@cosmicdrift/kumiko-bundled-features 0.352.0 → 0.354.0

package/dist/agent-tools/agent-doc-lint.d.ts

@@ -4,6 +4,7 @@ export declare const AgentDocGapKinds: {
     readonly handlerWithoutDescription: "handler-without-description";
     readonly customScreenWithoutDescription: "custom-screen-without-description";
     readonly exposedEntityWithoutDescription: "exposed-entity-without-description";
+    readonly handlerWithoutTranslation: "handler-without-translation";
 };
 export type AgentDocGapKind = (typeof AgentDocGapKinds)[keyof typeof AgentDocGapKinds];
 export type AgentDocGap = {
@@ -13,4 +14,5 @@ export type AgentDocGap = {
     readonly message: string;
 };
 export declare function findAgentDocGaps(features: readonly FeatureDefinition[]): readonly AgentDocGap[];
+export declare function findHandlerTranslationGaps(features: readonly FeatureDefinition[]): readonly AgentDocGap[];
 export declare function formatAgentDocGap(gap: AgentDocGap): string;

package/dist/agent-tools/agent-doc-lint.js

@@ -1,10 +1,12 @@
-import { isAgentVisibleScreen, QnTypes, qn, resolveAgentExposure, toKebab, } from "@cosmicdrift/kumiko-framework/engine";
+import { handlerFieldLabelKey, handlerTitleKey, isAgentVisibleScreen, QnTypes, qn, resolveAgentExposure, toKebab, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { systemOnlyPropertyNames } from "./agent-manifest.js";
 export const AgentDocGapKinds = {
     handlerSchemaNotExpressible: "handler-schema-not-expressible",
     handlerWithoutDescription: "handler-without-description",
     customScreenWithoutDescription: "custom-screen-without-description",
     exposedEntityWithoutDescription: "exposed-entity-without-description",
+    handlerWithoutTranslation: "handler-without-translation",
 };
 // No shared screen-type union exists in the codebase to import (ScreenDefinition
 // is a discriminated union keyed by inline string literals) — name the one
@@ -107,6 +109,57 @@ function exposedEntityDocGaps(feature) {
     }
     return gaps;
 }
+function actionFormHandlerQns(features) {
+    const handlerQns = new Set();
+    for (const feature of features) {
+        for (const screen of Object.values(feature.screens ?? {})) {
+            if (screen.type === "actionForm")
+                handlerQns.add(screen.handler);
+        }
+    }
+    return handlerQns;
+}
+function agentVisibleInputFieldNames(schema) {
+    if (!(schema instanceof z.ZodObject))
+        return [];
+    const fieldNames = Object.keys(schema.shape);
+    try {
+        const systemOnly = new Set(systemOnlyPropertyNames(z.toJSONSchema(schema, { io: "input" })));
+        return fieldNames.filter((field) => !systemOnly.has(field));
+    }
+    catch {
+        // skip: a schema without JSON Schema form is reported as its own gap kind
+        return fieldNames;
+    }
+}
+function translationGapsOfFeature(feature, coveredHandlerQns) {
+    const gaps = [];
+    // The client resolves translation keys verbatim (no feature prefix), so only
+    // fully spelled-out keys count.
+    const translated = new Set(Object.keys(feature.translations ?? {}));
+    for (const [name, def] of Object.entries(feature.writeHandlers ?? {})) {
+        if (!resolveAgentExposure(def, "write").expose)
+            continue;
+        if (feature.handlerEntityMappings?.[name] !== undefined)
+            continue;
+        const handlerQn = qn(toKebab(feature.name), QnTypes.write, toKebab(name));
+        if (coveredHandlerQns.has(handlerQn))
+            continue;
+        const missing = [
+            handlerTitleKey(handlerQn),
+            ...agentVisibleInputFieldNames(def.schema).map((field) => handlerFieldLabelKey(handlerQn, field)),
+        ].filter((key) => !translated.has(key));
+        if (missing.length === 0)
+            continue;
+        gaps.push({
+            qn: handlerQn,
+            feature: feature.name,
+            kind: AgentDocGapKinds.handlerWithoutTranslation,
+            message: `This write handler has no entity and no actionForm screen, so its title and field labels can only come from translations — missing keys: ${missing.join(", ")}.`,
+        });
+    }
+    return gaps;
+}
 export function findAgentDocGaps(features) {
     const gaps = [];
     for (const feature of features) {
@@ -119,6 +172,13 @@ export function findAgentDocGaps(features) {
     // depend on it (mirrors agent-manifest.ts's sortedByKey rationale).
     return [...gaps].sort((a, b) => compareByCodePoint(a.qn, b.qn));
 }
+// Kept out of findAgentDocGaps on purpose: the published agent-manifest guard
+// fails on every gap that function returns, and these are advisory.
+export function findHandlerTranslationGaps(features) {
+    const coveredHandlerQns = actionFormHandlerQns(features);
+    const gaps = features.flatMap((feature) => translationGapsOfFeature(feature, coveredHandlerQns));
+    return [...gaps].sort((a, b) => compareByCodePoint(a.qn, b.qn));
+}
 export function formatAgentDocGap(gap) {
     return `${gap.qn} — ${gap.message}`;
 }

package/dist/agent-tools/agent-manifest.d.ts

@@ -1,4 +1,5 @@
 import type { AgentManifest, AgentManifestOptions, RegistryManifestView } from "./types.js";
+export declare function systemOnlyPropertyNames(jsonSchema: Record<string, unknown>): readonly string[];
 /** Registry snapshot → AI-agent manifest. Pure, deterministic, no I/O — mirrors
  *  `buildToolCatalog`'s contract, just describing the app's shape instead of
  *  generating callable tools from it. */

package/dist/agent-tools/agent-manifest.js

@@ -1,6 +1,7 @@
 import { hasAccess, isAgentVisibleScreen, resolveAgentExposure, SYSTEM_ONLY_JSON_SCHEMA_KEY, } from "@cosmicdrift/kumiko-framework/engine";
 import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
 import * as z from "zod";
+import { recordManifestDenyQns } from "./manifest-deny-qns.js";
 /** The manifest surfaces one string per locale — a plural entry reads as its
  *  CLDR `other` form since the manifest has no `count` to select a category. */
 function entryAsLabels(entry) {
@@ -118,13 +119,19 @@ function buildFeatures(features) {
 }
 // Agent dispatch never runs as a system identity, so properties the engine only
 // honors for system callers would be silently dropped — hide them from the tool.
-function withoutSystemOnlyProperties(jsonSchema) {
+export function systemOnlyPropertyNames(jsonSchema) {
     const properties = jsonSchema["properties"];
     if (typeof properties !== "object" || properties === null)
-        return jsonSchema;
-    const hidden = Object.entries(properties)
+        return [];
+    return Object.entries(properties)
         .filter(([, property]) => property[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true)
         .map(([name]) => name);
+}
+function withoutSystemOnlyProperties(jsonSchema) {
+    const properties = jsonSchema["properties"];
+    if (typeof properties !== "object" || properties === null)
+        return jsonSchema;
+    const hidden = systemOnlyPropertyNames(jsonSchema);
     if (hidden.length === 0)
         return jsonSchema;
     const required = jsonSchema["required"];
@@ -232,6 +239,9 @@ function lastSegment(qualifiedId) {
 function detailIdParam(screen) {
     return screen.type === "projectionDetail" ? (screen.idParam ?? "id") : "id";
 }
+function screenTitles(translations, screenId, shortId) {
+    return entryAsLabels(translations[`${screenId}.title`] ?? translations[`screen:${shortId}.title`] ?? {});
+}
 function buildScreens(screens, navs, workspaces, translations, roles, visibleNavIds) {
     const allNavs = [...navs.values()];
     const result = [];
@@ -257,7 +267,7 @@ function buildScreens(screens, navs, workspaces, translations, roles, visibleNav
         result.push({
             id: screen.id,
             type: screen.type,
-            titles: labelsForSuffix(translations, `screen:${shortId}.title`),
+            titles: screenTitles(translations, screen.id, shortId),
             // `screen.description` may be a raw i18n key (`registry.getAllTranslations()`
             // double-prefixes it, see build-app-schema.ts:77-81) — match on suffix like
             // `labelsForSuffix` does for entity/field labels, else fall back to the
@@ -304,7 +314,7 @@ export function buildAgentManifest(registry, options) {
     const navs = buildNavs(navMap, workspaceMap, translations, roles, screenMap);
     const screens = buildScreens(screenMap, navMap, workspaceMap, translations, roles, new Set(navs.map((nav) => nav.id)));
     const workspaces = buildWorkspaces(workspaceMap, translations, roles);
-    return {
+    const manifest = {
         builtForRoles: [...roles],
         features: sortedByKey(features, (f) => f.name),
         entities: sortedByKey(entities, (e) => e.name),
@@ -317,4 +327,6 @@ export function buildAgentManifest(registry, options) {
             ...(options.currency && { currency: options.currency }),
         },
     };
+    recordManifestDenyQns(manifest, new Set(options.denyQns ?? []));
+    return manifest;
 }

package/dist/agent-tools/feature.js

@@ -1,5 +1,5 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { findAgentDocGaps, formatAgentDocGap } from "./agent-doc-lint.js";
+import { findAgentDocGaps, findHandlerTranslationGaps, formatAgentDocGap, } from "./agent-doc-lint.js";
 export const AGENT_TOOLS_FEATURE_NAME = "agent-tools";
 export function createAgentToolsFeature() {
     return defineFeature(AGENT_TOOLS_FEATURE_NAME, (r) => {
@@ -14,8 +14,13 @@ export function createAgentToolsFeature() {
         // would turn every incrementally-documented app into an outage.
         r.bootCheck(({ features }) => {
             const gaps = findAgentDocGaps(features);
+            const warningCount = findHandlerTranslationGaps(features).length;
+            if (warningCount > 0) {
+                // biome-ignore lint/suspicious/noConsole: operator-visibility at boot for agent-doc gaps
+                console.warn(`[agent-tools] ${warningCount} agent-exposed write handler(s) lack title/field-label translations — run \`kumiko agent lint\` for details.`);
+            }
             if (gaps.length === 0) {
-                // skip: no documentation gaps, nothing to warn about
+                // skip: no blocking documentation gaps, nothing more to warn about
                 return;
             }
             // biome-ignore lint/suspicious/noConsole: operator-visibility at boot for agent-doc gaps

package/dist/agent-tools/index.d.ts

@@ -1,5 +1,5 @@
 export type { AgentDocGap, AgentDocGapKind } from "./agent-doc-lint.js";
-export { AgentDocGapKinds, findAgentDocGaps, formatAgentDocGap } from "./agent-doc-lint.js";
+export { AgentDocGapKinds, findAgentDocGaps, findHandlerTranslationGaps, formatAgentDocGap, } from "./agent-doc-lint.js";
 export { buildAgentManifest } from "./agent-manifest.js";
 export { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "./feature.js";
 export { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "./tool-catalog.js";

package/dist/agent-tools/index.js

@@ -1,4 +1,4 @@
-export { AgentDocGapKinds, findAgentDocGaps, formatAgentDocGap } from "./agent-doc-lint.js";
+export { AgentDocGapKinds, findAgentDocGaps, findHandlerTranslationGaps, formatAgentDocGap, } from "./agent-doc-lint.js";
 export { buildAgentManifest } from "./agent-manifest.js";
 export { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "./feature.js";
 export { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "./tool-catalog.js";

package/dist/agent-tools/manifest-deny-qns.d.ts

@@ -0,0 +1,3 @@
+import type { AgentManifest } from "./types.js";
+export declare function recordManifestDenyQns(manifest: AgentManifest, denyQns: ReadonlySet<string>): void;
+export declare function assertCatalogMirrorsManifestDenyQns(manifest: AgentManifest, catalogDenyQns: ReadonlySet<string>): void;

package/dist/agent-tools/manifest-deny-qns.js

@@ -0,0 +1,17 @@
+// The deny list is deliberately not a manifest field (the manifest is prompt
+// payload), so the catalog builder learns it through this side channel to
+// detect a manifest cut that the catalog would silently not mirror.
+const denyQnsByManifest = new WeakMap();
+export function recordManifestDenyQns(manifest, denyQns) {
+    denyQnsByManifest.set(manifest, denyQns);
+}
+export function assertCatalogMirrorsManifestDenyQns(manifest, catalogDenyQns) {
+    const manifestDenyQns = denyQnsByManifest.get(manifest);
+    // skip: manifest has no registered deny list, nothing to mirror
+    if (!manifestDenyQns)
+        return;
+    const missing = [...manifestDenyQns].filter((qn) => !catalogDenyQns.has(qn));
+    if (missing.length > 0) {
+        throw new Error(`agent denyQns passed to buildAgentManifest but not to buildToolCatalog: ${missing.join(", ")} — the catalog would still expose their entity CRUD tools`);
+    }
+}

package/dist/agent-tools/tool-catalog.d.ts

@@ -24,5 +24,6 @@ export declare const OPEN_FORM_TOOL_NAME = "open_form";
  *  to drop an entity CRUD tool, which no `agent.expose` on the manifest side can reach. It is
  *  NOT read off the manifest on purpose — the manifest is prompt payload, and a list of the
  *  handlers the model may not call has no business travelling to the provider. Pass the same
- *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds. */
+ *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds;
+ *  a manifest built with `denyQns` that the catalog lacks throws. */
 export declare function buildToolCatalog(registry: RegistrySearchView, manifest: AgentManifest, options: ToolCatalogOptions): ToolCatalog;

package/dist/agent-tools/tool-catalog.js

@@ -1,5 +1,6 @@
 import { hasAccess, normalizeAccessEntry } from "@cosmicdrift/kumiko-framework/engine";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
+import { assertCatalogMirrorsManifestDenyQns } from "./manifest-deny-qns.js";
 const MAX_TOOL_NAME_LENGTH = 64;
 /** Field types that declare `filterable` (per `packages/framework/src/engine/types/fields.ts`).
  *  Mapped to the JSON-Schema type an LLM tool-call argument should use. `undefined` = field type
@@ -466,13 +467,15 @@ function addClientTools(manifest, mode, sink) {
  *  to drop an entity CRUD tool, which no `agent.expose` on the manifest side can reach. It is
  *  NOT read off the manifest on purpose — the manifest is prompt payload, and a list of the
  *  handlers the model may not call has no business travelling to the provider. Pass the same
- *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds. */
+ *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds;
+ *  a manifest built with `denyQns` that the catalog lacks throws. */
 export function buildToolCatalog(registry, manifest, options) {
     const sink = { tools: [], dispatchTable: new Map(), usedNames: new Set() };
     const roleFilter = { roles: manifest.builtForRoles };
     const locale = manifest.tenantSettings.locale;
     const entityByName = new Map(manifest.entities.map((entity) => [entity.name, entity]));
     const denyQns = new Set(options.denyQns ?? []);
+    assertCatalogMirrorsManifestDenyQns(manifest, denyQns);
     addRegistrySearchTools(registry, roleFilter, denyQns, sink);
     const { detailQnByEntity, listQnByEntity, entityListDetailQns } = collectEntityHandlerQns(registry, roleFilter, denyQns);
     addGetTools(registry, detailQnByEntity, entityByName, locale, sink);

package/dist/agent-tools/tool-dispatch.js

@@ -1,4 +1,4 @@
-import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/api";
+import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
 const SEARCH_RESULT_LIMIT = 10;
 const DEFAULT_LIST_LIMIT = 10;

package/dist/audit/handlers/list.query.js

@@ -34,7 +34,7 @@ function buildDateRange(from, to) {
 function escapeLikePattern(value) {
     return value.replace(/[\\%_]/g, (m) => `\\${m}`);
 }
-function buildAuditWhere(tenantId, p) {
+function buildAuditWhere(tenantId, p, direction) {
     const where = { tenantId };
     if (p.aggregateType)
         where["aggregateType"] = p.aggregateType;
@@ -50,8 +50,10 @@ function buildAuditWhere(tenantId, p) {
     if (range)
         where["createdAt"] = range;
     const cursor = p.cursor ?? p.before;
+    // The cursor is an event id, so it only walks pages in id order: ascending
+    // pages continue past it, descending pages stop before it.
     if (cursor)
-        where["id"] = { lt: BigInt(cursor) };
+        where["id"] = direction === "asc" ? { gt: BigInt(cursor) } : { lt: BigInt(cursor) };
     return where;
 }
 export const listQuery = defineQueryHandler({
@@ -81,15 +83,17 @@ export const listQuery = defineQueryHandler({
     handler: async (query, ctx) => {
         const p = query.payload;
         const scopeFilter = resolveAuditScopeFilter(query.user, p.scope);
+        const direction = p.sortDirection ?? "desc";
         const where = buildAuditWhere(scopeFilter.tenantId, {
             ...p,
             aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
-        });
+        }, direction);
         const rows = await selectMany(ctx.db, eventsTable, where, {
-            orderBy: {
-                col: query.payload.sort === "type" ? "type" : "createdAt",
-                direction: query.payload.sortDirection ?? "desc",
-            },
+            // `id` as tie-breaker keeps the order total, so pages never overlap.
+            orderBy: [
+                { col: p.sort === "type" ? "type" : "createdAt", direction },
+                { col: "id", direction },
+            ],
             limit: p.limit,
         });
         const serialised = rows.map((r) => ({
@@ -104,7 +108,8 @@ export const listQuery = defineQueryHandler({
             createdBy: r.createdBy,
         }));
         const last = serialised[serialised.length - 1];
-        const nextId = serialised.length === p.limit && last ? last.id : null;
+        // An id cursor cannot resume a type-ordered listing, so that sort is one page.
+        const nextId = serialised.length === p.limit && last && p.sort !== "type" ? last.id : null;
         return {
             rows: serialised,
             nextCursor: nextId,

package/dist/auth-email-password/handlers/change-password.write.js

@@ -16,6 +16,7 @@ export const changePasswordWrite = defineWriteHandler({
     }),
     access: { roles: access.authenticated },
     escapeHatch: {
+        grants: ["systemIdentity"],
         reason: "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, ...) " +
             "and writes the new hash via ctx.writeAs(SYSTEM, user:update) — the caller's own " +
             "identity can't reach either, field-access on passwordHash is privileged-only.",

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -29,7 +29,7 @@ import { decryptStoredPii, sessionLocaleField, sessionTimezoneField } from "../.
 // kumiko-lint-ignore cross-feature-import invite-flow
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add
-import { grantInvitedMembershipRole, invitationIssuedAt } from "../../tenant/invited-membership.js";
+import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import login-style password-check
@@ -118,7 +118,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                     userId,
                     tenantId: invitationTenantId,
                     role: invitationRole,
-                    invitationIssuedAt: invitationIssuedAt(invitation),
+                    invitation,
                 });
                 if (!grant.isSuccess)
                     return grant;

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -23,7 +23,7 @@ import { decryptStoredPii } from "../../shared/index.js";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add (like provisionSignupAccount)
-import { grantInvitedMembershipRole, invitationIssuedAt } from "../../tenant/invited-membership.js";
+import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import auth handler reads user-row für email-match
@@ -93,7 +93,7 @@ export function createInviteAcceptHandler() {
                     userId: event.user.id,
                     tenantId: invitationTenantId,
                     role: invitationRole,
-                    invitationIssuedAt: invitationIssuedAt(invitation),
+                    invitation,
                 });
                 if (!grant.isSuccess)
                     return grant;

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -24,10 +24,14 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
+// kumiko-lint-ignore cross-feature-import membership version read is owned by the tenant feature
+import { membershipVersionOf } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import membership-role validation owned by tenant-feature
 import { findForbiddenMembershipRole, findForbiddenRoleAssignment, reservedMembershipRoleError, unassignableMembershipRoleError, } from "../../tenant/membership-roles.js";
 // kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
 import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
+// kumiko-lint-ignore cross-feature-import invitee lookup by email reads the user row
+import { userTable } from "../../user/schema/user.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
 import { renderInviteEmail } from "../email-templates.js";
 import { inviteAlreadyAccepted } from "../errors.js";
@@ -61,6 +65,16 @@ function checkAssignableInviteRole(opts, inviterRoles, role, ctx) {
     }
     return undefined;
 }
+// 0 = the invitee has no membership in the tenant yet (or no account at all).
+async function currentMembershipVersion(ctx, tenantId, email) {
+    const user = await ctx.db.global(userTable).fetchOne({
+        email,
+        isDeleted: false,
+    });
+    if (!user)
+        return 0;
+    return membershipVersionOf(ctx.db, tenantId, user.id);
+}
 async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAccepted = false) {
     if (!ctx.redis) {
         return writeFailure(new InternalError({ message: "invite-create requires ctx.redis for token store" }));
@@ -72,6 +86,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
     // The unique index allows one row per (tenantId, email). Whatever its
     // status, a re-invite resets it to pending with a fresh token.
     const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
+    const membershipVersion = await currentMembershipVersion(ctx, tenantId, email);
     let invitationId;
     if (existing) {
         // Provisioning callers (waitlist) must not flip an accepted invite back to
@@ -96,6 +111,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
                 globalRoles: [...request.globalRoles],
                 status: INVITATION_STATUS.pending,
                 invitedBy: inviter.id,
+                membershipVersion,
                 expiresAt,
             },
         }, inviter, ctx.db);
@@ -109,6 +125,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
             globalRoles: [...request.globalRoles],
             status: INVITATION_STATUS.pending,
             invitedBy: inviter.id,
+            membershipVersion,
             expiresAt,
         }, inviter, ctx.db);
         if (!createResult.isSuccess)

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -21,7 +21,7 @@ import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-f
 import { buildSessionRoles, createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { decryptStoredPii } from "../../shared/index.js";
+import { decryptStoredPii, registrationLocaleFromRequest } from "../../shared/index.js";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
@@ -92,11 +92,13 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
                 const dbConn = ctx.db.unsafeRaw();
+                const registrationLocale = registrationLocaleFromRequest();
                 const { id: userId } = await seedUserWithPassword(dbConn, {
                     email: invitationEmail,
                     password: event.payload.password,
                     displayName: invitationEmail.split("@")[0] ?? invitationEmail,
                     emailVerified: true,
+                    ...registrationLocale,
                     ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
                 });
                 // Membership-Add via seed-helper (gleiches Pattern wie
@@ -136,6 +138,7 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                     id: userId,
                     tenantId: invitationTenantId,
                     roles: mergedRoles,
+                    ...registrationLocale,
                 };
                 committed = true;
                 return {

package/dist/auth-email-password/handlers/login.write.js

@@ -151,6 +151,7 @@ export function createLoginHandler(opts = {}) {
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["systemIdentity", "unsafeRaw"],
             reason: "Unauthenticated login has no caller identity yet — it looks up the user row by " +
                 "email via ctx.queryAs(SYSTEM, ...) and resolves tenant membership via " +
                 "ctx.resolveActiveMembership before a session exists. It also reads the MFA " +

package/dist/auth-email-password/handlers/reset-password.write.js

@@ -23,6 +23,7 @@ export function createResetPasswordHandler(opts) {
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["systemIdentity"],
             reason: "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
                 "target user via ctx.writeAs(SYSTEM, user:update) to set the new password hash.",
         },

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -24,7 +24,7 @@ import { ConflictError, InternalError, reraiseAsKumikoError, writeFailure, } fro
 import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { findSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, } from "../../shared/index.js";
+import { findSignupHandoverProvider, registrationLocaleFromRequest, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, } from "../../shared/index.js";
 // kumiko-lint-ignore cross-feature-import signup-confirm reads tenants.key for slug-uniqueness check (TOCTOU + DB-unique-index zusammen)
 import { tenantTable } from "../../tenant/schema/tenant.js";
 import { invalidSignupToken, signupEmailAlreadyRegistered } from "../errors.js";
@@ -116,6 +116,7 @@ export function createSignupConfirmHandler(opts = {}) {
                 // Display-Name aus email-prefix als sinnvolles Default; User kann
                 // den Tenant-Namen + sein eigenes displayName später ändern.
                 const displayName = email.split("@")[0] ?? email;
+                const registrationLocale = registrationLocaleFromRequest();
                 let provisioned;
                 try {
                     provisioned = await provisionSignupAccount(dbConn, {
@@ -124,9 +125,9 @@ export function createSignupConfirmHandler(opts = {}) {
                         displayName,
                         tenantId,
                         tenantKey,
-                        // Tenant-Display-Name als Default = Email. User wechselt das im
-                        // Settings-Screen. Konzept "Tenant" leakt nicht in die Signup-UI.
-                        tenantName: email,
+                        // Generated slug as default name: no personal data (the email) in the tenant name.
+                        tenantName: tenantKey,
+                        ...registrationLocale,
                     }, 
                     // #1463: seedTenant's postSave hooks (tier-engine's auto-default-
                     // tier, an app's auto-default-compliance) must fire on self-signup
@@ -151,6 +152,7 @@ export function createSignupConfirmHandler(opts = {}) {
                     id: provisioned.userId,
                     tenantId: provisioned.tenantId,
                     roles: [...INITIAL_SIGNUP_ROLES],
+                    ...registrationLocale,
                 };
                 // Claim BEFORE spending the signup token or the binding below and
                 // before `committed` flips: if the claim throws, the `finally` still