@cosmicdrift/kumiko-bundled-features 0.341.0 → 0.343.0

package/dist/audit/constants.d.ts

@@ -13,3 +13,10 @@ export declare const AuditQueries: {
 export declare const AUDIT_LOG_SCREEN_ID: "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export declare const AUDIT_LOG_DETAIL_SCREEN_ID: "audit-log-detail";
+/**
+ * Config key (system scope) for how long `escapeHatchUse` audit events are kept. Only a fallback
+ * for apps without compliance-profiles; with it mounted, the tenant profile's `auditLog.retention`
+ * applies (a tenant override can only lengthen it).
+ */
+export declare const ESCAPE_HATCH_RETENTION_DAYS_KEY: "audit:config:escape-hatch-retention-days";
+export declare const DEFAULT_ESCAPE_HATCH_RETENTION_DAYS = 90;

package/dist/audit/constants.js

@@ -18,3 +18,10 @@ export const AuditQueries = {
 export const AUDIT_LOG_SCREEN_ID = "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export const AUDIT_LOG_DETAIL_SCREEN_ID = "audit-log-detail";
+/**
+ * Config key (system scope) for how long `escapeHatchUse` audit events are kept. Only a fallback
+ * for apps without compliance-profiles; with it mounted, the tenant profile's `auditLog.retention`
+ * applies (a tenant override can only lengthen it).
+ */
+export const ESCAPE_HATCH_RETENTION_DAYS_KEY = "audit:config:escape-hatch-retention-days";
+export const DEFAULT_ESCAPE_HATCH_RETENTION_DAYS = 90;

package/dist/audit/escape-hatch-audit-sink.d.ts

@@ -7,6 +7,7 @@ export declare const escapeHatchUsedSchema: z.ZodObject<{
     handler: z.ZodString;
     kind: z.ZodEnum<{
         "acknowledge-cross-tenant": "acknowledge-cross-tenant";
+        "cross-tenant-read": "cross-tenant-read";
         "global-write": "global-write";
         "identity-switch": "identity-switch";
         "unsafe-all-tenants": "unsafe-all-tenants";

package/dist/audit/escape-hatch-audit-sink.js

@@ -11,6 +11,7 @@ const escapeHatchKinds = [
     "global-write",
     "identity-switch",
     "unsafe-all-tenants",
+    "cross-tenant-read",
 ];
 export const escapeHatchUsedSchema = z.object({
     handler: z.string(),

package/dist/audit/feature.js

@@ -1,9 +1,10 @@
-import { access, defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries } from "./constants.js";
+import { access, createSystemConfig, defineFeature, i18nKey, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries, DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, } from "./constants.js";
 import { escapeHatchUsedSchema } from "./escape-hatch-audit-sink.js";
 import { detailsQuery } from "./handlers/details.query.js";
 import { listQuery } from "./handlers/list.query.js";
 import { AUDIT_I18N } from "./i18n.js";
+import { runEscapeHatchRetention } from "./run-escape-hatch-retention.js";
 // Audit feature — exposes a filtered read over the framework's event log.
 //
 // Design: the event-store IS the audit trail (every entity write produces
@@ -12,10 +13,11 @@ import { AUDIT_I18N } from "./i18n.js";
 // the existing `events` table. See handlers/list.query.ts for the filter
 // surface.
 //
-// Retention lives elsewhere. Events are kept indefinitely as the source of
-// truth for state; archive or compress policies are a separate concern
-// (tracked with the snapshot/archive infrastructure that already exists in
-// the framework).
+// Retention: only `escapeHatchUse` events are pruned (daily job, config key
+// `escapeHatchRetentionDays`). All other events stay as the source of truth
+// for state; archive or compress policies are a separate concern (tracked
+// with the snapshot/archive infrastructure that already exists in the
+// framework).
 export function createAuditFeature() {
     return defineFeature("audit", (r) => {
         r.describe("Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection \u2014 the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).");
@@ -25,9 +27,34 @@ export function createAuditFeature() {
             recommended: false,
         });
         r.translations({ keys: AUDIT_I18N });
-        r.requires("tenant", "user");
+        r.requires("tenant", "user", "config");
         // Registered so ops tools/MSPs can discover the type — escape-hatch-audit-sink.ts appends it via the low-level event-store API.
         r.defineEvent("escape-hatch-used", escapeHatchUsedSchema, { piiFields: "none" });
+        r.config("escapeHatchRetentionDays", createSystemConfig("number", {
+            default: DEFAULT_ESCAPE_HATCH_RETENTION_DAYS,
+            bounds: { min: 1 },
+        }));
+        r.job({
+            name: "escape-hatch-retention",
+            trigger: { cron: "30 3 * * *" },
+            concurrency: "skip",
+            // pruneEvents needs a transaction-capable connection, which only unsafeRaw() hands a job.
+            escapeHatch: {
+                reason: "prunes expired escapeHatchUse audit events through pruneEvents",
+                grants: ["unsafeRaw"],
+            },
+            handler: async (_payload, ctx) => {
+                if (!ctx.registry) {
+                    throw new Error("escape-hatch-retention: ctx.registry required (JobContext incomplete)");
+                }
+                await runEscapeHatchRetention({
+                    db: ctx.db.unsafeRaw(),
+                    registry: ctx.registry,
+                    configResolver: ctx.configResolver,
+                    userId: ctx._userId ?? SYSTEM_USER_ID,
+                });
+            },
+        });
         const queries = {
             list: r.queryHandler(listQuery),
             details: r.queryHandler(detailsQuery),

package/dist/audit/run-escape-hatch-retention.d.ts

@@ -0,0 +1,11 @@
+import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type ConfigResolver, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+export declare function isDbConnection(runner: DbRunner): runner is DbConnection;
+export declare function runEscapeHatchRetention(args: {
+    readonly db: DbRunner;
+    readonly registry: Registry;
+    readonly configResolver: ConfigResolver | undefined;
+    readonly userId: string;
+}): Promise<{
+    readonly deletedCount: number;
+}>;

package/dist/audit/run-escape-hatch-retention.js

@@ -0,0 +1,91 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { COMPLIANCE_PROFILES, subtractRetentionSpec, } from "@cosmicdrift/kumiko-framework/compliance";
+import { parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { resolveProfileForTenant } from "../compliance-profiles/index.js";
+import { createConfigAccessor } from "../config/index.js";
+import { DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, ESCAPE_HATCH_RETENTION_DAYS_KEY, } from "./constants.js";
+import { ESCAPE_HATCH_USE_AGGREGATE_TYPE, escapeHatchUsedSchema, } from "./escape-hatch-audit-sink.js";
+// pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
+export function isDbConnection(runner) {
+    return "begin" in runner && typeof runner.begin === "function";
+}
+async function resolveRetentionDays(args) {
+    if (!args.configResolver)
+        return DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
+    const config = createConfigAccessor(args.registry, args.configResolver, SYSTEM_TENANT_ID, args.userId, args.db);
+    const raw = await config(ESCAPE_HATCH_RETENTION_DAYS_KEY);
+    return typeof raw === "number" && raw >= 1 ? raw : DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
+}
+// Soft dependency: audit must stay mountable without compliance-profiles, so we probe its entity.
+const COMPLIANCE_PROFILE_ENTITY = "tenant-compliance-profile";
+const PRUNE_CHUNK_SIZE = 1000;
+// Overrides may only lengthen retention: the earlier cutoff (same `now`) is the longer period.
+function earlierInstant(a, b) {
+    return Temporal.Instant.compare(a, b) <= 0 ? a : b;
+}
+async function resolveTenantCutoff(db, tenantId, now) {
+    const { profile } = await resolveProfileForTenant({ db, tenantId });
+    const effective = subtractRetentionSpec(now, profile.auditLog.retention);
+    const base = subtractRetentionSpec(now, COMPLIANCE_PROFILES[profile.key].auditLog.retention);
+    return earlierInstant(effective, base);
+}
+// A cross-tenant audit (e.g. identity-switch) lives under the actor's tenant but must also
+// satisfy the target tenant's retention. A malformed payload falls back to the storing tenant.
+function targetTenantOf(payload) {
+    const parsed = escapeHatchUsedSchema.safeParse(payload);
+    return parsed.success ? parseTenantId(parsed.data.targetTenantId) : null;
+}
+async function pruneByTenantProfiles(db) {
+    const rows = await selectMany(db, eventsTable, {
+        aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE,
+    });
+    const now = getTemporal().Now.instant();
+    const cutoffByTenant = new Map();
+    const cutoffOf = async (tenantId) => {
+        const cached = cutoffByTenant.get(tenantId);
+        if (cached)
+            return cached;
+        const cutoff = await resolveTenantCutoff(db, tenantId, now);
+        cutoffByTenant.set(tenantId, cutoff);
+        return cutoff;
+    };
+    const expiredAggregateIds = [];
+    for (const row of rows) {
+        const targetTenantId = targetTenantOf(row.payload);
+        const storeCutoff = await cutoffOf(row.tenantId);
+        const cutoff = targetTenantId
+            ? earlierInstant(storeCutoff, await cutoffOf(targetTenantId))
+            : storeCutoff;
+        if (Temporal.Instant.compare(row.createdAt, cutoff) < 0) {
+            expiredAggregateIds.push(row.aggregateId);
+        }
+    }
+    let deletedCount = 0;
+    for (let i = 0; i < expiredAggregateIds.length; i += PRUNE_CHUNK_SIZE) {
+        const result = await pruneEvents(db, {
+            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+            aggregateIds: expiredAggregateIds.slice(i, i + PRUNE_CHUNK_SIZE),
+            olderThan: now,
+        });
+        deletedCount += result.deletedCount;
+    }
+    return deletedCount;
+}
+export async function runEscapeHatchRetention(args) {
+    const { db } = args;
+    if (!isDbConnection(db)) {
+        throw new Error("audit escape-hatch retention: a transaction-free DbConnection is required");
+    }
+    if (!args.registry.getEntity(COMPLIANCE_PROFILE_ENTITY)) {
+        const olderThanDays = await resolveRetentionDays({ ...args, db });
+        const { deletedCount } = await pruneEvents(db, {
+            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+            olderThanDays,
+        });
+        return { deletedCount };
+    }
+    return { deletedCount: await pruneByTenantProfiles(db) };
+}

package/dist/auth-email-password/bootstrap.d.ts

@@ -1,6 +1,6 @@
-import { makeDispatchSystemWrite } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, type SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { Redis } from "ioredis";
 import type { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
@@ -15,6 +15,12 @@ export type BootstrapSeedDeps = {
     readonly tenantId: TenantId;
     readonly db: DbConnection;
     readonly dispatchSystemWrite: ReturnType<typeof makeDispatchSystemWrite>;
+    /** Writes as the system user with the given tenant roles in the seeded
+     *  tenant; use it when the app gates tenant data on its own roles rather
+     *  than SystemAdmin. */
+    readonly dispatchWriteAs: (args: Pick<SystemDispatchArgs, "handlerQn" | "payload"> & {
+        readonly roles: readonly string[];
+    }) => Promise<WriteResult>;
 };
 export type BootstrapConfigValue = string | number | boolean;
 export type BootstrapTenant = {

package/dist/auth-email-password/bootstrap.js

@@ -4,7 +4,7 @@
 // exactly as for any other writer. Nobody gets a role before accepting: the
 // invitation row holds membership role + global roles until the invitee
 // accepts through the regular invite-accept routes.
-import { makeDispatchSystemWrite } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -140,7 +140,12 @@ export async function bootstrapTenants(deps, plan) {
         const outcome = await ensureTenant(deps, tenant);
         const shouldSeed = outcome === "created" && plan.seed !== undefined;
         if (shouldSeed) {
-            await plan.seed?.({ tenantId: tenant.id, db: deps.db, dispatchSystemWrite });
+            await plan.seed?.({
+                tenantId: tenant.id,
+                db: deps.db,
+                dispatchSystemWrite,
+                dispatchWriteAs: ({ handlerQn, payload, roles }) => deps.dispatcher.write(handlerQn, payload, createSystemUser(tenant.id, roles)),
+            });
         }
         const configApplied = await applyTenantConfig(deps, tenant);
         tenants.push({ id: tenant.id, outcome, seeded: shouldSeed, configApplied });

package/dist/auth-email-password/email-templates.d.ts

@@ -6,6 +6,10 @@ export type RenderTokenContentArgs = {
     readonly locale?: AuthMailLocale;
     /** Optional app name for subject + intro. Default from auth.mail.appNameDefault. */
     readonly appName?: string;
+    /** ISO instant the token was issued; the validity duration is measured from it. Default: now. */
+    readonly issuedAt?: string;
+    /** IANA zone the expiry time is shown in. Default "UTC"; an invalid zone falls back to "UTC". */
+    readonly timeZone?: string;
 };
 export type RenderInviteEmailArgs = RenderTokenContentArgs & {
     readonly role: string;

package/dist/auth-email-password/email-templates.js

@@ -15,31 +15,31 @@ export const AUTH_MAIL_EN = {
     "auth.mail.reset.greeting": "Hi,",
     "auth.mail.reset.intro": "you requested a password reset for {app}. Click the link below to set a new password:",
     "auth.mail.reset.button": "Reset password",
-    "auth.mail.reset.expiry": "The link expires on {when}.",
+    "auth.mail.reset.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.reset.ignore": "If you didn't request a reset, you can safely ignore this email — your password won't change.",
     "auth.mail.verify.subject": "{app} — Verify your email",
     "auth.mail.verify.greeting": "Welcome,",
     "auth.mail.verify.intro": "please verify your email address for {app} to activate your account:",
     "auth.mail.verify.button": "Verify email",
-    "auth.mail.verify.expiry": "The link expires on {when}.",
+    "auth.mail.verify.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.verify.ignore": "If you didn't create this account, you can ignore this email.",
     "auth.mail.activation.subject": "{app} — Activate your account",
     "auth.mail.activation.greeting": "Welcome,",
     "auth.mail.activation.intro": "click the link below to activate your {app} account. The next step is choosing your password:",
     "auth.mail.activation.button": "Activate account",
-    "auth.mail.activation.expiry": "The link expires on {when}.",
+    "auth.mail.activation.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.activation.ignore": "If you didn't sign up, you can ignore this email — no account is created until you open the link.",
     "auth.mail.invite.subject": "{app} — Workspace invitation",
     "auth.mail.invite.greeting": "Hi,",
     "auth.mail.invite.intro": "you've been invited to a {app} workspace as {role}. Click the link below to accept:",
     "auth.mail.invite.button": "Accept invitation",
-    "auth.mail.invite.expiry": "The link expires on {when}.",
+    "auth.mail.invite.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.invite.ignore": "If you weren't expecting this invitation, you can ignore this email.",
     "auth.mail.unlock.subject": "{app} — Unlock your account",
     "auth.mail.unlock.greeting": "Hi,",
     "auth.mail.unlock.intro": "your {app} account was temporarily locked after several failed sign-in attempts. Click the link below to unlock it immediately:",
     "auth.mail.unlock.button": "Unlock account",
-    "auth.mail.unlock.expiry": "The link expires on {when}.",
+    "auth.mail.unlock.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.unlock.ignore": "If you didn't trigger this lock, you can ignore this email — the lock expires on its own.",
 };
 registerMailTranslations("en", AUTH_MAIL_EN);
@@ -73,7 +73,7 @@ export function renderResetPasswordEmail(args) {
         intro: t(locale, "auth.mail.reset.intro", { app }),
         buttonLabel: t(locale, "auth.mail.reset.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.reset.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.reset.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.reset.ignore"),
     });
 }
@@ -87,7 +87,7 @@ export function renderUnlockAccountEmail(args) {
         intro: t(locale, "auth.mail.unlock.intro", { app }),
         buttonLabel: t(locale, "auth.mail.unlock.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.unlock.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.unlock.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.unlock.ignore"),
     });
 }
@@ -101,7 +101,7 @@ export function renderVerifyEmail(args) {
         intro: t(locale, "auth.mail.verify.intro", { app }),
         buttonLabel: t(locale, "auth.mail.verify.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.verify.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.verify.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.verify.ignore"),
     });
 }
@@ -115,7 +115,7 @@ export function renderActivationEmail(args) {
         intro: t(locale, "auth.mail.activation.intro", { app }),
         buttonLabel: t(locale, "auth.mail.activation.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.activation.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.activation.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.activation.ignore"),
     });
 }
@@ -129,19 +129,72 @@ export function renderInviteEmail(args) {
         intro: t(locale, "auth.mail.invite.intro", { app, role: args.role }),
         buttonLabel: t(locale, "auth.mail.invite.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.invite.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.invite.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.invite.ignore"),
     });
 }
-function formatExpiry(iso) {
+const MS_PER_MINUTE = 60_000;
+const MS_PER_HOUR = 60 * MS_PER_MINUTE;
+const MS_PER_DAY = 24 * MS_PER_HOUR;
+// Rounds to whole minutes first so a few ms between issuing and signing still
+// read as "1 day"; a larger unit is only used when it divides the span exactly.
+function durationParts(ms) {
+    const minutes = Math.max(1, Math.round(ms / MS_PER_MINUTE));
+    const minutesPerHour = MS_PER_HOUR / MS_PER_MINUTE;
+    const minutesPerDay = MS_PER_DAY / MS_PER_MINUTE;
+    if (minutes % minutesPerDay === 0)
+        return { amount: minutes / minutesPerDay, unit: "day" };
+    if (minutes % minutesPerHour === 0)
+        return { amount: minutes / minutesPerHour, unit: "hour" };
+    return { amount: minutes, unit: "minute" };
+}
+function formatDuration(ms, locale) {
+    const { amount, unit } = durationParts(ms);
+    const options = { style: "unit", unit, unitDisplay: "long" };
     try {
-        const z = Temporal.Instant.from(iso).toZonedDateTimeISO("UTC");
-        return `${z.year}-${pad2(z.month)}-${pad2(z.day)} ${pad2(z.hour)}:${pad2(z.minute)} UTC`;
+        return new Intl.NumberFormat(locale, options).format(amount);
     }
     catch {
-        return iso;
+        return new Intl.NumberFormat("en", options).format(amount);
     }
 }
-function pad2(n) {
-    return String(n).padStart(2, "0");
+// Intl rejects timeZoneName together with dateStyle/timeStyle, so the zone
+// abbreviation is read from a second formatter and appended.
+function formatWhen(expiresAt, locale, timeZone) {
+    const build = (tag, zone) => {
+        const at = expiresAt.epochMilliseconds;
+        const dateTime = new Intl.DateTimeFormat(tag, {
+            dateStyle: "medium",
+            timeStyle: "short",
+            timeZone: zone,
+        }).format(at);
+        const zoneName = new Intl.DateTimeFormat(tag, { timeZone: zone, timeZoneName: "short" })
+            .formatToParts(at)
+            .find((part) => part.type === "timeZoneName")?.value;
+        return zoneName ? `${dateTime} ${zoneName}` : dateTime;
+    };
+    try {
+        return build(locale, timeZone);
+    }
+    catch {
+        try {
+            return build(locale, "UTC");
+        }
+        catch {
+            return build("en", "UTC");
+        }
+    }
+}
+function expiryParams(args, locale) {
+    try {
+        const expiresAt = Temporal.Instant.from(args.expiresAt);
+        const issuedAt = args.issuedAt ? Temporal.Instant.from(args.issuedAt) : Temporal.Now.instant();
+        return {
+            duration: formatDuration(expiresAt.epochMilliseconds - issuedAt.epochMilliseconds, locale),
+            when: formatWhen(expiresAt, locale, args.timeZone ?? "UTC"),
+        };
+    }
+    catch {
+        return { duration: args.expiresAt, when: args.expiresAt };
+    }
 }

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -67,7 +67,8 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
     }
     const email = request.email.toLowerCase();
     const tenantId = inviter.tenantId;
-    const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+    const issuedAt = Temporal.Now.instant();
+    const expiresAt = issuedAt.add({ seconds: ttlSeconds });
     // The unique index allows one row per (tenantId, email). Whatever its
     // status, a re-invite resets it to pending with a fresh token.
     const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
@@ -126,6 +127,8 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
         appUrl: opts.appUrl,
         token,
         expiresAt: expiresAt.toString(),
+        issuedAt: issuedAt.toString(),
+        timeZone: ctx.tz.user,
         ...(opts.appName !== undefined && { appName: opts.appName }),
         locale,
     });

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -104,7 +104,8 @@ export function createSignupRequestHandler(opts) {
             // uses randomBytes from node:crypto, the same source as CSRF/
             // session tokens.
             const token = generateToken();
-            const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+            const issuedAt = Temporal.Now.instant();
+            const expiresAt = issuedAt.add({ seconds: ttlSeconds });
             const expiresAtIso = expiresAt.toString();
             await storeSignupToken(ctx.redis, { email, token, ttlSeconds });
             // A handover grant in this request re-verifies and replaces the prior
@@ -158,6 +159,8 @@ export function createSignupRequestHandler(opts) {
                 appUrl: opts.appUrl,
                 token,
                 expiresAt: expiresAtIso,
+                issuedAt: issuedAt.toString(),
+                timeZone: ctx.tz.user,
                 ...(opts.appName !== undefined && { appName: opts.appName }),
                 locale,
             });

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -55,6 +55,7 @@ export function createTokenRequestHandler(spec, opts) {
                 return { isSuccess: true, data };
             }
             const { token, expiresAt } = spec.sign(user.id, ttl, opts.hmacSecret);
+            const issuedAt = expiresAt.subtract({ minutes: ttl }).toString();
             const locale = resolveHandlerMailLocale(ctx, opts.locale);
             await dispatchMagicLinkMail(ctx.notify, {
                 handlerName: spec.handlerName,
@@ -67,6 +68,8 @@ export function createTokenRequestHandler(spec, opts) {
                 appUrl: opts.appUrl,
                 token,
                 expiresAt: expiresAt.toString(),
+                issuedAt,
+                timeZone: ctx.tz.user,
                 ...(opts.appName !== undefined && { appName: opts.appName }),
                 locale,
             });

package/dist/auth-email-password/magic-link-mail.d.ts

@@ -12,6 +12,8 @@ export type MagicLinkMailParams = {
     readonly expiresAt: string;
     readonly appName?: string;
     readonly locale?: AuthMailLocale;
+    readonly issuedAt?: string;
+    readonly timeZone?: string;
 };
 export declare function resolveHandlerMailLocale(ctx: {
     readonly locale?: string;

package/dist/auth-email-password/magic-link-mail.js

@@ -40,6 +40,8 @@ export async function dispatchMagicLinkMail(notify, spec, params) {
         expiresAt: params.expiresAt,
         ...(params.locale !== undefined && { locale: params.locale }),
         ...(params.appName !== undefined && { appName: params.appName }),
+        ...(params.issuedAt !== undefined && { issuedAt: params.issuedAt }),
+        ...(params.timeZone !== undefined && { timeZone: params.timeZone }),
     });
     await notify(spec.notificationType, {
         route: { email: params.email },

package/dist/auth-email-password/web/auth-form-primitives.d.ts

@@ -8,8 +8,14 @@ export declare function useAuthShell(): AuthShellRenderer | null;
 export type AuthCardProps = {
     readonly title?: string;
     readonly subtitle?: ReactNode;
+    /** Merged onto the Card (default `w-full max-w-sm`). */
+    readonly className?: string;
+    readonly headerClassName?: string;
+    readonly titleClassName?: string;
+    /** Merged onto the body wrapper (default `p-6 pt-0 flex flex-col gap-4`). */
+    readonly bodyClassName?: string;
     readonly children: ReactNode;
 };
-export declare function AuthCard({ title, subtitle, children }: AuthCardProps): ReactNode;
+export declare function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }: AuthCardProps): ReactNode;
 export declare function parseUrlToken(paramName?: string): string;
 export declare function useUrlToken(override?: string, paramName?: string): string;

package/dist/auth-email-password/web/auth-form-primitives.js

@@ -15,7 +15,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Link-Styles laufen über das Link-Primitive (variant="button"/"muted") —
 // die früheren authButtonClass/authMutedLinkClass sind dorthin gewandert.
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
-import { BareFormProvider } from "@cosmicdrift/kumiko-renderer-web";
+import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer-web";
 import { createContext, useContext, useEffect, useState } from "react";
 const defaultAuthShell = (card) => (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background px-4", children: card }));
 const AuthShellContext = createContext(null);
@@ -26,14 +26,14 @@ export function useAuthShell() {
     return useContext(AuthShellContext);
 }
 // kumiko-lint-ignore no-custom-primitives Wraps usePrimitives().Card, pure domain name for the auth-screen chrome, not a primitive reimplementation
-export function AuthCard({ title, subtitle, children }) {
+export function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }) {
     const { Card } = usePrimitives();
     const shell = useAuthShell() ?? defaultAuthShell;
     // h1 (Seiten-Hauptüberschrift) via Header-Slot erhalten — die Card-Default-
     // Header wäre h3. padded:false = Form sitzt randlos wie bisher (bare form).
-    const card = (_jsx(Card, { className: "w-full max-w-sm", options: { padded: false }, slots: {
-            header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: "flex flex-col space-y-1.5 p-6 pb-4", children: [title !== undefined && (_jsx("h1", { className: "text-xl font-semibold tracking-tight", children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
-        }, children: _jsx(BareFormProvider, { children: children }) }));
+    const card = (_jsx(Card, { className: cn("w-full max-w-sm", className), options: { padded: false }, slots: {
+            header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: cn("flex flex-col space-y-1.5 p-6 pb-4", headerClassName), children: [title !== undefined && (_jsx("h1", { className: cn("text-xl font-semibold tracking-tight", titleClassName), children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
+        }, children: _jsx(BareFormProvider, { children: _jsx("div", { className: cn("p-6 pt-0 flex flex-col gap-4", bodyClassName), children: children }) }) }));
     return shell(card);
 }
 // Liest `?<paramName>=<value>` aus der aktuellen URL — typisches

package/dist/auth-email-password/web/confirm-account-unlock-screen.js

@@ -30,14 +30,14 @@ export function ConfirmAccountUnlockScreen({ title, token: tokenProp, loginHref
         })();
     }, [status, token]);
     if (status === "missing-token") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }));
     }
     if (status === "verifying") {
         return (_jsx(AuthCard, { children: _jsx("div", { className: "p-6", children: _jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.unlockAccount.verifying") }) }) }));
     }
     if (status === "success") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.successTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.unlockAccount.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.successTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.unlockAccount.goToLogin") })] }));
     }
     // status === "error"
-    return (_jsx(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.unlockAccount.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.unlockAccount.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.unlockAccount.goToLogin") })] }));
 }

package/dist/auth-email-password/web/forgot-password-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // ForgotPasswordScreen — Form mit email-input. Submit triggert
 // /api/auth/request-password-reset (silent-success, kein account-
@@ -53,5 +53,5 @@ export function ForgotPasswordScreen({ title, subtitle, loginHref = "/login", })
         void doSubmit();
     };
     const effectiveTitle = title ?? t("auth.forgotPassword.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.forgotPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.forgotPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.forgotPassword.backToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.forgotPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "forgot-email", label: t("auth.forgotPassword.email"), required: true, children: _jsx(Input, { kind: "text", id: "forgot-email", name: "forgot-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.forgotPassword.submitting") : t("auth.forgotPassword.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.forgotPassword.backToLogin") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.forgotPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.forgotPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.forgotPassword.backToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.forgotPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "forgot-email", label: t("auth.forgotPassword.email"), required: true, children: _jsx(Input, { kind: "text", id: "forgot-email", name: "forgot-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.forgotPassword.submitting") : t("auth.forgotPassword.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.forgotPassword.backToLogin") })] })) }));
 }

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -128,14 +128,14 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
         void acceptAnonNew();
     };
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.inviteAccept.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.inviteAccept.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.intro") }), mode === "loggedin" ? (_jsxs(Form, { onSubmit: onSubmit, children: [_jsx("p", { className: "text-sm", children: t("auth.inviteAccept.loggedInAs", { email: session.user?.email ?? "" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.acceptButton") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
-                                setMode("anon-existing");
-                            }, children: t("auth.inviteAccept.useOtherAccount") })] })) : (_jsxs(Form, { onSubmit: onSubmit, children: [mode === "anon-existing" && (_jsx(Field, { id: "invite-email", label: t("auth.inviteAccept.email"), required: true, children: _jsx(Input, { kind: "email", id: "invite-email", name: "invite-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) })), _jsx(Field, { id: "invite-password", label: t("auth.inviteAccept.password"), required: true, children: _jsx(Input, { kind: "password", id: "invite-password", name: "invite-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: mode === "anon-existing" ? "current-password" : "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.submit") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
-                                setMode(mode === "anon-existing" ? "anon-new" : "anon-existing");
-                                setError(null);
-                            }, children: mode === "anon-existing"
-                                ? t("auth.inviteAccept.toggleNew")
-                                : t("auth.inviteAccept.toggleExisting") })] }))] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.inviteAccept.intro") }), mode === "loggedin" ? (_jsxs(Form, { onSubmit: onSubmit, children: [_jsx("p", { className: "text-sm", children: t("auth.inviteAccept.loggedInAs", { email: session.user?.email ?? "" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.acceptButton") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
+                            setMode("anon-existing");
+                        }, children: t("auth.inviteAccept.useOtherAccount") })] })) : (_jsxs(Form, { onSubmit: onSubmit, children: [mode === "anon-existing" && (_jsx(Field, { id: "invite-email", label: t("auth.inviteAccept.email"), required: true, children: _jsx(Input, { kind: "email", id: "invite-email", name: "invite-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) })), _jsx(Field, { id: "invite-password", label: t("auth.inviteAccept.password"), required: true, children: _jsx(Input, { kind: "password", id: "invite-password", name: "invite-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: mode === "anon-existing" ? "current-password" : "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.inviteAccept.submitting") : t("auth.inviteAccept.submit") }), _jsx(Button, { type: "button", variant: "secondary", onClick: () => {
+                            setMode(mode === "anon-existing" ? "anon-new" : "anon-existing");
+                            setError(null);
+                        }, children: mode === "anon-existing"
+                            ? t("auth.inviteAccept.toggleNew")
+                            : t("auth.inviteAccept.toggleExisting") })] }))] }));
 }