@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -1,166 +0,0 @@
-// Shared factory for the request-side of out-of-band token flows
-// (password-reset, email-verification, account-unlock). All follow the
-// same shape:
-//
-//   POST email
-//     → resolve user (system-scoped query)
-//     → skip silently if user doesn't exist / is deleted / already done
-//     → mint an HMAC-signed token
-//     → return { kind: <successKind>, email, token, expiresAt }
-//
-// Differences between the flows are four parameters (successKind, sign fn,
-// default TTL, extra skip condition) + two error codes — encoded on the
-// spec rather than duplicated across two near-identical handler bodies.
-
-import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import type { Temporal } from "temporal-polyfill";
-import * as z from "zod";
-import { UserQueries } from "../../user";
-import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";
-import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "../email-templates";
-import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail";
-
-const RequestTokenSchema = z.object({
-  email: z.email(),
-});
-
-// What the route layer reads off `result.data` after dispatching. Identical
-// shape for both flows; only the `kind` discriminator differs so the route
-// knows whether to forward to sendResetEmail or sendVerificationEmail.
-export type TokenRequestSuccess<K extends string> = {
-  readonly kind: K;
-  readonly email: string;
-  readonly token: string;
-  readonly expiresAt: string;
-};
-
-export type TokenRequestNoOp = { readonly kind: "no-op" };
-
-export type TokenRequestData<K extends string> = TokenRequestSuccess<K> | TokenRequestNoOp;
-
-export type TokenRequestSpec<TName extends string, TSuccessKind extends string> = {
-  readonly handlerName: TName;
-  readonly successKind: TSuccessKind;
-  // Per-flow, never derived here — a shared sentence would describe the
-  // mechanism instead of the flow the agent is picking between.
-  readonly description: string;
-  readonly defaultTtlMinutes: number;
-  // Feature-specific sign function. Signature matches both signResetToken
-  // and signVerificationToken (thin wrappers over signed-token.ts).
-  readonly sign: (
-    userId: string,
-    ttlMinutes: number,
-    secret: string,
-  ) => { token: string; expiresAt: Temporal.Instant };
-  // Error code + i18nKey returned when the feature-factory wasn't given a
-  // working hmacSecret. Should never happen — feature-factory validates at
-  // boot — but defensive coverage for lazy secret-providers.
-  readonly notConfiguredError: string;
-  readonly notConfiguredI18nKey: string;
-  // Extra silent-skip predicate on top of "user doesn't exist or is
-  // soft-deleted". Verification skips when emailVerified is already true;
-  // password-reset has no extra condition (returns false).
-  readonly extraSilentSkip: (user: AuthUserRow) => boolean;
-  // Notification type dispatched via ctx.notify on success. No r.notification
-  // is declared (the recipient is an anonymous email, not a userId) — the
-  // route:{email} path delivers directly and buildMessage falls back to data.
-  readonly notificationType: string;
-  // Builds the structured mail body from the magic-link + expiry. Per-flow
-  // (renderResetPasswordEmail / renderVerifyEmail).
-  readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
-};
-
-export type TokenRequestOptions = {
-  readonly hmacSecret: string;
-  readonly tokenTtlMinutes?: number;
-  /** App page that receives the magic-link; the handler appends `?token=…`.
-   *  Apps with language-in-path routing pass a function to pick the right
-   *  page for the resolved locale; everyone else keeps a plain string. */
-  readonly appUrl: string | ((locale: string) => string);
-  readonly appName?: string;
-  /** Static fallback mail locale, used only when the request itself
-   *  carries no locale signal (no X-Locale header, no usable
-   *  Accept-Language) — see the locale resolution in the handler below. */
-  readonly locale?: AuthMailLocale;
-};
-
-export function createTokenRequestHandler<TName extends string, TSuccessKind extends string>(
-  spec: TokenRequestSpec<TName, TSuccessKind>,
-  opts: TokenRequestOptions,
-) {
-  const ttl = opts.tokenTtlMinutes ?? spec.defaultTtlMinutes;
-
-  return defineWriteHandler<TName, typeof RequestTokenSchema, TokenRequestData<TSuccessKind>>({
-    name: spec.handlerName,
-    schema: RequestTokenSchema,
-    access: { roles: ["anonymous"] },
-    rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-    escapeHatch: {
-      reason:
-        "Anonymous requester has no session — looks up the target user by email via " +
-        "ctx.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",
-    },
-    description: spec.description,
-    handler: async (event, ctx) => {
-      if (!opts.hmacSecret) {
-        // Feature-factory guards this at boot; defensive here for lazy-
-        // provided secrets that show up empty at runtime.
-        return writeFailure(
-          new UnprocessableError(spec.notConfiguredError, {
-            i18nKey: spec.notConfiguredI18nKey,
-          }),
-        );
-      }
-
-      const systemUser = createSystemUser(event.user.tenantId);
-
-      const user = parseAuthUserRow(
-        await ctx.queryAs(systemUser, UserQueries.findForAuth, {
-          email: event.payload.email,
-        }),
-      );
-
-      // Silent-success branches all return the SAME shape with kind="no-op".
-      // Response-level timing stays uniform (200 / isSuccess: true); the
-      // small difference in handler-internal work is accepted — no probing
-      // client can observe it through the HTTP surface.
-      if (!user || user.isDeleted || !user.email || spec.extraSilentSkip(user)) {
-        const data: TokenRequestData<TSuccessKind> = { kind: "no-op" };
-        // skip: silent no-op — uniform response prevents user-enumeration probing
-        return { isSuccess: true, data };
-      }
-
-      const { token, expiresAt } = spec.sign(user.id, ttl, opts.hmacSecret);
-
-      const locale = resolveHandlerMailLocale(ctx, opts.locale);
-
-      await dispatchMagicLinkMail(
-        ctx.notify,
-        {
-          handlerName: spec.handlerName,
-          notificationType: spec.notificationType,
-          renderContent: spec.renderContent,
-        },
-        {
-          // Row value is ciphertext with an active KMS; the byte-exact
-          // lookup above guarantees the payload IS the stored plaintext.
-          email: event.payload.email,
-          appUrl: opts.appUrl,
-          token,
-          expiresAt: expiresAt.toString(),
-          ...(opts.appName !== undefined && { appName: opts.appName }),
-          locale,
-        },
-      );
-
-      const data: TokenRequestData<TSuccessKind> = {
-        kind: spec.successKind,
-        email: event.payload.email,
-        token,
-        expiresAt: expiresAt.toString(),
-      };
-      return { isSuccess: true, data };
-    },
-  });
-}

package/src/auth-email-password/handlers/verify-email.write.ts

@@ -1,62 +0,0 @@
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import * as z from "zod";
-import { AuthErrors } from "../constants";
-import { invalidVerificationToken } from "../errors";
-import { verifyVerificationToken } from "../verification-token";
-import { runConfirmTokenFlow } from "./confirm-token-flow";
-
-export type VerifyEmailOptions = {
-  readonly hmacSecret: string;
-};
-
-const VerifyEmailSchema = z.object({
-  token: z.string().min(1),
-});
-
-export type VerifyEmailData = { readonly kind: "verified" } | { readonly kind: "already-verified" };
-
-// Sets user.emailVerified = true on a valid token. Idempotent via the
-// `alreadyDone` short-circuit — when the row already reads verified
-// (reached through another flow), we skip the write but keep the burn
-// so replays still see invalid_verification_token on the burn check.
-// Sessions are NOT revoked on verification — no security reason to
-// nuke active logins when a user finally confirms their address.
-export function createVerifyEmailHandler(opts: VerifyEmailOptions) {
-  return defineWriteHandler<"verify-email", typeof VerifyEmailSchema, VerifyEmailData>({
-    name: "verify-email",
-    schema: VerifyEmailSchema,
-    access: { roles: ["anonymous"] },
-    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
-    escapeHatch: {
-      reason:
-        "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
-        "target user via ctx.writeAs(SYSTEM, user:update) to set emailVerified.",
-    },
-    agent: { expose: false },
-    handler: async (event, ctx) => {
-      if (!opts.hmacSecret) {
-        return writeFailure(
-          new UnprocessableError(AuthErrors.verificationNotConfigured, {
-            i18nKey: "auth.errors.verificationNotConfigured",
-          }),
-        );
-      }
-
-      const verify = verifyVerificationToken(event.payload.token, opts.hmacSecret);
-      if (!verify.ok) return invalidVerificationToken();
-
-      return runConfirmTokenFlow<VerifyEmailData>(ctx, verify.userId, verify.expiresAtMs, {
-        purpose: "verify",
-        redisRequiredMessage: "email-verification requires ctx.redis to enforce token single-use",
-        invalidToken: invalidVerificationToken,
-        buildChanges: async () => ({ emailVerified: true }),
-        successData: { kind: "verified" },
-        alreadyDone: {
-          check: (me) => me.emailVerified === true,
-          data: { kind: "already-verified" },
-        },
-      });
-    },
-  });
-}

package/src/auth-email-password/i18n.ts

@@ -1,151 +0,0 @@
-// @runtime client
-// English UI copy for this feature. emailPasswordClient() mounts it as a
-// LocaleProvider fallback. Apps override keys via
-// `emailPasswordClient({ translations })`. German/Spanish ship in
-// localeDeClient() / localeEsClient(), not in this bundle.
-//
-// Keys: `auth.<area>.<slug>` — `auth.login.*` for the form,
-// `auth.errors.*` for login-handler reason codes (mirrors AuthErrors).
-
-import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-
-export const defaultTranslations: TranslationsByLocale = {
-  en: {
-    "auth.login.title": "Sign in",
-    "auth.login.email": "Email",
-    "auth.login.password": "Password",
-    "auth.login.submit": "Sign in",
-    "auth.login.submitting": "…",
-    "auth.login.forgotPassword": "Forgot password?",
-    "auth.login.unlockAccount": "Unlock account?",
-    "auth.login.resendVerification": "Send verification email again",
-    "auth.login.resendSuccess": "We've sent you a new verification email.",
-    "auth.login.resendRateLimited": "Please wait a moment and try again.",
-    "auth.login.resendError": "Could not send. Please try again.",
-    "auth.errors.invalidCredentials": "Invalid email or password.",
-    "auth.errors.noMembership": "This account has no tenant access.",
-    "auth.errors.accountLocked": "Account temporarily locked.",
-    "auth.errors.accountLockedRetry": "Account locked. Try again in {minutes} minutes.",
-    "auth.errors.emailNotVerified": "Email address not yet verified.",
-    "auth.errors.accountRestricted":
-      "Account paused (GDPR Art. 18). Please lift the restriction to sign in again.",
-    "auth.errors.rateLimited": "Too many login attempts. Please wait briefly.",
-    "auth.errors.invalidBody": "Invalid input.",
-    "auth.errors.loginFailed": "Login failed.",
-    "auth.errors.mfaNotSupported":
-      "This app doesn't support two-factor verification. Please contact support.",
-    "auth.errors.mfaSetupRequired":
-      "Two-factor authentication required. Please contact your administrator.",
-    "auth.errors.invalidResetToken": "Link is invalid or expired. Please request a new one.",
-    "auth.errors.invalidVerificationToken": "Verification link is invalid or expired.",
-    "auth.errors.invalidUnlockToken":
-      "Unlock link is invalid or expired. Please request a new one.",
-    "auth.errors.invalidSignupToken":
-      "Activation link is invalid or expired. Please request a new one.",
-    "auth.errors.signupEmailAlreadyRegistered":
-      "An account already exists for this email. Please sign in or reset your password.",
-    "auth.errors.unknownError": "Something went wrong. Please try again.",
-    "auth.errors.originNotAllowed": "Requests from this origin are not allowed.",
-    "auth.forgotPassword.title": "Reset password",
-    "auth.forgotPassword.intro":
-      "Enter your email. If an account exists, we'll send you a reset link.",
-    "auth.forgotPassword.email": "Email",
-    "auth.forgotPassword.submit": "Request link",
-    "auth.forgotPassword.submitting": "…",
-    "auth.forgotPassword.successTitle": "Email sent",
-    "auth.forgotPassword.successBody":
-      "If your email exists in our system, a reset link is on its way. Please check your inbox.",
-    "auth.forgotPassword.backToLogin": "Back to sign in",
-    "auth.resetPassword.title": "Set new password",
-    "auth.resetPassword.intro": "Choose a new password (at least 8 characters).",
-    "auth.resetPassword.newPassword": "New password",
-    "auth.resetPassword.confirmPassword": "Confirm password",
-    "auth.resetPassword.mismatch": "Passwords do not match.",
-    "auth.resetPassword.tooShort": "Password must be at least 8 characters.",
-    "auth.resetPassword.submit": "Save password",
-    "auth.resetPassword.submitting": "…",
-    "auth.resetPassword.successTitle": "Password set",
-    "auth.resetPassword.successBody": "You can now sign in with your new password.",
-    "auth.resetPassword.goToLogin": "Go to sign in",
-    "auth.resetPassword.missingToken": "Reset link is missing a token. Please request a new one.",
-    "auth.verifyEmail.verifying": "Verifying email …",
-    "auth.verifyEmail.successTitle": "Email verified",
-    "auth.verifyEmail.successBody": "Thanks! You can sign in now.",
-    "auth.verifyEmail.errorTitle": "Verification failed",
-    "auth.verifyEmail.errorBody":
-      "Link is invalid or expired. Please request a new verification email.",
-    "auth.verifyEmail.goToLogin": "Go to sign in",
-    "auth.verifyEmail.missingToken": "Verification link is missing a token.",
-    "auth.requestUnlock.title": "Unlock account",
-    "auth.requestUnlock.intro":
-      "Enter your email address. If your account is locked, we'll send you an unlock link.",
-    "auth.requestUnlock.email": "Email",
-    "auth.requestUnlock.submit": "Request link",
-    "auth.requestUnlock.submitting": "…",
-    "auth.requestUnlock.successTitle": "Email sent",
-    "auth.requestUnlock.successBody":
-      "If that email exists in our system and is locked, a message with an unlock link is on its way. Please check your inbox.",
-    "auth.requestUnlock.backToLogin": "Back to sign in",
-    "auth.requestUnlock.rateLimited": "Too many requests. Try again in {minutes} minutes.",
-    "auth.unlockAccount.verifying": "Unlocking account …",
-    "auth.unlockAccount.successTitle": "Account unlocked",
-    "auth.unlockAccount.successBody": "Your account is unlocked again. You can sign in now.",
-    "auth.unlockAccount.errorTitle": "Unlock failed",
-    "auth.unlockAccount.errorBody": "Link is invalid or expired. Please request a new unlock link.",
-    "auth.unlockAccount.goToLogin": "Go to sign in",
-    "auth.unlockAccount.missingToken": "Unlock link is missing a token.",
-    "auth.signup.title": "Create account",
-    "auth.signup.intro":
-      "Enter your email. We'll send you an activation link to set your password.",
-    "auth.signup.email": "Email",
-    "auth.signup.submit": "Send activation link",
-    "auth.signup.submitting": "…",
-    "auth.signup.successTitle": "Email sent",
-    "auth.signup.successBody":
-      "We've sent you an activation link. Click it to set your password and sign in.",
-    "auth.signup.resend": "Send email again",
-    "auth.signup.haveAccount": "Already have an account? Sign in",
-    "auth.signupComplete.title": "Set password",
-    "auth.signupComplete.intro": "Choose a password (at least 8 characters) for your new account.",
-    "auth.signupComplete.password": "Password",
-    "auth.signupComplete.confirmPassword": "Confirm password",
-    "auth.signupComplete.tooShort": "Password must be at least 8 characters.",
-    "auth.signupComplete.mismatch": "Passwords do not match.",
-    "auth.signupComplete.submit": "Activate account",
-    "auth.signupComplete.submitting": "…",
-    "auth.signupComplete.missingToken":
-      "Activation link is missing a token. Please request a new one.",
-    "auth.signupComplete.activatedTitle": "Account activated",
-    "auth.signupComplete.activated": "Your account is active and you're signed in.",
-    "auth.signupComplete.continue": "Continue",
-    "auth.inviteAccept.title": "Accept invitation",
-    "auth.inviteAccept.intro": "You've been invited to a workspace. Click 'Accept' to join.",
-    "auth.inviteAccept.loggedInAs": "Signed in as {email}",
-    "auth.inviteAccept.email": "Email",
-    "auth.inviteAccept.password": "Password",
-    "auth.inviteAccept.acceptButton": "Accept",
-    "auth.inviteAccept.submit": "Accept + sign in",
-    "auth.inviteAccept.submitting": "…",
-    "auth.inviteAccept.useOtherAccount": "Sign in with a different account",
-    "auth.inviteAccept.toggleNew": "I don't have an account yet",
-    "auth.inviteAccept.toggleExisting": "I already have an account",
-    "auth.inviteAccept.missingToken": "The invitation link is missing or invalid.",
-    "auth.inviteAccept.goToLogin": "Go to sign in",
-    "auth.sessionBootstrap.errorTitle": "Couldn't load your session",
-    "auth.sessionBootstrap.errorBody":
-      "The server could not be reached or returned an error. Please try again.",
-    "auth.sessionBootstrap.rateLimitedBody":
-      "Too many requests in a short time. Please wait a moment and try again.",
-    "auth.sessionBootstrap.retry": "Try again",
-    "auth.sessionBootstrap.retrying": "Retrying…",
-    "auth.user.menu.label": "Account",
-    "auth.user.menu.logout": "Sign out",
-    "auth.tenant.switcher.label": "Tenant",
-    "auth.tenant.switcher.none": "No tenant",
-  },
-};
-
-// Kanonische Implementierung lebt jetzt im Renderer (neben
-// TranslationsByLocale) — Re-Export hält die bestehende Import-Surface
-// (auth-email-password/web) stabil.
-export { mergeTranslations } from "@cosmicdrift/kumiko-renderer";

package/src/auth-email-password/index.ts

@@ -1,47 +0,0 @@
-// Convention paths for the auth pages (reset/verify/signup/invite); apps build
-// their magic-link appUrls from these. All mail now goes through delivery.
-
-// Kept as a public re-export (not just internal call sites) — this feature's
-// barrel is where consumers of the published package have always found
-// hashPassword/verifyPassword; removing it is a breaking change that needs
-// its own changeset + deliberate deprecation window, not a silent drop.
-export { hashPassword, verifyPassword } from "../shared/password-hashing";
-export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths";
-export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants";
-// Renderers for the auth mails. All four magic-link flows (reset, verify,
-// signup-activation, invite) emit structured AuthMailContent through delivery
-// (ctx.notify).
-export type {
-  AuthMailContent,
-  AuthMailLocale,
-  AuthMailSection,
-  RenderInviteEmailArgs,
-  RenderTokenContentArgs,
-} from "./email-templates";
-export {
-  renderActivationEmail,
-  renderInviteEmail,
-  renderResetPasswordEmail,
-  renderUnlockAccountEmail,
-  renderVerifyEmail,
-} from "./email-templates";
-export type {
-  AccountLockoutOptions,
-  AccountUnlockOptions,
-  AuthEmailPasswordOptions,
-  EmailVerificationOptions,
-  InviteOptions,
-  PasswordResetOptions,
-  SignupOptions,
-} from "./feature";
-export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature";
-export {
-  AUTH_SELF_REGISTRATION_FEATURE,
-  createAuthSelfRegistrationToggleFeature,
-} from "./self-registration-toggle";
-// Generic HMAC-signed single-purpose token helpers. Re-exported damit
-// app-spezifische out-of-band-Flows (subscriber-confirm, magic-links,
-// invite-tokens) denselben battle-tested signer/verifier nutzen können
-// statt eigene HMAC-Logik zu duplizieren. Purpose-string diskriminiert
-// Cross-Replay zwischen Flows.
-export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token";

package/src/auth-email-password/invite-token-store.ts

@@ -1,78 +0,0 @@
-// Redis-backed token store for the tenant-invite magic-link flow.
-//
-// Subject is the invitation row ID (DB-row owner: tenant-feature). The
-// store mechanics (bidirectional token↔subject mapping, sha256-hashed
-// keys, single-use burn) live in shared/single-use-token-store.ts — this
-// file only wires the invite key prefixes onto it.
-//
-// Unlike signup-token-store we don't rely on the store's reverse lookup for
-// reuse-detection: resend-idempotency lives at the invitation-row level (an
-// admin inviting the same email twice reuses the existing row and mints a
-// fresh token; invite-create looks up the *previous* token's hash via the
-// by-id entry to invalidate it before storing the new one). The by-id entry
-// is still useful for cancel: the admin knows row.id and needs the forward
-// key to delete it.
-//
-// Bug pattern: TTL lives only in Redis. DB-row.expiresAt is UI display
-// only. On an expired token, invite-accept doesn't find it → invalid-
-// invite-token. The DB row stays status="pending" — a cleanup job marks it
-// "expired" (separate concern, tracked in U.3-cleanup).
-//
-// No collision with signup/reset/verify tokens: all invite keys carry the
-// `invite:`-prefix.
-
-import type Redis from "ioredis";
-import { createSingleUseTokenStore } from "../shared";
-
-const store = createSingleUseTokenStore({
-  tokenPrefix: "invite:by-token:",
-  subjectPrefix: "invite:by-id:",
-  burnPrefix: "invite:burn:",
-});
-
-/** Stores the pair bidirectionally and sets TTL on both keys.
- *  Idempotent — re-writing the same token-invitation pair is fine
- *  (refreshes the TTL for resend). */
-export async function storeInviteToken(
-  redis: Redis,
-  args: { invitationId: string; token: string; ttlSeconds: number },
-): Promise<void> {
-  return store.store(redis, {
-    subjectId: args.invitationId,
-    token: args.token,
-    ttlSeconds: args.ttlSeconds,
-  });
-}
-
-/** Lookup: invitationId for a token. Null if the token no longer exists
- *  (expired, already consumed, or invalid). */
-export const getInvitationIdForToken = store.getSubjectForToken;
-
-/** Deletes a still-live invite token for this invitation, if one exists.
- *  Two callers: invite-create on every resend (a fresh token + by-id entry
- *  follows right after, so this is "at most one live token per
- *  invitation"), and cancel-invitation (no replacement follows, so this is
- *  full cleanup). */
-export async function invalidateExistingInviteToken(
-  redis: Redis,
-  invitationId: string,
-): Promise<boolean> {
-  return store.invalidateExistingBySubject(redis, invitationId);
-}
-
-/** Single-use burn. If two tabs click the accept link at the same time,
- *  the first one wins, the second gets "already-used". TTL = 1h. */
-export const burnInviteToken = store.burn;
-
-/** Cleanup after a successful accept OR cancel — deletes both lookup
- *  keys. The burn key stays for the remaining burn TTL as replay protection. */
-export async function deleteInviteToken(
-  redis: Redis,
-  args: { invitationId: string; token: string },
-): Promise<void> {
-  return store.deleteBoth(redis, { subjectId: args.invitationId, token: args.token });
-}
-
-/** Burn release for failed-accept paths (DB error etc.) so a legitimate
- *  retry isn't blocked by a stale burn marker. */
-export const unburnInviteToken = store.unburn;

package/src/auth-email-password/lockout-store.ts

@@ -1,34 +0,0 @@
-// Redis-backed account-lockout state for the login handler.
-//
-// Why Redis, not DB? The login handler returns WriteFailure on bad
-// credentials — the dispatcher rolls back the whole transaction, which
-// would wipe a DB-based counter-update alongside the "invalid credentials"
-// response. Redis operations run outside the DB tx and survive the rollback.
-// Consistent with token-burn-store.ts, which uses Redis for the same reason
-// (state that must persist regardless of the handler's WriteResult).
-//
-// Persistence note: in prod, configure Redis with AOF or RDB so lockout
-// state survives Redis restart. Without persistence, a restart resets every
-// active counter — an attacker could exploit the gap, though the IP-level
-// rate-limiter (framework rate-limit) is the parallel defense for that
-// case anyway.
-//
-// The counter mechanics (race-free INCR/NX, TTL rules, monotonic-counter
-// semantics) live in shared/lockout-counter.ts — this file only wires the
-// account-lockout key prefixes onto it. See that file for why a lock
-// re-arms immediately after expiry, and why a successful login (or the
-// account-unlock magic-link flow, #1266, see
-// handlers/confirm-account-unlock.write.ts) is what resets the streak.
-
-import { createLockoutCounter, type LockoutCounterState } from "../shared";
-
-export type LockoutState = LockoutCounterState;
-
-const COUNT_KEY_PREFIX = "kumiko:auth:lockout:count:";
-const UNTIL_KEY_PREFIX = "kumiko:auth:lockout:until:";
-
-const counter = createLockoutCounter(COUNT_KEY_PREFIX, UNTIL_KEY_PREFIX);
-
-export const getLockoutState = counter.getState;
-export const recordFailedAttempt = counter.recordFailedAttempt;
-export const clearLockoutState = counter.clearState;

package/src/auth-email-password/magic-link-mail.ts

@@ -1,87 +0,0 @@
-// Shared dispatch for the magic-link mails (password-reset, email-verification,
-// signup-activation). All three follow the same delivery shape: append the
-// token to the app page, render structured content, and notify the recipient
-// email directly (route:{email} skips preferences — the recipient may not have
-// a user account yet — and critical priority keeps a security mail
-// non-unsubscribable). No r.notification is declared; buildMessage falls back
-// to the structured `data` for the renderer.
-
-import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
-import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "./email-templates";
-
-// Per-flow constants: which notification type to dispatch and how to render the
-// body. renderContent is the flow's template (renderResetPasswordEmail / … /
-// renderActivationEmail), all unified on RenderTokenContentArgs → AuthMailContent.
-export type MagicLinkMailSpec = {
-  readonly handlerName: string;
-  readonly notificationType: string;
-  readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
-};
-
-// Per-request values: the recipient + the app page that receives the token, plus
-// optional presentation. appUrl is the bare page URL; the token is appended here.
-// appUrl as a function lets apps with language-in-path routing (/de/activate,
-// /en/activate) pick the right page for `locale` — the mail is the only
-// channel that survives a device switch (signup on desktop, open on mobile),
-// so this is the last point where the language can still reach the link.
-export type MagicLinkMailParams = {
-  readonly email: string;
-  readonly appUrl: string | ((locale: string) => string);
-  readonly token: string;
-  readonly expiresAt: string;
-  readonly appName?: string;
-  readonly locale?: AuthMailLocale;
-};
-
-function resolveAppUrl(appUrl: string | ((locale: string) => string), locale: string): string {
-  return typeof appUrl === "function" ? appUrl(locale) : appUrl;
-}
-
-function appendToken(appUrl: string, token: string): string {
-  const sep = appUrl.includes("?") ? "&" : "?";
-  return `${appUrl}${sep}token=${encodeURIComponent(token)}`;
-}
-
-// X-Locale on the request wins over the handler's static opts.locale, then
-// ctx.locale's resolved default (always set — boot default / "en"). Reading
-// requestContext is load-bearing: ctx.locale alone cannot tell whether THIS
-// request carried a locale signal.
-export function resolveHandlerMailLocale(
-  ctx: { readonly locale?: string },
-  optsLocale: string | undefined,
-): string | undefined {
-  return requestContext.get()?.locale ?? optsLocale ?? ctx.locale;
-}
-
-export async function dispatchMagicLinkMail(
-  notify: NotifyFn | undefined,
-  spec: MagicLinkMailSpec,
-  params: MagicLinkMailParams,
-): Promise<void> {
-  // delivery is a hard requirement when a magic-link flow is mounted (see
-  // feature.ts r.requires), so notify is always wired — this guard is a
-  // defensive boot-invariant, not a runtime branch.
-  if (!notify) {
-    throw new InternalError({
-      message: `${spec.handlerName}: ctx.notify unavailable — the delivery feature must be mounted`,
-    });
-  }
-  const locale = params.locale ?? "en";
-  // mailT already root-falls-back; appUrl must use the same negotiated tag
-  // or language-in-path apps 404 on e.g. /de-AT/activate.
-  const urlLocale = resolveMailLocale(locale);
-  const content = spec.renderContent({
-    url: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
-    expiresAt: params.expiresAt,
-    ...(params.locale !== undefined && { locale: params.locale }),
-    ...(params.appName !== undefined && { appName: params.appName }),
-  });
-  await notify(spec.notificationType, {
-    route: { email: params.email },
-    data: content,
-    priority: "critical",
-  });
-}