@cosmicdrift/kumiko-bundled-features 0.256.0 → 0.258.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.256.0",
+  "version": "0.258.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -110,7 +110,6 @@
     "./auth-mfa/testing": "./src/auth-mfa/testing.ts",
     "./sessions/testing": "./src/sessions/testing.ts",
     "./personal-access-tokens": "./src/personal-access-tokens/index.ts",
-    "./personal-access-tokens/web": "./src/personal-access-tokens/web/index.ts",
     "./feature-toggles": "./src/feature-toggles/index.ts",
     "./feature-toggles/web": "./src/feature-toggles/web/index.ts",
     "./template-resolver": "./src/template-resolver/index.ts",
@@ -130,12 +129,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.256.0",
-    "@cosmicdrift/kumiko-framework": "0.256.0",
-    "@cosmicdrift/kumiko-headless": "0.256.0",
-    "@cosmicdrift/kumiko-renderer": "0.256.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.256.0",
-    "@cosmicdrift/kumiko-types": "0.256.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.258.0",
+    "@cosmicdrift/kumiko-framework": "0.258.0",
+    "@cosmicdrift/kumiko-headless": "0.258.0",
+    "@cosmicdrift/kumiko-renderer": "0.258.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.258.0",
+    "@cosmicdrift/kumiko-types": "0.258.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +163,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.256.0",
-    "@cosmicdrift/kumiko-locale-es": "0.256.0"
+    "@cosmicdrift/kumiko-locale-de": "0.258.0",
+    "@cosmicdrift/kumiko-locale-es": "0.258.0"
   }
 }

package/src/auth-mfa/__tests__/enable-flow.integration.test.ts

@@ -4,6 +4,7 @@ import {
   createTestUser,
   setupTestStack,
   type TestStack,
+  TestUsers,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
@@ -15,6 +16,7 @@ import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
 import { createTenantFeature } from "../../tenant";
+import { UserHandlers } from "../../user/constants";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { base32Decode } from "../base32";
@@ -56,12 +58,13 @@ afterAll(async () => {
 });
 
 describe("enable-start + enable-confirm round trip", () => {
-  test("start returns a setup token + otpauth URI + 8 recovery codes", async () => {
+  test("start returns a setup token + otpauth URI + totp secret + 8 recovery codes", async () => {
     const user = createTestUser({ id: "enable-start-1", roles: ["User"] });
 
     const res = await stack.http.writeOk<{
       setupToken: string;
       otpauthUri: string;
+      totpSecret: string;
       recoveryCodes: string[];
     }>(AuthMfaHandlers.enableStart, { accountLabel: "jane@example.com" }, user);
 
@@ -73,6 +76,30 @@ describe("enable-start + enable-confirm round trip", () => {
     for (const code of res.recoveryCodes) {
       expect(code).toMatch(/^[A-Z2-9]{4}-[A-Z2-9]{4}$/);
     }
+    // The manual-entry secret is the same one embedded in the otpauth URI —
+    // it's a convenience duplicate for the reveal screen, not new exposure.
+    const secretParam = new URLSearchParams(res.otpauthUri.split("?")[1]).get("secret") ?? "";
+    expect(res.totpSecret).toBe(secretParam);
+  });
+
+  test("accountLabel is optional — omitted, the caller's own email is derived server-side", async () => {
+    const created = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      {
+        email: "derived-label@example.com",
+        displayName: "Derived Label",
+        passwordHash: "seeded-hash",
+      },
+      TestUsers.systemAdmin,
+    );
+    const user = createTestUser({ id: created.id, roles: ["User"] });
+
+    const res = await stack.http.writeOk<{ otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      {},
+      user,
+    );
+    expect(res.otpauthUri).toContain(encodeURIComponent("derived-label@example.com"));
   });
 
   test("confirm with the right code enables MFA", async () => {
@@ -150,11 +177,16 @@ describe("enable-start + enable-confirm round trip", () => {
     expectErrorIncludes(err, "invalid_setup_token");
   });
 
-  test("status query reflects enrollment before and after enable-confirm", async () => {
+  test("status query reflects enrollment before and after enable-confirm, and never carries the secret or codes", async () => {
     const user = createTestUser({ id: "status-query-1", roles: ["User"] });
 
-    const before = await stack.http.queryOk<{ enabled: boolean }>(AuthMfaQueries.status, {}, user);
-    expect(before.enabled).toBe(false);
+    const before = await stack.http.queryOk<Record<string, unknown>>(
+      AuthMfaQueries.status,
+      {},
+      user,
+    );
+    expect(before["enabled"]).toBe(false);
+    expect(Object.keys(before)).toEqual(["enabled"]);
 
     const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
       AuthMfaHandlers.enableStart,
@@ -169,8 +201,48 @@ describe("enable-start + enable-confirm round trip", () => {
       user,
     );
 
-    const after = await stack.http.queryOk<{ enabled: boolean }>(AuthMfaQueries.status, {}, user);
-    expect(after.enabled).toBe(true);
+    const after = await stack.http.queryOk<Record<string, unknown>>(
+      AuthMfaQueries.status,
+      {},
+      user,
+    );
+    expect(after["enabled"]).toBe(true);
+    // The only read surface for user-mfa (AuthMfaQueries has no other entry) —
+    // once enrolled it must never re-serve the plaintext recovery codes or the
+    // TOTP secret shown once at enable-start.
+    expect(Object.keys(after)).toEqual(["enabled"]);
+    expect(after["totpSecret"]).toBeUndefined();
+    expect(after["recoveryCodes"]).toBeUndefined();
+  });
+});
+
+describe("aborting between enable-start and enable-confirm leaves a clean state", () => {
+  test("MFA stays off and no user-mfa row exists until a confirm succeeds; a fresh start reissues codes", async () => {
+    const user = createTestUser({ id: "abort-mid-flow-1", roles: ["User"] });
+
+    const first = await stack.http.writeOk<{ setupToken: string; recoveryCodes: string[] }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "abort@example.com" },
+      user,
+    );
+
+    // enable-start alone never persists anything — status still reads "off".
+    const statusAfterAbort = await stack.http.queryOk<{ enabled: boolean }>(
+      AuthMfaQueries.status,
+      {},
+      user,
+    );
+    expect(statusAfterAbort.enabled).toBe(false);
+
+    // The user can restart the flow and gets an independent token + codes —
+    // no leftover state from the abandoned attempt blocks or reuses anything.
+    const second = await stack.http.writeOk<{ setupToken: string; recoveryCodes: string[] }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "abort@example.com" },
+      user,
+    );
+    expect(second.setupToken).not.toBe(first.setupToken);
+    expect(second.recoveryCodes).not.toEqual(first.recoveryCodes);
   });
 });
 

package/src/auth-mfa/__tests__/screen.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, test } from "bun:test";
+import { fieldLabelKey } from "@cosmicdrift/kumiko-headless";
+import { AuthMfaHandlers, MFA_ENABLE_SCREEN_ID } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { AUTH_MFA_FEATURE_I18N } from "../i18n";
+import { mfaEnableScreen } from "../screens";
+
+const feature = createAuthMfaFeature({
+  setupTokenSecret: "test-setup-token-secret-do-not-use-in-prod",
+  issuer: "Kumiko Test",
+  challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+});
+
+describe("auth-mfa enable screen — declarative secretMint (fw#2838)", () => {
+  test("is registered as a secretMint, not a custom screen", () => {
+    const screen = feature.screens[MFA_ENABLE_SCREEN_ID];
+    expect(screen?.type).toBe("secretMint");
+    if (screen?.type !== "secretMint") throw new Error("expected a secretMint screen");
+    expect(screen.handler).toBe(AuthMfaHandlers.enableStart);
+  });
+
+  test("reveal.fields is exactly otpauthUri, totpSecret, recoveryCodes — never setupToken", () => {
+    const fields = mfaEnableScreen.reveal.fields.map((f) => f.field);
+    expect(fields).toEqual(["otpauthUri", "totpSecret", "recoveryCodes"]);
+    expect(fields).not.toContain("setupToken");
+  });
+
+  test("otpauthUri renders as a QR code and is not copyable; secret and codes are copyable", () => {
+    const byField = Object.fromEntries(mfaEnableScreen.reveal.fields.map((f) => [f.field, f]));
+    expect(byField["otpauthUri"]).toMatchObject({ display: "qr", copyable: false });
+    expect(byField["totpSecret"]).toMatchObject({ display: "code", copyable: true });
+    expect(byField["recoveryCodes"]).toMatchObject({ display: "list", copyable: true });
+  });
+
+  test("confirm carries exactly setupToken from the mint payload into the code-confirm step", () => {
+    const confirm = mfaEnableScreen.confirm;
+    expect(confirm?.handler).toBe(AuthMfaHandlers.enableConfirm);
+    expect(confirm?.carry).toEqual(["setupToken"]);
+    expect(Object.keys(confirm?.fields ?? {})).toEqual(["code"]);
+  });
+
+  test("every i18n key the screen references is declared in AUTH_MFA_FEATURE_I18N", () => {
+    const referenced = [
+      mfaEnableScreen.submitLabel,
+      mfaEnableScreen.reveal.title,
+      mfaEnableScreen.reveal.warning,
+      ...mfaEnableScreen.reveal.fields.map((f) => f.label),
+      mfaEnableScreen.confirm?.submitLabel,
+      mfaEnableScreen.confirm?.doneMessage,
+      fieldLabelKey("auth-mfa", "__action-form__", "code"),
+    ].filter((key): key is string => typeof key === "string");
+
+    expect(referenced.length).toBeGreaterThan(0);
+    for (const key of referenced) {
+      expect(AUTH_MFA_FEATURE_I18N[key]).toBeDefined();
+    }
+  });
+});

package/src/auth-mfa/feature.ts

@@ -1,6 +1,5 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { mfaRequiredConfigKey } from "./config";
-import { MFA_ENABLE_SCREEN_ID } from "./constants";
 import { createDisableHandler } from "./handlers/disable.write";
 import { createEnableConfirmHandler } from "./handlers/enable-confirm.write";
 import { createEnableConfirmPreauthHandler } from "./handlers/enable-confirm-preauth.write";
@@ -14,6 +13,7 @@ import { AUTH_MFA_FEATURE_I18N } from "./i18n";
 import { createMfaCodeVerifier, type MfaCodeVerifier } from "./mfa-code-verifier";
 import { createMfaStatusChecker, type MfaStatusChecker } from "./mfa-status-checker";
 import { userMfaEntity } from "./schema/user-mfa";
+import { mfaEnableScreen } from "./screens";
 
 export type AuthMfaFeatureOptions = {
   // HMAC secret for the stateless enable-flow token (carries the generated
@@ -125,21 +125,11 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
     r.requires("tenant");
     r.config("required", mfaRequiredConfigKey());
 
-    // Dormant custom-screen — the client maps MFA_ENABLE_SCREEN_ID to
-    // MfaEnableScreen (see personal-access-tokens/feature.ts for the same
-    // convention). App places it via r.nav in its logged-in settings area.
-    // dormant: true skips createKumikoApp's missing-client-plugin boot
-    // diagnostic (#2025) for apps that don't nav this screen (#2034).
-    // kumiko-lint-ignore app-feature-structure Multi-step auth flow (enable + recovery-codes reveal), no declarative screen type covers this
-    r.screen({
-      id: MFA_ENABLE_SCREEN_ID,
-      type: "custom",
-      renderer: { react: { __component: "MfaEnableScreen" } },
-      access: { openToAll: true },
-      dormant: true,
-      description:
-        "Self-service screen where a signed-in user enrolls in TOTP two-factor authentication: it shows the QR code and manual secret, reveals the recovery codes once, and confirms enrollment with a code from their authenticator app.",
-    });
+    // Declarative secretMint screen — mint (no input) -> reveal QR/secret/
+    // recovery-codes -> confirm with a code. App places it via r.nav in its
+    // logged-in settings area (see personal-access-tokens/feature.ts for the
+    // same convention).
+    r.screen(mfaEnableScreen);
     r.translations({ keys: AUTH_MFA_FEATURE_I18N });
 
     // KEK-rotation for totpSecret (entity-field encryption). Manual

package/src/auth-mfa/handlers/enable-start.write.ts

@@ -1,5 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { UserQueries } from "../../user";
 import { base32Encode } from "../base32";
 import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants";
 import { findUserMfaRow } from "../db/queries";
@@ -23,22 +24,31 @@ export function createEnableStartHandler(opts: EnableStartOptions) {
   return defineWriteHandler({
     name: "enable-start",
     schema: z.object({
-      // Client-supplied label for the otpauth:// URI / authenticator-app
-      // entry (typically the user's own email) — avoids an extra DB lookup
-      // for something the already-authenticated client already knows about
-      // itself.
-      accountLabel: z.string().min(1).max(200),
+      // Optional client-supplied label for the otpauth:// URI / authenticator-
+      // app entry. Omitted by the declarative secretMint screen (mint has no
+      // input fields) — derived server-side from the caller's own email below.
+      accountLabel: z.string().min(1).max(200).optional(),
     }),
     access: { openToAll: true },
     description:
-      "Begins TOTP enrollment for the signed-in user by generating a secret plus recovery codes and returning them as a short-lived setup token, an otpauth:// URI and the one-time plaintext recovery codes; nothing is persisted until enable-confirm.",
-    // The result is the TOTP secret, the otpauth:// URI and the plaintext
+      "Begins TOTP enrollment for the signed-in user by generating a secret plus recovery codes and returning them as a short-lived setup token, an otpauth:// URI, the base32 secret for manual entry and the one-time plaintext recovery codes; nothing is persisted until enable-confirm. accountLabel defaults to the caller's own email.",
+    // The result carries the TOTP secret, the otpauth:// URI and the plaintext
     // recovery codes — an agent turn would put all three in the LLM transcript.
     agent: { expose: false },
     handler: async (event, ctx) => {
       const existing = await findUserMfaRow(ctx.db, event.user);
       if (existing) return mfaAlreadyEnabled();
 
+      let accountLabel = event.payload.accountLabel;
+      if (!accountLabel) {
+        // The declarative secretMint screen has no client component left to
+        // read the session email off — derive the otpauth label server-side.
+        const me = (await ctx.queryAs(event.user, UserQueries.me, {})) as {
+          email?: string;
+        } | null; // @cast-boundary engine-payload
+        accountLabel = me?.email ?? event.user.id;
+      }
+
       const secret = generateTotpSecret();
       const recoveryCodes = generateRecoveryCodes();
       const recoveryCodeHashes = await hashRecoveryCodes(recoveryCodes);
@@ -57,11 +67,10 @@ export function createEnableStartHandler(opts: EnableStartOptions) {
         isSuccess: true,
         data: {
           setupToken,
-          otpauthUri: buildOtpauthUri({
-            issuer: opts.issuer,
-            accountLabel: event.payload.accountLabel,
-            secret,
-          }),
+          otpauthUri: buildOtpauthUri({ issuer: opts.issuer, accountLabel, secret }),
+          // The otpauth URI already carries this secret in its query string —
+          // surfaced separately for the reveal screen's manual-entry display.
+          totpSecret: base32Encode(secret),
           // Plaintext — this is the one and only time these are shown.
           recoveryCodes,
         },

package/src/auth-mfa/i18n.ts

@@ -8,4 +8,23 @@ export const AUTH_MFA_FEATURE_I18N: Readonly<Record<string, LocalizedString>> =
   "screen:auth-mfa-enable.title": {
     en: "Two-factor authentication",
   },
+
+  "mfa.enable.start": { en: "Start setup" },
+
+  "mfa.enable.reveal.title": { en: "Set up your authenticator app" },
+  "mfa.enable.reveal.warning": {
+    en: "Save your recovery codes now — for security everything on this screen is shown only this once.",
+  },
+  "mfa.enable.reveal.qr": { en: "Scan this QR code" },
+  "mfa.enable.reveal.secret": { en: "Or enter this code manually" },
+  "mfa.enable.reveal.recoveryCodes": { en: "Recovery codes" },
+
+  "mfa.enable.confirm.submit": { en: "Enable" },
+  "mfa.enable.confirm.done": { en: "Two-factor authentication is now enabled." },
+
+  // Field label for the confirm step's pseudo-entity (`__action-form__`, see
+  // action-form-shim.ts) — required by the i18n boot-validator
+  // (requiredKeysFromScreen); the declarative renderer resolves this through
+  // the schema payload, not a client component's t().
+  "auth-mfa:entity:__action-form__:field:code": { en: "Code from your authenticator app" },
 };

package/src/auth-mfa/screens.ts

@@ -0,0 +1,52 @@
+import { i18nKey, type SecretMintScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { AuthMfaHandlers, MFA_ENABLE_SCREEN_ID } from "./constants";
+
+// Declarative TOTP-enrollment screen: mint (no input) -> reveal QR/secret/
+// recovery-codes -> confirm with a 6-digit code. `setupToken` is carried
+// from the mint payload into the confirm payload but never listed in
+// `reveal.fields` — it is threaded through, not shown.
+export const mfaEnableScreen: SecretMintScreenDefinition = {
+  id: MFA_ENABLE_SCREEN_ID,
+  type: "secretMint",
+  handler: AuthMfaHandlers.enableStart,
+  fields: {},
+  layout: { sections: [] },
+  submitLabel: i18nKey("mfa.enable.start"),
+  access: { openToAll: true },
+  description:
+    "Self-service screen where a signed-in user enrolls in TOTP two-factor authentication: it shows the QR code and manual secret, reveals the recovery codes once, and confirms enrollment with a code from their authenticator app.",
+  reveal: {
+    title: i18nKey("mfa.enable.reveal.title"),
+    warning: i18nKey("mfa.enable.reveal.warning"),
+    fields: [
+      {
+        field: "otpauthUri",
+        label: i18nKey("mfa.enable.reveal.qr"),
+        display: "qr",
+        copyable: false,
+      },
+      {
+        field: "totpSecret",
+        label: i18nKey("mfa.enable.reveal.secret"),
+        display: "code",
+        copyable: true,
+      },
+      {
+        field: "recoveryCodes",
+        label: i18nKey("mfa.enable.reveal.recoveryCodes"),
+        display: "list",
+        copyable: true,
+      },
+    ],
+  },
+  confirm: {
+    handler: AuthMfaHandlers.enableConfirm,
+    fields: {
+      code: { type: "text", required: true, maxLength: 6 },
+    },
+    layout: { sections: [{ fields: ["code"] }] },
+    carry: ["setupToken"],
+    submitLabel: i18nKey("mfa.enable.confirm.submit"),
+    doneMessage: i18nKey("mfa.enable.confirm.done"),
+  },
+};

package/src/auth-mfa/web/client-plugin.ts

@@ -4,14 +4,13 @@
 // createKumikoApp({ clientFeatures: [emailPasswordClient(), authMfaClient()] }).
 // No gates: MfaVerifyScreen isn't a route gate, it's a state swap wired
 // via EmailPasswordClientOptions.mfaVerifyScreen. This factory merges the
-// default de/en translations and maps MFA_ENABLE_SCREEN_ID to
-// MfaEnableScreen (same "components" convention as personal-access-tokens).
+// default de/en translations for the Verify/Disable/Regenerate components —
+// the enroll screen is a declarative secretMint (feature.ts's r.screen),
+// no client component of its own.
 
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
-import { MFA_ENABLE_SCREEN_ID } from "../constants";
 import { defaultTranslations, mergeTranslations } from "./i18n";
-import { MfaEnableScreen } from "./mfa-enable-screen";
 
 export type AuthMfaClientOptions = {
   /** Key-Overrides pro Locale, gemerged mit den Default-Bundles (de/en). */
@@ -32,6 +31,6 @@ export function authMfaClient(options: AuthMfaClientOptions = {}): AuthMfaClient
     providers: [],
     gates: [],
     translations: mergeTranslations(defaultTranslations, options.translations ?? {}),
-    components: { [MFA_ENABLE_SCREEN_ID]: MfaEnableScreen },
+    components: {},
   };
 }

package/src/auth-mfa/web/i18n.ts

@@ -27,10 +27,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.mfa.errors.invalidSetupToken": "Setup expired. Please start again.",
     "auth.mfa.errors.setupFailed": "Setup failed. Please try again.",
     "auth.mfa.errors.invalidRecoveryCode": "Invalid recovery code.",
-    "auth.mfa.enable.title": "Two-factor authentication",
-    "auth.mfa.enable.intro":
-      "Add an extra layer of protection with an authenticator app (e.g. Google Authenticator, 1Password).",
-    "auth.mfa.enable.start": "Start setup",
     "auth.mfa.enable.scanTitle": "Scan the QR code",
     "auth.mfa.enable.manualEntry": "Or enter manually:",
     "auth.mfa.enable.recoveryTitle": "Recovery codes",
@@ -38,9 +34,6 @@ export const defaultTranslations: TranslationsByLocale = {
       "Save these codes somewhere safe. They're shown only this once and let you back in if you lose your device.",
     "auth.mfa.enable.acknowledge": "I've saved my recovery codes.",
     "auth.mfa.enable.code": "Code from your authenticator app",
-    "auth.mfa.enable.cancel": "Cancel",
-    "auth.mfa.enable.confirm": "Enable",
-    "auth.mfa.enable.success": "Two-factor authentication is now enabled.",
     "auth.mfa.setup.title": "Two-factor authentication required",
     "auth.mfa.setup.subtitle":
       "Your account requires two-factor authentication. Set it up now to sign in.",

package/src/auth-mfa/web/index.ts

@@ -15,8 +15,6 @@ export type {
 export { confirmMfaSetupPreauth, startMfaSetupPreauth, verifyMfaChallenge } from "./mfa-client";
 export type { MfaDisableDialogProps } from "./mfa-disable-dialog";
 export { MfaDisableDialog } from "./mfa-disable-dialog";
-export type { MfaEnableScreenProps } from "./mfa-enable-screen";
-export { MfaEnableScreen } from "./mfa-enable-screen";
 export type { MfaRecoveryCodesRevealProps } from "./mfa-recovery-codes-reveal";
 export { MfaRecoveryCodesReveal } from "./mfa-recovery-codes-reveal";
 export type { MfaRegenerateRecoveryDialogProps } from "./mfa-regenerate-recovery-dialog";

package/src/auth-mfa/web/mfa-disable-dialog.tsx

@@ -1,7 +1,7 @@
 // @runtime client
 // MfaDisableDialog — confirm-with-code before turning MFA off. Uses the
-// generic Dialog primitive (unlike MfaEnableScreen/MfaRegenerateRecovery-
-// Dialog): disable is single-step, no state to preserve after confirm, so
+// generic Dialog primitive (unlike MfaRegenerateRecoveryDialog): disable is
+// single-step, no state to preserve after confirm, so
 // it doesn't hit the "Dialog always closes after onConfirm" problem that
 // ruled Dialog out for the multi-step enable/regenerate flows. Error
 // reporting still has to go through the parent (onError) rather than an

package/src/auth-mfa/web/mfa-recovery-codes-reveal.tsx

@@ -1,9 +1,9 @@
 // @runtime client
 // MfaRecoveryCodesReveal — one-time display of a fresh recovery-code set,
-// with an acknowledge-then-dismiss gate (same UX as the codes block in
-// MfaEnableScreen). Standalone so MfaRegenerateRecoveryDialog's caller can
-// render it after the dialog closes — the codes only exist in memory for
-// this one render, never persisted anywhere the app could show them again.
+// with an acknowledge-then-dismiss gate. Standalone so MfaRegenerateRecovery-
+// Dialog's caller can render it after the dialog closes — the codes only
+// exist in memory for this one render, never persisted anywhere the app
+// could show them again.
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";

package/src/auth-mfa/web/mfa-setup-preauth-screen.tsx

@@ -1,9 +1,9 @@
 // @runtime client
-// Pre-auth twin of MfaEnableScreen: a user blocked at login by MFA
-// enforcement and not yet enrolled lands here straight out of the login
-// flow — there is no session yet. Identity comes entirely from the
-// preauthSetupToken login()'s mfa-setup-required result carries (see
-// auth-client.ts's LoginResult). Calls startMfaSetupPreauth/confirmMfa-
+// Pre-auth twin of the declarative auth-mfa-enable secretMint screen: a user
+// blocked at login by MFA enforcement and not yet enrolled lands here
+// straight out of the login flow — there is no session yet. Identity comes
+// entirely from the preauthSetupToken login()'s mfa-setup-required result
+// carries (see auth-client.ts's LoginResult). Calls startMfaSetupPreauth/confirmMfa-
 // SetupPreauth directly via fetch (mfa-client.ts) — no useSession(), no
 // useDispatcher(), both assume a real session that doesn't exist here.
 //

package/src/auth-mfa/web/qrcode-browser.d.ts

@@ -1,6 +1,6 @@
 // @types/qrcode only declares the main "qrcode" entry, not the browser-only
-// subpath (see mfa-enable-screen.tsx's import — the main entry pulls in
-// Node-only deps like yargs/pngjs via qrcode's own package.json#browser
+// subpath (see mfa-setup-preauth-screen.tsx's import — the main entry pulls
+// in Node-only deps like yargs/pngjs via qrcode's own package.json#browser
 // remap, which Metro doesn't honor). Same runtime shape, just re-typed.
 // `export *` never re-exports a default — `import QRCode from "..."`
 // resolving here relies on the consuming app's esModuleInterop/