@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/dist/auth-email-password/reset-token.d.ts

@@ -0,0 +1,14 @@
+import type { Temporal } from "temporal-polyfill";
+export type VerifyResult = {
+    readonly ok: true;
+    readonly userId: string;
+    readonly expiresAtMs: number;
+} | {
+    readonly ok: false;
+    readonly reason: "malformed" | "bad_signature" | "expired";
+};
+export declare function signResetToken(userId: string, ttlMinutes: number, secret: string, now?: Temporal.Instant): {
+    token: string;
+    expiresAt: Temporal.Instant;
+};
+export declare function verifyResetToken(token: string, secret: string, now?: Temporal.Instant): VerifyResult;

package/dist/auth-email-password/reset-token.js

@@ -0,0 +1,13 @@
+// Thin wrapper around signed-token.ts pinning the purpose to "reset".
+// Handlers keep their terse API (signResetToken / verifyResetToken) while
+// the shared HMAC logic lives in one place. verification-token.ts mirrors
+// this pattern with purpose="verify".
+import { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
+// @wrapper-known semantic-alias
+export function signResetToken(userId, ttlMinutes, secret, now) {
+    return signToken(userId, TokenPurpose.passwordReset, ttlMinutes, secret, now);
+}
+// @wrapper-known semantic-alias
+export function verifyResetToken(token, secret, now) {
+    return verifyToken(token, TokenPurpose.passwordReset, secret, now);
+}

package/dist/auth-email-password/seeding.d.ts

@@ -0,0 +1,122 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type SeedTenantHooks } from "../tenant/seeding.js";
+export { seedTenant, seedTenantMembership } from "../tenant/seeding.js";
+export { seedUser } from "../user/seeding.js";
+export type SeedUserWithPasswordOptions = {
+    readonly email: string;
+    readonly password: string;
+    readonly displayName: string;
+    readonly locale?: string;
+    /** Globale Rollen — siehe SeedUserOptions.roles. */
+    readonly roles?: readonly string[];
+    /** Initial-emailVerified-Flag. Default false (Verify-Flow läuft).
+     *  Magic-Link-Signup setzt true weil der Mail-Klick die Email-
+     *  Ownership beweist. Siehe SeedUserOptions.emailVerified. */
+    readonly emailVerified?: boolean;
+    readonly by?: SessionUser;
+};
+/**
+ * Seed a user mit Plain-Password (wird vor dem Insert mit argon2
+ * gehasht). Liefert die userId, idempotent über email.
+ */
+export declare function seedUserWithPassword(db: DbConnection, options: SeedUserWithPasswordOptions, hooks?: SeedTenantHooks): Promise<{
+    id: string;
+}>;
+/** Provisioning-Helper für Self-Signup-Confirm. Legt einen frischen
+ *  Tenant + Admin-User + Membership in einem Rutsch an — verwendet die
+ *  bestehende Event-Store-Pipeline (wie seedAdmin) und ist daher
+ *  konsistent mit dem regulären create-Pfad: events werden geschrieben,
+ *  Projections sind populated, MSPs/Audit sehen die neuen Rows.
+ *
+ *  Naming-Hinweis: nutzt intern `seedTenant` / `seedUser*` —
+ *  diese Helpers sind production-grade (event-store-pipeline), das "seed"
+ *  im Namen ist historisch (zuerst für Tests + Bootstrap gebaut, dann
+ *  als General-Purpose-Helper exportiert). Rename `seed*` → `provision*`
+ *  ist als dedizierter Cleanup-PR geplant — disproportional zum Wert
+ *  innerhalb dieses Sprints, weil alle existing tests berührt würden.
+ *
+ *  Atomicity: läuft inside einer Drizzle-Tx wenn der Caller das angibt
+ *  (db.begin(tx => provisionSignupAccount(tx, ...)) — die seed-
+ *  helpers nehmen DbConnection|DbTx strukturell. Bei pure DbConnection
+ *  sind die 3 writes nicht atomic; bei Failure zwischen Schritten kann
+ *  ein orphan-Tenant zurückbleiben (Tenant ohne User → unused row;
+ *  User ohne Membership → "no_membership" beim ersten Login).
+ *
+ *  Create-only: existiert bereits ein User mit dieser Email (Seeding oder
+ *  früherer Signup), wirft die Funktion einen ConflictError BEVOR ein Tenant
+ *  entsteht. Der Self-Signup-Pfad darf einen bestehenden User nicht still
+ *  wiederverwenden — sonst würde der Confirm-Schritt eine Session für ihn
+ *  minten (Account-Takeover, #365). `seedUser` selbst bleibt idempotent
+ *  add-only (für Bootstrap/Tests); die create-only-Garantie sitzt hier.
+ *  tenantKey-Kollisionen löst der Caller via generateUniqueName. */
+/** Default membership roles for self-signup tenant owners. Shared between
+ *  provisionSignupAccount (DB-write) und signup-confirm-handler
+ *  (SessionUser-Konstruktion für JWT-Mint) — sonst hätten zwei
+ *  Stellen unabhängig "TenantAdmin" hardcoded und würden bei einem
+ *  Refactor zu role-mismatch zwischen DB und Session leiden. */
+export declare const INITIAL_SIGNUP_ROLES: readonly ["TenantAdmin", "Admin"];
+export type ProvisionSignupAccountOptions = {
+    readonly email: string;
+    readonly password: string;
+    readonly displayName: string;
+    readonly tenantKey: string;
+    readonly tenantName: string;
+    readonly tenantId: TenantId;
+    readonly memberRoles?: readonly string[];
+};
+export declare function provisionSignupAccount(db: DbConnection, options: ProvisionSignupAccountOptions, hooks?: SeedTenantHooks): Promise<{
+    readonly userId: string;
+    readonly tenantId: TenantId;
+}>;
+export type SeedAdminOptions = {
+    readonly email: string;
+    readonly password: string;
+    readonly displayName: string;
+    /** Tenants, in die der Admin als Mitglied eingetragen wird. Pro
+     *  Tenant kann eine eigene Rollenliste gesetzt werden — hilft beim
+     *  Sample-TenantSwitcher der pro Tenant unterschiedliche
+     *  Rollen-Listen zeigt. */
+    readonly memberships: ReadonlyArray<{
+        readonly tenantId: TenantId;
+        readonly tenantKey: string;
+        readonly tenantName: string;
+        readonly roles: readonly string[];
+    }>;
+    /** Globale Rollen die in users.roles landen — tenant-unabhängig.
+     *  Login-Handler mergt sie in jede Session parallel zu den tenant-
+     *  membership-Rollen. Typischer use-case: `["SystemAdmin"]` für
+     *  einen Plattform-Operator. Default: leer. */
+    readonly globalRoles?: readonly string[];
+    /** Initial emailVerified state — defaults to false (unverified). Same
+     *  mechanism as seedUserWithPassword.emailVerified. Re-running the seed
+     *  against an already-seeded row reconciles this flag too (true → sets
+     *  it via a real `.updated` event; never flips true → false). */
+    readonly emailVerified?: boolean;
+    readonly by?: SessionUser;
+};
+/**
+ * Seed-Convenience für Sample-Server: Admin-User mit gehashtem
+ * Password + N Tenants + N Memberships. Alles idempotent (Re-Run im
+ * persistent-DB-Modus läuft durch). Liefert die userId zurück.
+ */
+export declare function seedAdmin(db: DbConnection, options: SeedAdminOptions): Promise<{
+    id: string;
+}>;
+/**
+ * Boot-seed variant of seedAdmin that survives a blind-index miss on an
+ * otherwise-existing account (see the module comment above). Not for the
+ * self-signup hot path — seedAdmin/seedUser stay the unguarded entry point
+ * there.
+ *
+ * No cheap `fetchOne` fast path here on purpose: a hit there only proves
+ * SOME row matches (plaintext or bidx), never that it's the canonical one —
+ * a stale row's bidx can go NULL while a later duplicate's stays valid, so
+ * fetchOne keeps finding the duplicate forever and the seed never converges
+ * on the oldest row. The only cheap short-circuit that stays correct is
+ * skipping the scan entirely when no KMS is configured at all (plaintext
+ * DBs have no bidx ambiguity to guard against in the first place).
+ */
+export declare function seedAdminGuarded(db: DbConnection, options: SeedAdminOptions): Promise<{
+    id: string;
+}>;

package/dist/auth-email-password/seeding.js

@@ -0,0 +1,237 @@
+// Stable seeding helpers fürs auth-email-password-Feature. Liegen unter
+// `/seeding` (nicht `/testing`) damit der Vertrag klar ist: hier ist
+// non-test code der bei jedem Dev-Boot + jedem Integration-Test läuft.
+// Test-spezifische Variationen (account-locked-Setup, expired-token,
+// race-conditions) werden NICHT als Knöpfe an diesen Helpers angebaut —
+// sie kommen als neue Funktionen daneben oder inline ins Test-File.
+//
+// Bündelt drei Schritte in einem Aufruf:
+//   1. argon2-Hash des Plain-Passworts
+//   2. seedUser() aus user/seeding
+//   3. seedTenant + seedTenantMembership aus tenant/seeding
+// Damit Sample-Server und Tests keine drei sub-paths zusammensammeln
+// müssen.
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configuredBlindIndexKey, configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { hashPassword } from "../shared/index.js";
+// kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
+import { seedTenant, seedTenantMembership } from "../tenant/seeding.js";
+// kumiko-lint-ignore cross-feature-import signup create-only guard reads the user projection by email
+import { USER_STATUS, userTable } from "../user/schema/user.js";
+// kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
+import { reconcileSeededUserEmailVerified, seedUser } from "../user/seeding.js";
+// Re-export für ergonomische Single-Import-Site in tests/seed-scripts.
+// Das Auth-Feature ist der natürliche Aufrufer für "seed admin user mit
+// password + tenant + membership" — wer das nutzt soll nicht aus drei
+// verschiedenen sub-paths zusammensammeln müssen.
+// kumiko-lint-ignore cross-feature-import re-export of test-helpers
+export { seedTenant, seedTenantMembership } from "../tenant/seeding.js";
+// kumiko-lint-ignore cross-feature-import re-export of test-helpers
+export { seedUser } from "../user/seeding.js";
+/**
+ * Seed a user mit Plain-Password (wird vor dem Insert mit argon2
+ * gehasht). Liefert die userId, idempotent über email.
+ */
+export async function seedUserWithPassword(db, options, 
+// Optional, append-only — same rationale as provisionSignupAccount's
+// hooks param (#1478): the self-signup path passes it through so `user`'s
+// postSave hooks fire on self-signup same as on the regular create path.
+hooks) {
+    const passwordHash = await hashPassword(options.password);
+    return seedUser(db, {
+        email: options.email,
+        displayName: options.displayName,
+        passwordHash,
+        ...(options.locale !== undefined && { locale: options.locale }),
+        ...(options.roles !== undefined && { roles: options.roles }),
+        ...(options.emailVerified !== undefined && { emailVerified: options.emailVerified }),
+        ...(options.by !== undefined && { by: options.by }),
+    }, hooks);
+}
+/** Provisioning-Helper für Self-Signup-Confirm. Legt einen frischen
+ *  Tenant + Admin-User + Membership in einem Rutsch an — verwendet die
+ *  bestehende Event-Store-Pipeline (wie seedAdmin) und ist daher
+ *  konsistent mit dem regulären create-Pfad: events werden geschrieben,
+ *  Projections sind populated, MSPs/Audit sehen die neuen Rows.
+ *
+ *  Naming-Hinweis: nutzt intern `seedTenant` / `seedUser*` —
+ *  diese Helpers sind production-grade (event-store-pipeline), das "seed"
+ *  im Namen ist historisch (zuerst für Tests + Bootstrap gebaut, dann
+ *  als General-Purpose-Helper exportiert). Rename `seed*` → `provision*`
+ *  ist als dedizierter Cleanup-PR geplant — disproportional zum Wert
+ *  innerhalb dieses Sprints, weil alle existing tests berührt würden.
+ *
+ *  Atomicity: läuft inside einer Drizzle-Tx wenn der Caller das angibt
+ *  (db.begin(tx => provisionSignupAccount(tx, ...)) — die seed-
+ *  helpers nehmen DbConnection|DbTx strukturell. Bei pure DbConnection
+ *  sind die 3 writes nicht atomic; bei Failure zwischen Schritten kann
+ *  ein orphan-Tenant zurückbleiben (Tenant ohne User → unused row;
+ *  User ohne Membership → "no_membership" beim ersten Login).
+ *
+ *  Create-only: existiert bereits ein User mit dieser Email (Seeding oder
+ *  früherer Signup), wirft die Funktion einen ConflictError BEVOR ein Tenant
+ *  entsteht. Der Self-Signup-Pfad darf einen bestehenden User nicht still
+ *  wiederverwenden — sonst würde der Confirm-Schritt eine Session für ihn
+ *  minten (Account-Takeover, #365). `seedUser` selbst bleibt idempotent
+ *  add-only (für Bootstrap/Tests); die create-only-Garantie sitzt hier.
+ *  tenantKey-Kollisionen löst der Caller via generateUniqueName. */
+/** Default membership roles for self-signup tenant owners. Shared between
+ *  provisionSignupAccount (DB-write) und signup-confirm-handler
+ *  (SessionUser-Konstruktion für JWT-Mint) — sonst hätten zwei
+ *  Stellen unabhängig "TenantAdmin" hardcoded und würden bei einem
+ *  Refactor zu role-mismatch zwischen DB und Session leiden. */
+// TenantAdmin is the canonical owner role; Admin stays for handlers that still
+// gate on the legacy literal until those call sites move to access.admin.
+export const INITIAL_SIGNUP_ROLES = ["TenantAdmin", "Admin"];
+export async function provisionSignupAccount(db, options, 
+// Optional, append-only — existing callers (tests, seed scripts) that
+// don't pass hooks keep today's behavior. The real signup-confirm
+// handler DOES pass it (#1463) so seedTenant/seedUserWithPassword/
+// seedTenantMembership's postSave hooks (tier-engine's auto-default-tier,
+// app auto-default-compliance, a Welcome-notification hook, ...) fire on
+// self-signup for all three entities, same as they do on the regular
+// create paths (#1478 — this was only wired for tenant before).
+hooks) {
+    // Create-only guard BEFORE seedTenant: hard-abort on an already-registered
+    // email, otherwise an orphaned tenant would be created and seedUser
+    // (idempotent add-only) would silently return the existing userId ->
+    // confirm mints a session for the wrong account (#365).
+    // isDeleted: false — the partial bidx unique index only covers live rows,
+    // so a soft-deleted row must not block re-registering its email.
+    const existingUser = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
+    if (existingUser) {
+        throw new ConflictError({ message: "signup: email already registered" });
+    }
+    await seedTenant(db, {
+        id: options.tenantId,
+        key: options.tenantKey,
+        name: options.tenantName,
+    }, hooks);
+    const { id: userId } = await seedUserWithPassword(db, {
+        email: options.email,
+        password: options.password,
+        displayName: options.displayName,
+        emailVerified: true,
+    }, hooks);
+    await seedTenantMembership(db, {
+        userId,
+        tenantId: options.tenantId,
+        roles: options.memberRoles ?? INITIAL_SIGNUP_ROLES,
+    }, hooks);
+    return { userId, tenantId: options.tenantId };
+}
+/**
+ * Seed-Convenience für Sample-Server: Admin-User mit gehashtem
+ * Password + N Tenants + N Memberships. Alles idempotent (Re-Run im
+ * persistent-DB-Modus läuft durch). Liefert die userId zurück.
+ */
+export async function seedAdmin(db, options) {
+    const by = options.by ?? TestUsers.systemAdmin;
+    for (const m of options.memberships) {
+        await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, by });
+    }
+    const { id: userId } = await seedUserWithPassword(db, {
+        email: options.email,
+        password: options.password,
+        displayName: options.displayName,
+        ...(options.globalRoles !== undefined && { roles: options.globalRoles }),
+        ...(options.emailVerified !== undefined && { emailVerified: options.emailVerified }),
+        by,
+    });
+    for (const m of options.memberships) {
+        await seedTenantMembership(db, {
+            userId,
+            tenantId: m.tenantId,
+            roles: m.roles,
+            by,
+        });
+    }
+    return { id: userId };
+}
+function compareInsertedAt(a, b) {
+    if (a.epochNanoseconds < b.epochNanoseconds)
+        return -1;
+    if (a.epochNanoseconds > b.epochNanoseconds)
+        return 1;
+    return 0;
+}
+/** Oldest row wins, tie-broken by id — the same rule a manual duplicate
+ *  cleanup would apply, so this guard and any later cleanup never disagree
+ *  on which row is the survivor. */
+function pickCanonicalUserId(rows) {
+    const sorted = [...rows].sort((a, b) => {
+        const byTime = compareInsertedAt(a.insertedAt, b.insertedAt);
+        return byTime !== 0 ? byTime : a.id.localeCompare(b.id);
+    });
+    const first = sorted[0];
+    if (first === undefined)
+        throw new Error("pickCanonicalUserId: empty group");
+    return first.id;
+}
+async function findExistingUserIdForEmail(db, kms, email) {
+    // ponytail: decrypts every active user row to compare emails. Fine at
+    // boot-seed scale (tens of accounts, once per boot); if the user table
+    // grows past a few thousand rows, narrow this to rows whose email_bidx is
+    // NULL or doesn't match the expected HMAC — only those need decrypting.
+    const rows = await selectMany(db, userTable, {
+        isDeleted: false,
+        status: { ne: USER_STATUS.Deleted },
+    });
+    const matches = [];
+    for (const row of rows) {
+        // Compared byte-exact, deliberately not case-folded: email_bidx is an
+        // HMAC over the raw value and login matches case-sensitively, so a case
+        // variant is a different account to every other code path.
+        const decrypted = await decryptPiiFieldValues({ email: row.email }, ["email"], kms, {
+            requestId: "seed-admin-guarded",
+        });
+        if (decrypted["email"] === email)
+            matches.push(row);
+    }
+    return matches.length === 0 ? undefined : pickCanonicalUserId(matches);
+}
+/**
+ * Boot-seed variant of seedAdmin that survives a blind-index miss on an
+ * otherwise-existing account (see the module comment above). Not for the
+ * self-signup hot path — seedAdmin/seedUser stay the unguarded entry point
+ * there.
+ *
+ * No cheap `fetchOne` fast path here on purpose: a hit there only proves
+ * SOME row matches (plaintext or bidx), never that it's the canonical one —
+ * a stale row's bidx can go NULL while a later duplicate's stays valid, so
+ * fetchOne keeps finding the duplicate forever and the seed never converges
+ * on the oldest row. The only cheap short-circuit that stays correct is
+ * skipping the scan entirely when no KMS is configured at all (plaintext
+ * DBs have no bidx ambiguity to guard against in the first place).
+ */
+export async function seedAdminGuarded(db, options) {
+    const kms = configuredPiiSubjectKms();
+    if (kms === undefined)
+        return seedAdmin(db, options);
+    // Without a bidx key every row seeded here gets a NULL email_bidx, which
+    // neither seedAdmin's lookup nor the partial unique index can ever see.
+    if (configuredBlindIndexKey() === undefined) {
+        throw new Error("seedAdminGuarded: a PII KMS is configured but no blind-index key — the email lookup would be blind and the seed would insert a duplicate admin. Configure KUMIKO_BLIND_INDEX_KEY.");
+    }
+    const existingId = await findExistingUserIdForEmail(db, kms, options.email);
+    if (existingId === undefined)
+        return seedAdmin(db, options);
+    const by = options.by ?? TestUsers.systemAdmin;
+    if (options.emailVerified === true) {
+        const existingRow = await fetchOne(db, userTable, { id: existingId });
+        if (existingRow)
+            await reconcileSeededUserEmailVerified(db, existingRow, by);
+    }
+    for (const m of options.memberships) {
+        await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, by });
+        await seedTenantMembership(db, {
+            userId: existingId,
+            tenantId: m.tenantId,
+            roles: m.roles,
+            by,
+        });
+    }
+    return { id: existingId };
+}

package/dist/auth-email-password/self-registration-toggle.d.ts

@@ -0,0 +1,3 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export declare const AUTH_SELF_REGISTRATION_FEATURE = "auth-self-registration";
+export declare function createAuthSelfRegistrationToggleFeature(): FeatureDefinition;

package/dist/auth-email-password/self-registration-toggle.js

@@ -0,0 +1,21 @@
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+// Companion toggle for the auth-email-password self-signup flow. Handler-less
+// (like managed-pages-css/css-gate.ts): composing it just registers
+// "auth-self-registration" as toggleable (default ON) so an operator can
+// flip it at runtime via feature-toggles, without redeploying and without
+// making the rest of auth-email-password (login/reset/verify) toggleable.
+//
+// Deliberately owns NO handlers — the dispatcher's per-feature gate blocks
+// every handler belonging to a disabled feature, and a `status` query living
+// here would become unreachable exactly when it matters most (disabled).
+// The signup-request handler and the `signupRegistrationStatus` query both
+// live in auth-email-password itself and read `ctx.hasFeature(...)` against
+// this feature name instead — same split as managed-pages/css-gate.ts vs.
+// managed-pages' branding query.
+export const AUTH_SELF_REGISTRATION_FEATURE = "auth-self-registration";
+export function createAuthSelfRegistrationToggleFeature() {
+    return defineFeature(AUTH_SELF_REGISTRATION_FEATURE, (r) => {
+        r.describe('Runtime on/off switch for the auth-email-password self-signup flow. Handler-less: composing it registers "auth-self-registration" as a toggleable feature (default ON). auth-email-password\'s signup-request handler and its `signupRegistrationStatus` query both read `ctx.hasFeature("auth-self-registration")` — the query stays reachable when the toggle is off (deliberately not gated itself) so the public signup page can hide its own link/form. Only meaningful when `signup` is configured on `createAuthEmailPasswordFeature` — compose alongside it, then flip via the feature-toggles admin screen.');
+        r.toggleable({ default: true });
+    });
+}

package/dist/auth-email-password/signed-token.d.ts

@@ -0,0 +1 @@
+export * from "../shared/signed-token.js";

package/dist/auth-email-password/signed-token.js

@@ -0,0 +1,4 @@
+// Moved to shared/signed-token.ts — the mechanism was never specific to
+// email/password auth (user-data-rights and any row-bound grant use it too).
+// Re-exported so this feature's barrel and external importers keep working.
+export * from "../shared/signed-token.js";

package/dist/auth-email-password/signup-token-store.d.ts

@@ -0,0 +1,51 @@
+import type { Redis } from "ioredis";
+import { type SignupHandoverBinding } from "../shared/index.js";
+/** Email normalization — single source for every lookup layer (used
+ *  internally by the store AND by callers that need a consistent form
+ *  in the return body / mail send). Previously two places called
+ *  `.toLowerCase()` — one source means no drift. */
+export declare function normalizeEmail(email: string): string;
+/** Stores the pair bidirectionally and sets TTL on both keys.
+ *  Idempotent — re-writing the same token-email pair is fine. */
+export declare function storeSignupToken(redis: Redis, args: {
+    email: string;
+    token: string;
+    ttlSeconds: number;
+}): Promise<void>;
+/** Lookup: email for a token. Null if the token no longer exists
+ *  (expired, already consumed, or invalid). */
+export declare const getEmailForSignupToken: (redis: Redis, token: string) => Promise<string | null>;
+/** Deletes a still-live signup token for this email, if one exists. Used
+ *  by signup-request on every request; a fresh token + by-email entry
+ *  follows right after, so this is "at most one live token per email." */
+export declare function invalidateExistingSignupToken(redis: Redis, email: string): Promise<boolean>;
+/** Single-use burn: if two tabs click the confirm link at the same time,
+ *  the first one wins, the second gets "already-used". */
+export declare const burnSignupToken: (redis: Redis, token: string) => Promise<"burned" | "already-used">;
+/** Cleanup after a successful confirm — deletes both lookup keys.
+ *  The burn key stays (prevents replay within the burn TTL). */
+export declare function deleteSignupToken(redis: Redis, args: {
+    email: string;
+    token: string;
+}): Promise<void>;
+/** Burn release for failed-confirm paths (DB error etc.) so a legitimate
+ *  retry isn't blocked by a stale burn marker. */
+export declare const unburnSignupToken: (redis: Redis, token: string) => Promise<void>;
+/** Binds a verified grant to this signup token, TTL-matched to the token
+ *  itself so the binding never outlives (or is killed before) it. */
+export declare function storeSignupHandover(redis: Redis, args: {
+    token: string;
+    binding: SignupHandoverBinding;
+    ttlSeconds: number;
+}): Promise<void>;
+/** Reads the binding for a still-live signup token, if any. */
+export declare function getSignupHandover(redis: Redis, token: string): Promise<SignupHandoverBinding | null>;
+/** Carries a still-live binding over to a resend, before the old token is
+ *  invalidated: reads the old token's hash off the store's by-email entry
+ *  (never the token itself), fetches the binding under that hash, and
+ *  deletes it — the fresh token gets its own storeSignupHandover call with
+ *  the same binding right after. Null when there was no live binding. */
+export declare function takeOverSignupHandoverForResend(redis: Redis, email: string): Promise<SignupHandoverBinding | null>;
+/** Cleanup after signup-confirm has read (and acted on, or logged a failed
+ *  claim for) the binding. */
+export declare function deleteSignupHandover(redis: Redis, token: string): Promise<void>;

package/dist/auth-email-password/signup-token-store.js

@@ -0,0 +1,115 @@
+// Redis-backed pre-activation token store for magic-link signup.
+//
+// Subject is the (normalized) email — the user doesn't exist yet, so
+// there's no userId claim for an HMAC-signed token to bind to. The store
+// mechanics (bidirectional token↔subject mapping, sha256-hashed keys,
+// single-use burn) live in shared/single-use-token-store.ts — this file
+// only wires the signup key prefixes onto it and normalizes the email
+// used as the subject id.
+//
+// No collision with reset/verify/invite tokens: all signup keys carry the
+// `signup:`-prefix.
+import * as z from "zod";
+import { createSingleUseTokenStore, hashSingleUseToken, } from "../shared/index.js";
+/** Email normalization — single source for every lookup layer (used
+ *  internally by the store AND by callers that need a consistent form
+ *  in the return body / mail send). Previously two places called
+ *  `.toLowerCase()` — one source means no drift. */
+export function normalizeEmail(email) {
+    return email.toLowerCase();
+}
+const store = createSingleUseTokenStore({
+    tokenPrefix: "signup:by-token:",
+    subjectPrefix: "signup:by-email:",
+    burnPrefix: "signup:burn:",
+});
+/** Stores the pair bidirectionally and sets TTL on both keys.
+ *  Idempotent — re-writing the same token-email pair is fine. */
+export async function storeSignupToken(redis, args) {
+    return store.store(redis, {
+        subjectId: normalizeEmail(args.email),
+        token: args.token,
+        ttlSeconds: args.ttlSeconds,
+    });
+}
+/** Lookup: email for a token. Null if the token no longer exists
+ *  (expired, already consumed, or invalid). */
+export const getEmailForSignupToken = store.getSubjectForToken;
+/** Deletes a still-live signup token for this email, if one exists. Used
+ *  by signup-request on every request; a fresh token + by-email entry
+ *  follows right after, so this is "at most one live token per email." */
+export async function invalidateExistingSignupToken(redis, email) {
+    return store.invalidateExistingBySubject(redis, normalizeEmail(email));
+}
+/** Single-use burn: if two tabs click the confirm link at the same time,
+ *  the first one wins, the second gets "already-used". */
+export const burnSignupToken = store.burn;
+/** Cleanup after a successful confirm — deletes both lookup keys.
+ *  The burn key stays (prevents replay within the burn TTL). */
+export async function deleteSignupToken(redis, args) {
+    return store.deleteBoth(redis, { subjectId: normalizeEmail(args.email), token: args.token });
+}
+/** Burn release for failed-confirm paths (DB error etc.) so a legitimate
+ *  retry isn't blocked by a stale burn marker. */
+export const unburnSignupToken = store.unburn;
+// Cross-device try-first handover (kumiko-framework#3035 follow-up,
+// offlot-app#454): signup-request binds a verified tenant-handover grant to
+// its own signup token, in a SIBLING Redis namespace keyed the same way
+// (sha256(token)) so it stays byte-compatible with the token store above
+// without going through it — the binding has its own lifecycle (survives a
+// resend, is read once by signup-confirm) that doesn't fit the token↔email
+// pairing. Only {entityType, rowId, sourceTenantId} is ever stored — never
+// the grant token or the email (see shared/signup-handover.ts).
+const SIGNUP_HANDOVER_KEY_PREFIX = "signup:handover:";
+const signupHandoverBindingSchema = z.object({
+    entityType: z.string().min(1),
+    rowId: z.string().min(1),
+    sourceTenantId: z.string().min(1),
+});
+function signupHandoverKeyForHash(tokenHash) {
+    return `${SIGNUP_HANDOVER_KEY_PREFIX}${tokenHash}`;
+}
+function signupHandoverKey(token) {
+    return signupHandoverKeyForHash(hashSingleUseToken(token));
+}
+function parseSignupHandoverBinding(raw) {
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const parsed = signupHandoverBindingSchema.safeParse(json);
+    return parsed.success ? parsed.data : null;
+}
+/** Binds a verified grant to this signup token, TTL-matched to the token
+ *  itself so the binding never outlives (or is killed before) it. */
+export async function storeSignupHandover(redis, args) {
+    await redis.set(signupHandoverKey(args.token), JSON.stringify(args.binding), "EX", args.ttlSeconds);
+}
+/** Reads the binding for a still-live signup token, if any. */
+export async function getSignupHandover(redis, token) {
+    const raw = await redis.get(signupHandoverKey(token));
+    return raw === null ? null : parseSignupHandoverBinding(raw);
+}
+/** Carries a still-live binding over to a resend, before the old token is
+ *  invalidated: reads the old token's hash off the store's by-email entry
+ *  (never the token itself), fetches the binding under that hash, and
+ *  deletes it — the fresh token gets its own storeSignupHandover call with
+ *  the same binding right after. Null when there was no live binding. */
+export async function takeOverSignupHandoverForResend(redis, email) {
+    const oldTokenHash = await store.getTokenHashForSubject(redis, normalizeEmail(email));
+    if (oldTokenHash === null)
+        return null;
+    const raw = await redis.get(signupHandoverKeyForHash(oldTokenHash));
+    if (raw === null)
+        return null;
+    await redis.del(signupHandoverKeyForHash(oldTokenHash));
+    return parseSignupHandoverBinding(raw);
+}
+/** Cleanup after signup-confirm has read (and acted on, or logged a failed
+ *  claim for) the binding. */
+export async function deleteSignupHandover(redis, token) {
+    await redis.del(signupHandoverKey(token));
+}

package/dist/auth-email-password/testing.d.ts

@@ -0,0 +1 @@
+export * from "./seeding.js";

package/dist/auth-email-password/testing.js

@@ -0,0 +1,4 @@
+// /testing re-exportiert /seeding. Siehe ../tenant/testing.ts für die
+// Begründung — Helpers sind shared zwischen Tests und Dev-Server-
+// Bootstrap, /seeding ist die stabile Heimat.
+export * from "./seeding.js";

package/dist/auth-email-password/unlock-token.d.ts

@@ -0,0 +1,14 @@
+import type { Temporal } from "temporal-polyfill";
+export type VerifyResult = {
+    readonly ok: true;
+    readonly userId: string;
+    readonly expiresAtMs: number;
+} | {
+    readonly ok: false;
+    readonly reason: "malformed" | "bad_signature" | "expired";
+};
+export declare function signUnlockToken(userId: string, ttlMinutes: number, secret: string, now?: Temporal.Instant): {
+    token: string;
+    expiresAt: Temporal.Instant;
+};
+export declare function verifyUnlockToken(token: string, secret: string, now?: Temporal.Instant): VerifyResult;

package/dist/auth-email-password/unlock-token.js

@@ -0,0 +1,11 @@
+// Thin wrapper around signed-token.ts pinning the purpose to "unlock".
+// Mirrors reset-token.ts / verification-token.ts.
+import { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
+// @wrapper-known semantic-alias
+export function signUnlockToken(userId, ttlMinutes, secret, now) {
+    return signToken(userId, TokenPurpose.accountUnlock, ttlMinutes, secret, now);
+}
+// @wrapper-known semantic-alias
+export function verifyUnlockToken(token, secret, now) {
+    return verifyToken(token, TokenPurpose.accountUnlock, secret, now);
+}

package/dist/auth-email-password/verification-token.d.ts

@@ -0,0 +1,14 @@
+import type { Temporal } from "temporal-polyfill";
+export type VerifyResult = {
+    readonly ok: true;
+    readonly userId: string;
+    readonly expiresAtMs: number;
+} | {
+    readonly ok: false;
+    readonly reason: "malformed" | "bad_signature" | "expired";
+};
+export declare function signVerificationToken(userId: string, ttlMinutes: number, secret: string, now?: Temporal.Instant): {
+    token: string;
+    expiresAt: Temporal.Instant;
+};
+export declare function verifyVerificationToken(token: string, secret: string, now?: Temporal.Instant): VerifyResult;