@cosmicdrift/kumiko-bundled-features 0.321.0 → 0.323.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.321.0",
+  "version": "0.323.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -134,12 +134,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.321.0",
-    "@cosmicdrift/kumiko-framework": "0.321.0",
-    "@cosmicdrift/kumiko-headless": "0.321.0",
-    "@cosmicdrift/kumiko-renderer": "0.321.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.321.0",
-    "@cosmicdrift/kumiko-types": "0.321.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.323.0",
+    "@cosmicdrift/kumiko-framework": "0.323.0",
+    "@cosmicdrift/kumiko-headless": "0.323.0",
+    "@cosmicdrift/kumiko-renderer": "0.323.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.323.0",
+    "@cosmicdrift/kumiko-types": "0.323.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -168,8 +168,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.321.0",
-    "@cosmicdrift/kumiko-locale-es": "0.321.0",
+    "@cosmicdrift/kumiko-locale-de": "0.323.0",
+    "@cosmicdrift/kumiko-locale-es": "0.323.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/agent-tools/__tests__/kms-erase-gate.integration.test.ts

@@ -0,0 +1,127 @@
+// kms.eraseKey reached through configuredPiiSubjectKms() passes the same
+// agent-risk floor executor.forget()/delete() already enforce.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  configuredPiiSubjectKms,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  type SubjectId,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { setupTestStack, type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
+import * as z from "zod";
+import { buildAgentManifest } from "../agent-manifest";
+import { buildToolCatalog, toolNameForQn } from "../tool-catalog";
+import { dispatchToolCall } from "../tool-dispatch";
+
+const admin = TestUsers.admin;
+
+const SUBJECT: SubjectId = {
+  kind: "record",
+  entity: "kms-erase-gate-widget",
+  id: "aaaaaaaa-aaaa-4aaa-8aaa-000000000001",
+};
+
+const ERASE_MID_QN = "kms-erase-gate-test:write:erase-mid";
+const ERASE_HIGH_QN = "kms-erase-gate-test:write:erase-high";
+
+const kmsGateFeature = defineFeature("kms-erase-gate-test", (r) => {
+  r.writeHandler(
+    "erase-mid",
+    z.object({}),
+    async () => {
+      await configuredPiiSubjectKms()!.eraseKey(SUBJECT, {
+        requestId: "kms-erase-gate-test:erase-mid",
+        eraseReason: "test",
+      });
+      return { isSuccess: true as const, data: {} };
+    },
+    {
+      access: { roles: ["Admin"] },
+      description: "Erase the widget subject key (mid risk, default).",
+    },
+  );
+
+  r.writeHandler(
+    "erase-high",
+    z.object({}),
+    async () => {
+      await configuredPiiSubjectKms()!.eraseKey(SUBJECT, {
+        requestId: "kms-erase-gate-test:erase-high",
+        eraseReason: "test",
+      });
+      return { isSuccess: true as const, data: {} };
+    },
+    {
+      access: { roles: ["Admin"] },
+      description: "Erase the widget subject key (high risk).",
+      agent: { risk: "high" },
+    },
+  );
+});
+
+let stack: TestStack;
+let kms: InMemoryKmsAdapter;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [kmsGateFeature] });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  kms = new InMemoryKmsAdapter();
+  await kms.createKey(SUBJECT);
+  configurePiiSubjectKms(kms);
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+function catalogFor(roles: readonly string[]) {
+  const manifest = buildAgentManifest(stack.registry, { locale: "en", roles });
+  return buildToolCatalog(stack.registry, manifest, { mode: "edit" });
+}
+
+describe("kms.eraseKey via configuredPiiSubjectKms() — agent-risk gate", () => {
+  test("a mid-risk (default) tool is denied, the key stays readable", async () => {
+    const catalog = catalogFor(admin.roles);
+    const result = await dispatchToolCall({
+      dispatcher: stack.dispatcher,
+      user: admin,
+      toolName: toolNameForQn(ERASE_MID_QN),
+      input: {},
+      dispatchTable: catalog.dispatchTable,
+      runId: "run-mid",
+      toolCallId: "call-mid",
+    });
+
+    expect(result.ok).toBe(false);
+    if (result.ok) throw new Error("unreachable");
+    expect(result.error).toContain(ERASE_MID_QN);
+    expect(result.error).toContain("irreversible");
+    expect(result.error).toContain("kms.eraseKey");
+    await expect(kms.getKey(SUBJECT)).resolves.toBeTruthy();
+  });
+
+  test("a risk:high tool succeeds and the key is erased", async () => {
+    const catalog = catalogFor(admin.roles);
+    const result = await dispatchToolCall({
+      dispatcher: stack.dispatcher,
+      user: admin,
+      toolName: toolNameForQn(ERASE_HIGH_QN),
+      input: {},
+      dispatchTable: catalog.dispatchTable,
+      runId: "run-high",
+      toolCallId: "call-high",
+    });
+
+    expect(result.ok).toBe(true);
+    await expect(kms.getKey(SUBJECT)).rejects.toThrow("Subject key erased");
+  });
+});

package/src/agent-tools/__tests__/tool-catalog.test.ts

@@ -8,7 +8,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { buildAgentManifest } from "../agent-manifest";
-import { buildToolCatalog, toolNameForQn } from "../tool-catalog";
+import { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "../tool-catalog";
 import type { AgentManifest, AgentToolMode, RegistrySearchView } from "../types";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -440,6 +440,21 @@ describe("buildToolCatalog — built-in client tool names vs. a colliding handle
   });
 });
 
+describe("buildToolCatalog — tools/dispatchTable bijection", () => {
+  test("every tool name has exactly one dispatchTable entry, and vice versa, with no duplicates", () => {
+    const catalog = buildCatalog(ADMIN);
+    const names = catalog.tools.map((t) => t.name);
+    expect(names.length).toBeGreaterThan(0);
+    expect(new Set(names).size).toBe(names.length);
+    // open_form is the one deliberate exception: dispatch-only, claimed via
+    // claimDispatchName so the approval layer can trigger it, but never
+    // listed for the model to call directly (see addClientTools).
+    const dispatchNamesForModel = new Set(catalog.dispatchTable.keys());
+    dispatchNamesForModel.delete(OPEN_FORM_TOOL_NAME);
+    expect(dispatchNamesForModel).toEqual(new Set(names));
+  });
+});
+
 describe("toolNameForQn", () => {
   test("drops the verb segment, joins with underscores, sanitizes non-identifier characters", () => {
     expect(toolNameForQn("agent-tools-test-vendor:write:vendor:approve")).toBe(

package/src/agent-tools/__tests__/tool-dispatch.integration.test.ts

@@ -8,15 +8,21 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createEntity,
+  createEntityExecutor,
+  createTextField,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import * as z from "zod";
 import { buildAgentManifest } from "../agent-manifest";
-import { buildToolCatalog } from "../tool-catalog";
+import { buildToolCatalog, toolNameForQn } from "../tool-catalog";
 import { dispatchToolCall } from "../tool-dispatch";
 
 const vendorEntity = createEntity({
@@ -47,11 +53,92 @@ const vendorFeature = defineFeature("agent-tools-test-vendor", (r) => {
 
 const VENDOR_CREATE_QN = "agent-tools-test-vendor:write:vendor:create";
 
+// No softDelete — forget-gizmo-high performs a hard, irreversible purge and
+// therefore must resolve agent.risk "high" to pass the executor gate.
+const gizmoEntity = createEntity({
+  table: "agent_tools_test_gizmos",
+  fields: {
+    label: createTextField({ personal: false, reason: "test_fixture", required: true }),
+  },
+});
+const { executor: gizmoExecutor } = createEntityExecutor("gizmo", gizmoEntity);
+
+const GIZMO_CREATE_QN = "agent-tools-test-gizmo:write:gizmo:create";
+const GIZMO_FORGET_HIGH_QN = "agent-tools-test-gizmo:write:forget-gizmo-high";
+const GIZMO_DELEGATE_FORGET_MID_QN = "agent-tools-test-gizmo:write:delegate-forget-gizmo-mid";
+
+const gizmoFeature = defineFeature("agent-tools-test-gizmo", (r) => {
+  r.entity("gizmo", gizmoEntity);
+
+  r.writeHandler(
+    "gizmo:create",
+    z.object({ label: z.string() }),
+    async (event, ctx) => gizmoExecutor.create(event.payload, event.user, ctx.db),
+    { access: { roles: ["Admin"] } },
+  );
+
+  r.writeHandler(
+    "forget-gizmo-high",
+    z.object({ id: z.uuid() }),
+    async (event, ctx) => gizmoExecutor.forget({ id: event.payload.id }, event.user, ctx.db),
+    {
+      access: { roles: ["Admin"] },
+      description: "Permanently forget a gizmo (GDPR erasure).",
+      agent: { risk: "high" },
+    },
+  );
+
+  r.writeHandler(
+    "delegate-forget-gizmo-mid",
+    z.object({ id: z.uuid() }),
+    async (event, ctx) =>
+      ctx.write("agent-tools-test-gizmo:write:forget-gizmo-high", { id: event.payload.id }),
+    {
+      access: { roles: ["Admin"] },
+      description: "Delegates to forget-gizmo-high via ctx.write.",
+    },
+  );
+
+  // Simulates the enterprise "approve" write handler: an outer, mid-risk
+  // handler that itself runs the real dispatchToolCall path against a
+  // tool name given as input, the way an AI-agent turn approves a queued
+  // tool call.
+  r.writeHandler(
+    "approve",
+    z.object({ toolName: z.string(), id: z.string() }),
+    async (event) => {
+      const manifest = buildAgentManifest(stack.registry, {
+        locale: "en",
+        roles: event.user.roles,
+      });
+      const catalog = buildToolCatalog(stack.registry, manifest, { mode: "edit" });
+      // runId/toolCallId feed the write's idempotency key — must be unique
+      // per call, or a second approve() reuses the first call's cached
+      // WriteResult instead of actually re-dispatching the tool.
+      const result = await dispatchToolCall({
+        dispatcher: stack.dispatcher,
+        user: event.user,
+        toolName: event.payload.toolName,
+        input: { id: event.payload.id },
+        dispatchTable: catalog.dispatchTable,
+        runId: `run-approve:${event.payload.toolName}`,
+        toolCallId: `call-approve:${event.payload.id}`,
+      });
+      return {
+        isSuccess: true as const,
+        data: result.ok ? { ok: true } : { ok: false, error: result.error },
+      };
+    },
+    { access: { roles: ["Admin"] } },
+  );
+});
+
 let stack: TestStack;
 
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [vendorFeature] });
+  stack = await setupTestStack({ features: [vendorFeature, gizmoFeature] });
   await unsafeCreateEntityTable(stack.db, vendorEntity);
+  await unsafeCreateEntityTable(stack.db, gizmoEntity, "gizmo");
 }, 20000);
 
 afterAll(async () => {
@@ -61,6 +148,7 @@ afterAll(async () => {
 beforeEach(async () => {
   await asRawClient(stack.db).unsafe("DELETE FROM kumiko_events");
   await asRawClient(stack.db).unsafe("DELETE FROM agent_tools_test_vendors");
+  await asRawClient(stack.db).unsafe("DELETE FROM agent_tools_test_gizmos");
 });
 
 const TENANT_B = "00000000-0000-4000-8000-0000000000bb";
@@ -119,3 +207,42 @@ describe("dispatchToolCall — real <entity>:list pipeline", () => {
     expect(result.error).toContain("access denied");
   });
 });
+
+describe("dispatchToolCall — the invoked tool is the entry handler, not the surrounding write handler", () => {
+  async function createGizmo(label: string): Promise<string> {
+    const { id } = await stack.http.writeOk<{ id: string }>(GIZMO_CREATE_QN, { label }, adminA);
+    return id;
+  }
+
+  async function gizmoRowExists(id: string): Promise<boolean> {
+    const rows = (await asRawClient(stack.db).unsafe(
+      "SELECT id FROM agent_tools_test_gizmos WHERE id = $1",
+      [id],
+    )) as readonly Record<string, unknown>[];
+    return rows.length > 0;
+  }
+
+  test("approve (mid) invoking a high-risk forget tool succeeds — the tool is the entry, not approve", async () => {
+    const id = await createGizmo("gone-after-tool-forget");
+    const { ok } = await stack.http.writeOk<{ ok: boolean }>(
+      "agent-tools-test-gizmo:write:approve",
+      { toolName: toolNameForQn(GIZMO_FORGET_HIGH_QN), id },
+      adminA,
+    );
+    expect(ok).toBe(true);
+    expect(await gizmoRowExists(id)).toBe(false);
+  });
+
+  test("approve (mid) invoking a mid-risk tool that delegates via ctx.write to the high forget handler is denied", async () => {
+    const id = await createGizmo("survives-delegated-forget");
+    const { ok, error } = await stack.http.writeOk<{ ok: boolean; error?: string }>(
+      "agent-tools-test-gizmo:write:approve",
+      { toolName: toolNameForQn(GIZMO_DELEGATE_FORGET_MID_QN), id },
+      adminA,
+    );
+    expect(ok).toBe(false);
+    expect(error).toContain(GIZMO_DELEGATE_FORGET_MID_QN);
+    expect(error).toContain("irreversible");
+    expect(await gizmoRowExists(id)).toBe(true);
+  });
+});

package/src/agent-tools/agent-manifest.ts

@@ -6,6 +6,7 @@ import type {
   NavDefinition,
   QueryHandlerDef,
   ScreenDefinition,
+  TranslationEntry,
   TranslationKeys,
   WorkspaceDefinition,
   WriteHandlerDef,
@@ -15,6 +16,7 @@ import {
   isAgentVisibleScreen,
   resolveAgentExposure,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
 import * as z from "zod";
 import type {
   AgentManifest,
@@ -29,6 +31,14 @@ import type {
   RegistryManifestView,
 } from "./types";
 
+/** The manifest surfaces one string per locale — a plural entry reads as its
+ *  CLDR `other` form since the manifest has no `count` to select a category. */
+function entryAsLabels(entry: TranslationEntry): Readonly<Record<string, string>> {
+  return Object.fromEntries(
+    Object.entries(entry).map(([locale, value]) => [locale, translationValueOtherText(value)]),
+  );
+}
+
 /** Translation keys carry a feature prefix the manifest can't reconstruct
  *  (`showcase:entity:item:field:title`), so match on the suffix instead. */
 function labelsForSuffix(
@@ -36,7 +46,7 @@ function labelsForSuffix(
   suffix: string,
 ): Readonly<Record<string, string>> {
   for (const [key, labels] of Object.entries(translations)) {
-    if (key === suffix || key.endsWith(suffix)) return labels;
+    if (key === suffix || key.endsWith(suffix)) return entryAsLabels(labels);
   }
   return {};
 }
@@ -226,7 +236,7 @@ function buildNavs(
 
     result.push({
       id: nav.id,
-      labels: translations[nav.label] ?? {},
+      labels: entryAsLabels(translations[nav.label] ?? {}),
       ...(nav.screen !== undefined && { screen: nav.screen }),
       ...(nav.parent !== undefined && { parent: nav.parent }),
       workspaces: visibleWorkspaces,
@@ -304,7 +314,7 @@ function buildWorkspaces(
     if (!uiVisible(workspace.access, roles)) continue;
     result.push({
       id: workspace.id,
-      labels: translations[workspace.label] ?? {},
+      labels: entryAsLabels(translations[workspace.label] ?? {}),
       ...(workspace.default === true && { default: true as const }),
     });
   }

package/src/agent-tools/tool-dispatch.ts

@@ -1,3 +1,4 @@
+import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import type { ToolDispatchDescriptor } from "./types";
 
@@ -355,18 +356,22 @@ export async function dispatchToolCall(request: ToolCallRequest): Promise<ToolCa
   }
 
   try {
-    switch (descriptor.kind) {
-      case "search":
-        return await dispatchSearch(descriptor, dispatcher, user, toolName, input);
-      case "findBy":
-        return await dispatchFindBy(descriptor, dispatcher, user, toolName, input);
-      case "client":
-        return dispatchClient(descriptor, input);
-      case "server":
-        return descriptor.op === "query"
-          ? await dispatchServerQuery(descriptor, dispatcher, user, input)
-          : await dispatchServerWrite(descriptor, dispatcher, user, input, runId, toolCallId);
-    }
+    // The invoked tool, not the surrounding turn/approve write handler, must
+    // be what the irreversible-operation gate sees as the entry handler.
+    return await runAsDirectCallEntry(async () => {
+      switch (descriptor.kind) {
+        case "search":
+          return await dispatchSearch(descriptor, dispatcher, user, toolName, input);
+        case "findBy":
+          return await dispatchFindBy(descriptor, dispatcher, user, toolName, input);
+        case "client":
+          return dispatchClient(descriptor, input);
+        case "server":
+          return descriptor.op === "query"
+            ? await dispatchServerQuery(descriptor, dispatcher, user, input)
+            : await dispatchServerWrite(descriptor, dispatcher, user, input, runId, toolCallId);
+      }
+    });
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -50,7 +50,7 @@ import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
 import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
-import { AuthErrors, AuthHandlers } from "../constants";
+import { AuthErrors, AuthHandlers, AuthQueries } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { storeInviteToken } from "../invite-token-store";
 import { seedUser } from "../seeding";
@@ -125,6 +125,7 @@ beforeAll(async () => {
         acceptHandler: AuthHandlers.inviteAccept,
         acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
         signupCompleteHandler: AuthHandlers.inviteSignupComplete,
+        infoHandler: AuthQueries.inviteInfo,
       },
     },
   });
@@ -149,8 +150,11 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
   emailTransport.sent.length = 0;
-  const allKeys = await stack.redis.redis.keys("invite:*");
-  if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
+  // Also clears rate-limit buckets: trustedProxyHops defaults to 0, so
+  // every call in this file shares one unknown-IP bucket per handler —
+  // without this, earlier invite-info calls would count toward the
+  // rate-limit test's own budget.
+  await stack.redis.flushNamespace();
 
   // Pro Test frische Tenant-IDs + tenant.key (sonst unique-violation
   // auf read_tenants_key_unique beim 2. Run).
@@ -438,7 +442,7 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     }
   });
 
-  test("Wrong password → 422 invalid_invite_token (anti-enum)", async () => {
+  test("Wrong password → 422 invalid_credentials, invite stays acceptable", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Editor");
     const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
       token,
@@ -447,7 +451,16 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     });
     expect(res.status).toBe(422);
     const body = (await res.json()) as { error?: { details?: { reason?: string } } };
-    expect(body.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidCredentials);
+
+    // Token was released on failure (existing finally/unburn) — the same
+    // invite must still be acceptable with the correct password.
+    const retryRes = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(retryRes.status).toBe(200);
   });
 
   test("common password → 400 (schema rejects breach-list password) (#1340)", async () => {
@@ -536,6 +549,112 @@ describe("invite-signup-complete (Branch 3: anon + new email)", () => {
   });
 });
 
+describe("invite-info (anonymous, read-only lookup)", () => {
+  test("open invite for an existing account → {email, hasAccount:true}, token stays acceptable afterwards", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-info", { token });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { email?: string; hasAccount?: boolean };
+    expect(body.email).toBe(BOB_EMAIL);
+    expect(body.hasAccount).toBe(true);
+
+    // Token was never consumed — the same invite can still be accepted.
+    const acceptRes = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(acceptRes.status).toBe(200);
+  });
+
+  test("open invite for a new email → hasAccount:false", async () => {
+    const token = await inviteEmail(CAROL_EMAIL, "Admin");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-info", { token });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { email?: string; hasAccount?: boolean };
+    expect(body.email).toBe(CAROL_EMAIL);
+    expect(body.hasAccount).toBe(false);
+  });
+
+  test("unknown token → 422 invalid_invite_token", async () => {
+    const res = await stack.http.raw("POST", "/api/auth/invite-info", {
+      token: "not-a-real-token",
+    });
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
+  });
+
+  test("error body has the same shape as the write routes' — invalid_invite_token sits at error.details.reason on both", async () => {
+    const infoRes = await stack.http.raw("POST", "/api/auth/invite-info", {
+      token: "not-a-real-token",
+    });
+    const writeRes = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token: "not-a-real-token",
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(infoRes.status).toBe(422);
+    expect(writeRes.status).toBe(422);
+    type ErrorBody = {
+      isSuccess?: boolean;
+      error?: {
+        code?: string;
+        httpStatus?: number;
+        i18nKey?: string;
+        details?: { reason?: string };
+      };
+    };
+    const infoBody = (await infoRes.json()) as ErrorBody;
+    const writeBody = (await writeRes.json()) as ErrorBody;
+    expect(Object.keys(infoBody).sort()).toEqual(Object.keys(writeBody).sort());
+    expect(Object.keys(infoBody.error ?? {}).sort()).toEqual(
+      Object.keys(writeBody.error ?? {}).sort(),
+    );
+    expect(infoBody.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
+    expect(writeBody.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
+  });
+
+  test("already-accepted invitation → 422 invalid_invite_token", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+    const acceptRes = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(acceptRes.status).toBe(200);
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-info", { token });
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
+  });
+
+  test("token in the query string instead of the body → invalid_body", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+    const res = await stack.http.raw(
+      "POST",
+      `/api/auth/invite-info?token=${encodeURIComponent(token)}`,
+      {},
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error?: string };
+    expect(body.error).toBe("invalid_body");
+  });
+
+  test("rate limit: the 21st call in a window is rejected with 429", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+    for (let i = 0; i < 20; i++) {
+      const res = await stack.http.raw("POST", "/api/auth/invite-info", { token });
+      expect(res.status).toBe(200);
+    }
+    const limited = await stack.http.raw("POST", "/api/auth/invite-info", { token });
+    expect(limited.status).toBe(429);
+  });
+});
+
 describe("invite-accept defense-in-depth (assertAssignableMembershipRoles)", () => {
   test("a forbidden role planted directly on the invitation row (bug/migration) is rejected, not silently granted", async () => {
     // Simulates the ONE scenario this depth-layer exists for: a forbidden role

package/src/auth-email-password/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.323.0",
+    "type": "improvement",
+    "title": "New anonymous invite-info lookup route; invite-accept-with-login now returns invalid_credentials for a wrong or missing password",
+    "detail": "POST /auth/invite-info ({token} -> {email, hasAccount}) lets an invite-acceptance page pre-fill the email and show a login-vs-signup form without consuming the token; it 422s invalid_invite_token for any unknown/non-pending token, same as the accept routes. invite-accept-with-login's wrong-password and no-password-set branches now return 422 invalid_credentials instead of collapsing into invalid_invite_token — safe to reveal because reaching that branch already required a valid, open invite token plus the matching invitation email.",
+    "migration": "No action needed for apps using createAuthEmailPasswordFeature's default wiring via runProdApp/runDevApp — the new route only mounts when the host app's auth-routes config sets invite.infoHandler (runProdApp/runDevApp now do this automatically when the invite feature is enabled). A client that special-cased invite-accept-with-login's invalid_invite_token response to also mean \"wrong password\" should switch to matching invalid_credentials for that case."
+  },
   {
     "version": "0.320.0",
     "type": "fix",

package/src/auth-email-password/constants.ts

@@ -50,6 +50,9 @@ export const AuthHandlers = {
 // signup page can decide whether to show its own link/form.
 export const AuthQueries = {
   signupRegistrationStatus: "auth-email-password:query:signup-registration-status",
+  // Anonymous, read-only invite lookup for the invite-acceptance page —
+  // see invite-info.query.ts. Does not consume the token.
+  inviteInfo: "auth-email-password:query:invite-info",
 } as const;
 
 // Error codes — kept intentionally generic so clients can't distinguish

package/src/auth-email-password/feature.ts

@@ -10,6 +10,7 @@ import {
   createInviteCreateHandler,
   type InviteCreateOptions,
 } from "./handlers/invite-create.write";
+import { inviteInfoQuery } from "./handlers/invite-info.query";
 import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write";
 import { createLoginHandler, type LoginHandlerOptions } from "./handlers/login.write";
 import { logoutWrite } from "./handlers/logout.write";
@@ -233,6 +234,9 @@ export function createAuthEmailPasswordFeature(
       ...(opts.signup && {
         signupRegistrationStatus: r.queryHandler(selfRegistrationStatusQuery),
       }),
+      ...(opts.invite && {
+        inviteInfo: r.queryHandler(inviteInfoQuery),
+      }),
     };
 
     if (opts.signup) {