@cosmicdrift/kumiko-bundled-features 0.383.1 → 0.385.0

package/dist/auth-email-password/web/auth-form-primitives.js

@@ -1,18 +1,15 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// Shared Web-Primitives für die Auth-Screens. Nur noch Layout/Style-
-// Helpers — Form/Field/Input/Button/Banner kommen jetzt über
-// usePrimitives() aus dem Framework-Vertrag, damit Native dieselben
-// Auth-Screens rendern kann (renderer-native registriert eigene
-// Implementations).
+// Shared web primitives for the auth screens. Only layout/style helpers are
+// left here; Form/Field/Input/Button/Banner come through usePrimitives() from
+// the framework contract, so apps and tests can override the implementations
+// via PrimitivesProvider.
 //
-//   <AuthCard>          — Card-Wrapper für die Auth-Screen-Layouts
-//                         (full-screen, zentriert, max-w-sm). Web-only;
-//                         eine Native-Variante landet bei Bedarf
-//                         daneben (z.B. SafeArea + ScrollView).
-//   parseUrlToken       — URL-Param-Helper (window.location.search).
+//   <AuthCard>          — card wrapper for the auth screen layouts
+//                         (full-screen, centered, max-w-sm). Web-only.
+//   parseUrlToken       — URL param helper (window.location.search).
 //
-// Link-Styles laufen über das Link-Primitive (variant="button"/"muted") —
-// die früheren authButtonClass/authMutedLinkClass sind dorthin gewandert.
+// Link styles go through the Link primitive (variant="button"/"muted"); the
+// former authButtonClass/authMutedLinkClass moved there.
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
 import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer/web";
 import { createContext, useContext, useEffect, useState } from "react";

package/dist/auth-email-password/{auth-paths.d.ts → web/auth-paths.d.ts}

@@ -1,19 +1,21 @@
 /** A plain path, or a function picking the path per resolved mail locale
  *  (e.g. `/en/reset-password`, `/de/reset-password`). */
 export type AuthPath = string | ((locale: string) => string);
-/** Pfad-Konstanten der 4 Auth-Seiten (relativ zur App-baseUrl). */
 export type AuthPaths = {
     readonly resetPassword: AuthPath;
     readonly verifyEmail: AuthPath;
     readonly signupComplete: AuthPath;
     readonly inviteAccept: AuthPath;
+    readonly unlockAccount: AuthPath;
 };
-/** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
- *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
+/** Shared by every Kumiko app; apps override only the exceptions via `makeAuthPaths({ ... })`. */
 export declare const DEFAULT_AUTH_PATHS: {
     readonly resetPassword: "/reset-password";
     readonly verifyEmail: "/verify-email";
     readonly signupComplete: "/signup/complete";
     readonly inviteAccept: "/invite/accept";
+    readonly unlockAccount: "/unlock-account";
 };
+/** Client page that requests a reset mail; no mail links to it, so it is not part of AuthPaths. */
+export declare const DEFAULT_FORGOT_PASSWORD_PATH = "/forgot-password";
 export declare function makeAuthPaths(overrides?: Partial<AuthPaths>): AuthPaths;

package/dist/auth-email-password/{auth-paths.js → web/auth-paths.js}

@@ -1,14 +1,16 @@
-// Convention paths for the four auth pages (relative to the app base URL).
+// Convention paths for the five auth pages (relative to the app base URL).
 // resolveAuthMail builds each flow's magic-link appUrl from baseUrl + these;
 // the handlers append `?token=…` and mail via delivery (ctx.notify).
-/** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
- *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
+/** Shared by every Kumiko app; apps override only the exceptions via `makeAuthPaths({ ... })`. */
 export const DEFAULT_AUTH_PATHS = {
     resetPassword: "/reset-password",
     verifyEmail: "/verify-email",
     signupComplete: "/signup/complete",
     inviteAccept: "/invite/accept",
+    unlockAccount: "/unlock-account",
 };
+/** Client page that requests a reset mail; no mail links to it, so it is not part of AuthPaths. */
+export const DEFAULT_FORGOT_PASSWORD_PATH = "/forgot-password";
 export function makeAuthPaths(overrides = {}) {
     return { ...DEFAULT_AUTH_PATHS, ...overrides };
 }

package/dist/auth-email-password/web/client-plugin.d.ts

@@ -31,6 +31,11 @@ export type EmailPasswordClientOptions = {
      *  Für Branding ("Sign in" → "Login to Acme") oder weitere Sprachen
      *  (`fr`, `es`, …) zusätzlich. */
     readonly translations?: TranslationsByLocale;
+    /** Serve the forgot-password, reset-password and unlock-account pages at
+     *  their convention paths for signed-out visitors. Apps with their own
+     *  screens at those paths either register an earlier gate (it wins) or
+     *  set this to false. Default: true. */
+    readonly defaultAuthPages?: boolean;
 };
 export type EmailPasswordClientFeature = {
     readonly name: "auth-email-password";

package/dist/auth-email-password/web/client-plugin.js

@@ -5,6 +5,7 @@
 // Strings pro Locale, pro Key.
 import { makeSessionAuthGate, } from "./auth-gate.js";
 import { emailPasswordClientActions } from "./client-actions.js";
+import { DefaultAuthPagesGate } from "./default-auth-pages-gate.js";
 import { defaultTranslations, mergeTranslations } from "./i18n.js";
 export function emailPasswordClient(options = {}) {
     const translations = mergeTranslations(defaultTranslations, options.translations ?? {});
@@ -12,6 +13,7 @@ export function emailPasswordClient(options = {}) {
         name: "auth-email-password",
         providers: [],
         gates: [
+            ...(options.defaultAuthPages === false ? [] : [DefaultAuthPagesGate]),
             makeSessionAuthGate({
                 loginScreen: options.loginScreen,
                 loginScreenProps: options.loginScreenProps,

package/dist/auth-email-password/web/constants.d.ts

@@ -20,6 +20,7 @@ export declare const AuthHandlers: {
     readonly switchTenantMfaGate: "auth-email-password:write:switch-tenant-mfa-gate";
 };
 export declare const AuthQueries: {
+    readonly loginOptions: "auth-email-password:query:login-options";
     readonly signupRegistrationStatus: "auth-email-password:query:signup-registration-status";
     readonly inviteInfo: "auth-email-password:query:invite-info";
 };

package/dist/auth-email-password/web/constants.js

@@ -45,6 +45,7 @@ export const AuthHandlers = {
 // Qualified query names. Anonymous-readable status so the (unauthenticated)
 // signup page can decide whether to show its own link/form.
 export const AuthQueries = {
+    loginOptions: "auth-email-password:query:login-options",
     signupRegistrationStatus: "auth-email-password:query:signup-registration-status",
     // Anonymous, read-only invite lookup for the invite-acceptance page —
     // see invite-info.query.ts. Does not consume the token.

package/dist/auth-email-password/web/default-auth-pages-gate.d.ts

@@ -0,0 +1,4 @@
+import type { ReactNode } from "react";
+export declare function DefaultAuthPagesGate({ children }: {
+    readonly children: ReactNode;
+}): ReactNode;

package/dist/auth-email-password/web/default-auth-pages-gate.js

@@ -0,0 +1,28 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.js";
+import { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.js";
+import { ForgotPasswordScreen } from "./forgot-password-screen.js";
+import { RequestAccountUnlockScreen } from "./request-account-unlock-screen.js";
+import { ResetPasswordScreen } from "./reset-password-screen.js";
+function hasToken(search) {
+    return (new URLSearchParams(search).get("token") ?? "") !== "";
+}
+function pickDefaultAuthPage(pathname, search) {
+    const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+    switch (path) {
+        case DEFAULT_FORGOT_PASSWORD_PATH:
+            return _jsx(ForgotPasswordScreen, {});
+        case DEFAULT_AUTH_PATHS.resetPassword:
+            return hasToken(search) ? _jsx(ResetPasswordScreen, {}) : null;
+        case DEFAULT_AUTH_PATHS.unlockAccount:
+            return hasToken(search) ? _jsx(ConfirmAccountUnlockScreen, {}) : _jsx(RequestAccountUnlockScreen, {});
+        default:
+            return null;
+    }
+}
+// Sits inside emailPasswordClient's gate list, so app gates registered earlier
+// (outer) still win on the same path. The pages are public: no session needed.
+export function DefaultAuthPagesGate({ children }) {
+    const { pathname, search } = window.location;
+    return pickDefaultAuthPage(pathname, search) ?? _jsx(_Fragment, { children: children });
+}

package/dist/auth-email-password/web/login-screen.d.ts

@@ -4,32 +4,27 @@ export type AuthLegalLink = {
     readonly href: string;
 };
 export type LoginScreenProps = {
-    /** Overridet den `auth.login.title`-i18n-Key. Nur setzen wenn der
-     *  Titel stark app-branded ist und keine Translation braucht. */
+    /** Overrides the `auth.login.title` key; only for a branded title that needs no translation. */
     readonly title?: string;
     readonly subtitle?: ReactNode;
     readonly submitLabel?: string;
-    /** Optional href zum ForgotPasswordScreen. Wenn gesetzt rendert die
-     *  LoginScreen unter dem Submit-Button einen "Passwort vergessen?"-
-     *  Link. Apps die den Reset-Flow NICHT anbieten (z.B. nur Magic-Link),
-     *  setzen das einfach nicht — Login bleibt minimalistisch. */
-    readonly forgotPasswordHref?: string;
+    /** Href of the "Forgot password?" link under the submit button. Unset: the
+     *  default path once the server offers the reset flow (login-options);
+     *  `null` hides the link deliberately. */
+    readonly forgotPasswordHref?: string | null;
     /** Optional href to RequestAccountUnlockScreen (#1266). When set, an
      *  account_locked login error renders an "Unlock account?" link inline —
      *  the account-lockout escape hatch, since forgotPasswordHref does NOT
      *  help here: the lockout gate blocks login before password verify even
      *  runs, so it also blocks the post-reset login. Apps without
-     *  accountUnlock configured just leave this unset. */
-    readonly unlockAccountHref?: string;
-    /** Optional href zum SignupScreen. Wenn gesetzt rendert die LoginScreen
-     *  einen "Account erstellen"-Link. Apps die kein Self-Signup wollen
-     *  (closed-invite-only) setzen das einfach nicht. */
+     *  accountUnlock configured just leave this unset. Unset: default path once
+     *  the server offers the flow (login-options); `null` = deliberately no link. */
+    readonly unlockAccountHref?: string | null;
+    /** Href of the "Create account" link; invite-only apps leave it unset. */
     readonly signupHref?: string;
-    /** Impressum/Datenschutz unterhalb der Card — der Login-Screen ist
-     *  oft die einzige öffentliche Seite einer Admin-Domain und braucht
-     *  dann selbst erreichbare Legal-Links (DE: Impressumspflicht).
-     *  Labels kommen vom Caller (typisch schon übersetzt bzw. Eigennamen
-     *  wie "Impressum"). */
+    /** Imprint/privacy links under the card: the login screen is often the only
+     *  public page of an admin domain, which then must reach its legal pages
+     *  itself (German imprint duty). Labels come translated from the caller. */
     readonly legalLinks?: readonly AuthLegalLink[];
     /** Called when the server responds with an MFA challenge instead of a
      *  session. Apps typically swap this screen out for auth-mfa's
@@ -46,4 +41,4 @@ export type LoginScreenProps = {
      *  error. */
     readonly onMfaSetupRequired?: (preauthSetupToken: string, accountLabel: string) => void;
 };
-export declare function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref, unlockAccountHref, signupHref, legalLinks, onMfaChallenge, onMfaSetupRequired, }: LoginScreenProps): ReactNode;
+export declare function LoginScreen(props: LoginScreenProps): ReactNode;

package/dist/auth-email-password/web/login-screen.js

@@ -1,18 +1,13 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// Default-LoginScreen. Reine E-Mail-+-Passwort-Form, zentriert, Card-
-// Layout. Texte kommen aus `useTranslation()` — die Default-Bundles
-// (de+en) liefert das Feature selber mit (translations.ts); Apps die
-// was anderes wollen, setzen entweder einen eigenen LocaleResolver auf
-// App-Level oder reichen Key-Overrides an `emailPasswordClient()`.
-//
-// Die Reason-Codes aus dem Login-Handler werden 1:1 auf i18n-Keys
-// gemappt (reasonToI18nKey) — neue Reason-Codes brauchen nur eine
-// neue Zeile im Bundle + hier im Mapping.
-import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+// Login handler reason codes map 1:1 to i18n keys (reasonToI18nKey): a new
+// reason code needs a bundle entry plus a line in that mapping.
+import { useOptionalDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestEmailVerification, } from "./auth-client.js";
 import { AuthCard } from "./auth-form-primitives.js";
+import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.js";
 import { followNextOrLandingAfterLogin } from "./auth-redirect.js";
+import { AuthQueries } from "./constants.js";
 import { useSession } from "./session.js";
 // Map vom Reason-Code des Login-Handlers auf einen i18n-Key plus
 // optional extrahierte Interpolations-Parameter. Ungekannte Codes
@@ -45,7 +40,7 @@ function reasonToKey(failure) {
             return { key: "auth.errors.loginFailed" };
     }
 }
-export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref, unlockAccountHref, signupHref, legalLinks, onMfaChallenge, onMfaSetupRequired, }) {
+function LoginScreenBody({ title, subtitle, submitLabel, forgotPasswordHref, unlockAccountHref, signupHref, legalLinks, onMfaChallenge, onMfaSetupRequired, loginOptions, }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
     const session = useSession();
@@ -54,10 +49,19 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
     const [submitting, setSubmitting] = useState(false);
     const [error, setError] = useState(null);
     const [resendStatus, setResendStatus] = useState({ kind: "idle" });
-    // Tracked, damit der Resend-Button verschwindet sobald der User die
-    // Email-Eingabe ändert — sonst würde Resend silent an die geänderte
-    // (potentiell typoed) Adresse gehen ohne User-Feedback.
+    // Hides the resend button once the email input changes; otherwise resend
+    // would silently go to the edited, possibly mistyped address.
     const [failedLoginEmail, setFailedLoginEmail] = useState(null);
+    const effectiveForgotHref = forgotPasswordHref === undefined
+        ? loginOptions?.passwordReset === true
+            ? DEFAULT_FORGOT_PASSWORD_PATH
+            : null
+        : forgotPasswordHref;
+    const effectiveUnlockHref = unlockAccountHref === undefined
+        ? loginOptions?.accountUnlock === true
+            ? DEFAULT_AUTH_PATHS.unlockAccount
+            : null
+        : unlockAccountHref;
     const doSubmit = async () => {
         setSubmitting(true);
         setError(null);
@@ -93,10 +97,8 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
         e?.preventDefault();
         void doSubmit();
     };
-    // Resend-Bestätigungsmail bei reason=email_not_verified. requestEmail-
-    // Verification ist silent-success (200 auch wenn kein User existiert),
-    // sodass kein anti-enumeration-Branching nötig ist; 429 → rate-limit-
-    // Hint inline, sonstige Fehler → generischer Inline-Hint.
+    // requestEmailVerification answers 200 even for unknown users, so no
+    // anti-enumeration branching is needed; only 429 gets its own hint.
     const onResend = async () => {
         setResendStatus({ kind: "sending" });
         try {
@@ -122,5 +124,15 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
                                     email.trim().length > 0 &&
                                     email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
                                             ? t("auth.login.submitting")
-                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && unlockAccountHref !== undefined && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: unlockAccountHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), forgotPasswordHref !== undefined && (_jsx(Link, { href: forgotPasswordHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
+                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && effectiveUnlockHref !== null && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: effectiveUnlockHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), effectiveForgotHref !== null && (_jsx(Link, { href: effectiveForgotHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
+}
+function LoginScreenWithQueriedOptions(props) {
+    const { data } = useQuery(AuthQueries.loginOptions, {}, { enabled: props.forgotPasswordHref === undefined || props.unlockAccountHref === undefined });
+    return _jsx(LoginScreenBody, { ...props, loginOptions: data });
+}
+// Without a mounted dispatcher (standalone mounts, tests) the query is skipped
+// and only explicit hrefs render.
+export function LoginScreen(props) {
+    const dispatcher = useOptionalDispatcher();
+    return dispatcher === undefined ? (_jsx(LoginScreenBody, { ...props, loginOptions: null })) : (_jsx(LoginScreenWithQueriedOptions, { ...props }));
 }

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -1,71 +1,11 @@
 export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    readonly userId: {
-        readonly type: "text";
-        readonly description?: string;
-        readonly maxLength?: number;
-        readonly minLength?: number;
-        readonly autoComplete?: string;
-        readonly required?: boolean;
-        readonly searchable?: boolean;
-        readonly sortable?: boolean;
-        readonly filterable?: boolean;
-        readonly encrypted?: boolean;
-        readonly sensitive?: boolean;
-        readonly writeOnly?: boolean;
-        readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
-        readonly default?: string;
-        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
-        readonly multiline?: boolean | {
-            readonly rows?: number;
-        };
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    readonly userId: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: true;
     };
-    readonly totpSecret: {
-        readonly type: "text";
-        readonly description?: string;
-        readonly maxLength?: number;
-        readonly minLength?: number;
-        readonly autoComplete?: string;
-        readonly required?: boolean;
-        readonly searchable?: boolean;
-        readonly sortable?: boolean;
-        readonly filterable?: boolean;
-        readonly encrypted?: boolean;
-        readonly sensitive?: boolean;
-        readonly writeOnly?: boolean;
-        readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
-        readonly default?: string;
-        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
-        readonly multiline?: boolean | {
-            readonly rows?: number;
-        };
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    readonly totpSecret: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: true;
     };
-    readonly recoveryCodes: {
-        readonly type: "text";
-        readonly description?: string;
-        readonly maxLength?: number;
-        readonly minLength?: number;
-        readonly autoComplete?: string;
-        readonly required?: boolean;
-        readonly searchable?: boolean;
-        readonly sortable?: boolean;
-        readonly filterable?: boolean;
-        readonly encrypted?: boolean;
-        readonly sensitive?: boolean;
-        readonly writeOnly?: boolean;
-        readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
-        readonly default?: string;
-        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
-        readonly multiline?: boolean | {
-            readonly rows?: number;
-        };
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    readonly recoveryCodes: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: true;
     };
     readonly enabledAt: {
@@ -100,73 +40,13 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
     };
 }, "tenant">;
 export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    readonly userId: {
-        readonly type: "text";
-        readonly description?: string;
-        readonly maxLength?: number;
-        readonly minLength?: number;
-        readonly autoComplete?: string;
-        readonly required?: boolean;
-        readonly searchable?: boolean;
-        readonly sortable?: boolean;
-        readonly filterable?: boolean;
-        readonly encrypted?: boolean;
-        readonly sensitive?: boolean;
-        readonly writeOnly?: boolean;
-        readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
-        readonly default?: string;
-        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
-        readonly multiline?: boolean | {
-            readonly rows?: number;
-        };
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    readonly userId: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: true;
     };
-    readonly totpSecret: {
-        readonly type: "text";
-        readonly description?: string;
-        readonly maxLength?: number;
-        readonly minLength?: number;
-        readonly autoComplete?: string;
-        readonly required?: boolean;
-        readonly searchable?: boolean;
-        readonly sortable?: boolean;
-        readonly filterable?: boolean;
-        readonly encrypted?: boolean;
-        readonly sensitive?: boolean;
-        readonly writeOnly?: boolean;
-        readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
-        readonly default?: string;
-        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
-        readonly multiline?: boolean | {
-            readonly rows?: number;
-        };
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    readonly totpSecret: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: true;
     };
-    readonly recoveryCodes: {
-        readonly type: "text";
-        readonly description?: string;
-        readonly maxLength?: number;
-        readonly minLength?: number;
-        readonly autoComplete?: string;
-        readonly required?: boolean;
-        readonly searchable?: boolean;
-        readonly sortable?: boolean;
-        readonly filterable?: boolean;
-        readonly encrypted?: boolean;
-        readonly sensitive?: boolean;
-        readonly writeOnly?: boolean;
-        readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
-        readonly default?: string;
-        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
-        readonly multiline?: boolean | {
-            readonly rows?: number;
-        };
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    readonly recoveryCodes: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: true;
     };
     readonly enabledAt: {