@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.336.0

package/dist/admin-shell/overview-panels.js

@@ -114,7 +114,7 @@ export function platformOverviewPanels(metrics) {
         }),
         recentFailuresList(JobQueries.list, { status: "failed", sort: "startedAt", sortDirection: "desc", limit: 5 }, [
             { field: "jobName", label: `${I}.col.job` },
-            { field: "startedAt", label: `${I}.col.startedAt` },
+            { field: "startedAt", label: `${I}.col.startedAt`, display: "datetime" },
         ], "full"),
     ];
 }
@@ -161,7 +161,7 @@ export function tenantOverviewPanels(metrics, options) {
         recentFailuresList(JobQueries.failures, { limit: 5 }, [
             { field: "jobName", label: `${I}.col.job` },
             { field: "messageKey", label: `${I}.col.reason` },
-            { field: "failedAt", label: `${I}.col.failedAt` },
+            { field: "failedAt", label: `${I}.col.failedAt`, display: "datetime" },
         ], "half"),
     ];
 }

package/dist/agent-tools/agent-doc-lint.d.ts

@@ -1,5 +1,6 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export declare const AgentDocGapKinds: {
+    readonly handlerSchemaNotExpressible: "handler-schema-not-expressible";
     readonly handlerWithoutDescription: "handler-without-description";
     readonly customScreenWithoutDescription: "custom-screen-without-description";
     readonly exposedEntityWithoutDescription: "exposed-entity-without-description";

package/dist/agent-tools/agent-doc-lint.js

@@ -1,5 +1,7 @@
 import { isAgentVisibleScreen, QnTypes, qn, resolveAgentExposure, toKebab, } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
 export const AgentDocGapKinds = {
+    handlerSchemaNotExpressible: "handler-schema-not-expressible",
     handlerWithoutDescription: "handler-without-description",
     customScreenWithoutDescription: "custom-screen-without-description",
     exposedEntityWithoutDescription: "exposed-entity-without-description",
@@ -15,16 +17,44 @@ const ENTITY_QN_SEGMENT = "entity";
 function compareByCodePoint(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;
 }
+// agent-manifest.ts silently drops an exposed handler whose schema can't be
+// converted; surface it here so the missing tool doesn't go unnoticed.
+function schemaNotExpressibleGap(feature, handlerQn, def, handlerNoun) {
+    try {
+        z.toJSONSchema(def.schema, { io: "input" });
+        return undefined;
+    }
+    catch (error) {
+        return {
+            qn: handlerQn,
+            feature: feature.name,
+            kind: AgentDocGapKinds.handlerSchemaNotExpressible,
+            message: `This ${handlerNoun} is exposed to the AI agent but its input schema can't be converted to JSON Schema (${error instanceof Error ? error.message : String(error)}), so it is left out of the agent manifest.`,
+        };
+    }
+}
 function handlerDocGaps(feature, handlers, handlerQnType, handlerNoun) {
     const gaps = [];
+    const handlerKind = handlerQnType === QnTypes.write ? "write" : "query";
     for (const [name, def] of Object.entries(handlers)) {
-        if (def.description !== undefined || def.agent?.expose === false)
+        const handlerQn = qn(toKebab(feature.name), handlerQnType, toKebab(name));
+        const isExposed = resolveAgentExposure(def, handlerKind).expose;
+        if (isExposed) {
+            const schemaGap = schemaNotExpressibleGap(feature, handlerQn, def, handlerNoun);
+            if (schemaGap)
+                gaps.push(schemaGap);
+        }
+        if (def.agent?.expose === false)
+            continue;
+        if (def.description !== undefined && def.description.trim() !== "")
             continue;
         gaps.push({
-            qn: qn(toKebab(feature.name), handlerQnType, toKebab(name)),
+            qn: handlerQn,
             feature: feature.name,
             kind: AgentDocGapKinds.handlerWithoutDescription,
-            message: `This ${handlerNoun} has no description, so it stays invisible to the AI agent — set \`description\` to expose it, or \`agent: { expose: false }\` to opt out deliberately.`,
+            message: isExposed
+                ? `This ${handlerNoun} is exposed to the AI agent but has no usable description, so the agent sees an empty tool text — set a non-empty \`description\`, or \`agent: { expose: false }\` to opt out deliberately.`
+                : `This ${handlerNoun} has no description, so it stays invisible to the AI agent — set \`description\` to expose it, or \`agent: { expose: false }\` to opt out deliberately.`,
         });
     }
     return gaps;

package/dist/agent-tools/agent-manifest.js

@@ -1,4 +1,4 @@
-import { hasAccess, isAgentVisibleScreen, resolveAgentExposure, } from "@cosmicdrift/kumiko-framework/engine";
+import { hasAccess, isAgentVisibleScreen, resolveAgentExposure, SYSTEM_ONLY_JSON_SCHEMA_KEY, } from "@cosmicdrift/kumiko-framework/engine";
 import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
 import * as z from "zod";
 /** The manifest surfaces one string per locale — a plural entry reads as its
@@ -92,6 +92,24 @@ function buildFeatures(features) {
     }
     return result;
 }
+// Agent dispatch never runs as a system identity, so properties the engine only
+// honors for system callers would be silently dropped — hide them from the tool.
+function withoutSystemOnlyProperties(jsonSchema) {
+    const properties = jsonSchema["properties"];
+    if (typeof properties !== "object" || properties === null)
+        return jsonSchema;
+    const hidden = Object.entries(properties)
+        .filter(([, property]) => property[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true)
+        .map(([name]) => name);
+    if (hidden.length === 0)
+        return jsonSchema;
+    const required = jsonSchema["required"];
+    return {
+        ...jsonSchema,
+        properties: Object.fromEntries(Object.entries(properties).filter(([name]) => !hidden.includes(name))),
+        ...(Array.isArray(required) && { required: required.filter((name) => !hidden.includes(name)) }),
+    };
+}
 function buildHandlerEntry(qn, kind, def, roles, getHandlerEntity, denyQns) {
     if (denyQns.has(qn))
         return undefined;
@@ -108,7 +126,7 @@ function buildHandlerEntry(qn, kind, def, roles, getHandlerEntity, denyQns) {
         // A handler whose schema can't be expressed as JSON Schema (transforms,
         // z.instanceof, ...) is unusable for an agent tool call — leave it out
         // rather than ship a broken tool.
-        inputSchema = z.toJSONSchema(def.schema, { io: "input" });
+        inputSchema = withoutSystemOnlyProperties(z.toJSONSchema(def.schema, { io: "input" }));
     }
     catch {
         return undefined;
@@ -137,6 +155,16 @@ function buildHandlers(queryHandlers, writeHandlers, roles, getHandlerEntity, de
     }
     return result;
 }
+// A typo or a QN renamed by a framework update would otherwise deny nothing
+// and leave the handler exposed without anyone noticing.
+function assertDenyQnsExist(denyQns, registry) {
+    const queryHandlers = registry.getAllQueryHandlers();
+    const writeHandlers = registry.getAllWriteHandlers();
+    const unknown = denyQns.filter((qn) => !queryHandlers.has(qn) && !writeHandlers.has(qn));
+    if (unknown.length > 0) {
+        throw new Error(`agent denyQns names handlers that are not registered: ${unknown.join(", ")}`);
+    }
+}
 function buildNavs(navs, workspaces, translations, roles, screens) {
     const result = [];
     for (const [, nav] of navs) {
@@ -159,13 +187,25 @@ function buildNavs(navs, workspaces, translations, roles, screens) {
             workspaces: visibleWorkspaces,
         });
     }
-    return result;
+    return withoutOrphanedNavs(result);
+}
+// A child under a parent hidden from this role would point at an id that
+// isn't in the manifest; hiding cascades down the whole subtree.
+function withoutOrphanedNavs(navs) {
+    let remaining = navs;
+    for (;;) {
+        const ids = new Set(remaining.map((nav) => nav.id));
+        const reachable = remaining.filter((nav) => nav.parent === undefined || ids.has(nav.parent));
+        if (reachable.length === remaining.length)
+            return remaining;
+        remaining = reachable;
+    }
 }
 function lastSegment(qualifiedId) {
     const idx = qualifiedId.lastIndexOf(":");
     return idx === -1 ? qualifiedId : qualifiedId.slice(idx + 1);
 }
-function buildScreens(screens, navs, workspaces, translations, roles) {
+function buildScreens(screens, navs, workspaces, translations, roles, visibleNavIds) {
     const allNavs = [...navs.values()];
     const result = [];
     for (const [, screen] of screens) {
@@ -174,7 +214,7 @@ function buildScreens(screens, navs, workspaces, translations, roles) {
         if (!isAgentVisibleScreen(screen))
             continue;
         const matchingNavs = allNavs.filter((nav) => nav.screen === screen.id);
-        const accessibleNavs = matchingNavs.filter((nav) => uiVisible(nav.access, roles));
+        const accessibleNavs = matchingNavs.filter((nav) => visibleNavIds.has(nav.id) && uiVisible(nav.access, roles));
         // A screen with no nav pointing at it is a detail view, reached only via
         // navigation from a list row — never hidden by nav/workspace gating.
         const reachable = matchingNavs.length === 0 ||
@@ -229,12 +269,13 @@ export function buildAgentManifest(registry, options) {
     const workspaceMap = registry.getAllWorkspaces();
     const navMap = registry.getAllNavs();
     const { roles } = options;
+    assertDenyQnsExist(options.denyQns ?? [], registry);
     const features = buildFeatures(registry.features);
     const entities = buildEntities(registry.getAllEntities(), translations, (name) => registry.getSearchableFields(name));
     const handlers = buildHandlers(registry.getAllQueryHandlers(), registry.getAllWriteHandlers(), roles, (qn) => registry.getHandlerEntity(qn), new Set(options.denyQns ?? []));
     const screenMap = registry.getAllScreens();
     const navs = buildNavs(navMap, workspaceMap, translations, roles, screenMap);
-    const screens = buildScreens(screenMap, navMap, workspaceMap, translations, roles);
+    const screens = buildScreens(screenMap, navMap, workspaceMap, translations, roles, new Set(navs.map((nav) => nav.id)));
     const workspaces = buildWorkspaces(workspaceMap, translations, roles);
     return {
         builtForRoles: [...roles],

package/dist/agent-tools/filter-ops.d.ts

@@ -0,0 +1,2 @@
+export declare const FILTER_OPS: readonly ["eq", "ne", "lt", "gt", "lte", "gte", "in"];
+export declare function isRecord(value: unknown): value is Record<string, unknown>;

package/dist/agent-tools/filter-ops.js

@@ -0,0 +1,4 @@
+export const FILTER_OPS = ["eq", "ne", "lt", "gt", "lte", "gte", "in"];
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/agent-tools/tool-catalog.js

@@ -1,5 +1,5 @@
 import { hasAccess } from "@cosmicdrift/kumiko-framework/engine";
-const FILTER_OPS = ["eq", "ne", "lt", "gt", "lte", "gte", "in"];
+import { FILTER_OPS, isRecord } from "./filter-ops.js";
 const MAX_TOOL_NAME_LENGTH = 64;
 /** Field types that declare `filterable` (per `packages/framework/src/engine/types/fields.ts`).
  *  Mapped to the JSON-Schema type an LLM tool-call argument should use. `undefined` = field type
@@ -173,9 +173,6 @@ function filterableFieldsOf(entity) {
 function compareByCodePoint(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function schemaRequiresField(schema, field) {
     const required = schema["required"];
     return Array.isArray(required) && required.includes(field);

package/dist/agent-tools/tool-dispatch.js

@@ -1,11 +1,8 @@
 import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/api";
+import { FILTER_OPS, isRecord } from "./filter-ops.js";
 const SEARCH_RESULT_LIMIT = 10;
 const DEFAULT_LIST_LIMIT = 10;
 const MAX_LIST_LIMIT = 200;
-const FILTER_OPS = ["eq", "ne", "lt", "gt", "lte", "gte", "in"];
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function isFilterOp(value) {
     return typeof value === "string" && FILTER_OPS.includes(value);
 }

package/dist/audit/constants.d.ts

@@ -1,7 +1,7 @@
 export declare const AUDIT_FEATURE: "audit";
 /** Literal `createdBy` written by hand-built system actors (secrets/jobs/…). */
 export declare const SYSTEM_ACTOR_ID: "system";
-/** Literal `createdBy` for anonymous / unauthenticated actors. */
+/** Literal `createdBy` for anonymous / unauthenticated actors. Duplicated from `/engine` on purpose: a value import would pull the engine into the client bundle; constants.test.ts guards against drift. */
 export declare const ANONYMOUS_USER_ID: "anonymous";
 /** All `createdBy` values that mean "system" in the audit UI (nil-UUID from createSystemUser + literal). */
 export declare const SYSTEM_ACTOR_IDS: ReadonlySet<string>;

package/dist/audit/constants.js

@@ -3,7 +3,7 @@
 export const AUDIT_FEATURE = "audit";
 /** Literal `createdBy` written by hand-built system actors (secrets/jobs/…). */
 export const SYSTEM_ACTOR_ID = "system";
-/** Literal `createdBy` for anonymous / unauthenticated actors. */
+/** Literal `createdBy` for anonymous / unauthenticated actors. Duplicated from `/engine` on purpose: a value import would pull the engine into the client bundle; constants.test.ts guards against drift. */
 export const ANONYMOUS_USER_ID = "anonymous";
 /** All `createdBy` values that mean "system" in the audit UI (nil-UUID from createSystemUser + literal). */
 export const SYSTEM_ACTOR_IDS = new Set([

package/dist/auth-email-password/handlers/change-password.write.js

@@ -20,6 +20,8 @@ export const changePasswordWrite = defineWriteHandler({
             "and writes the new hash via ctx.writeAs(SYSTEM, user:update) — the caller's own " +
             "identity can't reach either, field-access on passwordHash is privileged-only.",
     },
+    // Payload carries the old and new password.
+    agent: { expose: false },
     description: "Replaces the signed-in caller's own password after re-checking the current one; use it for a self-service password change rather than the emailed reset flow.",
     handler: async (event, ctx) => {
         const systemUser = createSystemUser(event.user.tenantId);

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -18,7 +18,7 @@
 // invite-create.
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, assignableAppRolesFromUsages, defineWriteHandler, EXT_ASSIGNABLE_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, assignableAppRolesOf, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
@@ -38,7 +38,17 @@ const InviteCreateSchema = z.object({
 const executor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, {
     entityName: "tenant-invitation",
 });
+// A framework-ranked role is one the highest actor ("system") may assign without the
+// unknown-role fail-closed rejection; allow-listing it would let a lower-ranked inviter
+// bypass the elevation guard for it.
+function findRankedRole(roles) {
+    return roles.find((role) => findForbiddenRoleAssignment(["system"], [role], []) === undefined);
+}
 export function createInviteCreateHandler(opts) {
+    const rankedRole = findRankedRole(opts.additionalAssignableRoles ?? []);
+    if (rankedRole !== undefined) {
+        throw new Error(`[auth-email-password] invite.additionalAssignableRoles must list app-defined roles only; "${rankedRole}" is a framework-ranked role`);
+    }
     const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES;
     const ttlSeconds = ttlMinutes * 60;
     return defineWriteHandler({
@@ -54,7 +64,7 @@ export function createInviteCreateHandler(opts) {
             if (forbiddenRole !== undefined) {
                 return writeFailure(reservedMembershipRoleError(forbiddenRole));
             }
-            const elevationForbidden = findForbiddenRoleAssignment(event.user.roles, [event.payload.role], [], assignableAppRolesFromUsages(ctx.registry.getExtensionUsages(EXT_ASSIGNABLE_ROLE)));
+            const elevationForbidden = findForbiddenRoleAssignment(event.user.roles, [event.payload.role], [], assignableAppRolesOf(ctx.registry));
             if (elevationForbidden !== undefined &&
                 !opts.additionalAssignableRoles?.includes(elevationForbidden)) {
                 return writeFailure(unassignableMembershipRoleError(elevationForbidden));

package/dist/auth-email-password/handlers/login.write.js

@@ -157,6 +157,8 @@ export function createLoginHandler(opts = {}) {
                 "enrollment of the tenant named in the signed login/setup token, not the guest " +
                 "dispatch tenant, via the mfaStatusChecker callback.",
         },
+        // Anonymous credential intake (password) — must never enter an LLM transcript.
+        agent: { expose: false },
         description: "Signs a user in with email and password, running the lockout, email-verification, account-status, tenant-membership and MFA gates, and answering with a session or with an MFA challenge or setup requirement.",
         handler: async (event, ctx) => {
             const systemUser = createSystemUser(SYSTEM_USER_ID);

package/dist/auth-email-password/handlers/self-registration-status.query.js

@@ -13,7 +13,7 @@ export const selfRegistrationStatusQuery = defineQueryHandler({
     name: "signup-registration-status",
     schema: z.object({}),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     description: "Reports whether self-registration is currently switched on, readable without signing in, so a signup page can hide its own form instead of collecting an address that would be silently ignored.",
     handler: async (_query, ctx) => {
         // Same fail-open reasoning as signup-request.write.ts (#1468): only

package/dist/auth-email-password/i18n.js

@@ -15,6 +15,7 @@ export const defaultTranslations = {
         "auth.login.submitting": "…",
         "auth.login.forgotPassword": "Forgot password?",
         "auth.login.unlockAccount": "Unlock account?",
+        "auth.login.sessionEnded": "Your session has ended. Please sign in again.",
         "auth.login.resendVerification": "Send verification email again",
         "auth.login.resendSuccess": "We've sent you a new verification email.",
         "auth.login.resendRateLimited": "Please wait a moment and try again.",
@@ -119,6 +120,7 @@ export const defaultTranslations = {
         "auth.sessionBootstrap.rateLimitedBody": "Too many requests in a short time. Please wait a moment and try again.",
         "auth.sessionBootstrap.retry": "Try again",
         "auth.sessionBootstrap.retrying": "Retrying…",
+        "auth.sessionBootstrap.signOut": "Sign out",
         "auth.user.menu.label": "Account",
         "auth.user.menu.logout": "Sign out",
         "auth.tenant.switcher.label": "Tenant",

package/dist/auth-email-password/web/auth-client.d.ts

@@ -45,6 +45,7 @@ export type LoginResult = {
     readonly kind: "failure";
     readonly error: LoginFailure;
 };
+export declare function toLoginResponse(token: string, user: LoginResponse["user"], landingPath: unknown): LoginResponse;
 export declare function login(req: LoginRequest): Promise<LoginResult>;
 export declare function logout(): Promise<void>;
 export type AuthTokenFailure = {

package/dist/auth-email-password/web/auth-client.js

@@ -33,7 +33,7 @@ export function parseRetryAfterSeconds(header) {
         return undefined;
     return Number(header);
 }
-function toLoginResponse(token, user, landingPath) {
+export function toLoginResponse(token, user, landingPath) {
     return typeof landingPath === "string" ? { token, user, landingPath } : { token, user };
 }
 // POST /api/auth/login. Success → token + user; MFA-enrolled user → a

package/dist/auth-email-password/web/auth-gate.js

@@ -30,7 +30,7 @@ export function createLoginRoute(opts = {}) {
     const MfaVerifyComponent = opts.mfaVerifyScreen;
     const MfaSetupComponent = opts.mfaSetupScreen;
     function LoginRoute() {
-        const { status, refresh, bootstrapFailure } = useSession();
+        const { status, refresh, bootstrapFailure, logout } = useSession();
         const { onAuthenticated } = opts;
         // Pending challenge-token from LoginScreen's onMfaChallenge. Lives here
         // (not in SessionState) because it's a UI-only transition — the server
@@ -46,7 +46,7 @@ export function createLoginRoute(opts = {}) {
             return (_jsx("div", { className: "min-h-screen flex items-center justify-center text-muted-foreground text-sm" }));
         }
         if (status === "error" && bootstrapFailure !== null) {
-            return _jsx(SessionBootstrapErrorScreen, { failure: bootstrapFailure, onRetry: refresh });
+            return (_jsx(SessionBootstrapErrorScreen, { failure: bootstrapFailure, onRetry: refresh, onSignOut: logout }));
         }
         // A standalone mount (no parent gate, no onAuthenticated wired — e.g. an
         // apex/marketing surface that just places <LoginRoute /> directly) has no
@@ -65,12 +65,10 @@ export function createLoginRoute(opts = {}) {
             return (_jsx(MfaSetupComponent, { preauthSetupToken: setupRequest.preauthSetupToken, accountLabel: setupRequest.accountLabel, onSuccess: () => {
                     // MfaSetupPreauthScreen has no session to refresh itself with
                     // (it runs pre-auth) — the gate owns the session, so it refreshes.
-                    // Keep setupRequest until refresh settles: clearing first would
-                    // dump the user back on the login form with no retry if refresh
-                    // rejects (cookie+JWT already minted server-side).
-                    void refresh().then(() => setSetupRequest(null), () => {
-                        // leave setupRequest set so the user can cancel/retry
-                    });
+                    // refresh() never rejects: a failed refresh surfaces as status
+                    // "error" (bootstrap error screen with retry), so only the
+                    // success path needs to clear setupRequest.
+                    void refresh().then(() => setSetupRequest(null));
                 }, onCancel: () => setSetupRequest(null) }));
         }
         return (_jsx(LoginComponent, { ...opts.loginScreenProps, onMfaChallenge: MfaVerifyComponent ? setChallengeToken : opts.loginScreenProps?.onMfaChallenge, onMfaSetupRequired: MfaSetupComponent

package/dist/auth-email-password/web/index.d.ts

@@ -1,6 +1,6 @@
 export { defaultTranslations, mergeTranslations } from "../i18n.js";
 export type { AuthTokenFailure, CurrentUserProfile, LoginFailure, LoginRequest, LoginResponse, ResetPasswordFailure, SignupConfirmSuccess, TenantSummary, VerifyEmailFailure, } from "./auth-client.js";
-export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, verifyEmail, } from "./auth-client.js";
+export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export type { AuthCardProps, AuthShellRenderer } from "./auth-form-primitives.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
 export type { LoginRouteOptions, MfaSetupComponentProps, MfaVerifyComponentProps, } from "./auth-gate.js";

package/dist/auth-email-password/web/index.js

@@ -5,7 +5,7 @@
 // `@cosmicdrift/kumiko-bundled-features/auth-email-password` und hat keine
 // React-/DOM-Deps. Trennung bleibt sauber so wie renderer vs renderer-web.
 export { defaultTranslations, mergeTranslations } from "../i18n.js";
-export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, verifyEmail, } from "./auth-client.js";
+export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";
 export { emailPasswordClient } from "./client-plugin.js";

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -42,6 +42,19 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     const [submitting, setSubmitting] = useState(false);
     const [error, setError] = useState(null);
     const effectiveTitle = title ?? t("auth.inviteAccept.title");
+    // The invitation is already consumed when the server answers with an MFA
+    // challenge / setup requirement, but no session cookie was minted: send the
+    // user to the login screen (now a member) instead of a tenant URL.
+    const finishAccept = (data) => {
+        if (data.mfaRequired === true || data.mfaSetupRequired === true) {
+            window.location.assign(loginHref);
+            return;
+        }
+        window.location.assign(resolvePostAuthHref(data.landingPath, loggedInHref, {
+            tenantId: data.tenantId,
+            roles: grantedRoles(data),
+        }));
+    };
     const acceptLoggedIn = async () => {
         setSubmitting(true);
         setError(null);
@@ -56,10 +69,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
         if (res.ok) {
             // @cast-boundary engine-payload — auth route JSON
             const data = (await res.json());
-            window.location.assign(resolvePostAuthHref(data.landingPath, loggedInHref, {
-                tenantId: data.tenantId,
-                roles: grantedRoles(data),
-            }));
+            finishAccept(data);
             return;
         }
         setError(t("auth.errors.invalidInviteToken"));
@@ -78,10 +88,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
         if (res.ok) {
             // @cast-boundary engine-payload — auth route JSON
             const data = (await res.json());
-            window.location.assign(resolvePostAuthHref(data.landingPath, loggedInHref, {
-                tenantId: data.tenantId,
-                roles: grantedRoles(data),
-            }));
+            finishAccept(data);
             return;
         }
         setError(t("auth.errors.invalidInviteToken"));
@@ -100,10 +107,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
         if (res.ok) {
             // @cast-boundary engine-payload — auth route JSON
             const data = (await res.json());
-            window.location.assign(resolvePostAuthHref(data.landingPath, loggedInHref, {
-                tenantId: data.tenantId,
-                roles: grantedRoles(data),
-            }));
+            finishAccept(data);
             return;
         }
         setError(t("auth.errors.invalidInviteToken"));

package/dist/auth-email-password/web/login-screen.js

@@ -113,7 +113,7 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
     };
     const effectiveTitle = title ?? t("auth.login.title");
     const effectiveSubmit = submitLabel ?? t("auth.login.submit");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "login-email", label: t("auth.login.email"), required: true, children: _jsx(Input, { kind: "email", id: "login-email", name: "login-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), _jsx(Field, { id: "login-password", label: t("auth.login.password"), required: true, children: _jsx(Input, { kind: "password", id: "login-password", name: "login-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "current-password" }) }), resendStatus.kind === "success" ? (_jsx(Banner, { variant: "info", children: t("auth.login.resendSuccess") })) : error !== null ? (_jsx(Banner, { variant: "error", children: _jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("span", { children: (() => {
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "login-email", label: t("auth.login.email"), required: true, children: _jsx(Input, { kind: "email", id: "login-email", name: "login-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), _jsx(Field, { id: "login-password", label: t("auth.login.password"), required: true, children: _jsx(Input, { kind: "password", id: "login-password", name: "login-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "current-password" }) }), session.signedOutReason === "session-ended" && (_jsx(Banner, { variant: "info", children: t("auth.login.sessionEnded") })), resendStatus.kind === "success" ? (_jsx(Banner, { variant: "info", children: t("auth.login.resendSuccess") })) : error !== null ? (_jsx(Banner, { variant: "error", children: _jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("span", { children: (() => {
                                             const { key, params } = reasonToKey(error);
                                             return t(key, params);
                                         })() }), error.reason === "email_not_verified" &&

package/dist/auth-email-password/web/session-bootstrap-error.d.ts

@@ -3,7 +3,11 @@ import type { SessionBootstrapFailure } from "./session.js";
 export type SessionBootstrapErrorScreenProps = {
     readonly failure: SessionBootstrapFailure;
     readonly onRetry: () => Promise<void>;
+    /** A permanent bootstrap failure (e.g. 403/500 on the membership query) would
+     *  otherwise trap the user: the HttpOnly session cookie can only be cleared
+     *  server-side. */
+    readonly onSignOut?: () => Promise<void>;
 };
 /** Retry delay measured from failure time, not click time. */
 export declare function retryDelayMs(failure: SessionBootstrapFailure, nowEpochMs: number): number;
-export declare function SessionBootstrapErrorScreen({ failure, onRetry, }: SessionBootstrapErrorScreenProps): ReactNode;
+export declare function SessionBootstrapErrorScreen({ failure, onRetry, onSignOut, }: SessionBootstrapErrorScreenProps): ReactNode;

package/dist/auth-email-password/web/session-bootstrap-error.js

@@ -14,7 +14,7 @@ function wait(ms) {
         return Promise.resolve();
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-export function SessionBootstrapErrorScreen({ failure, onRetry, }) {
+export function SessionBootstrapErrorScreen({ failure, onRetry, onSignOut, }) {
     const t = useTranslation();
     const { Banner, Button } = usePrimitives();
     const [retrying, setRetrying] = useState(false);
@@ -26,5 +26,5 @@ export function SessionBootstrapErrorScreen({ failure, onRetry, }) {
     };
     return (_jsx("div", { "data-testid": "session-bootstrap-error", "data-http-status": failure.httpStatus ?? "network", children: _jsx(AuthCard, { title: t("auth.sessionBootstrap.errorTitle"), children: _jsxs("div", { className: "flex flex-col gap-4 px-6 pb-4", children: [_jsx(Banner, { variant: "error", children: failure.httpStatus === 429
                             ? t("auth.sessionBootstrap.rateLimitedBody")
-                            : t("auth.sessionBootstrap.errorBody") }), _jsx(Button, { variant: "primary", onClick: handleRetry, disabled: retrying, children: retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry") })] }) }) }));
+                            : t("auth.sessionBootstrap.errorBody") }), _jsx(Button, { variant: "primary", onClick: handleRetry, disabled: retrying, children: retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry") }), onSignOut !== undefined && (_jsx(Button, { variant: "secondary", onClick: () => void onSignOut(), disabled: retrying, children: t("auth.sessionBootstrap.signOut") }))] }) }) }));
 }

package/dist/auth-email-password/web/session.d.ts

@@ -18,6 +18,10 @@ export type SessionState = {
      *  tenants[active].roles damit nav-filtering greift. Dedupliziert. */
     readonly roles: readonly string[];
     readonly bootstrapFailure: SessionBootstrapFailure | null;
+    /** Set when an authenticated session was ended server-side (revoked,
+     *  expired) so the login screen can explain why it appeared. Optional so
+     *  SessionApi values apps build themselves (test doubles) stay valid. */
+    readonly signedOutReason?: "session-ended" | null;
 };
 export type SessionApi = SessionState & {
     readonly login: (req: LoginRequest) => Promise<LoginResult>;

package/dist/auth-email-password/web/session.js

@@ -10,6 +10,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // unter `<SessionProvider>`; der `useSession()`-Hook liefert den State
 // und die Transitions.
 import { readCsrfToken } from "@cosmicdrift/kumiko-dispatcher-live";
+import { useSessionEndedSignal } from "@cosmicdrift/kumiko-renderer";
 import { createContext, useCallback, useContext, useEffect, useState } from "react";
 import { AuthRequestError, fetchCurrentUser, fetchTenants, login as loginApi, logout as logoutApi, switchTenant as switchTenantApi, } from "./auth-client.js";
 // Exported so screens that render on BOTH authenticated and anonymous public
@@ -23,6 +24,7 @@ export const UNAUTHENTICATED = {
     tenants: [],
     roles: [],
     bootstrapFailure: null,
+    signedOutReason: null,
 };
 const INITIAL = {
     status: "loading",
@@ -31,6 +33,7 @@ const INITIAL = {
     tenants: [],
     roles: [],
     bootstrapFailure: null,
+    signedOutReason: null,
 };
 // kumiko_auth ist HttpOnly — kumiko_csrf wird beim Login gemeinsam gesetzt.
 export function hasLikelyAuthSession(cookieSource) {
@@ -75,6 +78,7 @@ async function refresh() {
         tenants: tenants.tenants,
         roles: computeActiveRoles(user, tenants.activeTenantId, tenants.tenants),
         bootstrapFailure: null,
+        signedOutReason: null,
     };
 }
 // Non-AuthRequestError throws (offline, DNS, CORS) have no status, so httpStatus stays null.
@@ -104,6 +108,17 @@ export function SessionProvider({ children }) {
     useEffect(() => {
         void doRefresh();
     }, [doRefresh]);
+    const sessionEndedSignal = useSessionEndedSignal();
+    // Only an authenticated session can "end": an anonymous 401 on a public
+    // surface must not show the hint.
+    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    useEffect(() => {
+        return sessionEndedSignal?.subscribe(() => {
+            setState((prev) => prev.status === "authenticated"
+                ? { ...UNAUTHENTICATED, signedOutReason: "session-ended" }
+                : prev);
+        });
+    }, [sessionEndedSignal]);
     const login = useCallback(async (req) => {
         const res = await loginApi(req);
         if (res.kind === "success") {

package/dist/auth-mfa/feature.js

@@ -14,6 +14,7 @@ import { createMfaCodeVerifier } from "./mfa-code-verifier.js";
 import { createMfaStatusChecker } from "./mfa-status-checker.js";
 import { userMfaEntity } from "./schema/user-mfa.js";
 import { mfaDisableScreen, mfaEnableScreen, mfaRegenerateRecoveryScreen } from "./screens.js";
+const REENCRYPT_ESCAPE_HATCH_REASON = "re-encrypts MFA secrets of every tenant's users with the new master key";
 // Reads the late-bind setter off a mounted auth-mfa feature's exports —
 // mirrors sessions' own bindAutoRevokeFromFeature. run{Prod,Dev}App call
 // this once the sessions feature (if mounted) has produced a concrete
@@ -102,9 +103,9 @@ export function createAuthMfaFeature(opts) {
             name: "reencrypt",
             trigger: { manual: true },
             escapeHatch: {
-                reason: "re-encrypts MFA secrets of every tenant's users with the new master key",
+                reason: REENCRYPT_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => mfaReencryptJob(payload, ctx, ctx.db.unsafeRaw("re-encrypts MFA secrets of every tenant's users with the new master key")),
+            handler: (payload, ctx) => mfaReencryptJob(payload, ctx, ctx.db.unsafeRaw(REENCRYPT_ESCAPE_HATCH_REASON)),
         });
         r.entity("user-mfa", userMfaEntity);
         // Late-bound by run-prod-app once the sessions feature (if mounted) has

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -42,8 +42,8 @@ export function createEnableConfirmPreauthHandler(opts) {
                 "guest dispatch tenant.",
         },
         description: "Completes the enrollment that unblocks a sign-in forced into two-factor setup: verifies the code against the pre-auth setup token, stores the factor and derives the session the blocked login never got.",
-        // Changes the caller's authentication state and mints a session.
-        agent: { risk: "high" },
+        // Payload carries the pre-auth setup token and the TOTP code; the call mints a session.
+        agent: { expose: false },
         handler: async (event, ctx) => {
             const verify = verifyMfaSetupToken(event.payload.setupToken, opts.setupTokenSecret);
             if (!verify.ok)

package/dist/auth-mfa/handlers/status.query.js

@@ -12,6 +12,7 @@ import { userMfaTable } from "../schema/user-mfa.js";
 export const mfaStatusQuery = defineQueryHandler({
     name: "user-mfa:status",
     schema: z.object({}),
+    outputSchema: z.object({ enabled: z.boolean() }),
     access: {
         openToAll: {
             reason: "each signed-in user reads only their own MFA status; the query filters " +