@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -108,8 +108,8 @@ export function createEnableConfirmPreauthHandler(opts) {
             // re-enrollment until an operator manually disables MFA. NOT fixed by
             // this ordering: burnToken() above still runs before this check, so a
             // mid-flight restricted/deleted user still burns their setup token
-            // (framework#1523/5) — moving the burn later would need care around
-            // the existing userId-unique-constraint backstop between the
+            // — moving the burn later would need care around the
+            // existing userId-unique-constraint backstop between the
             // `existing` check above and executor.create() below.
             const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
             const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
@@ -150,10 +150,10 @@ export function createEnableConfirmPreauthHandler(opts) {
                 id: userId,
                 tenantId,
                 roles: mergedRoles,
-                // This endpoint logs the user in directly (fw#1760), so a stored
+                // This endpoint logs the user in directly, so a stored
                 // timezone must survive the preauth-MFA-enrollment login just like
                 // a plain password login does — same helper as verify.write.ts /
-                // invite-accept-with-login.write.ts (#1759).
+                // invite-accept-with-login.write.ts.
                 ...sessionTimezoneField(userRow?.timezone),
                 ...sessionLocaleField(userRow?.locale),
             };

package/dist/auth-mfa/handlers/enable-confirm.write.js

@@ -38,8 +38,8 @@ export function createEnableConfirmHandler(opts) {
             // already rules that out).
             if (verify.payload.userId !== event.user.id)
                 return invalidSetupToken();
-            // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
-            // (#1467): session-authed (lower risk — the caller already has a
+            // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts:
+            // session-authed (lower risk — the caller already has a
             // valid JWT), but silently skipping the single-use burn here would
             // still let a double-confirm race complete twice instead of the
             // second seeing invalidSetupToken(). Checked before the TOTP verify

package/dist/auth-mfa/handlers/enable-start-preauth.write.js

@@ -37,7 +37,7 @@ export function createEnableStartPreauthHandler(opts) {
             const verified = verifyMfaPreauthSetupToken(event.payload.preauthSetupToken, opts.challengeTokenSecret);
             // Same generic "sign in again" error as an expired/invalid MFA
             // challenge token — both mean the login-flow token expired, no
-            // distinct i18n needed (see #1465's scoping comment).
+            // distinct i18n needed.
             if (!verified.ok)
                 return invalidChallengeToken();
             const { userId, tenantId } = verified.payload;

package/dist/auth-mfa/handlers/reencrypt.job.js

@@ -97,7 +97,7 @@ export async function mfaReencryptJob(rawPayload, ctx, db) {
         }
         // After PII peel (when configured), values must be current-cipher
         // envelopes — non-JSON/non-envelope is not a supported legacy decrypt
-        // path (#1541, mirrors config #1513).
+        // path, matching config behavior.
         const totpClass = classifyStoredEnvelope(envelopeValues.totpSecret, targetVersion);
         const recoveryClass = classifyStoredEnvelope(envelopeValues.recoveryCodes, targetVersion);
         if (totpClass === "unrecognized" || recoveryClass === "unrecognized") {

package/dist/auth-mfa/handlers/regenerate-recovery.write.js

@@ -36,11 +36,11 @@ export function createRegenerateRecoveryHandler(opts) {
             // count, since either way the presented code is consumed/irrelevant
             // afterward.
             //
-            // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
-            // (#1467): without ctx.redis, verifyMfaFactor's TOTP-replay burn is
-            // skipped, letting an observed code be replayed within the ±1-step
-            // window to regenerate (and thus invalidate) recovery codes — a
-            // session-authed route, so pre-unwiring JWTs stay a valid attack path.
+            // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts:
+            // without ctx.redis, verifyMfaFactor's TOTP-replay burn is skipped,
+            // letting an observed code be replayed within the ±1-step window to
+            // regenerate (and thus invalidate) recovery codes — a session-authed
+            // route, so pre-unwiring JWTs stay a valid attack path.
             if (!ctx.redis) {
                 return writeFailure(new InternalError({
                     message: "regenerate-recovery (mfa) requires ctx.redis for TOTP replay protection",

package/dist/auth-mfa/handlers/verify.write.js

@@ -42,7 +42,7 @@ export function createMfaVerifyHandler(opts) {
             if (!verified.ok)
                 return invalidChallengeToken();
             const { userId, tenantId } = verified.payload;
-            // Fail closed, matching enable-confirm-preauth.write.ts (#1467):
+            // Fail closed, matching enable-confirm-preauth.write.ts:
             // this route sits behind a challenge token from a successful login,
             // but its own secret is still just a short TOTP/recovery code —
             // silently skipping the brute-force cap and single-use burn when

package/dist/auth-mfa/token-secrets.js

@@ -6,7 +6,7 @@ const SETUP_TOKEN_PURPOSE = "mfa-setup-token-v1";
 const CHALLENGE_TOKEN_PURPOSE = "mfa-challenge-token-v1";
 // A blank or whitespace-only override is treated as absent — an empty env
 // var (MFA_SETUP_TOKEN_SECRET="") must fall back to derivation, not sign
-// tokens with an empty/near-empty HMAC key (fw#1623).
+// tokens with an empty/near-empty HMAC key.
 function resolveSecret(override, fallback) {
     return override !== undefined && override.trim() !== "" ? override : fallback();
 }

package/dist/auth-mfa/web/client-plugin.d.ts

@@ -1,7 +1,7 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
 export type AuthMfaClientOptions = {
-    /** Key-Overrides pro Locale, gemerged mit den Default-Bundles (de/en). */
+    /** Key overrides per locale, merged with the default bundles (de/en). */
     readonly translations?: TranslationsByLocale;
 };
 export type AuthMfaClientFeature = {

package/dist/auth-mfa/web/client-plugin.js

@@ -1,4 +1,4 @@
-// Client-Feature-Factory für auth-mfa — mirrors emailPasswordClient()'s
+// Client feature factory for auth-mfa — mirrors emailPasswordClient()'s
 // shape so apps register both the same way:
 // createKumikoApp({ clientFeatures: [emailPasswordClient(), authMfaClient()] }).
 // No gates: MfaVerifyScreen isn't a route gate, it's a state swap wired

package/dist/auth-mfa/web/i18n.js

@@ -1,6 +1,6 @@
-// Default-Bundles für die auth-mfa Feature-UI. Merged in mit
-// authMfaClient() analog zu emailPasswordClient() aus auth-email-password.
-// Keys folgen `auth.mfa.<area>.<slug>`.
+// Default bundles for the auth-mfa feature UI, merged by
+// authMfaClient() analogously to emailPasswordClient() from auth-email-password.
+// Keys follow `auth.mfa.<area>.<slug>`.
 export const defaultTranslations = {
     en: {
         "screen:auth-mfa-enable.title": "Two-factor authentication",
@@ -10,6 +10,10 @@ export const defaultTranslations = {
         "auth.mfa.verify.submit": "Verify",
         "auth.mfa.verify.submitting": "…",
         "auth.mfa.verify.backToLogin": "Back to login",
+        "auth.mfa.verify.recoveryCode": "Recovery code",
+        "auth.mfa.verify.recoverySubtitle": "Enter one of the recovery codes you saved when you set up two-factor authentication.",
+        "auth.mfa.verify.useAuthenticatorCode": "Use the code from your app",
+        "auth.mfa.verify.useRecoveryCode": "Use a recovery code instead",
         "auth.mfa.errors.invalidCode": "Invalid code. Please try again.",
         "auth.mfa.errors.invalidTotpCode": "Invalid code. Please try again.",
         "auth.mfa.errors.invalidChallengeToken": "Your sign-in has expired. Please sign in again.",
@@ -35,7 +39,7 @@ export const defaultTranslations = {
         "auth.mfa.setup.confirm": "Complete setup",
         "auth.mfa.disable.title": "Disable two-factor authentication",
         "auth.mfa.disable.description": "Confirm with a code from your authenticator app or a recovery code. Your account will then be protected by your password alone.",
-        "auth.mfa.disable.code": "Code from your authenticator app or a recovery code",
+        "auth.mfa.disable.code": "Code from your authenticator app",
         "auth.mfa.disable.confirm": "Disable",
         "auth.mfa.disable.cancel": "Cancel",
         "auth.mfa.disable.trigger": "Disable two-factor authentication",

package/dist/auth-mfa/web/index.js

@@ -1,7 +1,7 @@
-// Public exports für die Browser-Seite des auth-mfa Features. Sub-Path-
-// Export `@cosmicdrift/kumiko-bundled-features/auth-mfa/web` — Server-Seite
-// (defineFeature) bleibt frei von React-/DOM-Deps, siehe auth-email-
-// password/web/index.ts für die selbe Trennung.
+// Public exports for the browser side of the auth-mfa feature. The subpath
+// export `@cosmicdrift/kumiko-bundled-features/auth-mfa/web` keeps the server
+// side (`defineFeature`) free of React/DOM dependencies, matching the same
+// separation in auth-email-password/web/index.ts.
 export { authMfaClient } from "./client-plugin.js";
 export { defaultTranslations, mergeTranslations } from "./i18n.js";
 export { confirmMfaSetupPreauth, startMfaSetupPreauth, verifyMfaChallenge } from "./mfa-client.js";

package/dist/auth-mfa/web/mfa-client.js

@@ -1,10 +1,10 @@
-// Browser-Seite von POST /api/auth/mfa/verify — completes the two-step
-// login LoginScreen started when the server responded mfaRequired. Same
-// fetch/CSRF pattern as auth-email-password's login() (pre-session, no
-// csrfHeader() — there's no session yet to protect). Response shape is
+// Browser side of POST /api/auth/mfa/verify — completes the two-step
+// login that LoginScreen started when the server responded with mfaRequired.
+// Uses the same fetch/CSRF pattern as auth-email-password's login(), but runs
+// before a session exists, so it does not call csrfHeader(). The response is
 // byte-identical to /auth/login's ({isSuccess, token, user} | {isSuccess:
-// false, error}) since auth-routes.ts mints via the same
-// mintSessionAndRespond() for both routes.
+// false, error}) because auth-routes.ts uses mintSessionAndRespond() for both
+// routes.
 // kumiko-lint-ignore cross-feature-import client-only types, the feature's server barrel has no web/ re-export
 import { toLoginResponse, } from "../../auth-email-password/web/index.js";
 export async function verifyMfaChallenge(challengeToken, code) {
@@ -40,11 +40,12 @@ export async function verifyMfaChallenge(challengeToken, code) {
         },
     };
 }
-// Browser-Seite von POST /api/auth/mfa/preauth-enable-start — lets a user
+// Browser side of POST /api/auth/mfa/preauth-enable-start — lets a user
 // blocked at login by MFA enforcement generate a TOTP secret/QR without a
-// session, using the preauthSetupToken login()'s mfa-setup-required result
-// carries. No JWT/cookie here (see auth-routes.ts's route comment) — the
-// response's setupToken is consumed by confirmMfaSetupPreauth below.
+// session, using the preauthSetupToken carried by login()'s
+// mfa-setup-required result. No JWT/cookie is issued here (see the route
+// comment in auth-routes.ts); the response's
+// setupToken is consumed by confirmMfaSetupPreauth below.
 export async function startMfaSetupPreauth(preauthSetupToken, accountLabel) {
     const res = await fetch("/api/auth/mfa/preauth-enable-start", {
         method: "POST",
@@ -85,12 +86,12 @@ export async function startMfaSetupPreauth(preauthSetupToken, accountLabel) {
         },
     };
 }
-// Browser-Seite von POST /api/auth/mfa/preauth-confirm — completes both
-// the enrollment startMfaSetupPreauth began and the login mfa-setup-
-// required block. Response shape mirrors /auth/mfa/verify's (mints via
-// the same mintSessionAndRespond()), same as verifyMfaChallenge above —
-// kept as its own function rather than a shared helper so this file's
-// two already-tested request shapes stay independently editable.
+// Browser side of POST /api/auth/mfa/preauth-confirm — completes both the
+// enrollment started by startMfaSetupPreauth and the login
+// mfa-setup-required block. Its response mirrors /auth/mfa/verify's and is
+// minted via the same mintSessionAndRespond(). It remains a separate function
+// so this file's two already-tested request shapes stay independently
+// editable.
 export async function confirmMfaSetupPreauth(setupToken, code) {
     const res = await fetch("/api/auth/mfa/preauth-confirm", {
         method: "POST",

package/dist/auth-mfa/web/mfa-code-or-recovery-field.d.ts

@@ -0,0 +1,11 @@
+import type { ReactNode } from "react";
+export type MfaCodeOrRecoveryFieldProps = {
+    readonly id: string;
+    readonly codeLabel: string;
+    readonly code: string;
+    readonly onCodeChange: (code: string) => void;
+    readonly useRecovery: boolean;
+    readonly onUseRecoveryChange: (useRecovery: boolean) => void;
+    readonly disabled?: boolean;
+};
+export declare function MfaCodeOrRecoveryField({ id, codeLabel, code, onCodeChange, useRecovery, onUseRecoveryChange, disabled, }: MfaCodeOrRecoveryFieldProps): ReactNode;

package/dist/auth-mfa/web/mfa-code-or-recovery-field.js

@@ -0,0 +1,12 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+export function MfaCodeOrRecoveryField({ id, codeLabel, code, onCodeChange, useRecovery, onUseRecoveryChange, disabled, }) {
+    const t = useTranslation();
+    const { Button, Field, Input } = usePrimitives();
+    return (_jsxs(_Fragment, { children: [_jsx(Field, { id: id, label: useRecovery ? t("auth.mfa.verify.recoveryCode") : codeLabel, required: true, children: useRecovery ? (_jsx(Input, { kind: "text", id: id, name: id, value: code, onChange: onCodeChange, disabled: disabled, autoFocus: true, autoComplete: "off" })) : (_jsx(Input, { kind: "code", length: 6, id: id, name: id, value: code, onChange: onCodeChange, disabled: disabled, autoFocus: true })) }), _jsx(Button, { type: "button", variant: "link", disabled: disabled, onClick: () => {
+                    onUseRecoveryChange(!useRecovery);
+                    onCodeChange("");
+                }, children: useRecovery
+                    ? t("auth.mfa.verify.useAuthenticatorCode")
+                    : t("auth.mfa.verify.useRecoveryCode") })] }));
+}

package/dist/auth-mfa/web/mfa-disable-dialog.js

@@ -12,20 +12,31 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { AuthMfaHandlers } from "./constants.js";
+import { MfaCodeOrRecoveryField } from "./mfa-code-or-recovery-field.js";
 // kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaDisableDialog({ open, onOpenChange, onDisabled, onError, }) {
     const t = useTranslation();
-    const { Dialog, Field, Input } = usePrimitives();
+    const { Dialog } = usePrimitives();
     const dispatcher = useDispatcher();
     const [code, setCode] = useState("");
+    const [useRecovery, setUseRecovery] = useState(false);
+    const reset = () => {
+        setCode("");
+        setUseRecovery(false);
+    };
+    const handleOpenChange = (nextOpen) => {
+        if (!nextOpen)
+            reset();
+        onOpenChange(nextOpen);
+    };
     const confirm = async () => {
         const res = await dispatcher.write(AuthMfaHandlers.disable, { code });
-        setCode("");
+        reset();
         if (!res.isSuccess) {
             onError(res.error.i18nKey);
             return;
         }
         onDisabled();
     };
-    return (_jsx(Dialog, { open: open, onOpenChange: onOpenChange, variant: "danger", title: t("auth.mfa.disable.title"), description: t("auth.mfa.disable.description"), confirmLabel: t("auth.mfa.disable.confirm"), cancelLabel: t("auth.mfa.disable.cancel"), onConfirm: confirm, testId: "mfa-disable-dialog", children: _jsx(Field, { id: "mfa-disable-code", label: t("auth.mfa.disable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-disable-code", name: "mfa-disable-code", value: code, onChange: setCode, autoComplete: "one-time-code" }) }) }));
+    return (_jsx(Dialog, { open: open, onOpenChange: handleOpenChange, variant: "danger", title: t("auth.mfa.disable.title"), description: t("auth.mfa.disable.description"), confirmLabel: t("auth.mfa.disable.confirm"), cancelLabel: t("auth.mfa.disable.cancel"), onConfirm: confirm, testId: "mfa-disable-dialog", children: _jsx(MfaCodeOrRecoveryField, { id: "mfa-disable-code", codeLabel: t("auth.mfa.disable.code"), code: code, onCodeChange: setCode, useRecovery: useRecovery, onUseRecoveryChange: setUseRecovery }) }));
 }

package/dist/auth-mfa/web/mfa-regenerate-recovery-dialog.js

@@ -9,20 +9,31 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { AuthMfaHandlers } from "./constants.js";
+import { MfaCodeOrRecoveryField } from "./mfa-code-or-recovery-field.js";
 // kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaRegenerateRecoveryDialog({ open, onOpenChange, onRegenerated, onError, }) {
     const t = useTranslation();
-    const { Dialog, Field, Input } = usePrimitives();
+    const { Dialog } = usePrimitives();
     const dispatcher = useDispatcher();
     const [code, setCode] = useState("");
+    const [useRecovery, setUseRecovery] = useState(false);
+    const reset = () => {
+        setCode("");
+        setUseRecovery(false);
+    };
+    const handleOpenChange = (nextOpen) => {
+        if (!nextOpen)
+            reset();
+        onOpenChange(nextOpen);
+    };
     const confirm = async () => {
         const res = await dispatcher.write(AuthMfaHandlers.regenerateRecovery, { code });
-        setCode("");
+        reset();
         if (!res.isSuccess) {
             onError(res.error.i18nKey);
             return;
         }
         onRegenerated(res.data.recoveryCodes);
     };
-    return (_jsx(Dialog, { open: open, onOpenChange: onOpenChange, title: t("auth.mfa.regenerate.title"), description: t("auth.mfa.regenerate.description"), confirmLabel: t("auth.mfa.regenerate.confirm"), cancelLabel: t("auth.mfa.regenerate.cancel"), onConfirm: confirm, testId: "mfa-regenerate-recovery-dialog", children: _jsx(Field, { id: "mfa-regenerate-code", label: t("auth.mfa.regenerate.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-regenerate-code", name: "mfa-regenerate-code", value: code, onChange: setCode, autoComplete: "one-time-code" }) }) }));
+    return (_jsx(Dialog, { open: open, onOpenChange: handleOpenChange, title: t("auth.mfa.regenerate.title"), description: t("auth.mfa.regenerate.description"), confirmLabel: t("auth.mfa.regenerate.confirm"), cancelLabel: t("auth.mfa.regenerate.cancel"), onConfirm: confirm, testId: "mfa-regenerate-recovery-dialog", children: _jsx(MfaCodeOrRecoveryField, { id: "mfa-regenerate-code", codeLabel: t("auth.mfa.regenerate.code"), code: code, onCodeChange: setCode, useRecovery: useRecovery, onUseRecoveryChange: setUseRecovery }) }));
 }

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -48,6 +48,7 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
     const [setup, setSetup] = useState(null);
     const [acknowledged, setAcknowledged] = useState(false);
     const [code, setCode] = useState("");
+    const [attempt, setAttempt] = useState(0);
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState(null);
     const [retryAfterSeconds, setRetryAfterSeconds] = useState(null);
@@ -78,14 +79,14 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
             setBusy(false);
         }
     };
-    const confirmSetup = async () => {
-        if (!setup)
+    const confirmSetup = async (submittedCode) => {
+        if (!setup || busy)
             return;
         setBusy(true);
         setError(null);
         setRetryAfterSeconds(null);
         try {
-            const res = await confirmMfaSetupPreauth(setup.setupToken, code);
+            const res = await confirmMfaSetupPreauth(setup.setupToken, submittedCode);
             if (res.kind !== "success") {
                 setError(res.error.reason);
                 setRetryAfterSeconds(res.error.retryAfterSeconds ?? null);
@@ -98,7 +99,11 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
                     setSetup(null);
                     setAcknowledged(false);
                     setCode("");
+                    return;
                 }
+                // Remount: the field was disabled during confirm and lost focus.
+                setCode("");
+                setAttempt((n) => n + 1);
                 return;
             }
             onSuccess?.(res.data.landingPath);
@@ -112,7 +117,7 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
     };
     const onSubmit = (e) => {
         e?.preventDefault();
-        void confirmSetup();
+        void confirmSetup(code);
     };
     return (_jsxs(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
                     ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
@@ -124,5 +129,5 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
                                             copyable: false,
                                             multiline: false,
                                         },
-                                    ], copyLabel: t("kumiko.secretMint.copy"), copiedLabel: t("kumiko.secretMint.copied"), testId: "mfa-setup-preauth-qr" })) : (_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") })), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
+                                    ], copyLabel: t("kumiko.secretMint.copy"), copiedLabel: t("kumiko.secretMint.copied"), testId: "mfa-setup-preauth-qr" })) : (_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") })), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "code", length: 6, id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, onComplete: (next) => void confirmSetup(next), disabled: busy || !acknowledged, hasError: error !== null, autoFocus: attempt > 0 }, attempt) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
 }

package/dist/auth-mfa/web/mfa-verify-screen.js

@@ -1,15 +1,16 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// Login-Challenge-Step, gerendert wenn LoginScreen's onMfaChallenge feuert
-// (/auth/login antwortete mfaRequired). Stilistisch wie login-screen.tsx:
-// useState + direkter fetch-Call, kein Dispatcher — es existiert noch kein
-// JWT. Nach Erfolg ruft es session.refresh() statt eines Hard-Reloads, weil
-// der Aufrufer (typisch ein Wizard-State im App-Root) sofort neu rendern
-// will, sobald status:"authenticated" ankommt.
+// Login challenge step, rendered when LoginScreen's onMfaChallenge fires
+// (/auth/login returned mfaRequired). It follows login-screen.tsx:
+// useState plus a direct fetch call, without a dispatcher because no JWT
+// exists yet. After success, it calls session.refresh() instead of a hard
+// reload so the caller (typically wizard state in the app root) can render
+// immediately when status:"authenticated" arrives.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only barrel, the feature's server barrel has no web/ re-export
 import { AuthCard, useSession } from "../../auth-email-password/web/index.js";
 import { verifyMfaChallenge } from "./mfa-client.js";
+const MFA_CODE_LENGTH = 6;
 function reasonToKey(reason) {
     switch (reason) {
         case "invalid_totp_code":
@@ -31,13 +32,17 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner } = usePrimitives();
     const session = useSession();
+    const [mode, setMode] = useState("authenticator");
     const [code, setCode] = useState("");
+    const [attempt, setAttempt] = useState(0);
     const [submitting, setSubmitting] = useState(false);
     const [error, setError] = useState(null);
-    const doSubmit = async () => {
+    const doSubmit = async (submittedCode) => {
+        if (submitting)
+            return;
         setSubmitting(true);
         setError(null);
-        const res = await verifyMfaChallenge(challengeToken, code);
+        const res = await verifyMfaChallenge(challengeToken, submittedCode);
         if (res.kind === "success") {
             await session.refresh();
             setSubmitting(false);
@@ -46,12 +51,28 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
         }
         setSubmitting(false);
         setError(res.error.reason);
+        // Remount: the input was disabled during submit and lost focus.
+        setAttempt((n) => n + 1);
+        if (mode === "authenticator")
+            setCode("");
     };
     const onSubmit = (e) => {
         e?.preventDefault();
-        void doSubmit();
+        void doSubmit(code);
+    };
+    const toggleMode = () => {
+        setMode(mode === "authenticator" ? "recovery" : "authenticator");
+        setCode("");
+        setError(null);
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
+    const isRecovery = mode === "recovery";
+    const fieldId = isRecovery ? "mfa-verify-recovery-code" : "mfa-verify-code";
+    const defaultSubtitle = isRecovery
+        ? t("auth.mfa.verify.recoverySubtitle")
+        : t("auth.mfa.verify.subtitle");
+    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? defaultSubtitle, children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: fieldId, label: isRecovery ? t("auth.mfa.verify.recoveryCode") : t("auth.mfa.verify.code"), required: true, children: isRecovery ? (_jsx(Input, { kind: "text", id: fieldId, name: fieldId, value: code, onChange: setCode, disabled: submitting, required: true, autoFocus: true, autoComplete: "off" }, `${mode}-${attempt}`)) : (_jsx(Input, { kind: "code", length: MFA_CODE_LENGTH, id: fieldId, name: fieldId, value: code, onChange: setCode, onComplete: (next) => void doSubmit(next), disabled: submitting, hasError: error !== null, required: true, autoFocus: true }, `${mode}-${attempt}`)) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
                         ? t("auth.mfa.verify.submitting")
-                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
+                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), _jsx(Button, { type: "button", variant: "link", onClick: toggleMode, disabled: submitting, children: isRecovery
+                        ? t("auth.mfa.verify.useAuthenticatorCode")
+                        : t("auth.mfa.verify.useRecoveryCode") }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
 }

package/dist/billing-foundation/aggregate-id.d.ts

@@ -1,9 +1,9 @@
 /**
- * Deterministic aggregate-id für die subscription eines Plattform-
- * Tenants. EINE Subscription pro Tenant (Add-Ons sind line-items in
- * derselben subscription, nicht eigene). Provider-Wechsel (z.B.
- * Stripe→Mollie-Migration) appended einen neuen event auf denselben
- * Stream — selber Tenant, selber Aggregate-Stream.
+ * Deterministic aggregate ID for a platform tenant's subscription. Exactly
+ * one subscription exists per tenant; add-ons are line items in that
+ * subscription, not separate aggregates. A provider change, such as a
+ * Stripe→Mollie migration, appends a new event to the same stream because
+ * the tenant and aggregate stream remain the same.
  */
 export declare function subscriptionAggregateId(tenantId: string): string;
 /**

package/dist/billing-foundation/aggregate-id.js

@@ -1,10 +1,9 @@
 import { v5 as uuidv5 } from "uuid";
-// Fixed UUID-namespace für die deterministic aggregate-id-Ableitung.
-// Generiert einmalig (2026-05-03), in Stein gemeißelt: ein Wechsel
-// würde jeden existing aggregate-Stream re-keyen → kaputter
-// Subscription-State, kaputte Audit-History. Drift-Pin in
-// __tests__/feature.test.ts pinnt die UUID.
-/** Pro Plattform-Tenant existiert genau EIN subscription-Aggregate. */
+// Fixed UUID namespace for deterministic aggregate-id derivation.
+// Generated once and immutable: changing it would re-key every existing
+// aggregate stream, breaking subscription state and audit history. The drift
+// pin in __tests__/feature.test.ts locks the UUID.
+/** Exactly one subscription aggregate exists per platform tenant. */
 const SUBSCRIPTION_NAMESPACE = "5c3b2d1e-9a4f-4e8c-b7a3-1f8d6c2e9a4b";
 /** Exactly ONE payment-aggregate-stream exists per platform tenant (it
  *  collects many payment-received events — one stream per tenant, not one
@@ -20,11 +19,11 @@ const PAYMENT_ROW_NAMESPACE = "3a1c9f4e-6b2d-4c8a-9e5f-7d4b1a2c8e6f";
  *  declaration (one stream per request). Generated 2026-10-03, set in stone. */
 const TERMINATION_UNMATCHED_NAMESPACE = "7e2f4b9a-3c1d-4a68-8d05-b6c9e1f27a34";
 /**
- * Deterministic aggregate-id für die subscription eines Plattform-
- * Tenants. EINE Subscription pro Tenant (Add-Ons sind line-items in
- * derselben subscription, nicht eigene). Provider-Wechsel (z.B.
- * Stripe→Mollie-Migration) appended einen neuen event auf denselben
- * Stream — selber Tenant, selber Aggregate-Stream.
+ * Deterministic aggregate ID for a platform tenant's subscription. Exactly
+ * one subscription exists per tenant; add-ons are line items in that
+ * subscription, not separate aggregates. A provider change, such as a
+ * Stripe→Mollie migration, appends a new event to the same stream because
+ * the tenant and aggregate stream remain the same.
  */
 // @wrapper-known uuid-domain
 export function subscriptionAggregateId(tenantId) {

package/dist/billing-foundation/checkout-core.d.ts

@@ -17,20 +17,15 @@ export type ResolvedProvider = {
  *  entityName is registered. */
 export declare function findProviderPlugin(ctx: HandlerContext, providerName: string): ResolvedProvider | null;
 export declare function resolveProviderPlugin(ctx: HandlerContext, providerName: string): ResolvedProvider;
-/** Picks the catalog's provider — an explicit `catalog.providerName`, or the
- *  single registered provider exposing `priceToTier` when there is exactly
- *  one. Returns null when `providerName` is unset and no registered plugin
- *  exposes `priceToTier` — a state `billing-plans` renders as
- *  `enabled: false` instead of erroring. An explicit `providerName` that is
- *  not registered, or more than one candidate, is a config bug and throws
- *  `UnconfiguredError`. */
-export declare function findCatalogProvider(ctx: HandlerContext, catalog: BillingPlanCatalog): ResolvedProvider | null;
-/** `findCatalogProvider` for callers that require a provider to proceed —
- *  start-plan-checkout and switch-plan. `FeatureDisabledError` (not
- *  `UnconfiguredError`) when none is found: an unconfigured provider is
- *  the same "billing isn't live yet" state as `isPluginBillingEnabled`
- *  returning false, and the panel already renders both the same way. */
-export declare function resolveCatalogProvider(ctx: HandlerContext, catalog: BillingPlanCatalog, handlerName: string): ResolvedProvider;
+/** The providers a catalog sells through, in registration order: an explicit
+ *  `catalog.providerName` (only that one), otherwise every registered provider
+ *  exposing `priceToTier`. Empty when none qualifies, a state `billing-plans`
+ *  renders as `enabled: false` instead of erroring. An explicit `providerName`
+ *  that is not registered is a config bug and throws `UnconfiguredError`. */
+export declare function listCatalogProviders(ctx: HandlerContext, catalog: BillingPlanCatalog): readonly ResolvedProvider[];
+export declare function filterOfferedProviders(ctx: HandlerContext, providers: readonly ResolvedProvider[]): Promise<readonly ResolvedProvider[]>;
+/** The catalog providers that are live right now: what a buyer can choose from. */
+export declare function listOfferedCatalogProviders(ctx: HandlerContext, catalog: BillingPlanCatalog): Promise<readonly ResolvedProvider[]>;
 /** `plugin.isBillingEnabled?.(ctx) ?? true` — the one place this fallback is
  *  spelled out, so no call-site forgets to await the optional method before
  *  applying the `?? true` default. */