@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.388.0

package/dist/agent-tools/tool-dispatch.d.ts

@@ -37,11 +37,11 @@ export type ToolCallRequest = {
     /** Receives the cause of unexpected (5xx) failures, which the tool result never carries. */
     readonly log?: Pick<Logger, "error">;
 };
-/** Executes one LLM-issued tool call. Never throws — a missing tool, a missing argument, a
- *  disallowed filter field, or a rejected handler call (cap check, validation, ...) all come
- *  back as `{ ok: false }` so the agent loop can feed the error back to the model instead of
- *  crashing. Client errors (< 500) keep their message and carry a `code`; 429 adds
- *  `retryable`. Server-side failures (>= 500, unknown throws) are logged and returned as a
- *  generic message so internals never reach the model. `request.user` must be the caller's real identity — every server-kind tool runs
- *  through the same permission-checked dispatcher pipeline as a normal HTTP request. */
+/** Executes one LLM-issued tool call. Never throws: every failure comes back as `{ ok: false }`
+ *  so the agent loop can feed the error back to the model instead of crashing.
+ *  Handler and dispatcher failures carry a `code` (429 adds `retryable`); client errors (< 500)
+ *  keep their message, server failures (>= 500, unknown throws) are logged and returned as a
+ *  generic message. Local validation errors (unknown tool, bad arguments) have no `code`.
+ *  `request.user` must be the caller's real identity: server-kind tools run through the same
+ *  permission-checked pipeline as an HTTP request. */
 export declare function dispatchToolCall(request: ToolCallRequest): Promise<ToolCallResult>;

package/dist/agent-tools/tool-dispatch.js

@@ -1,5 +1,5 @@
 import { isKumikoError } from "@cosmicdrift/kumiko-framework/errors";
-import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
+import { runAsAgentToolCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
@@ -274,13 +274,13 @@ function dispatchClient(descriptor, input) {
             return dispatchClientAskUser(input);
     }
 }
-/** Executes one LLM-issued tool call. Never throws — a missing tool, a missing argument, a
- *  disallowed filter field, or a rejected handler call (cap check, validation, ...) all come
- *  back as `{ ok: false }` so the agent loop can feed the error back to the model instead of
- *  crashing. Client errors (< 500) keep their message and carry a `code`; 429 adds
- *  `retryable`. Server-side failures (>= 500, unknown throws) are logged and returned as a
- *  generic message so internals never reach the model. `request.user` must be the caller's real identity — every server-kind tool runs
- *  through the same permission-checked dispatcher pipeline as a normal HTTP request. */
+/** Executes one LLM-issued tool call. Never throws: every failure comes back as `{ ok: false }`
+ *  so the agent loop can feed the error back to the model instead of crashing.
+ *  Handler and dispatcher failures carry a `code` (429 adds `retryable`); client errors (< 500)
+ *  keep their message, server failures (>= 500, unknown throws) are logged and returned as a
+ *  generic message. Local validation errors (unknown tool, bad arguments) have no `code`.
+ *  `request.user` must be the caller's real identity: server-kind tools run through the same
+ *  permission-checked pipeline as an HTTP request. */
 export async function dispatchToolCall(request) {
     const { dispatcher, user, toolName, input, dispatchTable, runId, toolCallId } = request;
     const classifyFailure = createFailureClassifier(toolName, request.log ?? fallbackLog);
@@ -289,7 +289,7 @@ export async function dispatchToolCall(request) {
         return { ok: false, error: `Unknown tool "${toolName}"` };
     }
     try {
-        return await runAsDirectCallEntry(async () => {
+        return await runAsAgentToolCallEntry(async () => {
             switch (descriptor.kind) {
                 case "search":
                     return await dispatchSearch(descriptor, dispatcher, user, toolName, input);

package/dist/audit/handlers/audit-events.js

@@ -12,7 +12,7 @@ import { redactPiiCiphertext } from "../../shared/index.js";
 import { eventLabelKeyOf, TECHNICAL_EVENT_TYPES } from "../event-classification.js";
 import { AUDIT_EVENT_ACTIONS, INCLUDE_TECHNICAL_FILTER, } from "../web/constants.js";
 const MAX_LIMIT = 100;
-// At most 18 digits keeps the id inside bigint, so an oversized cursor or id is a 422, not a 500.
+// At most 18 digits keeps the id inside bigint, so an oversized cursor or id is a validation error (400), not a 500.
 const CURSOR_PATTERN = /^\d{1,18}$/;
 export const auditListPayloadShape = {
     cursor: z.string().regex(CURSOR_PATTERN, "cursor must be a positive integer").optional(),

package/dist/auth-mfa/feature-exports.d.ts

@@ -2,11 +2,11 @@ import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { MfaCodeVerifier } from "./mfa-code-verifier.ts";
 import type { MfaStatusChecker } from "./mfa-status-checker.ts";
 import type { MfaTokenSecretsEnv } from "./token-secrets.ts";
-export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => void;
+export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => () => void;
 export declare function bindMfaRevokeAllOtherSessionsFromFeature(feature: FeatureDefinition): BindMfaRevokeAllOtherSessions | undefined;
 export declare function mfaStatusCheckerFromFeature(feature: FeatureDefinition): MfaStatusChecker | undefined;
 export declare function mfaVerifierFromFeature(feature: FeatureDefinition): MfaCodeVerifier | undefined;
 export type BindMfaTokenSecrets = (masterSecret: string, env: MfaTokenSecretsEnv) => void;
 export declare function bindMfaTokenSecretsFromFeature(feature: FeatureDefinition): BindMfaTokenSecrets | undefined;
-export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => void;
+export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => () => void;
 export declare function bindRevokeAllPatTokensFromFeature(feature: FeatureDefinition): BindRevokeAllPatTokens | undefined;

package/dist/auth-mfa/feature.js

@@ -147,9 +147,17 @@ export function createAuthMfaFeature(opts) {
         const verifyMfaCode = createMfaCodeVerifier();
         const bindRevokeAllOtherSessions = (revoker) => {
             revokeAllOtherSessions = revoker;
+            return () => {
+                if (revokeAllOtherSessions === revoker)
+                    revokeAllOtherSessions = undefined;
+            };
         };
         const bindRevokeAllPatTokens = (revoker) => {
             revokeAllPatTokens = revoker;
+            return () => {
+                if (revokeAllPatTokens === revoker)
+                    revokeAllPatTokens = undefined;
+            };
         };
         return {
             handlers,

package/dist/auth-mfa/web/i18n.js

@@ -10,6 +10,10 @@ export const defaultTranslations = {
         "auth.mfa.verify.submit": "Verify",
         "auth.mfa.verify.submitting": "…",
         "auth.mfa.verify.backToLogin": "Back to login",
+        "auth.mfa.verify.recoveryCode": "Recovery code",
+        "auth.mfa.verify.recoverySubtitle": "Enter one of the recovery codes you saved when you set up two-factor authentication.",
+        "auth.mfa.verify.useAuthenticatorCode": "Use the code from your app",
+        "auth.mfa.verify.useRecoveryCode": "Use a recovery code instead",
         "auth.mfa.errors.invalidCode": "Invalid code. Please try again.",
         "auth.mfa.errors.invalidTotpCode": "Invalid code. Please try again.",
         "auth.mfa.errors.invalidChallengeToken": "Your sign-in has expired. Please sign in again.",
@@ -35,7 +39,7 @@ export const defaultTranslations = {
         "auth.mfa.setup.confirm": "Complete setup",
         "auth.mfa.disable.title": "Disable two-factor authentication",
         "auth.mfa.disable.description": "Confirm with a code from your authenticator app or a recovery code. Your account will then be protected by your password alone.",
-        "auth.mfa.disable.code": "Code from your authenticator app or a recovery code",
+        "auth.mfa.disable.code": "Code from your authenticator app",
         "auth.mfa.disable.confirm": "Disable",
         "auth.mfa.disable.cancel": "Cancel",
         "auth.mfa.disable.trigger": "Disable two-factor authentication",

package/dist/auth-mfa/web/mfa-code-or-recovery-field.d.ts

@@ -0,0 +1,11 @@
+import type { ReactNode } from "react";
+export type MfaCodeOrRecoveryFieldProps = {
+    readonly id: string;
+    readonly codeLabel: string;
+    readonly code: string;
+    readonly onCodeChange: (code: string) => void;
+    readonly useRecovery: boolean;
+    readonly onUseRecoveryChange: (useRecovery: boolean) => void;
+    readonly disabled?: boolean;
+};
+export declare function MfaCodeOrRecoveryField({ id, codeLabel, code, onCodeChange, useRecovery, onUseRecoveryChange, disabled, }: MfaCodeOrRecoveryFieldProps): ReactNode;

package/dist/auth-mfa/web/mfa-code-or-recovery-field.js

@@ -0,0 +1,12 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+export function MfaCodeOrRecoveryField({ id, codeLabel, code, onCodeChange, useRecovery, onUseRecoveryChange, disabled, }) {
+    const t = useTranslation();
+    const { Button, Field, Input } = usePrimitives();
+    return (_jsxs(_Fragment, { children: [_jsx(Field, { id: id, label: useRecovery ? t("auth.mfa.verify.recoveryCode") : codeLabel, required: true, children: useRecovery ? (_jsx(Input, { kind: "text", id: id, name: id, value: code, onChange: onCodeChange, disabled: disabled, autoFocus: true, autoComplete: "off" })) : (_jsx(Input, { kind: "code", length: 6, id: id, name: id, value: code, onChange: onCodeChange, disabled: disabled, autoFocus: true })) }), _jsx(Button, { type: "button", variant: "link", disabled: disabled, onClick: () => {
+                    onUseRecoveryChange(!useRecovery);
+                    onCodeChange("");
+                }, children: useRecovery
+                    ? t("auth.mfa.verify.useAuthenticatorCode")
+                    : t("auth.mfa.verify.useRecoveryCode") })] }));
+}

package/dist/auth-mfa/web/mfa-disable-dialog.js

@@ -12,20 +12,31 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { AuthMfaHandlers } from "./constants.js";
+import { MfaCodeOrRecoveryField } from "./mfa-code-or-recovery-field.js";
 // kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaDisableDialog({ open, onOpenChange, onDisabled, onError, }) {
     const t = useTranslation();
-    const { Dialog, Field, Input } = usePrimitives();
+    const { Dialog } = usePrimitives();
     const dispatcher = useDispatcher();
     const [code, setCode] = useState("");
+    const [useRecovery, setUseRecovery] = useState(false);
+    const reset = () => {
+        setCode("");
+        setUseRecovery(false);
+    };
+    const handleOpenChange = (nextOpen) => {
+        if (!nextOpen)
+            reset();
+        onOpenChange(nextOpen);
+    };
     const confirm = async () => {
         const res = await dispatcher.write(AuthMfaHandlers.disable, { code });
-        setCode("");
+        reset();
         if (!res.isSuccess) {
             onError(res.error.i18nKey);
             return;
         }
         onDisabled();
     };
-    return (_jsx(Dialog, { open: open, onOpenChange: onOpenChange, variant: "danger", title: t("auth.mfa.disable.title"), description: t("auth.mfa.disable.description"), confirmLabel: t("auth.mfa.disable.confirm"), cancelLabel: t("auth.mfa.disable.cancel"), onConfirm: confirm, testId: "mfa-disable-dialog", children: _jsx(Field, { id: "mfa-disable-code", label: t("auth.mfa.disable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-disable-code", name: "mfa-disable-code", value: code, onChange: setCode, autoComplete: "one-time-code" }) }) }));
+    return (_jsx(Dialog, { open: open, onOpenChange: handleOpenChange, variant: "danger", title: t("auth.mfa.disable.title"), description: t("auth.mfa.disable.description"), confirmLabel: t("auth.mfa.disable.confirm"), cancelLabel: t("auth.mfa.disable.cancel"), onConfirm: confirm, testId: "mfa-disable-dialog", children: _jsx(MfaCodeOrRecoveryField, { id: "mfa-disable-code", codeLabel: t("auth.mfa.disable.code"), code: code, onCodeChange: setCode, useRecovery: useRecovery, onUseRecoveryChange: setUseRecovery }) }));
 }

package/dist/auth-mfa/web/mfa-regenerate-recovery-dialog.js

@@ -9,20 +9,31 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { AuthMfaHandlers } from "./constants.js";
+import { MfaCodeOrRecoveryField } from "./mfa-code-or-recovery-field.js";
 // kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaRegenerateRecoveryDialog({ open, onOpenChange, onRegenerated, onError, }) {
     const t = useTranslation();
-    const { Dialog, Field, Input } = usePrimitives();
+    const { Dialog } = usePrimitives();
     const dispatcher = useDispatcher();
     const [code, setCode] = useState("");
+    const [useRecovery, setUseRecovery] = useState(false);
+    const reset = () => {
+        setCode("");
+        setUseRecovery(false);
+    };
+    const handleOpenChange = (nextOpen) => {
+        if (!nextOpen)
+            reset();
+        onOpenChange(nextOpen);
+    };
     const confirm = async () => {
         const res = await dispatcher.write(AuthMfaHandlers.regenerateRecovery, { code });
-        setCode("");
+        reset();
         if (!res.isSuccess) {
             onError(res.error.i18nKey);
             return;
         }
         onRegenerated(res.data.recoveryCodes);
     };
-    return (_jsx(Dialog, { open: open, onOpenChange: onOpenChange, title: t("auth.mfa.regenerate.title"), description: t("auth.mfa.regenerate.description"), confirmLabel: t("auth.mfa.regenerate.confirm"), cancelLabel: t("auth.mfa.regenerate.cancel"), onConfirm: confirm, testId: "mfa-regenerate-recovery-dialog", children: _jsx(Field, { id: "mfa-regenerate-code", label: t("auth.mfa.regenerate.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-regenerate-code", name: "mfa-regenerate-code", value: code, onChange: setCode, autoComplete: "one-time-code" }) }) }));
+    return (_jsx(Dialog, { open: open, onOpenChange: handleOpenChange, title: t("auth.mfa.regenerate.title"), description: t("auth.mfa.regenerate.description"), confirmLabel: t("auth.mfa.regenerate.confirm"), cancelLabel: t("auth.mfa.regenerate.cancel"), onConfirm: confirm, testId: "mfa-regenerate-recovery-dialog", children: _jsx(MfaCodeOrRecoveryField, { id: "mfa-regenerate-code", codeLabel: t("auth.mfa.regenerate.code"), code: code, onCodeChange: setCode, useRecovery: useRecovery, onUseRecoveryChange: setUseRecovery }) }));
 }

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -48,6 +48,7 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
     const [setup, setSetup] = useState(null);
     const [acknowledged, setAcknowledged] = useState(false);
     const [code, setCode] = useState("");
+    const [attempt, setAttempt] = useState(0);
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState(null);
     const [retryAfterSeconds, setRetryAfterSeconds] = useState(null);
@@ -78,14 +79,14 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
             setBusy(false);
         }
     };
-    const confirmSetup = async () => {
-        if (!setup)
+    const confirmSetup = async (submittedCode) => {
+        if (!setup || busy)
             return;
         setBusy(true);
         setError(null);
         setRetryAfterSeconds(null);
         try {
-            const res = await confirmMfaSetupPreauth(setup.setupToken, code);
+            const res = await confirmMfaSetupPreauth(setup.setupToken, submittedCode);
             if (res.kind !== "success") {
                 setError(res.error.reason);
                 setRetryAfterSeconds(res.error.retryAfterSeconds ?? null);
@@ -98,7 +99,11 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
                     setSetup(null);
                     setAcknowledged(false);
                     setCode("");
+                    return;
                 }
+                // Remount: the field was disabled during confirm and lost focus.
+                setCode("");
+                setAttempt((n) => n + 1);
                 return;
             }
             onSuccess?.(res.data.landingPath);
@@ -112,7 +117,7 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
     };
     const onSubmit = (e) => {
         e?.preventDefault();
-        void confirmSetup();
+        void confirmSetup(code);
     };
     return (_jsxs(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
                     ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
@@ -124,5 +129,5 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
                                             copyable: false,
                                             multiline: false,
                                         },
-                                    ], copyLabel: t("kumiko.secretMint.copy"), copiedLabel: t("kumiko.secretMint.copied"), testId: "mfa-setup-preauth-qr" })) : (_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") })), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
+                                    ], copyLabel: t("kumiko.secretMint.copy"), copiedLabel: t("kumiko.secretMint.copied"), testId: "mfa-setup-preauth-qr" })) : (_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") })), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "code", length: 6, id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, onComplete: (next) => void confirmSetup(next), disabled: busy || !acknowledged, hasError: error !== null, autoFocus: attempt > 0 }, attempt) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
 }

package/dist/auth-mfa/web/mfa-verify-screen.js

@@ -10,6 +10,7 @@ import { useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only barrel, the feature's server barrel has no web/ re-export
 import { AuthCard, useSession } from "../../auth-email-password/web/index.js";
 import { verifyMfaChallenge } from "./mfa-client.js";
+const MFA_CODE_LENGTH = 6;
 function reasonToKey(reason) {
     switch (reason) {
         case "invalid_totp_code":
@@ -31,13 +32,17 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner } = usePrimitives();
     const session = useSession();
+    const [mode, setMode] = useState("authenticator");
     const [code, setCode] = useState("");
+    const [attempt, setAttempt] = useState(0);
     const [submitting, setSubmitting] = useState(false);
     const [error, setError] = useState(null);
-    const doSubmit = async () => {
+    const doSubmit = async (submittedCode) => {
+        if (submitting)
+            return;
         setSubmitting(true);
         setError(null);
-        const res = await verifyMfaChallenge(challengeToken, code);
+        const res = await verifyMfaChallenge(challengeToken, submittedCode);
         if (res.kind === "success") {
             await session.refresh();
             setSubmitting(false);
@@ -46,12 +51,28 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
         }
         setSubmitting(false);
         setError(res.error.reason);
+        // Remount: the input was disabled during submit and lost focus.
+        setAttempt((n) => n + 1);
+        if (mode === "authenticator")
+            setCode("");
     };
     const onSubmit = (e) => {
         e?.preventDefault();
-        void doSubmit();
+        void doSubmit(code);
+    };
+    const toggleMode = () => {
+        setMode(mode === "authenticator" ? "recovery" : "authenticator");
+        setCode("");
+        setError(null);
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
+    const isRecovery = mode === "recovery";
+    const fieldId = isRecovery ? "mfa-verify-recovery-code" : "mfa-verify-code";
+    const defaultSubtitle = isRecovery
+        ? t("auth.mfa.verify.recoverySubtitle")
+        : t("auth.mfa.verify.subtitle");
+    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? defaultSubtitle, children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: fieldId, label: isRecovery ? t("auth.mfa.verify.recoveryCode") : t("auth.mfa.verify.code"), required: true, children: isRecovery ? (_jsx(Input, { kind: "text", id: fieldId, name: fieldId, value: code, onChange: setCode, disabled: submitting, required: true, autoFocus: true, autoComplete: "off" }, `${mode}-${attempt}`)) : (_jsx(Input, { kind: "code", length: MFA_CODE_LENGTH, id: fieldId, name: fieldId, value: code, onChange: setCode, onComplete: (next) => void doSubmit(next), disabled: submitting, hasError: error !== null, required: true, autoFocus: true }, `${mode}-${attempt}`)) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
                         ? t("auth.mfa.verify.submitting")
-                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
+                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), _jsx(Button, { type: "button", variant: "link", onClick: toggleMode, disabled: submitting, children: isRecovery
+                        ? t("auth.mfa.verify.useAuthenticatorCode")
+                        : t("auth.mfa.verify.useRecoveryCode") }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
 }

package/dist/billing-foundation/checkout-core.d.ts

@@ -17,20 +17,15 @@ export type ResolvedProvider = {
  *  entityName is registered. */
 export declare function findProviderPlugin(ctx: HandlerContext, providerName: string): ResolvedProvider | null;
 export declare function resolveProviderPlugin(ctx: HandlerContext, providerName: string): ResolvedProvider;
-/** Picks the catalog's provider — an explicit `catalog.providerName`, or the
- *  single registered provider exposing `priceToTier` when there is exactly
- *  one. Returns null when `providerName` is unset and no registered plugin
- *  exposes `priceToTier` — a state `billing-plans` renders as
- *  `enabled: false` instead of erroring. An explicit `providerName` that is
- *  not registered, or more than one candidate, is a config bug and throws
- *  `UnconfiguredError`. */
-export declare function findCatalogProvider(ctx: HandlerContext, catalog: BillingPlanCatalog): ResolvedProvider | null;
-/** `findCatalogProvider` for callers that require a provider to proceed —
- *  start-plan-checkout and switch-plan. `FeatureDisabledError` (not
- *  `UnconfiguredError`) when none is found: an unconfigured provider is
- *  the same "billing isn't live yet" state as `isPluginBillingEnabled`
- *  returning false, and the panel already renders both the same way. */
-export declare function resolveCatalogProvider(ctx: HandlerContext, catalog: BillingPlanCatalog, handlerName: string): ResolvedProvider;
+/** The providers a catalog sells through, in registration order: an explicit
+ *  `catalog.providerName` (only that one), otherwise every registered provider
+ *  exposing `priceToTier`. Empty when none qualifies, a state `billing-plans`
+ *  renders as `enabled: false` instead of erroring. An explicit `providerName`
+ *  that is not registered is a config bug and throws `UnconfiguredError`. */
+export declare function listCatalogProviders(ctx: HandlerContext, catalog: BillingPlanCatalog): readonly ResolvedProvider[];
+export declare function filterOfferedProviders(ctx: HandlerContext, providers: readonly ResolvedProvider[]): Promise<readonly ResolvedProvider[]>;
+/** The catalog providers that are live right now: what a buyer can choose from. */
+export declare function listOfferedCatalogProviders(ctx: HandlerContext, catalog: BillingPlanCatalog): Promise<readonly ResolvedProvider[]>;
 /** `plugin.isBillingEnabled?.(ctx) ?? true` — the one place this fallback is
  *  spelled out, so no call-site forgets to await the optional method before
  *  applying the `?? true` default. */

package/dist/billing-foundation/checkout-core.js

@@ -15,14 +15,18 @@ import { BILLING_FOUNDATION_FEATURE, isSubscriptionBlockingCheckout, SUBSCRIPTIO
 export function isNonEmptyStringArray(arr) {
     return arr.length > 0;
 }
+/** Every registered provider plugin, in registration order. */
+function listProviderPlugins(ctx) {
+    return ctx.registry.getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION).map((usage) => ({
+        name: usage.entityName,
+        // @cast-boundary engine-payload — extension-usage carries unknown options
+        plugin: usage.options,
+    }));
+}
 /** Non-throwing provider lookup by name — null when no plugin with that
  *  entityName is registered. */
 export function findProviderPlugin(ctx, providerName) {
-    const usage = ctx.registry
-        .getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION)
-        .find((u) => u.entityName === providerName);
-    // @cast-boundary engine-payload — extension-usage carries unknown options
-    return usage ? { name: providerName, plugin: usage.options } : null;
+    return listProviderPlugins(ctx).find((provider) => provider.name === providerName) ?? null;
 }
 export function resolveProviderPlugin(ctx, providerName) {
     const found = findProviderPlugin(ctx, providerName);
@@ -35,14 +39,12 @@ export function resolveProviderPlugin(ctx, providerName) {
     }
     return found;
 }
-/** Picks the catalog's provider — an explicit `catalog.providerName`, or the
- *  single registered provider exposing `priceToTier` when there is exactly
- *  one. Returns null when `providerName` is unset and no registered plugin
- *  exposes `priceToTier` — a state `billing-plans` renders as
- *  `enabled: false` instead of erroring. An explicit `providerName` that is
- *  not registered, or more than one candidate, is a config bug and throws
- *  `UnconfiguredError`. */
-export function findCatalogProvider(ctx, catalog) {
+/** The providers a catalog sells through, in registration order: an explicit
+ *  `catalog.providerName` (only that one), otherwise every registered provider
+ *  exposing `priceToTier`. Empty when none qualifies, a state `billing-plans`
+ *  renders as `enabled: false` instead of erroring. An explicit `providerName`
+ *  that is not registered is a config bug and throws `UnconfiguredError`. */
+export function listCatalogProviders(ctx, catalog) {
     if (catalog.providerName) {
         const found = findProviderPlugin(ctx, catalog.providerName);
         if (!found) {
@@ -52,34 +54,17 @@ export function findCatalogProvider(ctx, catalog) {
                 hint: `provider "${catalog.providerName}" not registered`,
             });
         }
-        return found;
-    }
-    const usages = ctx.registry.getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION);
-    const withPriceCatalog = usages.filter((u) => u.options.priceToTier !== undefined);
-    if (withPriceCatalog.length > 1) {
-        throw new UnconfiguredError({
-            feature: "billing-foundation",
-            key: "catalog.providerName",
-            hint: `ambiguous — ${withPriceCatalog.length} registered plugins expose priceToTier, set catalog.providerName explicitly`,
-        });
+        return [found];
     }
-    const usage = withPriceCatalog[0];
-    if (!usage)
-        return null;
-    // @cast-boundary engine-payload — extension-usage carries unknown options
-    return { name: usage.entityName, plugin: usage.options };
+    return listProviderPlugins(ctx).filter(({ plugin }) => plugin.priceToTier !== undefined);
 }
-/** `findCatalogProvider` for callers that require a provider to proceed —
- *  start-plan-checkout and switch-plan. `FeatureDisabledError` (not
- *  `UnconfiguredError`) when none is found: an unconfigured provider is
- *  the same "billing isn't live yet" state as `isPluginBillingEnabled`
- *  returning false, and the panel already renders both the same way. */
-export function resolveCatalogProvider(ctx, catalog, handlerName) {
-    const found = findCatalogProvider(ctx, catalog);
-    if (!found) {
-        throw new FeatureDisabledError(BILLING_FOUNDATION_FEATURE, handlerName);
-    }
-    return found;
+export async function filterOfferedProviders(ctx, providers) {
+    const enabledFlags = await Promise.all(providers.map(({ plugin }) => isPluginBillingEnabled(ctx, plugin)));
+    return providers.filter((_, index) => enabledFlags[index]);
+}
+/** The catalog providers that are live right now: what a buyer can choose from. */
+export async function listOfferedCatalogProviders(ctx, catalog) {
+    return filterOfferedProviders(ctx, listCatalogProviders(ctx, catalog));
 }
 /** `plugin.isBillingEnabled?.(ctx) ?? true` — the one place this fallback is
  *  spelled out, so no call-site forgets to await the optional method before

package/dist/billing-foundation/consumer-protection/confirmation-mail.js

@@ -112,8 +112,14 @@ inlineHtmlMarkdown.use({
         blockquote({ tokens }) {
             return this.parser.parse(tokens);
         },
-        list({ items }) {
-            return items.map((item) => this.parser.parse(item.tokens)).join("");
+        list({ items, ordered, start }) {
+            const firstNumber = typeof start === "number" ? start : 1;
+            return items
+                .map((item, index) => {
+                const marker = ordered ? `${firstNumber + index}. ` : "";
+                return `${marker}${this.parser.parse(item.tokens)}`;
+            })
+                .join("");
         },
         hr: () => "",
         space: () => "",

package/dist/billing-foundation/consumer-protection/consent-gate.d.ts

@@ -30,6 +30,7 @@ export type ConsentPriceDetails = {
     readonly priceId: string;
     readonly price: Pick<ProviderPrice, "unitAmount" | "currency" | "interval" | "intervalCount"> | null;
     readonly orderItem?: OrderItem;
+    readonly providerName?: string;
 };
 export declare function prepareConsent(ctx: HandlerContext, options: ConsumerProtectionOptions, consent: ConsentPayload | undefined, mode: CheckoutMode): Promise<PreparedConsent>;
 export declare function consentCheckoutFields(prepared: PreparedConsent): {

package/dist/billing-foundation/consumer-protection/consent-gate.js

@@ -104,6 +104,7 @@ export async function recordConsent(ctx, prepared, details) {
         termsTemplateVersion: prepared.termsTemplateVersion,
         locale: prepared.locale,
         actorUserId: String(ctx.user.id),
+        ...(details.providerName !== undefined && { providerName: details.providerName }),
         ...(details.orderItem && {
             itemLabelKey: details.orderItem.labelKey,
             ...(details.orderItem.params && { itemLabelParams: details.orderItem.params }),

package/dist/billing-foundation/consumer-protection/issue-confirmation.js

@@ -6,6 +6,7 @@ import { InternalError, UnprocessableError } from "@cosmicdrift/kumiko-framework
 import { createI18n } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
+import { decryptStoredUserEmail } from "../../shared/index.js";
 import { requireTemplateResolver, TEXT_BLOCK_KIND } from "../../template-resolver/index.js";
 import { UserQueries } from "../../user/index.js";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
@@ -13,7 +14,6 @@ import { CHECKOUT_CONSENT_RECORDED_EVENT_QN, CONTRACT_CONFIRMATION_ISSUED_EVENT_
 import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../web/constants.js";
 import { contractConfirmationVariables } from "./confirmation-mail.js";
 import { resolveConsentLocale } from "./consent-text.js";
-import { openStoredUserEmail } from "./stored-user-email.js";
 export const issueContractConfirmationSchema = z
     .object({
     consentId: z.string().min(1).max(100),
@@ -31,6 +31,12 @@ const recipientRowSchema = z.object({
 function translatedOrUndefined(translation, key) {
     return translation === key ? undefined : translation;
 }
+function vatNoteFor(consumerProtection, providerName) {
+    const providerNote = providerName === undefined
+        ? undefined
+        : consumerProtection.providerTexts?.[providerName]?.vatNote;
+    return providerNote ?? consumerProtection.vatNote;
+}
 function pickTimeZone(userZone, tenantZone) {
     if (userZone && isValidIanaTimeZone(userZone))
         return userZone;
@@ -102,7 +108,7 @@ export function createIssueContractConfirmationHandler(options, consumerProtecti
                 id: consent.actorUserId,
             }));
             const recipientEmail = recipient.success && recipient.data.isDeleted !== true
-                ? await openStoredUserEmail(recipient.data.email, "billing-foundation:issue-contract-confirmation")
+                ? await decryptStoredUserEmail(recipient.data.email, "billing-foundation:issue-contract-confirmation")
                 : null;
             if (!recipient.success || recipientEmail === null) {
                 ctx.log?.warn(`[billing-foundation:issue-contract-confirmation] recipient of consent ${payload.consentId} not found; no mail sent`);
@@ -142,7 +148,7 @@ export function createIssueContractConfirmationHandler(options, consumerProtecti
                 ...(payload.currentPeriodEndIso !== undefined && {
                     currentPeriodEndIso: payload.currentPeriodEndIso,
                 }),
-                vatNote: consumerProtection.vatNote,
+                vatNote: vatNoteFor(consumerProtection, consent.providerName),
                 operatorEmail: consumerProtection.operatorEmail,
                 termsContent: terms.content,
             });

package/dist/billing-foundation/consumer-protection/mail-notifications.js

@@ -44,7 +44,9 @@ export function terminationReceiptTemplate() {
                 mailRepeatedRows("details", "text"),
                 mailParagraph(texts.receiptNextSteps),
                 mailParagraph(texts.receiptRevoke(OPERATOR_EMAIL_SLOT)),
-                mailParagraphWithLink(texts.receiptNotMe, texts.receiptNotMeLink, "revokeUrl").replace("<p>", '<p data-if="revokeUrl">'),
+                mailParagraphWithLink(texts.receiptNotMe, texts.receiptNotMeLink, "revokeUrl", {
+                    showIf: "revokeUrl",
+                }),
                 mailParagraph(`${texts.contact} {operatorEmail}`),
             ].join(""),
         };

package/dist/billing-foundation/consumer-protection/termination-receipt-limit.d.ts

@@ -1,6 +1,8 @@
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 export declare const RECEIPT_MAILS_PER_RECIPIENT = 3;
 export declare const RECEIPT_WINDOW_SECONDS: number;
+export type ReceiptMailVerdict = "allowed" | "limited" | "unavailable";
 /** Consumes one receipt token for the recipient. Fails closed when the limiter
- *  errors or no digest key is wired: the declaration is already recorded, a missing receipt is the lesser harm. */
-export declare function mayMailReceipt(ctx: HandlerContext, email: string): Promise<boolean>;
+ *  errors or no digest key is wired ("unavailable"): the declaration is already
+ *  recorded, a missing receipt is the lesser harm. */
+export declare function mayMailReceipt(ctx: HandlerContext, email: string): Promise<ReceiptMailVerdict>;

package/dist/billing-foundation/consumer-protection/termination-receipt-limit.js

@@ -10,25 +10,26 @@ function receiptBucketKey(ctx, email) {
     return digest === undefined ? undefined : `${RECEIPT_BUCKET_PREFIX}:${digest}`;
 }
 /** Consumes one receipt token for the recipient. Fails closed when the limiter
- *  errors or no digest key is wired: the declaration is already recorded, a missing receipt is the lesser harm. */
+ *  errors or no digest key is wired ("unavailable"): the declaration is already
+ *  recorded, a missing receipt is the lesser harm. */
 export async function mayMailReceipt(ctx, email) {
     // skip: no rate limiter wired, nothing to count against
     if (!ctx.rateLimit)
-        return true;
+        return "allowed";
     try {
         const bucketKey = receiptBucketKey(ctx, email);
         if (bucketKey === undefined) {
             ctx.log?.warn("[billing-foundation:termination] no rate-limit digest available, receipt mail withheld");
-            return false;
+            return "unavailable";
         }
         const decision = await ctx.rateLimit.check(bucketKey, {
             limit: RECEIPT_MAILS_PER_RECIPIENT,
             windowSeconds: RECEIPT_WINDOW_SECONDS,
         });
-        return decision.allowed;
+        return decision.allowed ? "allowed" : "limited";
     }
     catch (error) {
         ctx.log?.warn(`[billing-foundation:termination] receipt rate limiter failed: ${error instanceof Error ? error.message : String(error)}`);
-        return false;
+        return "unavailable";
     }
 }