@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-mfa/web/__tests__/mfa-setup-preauth-screen.test.tsx

@@ -0,0 +1,379 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { defaultTranslations } from "../i18n";
+
+mock.module("qrcode/lib/browser", () => ({
+  default: { toString: mock(async () => "<svg></svg>") },
+}));
+
+const { MfaSetupPreauthScreen } = await import("../mfa-setup-preauth-screen");
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <PrimitivesProvider value={defaultPrimitives}>
+      <LocaleProvider
+        resolver={createStaticLocaleResolver({ locale: "de" })}
+        fallbackBundles={[defaultTranslations]}
+      >
+        {children}
+      </LocaleProvider>
+    </PrimitivesProvider>
+  );
+}
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status });
+}
+
+const startBody = {
+  isSuccess: true,
+  setupToken: "setup-token-1",
+  otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD1234&issuer=App",
+  recoveryCodes: ["code-1", "code-2"],
+};
+const confirmBody = {
+  isSuccess: true,
+  token: "t",
+  user: { id: "u1", tenantId: "t1", roles: [] },
+};
+
+beforeEach(() => {
+  globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+    const url = String(input);
+    if (url.includes("preauth-enable-start")) return jsonResponse(startBody);
+    if (url.includes("preauth-confirm")) return jsonResponse(confirmBody);
+    return jsonResponse({ isSuccess: false, error: "unexpected_url" }, 500);
+  }) as unknown as typeof fetch;
+});
+
+describe("MfaSetupPreauthScreen", () => {
+  test("rendert Titel + Start-Button, kein Setup-Bereich vor dem Start", () => {
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+    expect(screen.getByText("Zwei-Faktor-Authentifizierung erforderlich")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Einrichtung starten" })).toBeTruthy();
+    expect(screen.queryByLabelText(/^Code aus der Authenticator-App/)).toBeNull();
+  });
+
+  test("Start-Klick → postet preauthSetupToken+accountLabel, danach QR + Recovery-Codes", async () => {
+    const fetchMock = mock(async () => jsonResponse(startBody));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/mfa/preauth-enable-start",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({
+            preauthSetupToken: "preauth-1",
+            accountLabel: "user@example.com",
+          }),
+        }),
+      );
+    });
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    expect(screen.getByText(/code-1/)).toBeTruthy();
+    expect(screen.getByText(/code-2/)).toBeTruthy();
+  });
+
+  test("Bestätigen-Button bleibt disabled bis Recovery-Codes bestätigt + 6-stelliger Code eingegeben", async () => {
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+
+    const confirm = screen.getByRole("button", {
+      name: "Einrichtung abschließen",
+    }) as HTMLButtonElement;
+    expect(confirm.disabled).toBe(true);
+
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    expect(confirm.disabled).toBe(true);
+
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+    expect(confirm.disabled).toBe(false);
+  });
+
+  test("Bestätigen → postet setupToken+code, danach onSuccess", async () => {
+    const onSuccess = mock(() => {});
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen
+          preauthSetupToken="preauth-1"
+          accountLabel="user@example.com"
+          onSuccess={onSuccess}
+        />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+
+    const fetchMock = globalThis.fetch as unknown as ReturnType<typeof mock>;
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung abschließen" }));
+
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/mfa/preauth-confirm",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({ setupToken: "setup-token-1", code: "123456" }),
+        }),
+      );
+    });
+    await waitFor(() => {
+      expect(onSuccess).toHaveBeenCalled();
+    });
+  });
+
+  test("enable-start schlägt fehl → übersetztes Fehler-Banner, kein Setup-Bereich", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: "mfa_already_enabled" }),
+    ) as unknown as typeof fetch;
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Zwei-Faktor-Authentifizierung ist bereits aktiv.")).toBeTruthy();
+    });
+    expect(screen.queryByText("ABCD1234")).toBeNull();
+  });
+
+  test("onCancel gesetzt → 'Zurück zum Login'-Button vorhanden, klick ruft onCancel", () => {
+    const onCancel = mock(() => {});
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen
+          preauthSetupToken="preauth-1"
+          accountLabel="user@example.com"
+          onCancel={onCancel}
+        />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Zurück zum Login" }));
+    expect(onCancel).toHaveBeenCalled();
+  });
+
+  test("ohne onCancel → kein 'Zurück zum Login'-Button", () => {
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+    expect(screen.queryByRole("button", { name: "Zurück zum Login" })).toBeNull();
+  });
+
+  test("confirm schlägt mit invalid_totp_code fehl → übersetztes Banner, onSuccess NICHT gefeuert, Formular weiter bedienbar", async () => {
+    const onSuccess = mock(() => {});
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("preauth-enable-start")) return jsonResponse(startBody);
+      if (url.includes("preauth-confirm")) {
+        return jsonResponse({ isSuccess: false, error: "invalid_totp_code" });
+      }
+      return jsonResponse({ isSuccess: false, error: "unexpected_url" }, 500);
+    }) as unknown as typeof fetch;
+
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen
+          preauthSetupToken="preauth-1"
+          accountLabel="user@example.com"
+          onSuccess={onSuccess}
+        />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "000000" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung abschließen" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Ungültiger Code. Bitte erneut versuchen.")).toBeTruthy();
+    });
+    expect(onSuccess).not.toHaveBeenCalled();
+    // Form stays usable — QR/recovery section is still there, a retry is possible.
+    expect(screen.getByText("ABCD1234")).toBeTruthy();
+    const confirm = screen.getByRole("button", {
+      name: "Einrichtung abschließen",
+    }) as HTMLButtonElement;
+    expect(confirm.disabled).toBe(false);
+  });
+
+  // #1470: the banner told the user to "start over", but setup stayed
+  // non-null — the intro block (with the only "start setup" button) never
+  // came back, leaving the user stuck without a reload (which loses the
+  // preauthSetupToken entirely).
+  test("confirm schlägt mit invalid_setup_token fehl → Neustart-Pfad: Start-Button kommt zurück (#1470)", async () => {
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("preauth-enable-start")) return jsonResponse(startBody);
+      if (url.includes("preauth-confirm")) {
+        return jsonResponse({ isSuccess: false, error: "invalid_setup_token" });
+      }
+      return jsonResponse({ isSuccess: false, error: "unexpected_url" }, 500);
+    }) as unknown as typeof fetch;
+
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung abschließen" }));
+
+    await waitFor(() => {
+      expect(
+        screen.getByText("Die Einrichtung ist abgelaufen. Bitte erneut starten."),
+      ).toBeTruthy();
+    });
+    // The actual fix: intro re-appears with a working start button, the QR/
+    // recovery-codes section from the dead setup is gone.
+    expect(screen.getByRole("button", { name: "Einrichtung starten" })).toBeTruthy();
+    expect(screen.queryByText("ABCD1234")).toBeNull();
+  });
+
+  test("confirm schlägt mit invalid_challenge_token fehl → auch Neustart-Pfad (#1470)", async () => {
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("preauth-enable-start")) return jsonResponse(startBody);
+      if (url.includes("preauth-confirm")) {
+        return jsonResponse({ isSuccess: false, error: "invalid_challenge_token" });
+      }
+      return jsonResponse({ isSuccess: false, error: "unexpected_url" }, 500);
+    }) as unknown as typeof fetch;
+
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung abschließen" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("button", { name: "Einrichtung starten" })).toBeTruthy();
+    });
+  });
+
+  // kumiko-framework#1470: confirmMfaSetupPreauth already extracts
+  // retryAfterSeconds from error.details (see mfa-client.test.ts), but the
+  // screen used to drop it and show a generic "too many attempts" banner
+  // with no wait-time. Pins that the seconds actually reach the UI.
+  test("confirm schlägt mit too_many_attempts fehl → Banner zeigt retryAfterSeconds (#1470)", async () => {
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("preauth-enable-start")) return jsonResponse(startBody);
+      if (url.includes("preauth-confirm")) {
+        return jsonResponse({
+          isSuccess: false,
+          error: { code: "too_many_attempts", details: { retryAfterSeconds: 42 } },
+        });
+      }
+      return jsonResponse({ isSuccess: false, error: "unexpected_url" }, 500);
+    }) as unknown as typeof fetch;
+
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung abschließen" }));
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(
+          "Zu viele Fehlversuche. Bitte in 42 Sekunden erneut versuchen oder neu einloggen.",
+        ),
+      ).toBeTruthy();
+    });
+  });
+
+  // kumiko-framework#1470: server validates z.string().length(6) — a 7th
+  // pasted digit must not make the button look submittable, it would only
+  // 400 as invalid_body.
+  test("7-stelliger Code hält den Bestätigen-Button disabled", async () => {
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "1234567" },
+    });
+
+    const confirm = screen.getByRole("button", {
+      name: "Einrichtung abschließen",
+    }) as HTMLButtonElement;
+    expect(confirm.disabled).toBe(true);
+  });
+});

package/src/auth-mfa/web/__tests__/mfa-verify-screen.test.tsx

@@ -0,0 +1,104 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, type RenderResult, render, screen, waitFor } from "@testing-library/react";
+import type { ReactElement } from "react";
+import { makeSessionApi } from "../../../auth-email-password/web/__tests__/test-utils";
+import { SessionContext } from "../../../auth-email-password/web/session";
+import { defaultTranslations } from "../i18n";
+import { MfaVerifyScreen } from "../mfa-verify-screen";
+
+function renderScreen(ui: ReactElement, session = makeSessionApi()): RenderResult {
+  return render(
+    <PrimitivesProvider value={defaultPrimitives}>
+      <LocaleProvider
+        resolver={createStaticLocaleResolver({ locale: "de" })}
+        fallbackBundles={[defaultTranslations]}
+      >
+        <SessionContext.Provider value={session}>{ui}</SessionContext.Provider>
+      </LocaleProvider>
+    </PrimitivesProvider>,
+  );
+}
+
+const originalFetch = globalThis.fetch;
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe("MfaVerifyScreen", () => {
+  test("rendert Titel + Code-Feld + Submit-Button (de)", () => {
+    void renderScreen(<MfaVerifyScreen challengeToken="challenge-1" />);
+    expect(screen.getByText("Zwei-Faktor-Bestätigung")).toBeTruthy();
+    expect(screen.getByLabelText(/^Code/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Bestätigen" })).toBeTruthy();
+  });
+
+  test("richtiger Code → ruft session.refresh() + onSuccess()", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            isSuccess: true,
+            token: "t",
+            user: { id: "u1", tenantId: "t1", roles: [] },
+          }),
+          { status: 200 },
+        ),
+    ) as unknown as typeof fetch;
+    const session = makeSessionApi();
+    const onSuccess = mock(() => {});
+    void renderScreen(
+      <MfaVerifyScreen challengeToken="challenge-1" onSuccess={onSuccess} />,
+      session,
+    );
+
+    fireEvent.change(screen.getByLabelText(/^Code/), { target: { value: "123456" } });
+    fireEvent.click(screen.getByRole("button", { name: "Bestätigen" }));
+
+    await waitFor(() => {
+      expect(session.refresh).toHaveBeenCalled();
+      expect(onSuccess).toHaveBeenCalled();
+    });
+  });
+
+  test("falscher Code (invalid_totp_code) → Banner mit übersetztem Text", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ isSuccess: false, error: "invalid_totp_code" }), {
+          status: 200,
+        }),
+    ) as unknown as typeof fetch;
+    void renderScreen(<MfaVerifyScreen challengeToken="challenge-1" />);
+
+    fireEvent.change(screen.getByLabelText(/^Code/), { target: { value: "000000" } });
+    fireEvent.click(screen.getByRole("button", { name: "Bestätigen" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Ungültiger Code. Bitte erneut versuchen.")).toBeTruthy();
+    });
+  });
+
+  test("onCancel gesetzt → 'Zurück zum Login'-Button vorhanden, klick ruft onCancel", () => {
+    const onCancel = mock(() => {});
+    void renderScreen(<MfaVerifyScreen challengeToken="challenge-1" onCancel={onCancel} />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Zurück zum Login" }));
+    expect(onCancel).toHaveBeenCalled();
+  });
+
+  test("ohne onCancel → kein 'Zurück zum Login'-Button", () => {
+    void renderScreen(<MfaVerifyScreen challengeToken="challenge-1" />);
+    expect(screen.queryByRole("button", { name: "Zurück zum Login" })).toBeNull();
+  });
+});

package/src/auth-mfa/web/client-plugin.ts

@@ -0,0 +1,37 @@
+// @runtime client
+// Client-Feature-Factory für auth-mfa — mirrors emailPasswordClient()'s
+// shape so apps register both the same way:
+// createKumikoApp({ clientFeatures: [emailPasswordClient(), authMfaClient()] }).
+// No gates: MfaVerifyScreen isn't a route gate, it's a state swap wired
+// via EmailPasswordClientOptions.mfaVerifyScreen. This factory merges the
+// default de/en translations and maps MFA_ENABLE_SCREEN_ID to
+// MfaEnableScreen (same "components" convention as personal-access-tokens).
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ComponentType, ReactNode } from "react";
+import { MFA_ENABLE_SCREEN_ID } from "../constants";
+import { defaultTranslations, mergeTranslations } from "./i18n";
+import { MfaEnableScreen } from "./mfa-enable-screen";
+
+export type AuthMfaClientOptions = {
+  /** Key-Overrides pro Locale, gemerged mit den Default-Bundles (de/en). */
+  readonly translations?: TranslationsByLocale;
+};
+
+export type AuthMfaClientFeature = {
+  readonly name: "auth-mfa";
+  readonly providers: readonly ComponentType<{ children: ReactNode }>[];
+  readonly gates: readonly ComponentType<{ children: ReactNode }>[];
+  readonly translations: TranslationsByLocale;
+  readonly components: Readonly<Record<string, ComponentType>>;
+};
+
+export function authMfaClient(options: AuthMfaClientOptions = {}): AuthMfaClientFeature {
+  return {
+    name: "auth-mfa",
+    providers: [],
+    gates: [],
+    translations: mergeTranslations(defaultTranslations, options.translations ?? {}),
+    components: { [MFA_ENABLE_SCREEN_ID]: MfaEnableScreen },
+  };
+}

package/src/auth-mfa/web/i18n.ts

@@ -0,0 +1,136 @@
+// @runtime client
+// Default-Bundles für die auth-mfa Feature-UI. Merged in mit
+// authMfaClient() analog zu emailPasswordClient() aus auth-email-password.
+// Keys folgen `auth.mfa.<area>.<slug>`.
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  de: {
+    "screen:auth-mfa-enable.title": "Zwei-Faktor-Authentifizierung",
+    "auth.mfa.verify.title": "Zwei-Faktor-Bestätigung",
+    "auth.mfa.verify.subtitle": "Gib den 6-stelligen Code aus deiner Authenticator-App ein.",
+    "auth.mfa.verify.code": "Code",
+    "auth.mfa.verify.submit": "Bestätigen",
+    "auth.mfa.verify.submitting": "…",
+    "auth.mfa.verify.backToLogin": "Zurück zum Login",
+    "auth.mfa.errors.invalidCode": "Ungültiger Code. Bitte erneut versuchen.",
+    "auth.mfa.errors.invalidTotpCode": "Ungültiger Code. Bitte erneut versuchen.",
+    "auth.mfa.errors.invalidChallengeToken":
+      "Die Anmeldung ist abgelaufen. Bitte erneut einloggen.",
+    "auth.mfa.errors.challengeExpired": "Die Anmeldung ist abgelaufen. Bitte erneut einloggen.",
+    "auth.mfa.errors.tooManyAttempts": "Zu viele Fehlversuche. Bitte erneut einloggen.",
+    "auth.mfa.errors.tooManyAttemptsWithSeconds":
+      "Zu viele Fehlversuche. Bitte in {seconds} Sekunden erneut versuchen oder neu einloggen.",
+    "auth.mfa.errors.verifyFailed": "Bestätigung fehlgeschlagen.",
+    "auth.mfa.errors.mfaAlreadyEnabled": "Zwei-Faktor-Authentifizierung ist bereits aktiv.",
+    "auth.mfa.errors.mfaNotEnabled": "Zwei-Faktor-Authentifizierung ist nicht aktiv.",
+    "auth.mfa.errors.invalidSetupToken": "Die Einrichtung ist abgelaufen. Bitte erneut starten.",
+    "auth.mfa.errors.setupFailed": "Einrichtung fehlgeschlagen. Bitte erneut versuchen.",
+    "auth.mfa.errors.invalidRecoveryCode": "Ungültiger Recovery-Code.",
+    "auth.mfa.enable.title": "Zwei-Faktor-Authentifizierung",
+    "auth.mfa.enable.intro":
+      "Schütze dein Konto zusätzlich mit einer Authenticator-App (z.B. Google Authenticator, 1Password).",
+    "auth.mfa.enable.start": "Einrichtung starten",
+    "auth.mfa.enable.scanTitle": "QR-Code scannen",
+    "auth.mfa.enable.manualEntry": "Oder manuell eingeben:",
+    "auth.mfa.enable.recoveryTitle": "Recovery-Codes",
+    "auth.mfa.enable.recoveryHint":
+      "Speichere diese Codes an einem sicheren Ort. Sie werden nur dieses eine Mal angezeigt und erlauben dir den Zugriff, falls du dein Gerät verlierst.",
+    "auth.mfa.enable.acknowledge": "Ich habe die Recovery-Codes gespeichert.",
+    "auth.mfa.enable.code": "Code aus der Authenticator-App",
+    "auth.mfa.enable.cancel": "Abbrechen",
+    "auth.mfa.enable.confirm": "Aktivieren",
+    "auth.mfa.enable.success": "Zwei-Faktor-Authentifizierung ist jetzt aktiv.",
+    "auth.mfa.setup.title": "Zwei-Faktor-Authentifizierung erforderlich",
+    "auth.mfa.setup.subtitle":
+      "Dein Konto verlangt Zwei-Faktor-Authentifizierung. Richte sie jetzt ein, um dich anzumelden.",
+    "auth.mfa.setup.intro":
+      "Scanne den QR-Code mit einer Authenticator-App (z.B. Google Authenticator, 1Password).",
+    "auth.mfa.setup.start": "Einrichtung starten",
+    "auth.mfa.setup.confirm": "Einrichtung abschließen",
+    "auth.mfa.disable.title": "Zwei-Faktor-Authentifizierung deaktivieren",
+    "auth.mfa.disable.description":
+      "Bestätige mit einem Code aus deiner Authenticator-App oder einem Recovery-Code. Dein Konto ist danach nur noch durch dein Passwort geschützt.",
+    "auth.mfa.disable.code": "Code aus der Authenticator-App oder Recovery-Code",
+    "auth.mfa.disable.confirm": "Deaktivieren",
+    "auth.mfa.disable.cancel": "Abbrechen",
+    "auth.mfa.disable.trigger": "Zwei-Faktor-Authentifizierung deaktivieren",
+    "auth.mfa.regenerate.title": "Neue Recovery-Codes erzeugen",
+    "auth.mfa.regenerate.description":
+      "Bestätige mit einem Code aus deiner Authenticator-App. Alle bisherigen Recovery-Codes werden sofort ungültig.",
+    "auth.mfa.regenerate.code": "Code aus der Authenticator-App",
+    "auth.mfa.regenerate.confirm": "Neu erzeugen",
+    "auth.mfa.regenerate.cancel": "Abbrechen",
+    "auth.mfa.regenerate.trigger": "Neue Recovery-Codes erzeugen",
+    "auth.mfa.regenerate.newCodesTitle": "Deine neuen Recovery-Codes",
+    "auth.mfa.regenerate.newCodesHint":
+      "Speichere diese Codes an einem sicheren Ort. Die alten Codes funktionieren ab sofort nicht mehr.",
+    "auth.mfa.regenerate.acknowledge": "Ich habe die neuen Recovery-Codes gespeichert.",
+    "auth.mfa.regenerate.done": "Fertig",
+  },
+  en: {
+    "screen:auth-mfa-enable.title": "Two-factor authentication",
+    "auth.mfa.verify.title": "Two-factor verification",
+    "auth.mfa.verify.subtitle": "Enter the 6-digit code from your authenticator app.",
+    "auth.mfa.verify.code": "Code",
+    "auth.mfa.verify.submit": "Verify",
+    "auth.mfa.verify.submitting": "…",
+    "auth.mfa.verify.backToLogin": "Back to login",
+    "auth.mfa.errors.invalidCode": "Invalid code. Please try again.",
+    "auth.mfa.errors.invalidTotpCode": "Invalid code. Please try again.",
+    "auth.mfa.errors.invalidChallengeToken": "Your sign-in has expired. Please sign in again.",
+    "auth.mfa.errors.challengeExpired": "Your sign-in has expired. Please sign in again.",
+    "auth.mfa.errors.tooManyAttempts": "Too many failed attempts. Please sign in again.",
+    "auth.mfa.errors.tooManyAttemptsWithSeconds":
+      "Too many failed attempts. Try again in {seconds} seconds, or sign in again.",
+    "auth.mfa.errors.verifyFailed": "Verification failed.",
+    "auth.mfa.errors.mfaAlreadyEnabled": "Two-factor authentication is already enabled.",
+    "auth.mfa.errors.mfaNotEnabled": "Two-factor authentication is not enabled.",
+    "auth.mfa.errors.invalidSetupToken": "Setup expired. Please start again.",
+    "auth.mfa.errors.setupFailed": "Setup failed. Please try again.",
+    "auth.mfa.errors.invalidRecoveryCode": "Invalid recovery code.",
+    "auth.mfa.enable.title": "Two-factor authentication",
+    "auth.mfa.enable.intro":
+      "Add an extra layer of protection with an authenticator app (e.g. Google Authenticator, 1Password).",
+    "auth.mfa.enable.start": "Start setup",
+    "auth.mfa.enable.scanTitle": "Scan the QR code",
+    "auth.mfa.enable.manualEntry": "Or enter manually:",
+    "auth.mfa.enable.recoveryTitle": "Recovery codes",
+    "auth.mfa.enable.recoveryHint":
+      "Save these codes somewhere safe. They're shown only this once and let you back in if you lose your device.",
+    "auth.mfa.enable.acknowledge": "I've saved my recovery codes.",
+    "auth.mfa.enable.code": "Code from your authenticator app",
+    "auth.mfa.enable.cancel": "Cancel",
+    "auth.mfa.enable.confirm": "Enable",
+    "auth.mfa.enable.success": "Two-factor authentication is now enabled.",
+    "auth.mfa.setup.title": "Two-factor authentication required",
+    "auth.mfa.setup.subtitle":
+      "Your account requires two-factor authentication. Set it up now to sign in.",
+    "auth.mfa.setup.intro":
+      "Scan the QR code with an authenticator app (e.g. Google Authenticator, 1Password).",
+    "auth.mfa.setup.start": "Start setup",
+    "auth.mfa.setup.confirm": "Complete setup",
+    "auth.mfa.disable.title": "Disable two-factor authentication",
+    "auth.mfa.disable.description":
+      "Confirm with a code from your authenticator app or a recovery code. Your account will then be protected by your password alone.",
+    "auth.mfa.disable.code": "Code from your authenticator app or a recovery code",
+    "auth.mfa.disable.confirm": "Disable",
+    "auth.mfa.disable.cancel": "Cancel",
+    "auth.mfa.disable.trigger": "Disable two-factor authentication",
+    "auth.mfa.regenerate.title": "Generate new recovery codes",
+    "auth.mfa.regenerate.description":
+      "Confirm with a code from your authenticator app. All existing recovery codes stop working immediately.",
+    "auth.mfa.regenerate.code": "Code from your authenticator app",
+    "auth.mfa.regenerate.confirm": "Generate new codes",
+    "auth.mfa.regenerate.cancel": "Cancel",
+    "auth.mfa.regenerate.trigger": "Generate new recovery codes",
+    "auth.mfa.regenerate.newCodesTitle": "Your new recovery codes",
+    "auth.mfa.regenerate.newCodesHint":
+      "Save these codes somewhere safe. The old codes stop working immediately.",
+    "auth.mfa.regenerate.acknowledge": "I've saved my new recovery codes.",
+    "auth.mfa.regenerate.done": "Done",
+  },
+};
+
+export { mergeTranslations } from "@cosmicdrift/kumiko-renderer";