@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.379.0

package/dist/auth-email-password/errors.js

@@ -1,5 +1,5 @@
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { AuthErrors } from "./constants.js";
+import { AuthErrors } from "./web/constants.js";
 // @wrapper-known error-helper
 export function invalidCredentials() {
     return writeFailure(new UnprocessableError(AuthErrors.invalidCredentials, {

package/dist/auth-email-password/feature.js

@@ -1,7 +1,6 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
-import { MIN_HMAC_SECRET_LENGTH } from "./constants.js";
 import { changePasswordWrite } from "./handlers/change-password.write.js";
 import { createConfirmAccountUnlockHandler } from "./handlers/confirm-account-unlock.write.js";
 import { createInviteAcceptHandler } from "./handlers/invite-accept.write.js";
@@ -20,8 +19,9 @@ import { createSignupConfirmHandler } from "./handlers/signup-confirm.write.js";
 import { createSignupRequestHandler, } from "./handlers/signup-request.write.js";
 import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
-import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./mail-i18n.js";
 import { AUTH_MAIL_VARIABLES, authMailLocalizedTemplate, INVITE_MAIL_VARIABLES, sendsMagicLinkMail, } from "./mail-notifications.js";
+import { MIN_HMAC_SECRET_LENGTH } from "./web/constants.js";
+import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./web/mail-i18n.js";
 /**
  * Env-vars contract for the `auth-email-password` feature.
  *

package/dist/auth-email-password/handlers/confirm-account-unlock.write.js

@@ -1,10 +1,10 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { AuthErrors } from "../constants.js";
 import { invalidUnlockToken } from "../errors.js";
 import { clearLockoutState } from "../lockout-store.js";
 import { verifyUnlockToken } from "../unlock-token.js";
+import { AuthErrors } from "../web/constants.js";
 // Confirm step of the unlock flow. Unlike reset/verify, there's no entity
 // write: the token's HMAC signature already proves it was minted for an
 // existing, non-deleted user (see request-account-unlock.write.ts's

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -33,10 +33,10 @@ import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
 import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import login-style password-check
 import { userTable } from "../../user/schema/user.js";
-import { AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES, AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS, } from "../constants.js";
 import { invalidCredentials, invalidInviteToken, inviteEmailMismatch } from "../errors.js";
 import { burnInviteToken, deleteInviteToken, getInvitationIdForToken, unburnInviteToken, } from "../invite-token-store.js";
 import { passwordSchema } from "../password-policy.js";
+import { AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES, AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS, } from "../web/constants.js";
 import { gateEnforceAccountStatus, gateEnforceEmailVerified, gateEnforceLockout, gateEnforceMfa, gateVerifyPassword, } from "./login.write.js";
 const InviteAcceptWithLoginSchema = z.object({
     token: z.string().min(1),

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { type GlobalRole } from "../../user/constants.ts";
+import { type GlobalRole } from "../../user/web/constants.ts";
 import type { AuthMailLocale } from "../email-templates.ts";
 export type InviteCreateData = {
     readonly kind: "invite-created";

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -29,15 +29,15 @@ import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } fr
 import { membershipVersionOf } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import membership-role validation owned by tenant-feature
 import { findForbiddenMembershipRole, findForbiddenRoleAssignment, reservedMembershipRoleError, unassignableMembershipRoleError, } from "../../tenant/membership-roles.js";
-// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
-import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
 // kumiko-lint-ignore cross-feature-import invitee lookup by email reads the user row
 import { userTable } from "../../user/schema/user.js";
-import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../../user/web/constants.js";
 import { inviteAlreadyAccepted } from "../errors.js";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 import { AuthMailNotificationTypes } from "../mail-notifications.js";
+import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../web/constants.js";
 const InviteCreateSchema = z.object({
     email: z.email(),
     role: z.string().min(1).max(50),

package/dist/auth-email-password/handlers/invite-info.query.js

@@ -13,8 +13,8 @@ import { decryptStoredPii } from "../../shared/index.js";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import login-style account lookup, same as invite-accept-with-login
 import { userTable } from "../../user/schema/user.js";
-import { AuthErrors } from "../constants.js";
 import { getInvitationIdForToken } from "../invite-token-store.js";
+import { AuthErrors } from "../web/constants.js";
 const InviteInfoSchema = z.object({
     token: z.string().min(1),
 });

package/dist/auth-email-password/handlers/login.write.d.ts

@@ -47,6 +47,7 @@ type AuthenticatableUserRow = AuthUserRow & {
 };
 /** Uniform response on any credential miss — burns argon2 cost (#774). */
 export declare function gateResolveAuthUser(found: AuthUserRow | null, password: string): Promise<GateOutcome<AuthenticatableUserRow>>;
+export declare function gateCountUnknownUser(ctx: HandlerContext, email: string, maxFailedAttempts: number, lockoutDurationMinutes: number): Promise<GateOutcome<undefined>>;
 /**
  * Lockout BEFORE password verify — locked accounts can't be password-probed.
  * Fail-open without Redis (IP rate-limit still covers partially).

package/dist/auth-email-password/handlers/login.write.js

@@ -4,9 +4,9 @@ import * as z from "zod";
 import { verifyDummyPassword, verifyPassword } from "../../shared/index.js";
 import { USER_STATUS, UserQueries } from "../../user/index.js";
 import { parseAuthUserRow } from "../auth-user-row.js";
-import { AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES, AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS, } from "../constants.js";
 import { accountLocked, accountRestricted, emailNotVerified, invalidCredentials, noMembership, } from "../errors.js";
 import { clearLockoutState, getLockoutState, recordFailedAttempt } from "../lockout-store.js";
+import { AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES, AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS, } from "../web/constants.js";
 const SYSTEM_USER_ID = "00000000-0000-4000-8000-000000000000";
 function reject(result) {
     return { ok: false, result };
@@ -22,6 +22,26 @@ export async function gateResolveAuthUser(found, password) {
     }
     return ok({ ...found, passwordHash: found.passwordHash });
 }
+// Unknown and deleted addresses are counted too, under a keyed digest of the
+// address exactly as findForAuth looks it up (no own normalization: a differently
+// cased spelling is a different, unknown address and must not share a counter with a
+// registered one). ctx.rateLimitDigest is derived from the JWT secret, so that after the
+// threshold they answer account_locked exactly like a registered address.
+// Without a digest key (no rate-limit wiring) they stay plain invalid_credentials.
+function unknownEmailLockoutSubject(ctx, email) {
+    const digest = ctx.rateLimitDigest?.(email);
+    return digest === undefined ? undefined : `email:${digest}`;
+}
+export async function gateCountUnknownUser(ctx, email, maxFailedAttempts, lockoutDurationMinutes) {
+    const subject = unknownEmailLockoutSubject(ctx, email);
+    if (!ctx.redis || subject === undefined)
+        return ok(undefined);
+    const locked = await gateEnforceLockout(ctx, subject);
+    if (!locked.ok)
+        return locked;
+    await recordFailedAttempt(ctx.redis, subject, maxFailedAttempts, lockoutDurationMinutes);
+    return ok(undefined);
+}
 /**
  * Lockout BEFORE password verify — locked accounts can't be password-probed.
  * Fail-open without Redis (IP rate-limit still covers partially).
@@ -164,6 +184,11 @@ export function createLoginHandler(opts = {}) {
         handler: async (event, ctx) => {
             const systemUser = createSystemUser(SYSTEM_USER_ID);
             const foundRow = parseAuthUserRow(await ctx.queryAs(systemUser, UserQueries.findForAuth, { email: event.payload.email }));
+            if (!foundRow?.passwordHash || foundRow.isDeleted) {
+                const unknown = await gateCountUnknownUser(ctx, event.payload.email, maxFailedAttempts, lockoutDurationMinutes);
+                if (!unknown.ok)
+                    return unknown.result;
+            }
             const userGate = await gateResolveAuthUser(foundRow, event.payload.password);
             if (!userGate.ok)
                 return userGate.result;

package/dist/auth-email-password/handlers/request-account-unlock.write.js

@@ -1,6 +1,6 @@
-import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
 import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signUnlockToken } from "../unlock-token.js";
+import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../web/constants.js";
 import { createTokenRequestHandler, } from "./token-request-handler.js";
 // @wrapper-known semantic-alias
 export function createRequestAccountUnlockHandler(opts) {

package/dist/auth-email-password/handlers/request-email-verification.write.js

@@ -1,6 +1,6 @@
-import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
 import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signVerificationToken } from "../verification-token.js";
+import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../web/constants.js";
 import { createTokenRequestHandler, } from "./token-request-handler.js";
 // @wrapper-known semantic-alias
 export function createRequestEmailVerificationHandler(opts) {

package/dist/auth-email-password/handlers/request-password-reset.write.js

@@ -1,6 +1,6 @@
-import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
 import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signResetToken } from "../reset-token.js";
+import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../web/constants.js";
 import { createTokenRequestHandler, } from "./token-request-handler.js";
 // @wrapper-known semantic-alias
 export function createRequestPasswordResetHandler(opts) {

package/dist/auth-email-password/handlers/reset-password.write.js

@@ -2,10 +2,10 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { hashPassword } from "../../shared/index.js";
-import { AuthErrors } from "../constants.js";
 import { invalidResetToken } from "../errors.js";
 import { passwordSchema } from "../password-policy.js";
 import { verifyResetToken } from "../reset-token.js";
+import { AuthErrors } from "../web/constants.js";
 import { runConfirmTokenFlow } from "./confirm-token-flow.js";
 // Confirm step of the reset flow. Token-verify happens inline; the
 // post-verify pipeline (burn, load user, memberships, try-all-tenants,

package/dist/auth-email-password/handlers/verify-email.write.js

@@ -1,9 +1,9 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { AuthErrors } from "../constants.js";
 import { invalidVerificationToken } from "../errors.js";
 import { verifyVerificationToken } from "../verification-token.js";
+import { AuthErrors } from "../web/constants.js";
 import { runConfirmTokenFlow } from "./confirm-token-flow.js";
 const VerifyEmailSchema = z.object({
     token: z.string().min(1),

package/dist/auth-email-password/index.d.ts

@@ -2,7 +2,6 @@ export { hashPassword, verifyPassword } from "../shared/password-hashing.ts";
 export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.ts";
 export type { BootstrapConfigValue, BootstrapDeps, BootstrapInvite, BootstrapInviteOutcome, BootstrapPlan, BootstrapReport, BootstrapSeedDeps, BootstrapSystemAdmin, BootstrapTenant, BootstrapTenantOutcome, } from "./bootstrap.ts";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.ts";
-export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.ts";
 export type { AuthMailLocale } from "./email-templates.ts";
 export type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOptions, EmailVerificationOptions, InviteOptions, PasswordResetOptions, SignupOptions, } from "./feature.ts";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.ts";
@@ -11,3 +10,4 @@ export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature
 export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.ts";
 export { type IssuedSignupActivation, type IssueSignupActivationArgs, issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.ts";
 export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.ts";
+export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries, } from "./web/constants.ts";

package/dist/auth-email-password/index.js

@@ -7,7 +7,6 @@
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
 export { DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
-export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
 export { AuthMailNotificationTypes } from "./mail-notifications.js";
 export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.js";
@@ -19,3 +18,4 @@ export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature
 export { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
 export { issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
 export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";
+export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries, } from "./web/constants.js";

package/dist/auth-email-password/mail-notifications.js

@@ -1,7 +1,7 @@
 import { QnTypes, qn, templateVariable, } from "@cosmicdrift/kumiko-framework/engine";
 import { hasMailTranslationKey, listMailLocales, mailT, resolveMailLocale, } from "@cosmicdrift/kumiko-framework/i18n";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
-import { AUTH_EMAIL_PASSWORD_FEATURE } from "./constants.js";
+import { AUTH_EMAIL_PASSWORD_FEATURE } from "./web/constants.js";
 export const AUTH_MAIL_KINDS = {
     passwordReset: { name: "password-reset", translationKey: "reset" },
     accountUnlock: { name: "account-unlock", translationKey: "unlock" },

package/dist/auth-email-password/signup-activation.js

@@ -5,10 +5,10 @@
 // cannot drift between the two.
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "./constants.js";
 import { dispatchMagicLinkMail } from "./magic-link-mail.js";
 import { AuthMailNotificationTypes } from "./mail-notifications.js";
 import { invalidateExistingSignupToken, normalizeEmail, storeSignupToken, } from "./signup-token-store.js";
+import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "./web/constants.js";
 export const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = AuthMailNotificationTypes.signupActivation;
 export async function issueSignupActivation(args) {
     const ttlSeconds = (args.tokenTtlMinutes ?? AUTH_SIGNUP_DEFAULT_TTL_MINUTES) * 60;

package/dist/auth-email-password/web/auth-client.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Browser-Seite der Auth-Routes. Dünne fetch-Wrapper um /api/auth/*
 // mit Cookie-Transport: JWT lebt im HttpOnly kumiko_auth-Cookie,
 // Double-Submit-CSRF-Token im JS-lesbaren kumiko_csrf-Cookie. Alle

package/dist/auth-email-password/web/auth-form-logic.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure form helpers shared by auth screens. Extracted so unit tests can
 // pin password / rate-limit / redirect rules without mounting React.
 /** Client-side password + confirm check before calling signup/reset APIs. */

package/dist/auth-email-password/web/auth-form-primitives.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // Shared Web-Primitives für die Auth-Screens. Nur noch Layout/Style-
 // Helpers — Form/Field/Input/Button/Banner kommen jetzt über
 // usePrimitives() aus dem Framework-Vertrag, damit Native dieselben

package/dist/auth-email-password/web/auth-gate.js

@@ -1,5 +1,4 @@
 import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // Auth-Gate: rendert den LoginScreen solange der Session-Status
 // "unauthenticated" ist, sonst die Kinder. "loading" zeigt einen
 // minimalen Placeholder — die initiale Refresh-Runde liefert in der

package/dist/auth-email-password/web/auth-redirect.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Redirect targets for external login pages. `next` travels through the query
 // string, so anything read back from it is untrusted: only same-origin
 // root-relative paths pass (no "//host", no "/\host", no scheme).

package/dist/auth-email-password/web/client-actions.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Handlers for RowAction `kind: "clientAction"`: an admin screen lists users and
 // triggers the same public mail flows the login screens use.
 import { requestEmailVerification, requestPasswordReset, } from "./auth-client.js";

package/dist/auth-email-password/web/client-plugin.js

@@ -1,12 +1,11 @@
-// @runtime client
 // Client-Feature-Factory für auth-email-password. Wird vom App-Code
 // in createKumikoApp({ clientFeatures: [emailPasswordClient()] })
 // eingehängt und bringt Session-Context + AuthGate + Default-UI-
 // Translations (de/en) mit. Alles ist overridbar — Login-Screen,
 // Strings pro Locale, pro Key.
-import { defaultTranslations, mergeTranslations } from "../i18n.js";
 import { makeSessionAuthGate, } from "./auth-gate.js";
 import { emailPasswordClientActions } from "./client-actions.js";
+import { defaultTranslations, mergeTranslations } from "./i18n.js";
 export function emailPasswordClient(options = {}) {
     const translations = mergeTranslations(defaultTranslations, options.translations ?? {});
     return {

package/dist/auth-email-password/web/confirm-account-unlock-screen.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // ConfirmAccountUnlockScreen — reads `?token=...` from the URL, auto-posts
 // it to /api/auth/confirm-account-unlock on mount, shows success/error.
 // Idempotent server-side (clearLockoutState is a no-op when already

package/dist/auth-email-password/{constants.js → web/constants.js}

@@ -1,9 +1,6 @@
-// @runtime client
-// Pure string constants — no DB/Node builtins. Marked `@runtime client` so
-// browser code (Members screen etc.) can import them too without the
-// runtime-isolation guard complaining. Runtime may import "client" files
-// (see RUNTIME_RULES), so server-side access (handlers, dispatcher) stays
-// intact as well.
+// Pure string constants — no DB/Node builtins. They live under web/ so browser
+// code (Members screen etc.) can import them without the runtime-isolation
+// guard complaining; runtime may import client files, so handlers keep using them.
 export const AUTH_EMAIL_PASSWORD_FEATURE = "auth-email-password";
 // Minimum length for reset/verify hmacSecret — mirrors the ≥32-char
 // JWT_SECRET env check (HMAC-SHA256 key material).

package/dist/auth-email-password/web/default-topbar-actions.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // Standard-Topbar-Actions Komposition für Apps mit Auth + Workspaces.
 // Bündelt das Pattern das jeder App-Sample sonst hand-ausschreibt:
 // TenantSwitcher (links) → optional Extras (z.B. LanguageSwitcher) →

package/dist/auth-email-password/web/forgot-password-screen.js

@@ -1,5 +1,4 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // ForgotPasswordScreen — Form mit email-input. Submit triggert
 // /api/auth/request-password-reset (silent-success, kein account-
 // enumeration). UI zeigt unconditional ein "Wenn Account existiert,

package/dist/auth-email-password/{i18n.js → web/i18n.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // English UI copy for this feature. emailPasswordClient() mounts it as a
 // LocaleProvider fallback. Apps override keys via
 // `emailPasswordClient({ translations })`. German/Spanish ship in
@@ -129,7 +128,7 @@ export const defaultTranslations = {
         "auth.tenant.switcher.none": "No tenant",
     },
 };
-// Kanonische Implementierung lebt jetzt im Renderer (neben
-// TranslationsByLocale) — Re-Export hält die bestehende Import-Surface
-// (auth-email-password/web) stabil.
+// The canonical implementation lives in the renderer (next to
+// TranslationsByLocale); the re-export keeps the existing import surface
+// (auth-email-password/web) stable.
 export { mergeTranslations } from "@cosmicdrift/kumiko-renderer";

package/dist/auth-email-password/web/index.d.ts

@@ -1,4 +1,3 @@
-export { defaultTranslations, mergeTranslations } from "../i18n.ts";
 export type { AuthTokenFailure, CurrentUserProfile, LoginFailure, LoginRequest, LoginResponse, ResetPasswordFailure, SignupConfirmSuccess, TenantSummary, VerifyEmailFailure, } from "./auth-client.ts";
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.ts";
 export type { AuthCardProps, AuthShellRenderer } from "./auth-form-primitives.tsx";
@@ -14,6 +13,7 @@ export type { DefaultTopbarActionsProps } from "./default-topbar-actions.tsx";
 export { DefaultTopbarActions } from "./default-topbar-actions.tsx";
 export type { ForgotPasswordScreenProps } from "./forgot-password-screen.tsx";
 export { ForgotPasswordScreen } from "./forgot-password-screen.tsx";
+export { defaultTranslations, mergeTranslations } from "./i18n.ts";
 export type { InviteAcceptScreenProps } from "./invite-accept-screen.tsx";
 export { InviteAcceptScreen } from "./invite-accept-screen.tsx";
 export type { AuthLegalLink, LoginScreenProps } from "./login-screen.tsx";

package/dist/auth-email-password/web/index.js

@@ -1,10 +1,8 @@
-// @runtime client
 // Public exports für die Browser-Seite des auth-email-password Features.
 // Wird über den Sub-Path-Export `@cosmicdrift/kumiko-bundled-features/auth-email-
 // password/web` konsumiert — die Server-Seite (defineFeature) lebt in
 // `@cosmicdrift/kumiko-bundled-features/auth-email-password` und hat keine
 // React-/DOM-Deps. Trennung bleibt sauber so wie renderer vs renderer/web.
-export { defaultTranslations, mergeTranslations } from "../i18n.js";
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";
@@ -13,6 +11,7 @@ export { emailPasswordClient } from "./client-plugin.js";
 export { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.js";
 export { DefaultTopbarActions } from "./default-topbar-actions.js";
 export { ForgotPasswordScreen } from "./forgot-password-screen.js";
+export { defaultTranslations, mergeTranslations } from "./i18n.js";
 export { InviteAcceptScreen } from "./invite-accept-screen.js";
 export { LoginScreen } from "./login-screen.js";
 export { RequestAccountUnlockScreen } from "./request-account-unlock-screen.js";

package/dist/auth-email-password/web/invite-accept-screen.d.ts

@@ -6,8 +6,8 @@ export type InviteAcceptScreenProps = {
      *  `(data) => "/${data.tenantId}/"`. Function-form receives the roles this
      *  flow grants in the target tenant; branch 1 reports the invitation's
      *  role, which for an existing member is not their full role set there.
-     *  @deprecated Configure auth.postAuthLanding on the server; its landingPath wins.
-     *  Kept as fallback. */
+     *  @deprecated Removed in 0.390.0. Configure auth.postAuthLanding on the server; its landingPath wins.
+     *  Kept as fallback until 0.390.0. */
     readonly loggedInHref?: string | ((args: {
         tenantId: string;
         roles: readonly string[];

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // InviteAcceptScreen — Magic-Link-Accept für Tenant-Invitations.
 //
 // Liest `?token=...` aus der URL und branched intern je nach session-state:

package/dist/auth-email-password/web/login-screen.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // Default-LoginScreen. Reine E-Mail-+-Passwort-Form, zentriert, Card-
 // Layout. Texte kommen aus `useTranslation()` — die Default-Bundles
 // (de+en) liefert das Feature selber mit (translations.ts); Apps die

package/dist/auth-email-password/{mail-i18n.js → web/mail-i18n.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Server-registered so the document designer names the seeded auth mails.
 export const AUTH_EMAIL_PASSWORD_MAIL_I18N = {
     "auth-email-password:feature.label": { en: "Sign-in" },

package/dist/auth-email-password/web/request-account-unlock-screen.js

@@ -1,5 +1,4 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // RequestAccountUnlockScreen — form with an email input. Submit triggers
 // /api/auth/request-account-unlock (silent-success, no account
 // enumeration). UI unconditionally shows an "if your account is locked,

package/dist/auth-email-password/web/reset-password-screen.js

@@ -1,5 +1,4 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // ResetPasswordScreen — liest `?token=...` aus der URL, zeigt Form mit
 // new + confirm-password. Submit triggert /api/auth/reset-password mit
 // dem Token. Server collapses alle Token-Verify-Failures auf einen

package/dist/auth-email-password/web/session-bootstrap-error.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // Rendered by auth-gate's LoginRoute when the session bootstrap failed for a reason other than "not logged in".
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";

package/dist/auth-email-password/web/session.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // Session-State für den Browser-Renderer. Hält den aktuell eingeloggten
 // User (Profile + aktive Tenant-Zuordnung + Memberships), reagiert auf
 // Login/Logout/Switch-Tenant und refresh't die Daten automatisch.

package/dist/auth-email-password/web/signup-complete-screen.d.ts

@@ -7,8 +7,8 @@ export type SignupCompleteScreenProps = {
     /** Where to send the user after activation. Function-form receives the tenantKey, the
      *  roles granted by this flow in that tenant, and the claimed `handover` entity when
      *  signup claimed a try-first grant. Default "/".
-     *  @deprecated Configure auth.postAuthLanding on the server; its landingPath wins.
-     *  Kept as fallback. */
+     *  @deprecated Removed in 0.390.0. Configure auth.postAuthLanding on the server; its landingPath wins.
+     *  Kept as fallback until 0.390.0. */
     readonly loggedInHref?: string | ((args: {
         tenantKey: string;
         roles: readonly string[];

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // SignupCompleteScreen — Magic-Link-Self-Signup, Step 2.
 //
 // Reads `?token=...` from the URL, shows a form with password + confirm.

package/dist/auth-email-password/web/signup-screen.js

@@ -1,5 +1,4 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // SignupScreen — Magic-Link-Self-Signup, Step 1.
 //
 // Form mit Email-Input. Submit triggert /api/auth/signup-request

package/dist/auth-email-password/web/tenant-menu-items.js

@@ -1,5 +1,4 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // Tenant choices as dropdown entries — the TenantSwitcher's list for a user
 // menu that carries the shell controls. Renders nothing for a single tenant.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";

package/dist/auth-email-password/web/tenant-switcher.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // TenantSwitcher — kleines Dropdown, zeigt den aktiven Tenant und
 // erlaubt Wechsel zu anderen Memberships. Auf Radix-DropdownMenu für
 // konsistentes Verhalten (Click-outside/Escape/Keyboard-Nav).

package/dist/auth-email-password/web/use-shell-user.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Liest den eingeloggten User + die Rollen aus dem aktiven Tenant aus
 // der Session. Der Hook ist die Standard-Brücke zwischen Session-State
 // und Layout-Komponenten (WorkspaceShell.user, DefaultAppShell-Gates,

package/dist/auth-email-password/web/user-menu.js

@@ -1,5 +1,4 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // UserMenu — Avatar-Dropdown für die Topbar (variant="pill", Default) oder den
 // Sidebar-Footer (variant="sidebar" = die sidebar-07-NavUser-Row). Zeigt
 // Name/Email + Logout. Auf Radix-DropdownMenu, damit Click-outside, Escape,

package/dist/auth-email-password/web/verify-email-screen.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // VerifyEmailScreen — liest `?token=...` aus URL, schickt ihn auto an
 // /api/auth/verify-email beim Mount, zeigt success/error. Idempotent
 // auf Server-Seite (mehrfaches Klicken setzt emailVerified=true erneut),

package/dist/auth-mfa/errors.d.ts

@@ -1,5 +1,5 @@
 import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
-export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants.ts";
+export { AuthMfaErrorCodes as AuthMfaErrors } from "./web/constants.ts";
 export declare function mfaAlreadyEnabled(): WriteFailure;
 export declare function mfaNotEnabled(): WriteFailure;
 export declare function invalidSetupToken(): WriteFailure;

package/dist/auth-mfa/errors.js

@@ -1,6 +1,6 @@
 import { UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { AuthMfaErrorCodes } from "./constants.js";
-export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants.js";
+import { AuthMfaErrorCodes } from "./web/constants.js";
+export { AuthMfaErrorCodes as AuthMfaErrors } from "./web/constants.js";
 export function mfaAlreadyEnabled() {
     return writeFailure(new UnprocessableError(AuthMfaErrorCodes.mfaAlreadyEnabled, {
         i18nKey: "auth.mfa.errors.mfaAlreadyEnabled",

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -7,13 +7,13 @@ import * as z from "zod";
 import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared/index.js";
 import { USER_STATUS, UserQueries } from "../../user/index.js";
 import { base32Decode } from "../base32.js";
-import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants.js";
 import { findUserMfaRow } from "../db/queries.js";
 import { invalidSetupToken, invalidTotpCode, mfaAlreadyEnabled, tooManyAttempts, } from "../errors.js";
 import { verifyMfaSetupToken } from "../mfa-setup-token.js";
 import { clearMfaVerifyAttempts, getMfaVerifyLockoutState, recordFailedMfaVerifyAttempt, } from "../mfa-verify-attempts.js";
 import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
 import { verifyTotp } from "../totp.js";
+import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../web/constants.js";
 const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
     entityName: "user-mfa",
 });

package/dist/auth-mfa/handlers/enable-start-preauth.write.js

@@ -2,7 +2,6 @@ import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { base32Encode } from "../base32.js";
-import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.js";
 import { findUserMfaRow } from "../db/queries.js";
 import { invalidChallengeToken, mfaAlreadyEnabled } from "../errors.js";
 import { verifyMfaPreauthSetupToken } from "../mfa-preauth-setup-token.js";
@@ -10,6 +9,7 @@ import { signMfaSetupToken } from "../mfa-setup-token.js";
 import { buildOtpauthUri } from "../otpauth-uri.js";
 import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.js";
 import { generateTotpSecret } from "../totp.js";
+import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../web/constants.js";
 const ENABLE_START_PREAUTH_TENANT_REASON = "reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant";
 // Pre-auth twin of enable-start.write.ts: identity comes from a verified
 // preauthSetupToken (minted by login.write.ts when enforcement policy

package/dist/auth-mfa/handlers/enable-start.write.js

@@ -2,13 +2,13 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { UserQueries } from "../../user/index.js";
 import { base32Encode } from "../base32.js";
-import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.js";
 import { findUserMfaRow } from "../db/queries.js";
 import { mfaAlreadyEnabled } from "../errors.js";
 import { signMfaSetupToken } from "../mfa-setup-token.js";
 import { buildOtpauthUri } from "../otpauth-uri.js";
 import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.js";
 import { generateTotpSecret } from "../totp.js";
+import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../web/constants.js";
 const FALLBACK_ACCOUNT_LABEL = "account";
 // The authenticator app shows this label, so an internal user id must never leak into it.
 function readableAccountLabel(me) {