@cosmicdrift/kumiko-bundled-features 0.340.0 → 0.342.0

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -19,15 +19,18 @@
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, assignableAppRolesOf, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership-role validation owned by tenant-feature
 import { findForbiddenMembershipRole, findForbiddenRoleAssignment, reservedMembershipRoleError, unassignableMembershipRoleError, } from "../../tenant/membership-roles.js";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
 import { renderInviteEmail } from "../email-templates.js";
+import { inviteAlreadyAccepted } from "../errors.js";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 const INVITE_NOTIFICATION_TYPE = "auth-email-password:invite";
@@ -44,102 +47,146 @@ const executor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitati
 function findRankedRole(roles) {
     return roles.find((role) => findForbiddenRoleAssignment(["system"], [role], []) === undefined);
 }
-export function createInviteCreateHandler(opts) {
+function checkAssignableInviteRole(opts, inviterRoles, role, ctx) {
+    const forbiddenRole = findForbiddenMembershipRole([role]);
+    if (forbiddenRole !== undefined)
+        return writeFailure(reservedMembershipRoleError(forbiddenRole));
+    const elevationForbidden = findForbiddenRoleAssignment(inviterRoles, [role], [], assignableAppRolesOf(ctx.registry));
+    if (elevationForbidden !== undefined &&
+        !opts.additionalAssignableRoles?.includes(elevationForbidden)) {
+        return writeFailure(unassignableMembershipRoleError(elevationForbidden));
+    }
+    if (opts.canAssignRole && !opts.canAssignRole(inviterRoles, role)) {
+        return writeFailure(unassignableMembershipRoleError(role));
+    }
+    return undefined;
+}
+async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAccepted = false) {
+    if (!ctx.redis) {
+        return writeFailure(new InternalError({ message: "invite-create requires ctx.redis for token store" }));
+    }
+    const email = request.email.toLowerCase();
+    const tenantId = inviter.tenantId;
+    const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+    // The unique index allows one row per (tenantId, email). Whatever its
+    // status, a re-invite resets it to pending with a fresh token.
+    const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
+    let invitationId;
+    if (existing) {
+        // Provisioning callers (waitlist) must not flip an accepted invite back to
+        // pending: that would let them cancel a live membership's invitation.
+        // The tenant-admin path keeps resetting because re-inviting a member is
+        // how roles get re-assigned.
+        if (refuseAccepted && existing["status"] === INVITATION_STATUS.accepted) {
+            return inviteAlreadyAccepted();
+        }
+        invitationId = existing["id"]; // @cast-boundary db-row
+        const existingVersion = existing["version"]; // @cast-boundary db-row
+        // At most one live invite token per invitation: invalidate
+        // whatever's there before minting the new one.
+        await invalidateExistingInviteToken(ctx.redis, invitationId);
+        const updateResult = await executor.update({
+            id: invitationId,
+            version: existingVersion,
+            changes: {
+                role: request.role,
+                // Always written, also as []: a tenant-admin resend must drop
+                // global roles a previous system invite put on this row.
+                globalRoles: [...request.globalRoles],
+                status: INVITATION_STATUS.pending,
+                invitedBy: inviter.id,
+                expiresAt,
+            },
+        }, inviter, ctx.db);
+        if (!updateResult.isSuccess)
+            return updateResult;
+    }
+    else {
+        const createResult = await executor.create({
+            email,
+            role: request.role,
+            globalRoles: [...request.globalRoles],
+            status: INVITATION_STATUS.pending,
+            invitedBy: inviter.id,
+            expiresAt,
+        }, inviter, ctx.db);
+        if (!createResult.isSuccess)
+            return createResult;
+        invitationId = createResult.data.id; // @cast-boundary engine-payload
+    }
+    const token = generateToken();
+    await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
+    const locale = resolveHandlerMailLocale(ctx, opts.locale);
+    await dispatchMagicLinkMail(ctx.notify, {
+        handlerName: "invite-create",
+        notificationType: INVITE_NOTIFICATION_TYPE,
+        renderContent: (renderArgs) => renderInviteEmail({ ...renderArgs, role: request.role }),
+    }, {
+        email,
+        appUrl: opts.appUrl,
+        token,
+        expiresAt: expiresAt.toString(),
+        ...(opts.appName !== undefined && { appName: opts.appName }),
+        locale,
+    });
+    return {
+        isSuccess: true,
+        data: {
+            kind: "invite-created",
+            invitationId,
+            tenantId,
+            email,
+            role: request.role,
+            globalRoles: request.globalRoles,
+            expiresAt: expiresAt.toString(),
+        },
+    };
+}
+function assertAppDefinedAdditionalRoles(opts) {
     const rankedRole = findRankedRole(opts.additionalAssignableRoles ?? []);
     if (rankedRole !== undefined) {
         throw new Error(`[auth-email-password] invite.additionalAssignableRoles must list app-defined roles only; "${rankedRole}" is a framework-ranked role`);
     }
-    const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES;
-    const ttlSeconds = ttlMinutes * 60;
+}
+export function createInviteCreateHandler(opts) {
+    assertAppDefinedAdditionalRoles(opts);
+    const ttlSeconds = (opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES) * 60;
     return defineWriteHandler({
         name: "invite-create",
         schema: InviteCreateSchema,
         access: { roles: access.admin },
         description: "Invites an email address into the caller's tenant with a chosen membership role, creating or reusing the invitation and mailing the invitee a fresh accept link; re-inviting the same address invalidates the previous link.",
         handler: async (event, ctx) => {
-            if (!ctx.redis) {
-                return writeFailure(new InternalError({ message: "invite-create requires ctx.redis for token store" }));
-            }
-            const forbiddenRole = findForbiddenMembershipRole([event.payload.role]);
-            if (forbiddenRole !== undefined) {
-                return writeFailure(reservedMembershipRoleError(forbiddenRole));
-            }
-            const elevationForbidden = findForbiddenRoleAssignment(event.user.roles, [event.payload.role], [], assignableAppRolesOf(ctx.registry));
-            if (elevationForbidden !== undefined &&
-                !opts.additionalAssignableRoles?.includes(elevationForbidden)) {
-                return writeFailure(unassignableMembershipRoleError(elevationForbidden));
-            }
-            if (opts.canAssignRole && !opts.canAssignRole(event.user.roles, event.payload.role)) {
-                return writeFailure(unassignableMembershipRoleError(event.payload.role));
-            }
-            const email = event.payload.email.toLowerCase();
-            const tenantId = event.user.tenantId;
-            const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
-            // Existing row für (tenantId, email) — unique-index garantiert
-            // max. eine Row. Status egal (cancelled/accepted/expired/pending);
-            // wir setzen sie auf pending zurück und vergeben einen frischen
-            // Token wenn der bisherige nicht mehr lebt.
-            const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
-            let invitationId;
-            let token;
-            if (existing) {
-                invitationId = existing["id"]; // @cast-boundary db-row
-                const existingVersion = existing["version"]; // @cast-boundary db-row
-                // At most one live invite token per invitation: invalidate
-                // whatever's there before minting the new one.
-                await invalidateExistingInviteToken(ctx.redis, invitationId);
-                token = generateToken();
-                const updateResult = await executor.update({
-                    id: invitationId,
-                    version: existingVersion,
-                    changes: {
-                        role: event.payload.role,
-                        status: INVITATION_STATUS.pending,
-                        invitedBy: event.user.id,
-                        expiresAt,
-                    },
-                }, event.user, ctx.db);
-                if (!updateResult.isSuccess)
-                    return updateResult;
-            }
-            else {
-                const createResult = await executor.create({
-                    email,
-                    role: event.payload.role,
-                    status: INVITATION_STATUS.pending,
-                    invitedBy: event.user.id,
-                    expiresAt,
-                }, event.user, ctx.db);
-                if (!createResult.isSuccess)
-                    return createResult;
-                invitationId = createResult.data.id; // @cast-boundary engine-payload
-                token = generateToken();
-            }
-            await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
-            const locale = resolveHandlerMailLocale(ctx, opts.locale);
-            await dispatchMagicLinkMail(ctx.notify, {
-                handlerName: "invite-create",
-                notificationType: INVITE_NOTIFICATION_TYPE,
-                renderContent: (renderArgs) => renderInviteEmail({ ...renderArgs, role: event.payload.role }),
-            }, {
-                email,
-                appUrl: opts.appUrl,
-                token,
-                expiresAt: expiresAt.toString(),
-                ...(opts.appName !== undefined && { appName: opts.appName }),
-                locale,
-            });
-            return {
-                isSuccess: true,
-                data: {
-                    kind: "invite-created",
-                    invitationId,
-                    tenantId,
-                    email,
-                    role: event.payload.role,
-                    expiresAt: expiresAt.toString(),
-                },
-            };
+            const roleRejection = checkAssignableInviteRole(opts, event.user.roles, event.payload.role, ctx);
+            if (roleRejection)
+                return roleRejection;
+            return issueInvitation(opts, ttlSeconds, { email: event.payload.email, role: event.payload.role, globalRoles: [] }, event.user, ctx);
+        },
+    });
+}
+const SystemInviteCreateSchema = z.object({
+    email: z.email(),
+    role: z.string().min(1).max(50),
+    globalRoles: z.array(z.enum(GLOBAL_ROLE_OPTIONS)).max(GLOBAL_ROLE_OPTIONS.length).default([]),
+});
+// System-only sibling of invite-create: the only path that can put global
+// roles (SystemAdmin) on an invitation. No session mint path yields the
+// "system" role (users.roles only accepts GLOBAL_ROLE_OPTIONS), so only
+// in-process callers dispatching as createSystemUser (runBootstrap) get here.
+export function createSystemInviteCreateHandler(opts) {
+    assertAppDefinedAdditionalRoles(opts);
+    const ttlSeconds = (opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES) * 60;
+    return defineWriteHandler({
+        name: "system-invite-create",
+        schema: SystemInviteCreateSchema,
+        access: { roles: access.system },
+        agent: { expose: false },
+        description: "System-only invite into the dispatching tenant that may additionally carry global roles, which the invitee receives only when accepting; used by provisioning such as runBootstrap.",
+        handler: async (event, ctx) => {
+            const roleRejection = checkAssignableInviteRole(opts, event.user.roles, event.payload.role, ctx);
+            if (roleRejection)
+                return roleRejection;
+            return issueInvitation(opts, ttlSeconds, event.payload, event.user, ctx, true);
         },
     });
 }

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -28,6 +28,8 @@ import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } fr
 import { findForbiddenMembershipRole, reservedMembershipRoleError, } from "../../tenant/membership-roles.js";
 // kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
 import { seedTenantMembership } from "../../tenant/seeding.js";
+// kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
+import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import existence-check
 import { userTable } from "../../user/schema/user.js";
 import { invalidInviteToken } from "../errors.js";
@@ -70,6 +72,7 @@ export function createInviteSignupCompleteHandler() {
                 const invitationTenantId = invitation.tenantId;
                 const invitationEmail = await decryptStoredPii(invitation.email, "email", "auth:invite-signup-complete");
                 const invitationRole = invitation.role;
+                const invitationGlobalRoles = parseInvitedGlobalRoles(invitation.globalRoles);
                 const invitationVersion = invitation.version;
                 // User-Not-Exists-Check: wenn die Email schon registriert ist,
                 // muss der User Branch 2 (acceptWithLogin) nutzen. Hier ist
@@ -93,6 +96,7 @@ export function createInviteSignupCompleteHandler() {
                     password: event.payload.password,
                     displayName: invitationEmail.split("@")[0] ?? invitationEmail,
                     emailVerified: true,
+                    ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
                 });
                 // Membership-Add via seed-helper (gleiches Pattern wie
                 // provisionSignupAccount — bypassed addMember access-check
@@ -121,7 +125,7 @@ export function createInviteSignupCompleteHandler() {
                     tenantId: invitationTenantId,
                     // buildSessionRoles calls stripForbiddenMembershipRoles internally —
                     // a reserved role on the invitation itself must never reach the session.
-                    roles: buildSessionRoles([], [invitationRole]),
+                    roles: buildSessionRoles(invitationGlobalRoles, [invitationRole]),
                 };
                 committed = true;
                 return {

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -54,6 +54,7 @@ export function createSignupRequestHandler(opts) {
         schema: SignupRequestSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
         description: "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
         escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },
         handler: async (event, ctx) => {

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -27,6 +27,7 @@ export function createTokenRequestHandler(spec, opts) {
         schema: RequestTokenSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
         escapeHatch: {
             reason: "Anonymous requester has no session — looks up the target user by email via " +
                 "ctx.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",

package/dist/auth-email-password/index.d.ts

@@ -1,5 +1,7 @@
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
 export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
+export type { BootstrapConfigValue, BootstrapDeps, BootstrapInvite, BootstrapInviteOutcome, BootstrapPlan, BootstrapReport, BootstrapSeedDeps, BootstrapSystemAdmin, BootstrapTenant, BootstrapTenantOutcome, } from "./bootstrap.js";
+export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
 export type { AuthMailContent, AuthMailLocale, AuthMailSection, RenderInviteEmailArgs, RenderTokenContentArgs, } from "./email-templates.js";
 export { renderActivationEmail, renderInviteEmail, renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, } from "./email-templates.js";

package/dist/auth-email-password/index.js

@@ -6,6 +6,7 @@
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
 export { DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
+export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
 export { renderActivationEmail, renderInviteEmail, renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, } from "./email-templates.js";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";

package/dist/auth-email-password/invite-token-store.d.ts

@@ -28,3 +28,6 @@ export declare function deleteInviteToken(redis: Redis, args: {
 /** Burn release for failed-accept paths (DB error etc.) so a legitimate
  *  retry isn't blocked by a stale burn marker. */
 export declare const unburnInviteToken: (redis: Redis, token: string) => Promise<void>;
+/** Whether the invitation still has an unexpired, unconsumed token — Redis TTL
+ *  is the single truth for invite expiry (see the module comment). */
+export declare function hasLiveInviteToken(redis: Redis, invitationId: string): Promise<boolean>;

package/dist/auth-email-password/invite-token-store.js

@@ -58,3 +58,8 @@ export async function deleteInviteToken(redis, args) {
 /** Burn release for failed-accept paths (DB error etc.) so a legitimate
  *  retry isn't blocked by a stale burn marker. */
 export const unburnInviteToken = store.unburn;
+/** Whether the invitation still has an unexpired, unconsumed token — Redis TTL
+ *  is the single truth for invite expiry (see the module comment). */
+export async function hasLiveInviteToken(redis, invitationId) {
+    return (await store.getTokenHashForSubject(redis, invitationId)) !== null;
+}

package/dist/auth-email-password/magic-link-mail.js

@@ -44,6 +44,7 @@ export async function dispatchMagicLinkMail(notify, spec, params) {
     await notify(spec.notificationType, {
         route: { email: params.email },
         data: content,
+        locale,
         priority: "critical",
     });
 }

package/dist/auth-email-password/web/auth-form-primitives.d.ts

@@ -8,8 +8,14 @@ export declare function useAuthShell(): AuthShellRenderer | null;
 export type AuthCardProps = {
     readonly title?: string;
     readonly subtitle?: ReactNode;
+    /** Merged onto the Card (default `w-full max-w-sm`). */
+    readonly className?: string;
+    readonly headerClassName?: string;
+    readonly titleClassName?: string;
+    /** Merged onto the body wrapper (default `p-6 pt-0 flex flex-col gap-4`). */
+    readonly bodyClassName?: string;
     readonly children: ReactNode;
 };
-export declare function AuthCard({ title, subtitle, children }: AuthCardProps): ReactNode;
+export declare function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }: AuthCardProps): ReactNode;
 export declare function parseUrlToken(paramName?: string): string;
 export declare function useUrlToken(override?: string, paramName?: string): string;

package/dist/auth-email-password/web/auth-form-primitives.js

@@ -15,7 +15,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Link-Styles laufen über das Link-Primitive (variant="button"/"muted") —
 // die früheren authButtonClass/authMutedLinkClass sind dorthin gewandert.
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
-import { BareFormProvider } from "@cosmicdrift/kumiko-renderer-web";
+import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer-web";
 import { createContext, useContext, useEffect, useState } from "react";
 const defaultAuthShell = (card) => (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background px-4", children: card }));
 const AuthShellContext = createContext(null);
@@ -26,14 +26,14 @@ export function useAuthShell() {
     return useContext(AuthShellContext);
 }
 // kumiko-lint-ignore no-custom-primitives Wraps usePrimitives().Card, pure domain name for the auth-screen chrome, not a primitive reimplementation
-export function AuthCard({ title, subtitle, children }) {
+export function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }) {
     const { Card } = usePrimitives();
     const shell = useAuthShell() ?? defaultAuthShell;
     // h1 (Seiten-Hauptüberschrift) via Header-Slot erhalten — die Card-Default-
     // Header wäre h3. padded:false = Form sitzt randlos wie bisher (bare form).
-    const card = (_jsx(Card, { className: "w-full max-w-sm", options: { padded: false }, slots: {
-            header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: "flex flex-col space-y-1.5 p-6 pb-4", children: [title !== undefined && (_jsx("h1", { className: "text-xl font-semibold tracking-tight", children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
-        }, children: _jsx(BareFormProvider, { children: children }) }));
+    const card = (_jsx(Card, { className: cn("w-full max-w-sm", className), options: { padded: false }, slots: {
+            header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: cn("flex flex-col space-y-1.5 p-6 pb-4", headerClassName), children: [title !== undefined && (_jsx("h1", { className: cn("text-xl font-semibold tracking-tight", titleClassName), children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
+        }, children: _jsx(BareFormProvider, { children: _jsx("div", { className: cn("p-6 pt-0 flex flex-col gap-4", bodyClassName), children: children }) }) }));
     return shell(card);
 }
 // Liest `?<paramName>=<value>` aus der aktuellen URL — typisches

package/dist/auth-email-password/web/confirm-account-unlock-screen.js

@@ -30,14 +30,14 @@ export function ConfirmAccountUnlockScreen({ title, token: tokenProp, loginHref
         })();
     }, [status, token]);
     if (status === "missing-token") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }));
     }
     if (status === "verifying") {
         return (_jsx(AuthCard, { children: _jsx("div", { className: "p-6", children: _jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.unlockAccount.verifying") }) }) }));
     }
     if (status === "success") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.successTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.unlockAccount.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.successTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.unlockAccount.goToLogin") })] }));
     }
     // status === "error"
-    return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }));
 }

package/dist/auth-email-password/web/forgot-password-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // ForgotPasswordScreen — Form mit email-input. Submit triggert
 // /api/auth/request-password-reset (silent-success, kein account-
@@ -53,5 +53,5 @@ export function ForgotPasswordScreen({ title, subtitle, loginHref = "/login", })
         void doSubmit();
     };
     const effectiveTitle = title ?? t("auth.forgotPassword.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.forgotPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.forgotPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.forgotPassword.backToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.forgotPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "forgot-email", label: t("auth.forgotPassword.email"), required: true, children: _jsx(Input, { kind: "text", id: "forgot-email", name: "forgot-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.forgotPassword.submitting") : t("auth.forgotPassword.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.forgotPassword.backToLogin") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.forgotPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.forgotPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.forgotPassword.backToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.forgotPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "forgot-email", label: t("auth.forgotPassword.email"), required: true, children: _jsx(Input, { kind: "text", id: "forgot-email", name: "forgot-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.forgotPassword.submitting") : t("auth.forgotPassword.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.forgotPassword.backToLogin") })] })) }));
 }

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -128,14 +128,14 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
         void acceptAnonNew();
     };
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.inviteAccept.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.inviteAccept.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.intro") }), mode === "loggedin" ? (_jsxs(Form, { onSubmit: onSubmit, children: [_jsx("p", { className: "text-sm", children: t("auth.inviteAccept.loggedInAs", { email: session.user?.email ?? "" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.acceptButton") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
-                                setMode("anon-existing");
-                            }, children: t("auth.inviteAccept.useOtherAccount") })] })) : (_jsxs(Form, { onSubmit: onSubmit, children: [mode === "anon-existing" && (_jsx(Field, { id: "invite-email", label: t("auth.inviteAccept.email"), required: true, children: _jsx(Input, { kind: "email", id: "invite-email", name: "invite-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) })), _jsx(Field, { id: "invite-password", label: t("auth.inviteAccept.password"), required: true, children: _jsx(Input, { kind: "password", id: "invite-password", name: "invite-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: mode === "anon-existing" ? "current-password" : "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.submit") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
-                                setMode(mode === "anon-existing" ? "anon-new" : "anon-existing");
-                                setError(null);
-                            }, children: mode === "anon-existing"
-                                ? t("auth.inviteAccept.toggleNew")
-                                : t("auth.inviteAccept.toggleExisting") })] }))] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.intro") }), mode === "loggedin" ? (_jsxs(Form, { onSubmit: onSubmit, children: [_jsx("p", { className: "text-sm", children: t("auth.inviteAccept.loggedInAs", { email: session.user?.email ?? "" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.acceptButton") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
+                            setMode("anon-existing");
+                        }, children: t("auth.inviteAccept.useOtherAccount") })] })) : (_jsxs(Form, { onSubmit: onSubmit, children: [mode === "anon-existing" && (_jsx(Field, { id: "invite-email", label: t("auth.inviteAccept.email"), required: true, children: _jsx(Input, { kind: "email", id: "invite-email", name: "invite-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) })), _jsx(Field, { id: "invite-password", label: t("auth.inviteAccept.password"), required: true, children: _jsx(Input, { kind: "password", id: "invite-password", name: "invite-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: mode === "anon-existing" ? "current-password" : "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.submit") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
+                            setMode(mode === "anon-existing" ? "anon-new" : "anon-existing");
+                            setError(null);
+                        }, children: mode === "anon-existing"
+                            ? t("auth.inviteAccept.toggleNew")
+                            : t("auth.inviteAccept.toggleExisting") })] }))] }));
 }

package/dist/auth-email-password/web/login-screen.js

@@ -113,12 +113,12 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
     };
     const effectiveTitle = title ?? t("auth.login.title");
     const effectiveSubmit = submitLabel ?? t("auth.login.submit");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "login-email", label: t("auth.login.email"), required: true, children: _jsx(Input, { kind: "email", id: "login-email", name: "login-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), _jsx(Field, { id: "login-password", label: t("auth.login.password"), required: true, children: _jsx(Input, { kind: "password", id: "login-password", name: "login-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "current-password" }) }), session.signedOutReason === "session-ended" && (_jsx(Banner, { variant: "info", children: t("auth.login.sessionEnded") })), resendStatus.kind === "success" ? (_jsx(Banner, { variant: "info", children: t("auth.login.resendSuccess") })) : error !== null ? (_jsx(Banner, { variant: "error", children: _jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("span", { children: (() => {
-                                            const { key, params } = reasonToKey(error);
-                                            return t(key, params);
-                                        })() }), error.reason === "email_not_verified" &&
-                                        email.trim().length > 0 &&
-                                        email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
-                                                ? t("auth.login.submitting")
-                                                : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && unlockAccountHref !== undefined && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: unlockAccountHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), forgotPasswordHref !== undefined && (_jsx(Link, { href: forgotPasswordHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: [_jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "login-email", label: t("auth.login.email"), required: true, children: _jsx(Input, { kind: "email", id: "login-email", name: "login-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), _jsx(Field, { id: "login-password", label: t("auth.login.password"), required: true, children: _jsx(Input, { kind: "password", id: "login-password", name: "login-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "current-password" }) }), session.signedOutReason === "session-ended" && (_jsx(Banner, { variant: "info", children: t("auth.login.sessionEnded") })), resendStatus.kind === "success" ? (_jsx(Banner, { variant: "info", children: t("auth.login.resendSuccess") })) : error !== null ? (_jsx(Banner, { variant: "error", children: _jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("span", { children: (() => {
+                                        const { key, params } = reasonToKey(error);
+                                        return t(key, params);
+                                    })() }), error.reason === "email_not_verified" &&
+                                    email.trim().length > 0 &&
+                                    email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
+                                            ? t("auth.login.submitting")
+                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && unlockAccountHref !== undefined && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: unlockAccountHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), forgotPasswordHref !== undefined && (_jsx(Link, { href: forgotPasswordHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
 }

package/dist/auth-email-password/web/request-account-unlock-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // RequestAccountUnlockScreen — form with an email input. Submit triggers
 // /api/auth/request-account-unlock (silent-success, no account
@@ -54,5 +54,5 @@ export function RequestAccountUnlockScreen({ title, subtitle, loginHref = "/logi
         void doSubmit();
     };
     const effectiveTitle = title ?? t("auth.requestUnlock.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.requestUnlock.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.requestUnlock.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.requestUnlock.backToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.requestUnlock.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "unlock-email", label: t("auth.requestUnlock.email"), required: true, children: _jsx(Input, { kind: "text", id: "unlock-email", name: "unlock-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.requestUnlock.submitting") : t("auth.requestUnlock.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.requestUnlock.backToLogin") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.requestUnlock.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.requestUnlock.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.requestUnlock.backToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.requestUnlock.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "unlock-email", label: t("auth.requestUnlock.email"), required: true, children: _jsx(Input, { kind: "text", id: "unlock-email", name: "unlock-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.requestUnlock.submitting") : t("auth.requestUnlock.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.requestUnlock.backToLogin") })] })) }));
 }

package/dist/auth-email-password/web/reset-password-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // ResetPasswordScreen — liest `?token=...` aus der URL, zeigt Form mit
 // new + confirm-password. Submit triggert /api/auth/reset-password mit
@@ -62,7 +62,7 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     // submitten würde nur den invalidResetToken-Error zeigen — das ist
     // verwirrend. Lieber upfront eine klare Message.
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
 }

package/dist/auth-email-password/web/session-bootstrap-error.js

@@ -24,7 +24,7 @@ export function SessionBootstrapErrorScreen({ failure, onRetry, onSignOut, }) {
             .then(onRetry)
             .then(() => setRetrying(false));
     };
-    return (_jsx("div", { "data-testid": "session-bootstrap-error", "data-http-status": failure.httpStatus ?? "network", children: _jsx(AuthCard, { title: t("auth.sessionBootstrap.errorTitle"), children: _jsxs("div", { className: "flex flex-col gap-4 px-6 pb-4", children: [_jsx(Banner, { variant: "error", children: failure.httpStatus === 429
-                            ? t("auth.sessionBootstrap.rateLimitedBody")
-                            : t("auth.sessionBootstrap.errorBody") }), _jsx(Button, { variant: "primary", onClick: handleRetry, disabled: retrying, children: retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry") }), onSignOut !== undefined && (_jsx(Button, { variant: "secondary", onClick: () => void onSignOut(), disabled: retrying, children: t("auth.sessionBootstrap.signOut") }))] }) }) }));
+    return (_jsx("div", { "data-testid": "session-bootstrap-error", "data-http-status": failure.httpStatus ?? "network", children: _jsxs(AuthCard, { title: t("auth.sessionBootstrap.errorTitle"), bodyClassName: "pb-4", children: [_jsx(Banner, { variant: "error", children: failure.httpStatus === 429
+                        ? t("auth.sessionBootstrap.rateLimitedBody")
+                        : t("auth.sessionBootstrap.errorBody") }), _jsx(Button, { variant: "primary", onClick: handleRetry, disabled: retrying, children: retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry") }), onSignOut !== undefined && (_jsx(Button, { variant: "secondary", onClick: () => void onSignOut(), disabled: retrying, children: t("auth.sessionBootstrap.signOut") }))] }) }));
 }

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -77,10 +77,10 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
     // Kein Token in der URL → klare Message statt Form ohne Token
     // (würde nur invalidSignupToken zeigen, verwirrend).
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] }));
     }
     if (continueHref !== null) {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.signupComplete.activated") }), _jsx(Link, { href: continueHref, variant: "button", children: t("auth.signupComplete.continue") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.signupComplete.activated") }), _jsx(Link, { href: continueHref, variant: "button", children: t("auth.signupComplete.continue") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-password", label: t("auth.signupComplete.password"), required: true, children: _jsx(Input, { kind: "password", id: "signup-password", name: "signup-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "signup-confirm-password", label: t("auth.signupComplete.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "signup-confirm-password", name: "signup-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signupComplete.submitting") : t("auth.signupComplete.submit") })] })] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-password", label: t("auth.signupComplete.password"), required: true, children: _jsx(Input, { kind: "password", id: "signup-password", name: "signup-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "signup-confirm-password", label: t("auth.signupComplete.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "signup-confirm-password", name: "signup-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signupComplete.submitting") : t("auth.signupComplete.submit") })] })] }));
 }