@cosmicdrift/kumiko-bundled-features 0.211.0 → 0.212.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.211.0",
+  "version": "0.212.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.211.0",
-    "@cosmicdrift/kumiko-framework": "0.211.0",
-    "@cosmicdrift/kumiko-headless": "0.211.0",
-    "@cosmicdrift/kumiko-renderer": "0.211.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.211.0",
-    "@cosmicdrift/kumiko-types": "0.211.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.212.0",
+    "@cosmicdrift/kumiko-framework": "0.212.0",
+    "@cosmicdrift/kumiko-headless": "0.212.0",
+    "@cosmicdrift/kumiko-renderer": "0.212.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.212.0",
+    "@cosmicdrift/kumiko-types": "0.212.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.211.0"
+    "@cosmicdrift/kumiko-locale-de": "0.212.0"
   }
 }

package/src/admin-shell/feature.ts

@@ -63,6 +63,7 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
       ...(includeTierAdmin ? (["admin-shell:nav:tier-admin"] as const) : []),
     ];
 
+    // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312
     r.screen({
       id: TENANT_OVERVIEW_SCREEN_ID,
       type: "custom",
@@ -77,6 +78,7 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
       order: 1,
     });
 
+    // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312
     r.screen({
       id: PLATFORM_OVERVIEW_SCREEN_ID,
       type: "custom",

package/src/admin-shell/web/platform-overview-screen.tsx

@@ -13,6 +13,7 @@ export function PlatformOverviewScreen(): ReactNode {
   const dispatcher = useDispatcher();
   const [state, setState] = useState<OverviewState>({ kind: "loading" });
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     let cancelled = false;
     void (async (): Promise<void> => {

package/src/admin-shell/web/tenant-overview-screen.tsx

@@ -12,6 +12,7 @@ export function TenantOverviewScreen(): ReactNode {
   const dispatcher = useDispatcher();
   const [state, setState] = useState<OverviewState>({ kind: "loading" });
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     let cancelled = false;
     void (async (): Promise<void> => {

package/src/audit/__tests__/audit-log-screen.test.tsx

@@ -0,0 +1,228 @@
+// @runtime client
+// DOM test for AuditLogScreen actor-name resolution (#audit-log-actor-name).
+// Provider wrapper is local — renderer-web → bundled-features forbids importing
+// renderer-web test-utils from here.
+
+import { describe, expect, test } from "bun:test";
+import { createStore, type Dispatcher, type DispatcherStatus } from "@cosmicdrift/kumiko-headless";
+import {
+  createStaticLocaleResolver,
+  DispatcherProvider,
+  kumikoDefaultTranslations,
+  type LiveEventSubscriber,
+  LiveEventsProvider,
+  LocaleProvider,
+  type NavApi,
+  NavProvider,
+  PrimitivesProvider,
+  TokensProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives, defaultTokens } from "@cosmicdrift/kumiko-renderer-web";
+import { render, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { TenantQueries } from "../../tenant/constants";
+import { AuditQueries } from "../constants";
+import { AuditLogScreen } from "../web/audit-log-screen";
+import { defaultTranslations } from "../web/i18n";
+
+if (typeof globalThis.ResizeObserver === "undefined") {
+  globalThis.ResizeObserver = class {
+    observe(): void {}
+    unobserve(): void {}
+    disconnect(): void {}
+  } as unknown as typeof ResizeObserver;
+}
+
+const stubLiveEvents: LiveEventSubscriber = () => () => {};
+const stubTokens = {
+  tokens: defaultTokens,
+  mode: "light" as const,
+  setMode: () => {},
+  toggleMode: () => {},
+};
+const stubResolver = createStaticLocaleResolver();
+const stubNav: NavApi = {
+  route: undefined,
+  navigate: () => {},
+  replace: () => {},
+  hrefFor: (target) => {
+    if (!("screenId" in target)) return "";
+    return target.entityId !== undefined
+      ? `/${target.screenId}/${target.entityId}`
+      : `/${target.screenId}`;
+  },
+  searchParams: {},
+  setSearchParams: () => {},
+};
+
+type AuditRowFixture = {
+  readonly id: string;
+  readonly aggregateId: string;
+  readonly aggregateType: string;
+  readonly type: string;
+  readonly createdBy: string;
+  readonly createdAt: string;
+  readonly payload: Record<string, unknown>;
+};
+
+type MemberRowFixture = {
+  readonly userId: string;
+  readonly email: string | null;
+  readonly displayName: string | null;
+};
+
+const AUDIT_ROWS: readonly AuditRowFixture[] = [
+  {
+    id: "1",
+    aggregateId: "agg-1",
+    aggregateType: "widget",
+    type: "widget.created",
+    createdBy: "user-1",
+    createdAt: "2026-08-01T00:00:00.000Z",
+    payload: {},
+  },
+  {
+    id: "2",
+    aggregateId: "agg-2",
+    aggregateType: "widget",
+    type: "widget.updated",
+    createdBy: "user-2",
+    createdAt: "2026-08-02T00:00:00.000Z",
+    payload: {},
+  },
+  {
+    id: "3",
+    aggregateId: "agg-3",
+    aggregateType: "widget",
+    type: "widget.deleted",
+    createdBy: "user-missing",
+    createdAt: "2026-08-03T00:00:00.000Z",
+    payload: {},
+  },
+  {
+    id: "4",
+    aggregateId: "agg-4",
+    aggregateType: "widget",
+    type: "widget.synced",
+    createdBy: "system",
+    createdAt: "2026-08-04T00:00:00.000Z",
+    payload: {},
+  },
+  {
+    id: "5",
+    aggregateId: "agg-5",
+    aggregateType: "widget",
+    type: "widget.archived",
+    createdBy: "3f2504e0-4f89-11d3-9a0c-0305e82c3301",
+    createdAt: "2026-08-05T00:00:00.000Z",
+    payload: {},
+  },
+];
+
+const MEMBERS: readonly MemberRowFixture[] = [
+  { userId: "user-1", email: "alice@example.com", displayName: "Alice Example" },
+  { userId: "user-2", email: "bob@example.com", displayName: null },
+];
+
+function makeDispatcher(): Dispatcher {
+  const statusStore = createStore<DispatcherStatus>("online");
+  const query = (async (type: string) => {
+    if (type === AuditQueries.list) {
+      return { isSuccess: true, data: { rows: AUDIT_ROWS, nextBefore: null } };
+    }
+    if (type === TenantQueries.members) {
+      return { isSuccess: true, data: MEMBERS };
+    }
+    return { isSuccess: true, data: null };
+  }) as unknown as Dispatcher["query"];
+  return {
+    write: (async () => ({ isSuccess: true, data: null })) as unknown as Dispatcher["write"],
+    query,
+    batch: (async () => ({ isSuccess: true, results: [] })) as unknown as Dispatcher["batch"],
+    statusStore,
+    async *stream() {},
+    pendingWrites: () => [],
+    pendingFiles: () => [],
+  } as unknown as Dispatcher; // @cast-boundary test-stub
+}
+
+function renderScreen(): ReturnType<typeof render> {
+  const wrapper = ({ children }: { readonly children: ReactNode }): ReactNode => (
+    <TokensProvider value={stubTokens}>
+      <LocaleProvider
+        resolver={stubResolver}
+        fallbackBundles={[defaultTranslations, kumikoDefaultTranslations]}
+      >
+        <PrimitivesProvider value={defaultPrimitives}>
+          <NavProvider value={stubNav}>
+            <LiveEventsProvider value={stubLiveEvents}>
+              <DispatcherProvider dispatcher={makeDispatcher()}>{children}</DispatcherProvider>
+            </LiveEventsProvider>
+          </NavProvider>
+        </PrimitivesProvider>
+      </LocaleProvider>
+    </TokensProvider>
+  );
+  return render(<AuditLogScreen />, { wrapper });
+}
+
+describe("AuditLogScreen — actor name resolution", () => {
+  test("known member with displayName → cell shows the display name", async () => {
+    const view = renderScreen();
+    await waitFor(() => {
+      const cell = view.queryByTestId("cell-1-actor");
+      if (cell === null) throw new Error("actor cell not rendered yet");
+    });
+    expect(view.getByTestId("cell-1-actor").textContent).toBe("Alice Example");
+  });
+
+  test("known member without displayName → cell falls back to email", async () => {
+    const view = renderScreen();
+    await waitFor(() => {
+      const cell = view.queryByTestId("cell-2-actor");
+      if (cell === null) throw new Error("actor cell not rendered yet");
+    });
+    expect(view.getByTestId("cell-2-actor").textContent).toBe("bob@example.com");
+  });
+
+  test("createdBy not in members list → cell is empty, never the raw id", async () => {
+    const view = renderScreen();
+    await waitFor(() => {
+      const cell = view.queryByTestId("cell-3-actor");
+      if (cell === null) throw new Error("actor cell not rendered yet");
+    });
+    const cell = view.getByTestId("cell-3-actor");
+    expect(cell.textContent).toBe("");
+    expect(cell.textContent).not.toBe("user-missing");
+  });
+
+  test("table has no aggregate column", async () => {
+    const view = renderScreen();
+    await waitFor(() => {
+      const cell = view.queryByTestId("cell-1-actor");
+      if (cell === null) throw new Error("table not rendered yet");
+    });
+    expect(view.queryByTestId("cell-1-aggregate")).toBeNull();
+    expect(view.container.textContent).not.toContain("agg-1");
+  });
+
+  test("createdBy is the system literal → cell shows the System label", async () => {
+    const view = renderScreen();
+    await waitFor(() => {
+      const cell = view.queryByTestId("cell-4-actor");
+      if (cell === null) throw new Error("actor cell not rendered yet");
+    });
+    expect(view.getByTestId("cell-4-actor").textContent).toBe("System");
+  });
+
+  test("createdBy is an unresolvable UUID → cell stays empty, raw UUID never rendered", async () => {
+    const view = renderScreen();
+    await waitFor(() => {
+      const cell = view.queryByTestId("cell-5-actor");
+      if (cell === null) throw new Error("actor cell not rendered yet");
+    });
+    const cell = view.getByTestId("cell-5-actor");
+    expect(cell.textContent).toBe("");
+    expect(view.container.textContent).not.toContain("3f2504e0-4f89-11d3-9a0c-0305e82c3301");
+  });
+});

package/src/audit/constants.ts

@@ -2,6 +2,9 @@
 // Qualified handler names + screen ids — shared by server feature and web client.
 export const AUDIT_FEATURE = "audit" as const;
 
+/** Literal `createdBy` written by system-authored events (e.g. delivery attempts). */
+export const SYSTEM_ACTOR_ID = "system" as const;
+
 export const AuditQueries = {
   list: "audit:query:list",
   details: "audit:query:details",

package/src/audit/feature.ts

@@ -37,12 +37,14 @@ export function createAuditFeature(): FeatureDefinition {
       details: r.queryHandler(detailsQuery),
     };
 
+    // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312
     r.screen({
       id: AUDIT_LOG_SCREEN_ID,
       type: "custom",
       renderer: { react: { __component: "AuditLogScreen" } },
       access: { roles: access.admin },
     });
+    // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312
     r.screen({
       id: AUDIT_LOG_DETAIL_SCREEN_ID,
       type: "custom",

package/src/audit/i18n.ts

@@ -16,6 +16,7 @@ export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
   "audit.log.col.type": { en: "Event" },
   "audit.log.col.aggregate": { en: "Aggregate" },
   "audit.log.col.actor": { en: "Actor" },
+  "audit.log.actor.system": { en: "System" },
   "audit.log.filter.eventType": { en: "Event type" },
   "audit.log.filter.aggregateType": { en: "Aggregate type" },
   "audit.log.filter.from": { en: "From" },

package/src/audit/web/audit-log-detail-screen.tsx

@@ -10,7 +10,8 @@ import {
 } from "@cosmicdrift/kumiko-renderer";
 import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
 import { type ReactNode, useCallback, useEffect, useState } from "react";
-import { AuditQueries } from "../constants";
+import { TenantQueries } from "../../tenant/constants";
+import { AuditQueries, SYSTEM_ACTOR_ID } from "../constants";
 
 type AuditDetail = {
   readonly id: string;
@@ -23,11 +24,17 @@ type AuditDetail = {
   readonly metadata: Record<string, unknown>;
 };
 
+type MemberRow = {
+  readonly userId: string;
+  readonly email: string | null;
+  readonly displayName: string | null;
+};
+
 type State =
   | { readonly kind: "loading" }
   | { readonly kind: "missing" }
   | { readonly kind: "error"; readonly message: string }
-  | { readonly kind: "ready"; readonly event: AuditDetail };
+  | { readonly kind: "ready"; readonly event: AuditDetail; readonly actorName: string };
 
 export function AuditLogDetailScreen(): ReactNode {
   const t = useTranslation();
@@ -52,9 +59,24 @@ export function AuditLogDetailScreen(): ReactNode {
       setState({ kind: "missing" });
       return;
     }
-    setState({ kind: "ready", event: res.data });
-  }, [dispatcher, eventId]);
+    const event = res.data;
+    const membersRes = await dispatcher.query<readonly MemberRow[]>(TenantQueries.members, {});
+    const member = membersRes.isSuccess
+      ? membersRes.data.find((m) => m.userId === event.createdBy)
+      : undefined;
+    setState({
+      kind: "ready",
+      event,
+      actorName:
+        event.createdBy === SYSTEM_ACTOR_ID
+          ? t("audit.log.actor.system")
+          : member
+            ? (member.displayName ?? member.email ?? "")
+            : "",
+    });
+  }, [dispatcher, eventId, t]);
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     void load();
   }, [load]);
@@ -83,7 +105,7 @@ export function AuditLogDetailScreen(): ReactNode {
     );
   }
 
-  const { event } = state;
+  const { event, actorName } = state;
 
   return (
     <FormScreenShell testId="audit-log-detail-screen" className="flex flex-col gap-6">
@@ -101,7 +123,7 @@ export function AuditLogDetailScreen(): ReactNode {
           </div>
           <div>
             <dt className="font-medium">{t("audit.log.col.actor")}</dt>
-            <dd data-testid="audit-detail-actor">{event.createdBy}</dd>
+            <dd data-testid="audit-detail-actor">{actorName}</dd>
           </div>
           <div>
             <dt className="font-medium">{t("audit.log.detail.field.id")}</dt>

package/src/audit/web/audit-log-screen.tsx

@@ -11,8 +11,10 @@ import {
   usePrimitives,
   useTranslation,
 } from "@cosmicdrift/kumiko-renderer";
+import { Filter, RotateCcw } from "lucide-react";
 import { type ReactNode, useCallback, useEffect, useRef, useState } from "react";
-import { AUDIT_LOG_DETAIL_SCREEN_ID, AuditQueries } from "../constants";
+import { TenantQueries } from "../../tenant/constants";
+import { AUDIT_LOG_DETAIL_SCREEN_ID, AuditQueries, SYSTEM_ACTOR_ID } from "../constants";
 
 type AuditRow = {
   readonly id: string;
@@ -26,6 +28,12 @@ type AuditRow = {
 
 type AuditResponse = { readonly rows: readonly AuditRow[]; readonly nextBefore: string | null };
 
+type MemberRow = {
+  readonly userId: string;
+  readonly email: string | null;
+  readonly displayName: string | null;
+};
+
 type Filters = {
   readonly eventType: string;
   readonly aggregateType: string;
@@ -40,6 +48,7 @@ type State =
       readonly kind: "ready";
       readonly rows: readonly AuditRow[];
       readonly nextBefore: string | null;
+      readonly names: ReadonlyMap<string, string>;
     };
 
 const EMPTY_FILTERS: Filters = { eventType: "", aggregateType: "", from: "", to: "" };
@@ -57,29 +66,44 @@ export function AuditLogScreen(): ReactNode {
   const filtersRef = useRef(filters);
   filtersRef.current = filters;
 
+  // Loaded once per screen lifetime, not per page — members rarely change
+  // mid-session and refetching on every "older" click is wasted work.
+  const membersRef = useRef<Promise<ReadonlyMap<string, string>> | null>(null);
+
   const load = useCallback(
     async (cursor?: string, overrideFilters?: Filters): Promise<void> => {
       setState({ kind: "loading" });
       const f = overrideFilters ?? filtersRef.current;
-      const res = await dispatcher.query<AuditResponse>(AuditQueries.list, {
-        limit: 50,
-        ...(cursor !== undefined && { before: cursor }),
-        ...(f.eventType.trim() !== "" && { eventType: f.eventType.trim() }),
-        ...(f.aggregateType.trim() !== "" && {
-          aggregateType: f.aggregateType.trim(),
+      membersRef.current ??= dispatcher
+        .query<readonly MemberRow[]>(TenantQueries.members, {})
+        .then((res) =>
+          res.isSuccess
+            ? new Map(res.data.map((m) => [m.userId, m.displayName ?? m.email ?? ""] as const))
+            : new Map<string, string>(),
+        );
+      const [res, names] = await Promise.all([
+        dispatcher.query<AuditResponse>(AuditQueries.list, {
+          limit: 50,
+          ...(cursor !== undefined && { before: cursor }),
+          ...(f.eventType.trim() !== "" && { eventType: f.eventType.trim() }),
+          ...(f.aggregateType.trim() !== "" && {
+            aggregateType: f.aggregateType.trim(),
+          }),
+          ...(f.from !== "" && { from: toIsoStart(f.from) }),
+          ...(f.to !== "" && { to: toIsoEnd(f.to) }),
         }),
-        ...(f.from !== "" && { from: toIsoStart(f.from) }),
-        ...(f.to !== "" && { to: toIsoEnd(f.to) }),
-      });
+        membersRef.current,
+      ]);
       if (!res.isSuccess) {
         setState({ kind: "error", message: res.error.message });
         return;
       }
-      setState({ kind: "ready", rows: res.data.rows, nextBefore: res.data.nextBefore });
+      setState({ kind: "ready", rows: res.data.rows, nextBefore: res.data.nextBefore, names });
     },
     [dispatcher],
   );
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     void load(before);
   }, [load, before]);
@@ -105,8 +129,8 @@ export function AuditLogScreen(): ReactNode {
 
   return (
     <div className="w-full" data-testid="audit-log-screen">
-      <div className="flex flex-col gap-4 px-6 pt-6">
-        <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
+      <div className="flex flex-wrap items-end gap-4 px-6 pt-6">
+        <div className="min-w-40 flex-1">
           <Field id="audit-filter-event" label={t("audit.log.filter.eventType")}>
             <Input
               kind="text"
@@ -116,6 +140,8 @@ export function AuditLogScreen(): ReactNode {
               onChange={(v: string) => setFilters((f) => ({ ...f, eventType: v }))}
             />
           </Field>
+        </div>
+        <div className="min-w-40 flex-1">
           <Field id="audit-filter-aggregate" label={t("audit.log.filter.aggregateType")}>
             <Input
               kind="text"
@@ -125,6 +151,8 @@ export function AuditLogScreen(): ReactNode {
               onChange={(v) => setFilters((f) => ({ ...f, aggregateType: v }))}
             />
           </Field>
+        </div>
+        <div className="min-w-40 flex-1">
           <Field id="audit-filter-from" label={t("audit.log.filter.from")}>
             <Input
               kind="date"
@@ -134,6 +162,8 @@ export function AuditLogScreen(): ReactNode {
               onChange={(v) => setFilters((f) => ({ ...f, from: v ?? "" }))}
             />
           </Field>
+        </div>
+        <div className="min-w-40 flex-1">
           <Field id="audit-filter-to" label={t("audit.log.filter.to")}>
             <Input
               kind="date"
@@ -154,7 +184,8 @@ export function AuditLogScreen(): ReactNode {
             }}
             testId="audit-log-apply-filters"
           >
-            {t("audit.log.filter.apply")}
+            <Filter className="h-4 w-4" />
+            <span>{t("audit.log.filter.apply")}</span>
           </Button>
           <Button
             type="button"
@@ -166,7 +197,8 @@ export function AuditLogScreen(): ReactNode {
             }}
             testId="audit-log-reset-filters"
           >
-            {t("audit.log.filter.reset")}
+            <RotateCcw className="h-4 w-4" />
+            <span>{t("audit.log.filter.reset")}</span>
           </Button>
         </div>
       </div>
@@ -176,12 +208,6 @@ export function AuditLogScreen(): ReactNode {
         columns={[
           { field: "when", label: t("audit.log.col.when"), type: "string", sortable: true },
           { field: "type", label: t("audit.log.col.type"), type: "string", sortable: true },
-          {
-            field: "aggregate",
-            label: t("audit.log.col.aggregate"),
-            type: "string",
-            sortable: false,
-          },
           { field: "actor", label: t("audit.log.col.actor"), type: "string", sortable: false },
         ]}
         sort={sort}
@@ -191,8 +217,10 @@ export function AuditLogScreen(): ReactNode {
           values: {
             when: formatWhen(row.createdAt),
             type: row.type,
-            aggregate: `${row.aggregateType} / ${row.aggregateId}`,
-            actor: row.createdBy,
+            actor:
+              row.createdBy === SYSTEM_ACTOR_ID
+                ? t("audit.log.actor.system")
+                : (state.names.get(row.createdBy) ?? ""),
           },
         }))}
         onRowClick={(row) => openDetail(row.id)}

package/src/auth-email-password/feature.ts

@@ -169,6 +169,7 @@ export function createAuthEmailPasswordFeature(
     r.describe(
       "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, tenant invite, and account-unlock — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`, `accountUnlock`) to `createAuthEmailPasswordFeature(opts)`. All five magic-link flows dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify/unlock) or opaque-random in Redis (signup/invite). `accountUnlock` is the self-service escape hatch for `accountLockout`'s monotonic failure-counter (#1266): confirming the mailed token clears the Redis lockout state without touching the user entity. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
     );
+    // kumiko-lint-ignore i18n-ui-strings uiHints labels are feature-registry metadata for the admin feature catalog, not yet wired to the i18n system, see #2312
     r.uiHints({
       displayLabel: "Auth \u00b7 Email + Password",
       category: "identity",

package/src/auth-email-password/web/auth-form-primitives.tsx

@@ -50,6 +50,7 @@ export type AuthCardProps = {
   readonly children: ReactNode;
 };
 
+// kumiko-lint-ignore no-custom-primitives Wraps usePrimitives().Card, pure domain name for the auth-screen chrome, not a primitive reimplementation
 export function AuthCard({ title, subtitle, children }: AuthCardProps): ReactNode {
   const { Card } = usePrimitives();
   const shell = useAuthShell() ?? defaultAuthShell;
@@ -98,6 +99,7 @@ export function parseUrlToken(paramName = "token"): string {
 // (server-injected token) short-circuits both the URL read and the scrub.
 export function useUrlToken(override?: string, paramName = "token"): string {
   const [token] = useState(() => override ?? parseUrlToken(paramName));
+  // kumiko-lint-ignore no-raw-hooks DOM integration: history.replaceState scrubs the token from browser history once, no framework query/mutation equivalent
   useEffect(() => {
     if (override !== undefined) return;
     if (typeof window === "undefined") return;

package/src/auth-email-password/web/auth-gate.tsx

@@ -76,6 +76,7 @@ export function createLoginRoute(
       readonly accountLabel: string;
     } | null>(null);
 
+    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
     useEffect(() => {
       if (status === "authenticated") onAuthenticated?.();
     }, [status]);

package/src/auth-email-password/web/confirm-account-unlock-screen.tsx

@@ -33,6 +33,7 @@ export function ConfirmAccountUnlockScreen({
   const [status, setStatus] = useState<Status>(token === "" ? "missing-token" : "verifying");
   const startedRef = useRef(false);
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     if (status !== "verifying") return;
     if (startedRef.current) return;

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -61,6 +61,7 @@ export function InviteAcceptScreen({
   const acceptLoggedIn = async (): Promise<void> => {
     setSubmitting(true);
     setError(null);
+    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
     const res = await fetch("/api/auth/invite-accept", {
       method: "POST",
       credentials: "same-origin",
@@ -83,6 +84,7 @@ export function InviteAcceptScreen({
   const acceptAnonExisting = async (): Promise<void> => {
     setSubmitting(true);
     setError(null);
+    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
     const res = await fetch("/api/auth/invite-accept-with-login", {
       method: "POST",
       credentials: "same-origin",
@@ -105,6 +107,7 @@ export function InviteAcceptScreen({
   const acceptAnonNew = async (): Promise<void> => {
     setSubmitting(true);
     setError(null);
+    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
     const res = await fetch("/api/auth/invite-signup-complete", {
       method: "POST",
       credentials: "same-origin",

package/src/auth-email-password/web/session.tsx

@@ -128,6 +128,7 @@ export function SessionProvider({ children }: { readonly children: ReactNode }):
     setState(next);
   }, []);
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     void doRefresh();
   }, [doRefresh]);

package/src/auth-email-password/web/verify-email-screen.tsx

@@ -36,6 +36,7 @@ export function VerifyEmailScreen({
   const [status, setStatus] = useState<Status>(token === "" ? "missing-token" : "verifying");
   const startedRef = useRef(false);
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     if (status !== "verifying") return;
     if (startedRef.current) return;