@cosmicdrift/kumiko-bundled-features 0.393.0 → 0.394.0

package/dist/account-security/feature.d.ts

@@ -1,7 +1,9 @@
 import { type AccessRule, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { NavIconKey } from "@cosmicdrift/kumiko-types/nav-icon";
 export interface AccountSecurityNavOptions {
     readonly order?: number;
     readonly parent?: string;
+    readonly icon?: NavIconKey;
 }
 export interface AccountSecurityFeatureOptions {
     readonly access?: AccessRule;

package/dist/account-security/feature.js

@@ -7,6 +7,7 @@ const DEFAULT_ACCESS = {
     openToAll: { reason: "signed-in users manage their own account security" },
 };
 const DEFAULT_NAV_ORDER = 90;
+const DEFAULT_NAV_ICON = "user";
 export const accountSecurityMfaStatusVisibility = {
     query: AuthMfaQueries.status,
     field: "enabled",
@@ -49,10 +50,11 @@ export function createAccountSecurityFeature(options = {}) {
             // Explicit property assignments: the feature-AST parser reads neither
             // `??`, shorthand properties nor a conditional spread, and the boot validator treats
             // `parent: undefined` as a top-level entry.
-            const { order: navOrder = DEFAULT_NAV_ORDER, parent: navParent } = nav;
+            const { order: navOrder = DEFAULT_NAV_ORDER, parent: navParent, icon: navIcon = DEFAULT_NAV_ICON, } = nav;
             r.nav({
                 id: ACCOUNT_SECURITY_SCREEN_ID,
                 label: ACCOUNT_SECURITY_NAV_LABEL,
+                icon: navIcon,
                 screen: ACCOUNT_SECURITY_SCREEN_QN,
                 order: navOrder,
                 parent: navParent,

package/dist/audit/event-classification.js

@@ -12,6 +12,7 @@ export const AUDIT_EVENT_STANCES = {
     "cap-counter:event:rolling-incremented": TECHNICAL_EVENT,
     "cap-counter:event:rolling-released": TECHNICAL_EVENT,
     "inbound-mail-foundation:event:inbound-message-received": TECHNICAL_EVENT,
+    "inbound-mail-foundation:event:inbound-message-content-fetched": TECHNICAL_EVENT,
     "inbound-mail-foundation:event:mail-thread-updated": TECHNICAL_EVENT,
     "document-ingest-foundation:event:document-ingest-requested": TECHNICAL_EVENT,
     "document-ingest-foundation:event:document-ingest-skipped": TECHNICAL_EVENT,

package/dist/auth-email-password/handlers/change-password.write.d.ts

@@ -4,4 +4,4 @@ export declare const changePasswordWrite: import("@cosmicdrift/kumiko-types/defi
     newPassword: z.ZodString;
 }, z.core.$strip>, {
     kind: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/confirm-account-unlock.write.d.ts

@@ -6,4 +6,4 @@ export declare function createConfirmAccountUnlockHandler(opts: ConfirmAccountUn
     token: z.ZodString;
 }, z.core.$strip>, {
     kind: "account-unlocked";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/invite-accept-with-login.write.d.ts

@@ -18,4 +18,4 @@ export declare function createInviteAcceptWithLoginHandler(opts?: InviteAcceptWi
     token: z.ZodString;
     email: z.ZodEmail;
     password: z.ZodString;
-}, z.core.$strip>, InviteAcceptWithLoginData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, InviteAcceptWithLoginData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/invite-accept.write.d.ts

@@ -8,4 +8,4 @@ export type InviteAcceptData = {
 };
 export declare function createInviteAcceptHandler(): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-accept", z.ZodObject<{
     token: z.ZodString;
-}, z.core.$strip>, InviteAcceptData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, InviteAcceptData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -32,7 +32,7 @@ export type InviteCreateOptions = {
 export declare function createInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-create", z.ZodObject<{
     email: z.ZodEmail;
     role: z.ZodString;
-}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export declare function createSystemInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"system-invite-create", z.ZodObject<{
     email: z.ZodEmail;
     role: z.ZodString;
@@ -40,4 +40,4 @@ export declare function createSystemInviteCreateHandler(opts: InviteCreateOption
         SystemAdmin: "SystemAdmin";
     }>>>;
     locale: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/invite-signup-complete.write.d.ts

@@ -13,4 +13,4 @@ export type InviteSignupCompleteOptions = Pick<LoginHandlerOptions, "mfaStatusCh
 export declare function createInviteSignupCompleteHandler(opts?: InviteSignupCompleteOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-signup-complete", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/login.write.d.ts

@@ -75,5 +75,5 @@ export declare function gateBuildSession(ctx: HandlerContext, userId: string, te
 export declare function createLoginHandler(opts?: LoginHandlerOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"login", z.ZodObject<{
     email: z.ZodEmail;
     password: z.ZodString;
-}, z.core.$strip>, LoginResult, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, LoginResult, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export {};

package/dist/auth-email-password/handlers/logout.write.d.ts

@@ -1,2 +1,2 @@
 import * as z from "zod";
-export declare const logoutWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"logout", z.ZodObject<{}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+export declare const logoutWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"logout", z.ZodObject<{}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/request-account-unlock.write.d.ts

@@ -4,4 +4,4 @@ export type RequestUnlockData = TokenRequestData<"unlock-requested">;
 export declare function createRequestAccountUnlockHandler(opts: RequestAccountUnlockOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-account-unlock", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
     returnTo: import("zod").ZodCatch<import("zod").ZodOptional<import("zod").ZodString>>;
-}, import("zod/v4/core").$strip>, TokenRequestData<"unlock-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"unlock-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/request-email-verification.write.d.ts

@@ -4,4 +4,4 @@ export type RequestVerificationData = TokenRequestData<"verification-requested">
 export declare function createRequestEmailVerificationHandler(opts: RequestEmailVerificationOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-email-verification", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
     returnTo: import("zod").ZodCatch<import("zod").ZodOptional<import("zod").ZodString>>;
-}, import("zod/v4/core").$strip>, TokenRequestData<"verification-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"verification-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/request-password-reset.write.d.ts

@@ -4,4 +4,4 @@ export type RequestResetData = TokenRequestData<"reset-requested">;
 export declare function createRequestPasswordResetHandler(opts: RequestPasswordResetOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-password-reset", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
     returnTo: import("zod").ZodCatch<import("zod").ZodOptional<import("zod").ZodString>>;
-}, import("zod/v4/core").$strip>, TokenRequestData<"reset-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"reset-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/reset-password.write.d.ts

@@ -7,4 +7,4 @@ export declare function createResetPasswordHandler(opts: ResetPasswordOptions):
     newPassword: z.ZodString;
 }, z.core.$strip>, {
     kind: "password-reset";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/signup-confirm.write.d.ts

@@ -27,5 +27,5 @@ type ClaimedHandover = {
 export declare function createSignupConfirmHandler(opts?: SignupConfirmOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"signup-confirm", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export {};

package/dist/auth-email-password/handlers/signup-request.write.d.ts

@@ -30,4 +30,4 @@ export declare function createSignupRequestHandler(opts: SignupRequestOptions):
         token: z.ZodString;
     }, z.core.$strip>>;
     returnTo: z.ZodCatch<z.ZodOptional<z.ZodString>>;
-}, z.core.$strip>, SignupRequestData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, SignupRequestData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -7,4 +7,4 @@ export type SwitchTenantMfaGateData = {
 export declare function createSwitchTenantMfaGateHandler(opts: Pick<LoginHandlerOptions, "mfaStatusChecker">): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"switch-tenant-mfa-gate", z.ZodObject<{
     userId: z.ZodString;
     tenantId: z.ZodString;
-}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/token-request-handler.d.ts

@@ -43,4 +43,4 @@ export type TokenRequestOptions = {
 export declare function createTokenRequestHandler<TName extends string, TSuccessKind extends string>(spec: TokenRequestSpec<TName, TSuccessKind>, opts: TokenRequestOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<TName, z.ZodObject<{
     email: z.ZodEmail;
     returnTo: z.ZodCatch<z.ZodOptional<z.ZodString>>;
-}, z.core.$strip>, TokenRequestData<TSuccessKind>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, TokenRequestData<TSuccessKind>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/handlers/verify-email.write.d.ts

@@ -9,4 +9,4 @@ export type VerifyEmailData = {
 };
 export declare function createVerifyEmailHandler(opts: VerifyEmailOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"verify-email", z.ZodObject<{
     token: z.ZodString;
-}, z.core.$strip>, VerifyEmailData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, VerifyEmailData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-email-password/web/auth-client.d.ts

@@ -1,3 +1,6 @@
+import { type LoginFailure, parseRetryAfterSeconds } from "./login-failure.ts";
+export type { KnownLoginFailureReason, LoginFailure } from "./login-failure.ts";
+export { parseRetryAfterSeconds };
 export type TenantSummary = {
     readonly tenantId: string;
     readonly roles: readonly string[];
@@ -19,19 +22,12 @@ export type LoginResponse = {
     };
     readonly landingPath?: string;
 };
-export type KnownLoginFailureReason = "invalid_credentials" | "no_membership" | "account_locked" | "email_not_verified" | "rate_limited" | "invalid_body" | "mfa_not_supported" | "mfa_setup_required";
-export type LoginFailure = {
-    readonly reason: KnownLoginFailureReason | (string & {});
-    readonly message?: string;
-    readonly retryAfterSeconds?: number;
-};
 export declare function csrfHeader(): Record<string, string>;
 export declare class AuthRequestError extends Error {
     readonly status: number;
     readonly retryAfterSeconds: number | undefined;
     constructor(message: string, status: number, retryAfterSeconds: number | undefined);
 }
-export declare function parseRetryAfterSeconds(header: string | null): number | undefined;
 export type LoginResult = {
     readonly kind: "success";
     readonly data: LoginResponse;

package/dist/auth-email-password/web/auth-client.js

@@ -8,6 +8,8 @@
 // the cookie and header constants from diverging.
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { CSRF_HEADER_NAME, readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
+import { failureFromErrorField, parseRetryAfterSeconds, } from "./login-failure.js";
+export { parseRetryAfterSeconds };
 export function csrfHeader() {
     const token = readCsrfToken();
     return token !== undefined ? { [CSRF_HEADER_NAME]: token } : {};
@@ -23,14 +25,6 @@ export class AuthRequestError extends Error {
         this.retryAfterSeconds = retryAfterSeconds;
     }
 }
-// Only a non-negative integer second count is usable; anything else is treated as absent.
-export function parseRetryAfterSeconds(header) {
-    if (header === null)
-        return undefined;
-    if (!/^\d+$/.test(header))
-        return undefined;
-    return Number(header);
-}
 export function toLoginResponse(token, user, landingPath) {
     return typeof landingPath === "string" ? { token, user, landingPath } : { token, user };
 }
@@ -69,22 +63,7 @@ export async function login(req) {
             return { kind: "success", data: toLoginResponse(body.token, body.user, body.landingPath) };
         }
     }
-    // The server sends error either as a string ("invalid_body") or as a
-    // structured object. Extract the most descriptive reason.
-    const err = body.error;
-    if (typeof err === "string") {
-        return { kind: "failure", error: { reason: err } };
-    }
-    const reason = err?.details?.reason ?? err?.code ?? "login_failed";
-    const retry = err?.details?.retryAfterSeconds;
-    return {
-        kind: "failure",
-        error: {
-            reason,
-            ...(err?.message !== undefined && { message: err.message }),
-            ...(retry !== undefined && { retryAfterSeconds: retry }),
-        },
-    };
+    return { kind: "failure", error: failureFromErrorField(body.error, "login_failed") };
 }
 // POST /api/auth/logout. The server revokes the session when
 // sessionRevoker is wired and clears the cookies. A navigation refresh

package/dist/auth-email-password/web/auth-gate.d.ts

@@ -1,5 +1,7 @@
 import { type ComponentType, type ReactNode } from "react";
 import { type LoginScreenProps } from "./login-screen.tsx";
+import type { LoginUrlBuilder } from "./login-url.ts";
+export type { LoginUrlBuilder };
 export type MfaVerifyComponentProps = {
     readonly challengeToken: string;
     readonly onSuccess?: (landingPath?: string) => void;
@@ -23,9 +25,6 @@ export type LoginRouteOptions = {
     readonly onAuthenticated?: () => void;
 };
 export declare function createLoginRoute(opts?: LoginRouteOptions): ComponentType<Record<string, never>>;
-/** Builds the login page URL. `returnPath` is the current path + query + hash;
- *  append it as `next` yourself (use `NEXT_QUERY_PARAM`) if the login page should return there. */
-export type LoginUrlBuilder = (locale: string, returnPath: string) => string;
 export type AuthGateOptions = LoginRouteOptions & {
     /** Login page outside the SPA (root-relative path or http(s) URL), or a function
      *  that builds it per locale. Unauthenticated visitors are sent there with
@@ -50,4 +49,3 @@ export declare function makeAuthGate(opts?: AuthGateOptions): ComponentType<{
 export declare function makeSessionAuthGate(opts?: SessionAuthGateOptions): ComponentType<{
     children: ReactNode;
 }>;
-export {};

package/dist/auth-email-password/web/auth-redirect.d.ts

@@ -1,9 +1,9 @@
+import { appendReturnTo, NEXT_QUERY_PARAM } from "./login-url.ts";
 import { isSafeReturnPath } from "./return-path.ts";
-export declare const NEXT_QUERY_PARAM = "next";
+export { appendReturnTo, NEXT_QUERY_PARAM };
 export declare const isSafeNextPath: typeof isSafeReturnPath;
 export declare function readNextFromSearch(search: string): string | null;
 export declare function readReturnToFromWindow(): string | null;
-export declare function appendReturnTo(href: string, returnTo: string | null): string;
 export declare function readNextFromWindow(): string | null;
 export declare function assertNavigableUrl(url: string, optionName: string): void;
 export declare function buildLoginRedirectUrl(loginUrl: string, returnPath: string, currentOrigin: string): string;

package/dist/auth-email-password/web/auth-redirect.js

@@ -1,8 +1,9 @@
 // Redirect targets for external login pages. `next` travels through the query
 // string, so anything read back from it is untrusted: only same-origin
 // root-relative paths pass (no "//host", no "/\host", no scheme).
-import { isSafeReturnPath, RETURN_TO_QUERY_PARAM, readReturnToFromSearch } from "./return-path.js";
-export const NEXT_QUERY_PARAM = "next";
+import { appendReturnTo, NEXT_QUERY_PARAM } from "./login-url.js";
+import { isSafeReturnPath, readReturnToFromSearch } from "./return-path.js";
+export { appendReturnTo, NEXT_QUERY_PARAM };
 export const isSafeNextPath = isSafeReturnPath;
 export function readNextFromSearch(search) {
     const candidate = new URLSearchParams(search).get(NEXT_QUERY_PARAM);
@@ -12,16 +13,6 @@ export function readNextFromSearch(search) {
 export function readReturnToFromWindow() {
     return typeof window === "undefined" ? null : readReturnToFromSearch(window.location.search);
 }
-// Adds returnTo to an href of a sibling auth page; a missing value leaves the href untouched.
-export function appendReturnTo(href, returnTo) {
-    if (returnTo === null)
-        return href;
-    const hashAt = href.indexOf("#");
-    const base = hashAt === -1 ? href : href.slice(0, hashAt);
-    const hash = hashAt === -1 ? "" : href.slice(hashAt);
-    const separator = base.includes("?") ? "&" : "?";
-    return `${base}${separator}${RETURN_TO_QUERY_PARAM}=${encodeURIComponent(returnTo)}${hash}`;
-}
 // The safe `next` of this page's URL; null on native, where there is no window.
 export function readNextFromWindow() {
     return typeof window === "undefined" ? null : readNextFromSearch(window.location.search);

package/dist/auth-email-password/web/index.d.ts

@@ -2,7 +2,7 @@ export type { AuthTokenFailure, CurrentUserProfile, LoginFailure, LoginRequest,
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.ts";
 export type { AuthCardProps, AuthShellRenderer } from "./auth-form-primitives.tsx";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.tsx";
-export type { AuthGateOptions, LoginRouteOptions, MfaSetupComponentProps, MfaVerifyComponentProps, SessionAuthGateOptions, } from "./auth-gate.tsx";
+export type { AuthGateOptions, LoginRouteOptions, LoginUrlBuilder, MfaSetupComponentProps, MfaVerifyComponentProps, SessionAuthGateOptions, } from "./auth-gate.tsx";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.tsx";
 export { buildLoginRedirectUrl, isSafeNextPath, NEXT_QUERY_PARAM, readNextFromSearch, } from "./auth-redirect.ts";
 export type { EmailPasswordClientFeature, EmailPasswordClientOptions, } from "./client-plugin.ts";
@@ -16,6 +16,7 @@ export { ForgotPasswordScreen } from "./forgot-password-screen.tsx";
 export { defaultTranslations, mergeTranslations } from "./i18n.ts";
 export type { InviteAcceptScreenProps } from "./invite-accept-screen.tsx";
 export { InviteAcceptScreen } from "./invite-accept-screen.tsx";
+export { failureFromErrorField } from "./login-failure.ts";
 export type { AuthLegalLink, LoginScreenProps } from "./login-screen.tsx";
 export { LoginScreen } from "./login-screen.tsx";
 export type { RequestAccountUnlockScreenProps } from "./request-account-unlock-screen.tsx";

package/dist/auth-email-password/web/index.js

@@ -13,6 +13,7 @@ export { DefaultTopbarActions } from "./default-topbar-actions.js";
 export { ForgotPasswordScreen } from "./forgot-password-screen.js";
 export { defaultTranslations, mergeTranslations } from "./i18n.js";
 export { InviteAcceptScreen } from "./invite-accept-screen.js";
+export { failureFromErrorField } from "./login-failure.js";
 export { LoginScreen } from "./login-screen.js";
 export { RequestAccountUnlockScreen } from "./request-account-unlock-screen.js";
 export { ResetPasswordScreen } from "./reset-password-screen.js";

package/dist/auth-email-password/web/login-failure.d.ts

@@ -0,0 +1,9 @@
+export type KnownLoginFailureReason = "invalid_credentials" | "no_membership" | "account_locked" | "email_not_verified" | "rate_limited" | "invalid_body" | "mfa_not_supported" | "mfa_setup_required";
+export type LoginFailure = {
+    readonly reason: KnownLoginFailureReason | (string & {});
+    readonly message?: string;
+    readonly retryAfterSeconds?: number;
+};
+export declare function parseRetryAfterSeconds(header: string | null): number | undefined;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function failureFromErrorField(error: unknown, fallbackReason: string): LoginFailure;

package/dist/auth-email-password/web/login-failure.js

@@ -0,0 +1,32 @@
+// Pure (no DOM, no renderer): shared by the SPA clients and the static login, which must stay
+// importable from a plain script.
+// Only a non-negative integer second count is usable; anything else is treated as absent.
+export function parseRetryAfterSeconds(header) {
+    if (header === null)
+        return undefined;
+    if (!/^\d+$/.test(header))
+        return undefined;
+    return Number(header);
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringOrUndefined(value) {
+    return typeof value === "string" ? value : undefined;
+}
+// The server sends `error` either as a string ("invalid_body") or as a structured object; this
+// extracts the most descriptive reason, falling back to the endpoint's generic one.
+export function failureFromErrorField(error, fallbackReason) {
+    if (typeof error === "string")
+        return { reason: error };
+    const fields = isRecord(error) ? error : {};
+    const details = isRecord(fields["details"]) ? fields["details"] : {};
+    const reason = stringOrUndefined(details["reason"]) ?? stringOrUndefined(fields["code"]) ?? fallbackReason;
+    const message = stringOrUndefined(fields["message"]);
+    const retry = details["retryAfterSeconds"];
+    return {
+        reason,
+        ...(message !== undefined && { message }),
+        ...(typeof retry === "number" && { retryAfterSeconds: retry }),
+    };
+}

package/dist/auth-email-password/web/login-url.d.ts

@@ -0,0 +1,5 @@
+export declare const NEXT_QUERY_PARAM = "next";
+/** Builds the login page URL. `returnPath` is the current path + query + hash;
+ *  append it as `next` yourself (use `NEXT_QUERY_PARAM`) if the login page should return there. */
+export type LoginUrlBuilder = (locale: string, returnPath: string) => string;
+export declare function appendReturnTo(href: string, returnTo: string | null): string;

package/dist/auth-email-password/web/login-url.js

@@ -0,0 +1,13 @@
+// Pure (no DOM, no `new URL`): the redirect vocabulary shared by the SPA gate and the static login.
+import { RETURN_TO_QUERY_PARAM } from "./return-path.js";
+export const NEXT_QUERY_PARAM = "next";
+// Adds returnTo to an href of a sibling auth page; a missing value leaves the href untouched.
+export function appendReturnTo(href, returnTo) {
+    if (returnTo === null)
+        return href;
+    const hashAt = href.indexOf("#");
+    const base = hashAt === -1 ? href : href.slice(0, hashAt);
+    const hash = hashAt === -1 ? "" : href.slice(hashAt);
+    const separator = base.includes("?") ? "&" : "?";
+    return `${base}${separator}${RETURN_TO_QUERY_PARAM}=${encodeURIComponent(returnTo)}${hash}`;
+}

package/dist/auth-email-password/web/static-login.d.ts

@@ -0,0 +1,42 @@
+import { type KnownLoginFailureReason } from "./login-failure.ts";
+import { type LoginUrlBuilder, NEXT_QUERY_PARAM } from "./login-url.ts";
+export { NEXT_QUERY_PARAM };
+export declare const STATIC_LOGIN_FAILED_REASON = "login_failed";
+export declare const STATIC_MFA_VERIFY_FAILED_REASON = "mfa_verify_failed";
+export declare const STATIC_NETWORK_FAILURE_REASON = "network";
+export declare const STATIC_RATE_LIMITED_REASON = "rate_limited";
+export declare const STATIC_MFA_SETUP_REQUIRED_REASON = "mfa_setup_required";
+export type StaticAuthResult = {
+    readonly kind: "success";
+    readonly landingPath?: string;
+} | {
+    readonly kind: "mfa-challenge";
+    readonly challengeToken: string;
+} | {
+    readonly kind: "mfa-setup-required";
+} | {
+    readonly kind: "failure";
+    readonly reason: KnownLoginFailureReason | (string & {});
+    readonly retryAfterSeconds?: number;
+};
+export declare function loginWithPassword(email: string, password: string): Promise<StaticAuthResult>;
+export declare function verifyMfaCode(challengeToken: string, code: string): Promise<StaticAuthResult>;
+export type IsAppPath = (pathname: string) => boolean;
+export declare function appReturnPath(candidate: unknown, isAppPath: IsAppPath): string | null;
+export declare function postLoginPath(options: {
+    readonly search: string;
+    readonly landingPath?: string | undefined;
+    readonly isAppPath: IsAppPath;
+    readonly fallbackPath: string;
+}): string;
+export declare function forgotPasswordHref(forgotPasswordPath: string, search: string, isAppPath: IsAppPath): string;
+export type MarketingLoginPaths = {
+    readonly default: string;
+    /** Lowercase locale prefix ("de") to its login path. */
+    readonly byLocale?: Readonly<Record<string, string>>;
+};
+export declare function isMarketingLoginPath(pathname: string, localePaths: MarketingLoginPaths): boolean;
+export declare function marketingLoginUrl(options: {
+    readonly localePaths: MarketingLoginPaths;
+    readonly isAppPath: IsAppPath;
+}): LoginUrlBuilder;

package/dist/auth-email-password/web/static-login.js

@@ -0,0 +1,122 @@
+// DOM-free login for static sites (plain Astro scripts): fetch plus pure string logic only. It
+// must not import auth-client.ts or auth-gate.tsx, which pull in the renderer, React and window
+// access at import time. Only the pure modules below are allowed.
+import { failureFromErrorField, isRecord, parseRetryAfterSeconds, } from "./login-failure.js";
+import { appendReturnTo, NEXT_QUERY_PARAM } from "./login-url.js";
+import { isSafeReturnPath } from "./return-path.js";
+export { NEXT_QUERY_PARAM };
+export const STATIC_LOGIN_FAILED_REASON = "login_failed";
+export const STATIC_MFA_VERIFY_FAILED_REASON = "mfa_verify_failed";
+export const STATIC_NETWORK_FAILURE_REASON = "network";
+export const STATIC_RATE_LIMITED_REASON = "rate_limited";
+export const STATIC_MFA_SETUP_REQUIRED_REASON = "mfa_setup_required";
+function failure(reason, retryAfterSeconds) {
+    return {
+        kind: "failure",
+        reason,
+        ...(retryAfterSeconds !== undefined && { retryAfterSeconds }),
+    };
+}
+function interpretBody(body, fallbackReason) {
+    if (body["isSuccess"] === true) {
+        const challengeToken = body["challengeToken"];
+        if (body["mfaRequired"] === true && typeof challengeToken === "string") {
+            return { kind: "mfa-challenge", challengeToken };
+        }
+        if (body["mfaSetupRequired"] === true)
+            return { kind: "mfa-setup-required" };
+        if (body["token"] !== undefined && body["user"] !== undefined) {
+            const landingPath = body["landingPath"];
+            return typeof landingPath === "string"
+                ? { kind: "success", landingPath }
+                : { kind: "success" };
+        }
+    }
+    const { reason, retryAfterSeconds } = failureFromErrorField(body["error"], fallbackReason);
+    if (reason === STATIC_MFA_SETUP_REQUIRED_REASON)
+        return { kind: "mfa-setup-required" };
+    return failure(reason, retryAfterSeconds);
+}
+// Same request shape as auth-client's login() and mfa-client's verifyMfaChallenge(): no CSRF
+// header because no session exists yet.
+async function postAuth(path, payload, fallbackReason) {
+    let res;
+    try {
+        res = await fetch(path, {
+            method: "POST",
+            credentials: "same-origin",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(payload),
+        });
+    }
+    catch {
+        return failure(STATIC_NETWORK_FAILURE_REASON);
+    }
+    if (res.status === 429) {
+        return failure(STATIC_RATE_LIMITED_REASON, parseRetryAfterSeconds(res.headers.get("Retry-After")));
+    }
+    const parsed = await res.json().catch(() => ({}));
+    return interpretBody(isRecord(parsed) ? parsed : {}, fallbackReason);
+}
+export function loginWithPassword(email, password) {
+    return postAuth("/api/auth/login", { email, password }, STATIC_LOGIN_FAILED_REASON);
+}
+export function verifyMfaCode(challengeToken, code) {
+    return postAuth("/api/auth/mfa/verify", { challengeToken, code }, STATIC_MFA_VERIFY_FAILED_REASON);
+}
+function pathnameOf(pathAndQuery) {
+    const end = pathAndQuery.search(/[?#]/);
+    return end === -1 ? pathAndQuery : pathAndQuery.slice(0, end);
+}
+// `next` is read from a URL, so beyond the shared same-origin check it must also point into the
+// app; string logic only, because React Native's URL getters throw.
+export function appReturnPath(candidate, isAppPath) {
+    if (!isSafeReturnPath(candidate))
+        return null;
+    return isAppPath(pathnameOf(candidate)) ? candidate : null;
+}
+function readAppNext(search, isAppPath) {
+    return appReturnPath(new URLSearchParams(search).get(NEXT_QUERY_PARAM), isAppPath);
+}
+export function postLoginPath(options) {
+    const next = readAppNext(options.search, options.isAppPath);
+    if (next !== null)
+        return next;
+    return appReturnPath(options.landingPath, options.isAppPath) ?? options.fallbackPath;
+}
+export function forgotPasswordHref(forgotPasswordPath, search, isAppPath) {
+    return appendReturnTo(forgotPasswordPath, readAppNext(search, isAppPath));
+}
+function trimTrailingSlashes(pathname) {
+    return pathname.replace(/\/+$/, "");
+}
+export function isMarketingLoginPath(pathname, localePaths) {
+    const target = trimTrailingSlashes(pathname);
+    const loginPaths = [localePaths.default, ...Object.values(localePaths.byLocale ?? {})];
+    return loginPaths.some((loginPath) => trimTrailingSlashes(loginPath) === target);
+}
+function loginPathFor(locale, localePaths) {
+    const prefix = (locale.toLowerCase().split(/[-_]/)[0] ?? "").trim();
+    const byLocale = localePaths.byLocale;
+    if (byLocale !== undefined && Object.hasOwn(byLocale, prefix)) {
+        return byLocale[prefix] ?? localePaths.default;
+    }
+    return localePaths.default;
+}
+// Marketing site to app login: keeps the user's place as `next` when it is an app path, and never
+// bounces from a login page back to itself.
+export function marketingLoginUrl(options) {
+    const { localePaths, isAppPath } = options;
+    return (locale, returnPath) => {
+        const hashAt = returnPath.indexOf("#");
+        const pathAndQuery = hashAt === -1 ? returnPath : returnPath.slice(0, hashAt);
+        const pathname = pathnameOf(pathAndQuery);
+        if (isMarketingLoginPath(pathname, localePaths))
+            return pathname;
+        const loginPath = loginPathFor(locale, localePaths);
+        const next = appReturnPath(pathAndQuery, isAppPath);
+        return next === null
+            ? loginPath
+            : `${loginPath}?${NEXT_QUERY_PARAM}=${encodeURIComponent(next)}`;
+    };
+}

package/dist/auth-mfa/handlers/disable.write.d.ts

@@ -7,4 +7,4 @@ export declare function createDisableHandler(opts: DisableOptions): import("@cos
     code: z.ZodString;
 }, z.core.$strip>, {
     disabled: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.d.ts

@@ -13,4 +13,4 @@ export declare function createEnableConfirmPreauthHandler(opts: EnableConfirmPre
 }, z.core.$strip>, {
     kind: string;
     session: SessionUser;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-mfa/handlers/enable-confirm.write.d.ts

@@ -9,4 +9,4 @@ export declare function createEnableConfirmHandler(opts: EnableConfirmOptions):
     code: z.ZodString;
 }, z.core.$strip>, {
     enabled: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-mfa/handlers/enable-start-preauth.write.d.ts

@@ -11,4 +11,4 @@ export declare function createEnableStartPreauthHandler(opts: EnableStartPreauth
     setupToken: string;
     otpauthUri: string;
     recoveryCodes: string[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/auth-mfa/handlers/enable-start.write.d.ts

@@ -10,4 +10,4 @@ export declare function createEnableStartHandler(opts: EnableStartOptions): impo
     otpauthUri: string;
     totpSecret: string;
     recoveryCodes: string[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;