@cosmicdrift/kumiko-bundled-features 0.341.0 → 0.342.0

package/dist/audit/constants.d.ts

@@ -13,3 +13,6 @@ export declare const AuditQueries: {
 export declare const AUDIT_LOG_SCREEN_ID: "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export declare const AUDIT_LOG_DETAIL_SCREEN_ID: "audit-log-detail";
+/** Config key (system scope) for how long `escapeHatchUse` audit events are kept. */
+export declare const ESCAPE_HATCH_RETENTION_DAYS_KEY: "audit:config:escape-hatch-retention-days";
+export declare const DEFAULT_ESCAPE_HATCH_RETENTION_DAYS = 90;

package/dist/audit/constants.js

@@ -18,3 +18,6 @@ export const AuditQueries = {
 export const AUDIT_LOG_SCREEN_ID = "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export const AUDIT_LOG_DETAIL_SCREEN_ID = "audit-log-detail";
+/** Config key (system scope) for how long `escapeHatchUse` audit events are kept. */
+export const ESCAPE_HATCH_RETENTION_DAYS_KEY = "audit:config:escape-hatch-retention-days";
+export const DEFAULT_ESCAPE_HATCH_RETENTION_DAYS = 90;

package/dist/audit/feature.js

@@ -1,9 +1,10 @@
-import { access, defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries } from "./constants.js";
+import { access, createSystemConfig, defineFeature, i18nKey, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries, DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, } from "./constants.js";
 import { escapeHatchUsedSchema } from "./escape-hatch-audit-sink.js";
 import { detailsQuery } from "./handlers/details.query.js";
 import { listQuery } from "./handlers/list.query.js";
 import { AUDIT_I18N } from "./i18n.js";
+import { runEscapeHatchRetention } from "./run-escape-hatch-retention.js";
 // Audit feature — exposes a filtered read over the framework's event log.
 //
 // Design: the event-store IS the audit trail (every entity write produces
@@ -12,10 +13,11 @@ import { AUDIT_I18N } from "./i18n.js";
 // the existing `events` table. See handlers/list.query.ts for the filter
 // surface.
 //
-// Retention lives elsewhere. Events are kept indefinitely as the source of
-// truth for state; archive or compress policies are a separate concern
-// (tracked with the snapshot/archive infrastructure that already exists in
-// the framework).
+// Retention: only `escapeHatchUse` events are pruned (daily job, config key
+// `escapeHatchRetentionDays`). All other events stay as the source of truth
+// for state; archive or compress policies are a separate concern (tracked
+// with the snapshot/archive infrastructure that already exists in the
+// framework).
 export function createAuditFeature() {
     return defineFeature("audit", (r) => {
         r.describe("Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection \u2014 the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).");
@@ -25,9 +27,34 @@ export function createAuditFeature() {
             recommended: false,
         });
         r.translations({ keys: AUDIT_I18N });
-        r.requires("tenant", "user");
+        r.requires("tenant", "user", "config");
         // Registered so ops tools/MSPs can discover the type — escape-hatch-audit-sink.ts appends it via the low-level event-store API.
         r.defineEvent("escape-hatch-used", escapeHatchUsedSchema, { piiFields: "none" });
+        r.config("escapeHatchRetentionDays", createSystemConfig("number", {
+            default: DEFAULT_ESCAPE_HATCH_RETENTION_DAYS,
+            bounds: { min: 1 },
+        }));
+        r.job({
+            name: "escape-hatch-retention",
+            trigger: { cron: "30 3 * * *" },
+            concurrency: "skip",
+            // pruneEvents needs a transaction-capable connection, which only unsafeRaw() hands a job.
+            escapeHatch: {
+                reason: "prunes expired escapeHatchUse audit events through pruneEvents",
+                grants: ["unsafeRaw"],
+            },
+            handler: async (_payload, ctx) => {
+                if (!ctx.registry) {
+                    throw new Error("escape-hatch-retention: ctx.registry required (JobContext incomplete)");
+                }
+                await runEscapeHatchRetention({
+                    db: ctx.db.unsafeRaw(),
+                    registry: ctx.registry,
+                    configResolver: ctx.configResolver,
+                    userId: ctx._userId ?? SYSTEM_USER_ID,
+                });
+            },
+        });
         const queries = {
             list: r.queryHandler(listQuery),
             details: r.queryHandler(detailsQuery),

package/dist/audit/run-escape-hatch-retention.d.ts

@@ -0,0 +1,10 @@
+import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type ConfigResolver, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { type PruneEventsResult } from "@cosmicdrift/kumiko-framework/pipeline";
+export declare function isDbConnection(runner: DbRunner): runner is DbConnection;
+export declare function runEscapeHatchRetention(args: {
+    readonly db: DbRunner;
+    readonly registry: Registry;
+    readonly configResolver: ConfigResolver | undefined;
+    readonly userId: string;
+}): Promise<PruneEventsResult>;

package/dist/audit/run-escape-hatch-retention.js

@@ -0,0 +1,27 @@
+import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
+import { createConfigAccessor } from "../config/index.js";
+import { DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, ESCAPE_HATCH_RETENTION_DAYS_KEY, } from "./constants.js";
+import { ESCAPE_HATCH_USE_AGGREGATE_TYPE } from "./escape-hatch-audit-sink.js";
+// pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
+export function isDbConnection(runner) {
+    return "begin" in runner && typeof runner.begin === "function";
+}
+async function resolveRetentionDays(args) {
+    if (!args.configResolver)
+        return DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
+    const config = createConfigAccessor(args.registry, args.configResolver, SYSTEM_TENANT_ID, args.userId, args.db);
+    const raw = await config(ESCAPE_HATCH_RETENTION_DAYS_KEY);
+    return typeof raw === "number" && raw >= 1 ? raw : DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
+}
+export async function runEscapeHatchRetention(args) {
+    const { db } = args;
+    if (!isDbConnection(db)) {
+        throw new Error("audit escape-hatch retention: a transaction-free DbConnection is required");
+    }
+    const olderThanDays = await resolveRetentionDays({ ...args, db });
+    return pruneEvents(db, {
+        aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+        olderThanDays,
+    });
+}

package/dist/auth-email-password/bootstrap.d.ts

@@ -1,6 +1,6 @@
-import { makeDispatchSystemWrite } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, type SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { Redis } from "ioredis";
 import type { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
@@ -15,6 +15,12 @@ export type BootstrapSeedDeps = {
     readonly tenantId: TenantId;
     readonly db: DbConnection;
     readonly dispatchSystemWrite: ReturnType<typeof makeDispatchSystemWrite>;
+    /** Writes as the system user with the given tenant roles in the seeded
+     *  tenant; use it when the app gates tenant data on its own roles rather
+     *  than SystemAdmin. */
+    readonly dispatchWriteAs: (args: Pick<SystemDispatchArgs, "handlerQn" | "payload"> & {
+        readonly roles: readonly string[];
+    }) => Promise<WriteResult>;
 };
 export type BootstrapConfigValue = string | number | boolean;
 export type BootstrapTenant = {

package/dist/auth-email-password/bootstrap.js

@@ -4,7 +4,7 @@
 // exactly as for any other writer. Nobody gets a role before accepting: the
 // invitation row holds membership role + global roles until the invitee
 // accepts through the regular invite-accept routes.
-import { makeDispatchSystemWrite } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -140,7 +140,12 @@ export async function bootstrapTenants(deps, plan) {
         const outcome = await ensureTenant(deps, tenant);
         const shouldSeed = outcome === "created" && plan.seed !== undefined;
         if (shouldSeed) {
-            await plan.seed?.({ tenantId: tenant.id, db: deps.db, dispatchSystemWrite });
+            await plan.seed?.({
+                tenantId: tenant.id,
+                db: deps.db,
+                dispatchSystemWrite,
+                dispatchWriteAs: ({ handlerQn, payload, roles }) => deps.dispatcher.write(handlerQn, payload, createSystemUser(tenant.id, roles)),
+            });
         }
         const configApplied = await applyTenantConfig(deps, tenant);
         tenants.push({ id: tenant.id, outcome, seeded: shouldSeed, configApplied });

package/dist/auth-email-password/web/auth-form-primitives.d.ts

@@ -8,8 +8,14 @@ export declare function useAuthShell(): AuthShellRenderer | null;
 export type AuthCardProps = {
     readonly title?: string;
     readonly subtitle?: ReactNode;
+    /** Merged onto the Card (default `w-full max-w-sm`). */
+    readonly className?: string;
+    readonly headerClassName?: string;
+    readonly titleClassName?: string;
+    /** Merged onto the body wrapper (default `p-6 pt-0 flex flex-col gap-4`). */
+    readonly bodyClassName?: string;
     readonly children: ReactNode;
 };
-export declare function AuthCard({ title, subtitle, children }: AuthCardProps): ReactNode;
+export declare function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }: AuthCardProps): ReactNode;
 export declare function parseUrlToken(paramName?: string): string;
 export declare function useUrlToken(override?: string, paramName?: string): string;

package/dist/auth-email-password/web/auth-form-primitives.js

@@ -15,7 +15,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Link-Styles laufen über das Link-Primitive (variant="button"/"muted") —
 // die früheren authButtonClass/authMutedLinkClass sind dorthin gewandert.
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
-import { BareFormProvider } from "@cosmicdrift/kumiko-renderer-web";
+import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer-web";
 import { createContext, useContext, useEffect, useState } from "react";
 const defaultAuthShell = (card) => (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background px-4", children: card }));
 const AuthShellContext = createContext(null);
@@ -26,14 +26,14 @@ export function useAuthShell() {
     return useContext(AuthShellContext);
 }
 // kumiko-lint-ignore no-custom-primitives Wraps usePrimitives().Card, pure domain name for the auth-screen chrome, not a primitive reimplementation
-export function AuthCard({ title, subtitle, children }) {
+export function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }) {
     const { Card } = usePrimitives();
     const shell = useAuthShell() ?? defaultAuthShell;
     // h1 (Seiten-Hauptüberschrift) via Header-Slot erhalten — die Card-Default-
     // Header wäre h3. padded:false = Form sitzt randlos wie bisher (bare form).
-    const card = (_jsx(Card, { className: "w-full max-w-sm", options: { padded: false }, slots: {
-            header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: "flex flex-col space-y-1.5 p-6 pb-4", children: [title !== undefined && (_jsx("h1", { className: "text-xl font-semibold tracking-tight", children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
-        }, children: _jsx(BareFormProvider, { children: children }) }));
+    const card = (_jsx(Card, { className: cn("w-full max-w-sm", className), options: { padded: false }, slots: {
+            header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: cn("flex flex-col space-y-1.5 p-6 pb-4", headerClassName), children: [title !== undefined && (_jsx("h1", { className: cn("text-xl font-semibold tracking-tight", titleClassName), children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
+        }, children: _jsx(BareFormProvider, { children: _jsx("div", { className: cn("p-6 pt-0 flex flex-col gap-4", bodyClassName), children: children }) }) }));
     return shell(card);
 }
 // Liest `?<paramName>=<value>` aus der aktuellen URL — typisches

package/dist/auth-email-password/web/confirm-account-unlock-screen.js

@@ -30,14 +30,14 @@ export function ConfirmAccountUnlockScreen({ title, token: tokenProp, loginHref
         })();
     }, [status, token]);
     if (status === "missing-token") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }));
     }
     if (status === "verifying") {
         return (_jsx(AuthCard, { children: _jsx("div", { className: "p-6", children: _jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.unlockAccount.verifying") }) }) }));
     }
     if (status === "success") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.successTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.unlockAccount.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.successTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.unlockAccount.goToLogin") })] }));
     }
     // status === "error"
-    return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }));
 }

package/dist/auth-email-password/web/forgot-password-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // ForgotPasswordScreen — Form mit email-input. Submit triggert
 // /api/auth/request-password-reset (silent-success, kein account-
@@ -53,5 +53,5 @@ export function ForgotPasswordScreen({ title, subtitle, loginHref = "/login", })
         void doSubmit();
     };
     const effectiveTitle = title ?? t("auth.forgotPassword.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.forgotPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.forgotPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.forgotPassword.backToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.forgotPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "forgot-email", label: t("auth.forgotPassword.email"), required: true, children: _jsx(Input, { kind: "text", id: "forgot-email", name: "forgot-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.forgotPassword.submitting") : t("auth.forgotPassword.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.forgotPassword.backToLogin") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.forgotPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.forgotPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.forgotPassword.backToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.forgotPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "forgot-email", label: t("auth.forgotPassword.email"), required: true, children: _jsx(Input, { kind: "text", id: "forgot-email", name: "forgot-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.forgotPassword.submitting") : t("auth.forgotPassword.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.forgotPassword.backToLogin") })] })) }));
 }

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -128,14 +128,14 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
         void acceptAnonNew();
     };
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.inviteAccept.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.inviteAccept.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.intro") }), mode === "loggedin" ? (_jsxs(Form, { onSubmit: onSubmit, children: [_jsx("p", { className: "text-sm", children: t("auth.inviteAccept.loggedInAs", { email: session.user?.email ?? "" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.acceptButton") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
-                                setMode("anon-existing");
-                            }, children: t("auth.inviteAccept.useOtherAccount") })] })) : (_jsxs(Form, { onSubmit: onSubmit, children: [mode === "anon-existing" && (_jsx(Field, { id: "invite-email", label: t("auth.inviteAccept.email"), required: true, children: _jsx(Input, { kind: "email", id: "invite-email", name: "invite-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) })), _jsx(Field, { id: "invite-password", label: t("auth.inviteAccept.password"), required: true, children: _jsx(Input, { kind: "password", id: "invite-password", name: "invite-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: mode === "anon-existing" ? "current-password" : "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.submit") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
-                                setMode(mode === "anon-existing" ? "anon-new" : "anon-existing");
-                                setError(null);
-                            }, children: mode === "anon-existing"
-                                ? t("auth.inviteAccept.toggleNew")
-                                : t("auth.inviteAccept.toggleExisting") })] }))] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.intro") }), mode === "loggedin" ? (_jsxs(Form, { onSubmit: onSubmit, children: [_jsx("p", { className: "text-sm", children: t("auth.inviteAccept.loggedInAs", { email: session.user?.email ?? "" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.acceptButton") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
+                            setMode("anon-existing");
+                        }, children: t("auth.inviteAccept.useOtherAccount") })] })) : (_jsxs(Form, { onSubmit: onSubmit, children: [mode === "anon-existing" && (_jsx(Field, { id: "invite-email", label: t("auth.inviteAccept.email"), required: true, children: _jsx(Input, { kind: "email", id: "invite-email", name: "invite-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) })), _jsx(Field, { id: "invite-password", label: t("auth.inviteAccept.password"), required: true, children: _jsx(Input, { kind: "password", id: "invite-password", name: "invite-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: mode === "anon-existing" ? "current-password" : "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.submit") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
+                            setMode(mode === "anon-existing" ? "anon-new" : "anon-existing");
+                            setError(null);
+                        }, children: mode === "anon-existing"
+                            ? t("auth.inviteAccept.toggleNew")
+                            : t("auth.inviteAccept.toggleExisting") })] }))] }));
 }

package/dist/auth-email-password/web/login-screen.js

@@ -113,12 +113,12 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
     };
     const effectiveTitle = title ?? t("auth.login.title");
     const effectiveSubmit = submitLabel ?? t("auth.login.submit");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "login-email", label: t("auth.login.email"), required: true, children: _jsx(Input, { kind: "email", id: "login-email", name: "login-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), _jsx(Field, { id: "login-password", label: t("auth.login.password"), required: true, children: _jsx(Input, { kind: "password", id: "login-password", name: "login-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "current-password" }) }), session.signedOutReason === "session-ended" && (_jsx(Banner, { variant: "info", children: t("auth.login.sessionEnded") })), resendStatus.kind === "success" ? (_jsx(Banner, { variant: "info", children: t("auth.login.resendSuccess") })) : error !== null ? (_jsx(Banner, { variant: "error", children: _jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("span", { children: (() => {
-                                            const { key, params } = reasonToKey(error);
-                                            return t(key, params);
-                                        })() }), error.reason === "email_not_verified" &&
-                                        email.trim().length > 0 &&
-                                        email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
-                                                ? t("auth.login.submitting")
-                                                : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && unlockAccountHref !== undefined && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: unlockAccountHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), forgotPasswordHref !== undefined && (_jsx(Link, { href: forgotPasswordHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: [_jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "login-email", label: t("auth.login.email"), required: true, children: _jsx(Input, { kind: "email", id: "login-email", name: "login-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), _jsx(Field, { id: "login-password", label: t("auth.login.password"), required: true, children: _jsx(Input, { kind: "password", id: "login-password", name: "login-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "current-password" }) }), session.signedOutReason === "session-ended" && (_jsx(Banner, { variant: "info", children: t("auth.login.sessionEnded") })), resendStatus.kind === "success" ? (_jsx(Banner, { variant: "info", children: t("auth.login.resendSuccess") })) : error !== null ? (_jsx(Banner, { variant: "error", children: _jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("span", { children: (() => {
+                                        const { key, params } = reasonToKey(error);
+                                        return t(key, params);
+                                    })() }), error.reason === "email_not_verified" &&
+                                    email.trim().length > 0 &&
+                                    email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
+                                            ? t("auth.login.submitting")
+                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && unlockAccountHref !== undefined && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: unlockAccountHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), forgotPasswordHref !== undefined && (_jsx(Link, { href: forgotPasswordHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
 }

package/dist/auth-email-password/web/request-account-unlock-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // RequestAccountUnlockScreen — form with an email input. Submit triggers
 // /api/auth/request-account-unlock (silent-success, no account
@@ -54,5 +54,5 @@ export function RequestAccountUnlockScreen({ title, subtitle, loginHref = "/logi
         void doSubmit();
     };
     const effectiveTitle = title ?? t("auth.requestUnlock.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.requestUnlock.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.requestUnlock.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.requestUnlock.backToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.requestUnlock.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "unlock-email", label: t("auth.requestUnlock.email"), required: true, children: _jsx(Input, { kind: "text", id: "unlock-email", name: "unlock-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.requestUnlock.submitting") : t("auth.requestUnlock.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.requestUnlock.backToLogin") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.requestUnlock.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.requestUnlock.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.requestUnlock.backToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.requestUnlock.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "unlock-email", label: t("auth.requestUnlock.email"), required: true, children: _jsx(Input, { kind: "text", id: "unlock-email", name: "unlock-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.requestUnlock.submitting") : t("auth.requestUnlock.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.requestUnlock.backToLogin") })] })) }));
 }

package/dist/auth-email-password/web/reset-password-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // ResetPasswordScreen — liest `?token=...` aus der URL, zeigt Form mit
 // new + confirm-password. Submit triggert /api/auth/reset-password mit
@@ -62,7 +62,7 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     // submitten würde nur den invalidResetToken-Error zeigen — das ist
     // verwirrend. Lieber upfront eine klare Message.
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
 }

package/dist/auth-email-password/web/session-bootstrap-error.js

@@ -24,7 +24,7 @@ export function SessionBootstrapErrorScreen({ failure, onRetry, onSignOut, }) {
             .then(onRetry)
             .then(() => setRetrying(false));
     };
-    return (_jsx("div", { "data-testid": "session-bootstrap-error", "data-http-status": failure.httpStatus ?? "network", children: _jsx(AuthCard, { title: t("auth.sessionBootstrap.errorTitle"), children: _jsxs("div", { className: "flex flex-col gap-4 px-6 pb-4", children: [_jsx(Banner, { variant: "error", children: failure.httpStatus === 429
-                            ? t("auth.sessionBootstrap.rateLimitedBody")
-                            : t("auth.sessionBootstrap.errorBody") }), _jsx(Button, { variant: "primary", onClick: handleRetry, disabled: retrying, children: retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry") }), onSignOut !== undefined && (_jsx(Button, { variant: "secondary", onClick: () => void onSignOut(), disabled: retrying, children: t("auth.sessionBootstrap.signOut") }))] }) }) }));
+    return (_jsx("div", { "data-testid": "session-bootstrap-error", "data-http-status": failure.httpStatus ?? "network", children: _jsxs(AuthCard, { title: t("auth.sessionBootstrap.errorTitle"), bodyClassName: "pb-4", children: [_jsx(Banner, { variant: "error", children: failure.httpStatus === 429
+                        ? t("auth.sessionBootstrap.rateLimitedBody")
+                        : t("auth.sessionBootstrap.errorBody") }), _jsx(Button, { variant: "primary", onClick: handleRetry, disabled: retrying, children: retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry") }), onSignOut !== undefined && (_jsx(Button, { variant: "secondary", onClick: () => void onSignOut(), disabled: retrying, children: t("auth.sessionBootstrap.signOut") }))] }) }));
 }

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -77,10 +77,10 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
     // Kein Token in der URL → klare Message statt Form ohne Token
     // (würde nur invalidSignupToken zeigen, verwirrend).
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] }));
     }
     if (continueHref !== null) {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.signupComplete.activated") }), _jsx(Link, { href: continueHref, variant: "button", children: t("auth.signupComplete.continue") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.signupComplete.activated") }), _jsx(Link, { href: continueHref, variant: "button", children: t("auth.signupComplete.continue") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-password", label: t("auth.signupComplete.password"), required: true, children: _jsx(Input, { kind: "password", id: "signup-password", name: "signup-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "signup-confirm-password", label: t("auth.signupComplete.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "signup-confirm-password", name: "signup-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signupComplete.submitting") : t("auth.signupComplete.submit") })] })] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-password", label: t("auth.signupComplete.password"), required: true, children: _jsx(Input, { kind: "password", id: "signup-password", name: "signup-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "signup-confirm-password", label: t("auth.signupComplete.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "signup-confirm-password", name: "signup-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signupComplete.submitting") : t("auth.signupComplete.submit") })] })] }));
 }

package/dist/auth-email-password/web/signup-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // SignupScreen — Magic-Link-Self-Signup, Step 1.
 //
@@ -67,5 +67,5 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         }
     };
     const effectiveTitle = title ?? t("auth.signup.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.signup.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.signup.successBody") })] }), _jsx(Button, { variant: "secondary", onClick: onResend, disabled: submitting, children: t("auth.signup.resend") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signup.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-email", label: t("auth.signup.email"), required: true, children: _jsx(Input, { kind: "email", id: "signup-email", name: "signup-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signup.submitting") : t("auth.signup.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.signup.haveAccount") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.signup.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.signup.successBody") })] }), _jsx(Button, { variant: "secondary", onClick: onResend, disabled: submitting, children: t("auth.signup.resend") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signup.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-email", label: t("auth.signup.email"), required: true, children: _jsx(Input, { kind: "email", id: "signup-email", name: "signup-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signup.submitting") : t("auth.signup.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.signup.haveAccount") })] })) }));
 }

package/dist/auth-email-password/web/verify-email-screen.js

@@ -33,14 +33,14 @@ export function VerifyEmailScreen({ title, token: tokenProp, loginHref = "/login
         })();
     }, [status, token]);
     if (status === "missing-token") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }));
     }
     if (status === "verifying") {
         return (_jsx(AuthCard, { children: _jsx("div", { className: "p-6", children: _jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.verifyEmail.verifying") }) }) }));
     }
     if (status === "success") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.successTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.verifyEmail.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.successTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.verifyEmail.goToLogin") })] }));
     }
     // status === "error"
-    return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }));
 }

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -127,9 +127,9 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
         e?.preventDefault();
         void confirmSetup();
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
-                        ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
-                        : t(reasonToKey(error)) })) : null, !setup && (_jsx(Section, { testId: "mfa-setup-preauth-intro", actions: _jsx(Button, { variant: "primary", onClick: () => void startSetup(), loading: busy, disabled: busy, children: t("auth.mfa.setup.start") }), children: _jsx("span", { className: "text-sm text-muted-foreground", children: t("auth.mfa.setup.intro") }) })), setup && (_jsx(Form, { onSubmit: onSubmit, children: _jsxs(Section, { testId: "mfa-setup-preauth-setup", actions: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }), children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") }), _jsx("div", { className: "h-40 w-40", 
-                                        // biome-ignore lint/security/noDangerouslySetInnerHtml: qrcode-generated SVG, no user input
-                                        dangerouslySetInnerHTML: { __html: setup.qrSvg } }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
+                    ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
+                    : t(reasonToKey(error)) })) : null, !setup && (_jsx(Section, { testId: "mfa-setup-preauth-intro", actions: _jsx(Button, { variant: "primary", onClick: () => void startSetup(), loading: busy, disabled: busy, children: t("auth.mfa.setup.start") }), children: _jsx("span", { className: "text-sm text-muted-foreground", children: t("auth.mfa.setup.intro") }) })), setup && (_jsx(Form, { onSubmit: onSubmit, children: _jsxs(Section, { testId: "mfa-setup-preauth-setup", actions: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }), children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") }), _jsx("div", { className: "h-40 w-40", 
+                                    // biome-ignore lint/security/noDangerouslySetInnerHtml: qrcode-generated SVG, no user input
+                                    dangerouslySetInnerHTML: { __html: setup.qrSvg } }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
 }

package/dist/auth-mfa/web/mfa-verify-screen.js

@@ -52,7 +52,7 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
         e?.preventDefault();
         void doSubmit();
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsx("div", { className: "p-6 pt-0 flex flex-col gap-4", children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
-                            ? t("auth.mfa.verify.submitting")
-                            : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }) }));
+    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
+                        ? t("auth.mfa.verify.submitting")
+                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
 }

package/dist/channel-email/email-channel.js

@@ -44,6 +44,7 @@ function emailEnvelopeFrom(data) {
     if (!data)
         return {};
     const from = typeof data["from"] === "string" ? data["from"] : undefined;
+    const fromName = typeof data["fromName"] === "string" ? data["fromName"] : undefined;
     const replyTo = typeof data["replyTo"] === "string" ? data["replyTo"] : undefined;
     const autoHeaders = listUnsubscribeHeaders(data);
     const explicitHeaders = stringHeaders(data["headers"]);
@@ -55,7 +56,12 @@ function emailEnvelopeFrom(data) {
     const headers = (!overridesUnsubscribe && autoHeaders) || explicitHeaders
         ? { ...(overridesUnsubscribe ? undefined : autoHeaders), ...explicitHeaders }
         : undefined;
-    return { ...(from && { from }), ...(replyTo && { replyTo }), ...(headers && { headers }) };
+    return {
+        ...(from && { from }),
+        ...(fromName && { fromName }),
+        ...(replyTo && { replyTo }),
+        ...(headers && { headers }),
+    };
 }
 export function createEmailChannel(options) {
     const { transport, renderer, resolveEmail } = options;

package/dist/channel-email/pii-guard.js

@@ -9,15 +9,16 @@ const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
 // blob); ciphertext in subject/body fails loud in dev and is redacted+logged
 // in prod.
 export function guardEmailMessage(message) {
-    // Every envelope address, not just `to`: a ciphertext From or Reply-To is
+    // Every envelope address, not just `to`: a ciphertext From, From-Name or Reply-To is
     // the same garbage as a ciphertext recipient — refuse rather than mail it.
     for (const [label, address] of [
-        ["recipient", message.to],
-        ["from", message.from],
-        ["reply-to", message.replyTo],
+        ["recipient address", message.to],
+        ["from address", message.from],
+        ["from name", message.fromName],
+        ["reply-to address", message.replyTo],
     ]) {
         if (address?.includes(CIPHERTEXT_MARKER)) {
-            throw new Error(`[channel-email] refusing to send: ${label} address is a PII ciphertext ` +
+            throw new Error(`[channel-email] refusing to send: ${label} is a PII ciphertext ` +
                 `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`);
         }
     }

package/dist/channel-email/smtp-transport.js

@@ -16,6 +16,27 @@
 // Volume-Apps muss der Caller eine eigene Implementation mit
 // dedizierter Queue (BullMQ + retry) drüberlegen.
 import { createTransport } from "nodemailer";
+import addressparser from "nodemailer/lib/addressparser";
+function isControlCharacter(char) {
+    const code = char.charCodeAt(0);
+    return code <= 0x1f || code === 0x7f;
+}
+// Control characters in a display name would let a caller inject headers.
+function sanitizedDisplayName(name) {
+    const cleaned = name
+        ?.split("")
+        .map((char) => (isControlCharacter(char) ? " " : char))
+        .join("")
+        .trim();
+    return cleaned === undefined || cleaned === "" ? undefined : cleaned;
+}
+function fromHeader(address, fromName) {
+    const name = sanitizedDisplayName(fromName);
+    if (name === undefined)
+        return address;
+    const [parsed] = addressparser(address, { flatten: true });
+    return parsed?.address ? { name, address: parsed.address } : address;
+}
 export function createSmtpTransport(options) {
     const transporter = createTransport({
         host: options.host,
@@ -29,7 +50,7 @@ export function createSmtpTransport(options) {
     return {
         async send(message) {
             await transporter.sendMail({
-                from: message.from ?? options.from,
+                from: fromHeader(message.from ?? options.from, message.fromName),
                 to: message.to,
                 subject: message.subject,
                 html: message.html,

package/dist/channel-email/types.d.ts

@@ -3,6 +3,7 @@ export type EmailMessage = {
     readonly subject: string;
     readonly html: string;
     readonly from?: string;
+    readonly fromName?: string;
     readonly replyTo?: string;
     readonly headers?: Readonly<Record<string, string>>;
 };

package/dist/waitlist/handlers/submit.write.js

@@ -89,7 +89,7 @@ export function createSubmitHandler(opts) {
                 locale: resolveWaitlistMailLocale(payload.locale),
             }));
             await sendBestEffort(ctx, "admin notice", async (notify) => {
-                const adminRecipient = opts.notifyRecipient?.(ctx);
+                const adminRecipient = await opts.notifyRecipient?.(ctx);
                 // skip: no admin recipient configured
                 if (!adminRecipient)
                     return;

package/dist/waitlist/options.d.ts

@@ -13,8 +13,9 @@ export type WaitlistInviteOptions = {
 };
 export type WaitlistOptions = {
     /** Address for an admin notification mail on each new entry. Null, an empty
-     *  string or an absent option sends none. Best effort, never fails the submit. */
-    readonly notifyRecipient?: (ctx: HandlerContext) => string | null;
+     *  string or an absent option sends none. Best effort, never fails the submit,
+     *  also when the resolver throws or rejects. */
+    readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
     /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
     readonly invite?: WaitlistInviteOptions;
     /** Default: 5 submits per IP per 10 minutes. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.341.0",
+  "version": "0.342.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -503,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.341.0",
-    "@cosmicdrift/kumiko-framework": "0.341.0",
-    "@cosmicdrift/kumiko-headless": "0.341.0",
-    "@cosmicdrift/kumiko-renderer": "0.341.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.341.0",
-    "@cosmicdrift/kumiko-types": "0.341.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.342.0",
+    "@cosmicdrift/kumiko-framework": "0.342.0",
+    "@cosmicdrift/kumiko-headless": "0.342.0",
+    "@cosmicdrift/kumiko-renderer": "0.342.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.342.0",
+    "@cosmicdrift/kumiko-types": "0.342.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1025,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.341.0",
-    "@cosmicdrift/kumiko-locale-es": "0.341.0",
+    "@cosmicdrift/kumiko-locale-de": "0.342.0",
+    "@cosmicdrift/kumiko-locale-es": "0.342.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.342.0",
+    "type": "improvement",
+    "title": "AuthCard styling hooks (className, headerClassName, titleClassName, bodyClassName)",
+    "detail": "AuthCard takes className, headerClassName, titleClassName and bodyClassName\n`AuthCard` renders the body wrapper (`p-6 pt-0 flex flex-col gap-4`) itself and accepts `className` (Card), `headerClassName`, `titleClassName` and `bodyClassName`, merged with tailwind-merge over the defaults. The auth-email-password and auth-mfa screens no longer carry their own body wrapper; the rendered DOM stays the same. The session bootstrap error screen keeps its former bottom padding through `bodyClassName`."
+  },
+  {
+    "version": "0.342.0",
+    "type": "improvement",
+    "title": "Bootstrap seed can write with app tenant roles",
+    "detail": "Bootstrap seed gets `dispatchWriteAs` to write with app tenant roles instead of SystemAdmin."
+  },
   {
     "version": "0.341.0",
     "type": "breaking",

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.342.0",
+    "type": "improvement",
+    "title": "EmailMessage.fromName sets the From display name",
+    "detail": "channel-email: fromName sets the display name of the From header\n`EmailMessage` gets an optional `fromName`, and the email channel passes `data.fromName` through like `replyTo`. The SMTP transport combines it with the address of `message.from` or the transport default, so `from: \"App <noreply@x>\"` plus `fromName: \"Tenant via veridom\"` sends from `noreply@x` under the new name. Control characters in the name are replaced by spaces before sending, and an empty name behaves like no name. The PII ciphertext guard refuses a ciphertext `fromName`."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/waitlist/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.342.0",
+    "type": "improvement",
+    "title": "Waitlist notifyRecipient may return a promise",
+    "detail": "Waitlist `notifyRecipient` may return a promise, so apps can read the admin address from config"
+  },
   {
     "version": "0.341.0",
     "type": "improvement",