@cosmicdrift/kumiko-bundled-features 0.337.1 → 0.339.0

package/dist/agent-tools/tool-catalog.js

@@ -1,4 +1,4 @@
-import { hasAccess } from "@cosmicdrift/kumiko-framework/engine";
+import { hasAccess, normalizeAccessEntry } from "@cosmicdrift/kumiko-framework/engine";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
 const MAX_TOOL_NAME_LENGTH = 64;
 /** Field types that declare `filterable` (per `packages/framework/src/engine/types/fields.ts`).
@@ -74,14 +74,28 @@ function isDetailHandlerQn(qn, entityName) {
 function isExplicitlyAgentHidden(def) {
     return def.agent?.expose === false;
 }
-function addToolsForListHandler(registry, qn, entityName, entity, sink) {
+/** The model's filters feed the WHERE clause, and only the output is field-filtered — a field
+ *  whose read access is role- or row-restricted would leak through `totalCount` and hit/miss
+ *  probing. Only fields every one of these roles may read without a row condition are offered. */
+function isReadableWithoutRowCondition(field, roles) {
+    const accessMap = normalizeAccessEntry(field.access?.read);
+    if (!accessMap || Object.keys(accessMap).length === 0)
+        return true;
+    return roles.every((role) => accessMap[role] === "all");
+}
+/** Entity CRUD tools are registry-derived, so an explicit `agent.risk` on the handler is read
+ *  here; without a hint the read tools stay "low". */
+function entityHandlerRisk(registry, qn) {
+    return registry.getAllQueryHandlers().get(qn)?.agent?.risk ?? "low";
+}
+function addToolsForListHandler(registry, qn, entityName, entity, roles, sink) {
     const searchableFields = registry.getSearchableFields(entityName);
     if (searchableFields.length > 0) {
         const tool = buildSearchTool(entityName, searchableFields);
         addTool(sink, tool, { kind: "search", entityName, qn });
     }
     for (const [fieldName, field] of Object.entries(entity.fields)) {
-        if (!isFilterable(field))
+        if (!isFilterable(field) || !isReadableWithoutRowCondition(field, roles))
             continue;
         const fieldSchema = jsonSchemaTypeForField(field);
         if (!fieldSchema)
@@ -98,7 +112,7 @@ function entityDisplayLabel(entity, entityName, locale) {
         return label;
     return entityName;
 }
-function buildGetTool(entityName, qn, label) {
+function buildGetTool(entityName, qn, label, risk) {
     return {
         tool: {
             name: `get_${entityName}`,
@@ -110,7 +124,7 @@ function buildGetTool(entityName, qn, label) {
                 additionalProperties: false,
             },
         },
-        descriptor: { kind: "server", op: "query", qn, risk: "low", entity: entityName, detail: true },
+        descriptor: { kind: "server", op: "query", qn, risk, entity: entityName, detail: true },
     };
 }
 function buildListInputSchema(searchableFields, filterableFields) {
@@ -140,7 +154,7 @@ function buildListInputSchema(searchableFields, filterableFields) {
     properties["limit"] = { type: "integer", minimum: 1, maximum: 200 };
     return { type: "object", properties, required: [], additionalProperties: false };
 }
-function buildListTool(entityName, qn, label, searchableFields, filterableFields) {
+function buildListTool(entityName, qn, label, searchableFields, filterableFields, risk) {
     const descriptionParts = [`List ${label} records.`];
     if (searchableFields.length > 0) {
         descriptionParts.push(`Free-text search over: ${searchableFields.join(", ")}.`);
@@ -159,16 +173,22 @@ function buildListTool(entityName, qn, label, searchableFields, filterableFields
             kind: "server",
             op: "query",
             qn,
-            risk: "low",
+            risk,
             entity: entityName,
             list: { searchableFields, filterableFields },
         },
     };
 }
-function filterableFieldsOf(entity) {
+function filterableFieldsOf(entity, definition, roles) {
     if (!entity)
         return [];
-    return entity.fields.filter((field) => field.filterable === true).map((field) => field.name);
+    return entity.fields
+        .filter((field) => field.filterable === true)
+        .map((field) => field.name)
+        .filter((name) => {
+        const fieldDefinition = definition?.fields[name];
+        return fieldDefinition !== undefined && isReadableWithoutRowCondition(fieldDefinition, roles);
+    });
 }
 function compareByCodePoint(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;
@@ -321,7 +341,7 @@ function addRegistrySearchTools(registry, roleFilter, denyQns, sink) {
         const entity = registry.getEntity(entityName);
         if (!entity)
             continue;
-        addToolsForListHandler(registry, qn, entityName, entity, sink);
+        addToolsForListHandler(registry, qn, entityName, entity, roleFilter.roles, sink);
     }
 }
 function collectEntityHandlerQns(registry, roleFilter, denyQns) {
@@ -352,21 +372,21 @@ function collectEntityHandlerQns(registry, roleFilter, denyQns) {
     }
     return { detailQnByEntity, listQnByEntity, entityListDetailQns };
 }
-function addGetTools(detailQnByEntity, entityByName, locale, sink) {
+function addGetTools(registry, detailQnByEntity, entityByName, locale, sink) {
     const getEntries = [...detailQnByEntity.entries()].sort((a, b) => compareByCodePoint(a[0], b[0]));
     for (const [entityName, qn] of getEntries) {
         const label = entityDisplayLabel(entityByName.get(entityName), entityName, locale);
-        const { tool, descriptor } = buildGetTool(entityName, qn, label);
+        const { tool, descriptor } = buildGetTool(entityName, qn, label, entityHandlerRisk(registry, qn));
         addTool(sink, tool, descriptor);
     }
 }
-function addListTools(registry, listQnByEntity, entityByName, locale, sink) {
+function addListTools(registry, listQnByEntity, entityByName, roles, locale, sink) {
     const listEntries = [...listQnByEntity.entries()].sort((a, b) => compareByCodePoint(a[0], b[0]));
     for (const [entityName, qn] of listEntries) {
         const label = entityDisplayLabel(entityByName.get(entityName), entityName, locale);
         const searchableFields = registry.getSearchableFields(entityName);
-        const filterableFields = filterableFieldsOf(entityByName.get(entityName));
-        const { tool, descriptor } = buildListTool(entityName, qn, label, searchableFields, filterableFields);
+        const filterableFields = filterableFieldsOf(entityByName.get(entityName), registry.getEntity(entityName), roles);
+        const { tool, descriptor } = buildListTool(entityName, qn, label, searchableFields, filterableFields, entityHandlerRisk(registry, qn));
         addTool(sink, tool, descriptor);
     }
 }
@@ -455,8 +475,8 @@ export function buildToolCatalog(registry, manifest, options) {
     const denyQns = new Set(options.denyQns ?? []);
     addRegistrySearchTools(registry, roleFilter, denyQns, sink);
     const { detailQnByEntity, listQnByEntity, entityListDetailQns } = collectEntityHandlerQns(registry, roleFilter, denyQns);
-    addGetTools(detailQnByEntity, entityByName, locale, sink);
-    addListTools(registry, listQnByEntity, entityByName, locale, sink);
+    addGetTools(registry, detailQnByEntity, entityByName, locale, sink);
+    addListTools(registry, listQnByEntity, entityByName, roleFilter.roles, locale, sink);
     addQueryHandlerTools(manifest, entityListDetailQns, denyQns, sink);
     if (options.mode !== "read-only") {
         addWriteHandlerTools(manifest, detailQnByEntity, denyQns, sink);

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -53,6 +53,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: "Anonymous invite-accept has no session in the invited tenant yet — checks existing " +
                 "membership via ctx.queryAs(SYSTEM, tenant:query:memberships) of the invitation's tenant. " +
                 "Also reads the pending invitation by id (the invitee is not yet a member of the " +
@@ -74,7 +75,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 return invalidInviteToken();
             let committed = false;
             try {
-                const invitation = await fetchOne(ctx.db.unsafeRaw("reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant"), tenantInvitationsTable, { id: invitationId });
+                const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, { id: invitationId });
                 if (!invitation || invitation.status !== INVITATION_STATUS.pending)
                     return invalidInviteToken();
                 const invitationTenantId = invitation.tenantId;
@@ -110,7 +111,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 if (!statusGate.ok)
                     return statusGate.result;
                 const userId = userRow.id;
-                const dbConn = ctx.db.unsafeRaw("adds the membership and accepts the invitation in the invitation's tenant, which differs from the caller's tenant");
+                const dbConn = ctx.db.unsafeRaw();
                 const grant = await grantInvitedMembershipRole(dbConn, {
                     userId,
                     tenantId: invitationTenantId,

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -33,8 +33,6 @@ const InviteAcceptSchema = z.object({
 });
 const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 const INVITE_ACCEPT_ESCAPE_HATCH_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant. Adds the membership and accepts the invitation in the invitation's tenant, which differs from the caller's tenant.";
-const READ_PENDING_INVITATION_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant";
-const ADD_MEMBERSHIP_INVITATION_TENANT_REASON = "adds the membership and accepts the invitation in the invitation's tenant, which differs from the caller's tenant";
 export function createInviteAcceptHandler() {
     return defineWriteHandler({
         name: "invite-accept",
@@ -51,6 +49,7 @@ export function createInviteAcceptHandler() {
         },
         agent: { expose: false },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: INVITE_ACCEPT_ESCAPE_HATCH_REASON,
         },
         // kumiko-lint-ignore complexity-budget invite branches (auth/anon/burn) stay in one handler
@@ -66,7 +65,7 @@ export function createInviteAcceptHandler() {
                 return invalidInviteToken();
             let committed = false;
             try {
-                const invitation = await fetchOne(ctx.db.unsafeRaw(READ_PENDING_INVITATION_REASON), tenantInvitationsTable, { id: invitationId });
+                const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, { id: invitationId });
                 if (!invitation || invitation.status !== INVITATION_STATUS.pending)
                     return invalidInviteToken();
                 const invitationTenantId = invitation.tenantId;
@@ -87,7 +86,7 @@ export function createInviteAcceptHandler() {
                 }
                 // Executor instead of dispatcher.writeAs(addMember): addMember only
                 // accepts SystemAdmin, createSystemUser carries "system".
-                const dbConn = ctx.db.unsafeRaw(ADD_MEMBERSHIP_INVITATION_TENANT_REASON);
+                const dbConn = ctx.db.unsafeRaw();
                 const grant = await grantInvitedMembershipRole(dbConn, {
                     userId: event.user.id,
                     tenantId: invitationTenantId,

package/dist/auth-email-password/handlers/invite-info.query.js

@@ -34,6 +34,7 @@ export const inviteInfoQuery = defineQueryHandler({
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     agent: { expose: false },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: READ_PENDING_INVITATION_REASON,
     },
     description: "Anonymous, read-only invite lookup for the invite-acceptance page: reveals the invited " +
@@ -44,7 +45,9 @@ export const inviteInfoQuery = defineQueryHandler({
         const invitationId = await getInvitationIdForToken(ctx.redis, query.payload.token);
         if (!invitationId)
             throwInvalidInviteToken();
-        const invitation = await fetchOne(ctx.db.unsafeRaw(READ_PENDING_INVITATION_REASON), tenantInvitationsTable, { id: invitationId });
+        const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, {
+            id: invitationId,
+        });
         if (!invitation || invitation.status !== INVITATION_STATUS.pending) {
             throwInvalidInviteToken();
         }

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -41,8 +41,6 @@ const InviteSignupCompleteSchema = z.object({
 });
 const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 const INVITE_SIGNUP_COMPLETE_ESCAPE_HATCH_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant. Creates the user and adds the membership and accepts the invitation in the invitation's tenant, before any caller tenant context exists.";
-const READ_PENDING_INVITATION_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant";
-const CREATE_USER_AND_MEMBERSHIP_INVITATION_TENANT_REASON = "creates the user and adds the membership and accepts the invitation in the invitation's tenant, before any caller tenant context exists";
 export function createInviteSignupCompleteHandler() {
     return defineWriteHandler({
         name: "invite-signup-complete",
@@ -51,6 +49,7 @@ export function createInviteSignupCompleteHandler() {
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         agent: { expose: false },
         escapeHatch: {
+            grants: ["unsafeRaw", "globalWrites"],
             reason: INVITE_SIGNUP_COMPLETE_ESCAPE_HATCH_REASON,
         },
         handler: async (event, ctx) => {
@@ -65,7 +64,7 @@ export function createInviteSignupCompleteHandler() {
                 return invalidInviteToken();
             let committed = false;
             try {
-                const invitation = await fetchOne(ctx.db.unsafeRaw(READ_PENDING_INVITATION_REASON), tenantInvitationsTable, { id: invitationId });
+                const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, { id: invitationId });
                 if (!invitation || invitation.status !== INVITATION_STATUS.pending)
                     return invalidInviteToken();
                 const invitationTenantId = invitation.tenantId;
@@ -88,7 +87,7 @@ export function createInviteSignupCompleteHandler() {
                 // signup-confirm), emailVerified=true wegen Magic-Link.
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
-                const dbConn = ctx.db.unsafeRaw(CREATE_USER_AND_MEMBERSHIP_INVITATION_TENANT_REASON);
+                const dbConn = ctx.db.unsafeRaw();
                 const { id: userId } = await seedUserWithPassword(dbConn, {
                     email: invitationEmail,
                     password: event.payload.password,

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -78,6 +78,7 @@ export function createSignupConfirmHandler() {
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         agent: { expose: false },
         escapeHatch: {
+            grants: ["unsafeRaw", "systemIdentity"],
             reason: SIGNUP_CONFIRM_PROVISION_REASON,
         },
         handler: async (event, ctx) => {
@@ -103,7 +104,7 @@ export function createSignupConfirmHandler() {
                 // Fallback bei Kollision (siehe generateUniqueName).
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
-                const dbConn = ctx.db.unsafeRaw(SIGNUP_CONFIRM_PROVISION_REASON);
+                const dbConn = ctx.db.unsafeRaw();
                 const tenantKey = await generateUniqueName({
                     isAvailable: async (slug) => {
                         const existing = await fetchOne(dbConn, tenantTable, { key: slug });

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -55,7 +55,7 @@ export function createSignupRequestHandler(opts) {
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         description: "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
-        escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON },
+        escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },
         handler: async (event, ctx) => {
             // Silent no-op when off, matching the route's own always-200
             // anti-enumeration contract (registerTokenRequestRoute swallows every
@@ -123,7 +123,7 @@ export function createSignupRequestHandler(opts) {
                 else {
                     try {
                         const verified = await provider.verifyGrant({
-                            db: ctx.db.unsafeRaw(HANDOVER_GRANT_VERIFY_REASON),
+                            db: ctx.db.unsafeRaw(),
                             registry: ctx.registry,
                             entityType,
                             token: grantToken,

package/dist/auth-email-password/web/auth-gate.d.ts

@@ -23,9 +23,19 @@ export type LoginRouteOptions = {
     readonly onAuthenticated?: () => void;
 };
 export declare function createLoginRoute(opts?: LoginRouteOptions): ComponentType<Record<string, never>>;
-export declare function makeAuthGate(opts?: LoginRouteOptions): ComponentType<{
+export type AuthGateOptions = LoginRouteOptions & {
+    /** Login page outside the SPA (root-relative path or http(s) URL). Unauthenticated
+     *  visitors are sent there with `next=<current path>`; the built-in login screen
+     *  is not rendered. */
+    readonly loginUrl?: string;
+};
+export type SessionAuthGateOptions = AuthGateOptions & {
+    /** Where logout navigates to (root-relative path or http(s) URL). Without it, logout reloads the page. */
+    readonly postLogoutUrl?: string;
+};
+export declare function makeAuthGate(opts?: AuthGateOptions): ComponentType<{
     children: ReactNode;
 }>;
-export declare function makeSessionAuthGate(opts?: LoginRouteOptions): ComponentType<{
+export declare function makeSessionAuthGate(opts?: SessionAuthGateOptions): ComponentType<{
     children: ReactNode;
 }>;

package/dist/auth-email-password/web/auth-gate.js

@@ -10,6 +10,7 @@ import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 // (nur `{ children }`-Prop). Der Sample kann so einen eigenen Login-
 // Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
 import { useEffect, useState } from "react";
+import { assertNavigableUrl, buildLoginRedirectUrl } from "./auth-redirect.js";
 import { LoginScreen } from "./login-screen.js";
 import { SessionProvider, useSession } from "./session.js";
 import { SessionBootstrapErrorScreen } from "./session-bootstrap-error.js";
@@ -77,12 +78,32 @@ export function createLoginRoute(opts = {}) {
     }
     return LoginRoute;
 }
+function redirectToLoginUrl(loginUrl) {
+    const { origin, pathname, search, hash } = window.location;
+    // Compared before `next` is appended: the target always differs from the current
+    // URL once it carries next, so a gate mounted on the login page itself would loop.
+    const loginLocation = new URL(loginUrl, origin);
+    if (loginLocation.origin === origin && loginLocation.pathname === pathname)
+        return;
+    window.location.replace(buildLoginRedirectUrl(loginUrl, `${pathname}${search}${hash}`, origin));
+}
 export function makeAuthGate(opts = {}) {
+    const { loginUrl } = opts;
+    if (loginUrl !== undefined)
+        assertNavigableUrl(loginUrl, "loginUrl");
     const LoginRoute = createLoginRoute(opts);
     function AuthGate({ children }) {
         const { status } = useSession();
+        const redirectsToLoginUrl = loginUrl !== undefined && status === "unauthenticated";
+        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        useEffect(() => {
+            if (redirectsToLoginUrl)
+                redirectToLoginUrl(loginUrl);
+        }, [redirectsToLoginUrl]);
         if (status === "authenticated")
             return _jsx(_Fragment, { children: children });
+        if (redirectsToLoginUrl)
+            return null;
         return _jsx(LoginRoute, {});
     }
     return AuthGate;
@@ -91,9 +112,12 @@ export function makeAuthGate(opts = {}) {
 // /calculator) doesn't mount the session bootstrap — createKumikoApp stacks
 // providers outside all gates, so SessionProvider can't be a provider anymore.
 export function makeSessionAuthGate(opts = {}) {
+    const { postLogoutUrl } = opts;
+    if (postLogoutUrl !== undefined)
+        assertNavigableUrl(postLogoutUrl, "postLogoutUrl");
     const AuthGate = makeAuthGate(opts);
     function SessionAuthGate({ children }) {
-        return (_jsx(SessionProvider, { children: _jsx(AuthGate, { children: children }) }));
+        return (_jsx(SessionProvider, { postLogoutUrl: postLogoutUrl, children: _jsx(AuthGate, { children: children }) }));
     }
     return SessionAuthGate;
 }

package/dist/auth-email-password/web/auth-redirect.d.ts

@@ -0,0 +1,5 @@
+export declare const NEXT_QUERY_PARAM = "next";
+export declare function isSafeNextPath(candidate: unknown): candidate is string;
+export declare function readNextFromSearch(search: string): string | null;
+export declare function assertNavigableUrl(url: string, optionName: string): void;
+export declare function buildLoginRedirectUrl(loginUrl: string, returnPath: string, currentOrigin: string): string;

package/dist/auth-email-password/web/auth-redirect.js

@@ -0,0 +1,58 @@
+// @runtime client
+// Redirect targets for external login pages. `next` travels through the query
+// string, so anything read back from it is untrusted: only same-origin
+// root-relative paths pass (no "//host", no "/\host", no scheme).
+export const NEXT_QUERY_PARAM = "next";
+function hasControlOrWhitespace(candidate) {
+    for (let i = 0; i < candidate.length; i++) {
+        const code = candidate.charCodeAt(i);
+        if (code <= 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+// The URL parse is a backstop: browsers strip tabs/newlines, so "/\t/evil.com"
+// would otherwise normalize to "//evil.com" past the leading-slash check.
+export function isSafeNextPath(candidate) {
+    if (typeof candidate !== "string" || !candidate.startsWith("/"))
+        return false;
+    if (candidate[1] === "/" || candidate.includes("\\"))
+        return false;
+    if (hasControlOrWhitespace(candidate))
+        return false;
+    try {
+        const parsed = new URL(candidate, "https://next.invalid");
+        return parsed.origin === "https://next.invalid" && !parsed.pathname.startsWith("//");
+    }
+    catch {
+        return false;
+    }
+}
+export function readNextFromSearch(search) {
+    const candidate = new URLSearchParams(search).get(NEXT_QUERY_PARAM);
+    return isSafeNextPath(candidate) ? candidate : null;
+}
+// loginUrl/postLogoutUrl come from app code (trusted), but a typo like
+// "javascript:" must fail at startup instead of becoming a navigation target.
+export function assertNavigableUrl(url, optionName) {
+    // skip: a safe root-relative path needs no protocol check
+    if (url.startsWith("/") && isSafeNextPath(url))
+        return;
+    let protocol;
+    try {
+        protocol = new URL(url).protocol;
+    }
+    catch {
+        throw new Error(`${optionName} must be a root-relative path or an http(s) URL, got "${url}"`);
+    }
+    if (protocol !== "http:" && protocol !== "https:") {
+        throw new Error(`${optionName} must be a root-relative path or an http(s) URL, got "${url}"`);
+    }
+}
+export function buildLoginRedirectUrl(loginUrl, returnPath, currentOrigin) {
+    const target = new URL(loginUrl, currentOrigin);
+    if (isSafeNextPath(returnPath))
+        target.searchParams.set(NEXT_QUERY_PARAM, returnPath);
+    const isSameOrigin = target.origin === currentOrigin;
+    return isSameOrigin ? `${target.pathname}${target.search}${target.hash}` : target.href;
+}

package/dist/auth-email-password/web/client-plugin.d.ts

@@ -1,6 +1,6 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
-import { type MfaSetupComponentProps, type MfaVerifyComponentProps } from "./auth-gate.js";
+import { type AuthGateOptions, type MfaSetupComponentProps, type MfaVerifyComponentProps } from "./auth-gate.js";
 import type { LoginScreenProps } from "./login-screen.js";
 export type EmailPasswordClientOptions = {
     /** Eigener Login-Screen. Default: der shadcn-stylte LoginScreen
@@ -19,6 +19,13 @@ export type EmailPasswordClientOptions = {
      *  as mfaVerifyScreen above. Apps not mounting auth-mfa simply don't
      *  pass this. */
     readonly mfaSetupScreen?: ComponentType<MfaSetupComponentProps>;
+    /** Login page outside the SPA (root-relative path or http(s) URL). Unauthenticated
+     *  visitors are redirected there with `next=<current path>` instead of seeing the
+     *  built-in login screen. Read `next` back with readNextFromSearch (same-origin
+     *  paths only). */
+    readonly loginUrl?: AuthGateOptions["loginUrl"];
+    /** Where logout navigates to (root-relative path or http(s) URL). Default: reload. */
+    readonly postLogoutUrl?: string;
     /** Key-Overrides pro Locale. Wird mit den Default-Bundles (de/en)
      *  aus `translations.ts` gemerged — jeder hier gesetzte Key gewinnt.
      *  Für Branding ("Sign in" → "Login to Acme") oder weitere Sprachen

package/dist/auth-email-password/web/client-plugin.js

@@ -17,6 +17,8 @@ export function emailPasswordClient(options = {}) {
                 loginScreenProps: options.loginScreenProps,
                 mfaVerifyScreen: options.mfaVerifyScreen,
                 mfaSetupScreen: options.mfaSetupScreen,
+                loginUrl: options.loginUrl,
+                postLogoutUrl: options.postLogoutUrl,
             }),
         ],
         translations,

package/dist/auth-email-password/web/index.d.ts

@@ -3,8 +3,9 @@ export type { AuthTokenFailure, CurrentUserProfile, LoginFailure, LoginRequest,
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export type { AuthCardProps, AuthShellRenderer } from "./auth-form-primitives.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
-export type { LoginRouteOptions, MfaSetupComponentProps, MfaVerifyComponentProps, } from "./auth-gate.js";
+export type { AuthGateOptions, LoginRouteOptions, MfaSetupComponentProps, MfaVerifyComponentProps, SessionAuthGateOptions, } from "./auth-gate.js";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";
+export { buildLoginRedirectUrl, isSafeNextPath, NEXT_QUERY_PARAM, readNextFromSearch, } from "./auth-redirect.js";
 export type { EmailPasswordClientFeature, EmailPasswordClientOptions, } from "./client-plugin.js";
 export { emailPasswordClient } from "./client-plugin.js";
 export type { ConfirmAccountUnlockScreenProps } from "./confirm-account-unlock-screen.js";

package/dist/auth-email-password/web/index.js

@@ -8,6 +8,7 @@ export { defaultTranslations, mergeTranslations } from "../i18n.js";
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";
+export { buildLoginRedirectUrl, isSafeNextPath, NEXT_QUERY_PARAM, readNextFromSearch, } from "./auth-redirect.js";
 export { emailPasswordClient } from "./client-plugin.js";
 export { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.js";
 export { DefaultTopbarActions } from "./default-topbar-actions.js";

package/dist/auth-email-password/web/session.d.ts

@@ -40,7 +40,9 @@ export declare function computeActiveRoles(user: CurrentUserProfile | null, acti
  *  Code nutzt SessionProvider + useSession; direkter Context-Zugriff ist
  *  für Tests/Stories. */
 export declare const SessionContext: import("react").Context<SessionApi | undefined>;
-export declare function SessionProvider({ children }: {
+export declare function SessionProvider({ children, postLogoutUrl, }: {
     readonly children: ReactNode;
+    /** Logout navigates here instead of reloading. Validated by makeSessionAuthGate. */
+    readonly postLogoutUrl?: string;
 }): ReactNode;
 export declare function useSession(): SessionApi;

package/dist/auth-email-password/web/session.js

@@ -92,7 +92,7 @@ function toBootstrapFailure(err) {
     }
     return { httpStatus: null, retryAfterSeconds: null, failedAtEpochMs: Date.now() };
 }
-export function SessionProvider({ children }) {
+export function SessionProvider({ children, postLogoutUrl, }) {
     const [state, setState] = useState(INITIAL);
     // Never rejects, so bootstrap can't strand the UI on "loading" forever.
     const doRefresh = useCallback(async () => {
@@ -128,6 +128,12 @@ export function SessionProvider({ children }) {
     }, [doRefresh]);
     const logout = useCallback(async () => {
         await logoutApi();
+        if (postLogoutUrl !== undefined && typeof window !== "undefined") {
+            // State stays untouched: flipping to unauthenticated would let an AuthGate
+            // with loginUrl race this navigation to its own redirect.
+            window.location.assign(postLogoutUrl);
+            return;
+        }
         setState(UNAUTHENTICATED);
         // Hard-Reload: React-Tree, dispatcher-live-Caches, EventSource —
         // alles fliegt auf Null. Nach Logout ist das der billigste Weg zu
@@ -136,7 +142,7 @@ export function SessionProvider({ children }) {
         if (typeof window !== "undefined") {
             window.location.reload();
         }
-    }, []);
+    }, [postLogoutUrl]);
     const switchTenant = useCallback(async (tenantId) => {
         await switchTenantApi(tenantId);
         // Tenant-Wechsel rotiert JWT + Cookies. React-Tree enthält

package/dist/auth-mfa/feature.js

@@ -105,7 +105,7 @@ export function createAuthMfaFeature(opts) {
             escapeHatch: {
                 reason: REENCRYPT_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => mfaReencryptJob(payload, ctx, ctx.db.unsafeRaw(REENCRYPT_ESCAPE_HATCH_REASON)),
+            handler: (payload, ctx) => mfaReencryptJob(payload, ctx, ctx.db.unsafeRaw()),
         });
         r.entity("user-mfa", userMfaEntity);
         // Late-bound by run-prod-app once the sessions feature (if mounted) has

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -91,7 +91,7 @@ export function createEnableConfirmPreauthHandler(opts) {
                 return invalidSetupToken();
             // "system" mode: no session exists yet, tenantId comes from the
             // verified token, mirroring enable-start-preauth.write.ts.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw("reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant"), tenantId, "system");
+            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const existing = await findUserMfaRow(scopedDb, scopedUser);
             if (existing)

package/dist/auth-mfa/handlers/enable-start-preauth.write.js

@@ -30,6 +30,7 @@ export function createEnableStartPreauthHandler(opts) {
         // Same secret-bearing result as enable-start.
         agent: { expose: false },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: ENABLE_START_PREAUTH_TENANT_REASON,
         },
         handler: async (event, ctx) => {
@@ -43,7 +44,7 @@ export function createEnableStartPreauthHandler(opts) {
             // "system" mode: the guest dispatch identity's own tenantId is
             // meaningless here — the preauthSetupToken is the source of truth
             // for which tenant's row to read, mirroring verify.write.ts.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw(ENABLE_START_PREAUTH_TENANT_REASON), tenantId, "system");
+            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const existing = await findUserMfaRow(scopedDb, scopedUser);
             if (existing)

package/dist/auth-mfa/handlers/verify.write.js

@@ -68,7 +68,7 @@ export function createMfaVerifyHandler(opts) {
             // "system" mode: this handler runs with a guest identity whose own
             // tenantId is meaningless here — the challenge token is the source
             // of truth for which tenant's row to read.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw("reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant"), tenantId, "system");
+            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const row = await findUserMfaRow(scopedDb, scopedUser);
             // MFA got disabled between login and verify (race, or a stale

package/dist/auth-mfa/mfa-code-verifier.js

@@ -14,7 +14,7 @@ export function createMfaCodeVerifier() {
         declareEscapeHatch({
             reason: "reads the MFA enrollment of the user being re-authenticated on the caller's handler context; the calling handler declares its own escapeHatch",
         });
-        const scopedDb = createTenantDb(ctx.db.unsafeRaw("reads the MFA enrollment of the user being re-authenticated"), tenantId, "system");
+        const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
         const row = await findUserMfaRow(scopedDb, { id: userId, tenantId, roles: [] });
         if (!row)
             return { enrolled: false, ok: false };

package/dist/auth-mfa/mfa-status-checker.js

@@ -10,7 +10,7 @@ export function createMfaStatusChecker(opts) {
         declareEscapeHatch({
             reason: "reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant, on the caller's handler context; the calling handler declares its own escapeHatch",
         });
-        const scopedDb = createTenantDb(ctx.db.unsafeRaw("reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant"), tenantId, "system");
+        const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
         const scopedUser = { id: userId, tenantId, roles: ["User"] };
         const row = await findUserMfaRow(scopedDb, scopedUser);
         if (row) {

package/dist/billing-foundation/aggregate-id.d.ts

@@ -18,3 +18,5 @@ export declare function paymentAggregateId(tenantId: string): string;
  *  providerEventId)` rather than the event-store's bigserial `event.id` (not
  *  a UUID) or the shared per-tenant aggregateId (one row per payment). */
 export declare function paymentRowId(tenantId: string, providerName: string, providerEventId: string): string;
+/** Stream id of one unmatched termination declaration, derived from its request id. */
+export declare function terminationUnmatchedAggregateId(requestId: string): string;

package/dist/billing-foundation/aggregate-id.js

@@ -16,6 +16,9 @@ const PAYMENT_NAMESPACE = "dec0b897-646d-4da3-be3c-e9a35a83f4e0";
  *  UUID, so it can't back a uuid-typed PK. Generated 2026-09-11, set in
  *  stone (same rationale as the two namespaces above). */
 const PAYMENT_ROW_NAMESPACE = "3a1c9f4e-6b2d-4c8a-9e5f-7d4b1a2c8e6f";
+/** Namespace for the system-tenant stream of an unmatched termination
+ *  declaration (one stream per request). Generated 2026-10-03, set in stone. */
+const TERMINATION_UNMATCHED_NAMESPACE = "7e2f4b9a-3c1d-4a68-8d05-b6c9e1f27a34";
 /**
  * Deterministic aggregate-id für die subscription eines Plattform-
  * Tenants. EINE Subscription pro Tenant (Add-Ons sind line-items in
@@ -51,3 +54,8 @@ export function paymentRowId(tenantId, providerName, providerEventId) {
     // the payment with no error anywhere.
     return uuidv5(`${tenantId}:${providerName}:${providerEventId}`, PAYMENT_ROW_NAMESPACE);
 }
+/** Stream id of one unmatched termination declaration, derived from its request id. */
+// @wrapper-known uuid-domain
+export function terminationUnmatchedAggregateId(requestId) {
+    return uuidv5(requestId, TERMINATION_UNMATCHED_NAMESPACE);
+}