@cosmicdrift/kumiko-bundled-features 0.385.0 → 0.387.0

package/dist/document-ingest-foundation/entity.js

@@ -2,7 +2,7 @@ import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createJsonbField, createLongTextField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
 // documentExtract — implicit entity-projection (r.entity, NOT r.projection):
 // an explicit r.projection would make `forget` non-rebuild-safe and require
-// archiveStream instead of the regular forget path (kumiko-framework#1495).
+// archiveStream instead of the regular forget path.
 // fileRefId points at the source file_refs row; storageKey duplicates it for
 // direct provider access without a join.
 export const documentExtractEntity = createEntity({
@@ -15,11 +15,11 @@ export const documentExtractEntity = createEntity({
             reason: "technical_reference",
         }),
         // Holds the full extracted document text (PII). `personal: "tenant"`,
-        // NOT `encrypted: true` (#1621): the master-key path has no erasure subject,
+        // NOT `encrypted: true`: the master-key path has no erasure subject,
         // so nothing here would ever be shreddable. Tenant-subject ciphertext
-        // dies with eraseSubjectKeys on tenant-destroy (#800 pattern). Whose
+        // dies with eraseSubjectKeys on tenant-destroy. Whose
         // subject a third party named inside a document is stays open, same as
-        // inbound-mail-foundation (#957). meta is provider telemetry only and
+        // inbound-mail-foundation. meta is provider telemetry only and
         // stays plaintext jsonb.
         pages: createLongTextField({
             personal: "tenant",

package/dist/document-ingest-foundation/events.js

@@ -3,8 +3,8 @@ import * as z from "zod";
 // stream per fileRef with aggregateId derived from the fileRefId
 // (documentIngestAggregateId), never the fileRefId itself: foreign events on
 // the fileRef stream would break the fileRef's optimistic lock. Not backed by an r.entity;
-// this is a pure saga-anchor event (kumiko-framework#1497) that the Phase-2
-// worker job (kumiko-enterprise LiteParse provider) subscribes to.
+// this is a pure saga-anchor event that the worker job (kumiko-enterprise LiteParse provider)
+// subscribes to.
 export const DOCUMENT_INGEST_AGGREGATE_TYPE = "document-ingest";
 // Stream name of stored extract events; differs from the camelCase r.entity name
 // "documentExtract", so the projection replays this stream through an extension.

package/dist/document-ingest-foundation/feature.js

@@ -114,7 +114,7 @@ export function createDocumentIngestFoundationFeature() {
             default: "deu+eng",
             // Tesseract -l argument syntax: one or more 3-letter language codes
             // joined by "+" (e.g. "deu+eng"). Unconstrained free text here would
-            // reach the OCR provider call unvalidated (#1501).
+            // reach the OCR provider call unvalidated.
             pattern: { regex: "^[a-z]{3}(\\+[a-z]{3})*$" },
             write: access.roles("TenantAdmin", "SystemAdmin"),
             read: access.roles("TenantAdmin", "SystemAdmin", "User"),
@@ -123,7 +123,7 @@ export function createDocumentIngestFoundationFeature() {
             default: 50,
             // Without a bound a tenant could set 0 (silently kills ingest) or an
             // unbounded value (OCR worker runs per-file for as long as the PDF
-            // has pages — job-queue starvation) (#1501).
+            // has pages — job-queue starvation).
             bounds: { min: 1, max: 500 },
             write: access.roles("TenantAdmin", "SystemAdmin"),
             read: access.roles("TenantAdmin", "SystemAdmin", "User"),

package/dist/document-ingest-foundation/pages.js

@@ -2,7 +2,7 @@
 // longText (jsonb has no encryption support), so writers must persist
 // JSON.stringify(IngestPage[]) and readers must parse back. Centralising
 // the codec here keeps liteparse + recipe consumers lockstep with the
-// entity shape (kumiko-framework#1549/1).
+// entity shape.
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 export function writeIngestPages(pages) {
     return JSON.stringify(pages);

package/dist/document-ingest-foundation/tenant-destroy-hook.js

@@ -1,4 +1,4 @@
-// Tenant-destroy hook for the documentExtract entity-projection (#1621).
+// Tenant-destroy hook for the documentExtract entity-projection.
 //
 // Per-row forget() through the executor, not a bulk deleteMany: documentExtract
 // is an ES-managed implicit projection, so a store-table write here would be
@@ -6,9 +6,9 @@
 // resurrect every row this hook removed. forget() (Art. 17 hard-purge) is
 // replayed by the implicit projection itself, which keeps the erasure
 // rebuild-safe — the same reasoning as tenant-lifecycle's membership stage,
-// and the reason the feature owns an r.entity instead of an r.projection
-// (kumiko-framework#1495). The `pages` ciphertext dies separately when the
-// pipeline's later `subject-keys` stage erases the tenant subject key.
+// and the reason the feature owns an r.entity instead of an r.projection.
+// The `pages` ciphertext dies separately when the pipeline's later
+// `subject-keys` stage erases the tenant subject key.
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { documentExtractsTable } from "./entity.js";
 import { documentExtractExecutor } from "./executor.js";

package/dist/feature-toggles/compose-tier-resolver.js

@@ -53,7 +53,7 @@ registry) {
             // Non-toggleable (always-on) names must keep reaching `result` through the
             // globalCascade loop below even if this resolver's SYSTEM_TENANT_ID answer
             // satisfies the emptiness guard above without also merging always-on into
-            // every per-tenant tierSet (framework#1528).
+            // every per-tenant tierSet.
             tierManaged = new Set([...managed].filter((name) => {
                 const feature = registry.getFeature(name);
                 return feature !== undefined && isToggleableFeature(feature);

package/dist/feature-toggles/feature.js

@@ -60,7 +60,7 @@ export function createFeatureTogglesFeature(options = {}) {
         });
         r.translations({ keys: FEATURE_TOGGLES_I18N });
         // toggle-cache-sync — multi-instance snapshot propagation. One shared
-        // cursor reads every toggle-set event once (fw#2625); the winning
+        // cursor reads every toggle-set event once; the winning
         // process's handler calls runtime.broadcastToggle, which publishes on
         // GlobalFeatureToggleRuntime's syncSignal so every process (including
         // the one that won the cursor) applies the flip to its own snapshot —

package/dist/feature-toggles/global-feature-state-table.js

@@ -21,7 +21,7 @@ export const globalFeatureStateTable = declareGlobalTenancy(pgTable("store_globa
 // sees the table, so `kumiko schema generate` reports no changes and no
 // app ever gets a migration for it (framework gap, not app-local). Derived
 // from the pgTable above instead of hand-written a second time — the two
-// used to drift independently (framework#1529): a column added only to
+// used to drift independently: a column added only to
 // the pgTable made queries type-check while the migration generator stayed
 // blind to it, failing in prod with "column ... does not exist" while every
 // mocked-stack test stayed green.

package/dist/feature-toggles/handlers/registered.query.js

@@ -30,11 +30,11 @@ export const registeredQuery = defineQueryHandler({
         const db = ctx.systemDb.acknowledgeCrossTenant(FEATURE_TOGGLE_CROSS_TENANT_REASON);
         const overrideRows = await db.global(globalFeatureStateTable).selectMany();
         const overrides = new Map(overrideRows.map((r) => [r.featureName, r.enabled]));
-        // SystemAdmin operator-tooling: das listing soll die PLATTFORM-truth
-        // zeigen (alle features im Registry), nicht den eigenen tier-cut.
-        // Sprint-8a per-tenant signature → wir rufen mit SYSTEM_TENANT_ID,
-        // App-resolver returnt union-of-all-tier-features. Sentinel-Convention
-        // dokumentiert in DispatcherOptions.effectiveFeatures.
+        // SystemAdmin operator tooling: the listing must show platform truth
+        // (all features in the registry), not its own tier cut.
+        // The per-tenant signature requires SYSTEM_TENANT_ID; the app resolver
+        // returns the union of all tier features. The sentinel convention is
+        // documented in DispatcherOptions.effectiveFeatures.
         const effective = ctx.effectiveFeatures?.(SYSTEM_TENANT_ID);
         const rows = [];
         for (const feature of ctx.registry.features.values()) {

package/dist/feature-toggles/toggle-sync-signal.js

@@ -8,7 +8,7 @@ function isTogglePayload(value) {
         typeof value["featureName"] === "string" &&
         typeof value["enabled"] === "boolean");
 }
-// fw#2625: gives toggle-cache-sync the cross-replica transport its shared
+// Gives toggle-cache-sync the cross-replica transport its shared
 // dispatcher cursor needs — without this, only the one process that won
 // the shared cursor's toggle-set event would ever learn about a flip.
 // Standalone Redis transport for callers that want their own connections;

package/dist/feature-toggles/web/constants.js

@@ -8,7 +8,7 @@ export const FEATURE_TOGGLE_SET_EVENT_NAME = "feature-toggles:event:toggle-set";
 export const FEATURE_TOGGLE_AGGREGATE_TYPE = "feature-toggles";
 // Shared acknowledgeCrossTenant() reason across all three handlers that read
 // or write globalFeatureStateTable — one string so the three call sites
-// can't drift (framework#2076).
+// can't drift.
 export const FEATURE_TOGGLE_CROSS_TENANT_REASON = "global feature-toggle state, no tenant scope by design";
 // Error reasons surfaced from feature-toggle handlers. Scoped to the
 // feature's namespace per the framework's reason-convention.

package/dist/file-derivatives/feature.d.ts

@@ -2,7 +2,7 @@ import { type FeatureDefinition, type TenantId } from "@cosmicdrift/kumiko-frame
 /** Host → tenantId for the anonymous media route.
  *  MUST be cheap/synchronous (in-memory map or cached lookup): it runs
  *  *before* the query-handler rate limit, so a DB round-trip here is an
- *  unthrottled DoS surface for anonymous callers rotating Host headers (#1977). */
+ *  unthrottled DoS surface for anonymous callers rotating Host headers. */
 export type PublicVariantResolveApexTenant = (host: string) => Promise<TenantId | null> | TenantId | null;
 export type PublicVariantTenantResolution = "host" | "fileRef";
 export type FileDerivativesOptions = {

package/dist/file-derivatives/feature.js

@@ -21,7 +21,7 @@ const FEATURE_NAME = "file-derivatives";
 // charset constraint (`Readonly<Record<string, VariantSpec>>`), so this
 // stays permissive rather than guessing a convention — narrower than this
 // would silently 404 a legitimately declared name again. Do not reintroduce
-// a name list here "for safety" — see #1985.
+// a name list here "for safety".
 const VARIANT_NAME_RE = /^[a-zA-Z0-9_-]{1,64}$/;
 // file-derivatives — derive-on-first-use file variants (thumbnails,
 // resized/reformatted images) plus an opt-in ANONYMOUS route that serves any

package/dist/file-derivatives/handlers/public-variant.query.js

@@ -1,5 +1,5 @@
 // Public-Read of a derived FileRef variant — the anonymous counterpart to
-// GET /files/:id/variant/:name (#1950, auth-gated). Both routes resolve the
+// GET /files/:id/variant/:name (auth-gated). Both routes resolve the
 // same way: the variant spec comes from the FileRef's field declaration
 // (`createImageField({ variants: {...} })`), not a fixed list — an app that
 // declares its own variant name gets it served here too. This route never

package/dist/file-derivatives/presets.js

@@ -1,7 +1,7 @@
 // Ready-made specs to spread into a field's own `variants` declaration
 // (`createImageField({ variants: { thumb, full: { ...full, maxEdge: 4096 } } })`)
 // — not an allow-list. Which names a route serves is decided entirely by
-// what a field declares (#1985), these are just common defaults.
+// what a field declares; these are just common defaults.
 export const thumb = { maxEdge: 160, fit: "cover", format: "webp" };
 export const card = { maxEdge: 640, fit: "inside", format: "webp" };
 export const hero = { maxEdge: 1600, fit: "inside", format: "webp" };

package/dist/file-foundation/feature.js

@@ -8,13 +8,13 @@
 // erasure hit the same store by construction. This feature re-exports the moved
 // symbols unchanged so existing imports keep working.
 //
-// **Pattern-Vorbild:** identisch zu `mail-foundation`. Foundation deklariert
-// extension-point `fileProvider`, Provider-Features (file-provider-s3, -inmemory,
-// -s3-env, später -gcs/-azure-blob) registrieren sich namentlich. Tenant wählt
-// zur Runtime via config-key `provider`.
+// **Pattern reference:** identical to `mail-foundation`. The foundation declares
+// the `fileProvider` extension point; provider features (file-provider-s3,
+// -inmemory, -s3-env, later -gcs/-azure-blob) register themselves by name. The
+// tenant selects one at runtime via the `provider` config key.
 //
-// **Boot-Dependencies:** config (für provider-selector). Kein secrets, weil
-// Foundation selbst keine Secrets hält.
+// **Boot dependencies:** config (for the provider selector). No secrets, because
+// the foundation itself does not hold any secrets.
 import { access, createTenantConfig, defineFeature, EXT_FILE_PROVIDER, FILE_STORAGE_PROVIDER_ENV, } from "@cosmicdrift/kumiko-framework/engine";
 // Moved into the framework — re-exported here so `@cosmicdrift/kumiko-bundled-
 // features/file-foundation` consumers (user-data-rights, app code) keep working.

package/dist/file-provider-inmemory/feature.d.ts

@@ -1,6 +1,6 @@
 /** Demo/Test-Helper: liste die Keys eines Tenant-Storage. */
 export declare function listKeys(tenantId: string): readonly string[];
-/** Demo/Test-Helper: leere den Tenant-Storage. */
+/** Demo/test helper: clears a tenant's storage. */
 export declare function clearStorage(tenantId: string): void;
 export declare function createFileProviderInMemoryFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;

package/dist/file-provider-inmemory/feature.js

@@ -1,21 +1,21 @@
 // kumiko-feature-version: 1
 //
-// file-provider-inmemory — In-Memory-FileProvider für die file-
-// foundation Plugin-API. Speichert Files in einem per-Tenant-Map
-// statt in S3/Hetzner-Object-Storage. Für Demos, Sample-Apps und
-// Tests ohne MinIO-Container.
+// file-provider-inmemory — In-memory file provider for the file-
+// foundation plugin API. Stores files in a per-tenant Map instead
+// of S3/Hetzner object storage. Intended for demos, sample apps,
+// and tests without a MinIO container.
 //
-// **Was diese Feature liefert:**
-//   1. Plugin-Registration via `r.useExtension("fileProvider",
+// **What this feature provides:**
+//   1. Plugin registration via `r.useExtension("fileProvider",
 //      "inmemory", { build })`.
-//   2. **Pro-Tenant Storage.** Jeder Tenant kriegt einen eigenen
-//      InMemoryFileProvider — Tenant-Isolation by-design, keine
-//      Pfad-Konvention nötig.
+//   2. **Per-tenant storage.** Each tenant gets its own
+//      InMemoryFileProvider, providing tenant isolation by design
+//      without requiring a path convention.
 //
-// **Pattern-Vorbild:** mirrors file-provider-s3.
+// **Pattern reference:** mirrors file-provider-s3.
 //
-// **NICHT für Production.** Buffer ist Process-Memory, geht beim
-// Restart verloren + wächst monoton mit jedem write.
+// **NOT for production.** The buffer is process memory, is lost on
+// restart, and grows monotonically with every write.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createInMemoryFileProvider, } from "@cosmicdrift/kumiko-framework/files";
 const FEATURE_NAME = "file-provider-inmemory";
@@ -35,7 +35,7 @@ function getOrCreateProviderForTenant(tenantId) {
 export function listKeys(tenantId) {
     return providersByTenant.get(tenantId)?.keys() ?? [];
 }
-/** Demo/Test-Helper: leere den Tenant-Storage. */
+/** Demo/test helper: clears a tenant's storage. */
 export function clearStorage(tenantId) {
     providersByTenant.get(tenantId)?.clear();
 }
@@ -50,9 +50,9 @@ export function createFileProviderInMemoryFeature() {
             category: "storage",
             recommended: false,
         });
-        // Kein requires auf "config" oder "secrets" — der
-        // In-Memory-Provider hat keine Config + kein Secret. Nur die
-        // file-foundation muss da sein (Plugin-extension-point).
+        // No requirement for "config" or "secrets": the
+        // in-memory provider has neither configuration nor secrets. Only
+        // file-foundation must be present as the plugin extension point.
         r.requires({ features: ["file-foundation"] });
         const plugin = {
             build: async (_ctx, tenantId) => {

package/dist/file-provider-s3/feature.js

@@ -1,22 +1,22 @@
 // kumiko-feature-version: 1
 //
-// file-provider-s3 — concrete S3-implementation for the
-// file-foundation plugin-API.
+// file-provider-s3 — concrete S3 implementation for the
+// file-foundation plugin API.
 //
-// **Was diese Feature liefert:**
-//   1. Provider-spezifische Tenant-Config (bucket/region/endpoint/
-//      forcePathStyle/accessKeyId) und Secret (s3.secretAccessKey).
-//      Self-contained — file-foundation kennt diese nicht.
-//   2. Plugin-Registration via `r.useExtension("fileProvider", "s3",
-//      { build })`. file-foundation's Factory findet den Plugin via
-//      registry.
-//   3. build(ctx, tenantId) liest config + secret, ruft `createS3Provider`
-//      aus ./lib auf. Der EINZIGE Cross-Feature-Import
-//      des Plugins — bewusst lokal gehalten.
+// **What this feature provides:**
+//   1. Provider-specific tenant config (bucket/region/endpoint/
+//      forcePathStyle/accessKeyId) and secret (s3.secretAccessKey).
+//      Self-contained — file-foundation does not know about these.
+//   2. Plugin registration via `r.useExtension("fileProvider", "s3",
+//      { build })`. file-foundation's factory finds the plugin through
+//      the registry.
+//   3. build(ctx, tenantId) reads the config and secret, then calls
+//      `createS3Provider` from ./lib. This is the plugin's only
+//      cross-feature import, intentionally kept local.
 //
-// **Pattern-Vorbild:** mirrors mail-transport-smtp.
+// **Pattern reference:** mirrors mail-transport-smtp.
 //
-// **Boot-Dependencies:** config + secrets + file-foundation.
+// **Boot dependencies:** config + secrets + file-foundation.
 import { requireDefined, requireNonEmpty, requireSecretSet, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -83,8 +83,8 @@ function createTenantConfigFileProviderS3Feature() {
                 }),
             },
         });
-        // Plugin-Registration. entityName "s3" ist was tenants in
-        // file-foundation's `provider` config-key setzen.
+        // Plugin registration. The entityName "s3" is what tenants set in
+        // file-foundation's `provider` config key.
         const plugin = {
             build: async (ctx, tenantId) => buildS3Provider(ctx, tenantId), // @wrapper-known semantic-alias
         };

package/dist/file-provider-s3/lib/s3-provider.js

@@ -1,6 +1,6 @@
 import { assertSafeStorageKey, } from "@cosmicdrift/kumiko-framework/files";
 // =============================================================================
-// Operator-Pflicht-Setup (Multipart-Upload-Cleanup)
+// Required operator setup (multipart-upload cleanup)
 // =============================================================================
 //
 // `writeStream` uses Bun's S3 writer for real multipart streaming. S3
@@ -10,7 +10,7 @@ import { assertSafeStorageKey, } from "@cosmicdrift/kumiko-framework/files";
 // OPEN in S3 and bills storage for the parts already uploaded — until a
 // lifecycle rule aborts it.
 //
-// **Pflicht-Operator-Setup auf jedem Bucket:**
+// **Required operator setup on every bucket:**
 //
 //   {
 //     "Rules": [{
@@ -26,7 +26,7 @@ import { assertSafeStorageKey, } from "@cosmicdrift/kumiko-framework/files";
 // R2 and Minio support the same syntax.
 //
 // =============================================================================
-// Operator-Pflicht-Setup (IAM: list permission)
+// Required operator setup (IAM: list permission)
 // =============================================================================
 //
 // GDPR-forget/tenant-destroy erasure (user-data-rights-defaults) calls
@@ -134,9 +134,9 @@ export function createS3Provider(config) {
         },
         async getSignedUrl(key, expiresInSeconds, options) {
             assertSafeStorageKey(key);
-            // contentDisposition wird von Bun als response-content-disposition
-            // Query-Param signiert (Response-Override fuer den GET-Download) —
-            // der Browser sieht den Original-Dateinamen statt des UUID-Keys.
+            // Bun signs contentDisposition as the response-content-disposition
+            // query parameter (a response override for the GET download) —
+            // the browser sees the original filename instead of the UUID key.
             return client.presign(key, {
                 expiresIn: expiresInSeconds,
                 method: "GET",

package/dist/files/feature.js

@@ -1,7 +1,7 @@
-// files — full Event-Sourcing für File-Metadata. Die Implementierung (Entity,
-// files:event:*-Events, Inline-Projektion) lebt seit dem ES-Umbau im
-// Framework neben file-routes + fileRefsTable, weil file-routes hart davon
-// abhängt (appendDomainEventCore verlangt registrierte Events + Projektion).
-// Dieses Modul re-exportiert nur, damit der App-Import-Pfad
-// `@cosmicdrift/kumiko-bundled-features/files` stabil bleibt.
+// files — complete event sourcing for file metadata. The implementation (entity,
+// files:event:*-events, inline projection) lives in the framework alongside
+// file-routes and fileRefsTable because file-routes depends on registered events
+// and a projection, as required by appendDomainEventCore.
+// This module only re-exports the feature to keep the app import path
+// `@cosmicdrift/kumiko-bundled-features/files` stable.
 export { createFilesFeature, fileRefEntity } from "@cosmicdrift/kumiko-framework/files";

package/dist/files-tenant-data/handlers/sweep-orphaned-derivatives.job.js

@@ -1,5 +1,5 @@
 // Backfill/GC job for derivatives orphaned by a forget/tenant-destroy that ran
-// before #2461 wired binary cleanup into those flows (#2474). Those older runs
+// before binary cleanup was wired into those flows. Those older runs
 // left the FileRef row gone with no audit trail of what was ever forgotten —
 // so this sweep works forward from the deterministic derivative-key grammar
 // alone: for every key under a tenant's storage prefix that parses as a
@@ -8,8 +8,8 @@
 // a soft-deleted one sitting in trash — means the derivative is still
 // legitimate; only genuinely unreferenced derivatives are swept.
 //
-// Manual trigger only (no cron) — an operator runs this once after upgrading
-// past #2461, or on demand for spot-checks.
+// Manual trigger only (no cron) — an operator runs this once after upgrading,
+// or on demand for spot-checks.
 //
 // Row unit for runChunkedMigration is a discovered derivative CANDIDATE KEY,
 // not a tenant: one tenant's storage listing produces a variable number of
@@ -94,7 +94,7 @@ export async function sweepOrphanedDerivativesJob(rawPayload, ctx, db) {
     async function migrateRow(candidate) {
         // No isDeleted filter: a soft-deleted (trashed, not yet forgotten) fileRef
         // still legitimately backs its derivatives — only an ABSENT row (forgotten,
-        // or a tenant destroyed before #2461 with no row left at all) makes a
+        // or a tenant destroyed with no row left at all) makes a
         // derivative orphaned.
         const owners = await selectMany(db, fileRefsTable, { tenantId: candidate.tenantId, storageKey: candidate.originalKey }, { limit: 1 });
         if (owners.length > 0)

package/dist/files-tenant-data/hooks.js

@@ -1,5 +1,5 @@
 // EXT_TENANT_DATA + EXT_STORAGE_PROVIDER destroy hooks for the `fileRef`
-// entity (#2474). Kept apart from the `files` feature (like folders-user-data
+// entity. Kept apart from the `files` feature (like folders-user-data
 // does for EXT_USER_DATA) so file consumers without the tenant-lifecycle
 // pipeline don't pull a hard dependency — `files` stays usable standalone.
 //
@@ -10,18 +10,17 @@
 //     isDeleted filter: tenant-destroy purges trashed rows too, a destroyed
 //     tenant has no "restore from trash" future. ALSO sweeps, per row, any
 //     storageKey that does NOT sit under one of this tenant's own
-//     tenantStoragePrefixes() — the shape a tenant-handover (kumiko-
-//     framework#3035) leaves behind: the fileRef row's tenantId moved to
-//     this tenant, but the bytes stayed under the SOURCE tenant's prefix
-//     (moving them would mean copying bytes, which the handover design
-//     explicitly rejects). Must run here, not in the "files" stage below —
-//     that stage's own prefix sweep only reaches keys under ITS tenant's
-//     prefixes by construction, and by the time it runs this hook has
-//     already forgotten (hard-deleted) the rows it would need to read the
-//     storageKey off. Deleted by STEM prefix (storageKeyStemPrefix), not the
-//     exact key: a derived variant (thumbnail, resized render) has no
-//     `file_refs` row of its own, so only the stem reaches original +
-//     derivatives together.
+//     tenantStoragePrefixes() — the shape a tenant-handover leaves behind:
+//     the fileRef row's tenantId moved to this tenant, but the bytes stayed
+//     under the SOURCE tenant's prefix (moving them would mean copying bytes,
+//     which the handover design explicitly rejects). Must run here, not in
+//     the "files" stage below — that stage's own prefix sweep only reaches
+//     keys under ITS tenant's prefixes by construction, and by the time it
+//     runs this hook has already forgotten (hard-deleted) the rows it would
+//     need to read the storageKey off. Deleted by STEM prefix
+//     (storageKeyStemPrefix), not the exact key: a derived variant
+//     (thumbnail, resized render) has no `file_refs` row of its own, so only
+//     the stem reaches original + derivatives together.
 //   - fileRefStorageDestroyHook ("files" stage, EXT_STORAGE_PROVIDER): wipes
 //     every BINARY (original + derivatives + anything else) under the
 //     tenant's storage prefixes. A full prefix sweep per tenantStoragePrefixes()
@@ -32,19 +31,18 @@
 //     (the provider's own list() prefix already scopes it). Still catches a
 //     blob with no fileRef row at all (the orphan case the row-driven sweep
 //     above cannot see) — REFINED, not replaced, to skip a key a FOREIGN
-//     tenant's fileRef row still references (a tenant-handover, kumiko-
-//     framework#3035, leaves the row's tenantId moved but the storageKey
-//     under THIS tenant's prefix unchanged). By the time this stage runs,
-//     the "app-data" stage (stages.ts DESTRUCTION_STAGES: "app-data" before
-//     "files") has already hard-deleted every row THIS tenant owned, so any
-//     surviving row a listed key still matches is, by construction, a
-//     foreign tenant's — no tenant comparison needed, existence is enough.
-//     The exception is computed from the SURVIVING row's storageKeyStemPrefix
-//     (mirroring the deletion side above), not the listed key's exact match:
-//     a derivative has no fileRef row of its own, so excluding only exact
-//     matches would still delete it out from under the tenant that claimed
-//     its original. Batched: one existence query per chunk of listed keys,
-//     not one query per key.
+//     tenant's fileRef row still references (a tenant-handover leaves the
+//     row's tenantId moved but the storageKey under THIS tenant's prefix
+//     unchanged). By the time this stage runs, the "app-data" stage
+//     (stages.ts DESTRUCTION_STAGES: "app-data" before "files") has already
+//     hard-deleted every row THIS tenant owned, so any surviving row a listed
+//     key still matches is, by construction, a foreign tenant's — no tenant
+//     comparison needed, existence is enough. The exception is computed from
+//     the SURVIVING row's storageKeyStemPrefix (mirroring the deletion side
+//     above), not the listed key's exact match: a derivative has no fileRef row
+//     of its own, so excluding only exact matches would still delete it out
+//     from under the tenant that claimed its original. Batched: one existence
+//     query per chunk of listed keys, not one query per key.
 import { createEventStoreExecutor, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { assertSafeStorageKey, fileRefEntity, fileRefsTable, storageKeyStemPrefix, tenantStoragePrefixes, } from "@cosmicdrift/kumiko-framework/files";

package/dist/files-tenant-data/index.js

@@ -1,5 +1,5 @@
 // GDPR tenant-destroy + orphaned-derivative backfill coverage for the `files`
-// feature's `fileRef` entity (#2474). Kept apart from `files` — like
+// feature's `fileRef` entity. Kept apart from `files` — like
 // folders-user-data does for EXT_USER_DATA — so file consumers without the
 // tenant-lifecycle pipeline don't pull a hard dependency; `files` stays usable
 // standalone (e.g. user-data-rights-demo mounts `files` + user-data-rights

package/dist/folders/feature.d.ts

@@ -21,7 +21,7 @@ export type FoldersFeatureOptions = {
     /** Row-level ownership on the folder-assignment rows themselves — orthogonal
      *  to `access`, which only gates whether a caller may dispatch set/clear/list
      *  at all. Not needed to keep a caller from reading assignments on host
-     *  entities they can't see: that gate is default-on since fw#2766 and derives
+     *  entities they can't see: that gate is default-on and derives
      *  from the entity's `parentRef`. Use `ownership.read` for an ADDITIONAL row
      *  rule on the assignment row itself; it is AND-ed with the host-visibility
      *  gate. Applies only to `folder-assignment`; the `folder` catalog stays

package/dist/folders/web/folder-manager.js

@@ -285,8 +285,8 @@ export function FolderManager({ renderMeta, filing, }) {
     walk(tree, 0);
     // The bucket itself must stay in the tree even when nothing is currently
     // unfiled — it's the only drop target to un-file a leaf back out of a
-    // folder. Regression: #671/5 — an empty `unfiled` array made the bucket
-    // vanish entirely, silently removing that escape hatch.
+    // folder. An empty `unfiled` array made the bucket vanish entirely, silently
+    // removing that escape hatch.
     const hasUnfiled = filing !== undefined;
     if (hasUnfiled) {
         out.push(bucketRow(stripeNext()));

package/dist/folders/web/tree.js

@@ -33,11 +33,11 @@ export function buildFolderTree(rows) {
         .map((row) => ({ ...row, depth, children: build(row.id, depth + 1) }));
     return build(null, 0);
 }
-// "Immobilie Berlin / Person Müller" for a folder id, walking parentId up.
-// Empty string if the id is unknown. The row-count cap stops a (currently
-// impossible — no reparent yet) parent cycle from spinning forever — `< `,
-// not `<=` (658/4): a cycle of exactly rows.length nodes must stop AT the
-// cap, not run one iteration past it.
+// Returns a path such as "Properties / Berlin" for a folder id by walking
+// parentId upward, or an empty string if the id is unknown. The row-count cap
+// stops a parent cycle (currently impossible, since there is no reparent yet)
+// from spinning forever. Use `<`, not `<=`: a cycle of exactly rows.length
+// nodes must stop at the cap, not run one iteration past it.
 export function folderPath(rows, id, separator = " / ") {
     const byId = new Map(rows.map((r) => [r.id, r]));
     const names = [];

package/dist/form-draft/db/queries/cleanup.js

@@ -6,7 +6,7 @@ import { readStoredDraft } from "../../decrypt-draft.js";
 // once; a draft saved exactly once (create, never updated) has no
 // modified_at yet, so falls back to inserted_at.
 //
-// Reads the blob + tenantId BEFORE anything is deleted (issue #1915) — the
+// Reads the blob + tenantId BEFORE anything is deleted — the
 // caller (cleanup.job.ts) walks each row's blob for FileRefs and releases
 // them per-tenant via ctx._fileProviderResolver, then deletes the batch
 // per-row via formDraftExecutor.delete (event-sourced, not raw SQL — a

package/dist/form-draft/db/queries/owned-file-refs.js

@@ -1,6 +1,6 @@
 import { instantToTimestamptzParam, toPostgresArrayLiteral, unsafeReadRetrying, } from "@cosmicdrift/kumiko-framework/db";
 // Narrows a draft blob's raw FileRef-shaped storageKeys (collectDraftFileRefKeys
-// output — extracted from free-form, client-supplied JSON, issue #1889) down to
+// output — extracted from free-form, client-supplied JSON) down to
 // the ones with a real, non-deleted file_refs row owned by this exact
 // (tenantId, ownerId). Without this, a crafted draft value like
 // { storageKey: "<someone-else's-real-key>" } would reach the storage

package/dist/form-draft/entity.js

@@ -6,8 +6,8 @@ import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT } from "./w
 // (tenant, ownerId): the same key from two different users, or the same
 // user in two different tenants, is a different draft.
 //
-// Boundary (issue #1889): form-draft never holds anything that already
-// lives in a domain stream — it's a Zwischenstand BEFORE the domain entity
+// Boundary: form-draft never holds anything that already
+// lives in a domain stream — it's an intermediate state BEFORE the domain entity
 // is created. Consumers delete the draft (discard handler) once the real
 // submit succeeds; partially-created domain data past that point is the
 // consuming app's concern, not this feature's.
@@ -29,7 +29,7 @@ export const formDraftEntity = createEntity({
             personal: false,
             reason: "technical_reference",
         }),
-        // The blob shape is fixed by issue #1889, not left to the caller:
+        // The blob shape is fixed, not left to the caller:
         // { values: Record<string, unknown>, stepIndex: number, savedAt: string }.
         // Free-form because `values` mirrors whatever fields the in-progress
         // form has, so it can carry arbitrary user-entered PII. Encrypted under

package/dist/form-draft/feature.js

@@ -1,9 +1,8 @@
 // form-draft — a per-user, per-tenant working copy of an in-progress form,
-// saved BEFORE the real domain entity exists. Backing for wizard-mode resume
-// (kumiko-framework#1884/#1883): a caller-assigned draftKey (typically
-// screenId + optional hostEntityId) round-trips { values, stepIndex,
-// savedAt } through save/discard/get. See entity.ts for the ownership +
-// uniqueness model.
+// saved BEFORE the real domain entity exists. Backing for wizard-mode resume.
+// A caller-assigned draftKey (typically screenId + optional hostEntityId)
+// round-trips { values, stepIndex, savedAt } through save/discard/get. See
+// entity.ts for the ownership + uniqueness model.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { formDraftEntity } from "./entity.js";
 import { cleanupDraftsJob, formDraftRetentionDaysConfig } from "./handlers/cleanup.job.js";