@cosmicdrift/kumiko-bundled-features 0.363.0 → 0.365.0

package/dist/audit/feature.js

@@ -51,7 +51,7 @@ export function createAuditFeature() {
                     db: ctx.db.unsafeRaw(),
                     registry: ctx.registry,
                     configResolver: ctx.configResolver,
-                    userId: ctx._userId ?? SYSTEM_USER_ID,
+                    userId: SYSTEM_USER_ID,
                 });
             },
         });

package/dist/audit/handlers/list.query.js

@@ -88,11 +88,15 @@ export const listQuery = defineQueryHandler({
             aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
         }, direction);
         const rows = await selectMany(ctx.db, eventsTable, where, {
-            // `id` as tie-breaker keeps the order total, so pages never overlap.
-            orderBy: [
-                { col: p.sort === "type" ? "type" : "createdAt", direction },
-                { col: "id", direction },
-            ],
+            // The id cursor only resumes an id-ordered listing. created_at comes from the
+            // transaction start and can run against insert order, so ordering by it would let
+            // a page boundary skip rows; only the type sort leaves id order (and is one page).
+            orderBy: p.sort === "type"
+                ? [
+                    { col: "type", direction },
+                    { col: "id", direction },
+                ]
+                : [{ col: "id", direction }],
             limit: p.limit,
         });
         const serialised = rows.map((r) => ({

package/dist/audit/run-escape-hatch-retention.d.ts

@@ -6,6 +6,7 @@ export declare function runEscapeHatchRetention(args: {
     readonly registry: Registry;
     readonly configResolver: ConfigResolver | undefined;
     readonly userId: string;
+    readonly batchSize?: number;
 }): Promise<{
     readonly deletedCount: number;
 }>;

package/dist/audit/run-escape-hatch-retention.js

@@ -1,4 +1,4 @@
-import { aggregateWhere, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { aggregateWhere, runnerCanBeginTransaction, selectMany, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { COMPLIANCE_PROFILES, subtractRetentionSpec, } from "@cosmicdrift/kumiko-framework/compliance";
 import { parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -10,7 +10,7 @@ import { DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, ESCAPE_HATCH_RETENTION_DAYS_KEY, }
 import { ESCAPE_HATCH_USE_AGGREGATE_TYPE, escapeHatchUsedSchema, } from "./escape-hatch-audit-sink.js";
 // pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
 export function isDbConnection(runner) {
-    return "begin" in runner && typeof runner.begin === "function";
+    return runnerCanBeginTransaction(runner);
 }
 async function resolveRetentionDays(args) {
     if (!args.configResolver)
@@ -19,18 +19,29 @@ async function resolveRetentionDays(args) {
     const raw = await config(ESCAPE_HATCH_RETENTION_DAYS_KEY);
     return typeof raw === "number" && raw >= 1 ? raw : DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
 }
+// Only an operator-set value counts: the key's declared default must not override the tenant profiles.
+async function resolveExplicitRetentionDays(args) {
+    const keyDef = args.registry.getConfigKey(ESCAPE_HATCH_RETENTION_DAYS_KEY);
+    if (!args.configResolver || !keyDef)
+        return undefined;
+    const { value, source } = await args.configResolver.getWithSource(ESCAPE_HATCH_RETENTION_DAYS_KEY, keyDef, SYSTEM_TENANT_ID, args.userId, args.db);
+    const isOperatorSet = source !== "default" && source !== "missing";
+    return isOperatorSet && typeof value === "number" && value >= 1 ? value : undefined;
+}
 // Soft dependency: audit must stay mountable without compliance-profiles, so we probe its entity.
 const COMPLIANCE_PROFILE_ENTITY = "tenant-compliance-profile";
 const PRUNE_CHUNK_SIZE = 1000;
+const PRUNE_BATCH_SIZE = 5000;
 // Overrides may only lengthen retention: the earlier cutoff (same `now`) is the longer period.
 function earlierInstant(a, b) {
     return Temporal.Instant.compare(a, b) <= 0 ? a : b;
 }
-async function resolveTenantCutoff(db, tenantId, now) {
+async function resolveTenantCutoff(db, tenantId, now, operatorFloor) {
     const { profile } = await resolveProfileForTenant({ db, tenantId });
     const effective = subtractRetentionSpec(now, profile.auditLog.retention);
     const base = subtractRetentionSpec(now, COMPLIANCE_PROFILES[profile.key].auditLog.retention);
-    return earlierInstant(effective, base);
+    const profileCutoff = earlierInstant(effective, base);
+    return operatorFloor ? earlierInstant(profileCutoff, operatorFloor) : profileCutoff;
 }
 // A cross-tenant audit (e.g. identity-switch) lives under the actor's tenant but must also
 // satisfy the target tenant's retention. A malformed payload falls back to the storing tenant.
@@ -45,14 +56,17 @@ async function storingTenantIds(db) {
         return tenantId ? [tenantId] : [];
     });
 }
-async function pruneByTenantProfiles(db) {
+async function pruneByTenantProfiles(db, operatorRetentionDays) {
     const now = getTemporal().Now.instant();
+    const operatorFloor = operatorRetentionDays === undefined
+        ? undefined
+        : now.subtract({ hours: operatorRetentionDays * 24 });
     const cutoffByTenant = new Map();
     const cutoffOf = async (tenantId) => {
         const cached = cutoffByTenant.get(tenantId);
         if (cached)
             return cached;
-        const cutoff = await resolveTenantCutoff(db, tenantId, now);
+        const cutoff = await resolveTenantCutoff(db, tenantId, now, operatorFloor);
         cutoffByTenant.set(tenantId, cutoff);
         return cutoff;
     };
@@ -87,6 +101,22 @@ async function pruneByTenantProfiles(db) {
     }
     return deletedCount;
 }
+async function pruneInBatches(db, olderThanDays, batchSize = PRUNE_BATCH_SIZE) {
+    const olderThan = getTemporal()
+        .Now.instant()
+        .subtract({ hours: olderThanDays * 24 });
+    let deletedCount = 0;
+    for (;;) {
+        const batch = await pruneEvents(db, {
+            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+            olderThan,
+            batchSize,
+        });
+        deletedCount += batch.deletedCount;
+        if (batch.deletedCount < batchSize)
+            return deletedCount;
+    }
+}
 export async function runEscapeHatchRetention(args) {
     const { db } = args;
     if (!isDbConnection(db)) {
@@ -94,11 +124,8 @@ export async function runEscapeHatchRetention(args) {
     }
     if (!args.registry.getEntity(COMPLIANCE_PROFILE_ENTITY)) {
         const olderThanDays = await resolveRetentionDays({ ...args, db });
-        const { deletedCount } = await pruneEvents(db, {
-            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
-            olderThanDays,
-        });
-        return { deletedCount };
+        return { deletedCount: await pruneInBatches(db, olderThanDays, args.batchSize) };
     }
-    return { deletedCount: await pruneByTenantProfiles(db) };
+    const operatorRetentionDays = await resolveExplicitRetentionDays({ ...args, db });
+    return { deletedCount: await pruneByTenantProfiles(db, operatorRetentionDays) };
 }

package/dist/auth-email-password/bootstrap.d.ts

@@ -1,10 +1,10 @@
-import { makeDispatchSystemWrite, type SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, type RoleDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import { type Registry, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
-import type { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+import type { GlobalRole } from "../user/constants.js";
 export type BootstrapInvite = {
     readonly email: string;
     /** Membership role in the tenant, validated like a tenant-admin invite
@@ -18,9 +18,7 @@ export type BootstrapSeedDeps = {
     /** Writes as the system user with the given tenant roles in the seeded
      *  tenant; use it when the app gates tenant data on its own roles rather
      *  than SystemAdmin. */
-    readonly dispatchWriteAs: (args: Pick<SystemDispatchArgs, "handlerQn" | "payload"> & {
-        readonly roles: readonly string[];
-    }) => Promise<WriteResult>;
+    readonly dispatchWriteAs: (args: Omit<RoleDispatchArgs, "tenantId">) => Promise<WriteResult>;
 };
 export type BootstrapConfigValue = string | number | boolean;
 export type BootstrapTenant = {
@@ -54,6 +52,10 @@ export type BootstrapDeps = {
     readonly db: DbConnection;
     readonly redis: Redis;
     readonly dispatcher: Dispatcher;
+    /** With these, a rerun can compare `encrypted`/`piiEncrypted` config keys by
+     *  their decrypted value; without them such keys are rewritten on every run. */
+    readonly registry?: Registry;
+    readonly configCipher?: EnvelopeCipher;
 };
 export type BootstrapTenantOutcome = "created" | "exists";
 export type BootstrapInviteOutcome = "invited" | "resent" | "pending" | "active" | "cancelled" | "role-mismatch";
@@ -77,4 +79,3 @@ export declare class BootstrapPlanError extends Error {
 export declare class BootstrapWriteError extends Error {
 }
 export declare function bootstrapTenants(deps: BootstrapDeps, plan: BootstrapPlan): Promise<BootstrapReport>;
-export {};

package/dist/auth-email-password/bootstrap.js

@@ -4,14 +4,14 @@
 // exactly as for any other writer. Nobody gets a role before accepting: the
 // invitation row holds membership role + global roles until the invitee
 // accepts through the regular invite-accept routes.
-import { makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, makeDispatchWriteAs, } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
 import { ConfigHandlers } from "../config/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap compares against the stored config row to stay idempotent
-import { findConfigRow } from "../config/write-helpers.js";
+import { configRowHoldsValue, findConfigRow } from "../config/write-helpers.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
 import { TenantHandlers } from "../tenant/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
@@ -78,8 +78,10 @@ async function applyTenantConfig(deps, tenant) {
     const applied = [];
     for (const [key, value] of Object.entries(tenant.config ?? {})) {
         const existing = await findConfigRow(deps.db, key, tenant.id, null);
-        if (existing?.value === JSON.stringify(value))
+        const serialized = JSON.stringify(value);
+        if (await configRowHoldsValue(existing, deps.registry?.getConfigKey(key), deps.configCipher, key, serialized)) {
             continue;
+        }
         const result = await deps.dispatcher.write(ConfigHandlers.set, { key, value, scope: ConfigScopes.tenant }, 
         // SystemAdmin on top of the system role: keys with the default tenant
         // write access (admin roles) reject a bare system user, system-only keys
@@ -125,6 +127,11 @@ async function decideInvite(deps, invite) {
     }
     if (invitation.status === INVITATION_STATUS.accepted)
         return "active";
+    // The plan dropped a global role (e.g. an admin moved to tenants[].invites):
+    // the stored invitation would still grant it on accept, so it is re-issued.
+    if (storedGlobalRoles.some((role) => !invite.globalRoles.some((planned) => planned === role))) {
+        return "resent";
+    }
     if (await hasLiveInviteToken(deps.redis, invitation.id))
         return "pending";
     return "resent";
@@ -135,6 +142,7 @@ function isMailingOutcome(outcome) {
 export async function bootstrapTenants(deps, plan) {
     const plannedInvites = planInvites(plan);
     const dispatchSystemWrite = makeDispatchSystemWrite(deps.dispatcher);
+    const dispatchWriteAsRoles = makeDispatchWriteAs(deps.dispatcher);
     const tenants = [];
     for (const tenant of plan.tenants) {
         const outcome = await ensureTenant(deps, tenant);
@@ -144,7 +152,7 @@ export async function bootstrapTenants(deps, plan) {
                 tenantId: tenant.id,
                 db: deps.db,
                 dispatchSystemWrite,
-                dispatchWriteAs: ({ handlerQn, payload, roles }) => deps.dispatcher.write(handlerQn, payload, createSystemUser(tenant.id, roles)),
+                dispatchWriteAs: (args) => dispatchWriteAsRoles({ ...args, tenantId: tenant.id }),
             });
         }
         const configApplied = await applyTenantConfig(deps, tenant);

package/dist/auth-email-password/email-rate-limits.d.ts

@@ -0,0 +1,4 @@
+import type { PayloadRateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+export declare const AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS: number;
+export declare const AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS = 3;
+export declare const AUTH_EMAIL_PAYLOAD_RATE_LIMITS: readonly PayloadRateLimitOption[];

package/dist/auth-email-password/email-rate-limits.js

@@ -0,0 +1,13 @@
+// The bucket counts across all IPs, so a long window would let an attacker who
+// knows an address lock its owner out of recovery/signup for the whole window.
+// A short one still throttles mail bombing but clears within minutes.
+export const AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS = 15 * 60;
+export const AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS = 3;
+export const AUTH_EMAIL_PAYLOAD_RATE_LIMITS = [
+    {
+        per: { payloadField: "email" },
+        limit: AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS,
+        windowSeconds: AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS,
+        normalize: "email",
+    },
+];

package/dist/auth-email-password/feature.js

@@ -19,6 +19,7 @@ import { createSignupConfirmHandler } from "./handlers/signup-confirm.write.js";
 import { createSignupRequestHandler, } from "./handlers/signup-request.write.js";
 import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
+import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./mail-i18n.js";
 import { AUTH_MAIL_VARIABLES, authMailLocalizedTemplate, INVITE_MAIL_VARIABLES, sendsMagicLinkMail, } from "./mail-notifications.js";
 /**
  * Env-vars contract for the `auth-email-password` feature.
@@ -89,6 +90,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
         if (sendsMagicLinkMail(opts))
             r.requires("delivery");
         r.envSchema(authEmailPasswordEnvSchema);
+        r.translations({ keys: AUTH_EMAIL_PASSWORD_MAIL_I18N });
         // Declared unconditionally: apps also issue the activation link from their
         // own flows (issueSignupActivation) without enabling the signup option.
         r.notification("password-reset", {

package/dist/auth-email-password/handlers/change-password.write.d.ts

@@ -4,4 +4,4 @@ export declare const changePasswordWrite: import("@cosmicdrift/kumiko-types/defi
     newPassword: z.ZodString;
 }, z.core.$strip>, {
     kind: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/change-password.write.js

@@ -1,4 +1,4 @@
-import { access, createSystemUser, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { hashPassword, verifyPassword } from "../../shared/index.js";
 import { UserHandlers, UserQueries } from "../../user/index.js";
@@ -14,7 +14,11 @@ export const changePasswordWrite = defineWriteHandler({
         oldPassword: z.string().min(1),
         newPassword: passwordSchema,
     }),
-    access: { roles: access.authenticated },
+    access: {
+        openToAll: {
+            reason: "Self-service: acts only on event.user.id and re-checks the caller's current password; invited members hold only an app role, so a fixed role list would lock them out.",
+        },
+    },
     escapeHatch: {
         grants: ["systemIdentity"],
         reason: "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, ...) " +

package/dist/auth-email-password/handlers/confirm-account-unlock.write.d.ts

@@ -6,4 +6,4 @@ export declare function createConfirmAccountUnlockHandler(opts: ConfirmAccountUn
     token: z.ZodString;
 }, z.core.$strip>, {
     kind: "account-unlocked";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-accept-with-login.write.d.ts

@@ -18,4 +18,4 @@ export declare function createInviteAcceptWithLoginHandler(opts?: InviteAcceptWi
     token: z.ZodString;
     email: z.ZodEmail;
     password: z.ZodString;
-}, z.core.$strip>, InviteAcceptWithLoginData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteAcceptWithLoginData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -56,9 +56,8 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
             grants: ["unsafeRaw"],
-            reason: "Anonymous invite-accept has no session in the invited tenant yet — checks existing " +
-                "membership via ctx.queryAs(SYSTEM, tenant:query:memberships) of the invitation's tenant. " +
-                "Also reads the pending invitation by id (the invitee is not yet a member of the " +
+            reason: "Anonymous invite-accept has no session in the invited tenant yet — reads the pending " +
+                "invitation by id (the invitee is not yet a member of the " +
                 "invitation's tenant), adds the membership and accepts the invitation in the " +
                 "invitation's tenant, which differs from the caller's tenant, and reads the MFA " +
                 "enrollment of that tenant via the mfaStatusChecker callback.",

package/dist/auth-email-password/handlers/invite-accept.write.d.ts

@@ -8,4 +8,4 @@ export type InviteAcceptData = {
 };
 export declare function createInviteAcceptHandler(): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-accept", z.ZodObject<{
     token: z.ZodString;
-}, z.core.$strip>, InviteAcceptData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteAcceptData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -1,7 +1,6 @@
 import * as z from "zod";
-import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
+import { type GlobalRole } from "../../user/constants.js";
 import type { AuthMailLocale } from "../email-templates.js";
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
 export type InviteCreateData = {
     readonly kind: "invite-created";
     readonly invitationId: string;
@@ -33,12 +32,12 @@ export type InviteCreateOptions = {
 export declare function createInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-create", z.ZodObject<{
     email: z.ZodEmail;
     role: z.ZodString;
-}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export declare function createSystemInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"system-invite-create", z.ZodObject<{
     email: z.ZodEmail;
     role: z.ZodString;
     globalRoles: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         SystemAdmin: "SystemAdmin";
     }>>>;
-}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
-export {};
+    locale: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -20,6 +20,7 @@ import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, assignableAppRolesOf, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
@@ -133,7 +134,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
     }
     const token = generateToken();
     await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
-    const locale = resolveHandlerMailLocale(ctx, opts.locale);
+    const locale = request.locale ?? resolveHandlerMailLocale(ctx, opts.locale);
     await dispatchMagicLinkMail(ctx.notify, {
         handlerName: "invite-create",
         notificationType: AuthMailNotificationTypes.invite,
@@ -188,6 +189,8 @@ const SystemInviteCreateSchema = z.object({
     email: z.email(),
     role: z.string().min(1).max(50),
     globalRoles: z.array(z.enum(GLOBAL_ROLE_OPTIONS)).max(GLOBAL_ROLE_OPTIONS.length).default([]),
+    // Preferred over the request locale: provisioning callers know the invitee's language.
+    locale: z.string().max(35).refine(isValidLocaleTag, "invalid locale tag").optional(),
 });
 // System-only sibling of invite-create: the only path that can put global
 // roles (SystemAdmin) on an invitation. No session mint path yields the

package/dist/auth-email-password/handlers/invite-signup-complete.write.d.ts

@@ -13,4 +13,4 @@ export type InviteSignupCompleteOptions = Pick<LoginHandlerOptions, "mfaStatusCh
 export declare function createInviteSignupCompleteHandler(opts?: InviteSignupCompleteOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-signup-complete", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/login.write.d.ts

@@ -74,5 +74,5 @@ export declare function gateBuildSession(ctx: HandlerContext, userId: string, te
 export declare function createLoginHandler(opts?: LoginHandlerOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"login", z.ZodObject<{
     email: z.ZodEmail;
     password: z.ZodString;
-}, z.core.$strip>, LoginResult, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, LoginResult, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export {};

package/dist/auth-email-password/handlers/logout.write.d.ts

@@ -1,2 +1,2 @@
 import * as z from "zod";
-export declare const logoutWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"logout", z.ZodObject<{}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export declare const logoutWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"logout", z.ZodObject<{}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/logout.write.js

@@ -1,4 +1,4 @@
-import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 // Logout — JWT is stateless, so server-side we only return OK. A future
 // revocation list / session table can land here without changing the
@@ -6,7 +6,11 @@ import * as z from "zod";
 export const logoutWrite = defineWriteHandler({
     name: "logout",
     schema: z.object({}),
-    access: { roles: access.authenticated },
+    access: {
+        openToAll: {
+            reason: "Self-service: touches no data, any signed-in member must be able to sign out regardless of which role they hold.",
+        },
+    },
     description: "Acknowledges a sign-out for the authenticated caller so the client can discard its token; the JWT is stateless, so no server-side session state changes here.",
     perform: stepsPipeline(({ r }) => [
         r.step.return({ isSuccess: true, data: { kind: "logged-out" } }),

package/dist/auth-email-password/handlers/request-account-unlock.write.d.ts

@@ -3,4 +3,4 @@ export type RequestAccountUnlockOptions = TokenRequestOptions;
 export type RequestUnlockData = TokenRequestData<"unlock-requested">;
 export declare function createRequestAccountUnlockHandler(opts: RequestAccountUnlockOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-account-unlock", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"unlock-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"unlock-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/request-email-verification.write.d.ts

@@ -3,4 +3,4 @@ export type RequestEmailVerificationOptions = TokenRequestOptions;
 export type RequestVerificationData = TokenRequestData<"verification-requested">;
 export declare function createRequestEmailVerificationHandler(opts: RequestEmailVerificationOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-email-verification", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"verification-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"verification-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/request-password-reset.write.d.ts

@@ -3,4 +3,4 @@ export type RequestPasswordResetOptions = TokenRequestOptions;
 export type RequestResetData = TokenRequestData<"reset-requested">;
 export declare function createRequestPasswordResetHandler(opts: RequestPasswordResetOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-password-reset", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"reset-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"reset-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/reset-password.write.d.ts

@@ -7,4 +7,4 @@ export declare function createResetPasswordHandler(opts: ResetPasswordOptions):
     newPassword: z.ZodString;
 }, z.core.$strip>, {
     kind: "password-reset";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/signup-confirm.write.d.ts

@@ -27,5 +27,5 @@ type ClaimedHandover = {
 export declare function createSignupConfirmHandler(opts?: SignupConfirmOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"signup-confirm", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export {};

package/dist/auth-email-password/handlers/signup-request.write.d.ts

@@ -29,4 +29,4 @@ export declare function createSignupRequestHandler(opts: SignupRequestOptions):
         entityType: z.ZodString;
         token: z.ZodString;
     }, z.core.$strip>>;
-}, z.core.$strip>, SignupRequestData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SignupRequestData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -24,6 +24,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { findSignupHandoverProvider } from "../../shared/index.js";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
 import { resolveHandlerMailLocale } from "../magic-link-mail.js";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.js";
 import { issueSignupActivation } from "../signup-activation.js";
@@ -48,7 +49,7 @@ export function createSignupRequestHandler(opts) {
         schema: SignupRequestSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
+        additionalRateLimits: AUTH_EMAIL_PAYLOAD_RATE_LIMITS,
         description: "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
         escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },
         handler: async (event, ctx) => {

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -2,8 +2,9 @@ import * as z from "zod";
 import { gateEnforceMfa, type LoginHandlerOptions } from "./login.write.js";
 export type SwitchTenantMfaGateData = {
     readonly kind: "mfa-gate-clear";
+    readonly roles: readonly string[];
 } | NonNullable<Awaited<ReturnType<typeof gateEnforceMfa>>>;
 export declare function createSwitchTenantMfaGateHandler(opts: Pick<LoginHandlerOptions, "mfaStatusChecker">): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"switch-tenant-mfa-gate", z.ZodObject<{
     userId: z.ZodString;
     tenantId: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.js

@@ -33,7 +33,7 @@ export function createSwitchTenantMfaGateHandler(opts) {
             const userRow = parseAuthUserRow(await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, { id: userId }));
             const roles = buildSessionRoles(parseRoles(userRow?.roles ?? null), active.membership.roles);
             const mfaGate = await gateEnforceMfa(ctx, opts, userId, tenantId, roles);
-            return { isSuccess: true, data: mfaGate ?? { kind: "mfa-gate-clear" } };
+            return { isSuccess: true, data: mfaGate ?? { kind: "mfa-gate-clear", roles } };
         },
     });
 }

package/dist/auth-email-password/handlers/token-request-handler.d.ts

@@ -41,4 +41,4 @@ export type TokenRequestOptions = {
 };
 export declare function createTokenRequestHandler<TName extends string, TSuccessKind extends string>(spec: TokenRequestSpec<TName, TSuccessKind>, opts: TokenRequestOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<TName, z.ZodObject<{
     email: z.ZodEmail;
-}, z.core.$strip>, TokenRequestData<TSuccessKind>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, TokenRequestData<TSuccessKind>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -17,6 +17,7 @@ import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { UserQueries } from "../../user/index.js";
 import { parseAuthUserRow } from "../auth-user-row.js";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 const RequestTokenSchema = z.object({
     email: z.email(),
@@ -33,7 +34,7 @@ export function createTokenRequestHandler(spec, opts) {
         schema: RequestTokenSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
+        additionalRateLimits: AUTH_EMAIL_PAYLOAD_RATE_LIMITS,
         escapeHatch: {
             grants: ["systemIdentity"],
             reason: "Anonymous requester has no session — looks up the target user by email via " +

package/dist/auth-email-password/handlers/verify-email.write.d.ts

@@ -9,4 +9,4 @@ export type VerifyEmailData = {
 };
 export declare function createVerifyEmailHandler(opts: VerifyEmailOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"verify-email", z.ZodObject<{
     token: z.ZodString;
-}, z.core.$strip>, VerifyEmailData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, VerifyEmailData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/magic-link-mail.js

@@ -37,21 +37,24 @@ export async function dispatchMagicLinkMail(notify, spec, params) {
     // mailT already root-falls-back; appUrl must use the same negotiated tag
     // or language-in-path apps 404 on e.g. /de-AT/activate.
     const urlLocale = resolveMailLocale(locale);
+    // Template, expiry formatting and app-name fallback must share one locale,
+    // otherwise an English template shows e.g. French "3 heures".
+    const templateLocale = authMailTemplateLocale(spec.notificationType, locale);
     const { validFor, validUntil } = tokenMailExpiry({
         expiresAt: params.expiresAt,
         ...(params.issuedAt !== undefined && { issuedAt: params.issuedAt }),
         ...(params.timeZone !== undefined && { timeZone: params.timeZone }),
-    }, locale);
+    }, templateLocale);
     await notify(spec.notificationType, {
         route: { email: params.email },
         data: {
-            appName: params.appName ?? spec.fallbackAppName ?? mailT(locale, "auth.mail.appNameDefault"),
+            appName: params.appName ?? spec.fallbackAppName ?? mailT(templateLocale, "auth.mail.appNameDefault"),
             actionUrl: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
             validFor,
             validUntil,
             ...(params.role !== undefined && { role: params.role }),
         },
-        locale: authMailTemplateLocale(spec.notificationType, locale),
+        locale: templateLocale,
         priority: "critical",
     });
 }

package/dist/auth-email-password/mail-i18n.d.ts

@@ -0,0 +1,3 @@
+export declare const AUTH_EMAIL_PASSWORD_MAIL_I18N: Readonly<Record<string, {
+    readonly en: string;
+}>>;

package/dist/auth-email-password/mail-i18n.js

@@ -0,0 +1,10 @@
+// @runtime client
+// Server-registered so the document designer names the seeded auth mails.
+export const AUTH_EMAIL_PASSWORD_MAIL_I18N = {
+    "auth-email-password:feature.label": { en: "Sign-in" },
+    "auth-email-password:notify.password-reset.label": { en: "Password reset" },
+    "auth-email-password:notify.account-unlock.label": { en: "Account unlock" },
+    "auth-email-password:notify.email-verification.label": { en: "Email verification" },
+    "auth-email-password:notify.signup-activation.label": { en: "Sign-up activation" },
+    "auth-email-password:notify.invite.label": { en: "Invitation" },
+};