@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.387.0

package/dist/auth-email-password/web/signup-screen.js

@@ -1,16 +1,16 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// SignupScreen — Magic-Link-Self-Signup, Step 1.
+// SignupScreen — Magic-Link self-signup, Step 1.
 //
-// Form mit Email-Input. Submit triggert /api/auth/signup-request
-// (silent-success, kein account-enumeration). UI zeigt unconditional
-// ein "Mail unterwegs"-Confirm mit Resend-Button — auch wenn die Email
-// schon registriert ist (Server schickt dann dieselbe Mail mit dem
-// existing Token aus Redis = idempotent).
+// Form with an email input. Submission triggers /api/auth/signup-request
+// (silent success, no account enumeration). The UI always shows a
+// "email on its way" confirmation with a Resend button, even if the email
+// is already registered (the server then sends the same email with the
+// existing token from Redis, making the request idempotent).
 //
-// App ist verantwortlich, den Screen unter einer URL zu mounten (z.B.
-// /signup) und ihn anonymous reachable zu machen (AuthPathGate VOR
-// AuthGate). Apex-Marketing kann via Link "Kostenlos starten" auf den
-// /signup-Pfad routen.
+// The app is responsible for mounting the screen at a URL (e.g.
+// /signup) and making it anonymously reachable (AuthPathGate before
+// AuthGate). An apex marketing site can route its "Start for free" link to
+// the /signup path.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestSignup } from "./auth-client.js";
@@ -53,9 +53,9 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         void doSubmit();
     };
     const onResend = async () => {
-        // Resend nutzt den gleichen Endpunkt — Server returnt den existing
-        // Token aus Redis und schickt eine zweite Mail mit dem GLEICHEN
-        // Activation-Link (alte Mail bleibt also gültig).
+        // Resend uses the same endpoint: the server returns the existing
+        // token from Redis and sends a second email with the SAME
+        // activation link, so the old email remains valid.
         setSubmitting(true);
         setError(null);
         try {

package/dist/auth-email-password/web/tenant-switcher.d.ts

@@ -1,9 +1,9 @@
 import { type ReactNode } from "react";
 export type TenantSwitcherProps = {
-    /** Optional: liefert einen menschenlesbaren Namen pro Tenant-ID.
-     *  Default: die ID wird direkt angezeigt (kurze UUID genügt für
-     *  Dev-Umgebungen). Für prod sollte der Host z.B. die Tenant-Namen
-     *  beim Login cachen und hier durchreichen. */
+    /** Optional: provides a human-readable name for each tenant ID.
+     *  Default: displays the ID directly (a short UUID is sufficient for
+     *  development environments). In production, the host should cache
+     *  tenant names at login and pass them here. */
     readonly tenantName?: (tenantId: string) => string;
 };
 export declare function TenantSwitcher({ tenantName }: TenantSwitcherProps): ReactNode;

package/dist/auth-email-password/web/tenant-switcher.js

@@ -1,18 +1,17 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// TenantSwitcher — kleines Dropdown, zeigt den aktiven Tenant und
-// erlaubt Wechsel zu anderen Memberships. Auf Radix-DropdownMenu für
-// konsistentes Verhalten (Click-outside/Escape/Keyboard-Nav).
+// TenantSwitcher — compact dropdown showing the active tenant and
+// allowing switches to other memberships. Uses Radix-DropdownMenu for
+// consistent click-outside, Escape, and keyboard-navigation behavior.
 //
-// Rendert NICHT wenn kein User eingeloggt ist und auch NICHT wenn der
-// User nur einen Tenant hat (Single-Tenant-Apps brauchen keinen
-// Switcher).
+// Does NOT render when no user is logged in or when the user has only one
+// tenant (single-tenant apps do not need a switcher).
 //
-// Der Display-Name kommt aus einem optionalen `tenantName`-Prop
-// oder fallback zum ID-Hash. Design-Entscheidung: der TenantSwitcher
-// holt NICHT selbst tenant:query:me — das würde Round-Trips pro Mount
-// kosten und bräuchte Query-Caching-Infrastruktur. Stattdessen reicht
-// der Host den Resolver rein (kommt z.B. aus einer useTenantNames()-
-// Hook die einmalig am App-Boot geladen wird).
+// The display name comes from the optional `tenantName` prop or falls back
+// to the ID hash. Design decision: TenantSwitcher does NOT fetch
+// tenant:query:me itself, which would cost round trips per mount and
+// require query-caching infrastructure. Instead, the host passes in the
+// resolver (for example, from a useTenantNames() hook loaded once at app
+// boot).
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { cn, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuLabel, DropdownMenuTrigger, } from "@cosmicdrift/kumiko-renderer/web";
 import { Building2, ChevronDown } from "lucide-react";
@@ -30,25 +29,25 @@ export function TenantSwitcher({ tenantName }) {
             await switchTenant(tenantId);
         }
         finally {
-            // In der Praxis führt switchTenant zu einem full-page reload,
-            // also sehen wir den cleared-state nie — das `finally` ist nur
-            // für den Edge-Case dass switchTenant throwt, damit die UI
-            // nicht mit dem Spinner hängen bleibt.
+            // In practice, switchTenant causes a full-page reload, so we never see
+            // the cleared state — `finally` only handles the edge case where
+            // switchTenant throws, preventing the UI from remaining stuck with
+            // the spinner.
             setSwitching(null);
         }
     }, [activeTenantId, switchTenant]);
-    // Label-Priorität: App-eigener Resolver (Prop) > Server-geliefertes
-    // name/key aus /auth/tenants > UUID-Präfix. Letzteres ist nur noch der
-    // Notnagel — bei Seed-Tenants (00000000-…) ist es ununterscheidbar.
+    // Label priority: app-provided resolver (prop) > server-provided
+    // name/key from /auth/tenants > UUID prefix. The latter is only a
+    // last resort — it is indistinguishable for seeded tenants (00000000-…).
     const nameOf = (tenantId) => {
         if (tenantName !== undefined)
             return tenantName(tenantId);
         const membership = tenants.find((m) => m.tenantId === tenantId);
-        // || statt ??: ein leerer name/key-String darf nicht als Label durchrutschen.
+        // || instead of ??: an empty name/key string must not be used as a label.
         return membership?.name || membership?.key || tenantId.slice(0, 8);
     };
-    // Rendering-Gate: kein User → nix; nur ein Tenant → auch nix
-    // (Single-Tenant-Apps brauchen keinen Switcher).
+    // Rendering gate: no user → nothing; only one tenant → nothing as well
+    // (single-tenant apps do not need a switcher).
     if (user === null || tenants.length <= 1)
         return null;
     const activeLabel = activeTenantId !== null ? nameOf(activeTenantId) : t("auth.tenant.switcher.none");

package/dist/auth-email-password/web/use-shell-user.js

@@ -1,18 +1,17 @@
-// Liest den eingeloggten User + die Rollen aus dem aktiven Tenant aus
-// der Session. Der Hook ist die Standard-Brücke zwischen Session-State
-// und Layout-Komponenten (WorkspaceShell.user, DefaultAppShell-Gates,
-// custom permission checks).
+// Reads the logged-in user and roles for the active tenant from the session.
+// This hook is the standard bridge between session state and layout components
+// (WorkspaceShell.user, DefaultAppShell gates, custom permission checks).
 //
-// Returns undefined solange:
-//   - die Session lädt (status="loading")
-//   - der User unauthenticated ist
-//   - der activeTenantId in der tenants-Liste fehlt (defensiver Pfad —
-//     sollte nicht passieren, schadet aber nicht zu prüfen)
+// Returns undefined while:
+//   - the session is loading (status="loading")
+//   - the user is unauthenticated
+//   - activeTenantId is missing from the tenants list (a defensive path that
+//     should not occur, but is harmless to check)
 //
-// WorkspaceShell + DefaultAppShell akzeptieren undefined als "keine
-// Workspaces sichtbar", was im Loading-/Logged-Out-Fall die richtige UX
-// ist. Apps die mehr brauchen (Loading-Indicator etc.) prüfen
-// useSession().status direkt.
+// WorkspaceShell and DefaultAppShell treat undefined as "no workspaces
+// visible", which is the correct UX while loading or logged out. Apps that
+// need more (such as a loading indicator) should check useSession().status
+// directly.
 import { useMemo } from "react";
 import { useSession } from "./session.js";
 export function useShellUser() {

package/dist/auth-email-password/web/user-menu.d.ts

@@ -1,11 +1,11 @@
 import type { ReactNode } from "react";
 export type UserMenuVariant = "pill" | "sidebar";
 export type UserMenuProps = {
-    /** Zusätzliche Menu-Items über dem Logout. Per-item class/behaviour
-     *  controlliert der Caller — wir packen nur den Frame drumrum. */
+    /** Additional menu items above logout. The caller controls per-item
+     *  classes and behavior; this component only provides the surrounding frame. */
     readonly children?: ReactNode;
-    /** "pill" (Default) = kompakter Topbar-Trigger; "sidebar" = volle NavUser-
-     *  Row (Avatar + Name + Email) für den `sidebarFooter`-Slot der App-Shell.
+    /** "pill" (default) = compact top-bar trigger; "sidebar" = full NavUser-
+     *  row (avatar + name + email) for the App-Shell's `sidebarFooter` slot.
      *  Requires a `SidebarProvider` ancestor — the default App-Shell
      *  `sidebarFooter` slot already provides one. */
     readonly variant?: UserMenuVariant;

package/dist/auth-email-password/web/user-menu.js

@@ -1,21 +1,20 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// UserMenu — Avatar-Dropdown für die Topbar (variant="pill", Default) oder den
-// Sidebar-Footer (variant="sidebar" = die sidebar-07-NavUser-Row). Zeigt
-// Name/Email + Logout. Auf Radix-DropdownMenu, damit Click-outside, Escape,
-// Focus-Management, Keyboard-Nav (↑↓/Home/End) und ARIA-Roles aus der Kiste
-// funktionieren.
+// UserMenu — avatar dropdown for the top bar (variant="pill", default) or the
+// sidebar footer (variant="sidebar" = the sidebar-07-NavUser-Row). Shows
+// name/email and logout. Uses Radix-DropdownMenu so click-outside, Escape,
+// focus management, keyboard navigation (↑↓/Home/End), and ARIA roles work
+// out of the box.
 //
-// Rendert NICHTS wenn kein User eingeloggt ist — Hosts dürfen das
-// Component außerhalb des AuthGate einhängen ohne dass ein harter
-// Fehler entsteht.
+// Renders nothing when no user is logged in, so hosts can mount the component
+// outside AuthGate without causing a hard error.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { cn, DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuLabel, DropdownMenuSeparator, DropdownMenuTrigger, SidebarMenu, SidebarMenuButton, SidebarMenuItem, } from "@cosmicdrift/kumiko-renderer/web";
 import { ChevronDown, ChevronsUpDown, LogOut } from "lucide-react";
 import { useSession } from "./session.js";
 function initials(value) {
-    // Vor- und Nachname falls Displayname einen Spacebar hat, sonst
-    // erste zwei Chars der Email-Lokalseite. Deterministisch,
-    // damit der Avatar-Content nicht bei jedem Re-Render flattert.
+    // Uses the first and last name when the display name contains a space;
+    // otherwise uses the first two characters of the email local part. This is
+    // deterministic, so the avatar content does not change between re-renders.
     const trimmed = value.trim();
     if (trimmed.length === 0)
         return "?";
@@ -34,8 +33,8 @@ export function UserMenu({ children, variant = "pill" }) {
     const displayName = hasName ? user.displayName : user.email;
     const avatarText = initials(displayName);
     const content = (_jsxs(DropdownMenuContent, { align: variant === "sidebar" ? "start" : "end", "aria-label": t("auth.user.menu.label"), children: [_jsxs(DropdownMenuLabel, { className: "text-xs", children: [_jsx("div", { className: "font-medium text-foreground truncate", children: displayName }), hasName && _jsx("div", { className: "truncate", children: user.email })] }), _jsx(DropdownMenuSeparator, {}), children !== undefined && (_jsxs(_Fragment, { children: [children, _jsx(DropdownMenuSeparator, {})] })), _jsxs(DropdownMenuItem, { "data-testid": "user-menu-logout", onSelect: () => void logout(), children: [_jsx(LogOut, { className: "h-4 w-4" }), _jsx("span", { children: t("auth.user.menu.logout") })] })] }));
-    // Sidebar-Footer: volle NavUser-Row (sidebar-07) als Dropdown-Trigger —
-    // gleiche Optik wie SidebarUser, aber klickbar mit Logout/Profil.
+    // Sidebar footer: full NavUser row (sidebar-07) as the dropdown trigger —
+    // matches SidebarUser visually while providing clickable logout/profile actions.
     if (variant === "sidebar") {
         return (_jsx(SidebarMenu, { children: _jsx(SidebarMenuItem, { children: _jsxs(DropdownMenu, { children: [_jsx(DropdownMenuTrigger, { asChild: true, children: _jsxs(SidebarMenuButton, { size: "lg", className: "data-[state=open]:bg-sidebar-accent data-[state=open]:text-sidebar-accent-foreground", children: [_jsx("span", { "aria-hidden": "true", className: "flex size-7 shrink-0 items-center justify-center rounded-full bg-sidebar-accent text-xs font-medium text-sidebar-accent-foreground", children: avatarText }), _jsxs("div", { className: "grid flex-1 text-left text-sm leading-tight", children: [_jsx("span", { className: "truncate font-medium text-sidebar-foreground", children: displayName }), hasName && (_jsx("span", { className: "truncate text-xs text-sidebar-muted", children: user.email }))] }), _jsx(ChevronsUpDown, { className: "ml-auto size-4 text-sidebar-muted" })] }) }), content] }) }) }));
     }

package/dist/auth-email-password/web/verify-email-screen.d.ts

@@ -1,9 +1,9 @@
 import { type ReactNode } from "react";
 export type VerifyEmailScreenProps = {
     readonly title?: string;
-    /** Override für Token aus URL. Default: parsed aus `?token=...`. */
+    /** Override the token from the URL. Default: parsed from `?token=...`. */
     readonly token?: string;
-    /** href für "Zum Login"-Link. Default "/login". */
+    /** href for the "Zum Login" link. Default "/login". */
     readonly loginHref?: string;
 };
 export declare function VerifyEmailScreen({ title, token: tokenProp, loginHref, }: VerifyEmailScreenProps): ReactNode;

package/dist/auth-email-password/web/verify-email-screen.js

@@ -1,14 +1,13 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// VerifyEmailScreen — liest `?token=...` aus URL, schickt ihn auto an
-// /api/auth/verify-email beim Mount, zeigt success/error. Idempotent
-// auf Server-Seite (mehrfaches Klicken setzt emailVerified=true erneut),
-// also kein Re-Submit-Risiko.
+// VerifyEmailScreen — reads `?token=...` from the URL and automatically sends it to
+// /api/auth/verify-email on mount, then shows success/error. The server-side
+// operation is idempotent (repeating it sets emailVerified=true again), so
+// retries are safe.
 //
-// useEffect mit empty-deps + once-Guard damit React Strict-Mode den
-// Verify-Call nur einmal feuert (Strict-Mode dispatched useEffect 2x in
-// dev). Token-roundtrip ist server-side single-use, aber wir wollen
-// nicht den ersten valid-call beim Mount und den zweiten als invalid-
-// Banner sehen.
+// The empty-deps effect and once guard prevent React Strict Mode from firing
+// the verification call twice (Strict Mode dispatches useEffect twice in dev).
+// The token roundtrip is single-use server-side, but this avoids showing an
+// invalid-token banner after the first valid mount call.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useEffect, useRef, useState } from "react";
 import { verifyEmail } from "./auth-client.js";
@@ -19,7 +18,7 @@ export function VerifyEmailScreen({ title, token: tokenProp, loginHref = "/login
     const token = useUrlToken(tokenProp);
     const [status, setStatus] = useState(token === "" ? "missing-token" : "verifying");
     const startedRef = useRef(false);
-    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
     useEffect(() => {
         if (status !== "verifying")
             return;

package/dist/auth-foundation/boot-checks.js

@@ -1,5 +1,5 @@
 // Multiplicity boot-check for auth-foundation's `tokenVerifier` extension
-// point (#1368, #1570). Two static-shape conflicts a boot-check CAN catch (a
+// point. Two static-shape conflicts a boot-check CAN catch (a
 // runtime shape-match predicate's overlap can't be proven at boot): a
 // malformed plugin registration, and two providers both claiming the same
 // shape (resolveTokenVerifier can't tell them apart). Zero tokenVerifier
@@ -30,7 +30,7 @@ export function validateTokenVerifierMultiplicity(features) {
     }
     if (namesByShape.size === 0) {
         // Session-only apps (email-password + sessions) never hit tokenVerifier —
-        // cookie JWT auth uses sessionStore alone (#1570 / phronexsis#296).
+        // cookie JWT auth uses sessionStore alone.
         for (const feature of features) {
             for (const usage of feature.extensionUsages) {
                 // skip: sessionStore present — tokenVerifier optional for cookie-session apps.
@@ -79,7 +79,7 @@ function validateSingleProvider(features, opts) {
             `only one ${label} provider may be mounted at a time.`);
     }
 }
-// Multiplicity boot-check for the `sessionStore` extension point (#1370).
+// Multiplicity boot-check for the `sessionStore` extension point.
 // Single-provider, unlike tokenVerifier — no shape to route on, so ≥2 fails
 // boot. Zero registrations is a valid configuration (see
 // validateSingleProvider doc) — a pure machine API using auth-foundation for
@@ -93,7 +93,7 @@ export function validateSessionStoreMultiplicity(features) {
         shapeHint: "SessionStoreProvider — options must have a { build } shape",
     });
 }
-// Optional single-provider (#1373). Zero registrations = OK (single-tenant /
+// Optional single-provider. Zero registrations = OK (single-tenant /
 // header-cookie path). ≥2 or malformed = boot fail.
 export function validateTenantResolverMultiplicity(features) {
     validateSingleProvider(features, {

package/dist/auth-foundation/resolve-anonymous-access.d.ts

@@ -1,6 +1,6 @@
 /**
  * Merge app-facing AnonymousAccessConfig with auth-foundation tenant providers.
- * Providers win over any leftover callback fields (hard cutover #1374).
+ * Providers win over any leftover callback fields.
  * Test stacks may still pass Resolved callbacks when no provider is mounted.
  */
 import type { AnonymousAccessConfig, AnonymousAccessResolved } from "@cosmicdrift/kumiko-framework/api";

package/dist/auth-foundation/resolve-anonymous-access.js

@@ -10,7 +10,7 @@ export async function resolveAnonymousAccessFromRegistry(base, deps) {
     // (EXT_TENANT_RESOLVER/EXT_TENANT_EXISTENCE) alone must never make
     // anonymousAccess become defined for an app that never set it — that
     // would upgrade every roles:["anonymous"] handler to reachable without
-    // a JWT the moment such a routing feature is mounted (#1452).
+    // a JWT the moment such a routing feature is mounted.
     if (!base) {
         const needing = ANONYMOUS_ROUTE_FEATURES.filter((name) => deps.registry.getFeature(name));
         if (needing.length > 0) {
@@ -19,7 +19,7 @@ export async function resolveAnonymousAccessFromRegistry(base, deps) {
         }
         return undefined;
     }
-    // Fail-closed (#1374 security): inline tenantResolver without trust is the
+    // Fail-closed (security): inline tenantResolver without trust is the
     // old ambiguous config — providers always carry trust; test stacks must too.
     if (!tenantResolver &&
         base &&
@@ -29,7 +29,7 @@ export async function resolveAnonymousAccessFromRegistry(base, deps) {
         throw new Error("[auth-foundation] anonymousAccess.tenantResolver is set without resolverTrust — " +
             'declare "authoritative" or "fallback-only" (or mount an EXT_TENANT_RESOLVER provider).');
     }
-    // Providers win (#1374). When none are mounted, keep any test-injected
+    // Providers win. When none are mounted, keep any test-injected
     // Resolved callbacks so framework middleware suites stay self-contained.
     return {
         ...(base ?? {}),

package/dist/auth-foundation/types.js

@@ -42,14 +42,14 @@ export function tokenShapeMatches(shape, rawToken) {
 export function tokenShapeKey(shape) {
     return shape.kind === "jwt" ? "jwt" : `prefix:${shape.prefix}`;
 }
-// Session-store extension point (#1370). Unlike EXT_TOKEN_VERIFIER, this is
+// Session-store extension point. Unlike EXT_TOKEN_VERIFIER, this is
 // single-provider — sessions have no per-provider shape to route on, so
 // exactly one implementation must be registered (boot-fails on 0 or ≥2).
 export const EXT_SESSION_STORE = "sessionStore";
 export function isSessionStoreProvider(o) {
     return typeof o === "object" && o !== null && "build" in o && typeof o.build === "function";
 }
-// Tenant-resolution extension points (#1373). Both are single-provider and
+// Tenant-resolution extension points. Both are single-provider and
 // optional — zero registered means today's single-tenant / header-cookie
 // path (no subdomain resolver, no existence check). ≥2 fails boot.
 export const EXT_TENANT_RESOLVER = "tenantResolver";

package/dist/auth-mfa/handlers/disable.write.js

@@ -30,9 +30,9 @@ export function createDisableHandler(opts) {
             if (!row)
                 return mfaNotEnabled();
             // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
-            // (#1467): without ctx.redis, verifyMfaFactor's TOTP-replay burn is
-            // skipped, and a code observed once (phishing proxy/shoulder-surfing)
-            // could be replayed within the ±1-step window to disable MFA outright.
+            // without ctx.redis, verifyMfaFactor's TOTP-replay burn is skipped, and
+            // a code observed once (phishing proxy/shoulder-surfing) could be
+            // replayed within the ±1-step window to disable MFA outright.
             // "no ctx.redis means no one gets through MFA login" doesn't cover
             // this route — it's session-authed, and JWTs issued before Redis was
             // unwired stay valid until they expire.

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -108,8 +108,8 @@ export function createEnableConfirmPreauthHandler(opts) {
             // re-enrollment until an operator manually disables MFA. NOT fixed by
             // this ordering: burnToken() above still runs before this check, so a
             // mid-flight restricted/deleted user still burns their setup token
-            // (framework#1523/5) — moving the burn later would need care around
-            // the existing userId-unique-constraint backstop between the
+            // — moving the burn later would need care around the
+            // existing userId-unique-constraint backstop between the
             // `existing` check above and executor.create() below.
             const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
             const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
@@ -150,10 +150,10 @@ export function createEnableConfirmPreauthHandler(opts) {
                 id: userId,
                 tenantId,
                 roles: mergedRoles,
-                // This endpoint logs the user in directly (fw#1760), so a stored
+                // This endpoint logs the user in directly, so a stored
                 // timezone must survive the preauth-MFA-enrollment login just like
                 // a plain password login does — same helper as verify.write.ts /
-                // invite-accept-with-login.write.ts (#1759).
+                // invite-accept-with-login.write.ts.
                 ...sessionTimezoneField(userRow?.timezone),
                 ...sessionLocaleField(userRow?.locale),
             };

package/dist/auth-mfa/handlers/enable-confirm.write.js

@@ -38,8 +38,8 @@ export function createEnableConfirmHandler(opts) {
             // already rules that out).
             if (verify.payload.userId !== event.user.id)
                 return invalidSetupToken();
-            // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
-            // (#1467): session-authed (lower risk — the caller already has a
+            // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts:
+            // session-authed (lower risk — the caller already has a
             // valid JWT), but silently skipping the single-use burn here would
             // still let a double-confirm race complete twice instead of the
             // second seeing invalidSetupToken(). Checked before the TOTP verify

package/dist/auth-mfa/handlers/enable-start-preauth.write.js

@@ -37,7 +37,7 @@ export function createEnableStartPreauthHandler(opts) {
             const verified = verifyMfaPreauthSetupToken(event.payload.preauthSetupToken, opts.challengeTokenSecret);
             // Same generic "sign in again" error as an expired/invalid MFA
             // challenge token — both mean the login-flow token expired, no
-            // distinct i18n needed (see #1465's scoping comment).
+            // distinct i18n needed.
             if (!verified.ok)
                 return invalidChallengeToken();
             const { userId, tenantId } = verified.payload;

package/dist/auth-mfa/handlers/reencrypt.job.js

@@ -97,7 +97,7 @@ export async function mfaReencryptJob(rawPayload, ctx, db) {
         }
         // After PII peel (when configured), values must be current-cipher
         // envelopes — non-JSON/non-envelope is not a supported legacy decrypt
-        // path (#1541, mirrors config #1513).
+        // path, matching config behavior.
         const totpClass = classifyStoredEnvelope(envelopeValues.totpSecret, targetVersion);
         const recoveryClass = classifyStoredEnvelope(envelopeValues.recoveryCodes, targetVersion);
         if (totpClass === "unrecognized" || recoveryClass === "unrecognized") {

package/dist/auth-mfa/handlers/regenerate-recovery.write.js

@@ -36,11 +36,11 @@ export function createRegenerateRecoveryHandler(opts) {
             // count, since either way the presented code is consumed/irrelevant
             // afterward.
             //
-            // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
-            // (#1467): without ctx.redis, verifyMfaFactor's TOTP-replay burn is
-            // skipped, letting an observed code be replayed within the ±1-step
-            // window to regenerate (and thus invalidate) recovery codes — a
-            // session-authed route, so pre-unwiring JWTs stay a valid attack path.
+            // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts:
+            // without ctx.redis, verifyMfaFactor's TOTP-replay burn is skipped,
+            // letting an observed code be replayed within the ±1-step window to
+            // regenerate (and thus invalidate) recovery codes — a session-authed
+            // route, so pre-unwiring JWTs stay a valid attack path.
             if (!ctx.redis) {
                 return writeFailure(new InternalError({
                     message: "regenerate-recovery (mfa) requires ctx.redis for TOTP replay protection",

package/dist/auth-mfa/handlers/verify.write.js

@@ -42,7 +42,7 @@ export function createMfaVerifyHandler(opts) {
             if (!verified.ok)
                 return invalidChallengeToken();
             const { userId, tenantId } = verified.payload;
-            // Fail closed, matching enable-confirm-preauth.write.ts (#1467):
+            // Fail closed, matching enable-confirm-preauth.write.ts:
             // this route sits behind a challenge token from a successful login,
             // but its own secret is still just a short TOTP/recovery code —
             // silently skipping the brute-force cap and single-use burn when

package/dist/auth-mfa/token-secrets.js

@@ -6,7 +6,7 @@ const SETUP_TOKEN_PURPOSE = "mfa-setup-token-v1";
 const CHALLENGE_TOKEN_PURPOSE = "mfa-challenge-token-v1";
 // A blank or whitespace-only override is treated as absent — an empty env
 // var (MFA_SETUP_TOKEN_SECRET="") must fall back to derivation, not sign
-// tokens with an empty/near-empty HMAC key (fw#1623).
+// tokens with an empty/near-empty HMAC key.
 function resolveSecret(override, fallback) {
     return override !== undefined && override.trim() !== "" ? override : fallback();
 }

package/dist/auth-mfa/web/client-plugin.d.ts

@@ -1,7 +1,7 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
 export type AuthMfaClientOptions = {
-    /** Key-Overrides pro Locale, gemerged mit den Default-Bundles (de/en). */
+    /** Key overrides per locale, merged with the default bundles (de/en). */
     readonly translations?: TranslationsByLocale;
 };
 export type AuthMfaClientFeature = {

package/dist/auth-mfa/web/client-plugin.js

@@ -1,4 +1,4 @@
-// Client-Feature-Factory für auth-mfa — mirrors emailPasswordClient()'s
+// Client feature factory for auth-mfa — mirrors emailPasswordClient()'s
 // shape so apps register both the same way:
 // createKumikoApp({ clientFeatures: [emailPasswordClient(), authMfaClient()] }).
 // No gates: MfaVerifyScreen isn't a route gate, it's a state swap wired

package/dist/auth-mfa/web/i18n.js

@@ -1,6 +1,6 @@
-// Default-Bundles für die auth-mfa Feature-UI. Merged in mit
-// authMfaClient() analog zu emailPasswordClient() aus auth-email-password.
-// Keys folgen `auth.mfa.<area>.<slug>`.
+// Default bundles for the auth-mfa feature UI, merged by
+// authMfaClient() analogously to emailPasswordClient() from auth-email-password.
+// Keys follow `auth.mfa.<area>.<slug>`.
 export const defaultTranslations = {
     en: {
         "screen:auth-mfa-enable.title": "Two-factor authentication",

package/dist/auth-mfa/web/index.js

@@ -1,7 +1,7 @@
-// Public exports für die Browser-Seite des auth-mfa Features. Sub-Path-
-// Export `@cosmicdrift/kumiko-bundled-features/auth-mfa/web` — Server-Seite
-// (defineFeature) bleibt frei von React-/DOM-Deps, siehe auth-email-
-// password/web/index.ts für die selbe Trennung.
+// Public exports for the browser side of the auth-mfa feature. The subpath
+// export `@cosmicdrift/kumiko-bundled-features/auth-mfa/web` keeps the server
+// side (`defineFeature`) free of React/DOM dependencies, matching the same
+// separation in auth-email-password/web/index.ts.
 export { authMfaClient } from "./client-plugin.js";
 export { defaultTranslations, mergeTranslations } from "./i18n.js";
 export { confirmMfaSetupPreauth, startMfaSetupPreauth, verifyMfaChallenge } from "./mfa-client.js";

package/dist/auth-mfa/web/mfa-client.js

@@ -1,10 +1,10 @@
-// Browser-Seite von POST /api/auth/mfa/verify — completes the two-step
-// login LoginScreen started when the server responded mfaRequired. Same
-// fetch/CSRF pattern as auth-email-password's login() (pre-session, no
-// csrfHeader() — there's no session yet to protect). Response shape is
+// Browser side of POST /api/auth/mfa/verify — completes the two-step
+// login that LoginScreen started when the server responded with mfaRequired.
+// Uses the same fetch/CSRF pattern as auth-email-password's login(), but runs
+// before a session exists, so it does not call csrfHeader(). The response is
 // byte-identical to /auth/login's ({isSuccess, token, user} | {isSuccess:
-// false, error}) since auth-routes.ts mints via the same
-// mintSessionAndRespond() for both routes.
+// false, error}) because auth-routes.ts uses mintSessionAndRespond() for both
+// routes.
 // kumiko-lint-ignore cross-feature-import client-only types, the feature's server barrel has no web/ re-export
 import { toLoginResponse, } from "../../auth-email-password/web/index.js";
 export async function verifyMfaChallenge(challengeToken, code) {
@@ -40,11 +40,12 @@ export async function verifyMfaChallenge(challengeToken, code) {
         },
     };
 }
-// Browser-Seite von POST /api/auth/mfa/preauth-enable-start — lets a user
+// Browser side of POST /api/auth/mfa/preauth-enable-start — lets a user
 // blocked at login by MFA enforcement generate a TOTP secret/QR without a
-// session, using the preauthSetupToken login()'s mfa-setup-required result
-// carries. No JWT/cookie here (see auth-routes.ts's route comment) — the
-// response's setupToken is consumed by confirmMfaSetupPreauth below.
+// session, using the preauthSetupToken carried by login()'s
+// mfa-setup-required result. No JWT/cookie is issued here (see the route
+// comment in auth-routes.ts); the response's
+// setupToken is consumed by confirmMfaSetupPreauth below.
 export async function startMfaSetupPreauth(preauthSetupToken, accountLabel) {
     const res = await fetch("/api/auth/mfa/preauth-enable-start", {
         method: "POST",
@@ -85,12 +86,12 @@ export async function startMfaSetupPreauth(preauthSetupToken, accountLabel) {
         },
     };
 }
-// Browser-Seite von POST /api/auth/mfa/preauth-confirm — completes both
-// the enrollment startMfaSetupPreauth began and the login mfa-setup-
-// required block. Response shape mirrors /auth/mfa/verify's (mints via
-// the same mintSessionAndRespond()), same as verifyMfaChallenge above —
-// kept as its own function rather than a shared helper so this file's
-// two already-tested request shapes stay independently editable.
+// Browser side of POST /api/auth/mfa/preauth-confirm — completes both the
+// enrollment started by startMfaSetupPreauth and the login
+// mfa-setup-required block. Its response mirrors /auth/mfa/verify's and is
+// minted via the same mintSessionAndRespond(). It remains a separate function
+// so this file's two already-tested request shapes stay independently
+// editable.
 export async function confirmMfaSetupPreauth(setupToken, code) {
     const res = await fetch("/api/auth/mfa/preauth-confirm", {
         method: "POST",

package/dist/auth-mfa/web/mfa-verify-screen.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// Login-Challenge-Step, gerendert wenn LoginScreen's onMfaChallenge feuert
-// (/auth/login antwortete mfaRequired). Stilistisch wie login-screen.tsx:
-// useState + direkter fetch-Call, kein Dispatcher — es existiert noch kein
-// JWT. Nach Erfolg ruft es session.refresh() statt eines Hard-Reloads, weil
-// der Aufrufer (typisch ein Wizard-State im App-Root) sofort neu rendern
-// will, sobald status:"authenticated" ankommt.
+// Login challenge step, rendered when LoginScreen's onMfaChallenge fires
+// (/auth/login returned mfaRequired). It follows login-screen.tsx:
+// useState plus a direct fetch call, without a dispatcher because no JWT
+// exists yet. After success, it calls session.refresh() instead of a hard
+// reload so the caller (typically wizard state in the app root) can render
+// immediately when status:"authenticated" arrives.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only barrel, the feature's server barrel has no web/ re-export