@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/auth-email-password/web/session.d.ts

@@ -11,11 +11,12 @@ export type SessionState = {
     readonly user: CurrentUserProfile | null;
     readonly activeTenantId: string | null;
     readonly tenants: readonly TenantSummary[];
-    /** Merged session-roles für den active tenant: globalRoles (z.B.
-     *  SystemAdmin) + membership-roles des activeTenant. Server hat sie
-     *  schon im JWT gemerged, aber das JWT ist HttpOnly + nicht JS-lesbar;
-     *  Client computed dieselbe merge-Logik aus user.globalRoles +
-     *  tenants[active].roles damit nav-filtering greift. Dedupliziert. */
+    /** Merged session roles for the active tenant: globalRoles (for example,
+     *  SystemAdmin) plus the active tenant's membership roles. The server has
+     *  already merged them into the JWT, but the JWT is HttpOnly and cannot be
+     *  read by JavaScript; the client computes the same merge from
+     *  user.globalRoles + tenants[active].roles so navigation filtering works.
+     *  The result is deduplicated. */
     readonly roles: readonly string[];
     readonly bootstrapFailure: SessionBootstrapFailure | null;
     /** Set when an authenticated session was ended server-side (revoked,
@@ -35,10 +36,10 @@ export type SessionApi = SessionState & {
 export declare const UNAUTHENTICATED: SessionState;
 export declare function hasLikelyAuthSession(cookieSource?: string): boolean;
 export declare function computeActiveRoles(user: CurrentUserProfile | null, activeTenantId: string | null, tenants: readonly TenantSummary[]): readonly string[];
-/** Internal — exposed for tests die einen Mock-SessionApi-Wert reinreichen
- *  wollen, ohne durch SessionProvider's refresh-Lifecycle zu müssen. App-
- *  Code nutzt SessionProvider + useSession; direkter Context-Zugriff ist
- *  für Tests/Stories. */
+/** Internal — exposed so tests can pass a mock SessionApi value
+ *  without going through SessionProvider's refresh lifecycle. Application
+ *  code uses SessionProvider + useSession; direct context access is
+ *  intended for tests/stories. */
 export declare const SessionContext: import("react").Context<SessionApi | undefined>;
 export declare function SessionProvider({ children, postLogoutUrl, }: {
     readonly children: ReactNode;

package/dist/auth-email-password/web/session.js

@@ -1,13 +1,13 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// Session-State für den Browser-Renderer. Hält den aktuell eingeloggten
-// User (Profile + aktive Tenant-Zuordnung + Memberships), reagiert auf
-// Login/Logout/Switch-Tenant und refresh't die Daten automatisch.
+// Session state for the browser renderer. Holds the currently signed-in
+// user (profile + active tenant assignment + memberships), responds to
+// login/logout/tenant switching, and refreshes the data automatically.
 //
-// Warum Context + useReducer statt z.B. Zustand? Weil die State-Menge
-// klein ist (ein Handful Felder, ein paar Transitionen) und wir damit
-// eine Dependency weniger im Browser-Bundle haben. Die Consumer leben
-// unter `<SessionProvider>`; der `useSession()`-Hook liefert den State
-// und die Transitions.
+// Context + useReducer is used instead of, for example, Zustand because
+// the state is small (a handful of fields and a few transitions), avoiding
+// another dependency in the browser bundle. Consumers live under
+// `<SessionProvider>`; the `useSession()` hook provides the state
+// and transitions.
 import { CurrentUserProvider, useSessionEndedSignal, } from "@cosmicdrift/kumiko-renderer";
 import { readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
@@ -34,14 +34,14 @@ const INITIAL = {
     bootstrapFailure: null,
     signedOutReason: null,
 };
-// kumiko_auth ist HttpOnly — kumiko_csrf wird beim Login gemeinsam gesetzt.
+// kumiko_auth is HttpOnly; kumiko_csrf is set together with it at login.
 export function hasLikelyAuthSession(cookieSource) {
     return readCsrfToken(cookieSource) !== undefined;
 }
-// Exported damit tests den merge-pfad direkt pinnen können — der hier
-// muss byte-identisch zum server-side merge in auth-routes.ts +
-// login.write.ts sein, sonst sieht der Client andere session-rollen
-// als der Server.
+// Exported so tests can pin the merge path directly: this must be
+// byte-identical to the server-side merge in auth-routes.ts +
+// login.write.ts, otherwise the client sees different session roles
+// from the server.
 export function computeActiveRoles(user, activeTenantId, tenants) {
     if (user === null)
         return [];
@@ -51,13 +51,13 @@ export function computeActiveRoles(user, activeTenantId, tenants) {
     // login.write.ts).
     return Array.from(new Set([...user.globalRoles, ...membershipRoles]));
 }
-/** Internal — exposed for tests die einen Mock-SessionApi-Wert reinreichen
- *  wollen, ohne durch SessionProvider's refresh-Lifecycle zu müssen. App-
- *  Code nutzt SessionProvider + useSession; direkter Context-Zugriff ist
- *  für Tests/Stories. */
+/** Internal — exposed so tests can pass a mock SessionApi value
+ *  without going through SessionProvider's refresh lifecycle. Application
+ *  code uses SessionProvider + useSession; direct context access is
+ *  intended for tests/stories. */
 export const SessionContext = createContext(undefined);
-// Eine Refresh-Runde: /auth/tenants → wenn 401 nicht-eingeloggt, sonst
-// /user:me. Beides zusammen ergibt den vollen SessionState.
+// One refresh round: /auth/tenants → if 401, unauthenticated; otherwise
+// /user:me. Together, both requests produce the complete SessionState.
 async function refresh() {
     if (!hasLikelyAuthSession()) {
         return UNAUTHENTICATED;
@@ -103,14 +103,14 @@ export function SessionProvider({ children, postLogoutUrl, }) {
             setState({ ...UNAUTHENTICATED, status: "error", bootstrapFailure: toBootstrapFailure(err) });
         }
     }, []);
-    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
     useEffect(() => {
         void doRefresh();
     }, [doRefresh]);
     const sessionEndedSignal = useSessionEndedSignal();
     // Only an authenticated session can "end": an anonymous 401 on a public
     // surface must not show the hint.
-    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
     useEffect(() => {
         return sessionEndedSignal?.subscribe(() => {
             setState((prev) => prev.status === "authenticated"
@@ -134,20 +134,19 @@ export function SessionProvider({ children, postLogoutUrl, }) {
             return;
         }
         setState(UNAUTHENTICATED);
-        // Hard-Reload: React-Tree, dispatcher-live-Caches, EventSource —
-        // alles fliegt auf Null. Nach Logout ist das der billigste Weg zu
-        // sauberer Ausgangslage, ohne dass wir jeden einzelnen Consumer
-        // per Context-Bust invalidieren müssen.
+        // Hard reload: the React tree, dispatcher live caches, and EventSource
+        // are all reset. After logout, this is the cheapest way to reach a clean
+        // state without having to invalidate every consumer through a context
+        // reset.
         if (typeof window !== "undefined") {
             window.location.reload();
         }
     }, [postLogoutUrl]);
     const switchTenant = useCallback(async (tenantId) => {
         await switchTenantApi(tenantId);
-        // Tenant-Wechsel rotiert JWT + Cookies. React-Tree enthält
-        // tenant-gebundene Caches (Queries, Live-Events) — simpler
-        // Reload ist konsistent mit dem Logout-Pfad und vermeidet
-        // halbe State-Übergänge.
+        // Tenant switching rotates the JWT + cookies. The React tree contains
+        // tenant-bound caches (queries, live events), so a simple reload is
+        // consistent with the logout path and avoids partial state transitions.
         if (typeof window !== "undefined") {
             window.location.reload();
         }

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -6,7 +6,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // JWT + cookies (auto-login!) and returns the tenantKey.
 //
 // Token source is read-once via useUrlToken: reads `?token=...` on mount
-// and scrubs the param from the URL afterwards (#774). Apps that inject a
+// and scrubs the param from the URL afterwards. Apps that inject a
 // server-side token pass `token` as a prop instead.
 //
 // On success: shows a confirmation (account active, signed in) with a
@@ -82,8 +82,8 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
         (continueHref !== null
             ? t("auth.signupComplete.activatedTitle")
             : t("auth.signupComplete.title"));
-    // Kein Token in der URL → klare Message statt Form ohne Token
-    // (würde nur invalidSignupToken zeigen, verwirrend).
+    // No token in the URL → show a clear message instead of a form without a token
+    // (which would only show invalidSignupToken and confuse the user).
     if (token === "") {
         return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] }));
     }

package/dist/auth-email-password/web/signup-screen.d.ts

@@ -2,7 +2,7 @@ import { type ReactNode } from "react";
 export type SignupScreenProps = {
     readonly title?: string;
     readonly subtitle?: ReactNode;
-    /** href für den "Bereits einen Account?"-Link. App-spezifisch — Default
+    /** href for the "Already have an account?" link. App-specific; defaults to
      *  "/login". */
     readonly loginHref?: string;
 };

package/dist/auth-email-password/web/signup-screen.js

@@ -1,16 +1,16 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// SignupScreen — Magic-Link-Self-Signup, Step 1.
+// SignupScreen — Magic-Link self-signup, Step 1.
 //
-// Form mit Email-Input. Submit triggert /api/auth/signup-request
-// (silent-success, kein account-enumeration). UI zeigt unconditional
-// ein "Mail unterwegs"-Confirm mit Resend-Button — auch wenn die Email
-// schon registriert ist (Server schickt dann dieselbe Mail mit dem
-// existing Token aus Redis = idempotent).
+// Form with an email input. Submission triggers /api/auth/signup-request
+// (silent success, no account enumeration). The UI always shows a
+// "email on its way" confirmation with a Resend button, even if the email
+// is already registered (the server then sends the same email with the
+// existing token from Redis, making the request idempotent).
 //
-// App ist verantwortlich, den Screen unter einer URL zu mounten (z.B.
-// /signup) und ihn anonymous reachable zu machen (AuthPathGate VOR
-// AuthGate). Apex-Marketing kann via Link "Kostenlos starten" auf den
-// /signup-Pfad routen.
+// The app is responsible for mounting the screen at a URL (e.g.
+// /signup) and making it anonymously reachable (AuthPathGate before
+// AuthGate). An apex marketing site can route its "Start for free" link to
+// the /signup path.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestSignup } from "./auth-client.js";
@@ -53,9 +53,9 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         void doSubmit();
     };
     const onResend = async () => {
-        // Resend nutzt den gleichen Endpunkt — Server returnt den existing
-        // Token aus Redis und schickt eine zweite Mail mit dem GLEICHEN
-        // Activation-Link (alte Mail bleibt also gültig).
+        // Resend uses the same endpoint: the server returns the existing
+        // token from Redis and sends a second email with the SAME
+        // activation link, so the old email remains valid.
         setSubmitting(true);
         setError(null);
         try {

package/dist/auth-email-password/web/tenant-switcher.d.ts

@@ -1,9 +1,9 @@
 import { type ReactNode } from "react";
 export type TenantSwitcherProps = {
-    /** Optional: liefert einen menschenlesbaren Namen pro Tenant-ID.
-     *  Default: die ID wird direkt angezeigt (kurze UUID genügt für
-     *  Dev-Umgebungen). Für prod sollte der Host z.B. die Tenant-Namen
-     *  beim Login cachen und hier durchreichen. */
+    /** Optional: provides a human-readable name for each tenant ID.
+     *  Default: displays the ID directly (a short UUID is sufficient for
+     *  development environments). In production, the host should cache
+     *  tenant names at login and pass them here. */
     readonly tenantName?: (tenantId: string) => string;
 };
 export declare function TenantSwitcher({ tenantName }: TenantSwitcherProps): ReactNode;

package/dist/auth-email-password/web/tenant-switcher.js

@@ -1,18 +1,17 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// TenantSwitcher — kleines Dropdown, zeigt den aktiven Tenant und
-// erlaubt Wechsel zu anderen Memberships. Auf Radix-DropdownMenu für
-// konsistentes Verhalten (Click-outside/Escape/Keyboard-Nav).
+// TenantSwitcher — compact dropdown showing the active tenant and
+// allowing switches to other memberships. Uses Radix-DropdownMenu for
+// consistent click-outside, Escape, and keyboard-navigation behavior.
 //
-// Rendert NICHT wenn kein User eingeloggt ist und auch NICHT wenn der
-// User nur einen Tenant hat (Single-Tenant-Apps brauchen keinen
-// Switcher).
+// Does NOT render when no user is logged in or when the user has only one
+// tenant (single-tenant apps do not need a switcher).
 //
-// Der Display-Name kommt aus einem optionalen `tenantName`-Prop
-// oder fallback zum ID-Hash. Design-Entscheidung: der TenantSwitcher
-// holt NICHT selbst tenant:query:me — das würde Round-Trips pro Mount
-// kosten und bräuchte Query-Caching-Infrastruktur. Stattdessen reicht
-// der Host den Resolver rein (kommt z.B. aus einer useTenantNames()-
-// Hook die einmalig am App-Boot geladen wird).
+// The display name comes from the optional `tenantName` prop or falls back
+// to the ID hash. Design decision: TenantSwitcher does NOT fetch
+// tenant:query:me itself, which would cost round trips per mount and
+// require query-caching infrastructure. Instead, the host passes in the
+// resolver (for example, from a useTenantNames() hook loaded once at app
+// boot).
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { cn, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuLabel, DropdownMenuTrigger, } from "@cosmicdrift/kumiko-renderer/web";
 import { Building2, ChevronDown } from "lucide-react";
@@ -30,25 +29,25 @@ export function TenantSwitcher({ tenantName }) {
             await switchTenant(tenantId);
         }
         finally {
-            // In der Praxis führt switchTenant zu einem full-page reload,
-            // also sehen wir den cleared-state nie — das `finally` ist nur
-            // für den Edge-Case dass switchTenant throwt, damit die UI
-            // nicht mit dem Spinner hängen bleibt.
+            // In practice, switchTenant causes a full-page reload, so we never see
+            // the cleared state — `finally` only handles the edge case where
+            // switchTenant throws, preventing the UI from remaining stuck with
+            // the spinner.
             setSwitching(null);
         }
     }, [activeTenantId, switchTenant]);
-    // Label-Priorität: App-eigener Resolver (Prop) > Server-geliefertes
-    // name/key aus /auth/tenants > UUID-Präfix. Letzteres ist nur noch der
-    // Notnagel — bei Seed-Tenants (00000000-…) ist es ununterscheidbar.
+    // Label priority: app-provided resolver (prop) > server-provided
+    // name/key from /auth/tenants > UUID prefix. The latter is only a
+    // last resort — it is indistinguishable for seeded tenants (00000000-…).
     const nameOf = (tenantId) => {
         if (tenantName !== undefined)
             return tenantName(tenantId);
         const membership = tenants.find((m) => m.tenantId === tenantId);
-        // || statt ??: ein leerer name/key-String darf nicht als Label durchrutschen.
+        // || instead of ??: an empty name/key string must not be used as a label.
         return membership?.name || membership?.key || tenantId.slice(0, 8);
     };
-    // Rendering-Gate: kein User → nix; nur ein Tenant → auch nix
-    // (Single-Tenant-Apps brauchen keinen Switcher).
+    // Rendering gate: no user → nothing; only one tenant → nothing as well
+    // (single-tenant apps do not need a switcher).
     if (user === null || tenants.length <= 1)
         return null;
     const activeLabel = activeTenantId !== null ? nameOf(activeTenantId) : t("auth.tenant.switcher.none");

package/dist/auth-email-password/web/use-shell-user.js

@@ -1,18 +1,17 @@
-// Liest den eingeloggten User + die Rollen aus dem aktiven Tenant aus
-// der Session. Der Hook ist die Standard-Brücke zwischen Session-State
-// und Layout-Komponenten (WorkspaceShell.user, DefaultAppShell-Gates,
-// custom permission checks).
+// Reads the logged-in user and roles for the active tenant from the session.
+// This hook is the standard bridge between session state and layout components
+// (WorkspaceShell.user, DefaultAppShell gates, custom permission checks).
 //
-// Returns undefined solange:
-//   - die Session lädt (status="loading")
-//   - der User unauthenticated ist
-//   - der activeTenantId in der tenants-Liste fehlt (defensiver Pfad —
-//     sollte nicht passieren, schadet aber nicht zu prüfen)
+// Returns undefined while:
+//   - the session is loading (status="loading")
+//   - the user is unauthenticated
+//   - activeTenantId is missing from the tenants list (a defensive path that
+//     should not occur, but is harmless to check)
 //
-// WorkspaceShell + DefaultAppShell akzeptieren undefined als "keine
-// Workspaces sichtbar", was im Loading-/Logged-Out-Fall die richtige UX
-// ist. Apps die mehr brauchen (Loading-Indicator etc.) prüfen
-// useSession().status direkt.
+// WorkspaceShell and DefaultAppShell treat undefined as "no workspaces
+// visible", which is the correct UX while loading or logged out. Apps that
+// need more (such as a loading indicator) should check useSession().status
+// directly.
 import { useMemo } from "react";
 import { useSession } from "./session.js";
 export function useShellUser() {

package/dist/auth-email-password/web/user-menu.d.ts

@@ -1,11 +1,11 @@
 import type { ReactNode } from "react";
 export type UserMenuVariant = "pill" | "sidebar";
 export type UserMenuProps = {
-    /** Zusätzliche Menu-Items über dem Logout. Per-item class/behaviour
-     *  controlliert der Caller — wir packen nur den Frame drumrum. */
+    /** Additional menu items above logout. The caller controls per-item
+     *  classes and behavior; this component only provides the surrounding frame. */
     readonly children?: ReactNode;
-    /** "pill" (Default) = kompakter Topbar-Trigger; "sidebar" = volle NavUser-
-     *  Row (Avatar + Name + Email) für den `sidebarFooter`-Slot der App-Shell.
+    /** "pill" (default) = compact top-bar trigger; "sidebar" = full NavUser-
+     *  row (avatar + name + email) for the App-Shell's `sidebarFooter` slot.
      *  Requires a `SidebarProvider` ancestor — the default App-Shell
      *  `sidebarFooter` slot already provides one. */
     readonly variant?: UserMenuVariant;

package/dist/auth-email-password/web/user-menu.js

@@ -1,21 +1,20 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// UserMenu — Avatar-Dropdown für die Topbar (variant="pill", Default) oder den
-// Sidebar-Footer (variant="sidebar" = die sidebar-07-NavUser-Row). Zeigt
-// Name/Email + Logout. Auf Radix-DropdownMenu, damit Click-outside, Escape,
-// Focus-Management, Keyboard-Nav (↑↓/Home/End) und ARIA-Roles aus der Kiste
-// funktionieren.
+// UserMenu — avatar dropdown for the top bar (variant="pill", default) or the
+// sidebar footer (variant="sidebar" = the sidebar-07-NavUser-Row). Shows
+// name/email and logout. Uses Radix-DropdownMenu so click-outside, Escape,
+// focus management, keyboard navigation (↑↓/Home/End), and ARIA roles work
+// out of the box.
 //
-// Rendert NICHTS wenn kein User eingeloggt ist — Hosts dürfen das
-// Component außerhalb des AuthGate einhängen ohne dass ein harter
-// Fehler entsteht.
+// Renders nothing when no user is logged in, so hosts can mount the component
+// outside AuthGate without causing a hard error.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { cn, DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuLabel, DropdownMenuSeparator, DropdownMenuTrigger, SidebarMenu, SidebarMenuButton, SidebarMenuItem, } from "@cosmicdrift/kumiko-renderer/web";
 import { ChevronDown, ChevronsUpDown, LogOut } from "lucide-react";
 import { useSession } from "./session.js";
 function initials(value) {
-    // Vor- und Nachname falls Displayname einen Spacebar hat, sonst
-    // erste zwei Chars der Email-Lokalseite. Deterministisch,
-    // damit der Avatar-Content nicht bei jedem Re-Render flattert.
+    // Uses the first and last name when the display name contains a space;
+    // otherwise uses the first two characters of the email local part. This is
+    // deterministic, so the avatar content does not change between re-renders.
     const trimmed = value.trim();
     if (trimmed.length === 0)
         return "?";
@@ -34,8 +33,8 @@ export function UserMenu({ children, variant = "pill" }) {
     const displayName = hasName ? user.displayName : user.email;
     const avatarText = initials(displayName);
     const content = (_jsxs(DropdownMenuContent, { align: variant === "sidebar" ? "start" : "end", "aria-label": t("auth.user.menu.label"), children: [_jsxs(DropdownMenuLabel, { className: "text-xs", children: [_jsx("div", { className: "font-medium text-foreground truncate", children: displayName }), hasName && _jsx("div", { className: "truncate", children: user.email })] }), _jsx(DropdownMenuSeparator, {}), children !== undefined && (_jsxs(_Fragment, { children: [children, _jsx(DropdownMenuSeparator, {})] })), _jsxs(DropdownMenuItem, { "data-testid": "user-menu-logout", onSelect: () => void logout(), children: [_jsx(LogOut, { className: "h-4 w-4" }), _jsx("span", { children: t("auth.user.menu.logout") })] })] }));
-    // Sidebar-Footer: volle NavUser-Row (sidebar-07) als Dropdown-Trigger —
-    // gleiche Optik wie SidebarUser, aber klickbar mit Logout/Profil.
+    // Sidebar footer: full NavUser row (sidebar-07) as the dropdown trigger —
+    // matches SidebarUser visually while providing clickable logout/profile actions.
     if (variant === "sidebar") {
         return (_jsx(SidebarMenu, { children: _jsx(SidebarMenuItem, { children: _jsxs(DropdownMenu, { children: [_jsx(DropdownMenuTrigger, { asChild: true, children: _jsxs(SidebarMenuButton, { size: "lg", className: "data-[state=open]:bg-sidebar-accent data-[state=open]:text-sidebar-accent-foreground", children: [_jsx("span", { "aria-hidden": "true", className: "flex size-7 shrink-0 items-center justify-center rounded-full bg-sidebar-accent text-xs font-medium text-sidebar-accent-foreground", children: avatarText }), _jsxs("div", { className: "grid flex-1 text-left text-sm leading-tight", children: [_jsx("span", { className: "truncate font-medium text-sidebar-foreground", children: displayName }), hasName && (_jsx("span", { className: "truncate text-xs text-sidebar-muted", children: user.email }))] }), _jsx(ChevronsUpDown, { className: "ml-auto size-4 text-sidebar-muted" })] }) }), content] }) }) }));
     }

package/dist/auth-email-password/web/verify-email-screen.d.ts

@@ -1,9 +1,9 @@
 import { type ReactNode } from "react";
 export type VerifyEmailScreenProps = {
     readonly title?: string;
-    /** Override für Token aus URL. Default: parsed aus `?token=...`. */
+    /** Override the token from the URL. Default: parsed from `?token=...`. */
     readonly token?: string;
-    /** href für "Zum Login"-Link. Default "/login". */
+    /** href for the "Zum Login" link. Default "/login". */
     readonly loginHref?: string;
 };
 export declare function VerifyEmailScreen({ title, token: tokenProp, loginHref, }: VerifyEmailScreenProps): ReactNode;

package/dist/auth-email-password/web/verify-email-screen.js

@@ -1,14 +1,13 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// VerifyEmailScreen — liest `?token=...` aus URL, schickt ihn auto an
-// /api/auth/verify-email beim Mount, zeigt success/error. Idempotent
-// auf Server-Seite (mehrfaches Klicken setzt emailVerified=true erneut),
-// also kein Re-Submit-Risiko.
+// VerifyEmailScreen — reads `?token=...` from the URL and automatically sends it to
+// /api/auth/verify-email on mount, then shows success/error. The server-side
+// operation is idempotent (repeating it sets emailVerified=true again), so
+// retries are safe.
 //
-// useEffect mit empty-deps + once-Guard damit React Strict-Mode den
-// Verify-Call nur einmal feuert (Strict-Mode dispatched useEffect 2x in
-// dev). Token-roundtrip ist server-side single-use, aber wir wollen
-// nicht den ersten valid-call beim Mount und den zweiten als invalid-
-// Banner sehen.
+// The empty-deps effect and once guard prevent React Strict Mode from firing
+// the verification call twice (Strict Mode dispatches useEffect twice in dev).
+// The token roundtrip is single-use server-side, but this avoids showing an
+// invalid-token banner after the first valid mount call.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useEffect, useRef, useState } from "react";
 import { verifyEmail } from "./auth-client.js";
@@ -19,7 +18,7 @@ export function VerifyEmailScreen({ title, token: tokenProp, loginHref = "/login
     const token = useUrlToken(tokenProp);
     const [status, setStatus] = useState(token === "" ? "missing-token" : "verifying");
     const startedRef = useRef(false);
-    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
     useEffect(() => {
         if (status !== "verifying")
             return;

package/dist/auth-foundation/boot-checks.js

@@ -1,5 +1,5 @@
 // Multiplicity boot-check for auth-foundation's `tokenVerifier` extension
-// point (#1368, #1570). Two static-shape conflicts a boot-check CAN catch (a
+// point. Two static-shape conflicts a boot-check CAN catch (a
 // runtime shape-match predicate's overlap can't be proven at boot): a
 // malformed plugin registration, and two providers both claiming the same
 // shape (resolveTokenVerifier can't tell them apart). Zero tokenVerifier
@@ -30,7 +30,7 @@ export function validateTokenVerifierMultiplicity(features) {
     }
     if (namesByShape.size === 0) {
         // Session-only apps (email-password + sessions) never hit tokenVerifier —
-        // cookie JWT auth uses sessionStore alone (#1570 / phronexsis#296).
+        // cookie JWT auth uses sessionStore alone.
         for (const feature of features) {
             for (const usage of feature.extensionUsages) {
                 // skip: sessionStore present — tokenVerifier optional for cookie-session apps.
@@ -79,7 +79,7 @@ function validateSingleProvider(features, opts) {
             `only one ${label} provider may be mounted at a time.`);
     }
 }
-// Multiplicity boot-check for the `sessionStore` extension point (#1370).
+// Multiplicity boot-check for the `sessionStore` extension point.
 // Single-provider, unlike tokenVerifier — no shape to route on, so ≥2 fails
 // boot. Zero registrations is a valid configuration (see
 // validateSingleProvider doc) — a pure machine API using auth-foundation for
@@ -93,7 +93,7 @@ export function validateSessionStoreMultiplicity(features) {
         shapeHint: "SessionStoreProvider — options must have a { build } shape",
     });
 }
-// Optional single-provider (#1373). Zero registrations = OK (single-tenant /
+// Optional single-provider. Zero registrations = OK (single-tenant /
 // header-cookie path). ≥2 or malformed = boot fail.
 export function validateTenantResolverMultiplicity(features) {
     validateSingleProvider(features, {

package/dist/auth-foundation/resolve-anonymous-access.d.ts

@@ -1,6 +1,6 @@
 /**
  * Merge app-facing AnonymousAccessConfig with auth-foundation tenant providers.
- * Providers win over any leftover callback fields (hard cutover #1374).
+ * Providers win over any leftover callback fields.
  * Test stacks may still pass Resolved callbacks when no provider is mounted.
  */
 import type { AnonymousAccessConfig, AnonymousAccessResolved } from "@cosmicdrift/kumiko-framework/api";

package/dist/auth-foundation/resolve-anonymous-access.js

@@ -10,7 +10,7 @@ export async function resolveAnonymousAccessFromRegistry(base, deps) {
     // (EXT_TENANT_RESOLVER/EXT_TENANT_EXISTENCE) alone must never make
     // anonymousAccess become defined for an app that never set it — that
     // would upgrade every roles:["anonymous"] handler to reachable without
-    // a JWT the moment such a routing feature is mounted (#1452).
+    // a JWT the moment such a routing feature is mounted.
     if (!base) {
         const needing = ANONYMOUS_ROUTE_FEATURES.filter((name) => deps.registry.getFeature(name));
         if (needing.length > 0) {
@@ -19,7 +19,7 @@ export async function resolveAnonymousAccessFromRegistry(base, deps) {
         }
         return undefined;
     }
-    // Fail-closed (#1374 security): inline tenantResolver without trust is the
+    // Fail-closed (security): inline tenantResolver without trust is the
     // old ambiguous config — providers always carry trust; test stacks must too.
     if (!tenantResolver &&
         base &&
@@ -29,7 +29,7 @@ export async function resolveAnonymousAccessFromRegistry(base, deps) {
         throw new Error("[auth-foundation] anonymousAccess.tenantResolver is set without resolverTrust — " +
             'declare "authoritative" or "fallback-only" (or mount an EXT_TENANT_RESOLVER provider).');
     }
-    // Providers win (#1374). When none are mounted, keep any test-injected
+    // Providers win. When none are mounted, keep any test-injected
     // Resolved callbacks so framework middleware suites stay self-contained.
     return {
         ...(base ?? {}),

package/dist/auth-foundation/types.js

@@ -42,14 +42,14 @@ export function tokenShapeMatches(shape, rawToken) {
 export function tokenShapeKey(shape) {
     return shape.kind === "jwt" ? "jwt" : `prefix:${shape.prefix}`;
 }
-// Session-store extension point (#1370). Unlike EXT_TOKEN_VERIFIER, this is
+// Session-store extension point. Unlike EXT_TOKEN_VERIFIER, this is
 // single-provider — sessions have no per-provider shape to route on, so
 // exactly one implementation must be registered (boot-fails on 0 or ≥2).
 export const EXT_SESSION_STORE = "sessionStore";
 export function isSessionStoreProvider(o) {
     return typeof o === "object" && o !== null && "build" in o && typeof o.build === "function";
 }
-// Tenant-resolution extension points (#1373). Both are single-provider and
+// Tenant-resolution extension points. Both are single-provider and
 // optional — zero registered means today's single-tenant / header-cookie
 // path (no subdomain resolver, no existence check). ≥2 fails boot.
 export const EXT_TENANT_RESOLVER = "tenantResolver";

package/dist/auth-mfa/feature-exports.d.ts

@@ -2,11 +2,11 @@ import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { MfaCodeVerifier } from "./mfa-code-verifier.ts";
 import type { MfaStatusChecker } from "./mfa-status-checker.ts";
 import type { MfaTokenSecretsEnv } from "./token-secrets.ts";
-export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => void;
+export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => () => void;
 export declare function bindMfaRevokeAllOtherSessionsFromFeature(feature: FeatureDefinition): BindMfaRevokeAllOtherSessions | undefined;
 export declare function mfaStatusCheckerFromFeature(feature: FeatureDefinition): MfaStatusChecker | undefined;
 export declare function mfaVerifierFromFeature(feature: FeatureDefinition): MfaCodeVerifier | undefined;
 export type BindMfaTokenSecrets = (masterSecret: string, env: MfaTokenSecretsEnv) => void;
 export declare function bindMfaTokenSecretsFromFeature(feature: FeatureDefinition): BindMfaTokenSecrets | undefined;
-export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => void;
+export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => () => void;
 export declare function bindRevokeAllPatTokensFromFeature(feature: FeatureDefinition): BindRevokeAllPatTokens | undefined;

package/dist/auth-mfa/feature.js

@@ -147,9 +147,17 @@ export function createAuthMfaFeature(opts) {
         const verifyMfaCode = createMfaCodeVerifier();
         const bindRevokeAllOtherSessions = (revoker) => {
             revokeAllOtherSessions = revoker;
+            return () => {
+                if (revokeAllOtherSessions === revoker)
+                    revokeAllOtherSessions = undefined;
+            };
         };
         const bindRevokeAllPatTokens = (revoker) => {
             revokeAllPatTokens = revoker;
+            return () => {
+                if (revokeAllPatTokens === revoker)
+                    revokeAllPatTokens = undefined;
+            };
         };
         return {
             handlers,

package/dist/auth-mfa/handlers/disable.write.js

@@ -30,9 +30,9 @@ export function createDisableHandler(opts) {
             if (!row)
                 return mfaNotEnabled();
             // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
-            // (#1467): without ctx.redis, verifyMfaFactor's TOTP-replay burn is
-            // skipped, and a code observed once (phishing proxy/shoulder-surfing)
-            // could be replayed within the ±1-step window to disable MFA outright.
+            // without ctx.redis, verifyMfaFactor's TOTP-replay burn is skipped, and
+            // a code observed once (phishing proxy/shoulder-surfing) could be
+            // replayed within the ±1-step window to disable MFA outright.
             // "no ctx.redis means no one gets through MFA login" doesn't cover
             // this route — it's session-authed, and JWTs issued before Redis was
             // unwired stay valid until they expire.