@cosmicdrift/kumiko-samples 0.378.0 → 0.380.0

package/packages/bundled-features/src/audit/web/default-translations.ts

@@ -0,0 +1,7 @@
+import {
+  type TranslationsByLocale,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
+import { AUDIT_I18N } from "./i18n.ts";
+
+export const defaultTranslations: TranslationsByLocale = translationsByLocaleFromKeys(AUDIT_I18N);

package/packages/bundled-features/src/audit/web/i18n.ts

@@ -1,8 +1,34 @@
-// @runtime client
-import {
-  type TranslationsByLocale,
-  translationsByLocaleFromKeys,
-} from "@cosmicdrift/kumiko-renderer";
-import { AUDIT_I18N } from "../i18n.ts";
+// Server + client i18n for audit (nav labels + audit-log/-detail screens).
 
-export const defaultTranslations: TranslationsByLocale = translationsByLocaleFromKeys(AUDIT_I18N);
+type LocalizedString = { readonly en: string };
+
+export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:audit-log.title": { en: "Audit log" },
+  "screen:audit-log-detail.title": { en: "Event" },
+  "audit.log.description": {
+    en: "All events of this tenant. A row opens the details.",
+  },
+  "audit.log.allTenants.description": {
+    en: "All events of all tenants. A row opens the details.",
+  },
+  "audit.log.detail.subtitle": {
+    en: "One event with its actor, time and stored data.",
+  },
+  "audit.errors.systemScopeRequiresSystemAdmin": {
+    en: "Only SystemAdmin may read system events.",
+  },
+  "screen:audit-log-all-tenants.title": { en: "Audit log (all tenants)" },
+  "screen:audit-log-all-tenants-detail.title": { en: "Event" },
+  "audit:nav.auditLog": { en: "Audit" },
+  "audit:nav.auditLogAllTenants": { en: "Audit log (all tenants)" },
+  "audit.log.col.tenant": { en: "Tenant" },
+  "audit.log.col.when": { en: "When" },
+  "audit.log.col.type": { en: "Event" },
+  "audit.log.col.aggregateType": { en: "Aggregate type" },
+  "audit.log.col.aggregateId": { en: "Aggregate ID" },
+  "audit.log.col.actor": { en: "Actor" },
+  "audit.log.details": { en: "Details" },
+  "audit.log.detail.payload": { en: "Event payload" },
+  "audit.log.detail.metadata": { en: "Metadata" },
+  "audit.log.detail.field.id": { en: "Event ID" },
+};

package/packages/bundled-features/src/audit/web/index.ts

@@ -1,3 +1 @@
-// @runtime client
-
 export { type AuditClientOptions, auditClient } from "./client-plugin.tsx";

package/packages/bundled-features/src/auth-email-password/bootstrap.ts

@@ -24,23 +24,23 @@ import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import type { Redis } from "ioredis";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
-import { ConfigHandlers } from "../config/constants.ts";
+import { ConfigHandlers } from "../config/web/constants.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap compares against the stored config row to stay idempotent
 import { configRowHoldsValue, findConfigRow } from "../config/write-helpers.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
-import { TenantHandlers } from "../tenant/constants.ts";
-// kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
 import { INVITATION_STATUS, tenantInvitationsTable } from "../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap checks existing memberships
 import { tenantMembershipsTable } from "../tenant/membership-table.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap checks for an existing tenant
 import { tenantTable } from "../tenant/schema/tenant.ts";
-// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
-import type { GlobalRole } from "../user/constants.ts";
+// kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
+import { TenantHandlers } from "../tenant/web/constants.ts";
 // kumiko-lint-ignore cross-feature-import bootstrap skips already activated users
 import { userTable } from "../user/schema/user.ts";
-import { AuthHandlers } from "./constants.ts";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import type { GlobalRole } from "../user/web/constants.ts";
 import { hasLiveInviteToken } from "./invite-token-store.ts";
+import { AuthHandlers } from "./web/constants.ts";
 
 export type BootstrapInvite = {
   readonly email: string;

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Unknown e-mail addresses count towards the login lockout",
+    "detail": "Failed logins for unknown or deleted addresses are counted under a keyed digest of the normalized address (ctx.rateLimitDigest, derived from the JWT secret), so after the threshold they answer account_locked like a registered address and the lock no longer reveals which addresses exist. Without a digest key the old invalid_credentials answer stays."
+  },
   {
     "version": "0.374.0",
     "type": "improvement",

package/packages/bundled-features/src/auth-email-password/errors.ts

@@ -1,5 +1,5 @@
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { AuthErrors } from "./constants.ts";
+import { AuthErrors } from "./web/constants.ts";
 
 // @wrapper-known error-helper
 export function invalidCredentials() {

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -1,7 +1,6 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { type FeatureWithEnvSchema, featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
-import { MIN_HMAC_SECRET_LENGTH } from "./constants.ts";
 import type { AuthMailLocale } from "./email-templates.ts";
 import { changePasswordWrite } from "./handlers/change-password.write.ts";
 import { createConfirmAccountUnlockHandler } from "./handlers/confirm-account-unlock.write.ts";
@@ -31,13 +30,14 @@ import {
 } from "./handlers/signup-request.write.ts";
 import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.ts";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.ts";
-import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./mail-i18n.ts";
 import {
   AUTH_MAIL_VARIABLES,
   authMailLocalizedTemplate,
   INVITE_MAIL_VARIABLES,
   sendsMagicLinkMail,
 } from "./mail-notifications.ts";
+import { MIN_HMAC_SECRET_LENGTH } from "./web/constants.ts";
+import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./web/mail-i18n.ts";
 
 /**
  * Env-vars contract for the `auth-email-password` feature.

package/packages/bundled-features/src/auth-email-password/handlers/confirm-account-unlock.write.ts

@@ -5,10 +5,10 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { AuthErrors } from "../constants.ts";
 import { invalidUnlockToken } from "../errors.ts";
 import { clearLockoutState } from "../lockout-store.ts";
 import { verifyUnlockToken } from "../unlock-token.ts";
+import { AuthErrors } from "../web/constants.ts";
 
 export type ConfirmAccountUnlockOptions = {
   readonly hmacSecret: string;

package/packages/bundled-features/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -52,10 +52,6 @@ import {
 } from "../../user/invited-global-roles.ts";
 // kumiko-lint-ignore cross-feature-import login-style password-check
 import { userTable } from "../../user/schema/user.ts";
-import {
-  AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
-  AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
-} from "../constants.ts";
 import { invalidCredentials, invalidInviteToken, inviteEmailMismatch } from "../errors.ts";
 import {
   burnInviteToken,
@@ -64,6 +60,10 @@ import {
   unburnInviteToken,
 } from "../invite-token-store.ts";
 import { passwordSchema } from "../password-policy.ts";
+import {
+  AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
+  AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
+} from "../web/constants.ts";
 import {
   gateEnforceAccountStatus,
   gateEnforceEmailVerified,

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -50,16 +50,16 @@ import {
   reservedMembershipRoleError,
   unassignableMembershipRoleError,
 } from "../../tenant/membership-roles.ts";
-// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
-import { GLOBAL_ROLE_OPTIONS, type GlobalRole } from "../../user/constants.ts";
 // kumiko-lint-ignore cross-feature-import invitee lookup by email reads the user row
 import { userTable } from "../../user/schema/user.ts";
-import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.ts";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS, type GlobalRole } from "../../user/web/constants.ts";
 import type { AuthMailLocale } from "../email-templates.ts";
 import { inviteAlreadyAccepted } from "../errors.ts";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.ts";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.ts";
 import { AuthMailNotificationTypes } from "../mail-notifications.ts";
+import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../web/constants.ts";
 
 const InviteCreateSchema = z.object({
   email: z.email(),

package/packages/bundled-features/src/auth-email-password/handlers/invite-info.query.ts

@@ -14,8 +14,8 @@ import { decryptStoredPii } from "../../shared/index.ts";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import login-style account lookup, same as invite-accept-with-login
 import { userTable } from "../../user/schema/user.ts";
-import { AuthErrors } from "../constants.ts";
 import { getInvitationIdForToken } from "../invite-token-store.ts";
+import { AuthErrors } from "../web/constants.ts";
 
 const InviteInfoSchema = z.object({
   token: z.string().min(1),

package/packages/bundled-features/src/auth-email-password/handlers/login.write.ts

@@ -14,10 +14,6 @@ import * as z from "zod";
 import { verifyDummyPassword, verifyPassword } from "../../shared/index.ts";
 import { USER_STATUS, UserQueries } from "../../user/index.ts";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row.ts";
-import {
-  AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
-  AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
-} from "../constants.ts";
 import {
   accountLocked,
   accountRestricted,
@@ -26,6 +22,10 @@ import {
   noMembership,
 } from "../errors.ts";
 import { clearLockoutState, getLockoutState, recordFailedAttempt } from "../lockout-store.ts";
+import {
+  AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
+  AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
+} from "../web/constants.ts";
 
 export type LoginHandlerOptions = {
   // When true, a valid (email + password) login fails with email_not_verified
@@ -105,6 +105,31 @@ export async function gateResolveAuthUser(
   return ok({ ...found, passwordHash: found.passwordHash });
 }
 
+// Unknown and deleted addresses are counted too, under a keyed digest of the
+// address exactly as findForAuth looks it up (no own normalization: a differently
+// cased spelling is a different, unknown address and must not share a counter with a
+// registered one). ctx.rateLimitDigest is derived from the JWT secret, so that after the
+// threshold they answer account_locked exactly like a registered address.
+// Without a digest key (no rate-limit wiring) they stay plain invalid_credentials.
+function unknownEmailLockoutSubject(ctx: HandlerContext, email: string): string | undefined {
+  const digest = ctx.rateLimitDigest?.(email);
+  return digest === undefined ? undefined : `email:${digest}`;
+}
+
+export async function gateCountUnknownUser(
+  ctx: HandlerContext,
+  email: string,
+  maxFailedAttempts: number,
+  lockoutDurationMinutes: number,
+): Promise<GateOutcome<undefined>> {
+  const subject = unknownEmailLockoutSubject(ctx, email);
+  if (!ctx.redis || subject === undefined) return ok(undefined);
+  const locked = await gateEnforceLockout(ctx, subject);
+  if (!locked.ok) return locked;
+  await recordFailedAttempt(ctx.redis, subject, maxFailedAttempts, lockoutDurationMinutes);
+  return ok(undefined);
+}
+
 /**
  * Lockout BEFORE password verify — locked accounts can't be password-probed.
  * Fail-open without Redis (IP rate-limit still covers partially).
@@ -295,6 +320,15 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       const foundRow = parseAuthUserRow(
         await ctx.queryAs(systemUser, UserQueries.findForAuth, { email: event.payload.email }),
       );
+      if (!foundRow?.passwordHash || foundRow.isDeleted) {
+        const unknown = await gateCountUnknownUser(
+          ctx,
+          event.payload.email,
+          maxFailedAttempts,
+          lockoutDurationMinutes,
+        );
+        if (!unknown.ok) return unknown.result;
+      }
       const userGate = await gateResolveAuthUser(foundRow, event.payload.password);
       if (!userGate.ok) return userGate.result;
       const found = userGate.value;

package/packages/bundled-features/src/auth-email-password/handlers/request-account-unlock.write.ts

@@ -1,6 +1,6 @@
-import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.ts";
 import { AuthMailNotificationTypes } from "../mail-notifications.ts";
 import { signUnlockToken } from "../unlock-token.ts";
+import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../web/constants.ts";
 import {
   createTokenRequestHandler,
   type TokenRequestData,

package/packages/bundled-features/src/auth-email-password/handlers/request-email-verification.write.ts

@@ -1,6 +1,6 @@
-import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.ts";
 import { AuthMailNotificationTypes } from "../mail-notifications.ts";
 import { signVerificationToken } from "../verification-token.ts";
+import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../web/constants.ts";
 import {
   createTokenRequestHandler,
   type TokenRequestData,

package/packages/bundled-features/src/auth-email-password/handlers/request-password-reset.write.ts

@@ -1,6 +1,6 @@
-import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.ts";
 import { AuthMailNotificationTypes } from "../mail-notifications.ts";
 import { signResetToken } from "../reset-token.ts";
+import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../web/constants.ts";
 import {
   createTokenRequestHandler,
   type TokenRequestData,

package/packages/bundled-features/src/auth-email-password/handlers/reset-password.write.ts

@@ -2,10 +2,10 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { hashPassword } from "../../shared/index.ts";
-import { AuthErrors } from "../constants.ts";
 import { invalidResetToken } from "../errors.ts";
 import { passwordSchema } from "../password-policy.ts";
 import { verifyResetToken } from "../reset-token.ts";
+import { AuthErrors } from "../web/constants.ts";
 import { runConfirmTokenFlow } from "./confirm-token-flow.ts";
 
 export type ResetPasswordOptions = {

package/packages/bundled-features/src/auth-email-password/handlers/verify-email.write.ts

@@ -1,9 +1,9 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { AuthErrors } from "../constants.ts";
 import { invalidVerificationToken } from "../errors.ts";
 import { verifyVerificationToken } from "../verification-token.ts";
+import { AuthErrors } from "../web/constants.ts";
 import { runConfirmTokenFlow } from "./confirm-token-flow.ts";
 
 export type VerifyEmailOptions = {

package/packages/bundled-features/src/auth-email-password/index.ts

@@ -20,7 +20,6 @@ export type {
   BootstrapTenantOutcome,
 } from "./bootstrap.ts";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.ts";
-export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.ts";
 export type { AuthMailLocale } from "./email-templates.ts";
 export type {
   AccountLockoutOptions,
@@ -55,3 +54,9 @@ export {
   SIGNUP_TOKEN_KEY_PREFIXES,
   storeSignupToken,
 } from "./signup-token-store.ts";
+export {
+  AUTH_EMAIL_PASSWORD_FEATURE,
+  AuthErrors,
+  AuthHandlers,
+  AuthQueries,
+} from "./web/constants.ts";

package/packages/bundled-features/src/auth-email-password/mail-notifications.ts

@@ -12,7 +12,7 @@ import {
   resolveMailLocale,
 } from "@cosmicdrift/kumiko-framework/i18n";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
-import { AUTH_EMAIL_PASSWORD_FEATURE } from "./constants.ts";
+import { AUTH_EMAIL_PASSWORD_FEATURE } from "./web/constants.ts";
 
 export const AUTH_MAIL_KINDS = {
   passwordReset: { name: "password-reset", translationKey: "reset" },

package/packages/bundled-features/src/auth-email-password/signup-activation.ts

@@ -8,7 +8,6 @@ import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { Redis } from "ioredis";
-import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "./constants.ts";
 import { dispatchMagicLinkMail } from "./magic-link-mail.ts";
 import { AuthMailNotificationTypes } from "./mail-notifications.ts";
 import {
@@ -16,6 +15,7 @@ import {
   normalizeEmail,
   storeSignupToken,
 } from "./signup-token-store.ts";
+import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "./web/constants.ts";
 
 export const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = AuthMailNotificationTypes.signupActivation;
 

package/packages/bundled-features/src/auth-email-password/web/auth-client.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Browser-Seite der Auth-Routes. Dünne fetch-Wrapper um /api/auth/*
 // mit Cookie-Transport: JWT lebt im HttpOnly kumiko_auth-Cookie,
 // Double-Submit-CSRF-Token im JS-lesbaren kumiko_csrf-Cookie. Alle

package/packages/bundled-features/src/auth-email-password/web/auth-form-logic.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure form helpers shared by auth screens. Extracted so unit tests can
 // pin password / rate-limit / redirect rules without mounting React.
 

package/packages/bundled-features/src/auth-email-password/web/auth-form-primitives.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Shared Web-Primitives für die Auth-Screens. Nur noch Layout/Style-
 // Helpers — Form/Field/Input/Button/Banner kommen jetzt über
 // usePrimitives() aus dem Framework-Vertrag, damit Native dieselben

package/packages/bundled-features/src/auth-email-password/web/auth-gate.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Auth-Gate: rendert den LoginScreen solange der Session-Status
 // "unauthenticated" ist, sonst die Kinder. "loading" zeigt einen
 // minimalen Placeholder — die initiale Refresh-Runde liefert in der

package/packages/bundled-features/src/auth-email-password/web/auth-redirect.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Redirect targets for external login pages. `next` travels through the query
 // string, so anything read back from it is untrusted: only same-origin
 // root-relative paths pass (no "//host", no "/\host", no scheme).

package/packages/bundled-features/src/auth-email-password/web/client-actions.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Handlers for RowAction `kind: "clientAction"`: an admin screen lists users and
 // triggers the same public mail flows the login screens use.
 

package/packages/bundled-features/src/auth-email-password/web/client-plugin.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Client-Feature-Factory für auth-email-password. Wird vom App-Code
 // in createKumikoApp({ clientFeatures: [emailPasswordClient()] })
 // eingehängt und bringt Session-Context + AuthGate + Default-UI-
@@ -7,7 +6,6 @@
 
 import type { ClientActionHandler, TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
-import { defaultTranslations, mergeTranslations } from "../i18n.ts";
 import {
   type AuthGateOptions,
   type MfaSetupComponentProps,
@@ -15,6 +13,7 @@ import {
   makeSessionAuthGate,
 } from "./auth-gate.tsx";
 import { emailPasswordClientActions } from "./client-actions.ts";
+import { defaultTranslations, mergeTranslations } from "./i18n.ts";
 import type { LoginScreenProps } from "./login-screen.tsx";
 
 export type EmailPasswordClientOptions = {

package/packages/bundled-features/src/auth-email-password/web/confirm-account-unlock-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // ConfirmAccountUnlockScreen — reads `?token=...` from the URL, auto-posts
 // it to /api/auth/confirm-account-unlock on mount, shows success/error.
 // Idempotent server-side (clearLockoutState is a no-op when already

package/packages/bundled-features/src/auth-email-password/{constants.ts → web/constants.ts}

@@ -1,9 +1,6 @@
-// @runtime client
-// Pure string constants — no DB/Node builtins. Marked `@runtime client` so
-// browser code (Members screen etc.) can import them too without the
-// runtime-isolation guard complaining. Runtime may import "client" files
-// (see RUNTIME_RULES), so server-side access (handlers, dispatcher) stays
-// intact as well.
+// Pure string constants — no DB/Node builtins. They live under web/ so browser
+// code (Members screen etc.) can import them without the runtime-isolation
+// guard complaining; runtime may import client files, so handlers keep using them.
 export const AUTH_EMAIL_PASSWORD_FEATURE = "auth-email-password" as const;
 
 // Minimum length for reset/verify hmacSecret — mirrors the ≥32-char

package/packages/bundled-features/src/auth-email-password/web/default-topbar-actions.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Standard-Topbar-Actions Komposition für Apps mit Auth + Workspaces.
 // Bündelt das Pattern das jeder App-Sample sonst hand-ausschreibt:
 // TenantSwitcher (links) → optional Extras (z.B. LanguageSwitcher) →

package/packages/bundled-features/src/auth-email-password/web/forgot-password-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // ForgotPasswordScreen — Form mit email-input. Submit triggert
 // /api/auth/request-password-reset (silent-success, kein account-
 // enumeration). UI zeigt unconditional ein "Wenn Account existiert,

package/packages/bundled-features/src/auth-email-password/{i18n.ts → web/i18n.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // English UI copy for this feature. emailPasswordClient() mounts it as a
 // LocaleProvider fallback. Apps override keys via
 // `emailPasswordClient({ translations })`. German/Spanish ship in
@@ -150,7 +149,7 @@ export const defaultTranslations: TranslationsByLocale = {
   },
 };
 
-// Kanonische Implementierung lebt jetzt im Renderer (neben
-// TranslationsByLocale) — Re-Export hält die bestehende Import-Surface
-// (auth-email-password/web) stabil.
+// The canonical implementation lives in the renderer (next to
+// TranslationsByLocale); the re-export keeps the existing import surface
+// (auth-email-password/web) stable.
 export { mergeTranslations } from "@cosmicdrift/kumiko-renderer";

package/packages/bundled-features/src/auth-email-password/web/index.ts

@@ -1,11 +1,9 @@
-// @runtime client
 // Public exports für die Browser-Seite des auth-email-password Features.
 // Wird über den Sub-Path-Export `@cosmicdrift/kumiko-bundled-features/auth-email-
 // password/web` konsumiert — die Server-Seite (defineFeature) lebt in
 // `@cosmicdrift/kumiko-bundled-features/auth-email-password` und hat keine
 // React-/DOM-Deps. Trennung bleibt sauber so wie renderer vs renderer/web.
 
-export { defaultTranslations, mergeTranslations } from "../i18n.ts";
 export type {
   AuthTokenFailure,
   CurrentUserProfile,
@@ -56,6 +54,7 @@ export type { DefaultTopbarActionsProps } from "./default-topbar-actions.tsx";
 export { DefaultTopbarActions } from "./default-topbar-actions.tsx";
 export type { ForgotPasswordScreenProps } from "./forgot-password-screen.tsx";
 export { ForgotPasswordScreen } from "./forgot-password-screen.tsx";
+export { defaultTranslations, mergeTranslations } from "./i18n.ts";
 export type { InviteAcceptScreenProps } from "./invite-accept-screen.tsx";
 export { InviteAcceptScreen } from "./invite-accept-screen.tsx";
 export type { AuthLegalLink, LoginScreenProps } from "./login-screen.tsx";

package/packages/bundled-features/src/auth-email-password/web/invite-accept-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // InviteAcceptScreen — Magic-Link-Accept für Tenant-Invitations.
 //
 // Liest `?token=...` aus der URL und branched intern je nach session-state:
@@ -30,8 +29,8 @@ export type InviteAcceptScreenProps = {
    *  `(data) => "/${data.tenantId}/"`. Function-form receives the roles this
    *  flow grants in the target tenant; branch 1 reports the invitation's
    *  role, which for an existing member is not their full role set there.
-   *  @deprecated Configure auth.postAuthLanding on the server; its landingPath wins.
-   *  Kept as fallback. */
+   *  @deprecated Removed in 0.390.0. Configure auth.postAuthLanding on the server; its landingPath wins.
+   *  Kept as fallback until 0.390.0. */
   readonly loggedInHref?:
     | string
     | ((args: { tenantId: string; roles: readonly string[] }) => string);

package/packages/bundled-features/src/auth-email-password/web/login-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Default-LoginScreen. Reine E-Mail-+-Passwort-Form, zentriert, Card-
 // Layout. Texte kommen aus `useTranslation()` — die Default-Bundles
 // (de+en) liefert das Feature selber mit (translations.ts); Apps die

package/packages/bundled-features/src/auth-email-password/{mail-i18n.ts → web/mail-i18n.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Server-registered so the document designer names the seeded auth mails.
 export const AUTH_EMAIL_PASSWORD_MAIL_I18N: Readonly<Record<string, { readonly en: string }>> = {
   "auth-email-password:feature.label": { en: "Sign-in" },

package/packages/bundled-features/src/auth-email-password/web/request-account-unlock-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // RequestAccountUnlockScreen — form with an email input. Submit triggers
 // /api/auth/request-account-unlock (silent-success, no account
 // enumeration). UI unconditionally shows an "if your account is locked,

package/packages/bundled-features/src/auth-email-password/web/reset-password-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // ResetPasswordScreen — liest `?token=...` aus der URL, zeigt Form mit
 // new + confirm-password. Submit triggert /api/auth/reset-password mit
 // dem Token. Server collapses alle Token-Verify-Failures auf einen

package/packages/bundled-features/src/auth-email-password/web/session-bootstrap-error.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Rendered by auth-gate's LoginRoute when the session bootstrap failed for a reason other than "not logged in".
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";

package/packages/bundled-features/src/auth-email-password/web/session.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Session-State für den Browser-Renderer. Hält den aktuell eingeloggten
 // User (Profile + aktive Tenant-Zuordnung + Memberships), reagiert auf
 // Login/Logout/Switch-Tenant und refresh't die Daten automatisch.

package/packages/bundled-features/src/auth-email-password/web/signup-complete-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // SignupCompleteScreen — Magic-Link-Self-Signup, Step 2.
 //
 // Reads `?token=...` from the URL, shows a form with password + confirm.
@@ -31,8 +30,8 @@ export type SignupCompleteScreenProps = {
   /** Where to send the user after activation. Function-form receives the tenantKey, the
    *  roles granted by this flow in that tenant, and the claimed `handover` entity when
    *  signup claimed a try-first grant. Default "/".
-   *  @deprecated Configure auth.postAuthLanding on the server; its landingPath wins.
-   *  Kept as fallback. */
+   *  @deprecated Removed in 0.390.0. Configure auth.postAuthLanding on the server; its landingPath wins.
+   *  Kept as fallback until 0.390.0. */
   readonly loggedInHref?:
     | string
     | ((args: {

package/packages/bundled-features/src/auth-email-password/web/signup-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // SignupScreen — Magic-Link-Self-Signup, Step 1.
 //
 // Form mit Email-Input. Submit triggert /api/auth/signup-request

package/packages/bundled-features/src/auth-email-password/web/tenant-menu-items.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Tenant choices as dropdown entries — the TenantSwitcher's list for a user
 // menu that carries the shell controls. Renders nothing for a single tenant.
 

package/packages/bundled-features/src/auth-email-password/web/tenant-switcher.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // TenantSwitcher — kleines Dropdown, zeigt den aktiven Tenant und
 // erlaubt Wechsel zu anderen Memberships. Auf Radix-DropdownMenu für
 // konsistentes Verhalten (Click-outside/Escape/Keyboard-Nav).

package/packages/bundled-features/src/auth-email-password/web/use-shell-user.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Liest den eingeloggten User + die Rollen aus dem aktiven Tenant aus
 // der Session. Der Hook ist die Standard-Brücke zwischen Session-State
 // und Layout-Komponenten (WorkspaceShell.user, DefaultAppShell-Gates,

package/packages/bundled-features/src/auth-email-password/web/user-menu.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // UserMenu — Avatar-Dropdown für die Topbar (variant="pill", Default) oder den
 // Sidebar-Footer (variant="sidebar" = die sidebar-07-NavUser-Row). Zeigt
 // Name/Email + Logout. Auf Radix-DropdownMenu, damit Click-outside, Escape,

package/packages/bundled-features/src/auth-email-password/web/verify-email-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // VerifyEmailScreen — liest `?token=...` aus URL, schickt ihn auto an
 // /api/auth/verify-email beim Mount, zeigt success/error. Idempotent
 // auf Server-Seite (mehrfaches Klicken setzt emailVerified=true erneut),

package/packages/bundled-features/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "MFA setup uses the shared QR secret primitive",
+    "detail": "The pre-auth MFA setup screen renders the QR code and secret through the renderer's QR secret primitive instead of its own markup."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",