@cosmicdrift/kumiko-bundled-features 0.383.0 → 0.384.0

package/dist/audit/web/audit-event-labels.js

@@ -0,0 +1,23 @@
+import { AUDIT_EVENT_ACTIONS } from "./constants.js";
+export function isAuditEventAction(value) {
+    return AUDIT_EVENT_ACTIONS.some((action) => action === value);
+}
+function humanizeEntityName(aggregateType) {
+    const spaced = aggregateType.replaceAll("-", " ").replace(/([a-z])([A-Z])/g, "$1 $2");
+    return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
+}
+/** Singular entity noun: the entity's own `:noun` key, then the audit log's label for bundled entities, then the humanized aggregate type. */
+export function auditEntityLabel(t, row) {
+    const aggregateType = row["aggregateType"];
+    if (typeof aggregateType !== "string")
+        return null;
+    const nounKey = row["entityNounKey"];
+    if (typeof nounKey === "string") {
+        const noun = t(nounKey, { count: 1 });
+        if (noun !== nounKey)
+            return noun;
+    }
+    const bundledKey = `audit.log.entity.${aggregateType}`;
+    const bundledLabel = t(bundledKey);
+    return bundledLabel === bundledKey ? humanizeEntityName(aggregateType) : bundledLabel;
+}

package/dist/audit/web/client-plugin.js

@@ -1,9 +1,14 @@
 import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
-import { AUDIT_FEATURE } from "./constants.js";
+import { AuditEventCell, AuditObjectCell } from "./audit-event-cell.js";
+import { AUDIT_EVENT_CELL_COMPONENT, AUDIT_FEATURE, AUDIT_OBJECT_CELL_COMPONENT, } from "./constants.js";
 import { defaultTranslations } from "./default-translations.js";
 export function auditClient(options) {
     return {
         name: AUDIT_FEATURE,
         translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+        columnRenderers: {
+            [AUDIT_EVENT_CELL_COMPONENT]: AuditEventCell,
+            [AUDIT_OBJECT_CELL_COMPONENT]: AuditObjectCell,
+        },
     };
 }

package/dist/audit/web/constants.d.ts

@@ -5,6 +5,14 @@ export declare const SYSTEM_ACTOR_ID: "system";
 export declare const ANONYMOUS_USER_ID: "anonymous";
 /** All `createdBy` values that mean "system" in the audit UI (nil-UUID from createSystemUser + literal). */
 export declare const SYSTEM_ACTOR_IDS: ReadonlySet<string>;
+/** Column-renderer names shared by screens.ts and `auditClient()`. */
+export declare const AUDIT_EVENT_CELL_COMPONENT: "audit-event-cell";
+export declare const AUDIT_OBJECT_CELL_COMPONENT: "audit-object-cell";
+/** Action suffix of entity events (`<entity>.<action>`); other event types have none. */
+export declare const AUDIT_EVENT_ACTIONS: readonly ["created", "updated", "deleted", "restored"];
+export type AuditEventAction = (typeof AUDIT_EVENT_ACTIONS)[number];
+/** Value of the facet that brings technical entries (escape-hatch use) back into the log. */
+export declare const INCLUDE_TECHNICAL_FILTER: "include-technical";
 export declare const AuditQueries: {
     readonly list: "audit:query:list";
     readonly details: "audit:query:details";

package/dist/audit/web/constants.js

@@ -9,6 +9,13 @@ export const SYSTEM_ACTOR_IDS = new Set([
     SYSTEM_ACTOR_ID,
     "00000000-0000-0000-0000-000000000000",
 ]);
+/** Column-renderer names shared by screens.ts and `auditClient()`. */
+export const AUDIT_EVENT_CELL_COMPONENT = "audit-event-cell";
+export const AUDIT_OBJECT_CELL_COMPONENT = "audit-object-cell";
+/** Action suffix of entity events (`<entity>.<action>`); other event types have none. */
+export const AUDIT_EVENT_ACTIONS = ["created", "updated", "deleted", "restored"];
+/** Value of the facet that brings technical entries (escape-hatch use) back into the log. */
+export const INCLUDE_TECHNICAL_FILTER = "include-technical";
 export const AuditQueries = {
     list: "audit:query:list",
     details: "audit:query:details",

package/dist/audit/web/i18n.js

@@ -21,8 +21,55 @@ export const AUDIT_I18N = {
     "audit.log.col.tenant": { en: "Tenant" },
     "audit.log.col.when": { en: "When" },
     "audit.log.col.type": { en: "Event" },
-    "audit.log.col.aggregateType": { en: "Aggregate type" },
     "audit.log.col.aggregateId": { en: "Aggregate ID" },
+    "audit.log.col.aggregateType": { en: "Object" },
+    "audit.log.event": { en: "{entity} {action}" },
+    "audit.log.action.created": { en: "created" },
+    "audit.log.action.updated": { en: "updated" },
+    "audit.log.action.deleted": { en: "deleted" },
+    "audit.log.action.restored": { en: "restored" },
+    "audit.log.facet.technical": { en: "Technical entries" },
+    "audit.log.facet.technical.include": { en: "Show technical entries" },
+    "audit.log.event.custom-field-set": { en: "Custom field value set" },
+    "audit.log.event.custom-field-cleared": { en: "Custom field value cleared" },
+    "audit.log.event.field-definition-deleted": { en: "Custom field deleted" },
+    "audit.log.event.secret-read": { en: "Secret read" },
+    "audit.log.event.session-revoked": { en: "Session ended" },
+    "audit.log.event.subject-forgotten": { en: "Person forgotten (data erased)" },
+    "audit.log.event.forget-denied": { en: "Erasure request denied" },
+    "audit.log.event.pat-revoked": { en: "Access token revoked" },
+    "audit.log.event.mail-account-connected": { en: "Mail account connected" },
+    "audit.log.event.mail-account-updated": { en: "Mail account updated" },
+    "audit.log.event.mail-account-disconnected": { en: "Mail account disconnected" },
+    "audit.log.event.subscription-created": { en: "Subscription created" },
+    "audit.log.event.subscription-updated": { en: "Subscription updated" },
+    "audit.log.event.subscription-canceled": { en: "Subscription canceled" },
+    "audit.log.event.invoice-paid": { en: "Invoice paid" },
+    "audit.log.event.invoice-payment-failed": { en: "Invoice payment failed" },
+    "audit.log.event.payment-received": { en: "Payment received" },
+    "audit.log.event.checkout-consent-recorded": { en: "Checkout consent recorded" },
+    "audit.log.event.contract-confirmation-issued": { en: "Contract confirmation issued" },
+    "audit.log.event.contract-termination-revoked": { en: "Contract termination revoked" },
+    "audit.log.event.destruction-requested": { en: "Tenant deletion requested" },
+    "audit.log.event.destruction-cancelled": { en: "Tenant deletion cancelled" },
+    "audit.log.event.tenant-destruction-started": { en: "Tenant deletion started" },
+    "audit.log.event.tenant-destruction-completed": { en: "Tenant deletion completed" },
+    "audit.log.event.tenant-destruction-failed": { en: "Tenant deletion failed" },
+    "audit.log.event.tenant-handover-claimed": { en: "Tenant handover claimed" },
+    "audit.log.event.waitlist-exported": { en: "Waitlist exported" },
+    "audit.log.event.waitlist-purged": { en: "Waitlist purged" },
+    "audit.log.event.feature-toggle-set": { en: "Feature toggle changed" },
+    "audit.log.event.contract-termination-requested": { en: "Contract termination requested" },
+    "audit.log.event.contract-termination-declared": { en: "Contract termination declared" },
+    "audit.log.event.contract-termination-unmatched": { en: "Contract termination not matched" },
+    "audit.log.entity.tenant": { en: "Tenant" },
+    "audit.log.entity.tenant-membership": { en: "Membership" },
+    "audit.log.entity.tenant-invitation": { en: "Invitation" },
+    "audit.log.entity.user": { en: "User" },
+    "audit.log.entity.folder": { en: "Folder" },
+    "audit.log.entity.folder-assignment": { en: "Folder assignment" },
+    "audit.log.entity.field-definition": { en: "Custom field" },
+    "audit.log.entity.template-resource": { en: "Template" },
     "audit.log.col.actor": { en: "Actor" },
     "audit.log.details": { en: "Details" },
     "audit.log.detail.payload": { en: "Event payload" },

package/dist/auth-email-password/feature.js

@@ -9,6 +9,7 @@ import { createInviteCreateHandler, createSystemInviteCreateHandler, } from "./h
 import { inviteInfoQuery } from "./handlers/invite-info.query.js";
 import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write.js";
 import { createLoginHandler } from "./handlers/login.write.js";
+import { loginOptionsQuery } from "./handlers/login-options.query.js";
 import { logoutWrite } from "./handlers/logout.write.js";
 import { createRequestAccountUnlockHandler, } from "./handlers/request-account-unlock.write.js";
 import { createRequestEmailVerificationHandler } from "./handlers/request-email-verification.write.js";
@@ -83,8 +84,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
                 { key: "accountUnlock", label: "Account-Unlock-Flow", type: "boolean", default: false },
             ],
         });
-        r.requires({ features: ["user"] });
-        r.requires({ features: ["tenant"] });
+        r.requires({ features: ["user", "tenant"] });
         // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
         // via ctx.notify → delivery must be mounted. Fail closed at boot instead
         // of silently dropping the mail.
@@ -135,6 +135,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
             r.writeHandler(createVerifyEmailHandler(opts.emailVerification));
         }
         const queries = {
+            loginOptions: r.queryHandler(loginOptionsQuery),
             ...(opts.signup && {
                 signupRegistrationStatus: r.queryHandler(selfRegistrationStatusQuery),
             }),

package/dist/auth-email-password/handlers/login-options.query.d.ts

@@ -0,0 +1,5 @@
+import * as z from "zod";
+export declare const loginOptionsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"login-options", z.ZodObject<{}, z.core.$strip>, {
+    passwordReset: boolean;
+    accountUnlock: boolean;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/auth-email-password/handlers/login-options.query.js

@@ -0,0 +1,17 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { AuthHandlers } from "../web/constants.js";
+// Anonymous-readable so the (unauthenticated) login screen can show the
+// forgot-password and unlock links only when the matching mail flows are
+// actually mounted, without every app having to pass hrefs by hand.
+export const loginOptionsQuery = defineQueryHandler({
+    name: "login-options",
+    schema: z.object({}),
+    access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+    rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
+    description: "Reports which optional login-page flows (password reset, account unlock) are available, readable without signing in, so the login screen links only to flows that exist.",
+    handler: async (_query, ctx) => ({
+        passwordReset: ctx.registry.getWriteHandler(AuthHandlers.requestPasswordReset) !== undefined,
+        accountUnlock: ctx.registry.getWriteHandler(AuthHandlers.requestAccountUnlock) !== undefined,
+    }),
+});

package/dist/auth-email-password/index.d.ts

@@ -1,5 +1,4 @@
 export { hashPassword, verifyPassword } from "../shared/password-hashing.ts";
-export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.ts";
 export type { BootstrapConfigValue, BootstrapDeps, BootstrapInvite, BootstrapInviteOutcome, BootstrapPlan, BootstrapReport, BootstrapSeedDeps, BootstrapSystemAdmin, BootstrapTenant, BootstrapTenantOutcome, } from "./bootstrap.ts";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.ts";
 export type { AuthMailLocale } from "./email-templates.ts";
@@ -10,4 +9,5 @@ export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature
 export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.ts";
 export { type IssuedSignupActivation, type IssueSignupActivationArgs, issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.ts";
 export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.ts";
+export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH, makeAuthPaths, } from "./web/auth-paths.ts";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries, } from "./web/constants.ts";

package/dist/auth-email-password/index.js

@@ -5,7 +5,6 @@
 // hashPassword/verifyPassword; removing it is a breaking change that needs
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
-export { DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
 export { AuthMailNotificationTypes } from "./mail-notifications.js";
@@ -18,4 +17,5 @@ export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature
 export { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
 export { issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
 export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";
+export { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH, makeAuthPaths, } from "./web/auth-paths.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries, } from "./web/constants.js";

package/dist/auth-email-password/{auth-paths.d.ts → web/auth-paths.d.ts}

@@ -1,19 +1,21 @@
 /** A plain path, or a function picking the path per resolved mail locale
  *  (e.g. `/en/reset-password`, `/de/reset-password`). */
 export type AuthPath = string | ((locale: string) => string);
-/** Pfad-Konstanten der 4 Auth-Seiten (relativ zur App-baseUrl). */
 export type AuthPaths = {
     readonly resetPassword: AuthPath;
     readonly verifyEmail: AuthPath;
     readonly signupComplete: AuthPath;
     readonly inviteAccept: AuthPath;
+    readonly unlockAccount: AuthPath;
 };
-/** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
- *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
+/** Shared by every Kumiko app; apps override only the exceptions via `makeAuthPaths({ ... })`. */
 export declare const DEFAULT_AUTH_PATHS: {
     readonly resetPassword: "/reset-password";
     readonly verifyEmail: "/verify-email";
     readonly signupComplete: "/signup/complete";
     readonly inviteAccept: "/invite/accept";
+    readonly unlockAccount: "/unlock-account";
 };
+/** Client page that requests a reset mail; no mail links to it, so it is not part of AuthPaths. */
+export declare const DEFAULT_FORGOT_PASSWORD_PATH = "/forgot-password";
 export declare function makeAuthPaths(overrides?: Partial<AuthPaths>): AuthPaths;

package/dist/auth-email-password/{auth-paths.js → web/auth-paths.js}

@@ -1,14 +1,16 @@
-// Convention paths for the four auth pages (relative to the app base URL).
+// Convention paths for the five auth pages (relative to the app base URL).
 // resolveAuthMail builds each flow's magic-link appUrl from baseUrl + these;
 // the handlers append `?token=…` and mail via delivery (ctx.notify).
-/** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
- *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
+/** Shared by every Kumiko app; apps override only the exceptions via `makeAuthPaths({ ... })`. */
 export const DEFAULT_AUTH_PATHS = {
     resetPassword: "/reset-password",
     verifyEmail: "/verify-email",
     signupComplete: "/signup/complete",
     inviteAccept: "/invite/accept",
+    unlockAccount: "/unlock-account",
 };
+/** Client page that requests a reset mail; no mail links to it, so it is not part of AuthPaths. */
+export const DEFAULT_FORGOT_PASSWORD_PATH = "/forgot-password";
 export function makeAuthPaths(overrides = {}) {
     return { ...DEFAULT_AUTH_PATHS, ...overrides };
 }

package/dist/auth-email-password/web/client-plugin.d.ts

@@ -31,6 +31,11 @@ export type EmailPasswordClientOptions = {
      *  Für Branding ("Sign in" → "Login to Acme") oder weitere Sprachen
      *  (`fr`, `es`, …) zusätzlich. */
     readonly translations?: TranslationsByLocale;
+    /** Serve the forgot-password, reset-password and unlock-account pages at
+     *  their convention paths for signed-out visitors. Apps with their own
+     *  screens at those paths either register an earlier gate (it wins) or
+     *  set this to false. Default: true. */
+    readonly defaultAuthPages?: boolean;
 };
 export type EmailPasswordClientFeature = {
     readonly name: "auth-email-password";

package/dist/auth-email-password/web/client-plugin.js

@@ -5,6 +5,7 @@
 // Strings pro Locale, pro Key.
 import { makeSessionAuthGate, } from "./auth-gate.js";
 import { emailPasswordClientActions } from "./client-actions.js";
+import { DefaultAuthPagesGate } from "./default-auth-pages-gate.js";
 import { defaultTranslations, mergeTranslations } from "./i18n.js";
 export function emailPasswordClient(options = {}) {
     const translations = mergeTranslations(defaultTranslations, options.translations ?? {});
@@ -12,6 +13,7 @@ export function emailPasswordClient(options = {}) {
         name: "auth-email-password",
         providers: [],
         gates: [
+            ...(options.defaultAuthPages === false ? [] : [DefaultAuthPagesGate]),
             makeSessionAuthGate({
                 loginScreen: options.loginScreen,
                 loginScreenProps: options.loginScreenProps,

package/dist/auth-email-password/web/constants.d.ts

@@ -20,6 +20,7 @@ export declare const AuthHandlers: {
     readonly switchTenantMfaGate: "auth-email-password:write:switch-tenant-mfa-gate";
 };
 export declare const AuthQueries: {
+    readonly loginOptions: "auth-email-password:query:login-options";
     readonly signupRegistrationStatus: "auth-email-password:query:signup-registration-status";
     readonly inviteInfo: "auth-email-password:query:invite-info";
 };

package/dist/auth-email-password/web/constants.js

@@ -45,6 +45,7 @@ export const AuthHandlers = {
 // Qualified query names. Anonymous-readable status so the (unauthenticated)
 // signup page can decide whether to show its own link/form.
 export const AuthQueries = {
+    loginOptions: "auth-email-password:query:login-options",
     signupRegistrationStatus: "auth-email-password:query:signup-registration-status",
     // Anonymous, read-only invite lookup for the invite-acceptance page —
     // see invite-info.query.ts. Does not consume the token.

package/dist/auth-email-password/web/default-auth-pages-gate.d.ts

@@ -0,0 +1,4 @@
+import type { ReactNode } from "react";
+export declare function DefaultAuthPagesGate({ children }: {
+    readonly children: ReactNode;
+}): ReactNode;

package/dist/auth-email-password/web/default-auth-pages-gate.js

@@ -0,0 +1,28 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.js";
+import { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.js";
+import { ForgotPasswordScreen } from "./forgot-password-screen.js";
+import { RequestAccountUnlockScreen } from "./request-account-unlock-screen.js";
+import { ResetPasswordScreen } from "./reset-password-screen.js";
+function hasToken(search) {
+    return (new URLSearchParams(search).get("token") ?? "") !== "";
+}
+function pickDefaultAuthPage(pathname, search) {
+    const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+    switch (path) {
+        case DEFAULT_FORGOT_PASSWORD_PATH:
+            return _jsx(ForgotPasswordScreen, {});
+        case DEFAULT_AUTH_PATHS.resetPassword:
+            return hasToken(search) ? _jsx(ResetPasswordScreen, {}) : null;
+        case DEFAULT_AUTH_PATHS.unlockAccount:
+            return hasToken(search) ? _jsx(ConfirmAccountUnlockScreen, {}) : _jsx(RequestAccountUnlockScreen, {});
+        default:
+            return null;
+    }
+}
+// Sits inside emailPasswordClient's gate list, so app gates registered earlier
+// (outer) still win on the same path. The pages are public: no session needed.
+export function DefaultAuthPagesGate({ children }) {
+    const { pathname, search } = window.location;
+    return pickDefaultAuthPage(pathname, search) ?? _jsx(_Fragment, { children: children });
+}

package/dist/auth-email-password/web/login-screen.d.ts

@@ -4,32 +4,27 @@ export type AuthLegalLink = {
     readonly href: string;
 };
 export type LoginScreenProps = {
-    /** Overridet den `auth.login.title`-i18n-Key. Nur setzen wenn der
-     *  Titel stark app-branded ist und keine Translation braucht. */
+    /** Overrides the `auth.login.title` key; only for a branded title that needs no translation. */
     readonly title?: string;
     readonly subtitle?: ReactNode;
     readonly submitLabel?: string;
-    /** Optional href zum ForgotPasswordScreen. Wenn gesetzt rendert die
-     *  LoginScreen unter dem Submit-Button einen "Passwort vergessen?"-
-     *  Link. Apps die den Reset-Flow NICHT anbieten (z.B. nur Magic-Link),
-     *  setzen das einfach nicht — Login bleibt minimalistisch. */
-    readonly forgotPasswordHref?: string;
+    /** Href of the "Forgot password?" link under the submit button. Unset: the
+     *  default path once the server offers the reset flow (login-options);
+     *  `null` hides the link deliberately. */
+    readonly forgotPasswordHref?: string | null;
     /** Optional href to RequestAccountUnlockScreen (#1266). When set, an
      *  account_locked login error renders an "Unlock account?" link inline —
      *  the account-lockout escape hatch, since forgotPasswordHref does NOT
      *  help here: the lockout gate blocks login before password verify even
      *  runs, so it also blocks the post-reset login. Apps without
-     *  accountUnlock configured just leave this unset. */
-    readonly unlockAccountHref?: string;
-    /** Optional href zum SignupScreen. Wenn gesetzt rendert die LoginScreen
-     *  einen "Account erstellen"-Link. Apps die kein Self-Signup wollen
-     *  (closed-invite-only) setzen das einfach nicht. */
+     *  accountUnlock configured just leave this unset. Unset: default path once
+     *  the server offers the flow (login-options); `null` = deliberately no link. */
+    readonly unlockAccountHref?: string | null;
+    /** Href of the "Create account" link; invite-only apps leave it unset. */
     readonly signupHref?: string;
-    /** Impressum/Datenschutz unterhalb der Card — der Login-Screen ist
-     *  oft die einzige öffentliche Seite einer Admin-Domain und braucht
-     *  dann selbst erreichbare Legal-Links (DE: Impressumspflicht).
-     *  Labels kommen vom Caller (typisch schon übersetzt bzw. Eigennamen
-     *  wie "Impressum"). */
+    /** Imprint/privacy links under the card: the login screen is often the only
+     *  public page of an admin domain, which then must reach its legal pages
+     *  itself (German imprint duty). Labels come translated from the caller. */
     readonly legalLinks?: readonly AuthLegalLink[];
     /** Called when the server responds with an MFA challenge instead of a
      *  session. Apps typically swap this screen out for auth-mfa's
@@ -46,4 +41,4 @@ export type LoginScreenProps = {
      *  error. */
     readonly onMfaSetupRequired?: (preauthSetupToken: string, accountLabel: string) => void;
 };
-export declare function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref, unlockAccountHref, signupHref, legalLinks, onMfaChallenge, onMfaSetupRequired, }: LoginScreenProps): ReactNode;
+export declare function LoginScreen(props: LoginScreenProps): ReactNode;

package/dist/auth-email-password/web/login-screen.js

@@ -1,18 +1,13 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// Default-LoginScreen. Reine E-Mail-+-Passwort-Form, zentriert, Card-
-// Layout. Texte kommen aus `useTranslation()` — die Default-Bundles
-// (de+en) liefert das Feature selber mit (translations.ts); Apps die
-// was anderes wollen, setzen entweder einen eigenen LocaleResolver auf
-// App-Level oder reichen Key-Overrides an `emailPasswordClient()`.
-//
-// Die Reason-Codes aus dem Login-Handler werden 1:1 auf i18n-Keys
-// gemappt (reasonToI18nKey) — neue Reason-Codes brauchen nur eine
-// neue Zeile im Bundle + hier im Mapping.
-import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+// Login handler reason codes map 1:1 to i18n keys (reasonToI18nKey): a new
+// reason code needs a bundle entry plus a line in that mapping.
+import { useOptionalDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestEmailVerification, } from "./auth-client.js";
 import { AuthCard } from "./auth-form-primitives.js";
+import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.js";
 import { followNextOrLandingAfterLogin } from "./auth-redirect.js";
+import { AuthQueries } from "./constants.js";
 import { useSession } from "./session.js";
 // Map vom Reason-Code des Login-Handlers auf einen i18n-Key plus
 // optional extrahierte Interpolations-Parameter. Ungekannte Codes
@@ -45,7 +40,7 @@ function reasonToKey(failure) {
             return { key: "auth.errors.loginFailed" };
     }
 }
-export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref, unlockAccountHref, signupHref, legalLinks, onMfaChallenge, onMfaSetupRequired, }) {
+function LoginScreenBody({ title, subtitle, submitLabel, forgotPasswordHref, unlockAccountHref, signupHref, legalLinks, onMfaChallenge, onMfaSetupRequired, loginOptions, }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
     const session = useSession();
@@ -54,10 +49,19 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
     const [submitting, setSubmitting] = useState(false);
     const [error, setError] = useState(null);
     const [resendStatus, setResendStatus] = useState({ kind: "idle" });
-    // Tracked, damit der Resend-Button verschwindet sobald der User die
-    // Email-Eingabe ändert — sonst würde Resend silent an die geänderte
-    // (potentiell typoed) Adresse gehen ohne User-Feedback.
+    // Hides the resend button once the email input changes; otherwise resend
+    // would silently go to the edited, possibly mistyped address.
     const [failedLoginEmail, setFailedLoginEmail] = useState(null);
+    const effectiveForgotHref = forgotPasswordHref === undefined
+        ? loginOptions?.passwordReset === true
+            ? DEFAULT_FORGOT_PASSWORD_PATH
+            : null
+        : forgotPasswordHref;
+    const effectiveUnlockHref = unlockAccountHref === undefined
+        ? loginOptions?.accountUnlock === true
+            ? DEFAULT_AUTH_PATHS.unlockAccount
+            : null
+        : unlockAccountHref;
     const doSubmit = async () => {
         setSubmitting(true);
         setError(null);
@@ -93,10 +97,8 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
         e?.preventDefault();
         void doSubmit();
     };
-    // Resend-Bestätigungsmail bei reason=email_not_verified. requestEmail-
-    // Verification ist silent-success (200 auch wenn kein User existiert),
-    // sodass kein anti-enumeration-Branching nötig ist; 429 → rate-limit-
-    // Hint inline, sonstige Fehler → generischer Inline-Hint.
+    // requestEmailVerification answers 200 even for unknown users, so no
+    // anti-enumeration branching is needed; only 429 gets its own hint.
     const onResend = async () => {
         setResendStatus({ kind: "sending" });
         try {
@@ -122,5 +124,15 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
                                     email.trim().length > 0 &&
                                     email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
                                             ? t("auth.login.submitting")
-                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && unlockAccountHref !== undefined && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: unlockAccountHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), forgotPasswordHref !== undefined && (_jsx(Link, { href: forgotPasswordHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
+                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && effectiveUnlockHref !== null && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: effectiveUnlockHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), effectiveForgotHref !== null && (_jsx(Link, { href: effectiveForgotHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
+}
+function LoginScreenWithQueriedOptions(props) {
+    const { data } = useQuery(AuthQueries.loginOptions, {}, { enabled: props.forgotPasswordHref === undefined || props.unlockAccountHref === undefined });
+    return _jsx(LoginScreenBody, { ...props, loginOptions: data });
+}
+// Without a mounted dispatcher (standalone mounts, tests) the query is skipped
+// and only explicit hrefs render.
+export function LoginScreen(props) {
+    const dispatcher = useOptionalDispatcher();
+    return dispatcher === undefined ? (_jsx(LoginScreenBody, { ...props, loginOptions: null })) : (_jsx(LoginScreenWithQueriedOptions, { ...props }));
 }