@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.387.0

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -6,5 +6,5 @@ export type SwitchTenantMfaGateData = {
 } | NonNullable<Awaited<ReturnType<typeof gateEnforceMfa>>>;
 export declare function createSwitchTenantMfaGateHandler(opts: Pick<LoginHandlerOptions, "mfaStatusChecker">): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"switch-tenant-mfa-gate", z.ZodObject<{
     userId: z.ZodString;
-    tenantId: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    tenantId: z.ZodString;
 }, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.js

@@ -7,10 +7,7 @@ import { noMembership } from "../errors.js";
 import { gateEnforceMfa } from "./login.write.js";
 const SwitchTenantMfaGateSchema = z.object({
     userId: z.string().min(1),
-    tenantId: z
-        .string()
-        .min(1)
-        .transform((id) => id),
+    tenantId: z.string().min(1),
 });
 // Dispatched by POST /auth/switch-tenant with the system identity. The handler
 // resolves membership and roles itself, so the gate never trusts caller-supplied

package/dist/auth-email-password/index.js

@@ -9,11 +9,11 @@ export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./boo
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
 export { AuthMailNotificationTypes } from "./mail-notifications.js";
 export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.js";
-// Generic HMAC-signed single-purpose token helpers. Re-exported damit
-// app-spezifische out-of-band-Flows (subscriber-confirm, magic-links,
-// invite-tokens) denselben battle-tested signer/verifier nutzen können
-// statt eigene HMAC-Logik zu duplizieren. Purpose-string diskriminiert
-// Cross-Replay zwischen Flows.
+// Generic HMAC-signed single-purpose token helpers. Re-exported so
+// app-specific out-of-band flows (subscriber-confirm, magic-links,
+// invite-tokens) can use the same battle-tested signer/verifier
+// instead of duplicating HMAC logic. The purpose string prevents
+// cross-replay between flows.
 export { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
 export { issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
 export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";

package/dist/auth-email-password/lockout-store.js

@@ -17,7 +17,7 @@
 // semantics) live in shared/lockout-counter.ts — this file only wires the
 // account-lockout key prefixes onto it. See that file for why a lock
 // re-arms immediately after expiry, and why a successful login (or the
-// account-unlock magic-link flow, #1266, see
+// account-unlock magic-link flow in
 // handlers/confirm-account-unlock.write.ts) is what resets the streak.
 import { createLockoutCounter } from "../shared/index.js";
 const COUNT_KEY_PREFIX = "kumiko:auth:lockout:count:";

package/dist/auth-email-password/seeding.d.ts

@@ -8,53 +8,51 @@ export type SeedUserWithPasswordOptions = {
     readonly password: string;
     readonly displayName: string;
     readonly locale?: string;
-    /** Globale Rollen — siehe SeedUserOptions.roles. */
+    /** Global roles — see SeedUserOptions.roles. */
     readonly roles?: readonly string[];
-    /** Initial-emailVerified-Flag. Default false (Verify-Flow läuft).
-     *  Magic-Link-Signup setzt true weil der Mail-Klick die Email-
-     *  Ownership beweist. Siehe SeedUserOptions.emailVerified. */
+    /** Initial emailVerified flag. Defaults to false (the verification flow runs).
+     *  Magic-link signup sets it to true because clicking the email proves
+     *  ownership. See SeedUserOptions.emailVerified. */
     readonly emailVerified?: boolean;
     readonly by?: SessionUser;
 };
 /**
- * Seed a user mit Plain-Password (wird vor dem Insert mit argon2
- * gehasht). Liefert die userId, idempotent über email.
+ * Seed a user with a plaintext password (hashed with argon2 before insertion).
+ * Returns the userId and is idempotent by email.
  */
 export declare function seedUserWithPassword(db: DbConnection, options: SeedUserWithPasswordOptions, hooks?: SeedTenantHooks): Promise<{
     id: string;
 }>;
-/** Provisioning-Helper für Self-Signup-Confirm. Legt einen frischen
- *  Tenant + Admin-User + Membership in einem Rutsch an — verwendet die
- *  bestehende Event-Store-Pipeline (wie seedAdmin) und ist daher
- *  konsistent mit dem regulären create-Pfad: events werden geschrieben,
- *  Projections sind populated, MSPs/Audit sehen die neuen Rows.
+/** Provisions a fresh tenant, admin user, and membership for self-signup
+ *  confirmation in one operation. It uses the existing event-store pipeline
+ *  (as seedAdmin), keeping it consistent with the regular create path:
+ *  events are written, projections are populated, and MSPs/audit see the
+ *  new rows.
  *
- *  Naming-Hinweis: nutzt intern `seedTenant` / `seedUser*` —
- *  diese Helpers sind production-grade (event-store-pipeline), das "seed"
- *  im Namen ist historisch (zuerst für Tests + Bootstrap gebaut, dann
- *  als General-Purpose-Helper exportiert). Rename `seed*` → `provision*`
- *  ist als dedizierter Cleanup-PR geplant — disproportional zum Wert
- *  innerhalb dieses Sprints, weil alle existing tests berührt würden.
+ *  Naming note: internally uses `seedTenant` / `seedUser*`; these helpers are
+ *  production-grade (event-store pipeline), and "seed" is historical because
+ *  they were first built for tests and bootstrap before being exported as
+ *  general-purpose helpers.
  *
- *  Atomicity: läuft inside einer Drizzle-Tx wenn der Caller das angibt
- *  (db.begin(tx => provisionSignupAccount(tx, ...)) — die seed-
- *  helpers nehmen DbConnection|DbTx strukturell. Bei pure DbConnection
- *  sind die 3 writes nicht atomic; bei Failure zwischen Schritten kann
- *  ein orphan-Tenant zurückbleiben (Tenant ohne User → unused row;
- *  User ohne Membership → "no_membership" beim ersten Login).
+ *  Atomicity: runs inside a Drizzle transaction when the caller provides one
+ *  (db.begin(tx => provisionSignupAccount(tx, ...)); the seed helpers accept
+ *  DbConnection|DbTx structurally. With a plain DbConnection, the three writes
+ *  are not atomic; a failure between steps can leave an orphan tenant (tenant
+ *  without a user → unused row; user without a membership → "no_membership"
+ *  on first login).
  *
- *  Create-only: existiert bereits ein User mit dieser Email (Seeding oder
- *  früherer Signup), wirft die Funktion einen ConflictError BEVOR ein Tenant
- *  entsteht. Der Self-Signup-Pfad darf einen bestehenden User nicht still
- *  wiederverwenden — sonst würde der Confirm-Schritt eine Session für ihn
- *  minten (Account-Takeover, #365). `seedUser` selbst bleibt idempotent
- *  add-only (für Bootstrap/Tests); die create-only-Garantie sitzt hier.
- *  tenantKey-Kollisionen löst der Caller via generateUniqueName. */
+ *  Create-only: if a user with this email already exists (from seeding or an
+ *  earlier signup), the function throws a ConflictError BEFORE creating a
+ *  tenant. The self-signup path must not silently reuse an existing user —
+ *  otherwise the confirmation step could mint a session for that user
+ *  (account takeover). `seedUser` itself remains idempotent and add-only
+ *  (for bootstrap/tests); the create-only guarantee belongs here.
+ *  The caller resolves tenantKey collisions via generateUniqueName. */
 /** Default membership roles for self-signup tenant owners. Shared between
- *  provisionSignupAccount (DB-write) und signup-confirm-handler
- *  (SessionUser-Konstruktion für JWT-Mint) — sonst hätten zwei
- *  Stellen unabhängig "TenantAdmin" hardcoded und würden bei einem
- *  Refactor zu role-mismatch zwischen DB und Session leiden. */
+ *  provisionSignupAccount (DB write) and signup-confirm-handler
+ *  (SessionUser construction for JWT minting); otherwise two locations would
+ *  independently hardcode "TenantAdmin" and a refactor could cause a role
+ *  mismatch between the database and the session. */
 export declare const INITIAL_SIGNUP_ROLES: readonly ["TenantAdmin", "Admin"];
 export type ProvisionSignupAccountOptions = {
     readonly email: string;
@@ -75,20 +73,19 @@ export type SeedAdminOptions = {
     readonly email: string;
     readonly password: string;
     readonly displayName: string;
-    /** Tenants, in die der Admin als Mitglied eingetragen wird. Pro
-     *  Tenant kann eine eigene Rollenliste gesetzt werden — hilft beim
-     *  Sample-TenantSwitcher der pro Tenant unterschiedliche
-     *  Rollen-Listen zeigt. */
+    /** Tenants where the admin is added as a member. Each tenant can have
+     *  its own role list, which lets the sample TenantSwitcher show different
+     *  role lists for each tenant. */
     readonly memberships: ReadonlyArray<{
         readonly tenantId: TenantId;
         readonly tenantKey: string;
         readonly tenantName: string;
         readonly roles: readonly string[];
     }>;
-    /** Globale Rollen die in users.roles landen — tenant-unabhängig.
-     *  Login-Handler mergt sie in jede Session parallel zu den tenant-
-     *  membership-Rollen. Typischer use-case: `["SystemAdmin"]` für
-     *  einen Plattform-Operator. Default: leer. */
+    /** Global roles stored in users.roles, independent of the tenant.
+     *  The login handler merges them into every session alongside the tenant
+     *  membership roles. Typical use case: `["SystemAdmin"]` for a platform
+     *  operator. Default: empty. */
     readonly globalRoles?: readonly string[];
     /** Initial emailVerified state — defaults to false (unverified). Same
      *  mechanism as seedUserWithPassword.emailVerified. Re-running the seed
@@ -98,9 +95,9 @@ export type SeedAdminOptions = {
     readonly by?: SessionUser;
 };
 /**
- * Seed-Convenience für Sample-Server: Admin-User mit gehashtem
- * Password + N Tenants + N Memberships. Alles idempotent (Re-Run im
- * persistent-DB-Modus läuft durch). Liefert die userId zurück.
+ * Seeding convenience for sample servers: an admin user with a hashed
+ * password, N tenants, and N memberships. Idempotent, so rerunning it in
+ * persistent-DB mode succeeds. Returns the userId.
  */
 export declare function seedAdmin(db: DbConnection, options: SeedAdminOptions): Promise<{
     id: string;

package/dist/auth-email-password/seeding.js

@@ -1,16 +1,16 @@
-// Stable seeding helpers fürs auth-email-password-Feature. Liegen unter
-// `/seeding` (nicht `/testing`) damit der Vertrag klar ist: hier ist
-// non-test code der bei jedem Dev-Boot + jedem Integration-Test läuft.
-// Test-spezifische Variationen (account-locked-Setup, expired-token,
-// race-conditions) werden NICHT als Knöpfe an diesen Helpers angebaut —
-// sie kommen als neue Funktionen daneben oder inline ins Test-File.
+// Stable seeding helpers for the auth-email-password feature. They live under
+// `/seeding` rather than `/testing` to make the contract clear: this is
+// non-test code that runs on every dev boot and integration test.
+// Test-specific variations (account-locked setup, expired-token,
+// race-conditions) are NOT added as options to these helpers —
+// they belong in separate functions or inline in the test file.
 //
-// Bündelt drei Schritte in einem Aufruf:
-//   1. argon2-Hash des Plain-Passworts
-//   2. seedUser() aus user/seeding
-//   3. seedTenant + seedTenantMembership aus tenant/seeding
-// Damit Sample-Server und Tests keine drei sub-paths zusammensammeln
-// müssen.
+// Bundles three steps into one call:
+//   1. argon2 hash of the plaintext password
+//   2. seedUser() from user/seeding
+//   3. seedTenant + seedTenantMembership from tenant/seeding
+// This keeps sample servers and tests from having to assemble three
+// sub-paths themselves.
 import { configuredBlindIndexKey, configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
@@ -24,21 +24,21 @@ import { USER_STATUS, userTable } from "../user/schema/user.js";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { reconcileSeededUserEmailVerified, rewriteSeededUserEmail, seedUser, } from "../user/seeding.js";
 const log = createFallbackLogger("auth-email-password-seeding");
-// Re-export für ergonomische Single-Import-Site in tests/seed-scripts.
-// Das Auth-Feature ist der natürliche Aufrufer für "seed admin user mit
-// password + tenant + membership" — wer das nutzt soll nicht aus drei
-// verschiedenen sub-paths zusammensammeln müssen.
+// Re-export for a convenient single import site in tests/seed-scripts.
+// The auth feature is the natural caller for "seed admin user with
+// password + tenant + membership", so consumers do not need to assemble
+// these helpers from three different sub-paths.
 // kumiko-lint-ignore cross-feature-import re-export of test-helpers
 export { seedTenant, seedTenantMembership } from "../tenant/seeding.js";
 // kumiko-lint-ignore cross-feature-import re-export of test-helpers
 export { seedUser } from "../user/seeding.js";
 /**
- * Seed a user mit Plain-Password (wird vor dem Insert mit argon2
- * gehasht). Liefert die userId, idempotent über email.
+ * Seed a user with a plaintext password (hashed with argon2 before insertion).
+ * Returns the userId and is idempotent by email.
  */
 export async function seedUserWithPassword(db, options, 
 // Optional, append-only — same rationale as provisionSignupAccount's
-// hooks param (#1478): the self-signup path passes it through so `user`'s
+// hooks param: the self-signup path passes it through so `user`'s
 // postSave hooks fire on self-signup same as on the regular create path.
 hooks) {
     const passwordHash = await hashPassword(options.password);
@@ -52,54 +52,52 @@ hooks) {
         ...(options.by !== undefined && { by: options.by }),
     }, hooks);
 }
-/** Provisioning-Helper für Self-Signup-Confirm. Legt einen frischen
- *  Tenant + Admin-User + Membership in einem Rutsch an — verwendet die
- *  bestehende Event-Store-Pipeline (wie seedAdmin) und ist daher
- *  konsistent mit dem regulären create-Pfad: events werden geschrieben,
- *  Projections sind populated, MSPs/Audit sehen die neuen Rows.
+/** Provisions a fresh tenant, admin user, and membership for self-signup
+ *  confirmation in one operation. It uses the existing event-store pipeline
+ *  (as seedAdmin), keeping it consistent with the regular create path:
+ *  events are written, projections are populated, and MSPs/audit see the
+ *  new rows.
  *
- *  Naming-Hinweis: nutzt intern `seedTenant` / `seedUser*` —
- *  diese Helpers sind production-grade (event-store-pipeline), das "seed"
- *  im Namen ist historisch (zuerst für Tests + Bootstrap gebaut, dann
- *  als General-Purpose-Helper exportiert). Rename `seed*` → `provision*`
- *  ist als dedizierter Cleanup-PR geplant — disproportional zum Wert
- *  innerhalb dieses Sprints, weil alle existing tests berührt würden.
+ *  Naming note: internally uses `seedTenant` / `seedUser*`; these helpers are
+ *  production-grade (event-store pipeline), and "seed" is historical because
+ *  they were first built for tests and bootstrap before being exported as
+ *  general-purpose helpers.
  *
- *  Atomicity: läuft inside einer Drizzle-Tx wenn der Caller das angibt
- *  (db.begin(tx => provisionSignupAccount(tx, ...)) — die seed-
- *  helpers nehmen DbConnection|DbTx strukturell. Bei pure DbConnection
- *  sind die 3 writes nicht atomic; bei Failure zwischen Schritten kann
- *  ein orphan-Tenant zurückbleiben (Tenant ohne User → unused row;
- *  User ohne Membership → "no_membership" beim ersten Login).
+ *  Atomicity: runs inside a Drizzle transaction when the caller provides one
+ *  (db.begin(tx => provisionSignupAccount(tx, ...)); the seed helpers accept
+ *  DbConnection|DbTx structurally. With a plain DbConnection, the three writes
+ *  are not atomic; a failure between steps can leave an orphan tenant (tenant
+ *  without a user → unused row; user without a membership → "no_membership"
+ *  on first login).
  *
- *  Create-only: existiert bereits ein User mit dieser Email (Seeding oder
- *  früherer Signup), wirft die Funktion einen ConflictError BEVOR ein Tenant
- *  entsteht. Der Self-Signup-Pfad darf einen bestehenden User nicht still
- *  wiederverwenden — sonst würde der Confirm-Schritt eine Session für ihn
- *  minten (Account-Takeover, #365). `seedUser` selbst bleibt idempotent
- *  add-only (für Bootstrap/Tests); die create-only-Garantie sitzt hier.
- *  tenantKey-Kollisionen löst der Caller via generateUniqueName. */
+ *  Create-only: if a user with this email already exists (from seeding or an
+ *  earlier signup), the function throws a ConflictError BEFORE creating a
+ *  tenant. The self-signup path must not silently reuse an existing user —
+ *  otherwise the confirmation step could mint a session for that user
+ *  (account takeover). `seedUser` itself remains idempotent and add-only
+ *  (for bootstrap/tests); the create-only guarantee belongs here.
+ *  The caller resolves tenantKey collisions via generateUniqueName. */
 /** Default membership roles for self-signup tenant owners. Shared between
- *  provisionSignupAccount (DB-write) und signup-confirm-handler
- *  (SessionUser-Konstruktion für JWT-Mint) — sonst hätten zwei
- *  Stellen unabhängig "TenantAdmin" hardcoded und würden bei einem
- *  Refactor zu role-mismatch zwischen DB und Session leiden. */
+ *  provisionSignupAccount (DB write) and signup-confirm-handler
+ *  (SessionUser construction for JWT minting); otherwise two locations would
+ *  independently hardcode "TenantAdmin" and a refactor could cause a role
+ *  mismatch between the database and the session. */
 // TenantAdmin is the canonical owner role; Admin stays for handlers that still
 // gate on the legacy literal until those call sites move to access.admin.
 export const INITIAL_SIGNUP_ROLES = ["TenantAdmin", "Admin"];
 export async function provisionSignupAccount(db, options, 
 // Optional, append-only — existing callers (tests, seed scripts) that
 // don't pass hooks keep today's behavior. The real signup-confirm
-// handler DOES pass it (#1463) so seedTenant/seedUserWithPassword/
+// handler DOES pass it so seedTenant/seedUserWithPassword/
 // seedTenantMembership's postSave hooks (tier-engine's auto-default-tier,
 // app auto-default-compliance, a Welcome-notification hook, ...) fire on
 // self-signup for all three entities, same as they do on the regular
-// create paths (#1478 — this was only wired for tenant before).
+// create paths — this was only wired for tenant before.
 hooks) {
     // Create-only guard BEFORE seedTenant: hard-abort on an already-registered
     // email, otherwise an orphaned tenant would be created and seedUser
     // (idempotent add-only) would silently return the existing userId ->
-    // confirm mints a session for the wrong account (#365).
+    // confirm mints a session for the wrong account.
     // isDeleted: false — the partial bidx unique index only covers live rows,
     // so a soft-deleted row must not block re-registering its email.
     const existingUser = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
@@ -126,9 +124,9 @@ hooks) {
     return { userId, tenantId: options.tenantId };
 }
 /**
- * Seed-Convenience für Sample-Server: Admin-User mit gehashtem
- * Password + N Tenants + N Memberships. Alles idempotent (Re-Run im
- * persistent-DB-Modus läuft durch). Liefert die userId zurück.
+ * Seeding convenience for sample servers: an admin user with a hashed
+ * password, N tenants, and N memberships. Idempotent, so rerunning it in
+ * persistent-DB mode succeeds. Returns the userId.
  */
 export async function seedAdmin(db, options) {
     const by = options.by ?? TestUsers.systemAdmin;

package/dist/auth-email-password/signup-token-store.js

@@ -57,14 +57,14 @@ export async function deleteSignupToken(redis, args) {
 /** Burn release for failed-confirm paths (DB error etc.) so a legitimate
  *  retry isn't blocked by a stale burn marker. */
 export const unburnSignupToken = store.unburn;
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): signup-request binds a verified tenant-handover grant to
-// its own signup token, in a SIBLING Redis namespace keyed the same way
-// (sha256(token)) so it stays byte-compatible with the token store above
-// without going through it — the binding has its own lifecycle (survives a
-// resend, is read once by signup-confirm) that doesn't fit the token↔email
-// pairing. Only {entityType, rowId, sourceTenantId} is ever stored — never
-// the grant token or the email (see shared/signup-handover.ts).
+// Cross-device try-first handover:
+// signup-request binds a verified tenant-handover grant to its own signup token,
+// in a SIBLING Redis namespace keyed the same way (sha256(token)) so it stays
+// byte-compatible with the token store above without going through it — the
+// binding has its own lifecycle (survives a resend, is read once by
+// signup-confirm) that doesn't fit the token↔email pairing. Only
+// {entityType, rowId, sourceTenantId} is ever stored — never the grant token
+// or the email (see shared/signup-handover.ts).
 const SIGNUP_HANDOVER_KEY_PREFIX = "signup:handover:";
 const signupHandoverBindingSchema = z.object({
     entityType: z.string().min(1),

package/dist/auth-email-password/testing.js

@@ -1,4 +1,4 @@
-// /testing re-exportiert /seeding. Siehe ../tenant/testing.ts für die
-// Begründung — Helpers sind shared zwischen Tests und Dev-Server-
-// Bootstrap, /seeding ist die stabile Heimat.
+// /testing re-exports /seeding. See ../tenant/testing.ts for the reason:
+// Helpers are shared between tests and Dev-Server bootstrap, so /seeding is
+// the stable home.
 export * from "./seeding.js";

package/dist/auth-email-password/web/auth-client.d.ts

@@ -1,8 +1,8 @@
 export type TenantSummary = {
     readonly tenantId: string;
     readonly roles: readonly string[];
-    /** Display-Name aus /auth/tenants — fehlt nur bei App-eigenen
-     *  membership-Queries ohne tenantName-Anreicherung. */
+    /** Display name from /auth/tenants; absent only for app-owned membership
+     * queries without tenantName enrichment. */
     readonly name?: string;
     readonly key?: string;
 };

package/dist/auth-email-password/web/auth-client.js

@@ -1,12 +1,11 @@
-// Browser-Seite der Auth-Routes. Dünne fetch-Wrapper um /api/auth/*
-// mit Cookie-Transport: JWT lebt im HttpOnly kumiko_auth-Cookie,
-// Double-Submit-CSRF-Token im JS-lesbaren kumiko_csrf-Cookie. Alle
-// state-changing Requests echo'n den CSRF-Token via X-CSRF-Token —
-// der Server rejected sonst mit csrf_token_missing.
+// Browser-side wrappers around /api/auth/* using cookie transport: the JWT
+// lives in the HttpOnly kumiko_auth cookie, while the Double-Submit CSRF
+// token lives in the JS-readable kumiko_csrf cookie. Every state-changing
+// request echoes the CSRF token via X-CSRF-Token; otherwise the server
+// rejects it with csrf_token_missing.
 //
-// Die dispatcher-live nutzt denselben readCsrfToken-Helper; wir
-// reuse'n ihn hier, damit die Konstanten (Cookie-Name, Header-Name)
-// nicht divergieren.
+// dispatcher-live uses the same readCsrfToken helper; reusing it here keeps
+// the cookie and header constants from diverging.
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { CSRF_HEADER_NAME, readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
 export function csrfHeader() {
@@ -70,8 +69,8 @@ export async function login(req) {
             return { kind: "success", data: toLoginResponse(body.token, body.user, body.landingPath) };
         }
     }
-    // Der Server schickt error entweder als string ("invalid_body") oder als
-    // strukturiertes Objekt. Wir ziehen uns den sprechendsten Reason raus.
+    // The server sends error either as a string ("invalid_body") or as a
+    // structured object. Extract the most descriptive reason.
     const err = body.error;
     if (typeof err === "string") {
         return { kind: "failure", error: { reason: err } };
@@ -87,10 +86,10 @@ export async function login(req) {
         },
     };
 }
-// POST /api/auth/logout. Server revoked die Session (wenn sessionRevoker
-// gewired ist) und clear't die Cookies. Wir triggern hinterher einen
-// Navigation-Refresh, damit alle caches (React-State, query-cache) auf
-// Null gehen — billigster Weg zu sauberer Ausgangslage.
+// POST /api/auth/logout. The server revokes the session when
+// sessionRevoker is wired and clears the cookies. A navigation refresh
+// afterward ensures that all caches (React state, query cache) return to
+// an unauthenticated state—the simplest way to restore a clean baseline.
 export async function logout() {
     await fetch("/api/auth/logout", {
         method: "POST",
@@ -98,11 +97,11 @@ export async function logout() {
         headers: { "Content-Type": "application/json", ...csrfHeader() },
     });
 }
-// 4xx/5xx → typed AuthTokenFailure parsen. 429 (Rate-Limit) hat einen
-// dedizierten reason damit das UI einen Retry-Hinweis zeigen kann.
+// Parse 4xx/5xx responses into AuthTokenFailure. 429 uses a dedicated
+// reason so the UI can display a retry hint.
 async function parseTokenFailure(res) {
     if (res.status === 429) {
-        // @cast-boundary engine-payload — server schickt details.retryAfterSeconds bei 429
+        // @cast-boundary engine-payload — the server sends details.retryAfterSeconds for 429
         const body = (await res.json().catch(() => ({})));
         const retry = body.error?.details?.retryAfterSeconds;
         return { reason: "rate_limited", ...(retry !== undefined && { retryAfterSeconds: retry }) };
@@ -127,11 +126,12 @@ export async function requestPasswordReset(email) {
         return { ok: true };
     return { ok: false, error: await parseTokenFailure(res) };
 }
-// POST /api/auth/reset-password. Token aus URL + neues Passwort. Auf
-// 422 collapses der Server alle Token-Verify-Fehler (malformed / bad-
-// signature / expired) auf den einzigen Code `invalid_reset_token` —
-// anti-enumeration. Plus zod-validation-failures (newPassword < 8) als
-// eigene 4xx mit code "validation_failed". UI mappt reason → i18n-Key.
+// POST /api/auth/reset-password. The token comes from the URL and the
+// request includes the new password. On 422, the server collapses all
+// token-verification errors (malformed, bad signature, expired) into the
+// single code `invalid_reset_token` to prevent enumeration. Zod validation
+// failures (newPassword < 8) use a separate 4xx code, "validation_failed".
+// The UI maps reason to an i18n key.
 export async function resetPassword(token, newPassword) {
     const res = await fetch("/api/auth/reset-password", {
         method: "POST",
@@ -156,9 +156,9 @@ export async function requestEmailVerification(email) {
         return { ok: true };
     return { ok: false, error: await parseTokenFailure(res) };
 }
-// POST /api/auth/verify-email. Auto-submitted vom VerifyEmailScreen
-// nach `?token=...`-parse. Server collapses alle Verify-Failures auf
-// `invalid_verification_token` (anti-enumeration, parallel zu reset).
+// POST /api/auth/verify-email. VerifyEmailScreen submits this automatically
+// after parsing `?token=...`. The server collapses all verification failures
+// into `invalid_verification_token` to prevent enumeration, as with reset.
 export async function verifyEmail(token) {
     const res = await fetch("/api/auth/verify-email", {
         method: "POST",
@@ -199,14 +199,13 @@ export async function confirmAccountUnlock(token) {
         return { ok: true };
     return { ok: false, error: await parseTokenFailure(res) };
 }
-// POST /api/auth/signup-request. Always-200 (anti-enumeration; wir
-// sagen nicht ob die Email schon registriert ist). Server schickt
-// Activation-Mail an die Adresse — beim Klick auf den Link landet der
-// User auf /signup/complete?token=… wo er sein Password setzt.
+// POST /api/auth/signup-request. Always returns 200 to prevent enumeration;
+// the response does not reveal whether the email is already registered. The
+// server sends an activation email to the address; following its link takes
+// the user to /signup/complete?token=… to set a password.
 export async function requestSignup(email, 
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): forwards a row-bound tenant-handover grant so the
-// server can verify + rebind it to the signup token. The grant never
+// Cross-device try-first handover: forwards a row-bound tenant-handover
+// grant so the server can verify + rebind it to the signup token. The grant never
 // travels any further than this request — never in the URL, the mail,
 // or the confirm response.
 handover) {
@@ -243,8 +242,8 @@ export async function confirmSignup(token, password) {
     }
     return { ok: false, error: await parseTokenFailure(res) };
 }
-// GET /api/auth/tenants. Liefert die Memberships des aktuellen Users;
-// der Server liefert 401 wenn das Cookie fehlt oder abgelaufen ist.
+// GET /api/auth/tenants. Returns the current user's memberships; the server
+// returns 401 when the cookie is missing or expired.
 export async function fetchTenants() {
     const res = await fetch("/api/auth/tenants", {
         method: "GET",
@@ -258,9 +257,9 @@ export async function fetchTenants() {
     // @cast-boundary engine-payload — HTTP-API contract, server-side schema-validated
     return (await res.json());
 }
-// POST /api/auth/switch-tenant. Mintet ein neues JWT für den Ziel-Tenant
-// und rotated beide Cookies. 400 wenn already_in_tenant oder tenant_
-// switch_not_available, 403 wenn not_a_member.
+// POST /api/auth/switch-tenant. Mints a new JWT for the target tenant and
+// rotates both cookies. Returns 400 for already_in_tenant or
+// tenant_switch_not_available, and 403 for not_a_member.
 export async function switchTenant(tenantId) {
     const res = await fetch("/api/auth/switch-tenant", {
         method: "POST",

package/dist/auth-email-password/web/auth-form-primitives.js

@@ -25,21 +25,21 @@ export function useAuthShell() {
 export function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }) {
     const { Card } = usePrimitives();
     const shell = useAuthShell() ?? defaultAuthShell;
-    // h1 (Seiten-Hauptüberschrift) via Header-Slot erhalten — die Card-Default-
-    // Header wäre h3. padded:false = Form sitzt randlos wie bisher (bare form).
+    // Keep an h1 (page heading) through the header slot; the Card's default
+    // header would be h3. padded:false keeps the form edge-to-edge as before
+    // (bare form).
     const card = (_jsx(Card, { className: cn("w-full max-w-sm", className), options: { padded: false }, slots: {
             header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: cn("flex flex-col space-y-1.5 p-6 pb-4", headerClassName), children: [title !== undefined && (_jsx("h1", { className: cn("text-xl font-semibold tracking-tight", titleClassName), children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
         }, children: _jsx(BareFormProvider, { children: _jsx("div", { className: cn("p-6 pt-0 flex flex-col gap-4", bodyClassName), children: children }) }) }));
     return shell(card);
 }
-// Liest `?<paramName>=<value>` aus der aktuellen URL — typisches
-// Pattern für Token-bearing Pages (reset, verify). Returnt "" wenn der
-// Browser nicht da ist (SSR-safety) oder der Parameter fehlt.
+// Reads `?<paramName>=<value>` from the current URL, as used by token-bearing
+// pages (reset, verify). Returns "" during SSR or when the parameter is absent.
 //
-// Nicht über useState/useEffect - das wäre ein read-once-on-mount
-// pattern aber URL-changes sind hier irrelevant (Token-Pages re-loaden
-// für neue Tokens). Caller setzt useState(() => parseUrlToken(...)) wenn
-// gewünscht.
+// This is intentionally not read through useState/useEffect: that would be a
+// read-once-on-mount pattern, while URL changes are irrelevant here because
+// token pages reload for new tokens. Callers can use
+// useState(() => parseUrlToken(...)) when needed.
 export function parseUrlToken(paramName = "token") {
     if (typeof window === "undefined")
         return "";
@@ -47,7 +47,7 @@ export function parseUrlToken(paramName = "token") {
 }
 // Reads the magic-link token from `?<paramName>=` once on mount, then strips
 // that param from the URL via history.replaceState so the single-use token
-// doesn't linger in browser history / Referer (#774). An explicit `override`
+// doesn't linger in browser history / Referer. An explicit `override`
 // (server-injected token) short-circuits both the URL read and the scrub.
 export function useUrlToken(override, paramName = "token") {
     const [token] = useState(() => override ?? parseUrlToken(paramName));