t("auth.login.resendRateLimited")}</span>
@@ -212,14 +212,14 @@ export function LoginScreen({
           </Button>
         </Form>
         {forgotPasswordHref !== undefined && (
-          <a href={forgotPasswordHref} className={`${authMutedLinkClass} self-center`}>
+          <Link href={forgotPasswordHref} variant="muted" className="self-center">
             {t("auth.login.forgotPassword")}
-          </a>
+          </Link>
         )}
         {signupHref !== undefined && (
-          <a href={signupHref} className={`${authMutedLinkClass} self-center`}>
+          <Link href={signupHref} variant="muted" className="self-center">
             {t("auth.signup.title")}
-          </a>
+          </Link>
         )}
         {legalLinks !== undefined && legalLinks.length > 0 && (
           <nav
@@ -227,9 +227,9 @@ export function LoginScreen({
             className="flex items-center justify-center gap-3 pt-2 border-t border-border/50"
           >
             {legalLinks.map((link) => (
-              <a key={link.href} href={link.href} className={`${authMutedLinkClass} text-xs`}>
+              <Link key={link.href} href={link.href} variant="muted" className="text-xs">
                 {link.label}
-              </a>
+              </Link>
             ))}
           </nav>
         )}

package/src/auth-email-password/web/reset-password-screen.tsx

@@ -13,7 +13,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { resetPassword } from "./auth-client";
-import { AuthCard, authButtonClass, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
+import { AuthCard, useUrlToken } from "./auth-form-primitives";
 
 export type ResetPasswordScreenProps = {
   readonly title?: string;
@@ -31,7 +31,7 @@ export function ResetPasswordScreen({
   loginHref = "/login",
 }: ResetPasswordScreenProps): ReactNode {
   const t = useTranslation();
-  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
   const token = useUrlToken(tokenProp);
   const [newPassword, setNewPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
@@ -83,9 +83,9 @@ export function ResetPasswordScreen({
       <AuthCard title={effectiveTitle}>
         <div className="p-6 pt-0 flex flex-col gap-4">
           <p className="text-sm text-muted-foreground">{t("auth.resetPassword.missingToken")}</p>
-          <a href={loginHref} className={authMutedLinkClass}>
+          <Link href={loginHref} variant="muted">
             {t("auth.resetPassword.goToLogin")}
-          </a>
+          </Link>
         </div>
       </AuthCard>
     );
@@ -99,9 +99,9 @@ export function ResetPasswordScreen({
             <p className="font-medium text-foreground">{t("auth.resetPassword.successTitle")}</p>
             <p className="mt-1">{t("auth.resetPassword.successBody")}</p>
           </Banner>
-          <a href={loginHref} className={authButtonClass}>
+          <Link href={loginHref} variant="button">
             {t("auth.resetPassword.goToLogin")}
-          </a>
+          </Link>
         </div>
       ) : (
         <div className="p-6 pt-0 flex flex-col gap-4">

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -18,7 +18,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { confirmSignup } from "./auth-client";
-import { AuthCard, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
+import { AuthCard, useUrlToken } from "./auth-form-primitives";
 
 export type SignupCompleteScreenProps = {
   readonly title?: string;
@@ -43,7 +43,7 @@ export function SignupCompleteScreen({
   loginHref = "/login",
 }: SignupCompleteScreenProps): ReactNode {
   const t = useTranslation();
-  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
   const token = useUrlToken(tokenProp);
   const [password, setPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
@@ -98,9 +98,9 @@ export function SignupCompleteScreen({
       <AuthCard title={effectiveTitle}>
         <div className="p-6 pt-0 flex flex-col gap-4">
           <p className="text-sm text-muted-foreground">{t("auth.signupComplete.missingToken")}</p>
-          <a href={loginHref} className={authMutedLinkClass}>
+          <Link href={loginHref} variant="muted">
             {t("auth.signup.haveAccount")}
-          </a>
+          </Link>
         </div>
       </AuthCard>
     );

package/src/auth-email-password/web/signup-screen.tsx

@@ -15,7 +15,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { requestSignup } from "./auth-client";
-import { AuthCard, authMutedLinkClass } from "./auth-form-primitives";
+import { AuthCard } from "./auth-form-primitives";
 
 export type SignupScreenProps = {
   readonly title?: string;
@@ -31,7 +31,7 @@ export function SignupScreen({
   loginHref = "/login",
 }: SignupScreenProps): ReactNode {
   const t = useTranslation();
-  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
   const [email, setEmail] = useState("");
   const [submitting, setSubmitting] = useState(false);
   const [done, setDone] = useState(false);
@@ -95,9 +95,9 @@ export function SignupScreen({
           <Button variant="secondary" onClick={onResend} disabled={submitting}>
             {t("auth.signup.resend")}
           </Button>
-          <a href={loginHref} className={authMutedLinkClass}>
+          <Link href={loginHref} variant="muted">
             {t("auth.signup.haveAccount")}
-          </a>
+          </Link>
         </div>
       ) : (
         <div className="p-6 pt-0 flex flex-col gap-4">
@@ -120,9 +120,9 @@ export function SignupScreen({
               {submitting ? t("auth.signup.submitting") : t("auth.signup.submit")}
             </Button>
           </Form>
-          <a href={loginHref} className={`${authMutedLinkClass} self-center`}>
+          <Link href={loginHref} variant="muted" className="self-center">
             {t("auth.signup.haveAccount")}
-          </a>
+          </Link>
         </div>
       )}
     </AuthCard>

package/src/auth-email-password/web/verify-email-screen.tsx

@@ -10,10 +10,10 @@
 // nicht den ersten valid-call beim Mount und den zweiten als invalid-
 // Banner sehen.
 
-import { useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useEffect, useRef, useState } from "react";
 import { verifyEmail } from "./auth-client";
-import { AuthCard, authButtonClass, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
+import { AuthCard, useUrlToken } from "./auth-form-primitives";
 
 export type VerifyEmailScreenProps = {
   readonly title?: string;
@@ -31,6 +31,7 @@ export function VerifyEmailScreen({
   loginHref = "/login",
 }: VerifyEmailScreenProps): ReactNode {
   const t = useTranslation();
+  const { Link } = usePrimitives();
   const token = useUrlToken(tokenProp);
   const [status, setStatus] = useState<Status>(token === "" ? "missing-token" : "verifying");
   const startedRef = useRef(false);
@@ -50,9 +51,9 @@ export function VerifyEmailScreen({
       <AuthCard title={title ?? t("auth.verifyEmail.errorTitle")}>
         <div className="p-6 pt-0 flex flex-col gap-4">
           <p className="text-sm text-muted-foreground">{t("auth.verifyEmail.missingToken")}</p>
-          <a href={loginHref} className={authMutedLinkClass}>
+          <Link href={loginHref} variant="muted">
             {t("auth.verifyEmail.goToLogin")}
-          </a>
+          </Link>
         </div>
       </AuthCard>
     );
@@ -75,9 +76,9 @@ export function VerifyEmailScreen({
       <AuthCard title={title ?? t("auth.verifyEmail.successTitle")}>
         <div className="p-6 pt-0 flex flex-col gap-4">
           <p className="text-sm text-muted-foreground">{t("auth.verifyEmail.successBody")}</p>
-          <a href={loginHref} className={authButtonClass}>
+          <Link href={loginHref} variant="button">
             {t("auth.verifyEmail.goToLogin")}
-          </a>
+          </Link>
         </div>
       </AuthCard>
     );
@@ -88,9 +89,9 @@ export function VerifyEmailScreen({
     <AuthCard title={title ?? t("auth.verifyEmail.errorTitle")}>
       <div className="p-6 pt-0 flex flex-col gap-4">
         <p className="text-sm text-muted-foreground">{t("auth.verifyEmail.errorBody")}</p>
-        <a href={loginHref} className={authMutedLinkClass}>
+        <Link href={loginHref} variant="muted">
           {t("auth.verifyEmail.goToLogin")}
-        </a>
+        </Link>
       </div>
     </AuthCard>
   );

package/src/text-content/web/__tests__/group-blocks.test.ts

@@ -53,7 +53,7 @@ describe("groupBlocksByFolder", () => {
       args: { slug: "imprint", lang: "de" },
     });
     expect(root.children).toBeUndefined();
-    expect(root.icon).toBeUndefined();
+    expect(root.icon).toBe("file");
   });
   test('folder="page" → Folder-Container mit child', () => {
     const nodes = inside(
@@ -101,7 +101,7 @@ describe("groupBlocksByFolder", () => {
     );
     expect(nodes).toHaveLength(2);
     expect(nodes[0]?.label).toBe("imprint");
-    expect(nodes[0]?.icon).toBeUndefined();
+    expect(nodes[0]?.icon).toBe("file");
     expect(nodes[1]?.label).toBe("page");
     expect(nodes[1]?.icon).toBe("folder");
   });
@@ -184,7 +184,7 @@ describe("groupBlocksByFolder", () => {
     const leaf = nodes[0];
     const folder = nodes[1];
     expect(leaf?.label).toBe("Page-Root");
-    expect(leaf?.icon).toBeUndefined();
+    expect(leaf?.icon).toBe("file");
     expect(leaf?.target).toBeDefined();
     expect(folder?.label).toBe("page");
     expect(folder?.icon).toBe("folder");

package/src/text-content/web/client-plugin.tsx

@@ -77,6 +77,7 @@ function newFolderNode(): FolderNode {
 function attachBlock(root: FolderNode, block: BlockSummary, tenantIdOverride?: string): void {
   const leaf: TreeNode = {
     label: block.title || block.slug,
+    icon: "file",
     target: {
       featureId: "text-content",
       action: "edit",
@@ -217,9 +218,11 @@ type SetResponse = { readonly slug: string; readonly lang: string; readonly isNe
 
 function TextContentEditor({
   target,
-  onClose,
 }: {
   readonly target: TargetRef;
+  // onClose bleibt Teil des Resolver-Contracts (Visual-Panel liefert es),
+  // wird aber nicht mehr gebraucht: die Tree-Auswahl navigiert, kein
+  // Schließen-Button mehr. Nicht destrukturiert → kein unused binding.
   readonly onClose: () => void;
 }): ReactNode {
   // @cast-boundary visual-tree-args — TargetRef.args ist erased zu
@@ -309,61 +312,53 @@ function TextContentEditor({
   const disabled = submitting || loading || !canWrite;
 
   return (
-    <div className="flex h-full flex-col">
-      <header className="flex items-center justify-between border-b px-6 py-4">
-        <div>
-          <h2 className="text-lg font-semibold">Text-Block bearbeiten</h2>
-          <p className="text-xs text-muted-foreground">
-            {slug || "—"} ({lang || "—"})
-          </p>
-        </div>
-        <Button variant="secondary" onClick={onClose}>
-          schlie&szlig;en
-        </Button>
-      </header>
-      <div className="flex-1 overflow-y-auto px-6 py-6">
-        <Form onSubmit={onSubmit}>
-          {loading && <Banner variant="loading">Lädt aktuellen Stand…</Banner>}
-          {loadError !== null && (
-            <Banner variant="error">Konnte Block nicht laden: {loadError.code}</Banner>
-          )}
-          {!canWrite && !loading && (
-            <Banner variant="info">
-              Read-only — TenantAdmin- oder SystemAdmin-Rolle f&uuml;r &Auml;nderungen erforderlich.
-            </Banner>
-          )}
-          <Field id="text-content-title" label="Titel" required>
-            <Input
-              kind="text"
-              id="text-content-title"
-              name="text-content-title"
-              value={title}
-              onChange={setTitle}
-              disabled={disabled}
-              required
-            />
-          </Field>
-          <Field id="text-content-body" label="Inhalt">
-            <Input
-              kind="textarea"
-              id="text-content-body"
-              name="text-content-body"
-              value={body}
-              onChange={setBody}
-              disabled={disabled}
-              rows={14}
-            />
-          </Field>
-          {saveError !== null && <Banner variant="error">{saveError}</Banner>}
-          {savedMsg !== null && <Banner variant="info">{savedMsg}</Banner>}
-          {canWrite && (
-            <Button type="submit" loading={submitting} disabled={disabled}>
-              {submitting ? "Speichern…" : "Speichern"}
-            </Button>
-          )}
-        </Form>
-      </div>
-    </div>
+    <Form
+      onSubmit={onSubmit}
+      testId="text-content-editor"
+      title={title || slug || "—"}
+      subtitle={lang !== "" ? `(${lang})` : undefined}
+      actions={
+        canWrite ? (
+          <Button type="submit" loading={submitting} disabled={disabled}>
+            {submitting ? "Speichern…" : "Speichern"}
+          </Button>
+        ) : undefined
+      }
+    >
+      {loading && <Banner variant="loading">Lädt aktuellen Stand…</Banner>}
+      {loadError !== null && (
+        <Banner variant="error">Konnte Block nicht laden: {loadError.code}</Banner>
+      )}
+      {!canWrite && !loading && (
+        <Banner variant="info">
+          Read-only — TenantAdmin- oder SystemAdmin-Rolle f&uuml;r &Auml;nderungen erforderlich.
+        </Banner>
+      )}
+      <Field id="text-content-title" label="Titel" required>
+        <Input
+          kind="text"
+          id="text-content-title"
+          name="text-content-title"
+          value={title}
+          onChange={setTitle}
+          disabled={disabled}
+          required
+        />
+      </Field>
+      <Field id="text-content-body" label="Inhalt">
+        <Input
+          kind="textarea"
+          id="text-content-body"
+          name="text-content-body"
+          value={body}
+          onChange={setBody}
+          disabled={disabled}
+          rows={14}
+        />
+      </Field>
+      {saveError !== null && <Banner variant="error">{saveError}</Banner>}
+      {savedMsg !== null && <Banner variant="info">{savedMsg}</Banner>}
+    </Form>
   );
 }
 

package/src/user/constants.ts

@@ -1,3 +1,4 @@
+// @runtime client
 // Feature name
 export const USER_FEATURE = "user" as const;