@cosmicdrift/kumiko-bundled-features 0.385.0 → 0.387.0

package/dist/auth-email-password/web/auth-form-primitives.js

@@ -25,21 +25,21 @@ export function useAuthShell() {
 export function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }) {
     const { Card } = usePrimitives();
     const shell = useAuthShell() ?? defaultAuthShell;
-    // h1 (Seiten-Hauptüberschrift) via Header-Slot erhalten — die Card-Default-
-    // Header wäre h3. padded:false = Form sitzt randlos wie bisher (bare form).
+    // Keep an h1 (page heading) through the header slot; the Card's default
+    // header would be h3. padded:false keeps the form edge-to-edge as before
+    // (bare form).
     const card = (_jsx(Card, { className: cn("w-full max-w-sm", className), options: { padded: false }, slots: {
             header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: cn("flex flex-col space-y-1.5 p-6 pb-4", headerClassName), children: [title !== undefined && (_jsx("h1", { className: cn("text-xl font-semibold tracking-tight", titleClassName), children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
         }, children: _jsx(BareFormProvider, { children: _jsx("div", { className: cn("p-6 pt-0 flex flex-col gap-4", bodyClassName), children: children }) }) }));
     return shell(card);
 }
-// Liest `?<paramName>=<value>` aus der aktuellen URL — typisches
-// Pattern für Token-bearing Pages (reset, verify). Returnt "" wenn der
-// Browser nicht da ist (SSR-safety) oder der Parameter fehlt.
+// Reads `?<paramName>=<value>` from the current URL, as used by token-bearing
+// pages (reset, verify). Returns "" during SSR or when the parameter is absent.
 //
-// Nicht über useState/useEffect - das wäre ein read-once-on-mount
-// pattern aber URL-changes sind hier irrelevant (Token-Pages re-loaden
-// für neue Tokens). Caller setzt useState(() => parseUrlToken(...)) wenn
-// gewünscht.
+// This is intentionally not read through useState/useEffect: that would be a
+// read-once-on-mount pattern, while URL changes are irrelevant here because
+// token pages reload for new tokens. Callers can use
+// useState(() => parseUrlToken(...)) when needed.
 export function parseUrlToken(paramName = "token") {
     if (typeof window === "undefined")
         return "";
@@ -47,7 +47,7 @@ export function parseUrlToken(paramName = "token") {
 }
 // Reads the magic-link token from `?<paramName>=` once on mount, then strips
 // that param from the URL via history.replaceState so the single-use token
-// doesn't linger in browser history / Referer (#774). An explicit `override`
+// doesn't linger in browser history / Referer. An explicit `override`
 // (server-injected token) short-circuits both the URL read and the scrub.
 export function useUrlToken(override, paramName = "token") {
     const [token] = useState(() => override ?? parseUrlToken(paramName));

package/dist/auth-email-password/web/auth-gate.js

@@ -1,13 +1,13 @@
 import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
-// Auth-Gate: rendert den LoginScreen solange der Session-Status
-// "unauthenticated" ist, sonst die Kinder. "loading" zeigt einen
-// minimalen Placeholder — die initiale Refresh-Runde liefert in der
-// Regel in <100ms, also kein Spinner-Overkill.
+// Auth gate: renders the LoginScreen while the session status is
+// "unauthenticated" and the children otherwise. "loading" shows a
+// minimal placeholder—the initial refresh usually completes in <100ms,
+// so a spinner would be excessive.
 //
-// Die Factory makeAuthGate schließt die LoginScreen-Komponente in,
-// damit das Gate der ClientFeatureDefinition-Signatur entspricht
-// (nur `{ children }`-Prop). Der Sample kann so einen eigenen Login-
-// Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
+// The makeAuthGate factory closes over the LoginScreen component so the
+// gate matches the ClientFeatureDefinition signature (only a `{ children }`
+// prop). This lets the sample configure a custom login screen without
+// replacing the gate.
 import { useLocale } from "@cosmicdrift/kumiko-renderer";
 import { useEffect, useMemo, useState } from "react";
 import { assertNavigableUrl, buildLoginRedirectUrl, followNextOrLandingAfterLogin, } from "./auth-redirect.js";
@@ -20,12 +20,11 @@ import { SessionBootstrapErrorScreen } from "./session-bootstrap-error.js";
 // their own standalone login route outside any gate (createPublicSurface
 // apex pages stack providers, not gates — see auth-mount.tsx recipes).
 // Handing an app raw LoginScreen + telling it to hand-roll the challenge-
-// token swap itself is exactly how kumiko-framework#266's login-time MFA
-// step went missing in a real apex surface; this prevents the *most common*
-// version of that mistake. MFA still only actually works once a consumer
-// wires `mfaVerifyScreen` — omitting it is a silent no-MFA fallback, not
-// something this route can catch on its own (auth-mfa is a separate,
-// optional package).
+// token swap itself is exactly how the login-time MFA step went missing in a
+// real apex surface; this prevents the *most common* version of that mistake.
+// MFA still only actually works once a consumer wires `mfaVerifyScreen` —
+// omitting it is a silent no-MFA fallback, not something this route can catch
+// on its own (auth-mfa is a separate, optional package).
 export function createLoginRoute(opts = {}) {
     const LoginComponent = opts.loginScreen ?? LoginScreen;
     const MfaVerifyComponent = opts.mfaVerifyScreen;
@@ -38,7 +37,7 @@ export function createLoginRoute(opts = {}) {
         // never considers this session authenticated until verify succeeds.
         const [challengeToken, setChallengeToken] = useState(null);
         const [setupRequest, setSetupRequest] = useState(null);
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         useEffect(() => {
             if (status === "authenticated")
                 onAuthenticated?.();
@@ -125,7 +124,7 @@ export function makeAuthGate(opts = {}) {
             ? resolveLoginRedirectOrNull(loginUrl, locale, { origin, pathname, search, hash })
             : null, [status, locale, origin, pathname, search, hash]);
         const redirectUrl = loginRedirect?.kind === "redirect" ? loginRedirect.url : null;
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         useEffect(() => {
             if (redirectUrl !== null)
                 window.location.replace(redirectUrl);

package/dist/auth-email-password/web/client-plugin.d.ts

@@ -3,9 +3,9 @@ import type { ComponentType, ReactNode } from "react";
 import { type AuthGateOptions, type MfaSetupComponentProps, type MfaVerifyComponentProps } from "./auth-gate.tsx";
 import type { LoginScreenProps } from "./login-screen.tsx";
 export type EmailPasswordClientOptions = {
-    /** Eigener Login-Screen. Default: der shadcn-stylte LoginScreen
-     *  aus diesem Modul. Für Branding- oder Layout-Overrides einfach
-     *  eine eigene Komponente mit derselben Signatur reichen. */
+    /** Custom login screen. Default: the shadcn-styled LoginScreen
+     *  from this module. Provide a component with the same signature for
+     *  branding or layout overrides. */
     readonly loginScreen?: ComponentType<LoginScreenProps>;
     readonly loginScreenProps?: LoginScreenProps;
     /** auth-mfa's MfaVerifyScreen, wired in from the app so this feature
@@ -26,10 +26,10 @@ export type EmailPasswordClientOptions = {
     readonly loginUrl?: AuthGateOptions["loginUrl"];
     /** Where logout navigates to (root-relative path or http(s) URL). Default: reload. */
     readonly postLogoutUrl?: string;
-    /** Key-Overrides pro Locale. Wird mit den Default-Bundles (de/en)
-     *  aus `translations.ts` gemerged — jeder hier gesetzte Key gewinnt.
-     *  Für Branding ("Sign in" → "Login to Acme") oder weitere Sprachen
-     *  (`fr`, `es`, …) zusätzlich. */
+    /** Per-locale key overrides. Merged with the default bundles (de/en)
+     *  from `translations.ts`; each key supplied here takes precedence.
+     *  Use this for branding ("Sign in" → "Login to Acme") or to add
+     *  further languages (`fr`, `es`, …). */
     readonly translations?: TranslationsByLocale;
     /** Serve the forgot-password, reset-password and unlock-account pages at
      *  their convention paths for signed-out visitors. Apps with their own

package/dist/auth-email-password/web/client-plugin.js

@@ -1,8 +1,7 @@
-// Client-Feature-Factory für auth-email-password. Wird vom App-Code
-// in createKumikoApp({ clientFeatures: [emailPasswordClient()] })
-// eingehängt und bringt Session-Context + AuthGate + Default-UI-
-// Translations (de/en) mit. Alles ist overridbar — Login-Screen,
-// Strings pro Locale, pro Key.
+// Client feature factory for auth-email-password. App code mounts it in
+// createKumikoApp({ clientFeatures: [emailPasswordClient()] }) to provide
+// session context, AuthGate, and default UI translations (de/en). All of
+// these can be overridden: the login screen and strings per locale and key.
 import { makeSessionAuthGate, } from "./auth-gate.js";
 import { emailPasswordClientActions } from "./client-actions.js";
 import { DefaultAuthPagesGate } from "./default-auth-pages-gate.js";

package/dist/auth-email-password/web/confirm-account-unlock-screen.js

@@ -16,7 +16,7 @@ export function ConfirmAccountUnlockScreen({ title, token: tokenProp, loginHref
     const token = useUrlToken(tokenProp);
     const [status, setStatus] = useState(token === "" ? "missing-token" : "verifying");
     const startedRef = useRef(false);
-    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
     useEffect(() => {
         if (status !== "verifying")
             return;

package/dist/auth-email-password/web/constants.js

@@ -15,7 +15,7 @@ export const AuthHandlers = {
     requestEmailVerification: "auth-email-password:write:request-email-verification",
     verifyEmail: "auth-email-password:write:verify-email",
     // Account-Unlock Magic-Link (fixes the lockout-DoS where the monotonic
-    // failure-counter re-locks immediately after expiry, #1266). Mirrors
+    // failure-counter re-locks immediately after expiry). Mirrors
     // reset: request mints an HMAC token + mails it, confirm clears the
     // Redis lockout state.
     requestAccountUnlock: "auth-email-password:write:request-account-unlock",
@@ -81,7 +81,7 @@ export const AuthErrors = {
     invalidSignupToken: "invalid_signup_token",
     signupNotConfigured: "signup_not_configured",
     // Self-signup: confirm rejects an already-registered email instead of
-    // reusing the existing user (account takeover, #365). NO
+    // reusing the existing user (account takeover). NO
     // anti-enumeration collapse like invalidSignupToken: whoever gets here
     // controls the inbox (has the magic link), so revealing "email exists"
     // is not new information.
@@ -101,7 +101,7 @@ export const AuthErrors = {
     // deliberate enumeration trade-off: the lockout event itself is already
     // observable to the attacker, and legit users benefit from a clear signal.
     accountLocked: "account_locked",
-    // S2.U6 (GDPR Art. 18) — account is in Restricted status. Login is
+    // (GDPR Art. 18) — account is in Restricted status. Login is
     // explicitly refused with its own code (not collapsed into
     // invalid_credentials) so the UI can say "account is currently paused,
     // click here to lift it". Enumeration leak accepted: restriction is

package/dist/auth-email-password/web/default-topbar-actions.d.ts

@@ -1,15 +1,15 @@
 import type { ReactNode } from "react";
 export type DefaultTopbarActionsProps = {
-    /** Mapped Tenant-ID auf einen sprechenden Namen (z.B. branded label
-     *  pro Tenant). TenantSwitcher's Default zeigt sonst die ersten 8
-     *  Zeichen der UUID. */
+    /** Maps a tenant ID to a human-readable name (for example, a branded label
+     *  per tenant). TenantSwitcher's default otherwise displays the first 8
+     *  characters of the UUID. */
     readonly tenantName?: (tenantId: string) => string;
-    /** Slot zwischen TenantSwitcher und ThemeToggle. Typischer Use-Case:
-     *  LanguageSwitcher pro App. ReactNode (nicht Array) damit die App
-     *  selbst Reihenfolge + Spacing bestimmt. */
+    /** Slot between TenantSwitcher and ThemeToggle. Typical use case:
+     *  an app-specific LanguageSwitcher. ReactNode, rather than an array, so the
+     *  app controls the ordering and spacing. */
     readonly extras?: ReactNode;
-    /** Light-Mode-Icon im ThemeToggle. Default: Unicode ☀. Apps die
-     *  Lucide-Icons o.ä. wollen, übergeben ein eigenes Icon-Element. */
+    /** Light-mode icon for ThemeToggle. Default: Unicode ☀. Apps that want
+     *  Lucide icons or similar can provide a custom icon element. */
     readonly lightIcon?: ReactNode;
     /** Dark-Mode-Icon. Default: Unicode ☾. */
     readonly darkIcon?: ReactNode;

package/dist/auth-email-password/web/default-topbar-actions.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// Standard-Topbar-Actions Komposition für Apps mit Auth + Workspaces.
-// Bündelt das Pattern das jeder App-Sample sonst hand-ausschreibt:
-// TenantSwitcher (links) → optional Extras (z.B. LanguageSwitcher) →
-// ThemeToggle → UserMenu (rechts). Apps mit eigener Anordnung
-// importieren weiter die Einzelkomponenten direkt — DefaultTopbarActions
-// ist Convenience, kein Muss.
+// Composes the standard top-bar actions for apps with auth and workspaces.
+// This bundles the pattern that each app sample would otherwise write by hand:
+// TenantSwitcher (left) → optional extras (for example, LanguageSwitcher) →
+// ThemeToggle → UserMenu (right). Apps with a custom arrangement can still
+// import the individual components directly; DefaultTopbarActions is
+// convenience, not a requirement.
 import { ThemeToggle } from "@cosmicdrift/kumiko-renderer/web";
 import { TenantSwitcher } from "./tenant-switcher.js";
 import { UserMenu } from "./user-menu.js";

package/dist/auth-email-password/web/forgot-password-screen.d.ts

@@ -2,8 +2,8 @@ import { type ReactNode } from "react";
 export type ForgotPasswordScreenProps = {
     readonly title?: string;
     readonly subtitle?: ReactNode;
-    /** href für den "Zurück zum Login"-Link in success + form. App-
-     *  spezifisch — Default "/login". */
+    /** href for the "Back to login" link in the success and form states. App-
+     * specific — defaults to "/login". */
     readonly loginHref?: string;
 };
 export declare function ForgotPasswordScreen({ title, subtitle, loginHref, }: ForgotPasswordScreenProps): ReactNode;

package/dist/auth-email-password/web/forgot-password-screen.js

@@ -1,13 +1,13 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// ForgotPasswordScreen — Form mit email-input. Submit triggert
-// /api/auth/request-password-reset (silent-success, kein account-
-// enumeration). UI zeigt unconditional ein "Wenn Account existiert,
-// Mail unterwegs"-Confirm — auch wenn der Server intern erkannt hat
-// dass die Email nicht existiert.
+// ForgotPasswordScreen — form with an email input. Submission triggers
+// /api/auth/request-password-reset (silent success, no account enumeration).
+// The UI always shows a "If an account exists, the email is on its way"
+// confirmation, even when the server determines internally that the email
+// does not exist.
 //
-// App ist verantwortlich, den Screen unter einer URL zu mounten (z.B.
-// /forgot-password) und ihn zu erreichen — der LoginScreen kann einen
-// "Passwort vergessen?"-Link auf die App-Route setzen.
+// The app is responsible for mounting and exposing the screen at a URL
+// (for example, /forgot-password); the LoginScreen can link to that app
+// route with a "Forgot password?" link.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestPasswordReset } from "./auth-client.js";
@@ -19,7 +19,7 @@ export function ForgotPasswordScreen({ title, subtitle, loginHref = "/login", })
     const [submitting, setSubmitting] = useState(false);
     const [done, setDone] = useState(false);
     const [error, setError] = useState(null);
-    // guard:dup-ok — gleiches Submit-Muster wie signup-screen, aber verschiedene API-Endpoints und State
+    // guard:dup-ok — same submission pattern as signup-screen, but with different API endpoints and state
     const doSubmit = async () => {
         setSubmitting(true);
         setError(null);

package/dist/auth-email-password/web/index.js

@@ -1,8 +1,8 @@
-// Public exports für die Browser-Seite des auth-email-password Features.
-// Wird über den Sub-Path-Export `@cosmicdrift/kumiko-bundled-features/auth-email-
-// password/web` konsumiert — die Server-Seite (defineFeature) lebt in
-// `@cosmicdrift/kumiko-bundled-features/auth-email-password` und hat keine
-// React-/DOM-Deps. Trennung bleibt sauber so wie renderer vs renderer/web.
+// Public exports for the browser side of the auth-email-password feature.
+// Consumed through the subpath export `@cosmicdrift/kumiko-bundled-features/auth-email-
+// password/web`; the server side (defineFeature) lives in
+// `@cosmicdrift/kumiko-bundled-features/auth-email-password` and has no
+// React-/DOM dependencies. This keeps the separation clean, like renderer vs renderer/web.
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";

package/dist/auth-email-password/web/invite-accept-screen.d.ts

@@ -12,7 +12,7 @@ export type InviteAcceptScreenProps = {
         tenantId: string;
         roles: readonly string[];
     }) => string);
-    /** Login-Href für "Mit anderem Account anmelden". Default "/login". */
+    /** Login href for "Mit anderem Account anmelden". Default "/login". */
     readonly loginHref?: string;
 };
 export declare function InviteAcceptScreen({ title, token: tokenProp, loggedInHref, loginHref, }: InviteAcceptScreenProps): ReactNode;

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -1,20 +1,20 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// InviteAcceptScreen — Magic-Link-Accept für Tenant-Invitations.
+// InviteAcceptScreen — accepts tenant invitations through a magic link.
 //
-// Liest `?token=...` aus der URL und branched intern je nach session-state:
-//   - Logged-in + Email-Match: 1-click accept (Branch 1, dispatcher
-//     invite-accept). Bei Email-Mismatch zeigen wir die fehlermeldung
-//     und einen "Mit anderem Account anmelden"-Link.
-//   - Anonymous: Email + Password-Form. Toggle "Schon einen Account?"
-//     entscheidet Branch 2 (existing user, login + accept) vs Branch 3
-//     (neuer user, signup + accept).
+// Reads `?token=...` from the URL and selects a flow based on session state:
+//   - Logged in with a matching email: one-click accept (Branch 1, via the
+//     invite-accept dispatcher). For an email mismatch, show an error and a
+//     "Sign in with a different account" link.
+//   - Anonymous: email and password form. The "Already have an account?" toggle
+//     selects Branch 2 (existing user, login + accept) or Branch 3 (new user,
+//     signup + accept).
 //
-// Anti-enumeration: invalidInviteToken collapsed alle Token/User/
-// Password-Failures auf einen Code (gleicher Trade-off wie reset).
+// Anti-enumeration: invalidInviteToken collapses token, user, and password
+// failures into one code, using the same trade-off as reset.
 //
-// Auto-Login: Branch 2+3 setzen Cookies via Server, Frontend redirected
-// zu loggedInHref. Branch 1 hat schon eine Session — Frontend redirected
-// auch zu loggedInHref damit der invitee in seinem neuen Tenant landet.
+// Auto-login: Branches 2 and 3 set cookies through the server, then the
+// frontend redirects to loggedInHref. Branch 1 already has a session, but the
+// frontend also redirects to loggedInHref so the invitee enters the new tenant.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useContext, useState } from "react";
 import { csrfHeader } from "./auth-client.js";
@@ -60,7 +60,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     const acceptLoggedIn = async () => {
         setSubmitting(true);
         setError(null);
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         const res = await fetch("/api/auth/invite-accept", {
             method: "POST",
             credentials: "same-origin",
@@ -79,7 +79,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     const acceptAnonExisting = async () => {
         setSubmitting(true);
         setError(null);
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         const res = await fetch("/api/auth/invite-accept-with-login", {
             method: "POST",
             credentials: "same-origin",
@@ -98,7 +98,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     const acceptAnonNew = async () => {
         setSubmitting(true);
         setError(null);
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         const res = await fetch("/api/auth/invite-signup-complete", {
             method: "POST",
             credentials: "same-origin",

package/dist/auth-email-password/web/login-screen.d.ts

@@ -12,7 +12,7 @@ export type LoginScreenProps = {
      *  default path once the server offers the reset flow (login-options);
      *  `null` hides the link deliberately. */
     readonly forgotPasswordHref?: string | null;
-    /** Optional href to RequestAccountUnlockScreen (#1266). When set, an
+    /** Optional href to RequestAccountUnlockScreen. When set, an
      *  account_locked login error renders an "Unlock account?" link inline —
      *  the account-lockout escape hatch, since forgotPasswordHref does NOT
      *  help here: the lockout gate blocks login before password verify even

package/dist/auth-email-password/web/login-screen.js

@@ -9,9 +9,8 @@ import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.j
 import { followNextOrLandingAfterLogin } from "./auth-redirect.js";
 import { AuthQueries } from "./constants.js";
 import { useSession } from "./session.js";
-// Map vom Reason-Code des Login-Handlers auf einen i18n-Key plus
-// optional extrahierte Interpolations-Parameter. Ungekannte Codes
-// fallen auf `auth.errors.loginFailed` zurück.
+// Maps login-handler reason codes to i18n keys and optional interpolation parameters.
+// Unknown codes fall back to `auth.errors.loginFailed`.
 function reasonToKey(failure) {
     switch (failure.reason) {
         case "invalid_credentials":

package/dist/auth-email-password/web/reset-password-screen.d.ts

@@ -1,11 +1,11 @@
 import { type ReactNode } from "react";
 export type ResetPasswordScreenProps = {
     readonly title?: string;
-    /** Override für den Token aus der URL — Apps die per server-side-
-     *  Render einen Token reinreichen, brauchen das. Default: parsed aus
-     *  `?token=...` in der URL. */
+    /** Override for the token from the URL. Apps that pass a token during
+     * server-side rendering need this. Default: parsed from `?token=...` in
+     * the URL. */
     readonly token?: string;
-    /** href für "Zum Login"-Link nach Success. Default "/login". */
+    /** href for the "Zum Login" link after success. Default "/login". */
     readonly loginHref?: string;
 };
 export declare function ResetPasswordScreen({ title, token: tokenProp, loginHref, }: ResetPasswordScreenProps): ReactNode;

package/dist/auth-email-password/web/reset-password-screen.js

@@ -1,14 +1,13 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// ResetPasswordScreen — liest `?token=...` aus der URL, zeigt Form mit
-// new + confirm-password. Submit triggert /api/auth/reset-password mit
-// dem Token. Server collapses alle Token-Verify-Failures auf einen
-// Code (anti-enumeration); UI zeigt unified "Link ungültig oder
-// abgelaufen"-message.
+// ResetPasswordScreen reads `?token=...` from the URL and shows fields for
+// a new and confirmed password. Submission calls /api/auth/reset-password
+// with the token. The server collapses all token-verification failures into
+// one code (anti-enumeration), so the UI shows the unified "link invalid or
+// expired" message.
 //
-// Token-Quelle ist read-once via useUrlToken(): liest `?token=...` beim
-// Mount und scrubbt den Param danach aus der URL (#774). Apps die das
-// anders brauchen (server-injected Token-Prop) reichen `token` als Prop
-// durch — dann bleibt die URL unangetastet.
+// The token is read once via useUrlToken(): `?token=...` is read on mount and
+// then scrubbed from the URL. Apps that need different behavior can pass a
+// server-injected token through the `token` prop; the URL is then left intact.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { resetPassword } from "./auth-client.js";
@@ -56,10 +55,10 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
         void doSubmit();
     };
     const effectiveTitle = title ?? t("auth.resetPassword.title");
-    // Kein Token in der URL → User soll den Link aus seiner Mail nochmal
-    // klicken oder einen neuen Reset anfordern. Form ohne Token zu
-    // submitten würde nur den invalidResetToken-Error zeigen — das ist
-    // verwirrend. Lieber upfront eine klare Message.
+    // No token in the URL: the user should click the link from their email again
+    // or request a new reset. Submitting without a token would only show the
+    // invalidResetToken error, which is confusing, so show a clear message
+    // immediately instead.
     if (token === "") {
         return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }));
     }

package/dist/auth-email-password/web/session.d.ts

@@ -11,11 +11,12 @@ export type SessionState = {
     readonly user: CurrentUserProfile | null;
     readonly activeTenantId: string | null;
     readonly tenants: readonly TenantSummary[];
-    /** Merged session-roles für den active tenant: globalRoles (z.B.
-     *  SystemAdmin) + membership-roles des activeTenant. Server hat sie
-     *  schon im JWT gemerged, aber das JWT ist HttpOnly + nicht JS-lesbar;
-     *  Client computed dieselbe merge-Logik aus user.globalRoles +
-     *  tenants[active].roles damit nav-filtering greift. Dedupliziert. */
+    /** Merged session roles for the active tenant: globalRoles (for example,
+     *  SystemAdmin) plus the active tenant's membership roles. The server has
+     *  already merged them into the JWT, but the JWT is HttpOnly and cannot be
+     *  read by JavaScript; the client computes the same merge from
+     *  user.globalRoles + tenants[active].roles so navigation filtering works.
+     *  The result is deduplicated. */
     readonly roles: readonly string[];
     readonly bootstrapFailure: SessionBootstrapFailure | null;
     /** Set when an authenticated session was ended server-side (revoked,
@@ -35,10 +36,10 @@ export type SessionApi = SessionState & {
 export declare const UNAUTHENTICATED: SessionState;
 export declare function hasLikelyAuthSession(cookieSource?: string): boolean;
 export declare function computeActiveRoles(user: CurrentUserProfile | null, activeTenantId: string | null, tenants: readonly TenantSummary[]): readonly string[];
-/** Internal — exposed for tests die einen Mock-SessionApi-Wert reinreichen
- *  wollen, ohne durch SessionProvider's refresh-Lifecycle zu müssen. App-
- *  Code nutzt SessionProvider + useSession; direkter Context-Zugriff ist
- *  für Tests/Stories. */
+/** Internal — exposed so tests can pass a mock SessionApi value
+ *  without going through SessionProvider's refresh lifecycle. Application
+ *  code uses SessionProvider + useSession; direct context access is
+ *  intended for tests/stories. */
 export declare const SessionContext: import("react").Context<SessionApi | undefined>;
 export declare function SessionProvider({ children, postLogoutUrl, }: {
     readonly children: ReactNode;

package/dist/auth-email-password/web/session.js

@@ -1,13 +1,13 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// Session-State für den Browser-Renderer. Hält den aktuell eingeloggten
-// User (Profile + aktive Tenant-Zuordnung + Memberships), reagiert auf
-// Login/Logout/Switch-Tenant und refresh't die Daten automatisch.
+// Session state for the browser renderer. Holds the currently signed-in
+// user (profile + active tenant assignment + memberships), responds to
+// login/logout/tenant switching, and refreshes the data automatically.
 //
-// Warum Context + useReducer statt z.B. Zustand? Weil die State-Menge
-// klein ist (ein Handful Felder, ein paar Transitionen) und wir damit
-// eine Dependency weniger im Browser-Bundle haben. Die Consumer leben
-// unter `<SessionProvider>`; der `useSession()`-Hook liefert den State
-// und die Transitions.
+// Context + useReducer is used instead of, for example, Zustand because
+// the state is small (a handful of fields and a few transitions), avoiding
+// another dependency in the browser bundle. Consumers live under
+// `<SessionProvider>`; the `useSession()` hook provides the state
+// and transitions.
 import { CurrentUserProvider, useSessionEndedSignal, } from "@cosmicdrift/kumiko-renderer";
 import { readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
@@ -34,14 +34,14 @@ const INITIAL = {
     bootstrapFailure: null,
     signedOutReason: null,
 };
-// kumiko_auth ist HttpOnly — kumiko_csrf wird beim Login gemeinsam gesetzt.
+// kumiko_auth is HttpOnly; kumiko_csrf is set together with it at login.
 export function hasLikelyAuthSession(cookieSource) {
     return readCsrfToken(cookieSource) !== undefined;
 }
-// Exported damit tests den merge-pfad direkt pinnen können — der hier
-// muss byte-identisch zum server-side merge in auth-routes.ts +
-// login.write.ts sein, sonst sieht der Client andere session-rollen
-// als der Server.
+// Exported so tests can pin the merge path directly: this must be
+// byte-identical to the server-side merge in auth-routes.ts +
+// login.write.ts, otherwise the client sees different session roles
+// from the server.
 export function computeActiveRoles(user, activeTenantId, tenants) {
     if (user === null)
         return [];
@@ -51,13 +51,13 @@ export function computeActiveRoles(user, activeTenantId, tenants) {
     // login.write.ts).
     return Array.from(new Set([...user.globalRoles, ...membershipRoles]));
 }
-/** Internal — exposed for tests die einen Mock-SessionApi-Wert reinreichen
- *  wollen, ohne durch SessionProvider's refresh-Lifecycle zu müssen. App-
- *  Code nutzt SessionProvider + useSession; direkter Context-Zugriff ist
- *  für Tests/Stories. */
+/** Internal — exposed so tests can pass a mock SessionApi value
+ *  without going through SessionProvider's refresh lifecycle. Application
+ *  code uses SessionProvider + useSession; direct context access is
+ *  intended for tests/stories. */
 export const SessionContext = createContext(undefined);
-// Eine Refresh-Runde: /auth/tenants → wenn 401 nicht-eingeloggt, sonst
-// /user:me. Beides zusammen ergibt den vollen SessionState.
+// One refresh round: /auth/tenants → if 401, unauthenticated; otherwise
+// /user:me. Together, both requests produce the complete SessionState.
 async function refresh() {
     if (!hasLikelyAuthSession()) {
         return UNAUTHENTICATED;
@@ -103,14 +103,14 @@ export function SessionProvider({ children, postLogoutUrl, }) {
             setState({ ...UNAUTHENTICATED, status: "error", bootstrapFailure: toBootstrapFailure(err) });
         }
     }, []);
-    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
     useEffect(() => {
         void doRefresh();
     }, [doRefresh]);
     const sessionEndedSignal = useSessionEndedSignal();
     // Only an authenticated session can "end": an anonymous 401 on a public
     // surface must not show the hint.
-    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
     useEffect(() => {
         return sessionEndedSignal?.subscribe(() => {
             setState((prev) => prev.status === "authenticated"
@@ -134,20 +134,19 @@ export function SessionProvider({ children, postLogoutUrl, }) {
             return;
         }
         setState(UNAUTHENTICATED);
-        // Hard-Reload: React-Tree, dispatcher-live-Caches, EventSource —
-        // alles fliegt auf Null. Nach Logout ist das der billigste Weg zu
-        // sauberer Ausgangslage, ohne dass wir jeden einzelnen Consumer
-        // per Context-Bust invalidieren müssen.
+        // Hard reload: the React tree, dispatcher live caches, and EventSource
+        // are all reset. After logout, this is the cheapest way to reach a clean
+        // state without having to invalidate every consumer through a context
+        // reset.
         if (typeof window !== "undefined") {
             window.location.reload();
         }
     }, [postLogoutUrl]);
     const switchTenant = useCallback(async (tenantId) => {
         await switchTenantApi(tenantId);
-        // Tenant-Wechsel rotiert JWT + Cookies. React-Tree enthält
-        // tenant-gebundene Caches (Queries, Live-Events) — simpler
-        // Reload ist konsistent mit dem Logout-Pfad und vermeidet
-        // halbe State-Übergänge.
+        // Tenant switching rotates the JWT + cookies. The React tree contains
+        // tenant-bound caches (queries, live events), so a simple reload is
+        // consistent with the logout path and avoids partial state transitions.
         if (typeof window !== "undefined") {
             window.location.reload();
         }