[pyramation]

Summary

Client half of constructive-planning#2284, pairs with constructive-io/constructive-db#4086. Password signUp now returns nothing and never signs anyone in. The tenant mails a one-time sign-in link to /auth/magic, and a fresh address and a taken one get the same answer.

• packages/sheets useRegister: selects only clientMutationId, sends { email, password }, stores no token, and returns { email }. Remember-me is removed from RegisterForm and its schema.
• console-runtime/standalone-session: signUp resolves { status: 'check-email' } and the snapshot stays anonymous. signIn is unchanged.
• feature-packs/auth/auth-entry-panel: sign-up shows "Check your email…" instead of calling onAuthenticated.
• e2e-live/constructive-graphql.ts: the helper signs up, then signs in.

Evidence: tsc --noEmit is clean in apps/blocks and packages/sheets. packages/sheets vitest: 369 passed. apps/blocks console-runtime + feature-packs/auth: 50 passed.

packages/sheets/dist-vendor is not rebuilt here. Rebuilding it locally rewrites about 200k lines from dependency drift, so it's left for the release build.

Merge after constructive-io/constructive-db#4086 is deployed.

Written by Devin

Open in Devin Desktop: https://app.devin.ai/desktop/session/c288d2e1eb6d40f3b313b4e6a39de289?variant=devin
Requested by: @pyramation

[tenki-reviewer]

Review complete. 🟡 2 medium

📍 Findings outside the diff (2) — 🟡 2 medium — defects on lines GitHub can't attach comments to

🟡 Medium — Sheets sign-up success gives the user no feedback · register-form.tsx:34–41 · unchanged line

// packages/sheets/src/auth/ui/register-form.tsx
34				try {
35					const validatedData = registerSchema.parse(value);
36					await onRegister(validatedData);
37				} catch (err) {
38					setError(parseGraphQLError(err).message);
39				} finally {
40					setIsSubmitting(false);
41				}

Sign-up no longer signs the user in (packages/sheets/src/auth/hooks/use-register.ts:24-38 now only executes the mutation and returns { email }), but the sheets register UI shows nothing on success: SheetsRegisterForm.onSubmit resolves onRegister and merely re-enables the button (packages/sheets/src/auth/ui/register-form.tsx:34-41), and StandaloneAuthUI keeps rendering the register form (packages/sheets/src/auth/auth-gate.tsx:116-121). The analogous console path was updated with a 'Check your email' notice (apps/blocks/src/blocks/feature-packs/auth/auth-entry-panel.tsx:192), but the sheets path was not. Users who just created an account are left on an inert form with no indication they must confirm their address and sign in.

---

🟡 Medium — Vendor bundle still ships the old signUp flow · index.js:100327–100333 · file not in diff

// packages/sheets/dist-vendor/index.js
100327	            rememberMe: formData.rememberMe ?? true
100328	          }
100329	        }
100330	      );
100331	      const signUpResult = result.signUp?.result;
100332	      const token = signUpResult ? toAuthToken(signUpResult) : null;
100333	      return { token, email: formData.email, identityKey: signUpResult?.userId ?? null };

The committed vendor bundle packages/sheets/dist-vendor/index.js still contains the pre-change signUp behavior: it sends rememberMe: formData.rememberMe ?? true (packages/sheets/dist-vendor/index.js:100327) and stores a session token from signUp?.result via toAuthToken (packages/sheets/dist-vendor/index.js:100331-100333). The file was modified in this PR's commit yet not regenerated from the updated source, which now selects only clientMutationId and never stores a token. Whatever consumes the vendor artifact still runs the old flow against the new server contract, where signUp returns no session.

🧹 Nitpicks (1) — 🟢 1 low

• 🟢 Unused data binding in e2e signUp helper (constructive-graphql.ts:183) — The e2e signUp helper assigns the mutation response to data (apps/blocks/e2e-live/constructive-graphql.ts:183) but, after this change, returns signIn(tenant, credentials) without ever reading data — dead code that lint will flag.

---

This PR converts sign-up from an auto-login flow to a check-your-email flow: the signUp mutation selection is narrowed to clientMutationId, rememberMe/credentialKind are dropped from the sign-up payload, and callers react with a check-email outcome.

Files	Change
packages/sheets/src/auth/* (auth-types.ts, schemas.ts, use-register.ts, register-form.tsx)	Removes rememberMe from the form, schema, and SignUpInput; the register hook now executes only the mutation and returns { email } instead of storing tokens.
apps/blocks/src/blocks/console-runtime/standalone-session.*	Adds a check-email outcome for sign-up, validates the signIn envelope, and updates tests.
apps/blocks/src/blocks/feature-packs/auth/auth-entry-panel.tsx	Shows a "Check your email" notice after successful sign-up.
apps/blocks/e2e-live/constructive-graphql.ts	Updates the e2e client's signUp helper to chain into signIn with the just-set credentials.

_{Reviewed commit: c823486}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring