@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/auth-email-password/web/auth-client.js

@@ -1,12 +1,11 @@
-// Browser-Seite der Auth-Routes. Dünne fetch-Wrapper um /api/auth/*
-// mit Cookie-Transport: JWT lebt im HttpOnly kumiko_auth-Cookie,
-// Double-Submit-CSRF-Token im JS-lesbaren kumiko_csrf-Cookie. Alle
-// state-changing Requests echo'n den CSRF-Token via X-CSRF-Token —
-// der Server rejected sonst mit csrf_token_missing.
+// Browser-side wrappers around /api/auth/* using cookie transport: the JWT
+// lives in the HttpOnly kumiko_auth cookie, while the Double-Submit CSRF
+// token lives in the JS-readable kumiko_csrf cookie. Every state-changing
+// request echoes the CSRF token via X-CSRF-Token; otherwise the server
+// rejects it with csrf_token_missing.
 //
-// Die dispatcher-live nutzt denselben readCsrfToken-Helper; wir
-// reuse'n ihn hier, damit die Konstanten (Cookie-Name, Header-Name)
-// nicht divergieren.
+// dispatcher-live uses the same readCsrfToken helper; reusing it here keeps
+// the cookie and header constants from diverging.
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { CSRF_HEADER_NAME, readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
 export function csrfHeader() {
@@ -70,8 +69,8 @@ export async function login(req) {
             return { kind: "success", data: toLoginResponse(body.token, body.user, body.landingPath) };
         }
     }
-    // Der Server schickt error entweder als string ("invalid_body") oder als
-    // strukturiertes Objekt. Wir ziehen uns den sprechendsten Reason raus.
+    // The server sends error either as a string ("invalid_body") or as a
+    // structured object. Extract the most descriptive reason.
     const err = body.error;
     if (typeof err === "string") {
         return { kind: "failure", error: { reason: err } };
@@ -87,10 +86,10 @@ export async function login(req) {
         },
     };
 }
-// POST /api/auth/logout. Server revoked die Session (wenn sessionRevoker
-// gewired ist) und clear't die Cookies. Wir triggern hinterher einen
-// Navigation-Refresh, damit alle caches (React-State, query-cache) auf
-// Null gehen — billigster Weg zu sauberer Ausgangslage.
+// POST /api/auth/logout. The server revokes the session when
+// sessionRevoker is wired and clears the cookies. A navigation refresh
+// afterward ensures that all caches (React state, query cache) return to
+// an unauthenticated state—the simplest way to restore a clean baseline.
 export async function logout() {
     await fetch("/api/auth/logout", {
         method: "POST",
@@ -98,11 +97,11 @@ export async function logout() {
         headers: { "Content-Type": "application/json", ...csrfHeader() },
     });
 }
-// 4xx/5xx → typed AuthTokenFailure parsen. 429 (Rate-Limit) hat einen
-// dedizierten reason damit das UI einen Retry-Hinweis zeigen kann.
+// Parse 4xx/5xx responses into AuthTokenFailure. 429 uses a dedicated
+// reason so the UI can display a retry hint.
 async function parseTokenFailure(res) {
     if (res.status === 429) {
-        // @cast-boundary engine-payload — server schickt details.retryAfterSeconds bei 429
+        // @cast-boundary engine-payload — the server sends details.retryAfterSeconds for 429
         const body = (await res.json().catch(() => ({})));
         const retry = body.error?.details?.retryAfterSeconds;
         return { reason: "rate_limited", ...(retry !== undefined && { retryAfterSeconds: retry }) };
@@ -127,11 +126,12 @@ export async function requestPasswordReset(email) {
         return { ok: true };
     return { ok: false, error: await parseTokenFailure(res) };
 }
-// POST /api/auth/reset-password. Token aus URL + neues Passwort. Auf
-// 422 collapses der Server alle Token-Verify-Fehler (malformed / bad-
-// signature / expired) auf den einzigen Code `invalid_reset_token` —
-// anti-enumeration. Plus zod-validation-failures (newPassword < 8) als
-// eigene 4xx mit code "validation_failed". UI mappt reason → i18n-Key.
+// POST /api/auth/reset-password. The token comes from the URL and the
+// request includes the new password. On 422, the server collapses all
+// token-verification errors (malformed, bad signature, expired) into the
+// single code `invalid_reset_token` to prevent enumeration. Zod validation
+// failures (newPassword < 8) use a separate 4xx code, "validation_failed".
+// The UI maps reason to an i18n key.
 export async function resetPassword(token, newPassword) {
     const res = await fetch("/api/auth/reset-password", {
         method: "POST",
@@ -156,9 +156,9 @@ export async function requestEmailVerification(email) {
         return { ok: true };
     return { ok: false, error: await parseTokenFailure(res) };
 }
-// POST /api/auth/verify-email. Auto-submitted vom VerifyEmailScreen
-// nach `?token=...`-parse. Server collapses alle Verify-Failures auf
-// `invalid_verification_token` (anti-enumeration, parallel zu reset).
+// POST /api/auth/verify-email. VerifyEmailScreen submits this automatically
+// after parsing `?token=...`. The server collapses all verification failures
+// into `invalid_verification_token` to prevent enumeration, as with reset.
 export async function verifyEmail(token) {
     const res = await fetch("/api/auth/verify-email", {
         method: "POST",
@@ -199,14 +199,13 @@ export async function confirmAccountUnlock(token) {
         return { ok: true };
     return { ok: false, error: await parseTokenFailure(res) };
 }
-// POST /api/auth/signup-request. Always-200 (anti-enumeration; wir
-// sagen nicht ob die Email schon registriert ist). Server schickt
-// Activation-Mail an die Adresse — beim Klick auf den Link landet der
-// User auf /signup/complete?token=… wo er sein Password setzt.
+// POST /api/auth/signup-request. Always returns 200 to prevent enumeration;
+// the response does not reveal whether the email is already registered. The
+// server sends an activation email to the address; following its link takes
+// the user to /signup/complete?token=… to set a password.
 export async function requestSignup(email, 
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): forwards a row-bound tenant-handover grant so the
-// server can verify + rebind it to the signup token. The grant never
+// Cross-device try-first handover: forwards a row-bound tenant-handover
+// grant so the server can verify + rebind it to the signup token. The grant never
 // travels any further than this request — never in the URL, the mail,
 // or the confirm response.
 handover) {
@@ -243,8 +242,8 @@ export async function confirmSignup(token, password) {
     }
     return { ok: false, error: await parseTokenFailure(res) };
 }
-// GET /api/auth/tenants. Liefert die Memberships des aktuellen Users;
-// der Server liefert 401 wenn das Cookie fehlt oder abgelaufen ist.
+// GET /api/auth/tenants. Returns the current user's memberships; the server
+// returns 401 when the cookie is missing or expired.
 export async function fetchTenants() {
     const res = await fetch("/api/auth/tenants", {
         method: "GET",
@@ -258,9 +257,9 @@ export async function fetchTenants() {
     // @cast-boundary engine-payload — HTTP-API contract, server-side schema-validated
     return (await res.json());
 }
-// POST /api/auth/switch-tenant. Mintet ein neues JWT für den Ziel-Tenant
-// und rotated beide Cookies. 400 wenn already_in_tenant oder tenant_
-// switch_not_available, 403 wenn not_a_member.
+// POST /api/auth/switch-tenant. Mints a new JWT for the target tenant and
+// rotates both cookies. Returns 400 for already_in_tenant or
+// tenant_switch_not_available, and 403 for not_a_member.
 export async function switchTenant(tenantId) {
     const res = await fetch("/api/auth/switch-tenant", {
         method: "POST",

package/dist/auth-email-password/web/auth-form-primitives.js

@@ -25,21 +25,21 @@ export function useAuthShell() {
 export function AuthCard({ title, subtitle, className, headerClassName, titleClassName, bodyClassName, children, }) {
     const { Card } = usePrimitives();
     const shell = useAuthShell() ?? defaultAuthShell;
-    // h1 (Seiten-Hauptüberschrift) via Header-Slot erhalten — die Card-Default-
-    // Header wäre h3. padded:false = Form sitzt randlos wie bisher (bare form).
+    // Keep an h1 (page heading) through the header slot; the Card's default
+    // header would be h3. padded:false keeps the form edge-to-edge as before
+    // (bare form).
     const card = (_jsx(Card, { className: cn("w-full max-w-sm", className), options: { padded: false }, slots: {
             header: title !== undefined || subtitle !== undefined ? (_jsxs("div", { className: cn("flex flex-col space-y-1.5 p-6 pb-4", headerClassName), children: [title !== undefined && (_jsx("h1", { className: cn("text-xl font-semibold tracking-tight", titleClassName), children: title })), subtitle !== undefined && (_jsx("p", { className: "text-sm text-muted-foreground", children: subtitle }))] })) : undefined,
         }, children: _jsx(BareFormProvider, { children: _jsx("div", { className: cn("p-6 pt-0 flex flex-col gap-4", bodyClassName), children: children }) }) }));
     return shell(card);
 }
-// Liest `?<paramName>=<value>` aus der aktuellen URL — typisches
-// Pattern für Token-bearing Pages (reset, verify). Returnt "" wenn der
-// Browser nicht da ist (SSR-safety) oder der Parameter fehlt.
+// Reads `?<paramName>=<value>` from the current URL, as used by token-bearing
+// pages (reset, verify). Returns "" during SSR or when the parameter is absent.
 //
-// Nicht über useState/useEffect - das wäre ein read-once-on-mount
-// pattern aber URL-changes sind hier irrelevant (Token-Pages re-loaden
-// für neue Tokens). Caller setzt useState(() => parseUrlToken(...)) wenn
-// gewünscht.
+// This is intentionally not read through useState/useEffect: that would be a
+// read-once-on-mount pattern, while URL changes are irrelevant here because
+// token pages reload for new tokens. Callers can use
+// useState(() => parseUrlToken(...)) when needed.
 export function parseUrlToken(paramName = "token") {
     if (typeof window === "undefined")
         return "";
@@ -47,7 +47,7 @@ export function parseUrlToken(paramName = "token") {
 }
 // Reads the magic-link token from `?<paramName>=` once on mount, then strips
 // that param from the URL via history.replaceState so the single-use token
-// doesn't linger in browser history / Referer (#774). An explicit `override`
+// doesn't linger in browser history / Referer. An explicit `override`
 // (server-injected token) short-circuits both the URL read and the scrub.
 export function useUrlToken(override, paramName = "token") {
     const [token] = useState(() => override ?? parseUrlToken(paramName));

package/dist/auth-email-password/web/auth-gate.js

@@ -1,13 +1,13 @@
 import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
-// Auth-Gate: rendert den LoginScreen solange der Session-Status
-// "unauthenticated" ist, sonst die Kinder. "loading" zeigt einen
-// minimalen Placeholder — die initiale Refresh-Runde liefert in der
-// Regel in <100ms, also kein Spinner-Overkill.
+// Auth gate: renders the LoginScreen while the session status is
+// "unauthenticated" and the children otherwise. "loading" shows a
+// minimal placeholder—the initial refresh usually completes in <100ms,
+// so a spinner would be excessive.
 //
-// Die Factory makeAuthGate schließt die LoginScreen-Komponente in,
-// damit das Gate der ClientFeatureDefinition-Signatur entspricht
-// (nur `{ children }`-Prop). Der Sample kann so einen eigenen Login-
-// Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
+// The makeAuthGate factory closes over the LoginScreen component so the
+// gate matches the ClientFeatureDefinition signature (only a `{ children }`
+// prop). This lets the sample configure a custom login screen without
+// replacing the gate.
 import { useLocale } from "@cosmicdrift/kumiko-renderer";
 import { useEffect, useMemo, useState } from "react";
 import { assertNavigableUrl, buildLoginRedirectUrl, followNextOrLandingAfterLogin, } from "./auth-redirect.js";
@@ -20,12 +20,11 @@ import { SessionBootstrapErrorScreen } from "./session-bootstrap-error.js";
 // their own standalone login route outside any gate (createPublicSurface
 // apex pages stack providers, not gates — see auth-mount.tsx recipes).
 // Handing an app raw LoginScreen + telling it to hand-roll the challenge-
-// token swap itself is exactly how kumiko-framework#266's login-time MFA
-// step went missing in a real apex surface; this prevents the *most common*
-// version of that mistake. MFA still only actually works once a consumer
-// wires `mfaVerifyScreen` — omitting it is a silent no-MFA fallback, not
-// something this route can catch on its own (auth-mfa is a separate,
-// optional package).
+// token swap itself is exactly how the login-time MFA step went missing in a
+// real apex surface; this prevents the *most common* version of that mistake.
+// MFA still only actually works once a consumer wires `mfaVerifyScreen` —
+// omitting it is a silent no-MFA fallback, not something this route can catch
+// on its own (auth-mfa is a separate, optional package).
 export function createLoginRoute(opts = {}) {
     const LoginComponent = opts.loginScreen ?? LoginScreen;
     const MfaVerifyComponent = opts.mfaVerifyScreen;
@@ -38,7 +37,7 @@ export function createLoginRoute(opts = {}) {
         // never considers this session authenticated until verify succeeds.
         const [challengeToken, setChallengeToken] = useState(null);
         const [setupRequest, setSetupRequest] = useState(null);
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         useEffect(() => {
             if (status === "authenticated")
                 onAuthenticated?.();
@@ -125,7 +124,7 @@ export function makeAuthGate(opts = {}) {
             ? resolveLoginRedirectOrNull(loginUrl, locale, { origin, pathname, search, hash })
             : null, [status, locale, origin, pathname, search, hash]);
         const redirectUrl = loginRedirect?.kind === "redirect" ? loginRedirect.url : null;
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         useEffect(() => {
             if (redirectUrl !== null)
                 window.location.replace(redirectUrl);

package/dist/auth-email-password/web/client-plugin.d.ts

@@ -3,9 +3,9 @@ import type { ComponentType, ReactNode } from "react";
 import { type AuthGateOptions, type MfaSetupComponentProps, type MfaVerifyComponentProps } from "./auth-gate.tsx";
 import type { LoginScreenProps } from "./login-screen.tsx";
 export type EmailPasswordClientOptions = {
-    /** Eigener Login-Screen. Default: der shadcn-stylte LoginScreen
-     *  aus diesem Modul. Für Branding- oder Layout-Overrides einfach
-     *  eine eigene Komponente mit derselben Signatur reichen. */
+    /** Custom login screen. Default: the shadcn-styled LoginScreen
+     *  from this module. Provide a component with the same signature for
+     *  branding or layout overrides. */
     readonly loginScreen?: ComponentType<LoginScreenProps>;
     readonly loginScreenProps?: LoginScreenProps;
     /** auth-mfa's MfaVerifyScreen, wired in from the app so this feature
@@ -26,10 +26,10 @@ export type EmailPasswordClientOptions = {
     readonly loginUrl?: AuthGateOptions["loginUrl"];
     /** Where logout navigates to (root-relative path or http(s) URL). Default: reload. */
     readonly postLogoutUrl?: string;
-    /** Key-Overrides pro Locale. Wird mit den Default-Bundles (de/en)
-     *  aus `translations.ts` gemerged — jeder hier gesetzte Key gewinnt.
-     *  Für Branding ("Sign in" → "Login to Acme") oder weitere Sprachen
-     *  (`fr`, `es`, …) zusätzlich. */
+    /** Per-locale key overrides. Merged with the default bundles (de/en)
+     *  from `translations.ts`; each key supplied here takes precedence.
+     *  Use this for branding ("Sign in" → "Login to Acme") or to add
+     *  further languages (`fr`, `es`, …). */
     readonly translations?: TranslationsByLocale;
     /** Serve the forgot-password, reset-password and unlock-account pages at
      *  their convention paths for signed-out visitors. Apps with their own

package/dist/auth-email-password/web/client-plugin.js

@@ -1,8 +1,7 @@
-// Client-Feature-Factory für auth-email-password. Wird vom App-Code
-// in createKumikoApp({ clientFeatures: [emailPasswordClient()] })
-// eingehängt und bringt Session-Context + AuthGate + Default-UI-
-// Translations (de/en) mit. Alles ist overridbar — Login-Screen,
-// Strings pro Locale, pro Key.
+// Client feature factory for auth-email-password. App code mounts it in
+// createKumikoApp({ clientFeatures: [emailPasswordClient()] }) to provide
+// session context, AuthGate, and default UI translations (de/en). All of
+// these can be overridden: the login screen and strings per locale and key.
 import { makeSessionAuthGate, } from "./auth-gate.js";
 import { emailPasswordClientActions } from "./client-actions.js";
 import { DefaultAuthPagesGate } from "./default-auth-pages-gate.js";

package/dist/auth-email-password/web/confirm-account-unlock-screen.js

@@ -16,7 +16,7 @@ export function ConfirmAccountUnlockScreen({ title, token: tokenProp, loginHref
     const token = useUrlToken(tokenProp);
     const [status, setStatus] = useState(token === "" ? "missing-token" : "verifying");
     const startedRef = useRef(false);
-    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
     useEffect(() => {
         if (status !== "verifying")
             return;

package/dist/auth-email-password/web/constants.js

@@ -15,7 +15,7 @@ export const AuthHandlers = {
     requestEmailVerification: "auth-email-password:write:request-email-verification",
     verifyEmail: "auth-email-password:write:verify-email",
     // Account-Unlock Magic-Link (fixes the lockout-DoS where the monotonic
-    // failure-counter re-locks immediately after expiry, #1266). Mirrors
+    // failure-counter re-locks immediately after expiry). Mirrors
     // reset: request mints an HMAC token + mails it, confirm clears the
     // Redis lockout state.
     requestAccountUnlock: "auth-email-password:write:request-account-unlock",
@@ -81,7 +81,7 @@ export const AuthErrors = {
     invalidSignupToken: "invalid_signup_token",
     signupNotConfigured: "signup_not_configured",
     // Self-signup: confirm rejects an already-registered email instead of
-    // reusing the existing user (account takeover, #365). NO
+    // reusing the existing user (account takeover). NO
     // anti-enumeration collapse like invalidSignupToken: whoever gets here
     // controls the inbox (has the magic link), so revealing "email exists"
     // is not new information.
@@ -101,7 +101,7 @@ export const AuthErrors = {
     // deliberate enumeration trade-off: the lockout event itself is already
     // observable to the attacker, and legit users benefit from a clear signal.
     accountLocked: "account_locked",
-    // S2.U6 (GDPR Art. 18) — account is in Restricted status. Login is
+    // (GDPR Art. 18) — account is in Restricted status. Login is
     // explicitly refused with its own code (not collapsed into
     // invalid_credentials) so the UI can say "account is currently paused,
     // click here to lift it". Enumeration leak accepted: restriction is

package/dist/auth-email-password/web/default-topbar-actions.d.ts

@@ -1,15 +1,15 @@
 import type { ReactNode } from "react";
 export type DefaultTopbarActionsProps = {
-    /** Mapped Tenant-ID auf einen sprechenden Namen (z.B. branded label
-     *  pro Tenant). TenantSwitcher's Default zeigt sonst die ersten 8
-     *  Zeichen der UUID. */
+    /** Maps a tenant ID to a human-readable name (for example, a branded label
+     *  per tenant). TenantSwitcher's default otherwise displays the first 8
+     *  characters of the UUID. */
     readonly tenantName?: (tenantId: string) => string;
-    /** Slot zwischen TenantSwitcher und ThemeToggle. Typischer Use-Case:
-     *  LanguageSwitcher pro App. ReactNode (nicht Array) damit die App
-     *  selbst Reihenfolge + Spacing bestimmt. */
+    /** Slot between TenantSwitcher and ThemeToggle. Typical use case:
+     *  an app-specific LanguageSwitcher. ReactNode, rather than an array, so the
+     *  app controls the ordering and spacing. */
     readonly extras?: ReactNode;
-    /** Light-Mode-Icon im ThemeToggle. Default: Unicode ☀. Apps die
-     *  Lucide-Icons o.ä. wollen, übergeben ein eigenes Icon-Element. */
+    /** Light-mode icon for ThemeToggle. Default: Unicode ☀. Apps that want
+     *  Lucide icons or similar can provide a custom icon element. */
     readonly lightIcon?: ReactNode;
     /** Dark-Mode-Icon. Default: Unicode ☾. */
     readonly darkIcon?: ReactNode;

package/dist/auth-email-password/web/default-topbar-actions.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// Standard-Topbar-Actions Komposition für Apps mit Auth + Workspaces.
-// Bündelt das Pattern das jeder App-Sample sonst hand-ausschreibt:
-// TenantSwitcher (links) → optional Extras (z.B. LanguageSwitcher) →
-// ThemeToggle → UserMenu (rechts). Apps mit eigener Anordnung
-// importieren weiter die Einzelkomponenten direkt — DefaultTopbarActions
-// ist Convenience, kein Muss.
+// Composes the standard top-bar actions for apps with auth and workspaces.
+// This bundles the pattern that each app sample would otherwise write by hand:
+// TenantSwitcher (left) → optional extras (for example, LanguageSwitcher) →
+// ThemeToggle → UserMenu (right). Apps with a custom arrangement can still
+// import the individual components directly; DefaultTopbarActions is
+// convenience, not a requirement.
 import { ThemeToggle } from "@cosmicdrift/kumiko-renderer/web";
 import { TenantSwitcher } from "./tenant-switcher.js";
 import { UserMenu } from "./user-menu.js";

package/dist/auth-email-password/web/forgot-password-screen.d.ts

@@ -2,8 +2,8 @@ import { type ReactNode } from "react";
 export type ForgotPasswordScreenProps = {
     readonly title?: string;
     readonly subtitle?: ReactNode;
-    /** href für den "Zurück zum Login"-Link in success + form. App-
-     *  spezifisch — Default "/login". */
+    /** href for the "Back to login" link in the success and form states. App-
+     * specific — defaults to "/login". */
     readonly loginHref?: string;
 };
 export declare function ForgotPasswordScreen({ title, subtitle, loginHref, }: ForgotPasswordScreenProps): ReactNode;

package/dist/auth-email-password/web/forgot-password-screen.js

@@ -1,13 +1,13 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// ForgotPasswordScreen — Form mit email-input. Submit triggert
-// /api/auth/request-password-reset (silent-success, kein account-
-// enumeration). UI zeigt unconditional ein "Wenn Account existiert,
-// Mail unterwegs"-Confirm — auch wenn der Server intern erkannt hat
-// dass die Email nicht existiert.
+// ForgotPasswordScreen — form with an email input. Submission triggers
+// /api/auth/request-password-reset (silent success, no account enumeration).
+// The UI always shows a "If an account exists, the email is on its way"
+// confirmation, even when the server determines internally that the email
+// does not exist.
 //
-// App ist verantwortlich, den Screen unter einer URL zu mounten (z.B.
-// /forgot-password) und ihn zu erreichen — der LoginScreen kann einen
-// "Passwort vergessen?"-Link auf die App-Route setzen.
+// The app is responsible for mounting and exposing the screen at a URL
+// (for example, /forgot-password); the LoginScreen can link to that app
+// route with a "Forgot password?" link.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestPasswordReset } from "./auth-client.js";
@@ -19,7 +19,7 @@ export function ForgotPasswordScreen({ title, subtitle, loginHref = "/login", })
     const [submitting, setSubmitting] = useState(false);
     const [done, setDone] = useState(false);
     const [error, setError] = useState(null);
-    // guard:dup-ok — gleiches Submit-Muster wie signup-screen, aber verschiedene API-Endpoints und State
+    // guard:dup-ok — same submission pattern as signup-screen, but with different API endpoints and state
     const doSubmit = async () => {
         setSubmitting(true);
         setError(null);

package/dist/auth-email-password/web/index.js

@@ -1,8 +1,8 @@
-// Public exports für die Browser-Seite des auth-email-password Features.
-// Wird über den Sub-Path-Export `@cosmicdrift/kumiko-bundled-features/auth-email-
-// password/web` konsumiert — die Server-Seite (defineFeature) lebt in
-// `@cosmicdrift/kumiko-bundled-features/auth-email-password` und hat keine
-// React-/DOM-Deps. Trennung bleibt sauber so wie renderer vs renderer/web.
+// Public exports for the browser side of the auth-email-password feature.
+// Consumed through the subpath export `@cosmicdrift/kumiko-bundled-features/auth-email-
+// password/web`; the server side (defineFeature) lives in
+// `@cosmicdrift/kumiko-bundled-features/auth-email-password` and has no
+// React-/DOM dependencies. This keeps the separation clean, like renderer vs renderer/web.
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";

package/dist/auth-email-password/web/invite-accept-screen.d.ts

@@ -12,7 +12,7 @@ export type InviteAcceptScreenProps = {
         tenantId: string;
         roles: readonly string[];
     }) => string);
-    /** Login-Href für "Mit anderem Account anmelden". Default "/login". */
+    /** Login href for "Mit anderem Account anmelden". Default "/login". */
     readonly loginHref?: string;
 };
 export declare function InviteAcceptScreen({ title, token: tokenProp, loggedInHref, loginHref, }: InviteAcceptScreenProps): ReactNode;

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -1,20 +1,20 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// InviteAcceptScreen — Magic-Link-Accept für Tenant-Invitations.
+// InviteAcceptScreen — accepts tenant invitations through a magic link.
 //
-// Liest `?token=...` aus der URL und branched intern je nach session-state:
-//   - Logged-in + Email-Match: 1-click accept (Branch 1, dispatcher
-//     invite-accept). Bei Email-Mismatch zeigen wir die fehlermeldung
-//     und einen "Mit anderem Account anmelden"-Link.
-//   - Anonymous: Email + Password-Form. Toggle "Schon einen Account?"
-//     entscheidet Branch 2 (existing user, login + accept) vs Branch 3
-//     (neuer user, signup + accept).
+// Reads `?token=...` from the URL and selects a flow based on session state:
+//   - Logged in with a matching email: one-click accept (Branch 1, via the
+//     invite-accept dispatcher). For an email mismatch, show an error and a
+//     "Sign in with a different account" link.
+//   - Anonymous: email and password form. The "Already have an account?" toggle
+//     selects Branch 2 (existing user, login + accept) or Branch 3 (new user,
+//     signup + accept).
 //
-// Anti-enumeration: invalidInviteToken collapsed alle Token/User/
-// Password-Failures auf einen Code (gleicher Trade-off wie reset).
+// Anti-enumeration: invalidInviteToken collapses token, user, and password
+// failures into one code, using the same trade-off as reset.
 //
-// Auto-Login: Branch 2+3 setzen Cookies via Server, Frontend redirected
-// zu loggedInHref. Branch 1 hat schon eine Session — Frontend redirected
-// auch zu loggedInHref damit der invitee in seinem neuen Tenant landet.
+// Auto-login: Branches 2 and 3 set cookies through the server, then the
+// frontend redirects to loggedInHref. Branch 1 already has a session, but the
+// frontend also redirects to loggedInHref so the invitee enters the new tenant.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useContext, useState } from "react";
 import { csrfHeader } from "./auth-client.js";
@@ -60,7 +60,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     const acceptLoggedIn = async () => {
         setSubmitting(true);
         setError(null);
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         const res = await fetch("/api/auth/invite-accept", {
             method: "POST",
             credentials: "same-origin",
@@ -79,7 +79,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     const acceptAnonExisting = async () => {
         setSubmitting(true);
         setError(null);
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         const res = await fetch("/api/auth/invite-accept-with-login", {
             method: "POST",
             credentials: "same-origin",
@@ -98,7 +98,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     const acceptAnonNew = async () => {
         setSubmitting(true);
         setError(null);
-        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
         const res = await fetch("/api/auth/invite-signup-complete", {
             method: "POST",
             credentials: "same-origin",

package/dist/auth-email-password/web/login-screen.d.ts

@@ -12,7 +12,7 @@ export type LoginScreenProps = {
      *  default path once the server offers the reset flow (login-options);
      *  `null` hides the link deliberately. */
     readonly forgotPasswordHref?: string | null;
-    /** Optional href to RequestAccountUnlockScreen (#1266). When set, an
+    /** Optional href to RequestAccountUnlockScreen. When set, an
      *  account_locked login error renders an "Unlock account?" link inline —
      *  the account-lockout escape hatch, since forgotPasswordHref does NOT
      *  help here: the lockout gate blocks login before password verify even

package/dist/auth-email-password/web/login-screen.js

@@ -9,9 +9,8 @@ import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.j
 import { followNextOrLandingAfterLogin } from "./auth-redirect.js";
 import { AuthQueries } from "./constants.js";
 import { useSession } from "./session.js";
-// Map vom Reason-Code des Login-Handlers auf einen i18n-Key plus
-// optional extrahierte Interpolations-Parameter. Ungekannte Codes
-// fallen auf `auth.errors.loginFailed` zurück.
+// Maps login-handler reason codes to i18n keys and optional interpolation parameters.
+// Unknown codes fall back to `auth.errors.loginFailed`.
 function reasonToKey(failure) {
     switch (failure.reason) {
         case "invalid_credentials":

package/dist/auth-email-password/web/reset-password-screen.d.ts

@@ -1,11 +1,11 @@
 import { type ReactNode } from "react";
 export type ResetPasswordScreenProps = {
     readonly title?: string;
-    /** Override für den Token aus der URL — Apps die per server-side-
-     *  Render einen Token reinreichen, brauchen das. Default: parsed aus
-     *  `?token=...` in der URL. */
+    /** Override for the token from the URL. Apps that pass a token during
+     * server-side rendering need this. Default: parsed from `?token=...` in
+     * the URL. */
     readonly token?: string;
-    /** href für "Zum Login"-Link nach Success. Default "/login". */
+    /** href for the "Zum Login" link after success. Default "/login". */
     readonly loginHref?: string;
 };
 export declare function ResetPasswordScreen({ title, token: tokenProp, loginHref, }: ResetPasswordScreenProps): ReactNode;

package/dist/auth-email-password/web/reset-password-screen.js

@@ -1,14 +1,13 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// ResetPasswordScreen — liest `?token=...` aus der URL, zeigt Form mit
-// new + confirm-password. Submit triggert /api/auth/reset-password mit
-// dem Token. Server collapses alle Token-Verify-Failures auf einen
-// Code (anti-enumeration); UI zeigt unified "Link ungültig oder
-// abgelaufen"-message.
+// ResetPasswordScreen reads `?token=...` from the URL and shows fields for
+// a new and confirmed password. Submission calls /api/auth/reset-password
+// with the token. The server collapses all token-verification failures into
+// one code (anti-enumeration), so the UI shows the unified "link invalid or
+// expired" message.
 //
-// Token-Quelle ist read-once via useUrlToken(): liest `?token=...` beim
-// Mount und scrubbt den Param danach aus der URL (#774). Apps die das
-// anders brauchen (server-injected Token-Prop) reichen `token` als Prop
-// durch — dann bleibt die URL unangetastet.
+// The token is read once via useUrlToken(): `?token=...` is read on mount and
+// then scrubbed from the URL. Apps that need different behavior can pass a
+// server-injected token through the `token` prop; the URL is then left intact.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { resetPassword } from "./auth-client.js";
@@ -56,10 +55,10 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
         void doSubmit();
     };
     const effectiveTitle = title ?? t("auth.resetPassword.title");
-    // Kein Token in der URL → User soll den Link aus seiner Mail nochmal
-    // klicken oder einen neuen Reset anfordern. Form ohne Token zu
-    // submitten würde nur den invalidResetToken-Error zeigen — das ist
-    // verwirrend. Lieber upfront eine klare Message.
+    // No token in the URL: the user should click the link from their email again
+    // or request a new reset. Submitting without a token would only show the
+    // invalidResetToken error, which is confusing, so show a clear message
+    // immediately instead.
     if (token === "") {
         return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }));
     }