@cosmicdrift/kumiko-bundled-features 0.385.0 → 0.387.0

package/dist/notes-history/entity.js

@@ -9,7 +9,7 @@ import { createEntity, createLongTextField, createTextField, } from "@cosmicdrif
 // Strictly append-only by design: no update/delete write-handler is
 // registered (see feature.ts). A correction is a new entry, not an edit —
 // that is the whole point of a note *history* instead of the single
-// overwritable textarea this bundle replaces (solon#13).
+// overwritable textarea this bundle replaces.
 //
 // `body` is about the HOST entity (entityType/entityId), not the author — the
 // author is never the data subject of a note's content, so it is deliberately
@@ -18,7 +18,7 @@ import { createEntity, createLongTextField, createTextField, } from "@cosmicdrif
 // employee leaving triggers a forget), garbling unrelated business notes
 // about customers/projects/etc. — data loss, not privacy.
 //
-// `body` is instead `personal: { of: "id" }` (Row-Subject, fw#2596/#2786):
+// `body` is instead `personal: { of: "id" }` (Row-Subject):
 // the note's OWN row is its content's subject, so `body` is encrypted under a
 // per-note key that nothing else shares. That key gets erased only when the
 // note is reached by a forgotten subject: `note-mention` (below) names the
@@ -28,7 +28,7 @@ import { createEntity, createLongTextField, createTextField, } from "@cosmicdrif
 // shreds `authorName` (`personal: { of: "authorId" }`, the name as stamped at
 // write time); the two erasures are independent.
 //
-// Known gap (fw#2596, not fixed by this entity): prose that names a third
+// Known gap (not fixed by this entity): prose that names a third
 // party without a structured @-mention is not tracked — regex/NLP over
 // free text is unreliable. An operator must erase such a note's own record
 // subject (`forget-subject` kind "record", entity "note-entry") to cover it.
@@ -76,7 +76,7 @@ export function createNoteEntryEntity(access, parents) {
             body: createLongTextField({
                 required: true,
                 maxLength: 20_000,
-                // Row-Subject (fw#2596/#2786): the note itself is the subject, so its
+                // Row-Subject: the note itself is the subject, so its
                 // key is erased per-note via `note-mention` lookups, not tied to any
                 // user's own forget.
                 personal: { of: "id" },

package/dist/notes-history/feature.d.ts

@@ -13,8 +13,8 @@ export type NotesHistoryFeatureOptions = {
     /** Row-level ownership on the note-entry rows themselves — orthogonal to
      *  `access`, which only gates whether a caller may dispatch create/list at
      *  all. `ownership.read` is no longer what keeps a caller from reading notes
-     *  on host entities they can't see: that gate is default-on since fw#2766
-     *  and derives from the entity's `parentRef`. Use `ownership.read` for an
+     *  on host entities they can't see: that gate is default-on and derives from
+     *  the entity's `parentRef`. Use `ownership.read` for an
      *  ADDITIONAL row rule on the note row itself (e.g. author-only visibility);
      *  it is AND-ed with the host-visibility gate, never a replacement for it.
      *

package/dist/notes-history-user-data/hooks.js

@@ -51,7 +51,7 @@ async function selectNotesReachingSubject(db, subject) {
 // (entity.ts), so forgetting the AUTHOR already crypto-shreds that field on
 // its own. `body` is Row-Subject (`personal: { of: "id" }`): its key is per
 // note, so forgetting a subject only reaches a body when the note structurally
-// @-mentions the subject (`note-mention`, fw#2787) or hangs on it as host.
+// @-mentions the subject (`note-mention`) or hangs on it as host.
 // Free-text mentions are NOT detected — the documented gap in entity.ts.
 //
 // Reached bodies are shredded regardless of the host entity's retention strategy:

package/dist/page-render/layout.js

@@ -33,18 +33,18 @@ export function tenantStyleBlock(customCss) {
     const sanitized = sanitizeTenantCss(customCss, TENANT_SCOPE);
     if (!sanitized)
         return "";
-    // html-ok: sanitizeTenantCss ist die Escaping-Boundary (Allowlist, strippt `<`).
+    // html-ok: sanitizeTenantCss is the escaping boundary (allowlist, strips `<`).
     return `\n<style data-tenant-css>${TENANT_CONTAINMENT}\n${TENANT_CLIP}\n${sanitized}</style>`;
 }
-// Minimaler HTML5-Skeleton mit Inline-CSS — Default-`wrapLayout` für
-// server-gerenderte Public-Pages, damit sie auch ohne App-Layout sauber
-// aussehen. Apps die ihr eigenes Marketing-Layout (Header/Footer/Theme)
-// um den Body legen wollen, übergeben ihre eigene Render-Function.
+// Minimal HTML5 skeleton with inline CSS — the default `wrapLayout` for
+// server-rendered public pages, so they look clean without an app layout.
+// Apps that want to wrap the body in their own marketing layout
+// (header/footer/theme) pass their own render function.
 //
-// Branding (optional): emittiert nach dem Base-`<style>` einen scoped
-// `:root`-Override (Accent-Farbe, Layout-Preset → max-width) plus einen
-// Logo-/Titel-Header. Alle Branding-Werte sind tenant-supplied + untrusted
-// und werden in branding.ts re-validiert/escaped, bevor sie ins Markup gehen.
+// Branding (optional): emits a scoped `:root` override after the base
+// `<style>` (accent color, layout preset → max-width) and a logo/title header.
+// All branding values are tenant-supplied and untrusted; branding.ts
+// revalidates/escapes them before they enter the markup.
 export function wrapInLayout(opts) {
     const themeStyleHtml = opts.branding ? brandingStyleBlock(opts.branding) : "";
     const header = opts.branding ? brandingHeaderHtml(opts.branding) : "";

package/dist/page-render/markdown.js

@@ -1,14 +1,14 @@
 import { escapeHtml, isSafeHref } from "@cosmicdrift/kumiko-renderer/headless";
 import { Marked } from "marked";
-// Geteilter, gehärteter Markdown→HTML-Kern für server-gerenderte Public-
-// Pages (legal-pages, managed-pages). Annahme: untrusted Tenant-Authoren.
-// Raw-HTML-Tokens werden als Text escaped (kein <script>/<img onerror>-
-// Passthrough), und link/image-hrefs auf http(s)/mailto/relativ beschränkt
-// (kein javascript:/data:). Markdown-Struktur (Headings, Listen, Links,
-// Code) bleibt intakt — das neutralisiert die XSS-Vektoren ohne Sanitizer-
-// Dependency. Defense-in-Depth ergänzt `securePageHeaders` (`script-src
-// 'none'`). GFM aus, breaks aus — strukturierte Pages brauchen keine
-// Tables/Strikethrough/Task-Lists.
+// Shared, hardened Markdown→HTML core for server-rendered public
+// pages (legal-pages, managed-pages). Assumption: untrusted tenant authors.
+// Raw HTML tokens are escaped as text (no <script>/<img onerror>-
+// passthrough), and link/image hrefs are restricted to http(s)/mailto/relative
+// (no javascript:/data:). Markdown structure (headings, lists, links,
+// code) remains intact—this neutralizes XSS vectors without a sanitizer
+// dependency. Defense in depth complements `securePageHeaders` (`script-src
+// 'none'`). GFM and breaks are disabled—structured pages do not need
+// tables/strikethrough/task lists.
 const safeRenderer = new Marked({ gfm: false, breaks: false });
 safeRenderer.use({
     walkTokens(token) {
@@ -23,7 +23,7 @@ safeRenderer.use({
     },
 });
 export function renderSafeMarkdown(markdown) {
-    // @cast-boundary third-party-type-gap marked.parse return-type ist `string | Promise<string>`;
-    // `{ async: false }` garantiert sync (string) — Cast nur API-Vertragsfix.
+    // @cast-boundary third-party-type-gap marked.parse return type is `string | Promise<string>`;
+    // `{ async: false }` guarantees synchronous output (string)—the cast only fixes the API contract.
     return safeRenderer.parse(markdown, { async: false });
 }

package/dist/page-render/security-headers.js

@@ -1,9 +1,10 @@
-// Security-Header für server-gerenderte Public-HTML-Pages (legal-pages,
-// managed-pages). `script-src 'none'` ist Defense-in-Depth: selbst wenn
-// HTML-Injection durchrutscht, läuft kein Script. Bewusst KEIN `default-src`
-// → Styles/Images/Fonts bleiben unrestricted (rückwärtskompatibel zu
-// Inline-<style>-Layouts wie publicstatus' renderLegalLayout).
-// nosniff/SAMEORIGIN/Referrer-Policy sind universell sichere Defaults.
+// Security headers for server-rendered public HTML pages (legal-pages,
+// managed-pages). `script-src 'none'` provides defense in depth: even if
+// HTML injection gets through, no script can run. Deliberately omit
+// `default-src` so styles, images, and fonts remain unrestricted for
+// backward compatibility with inline-<style> layouts such as
+// publicstatus' renderLegalLayout.
+// nosniff/SAMEORIGIN/Referrer-Policy are broadly safe defaults.
 const PUBLIC_PAGE_SECURITY_HEADERS = {
     "content-security-policy": "script-src 'none'; object-src 'none'; base-uri 'none'",
     "x-content-type-options": "nosniff",

package/dist/personal-access-tokens/feature.js

@@ -62,10 +62,10 @@ export function createPersonalAccessTokensFeature(options) {
         });
         // Direct-write store like store_user_sessions: create/revoke write it, the
         // resolver point-reads it. r.entity would make it a rebuildable projection
-        // whose replay (no token events) would wipe every live token (#498/#494).
+        // whose replay (no token events) would wipe every live token.
         r.storeTable(deriveEntityTableMeta(API_TOKEN_ENTITY_NAME, apiTokenEntity, { source: "unmanaged" }), {
             reason: "read_side.api_tokens_direct_write",
-            // create.write encrypts `name` via encryptForDirectWrite (#820).
+            // create.write encrypts `name` via encryptForDirectWrite.
             piiEncryptedOnWrite: true,
         });
         // Custom domain-event for cross-instance access-invalidation,
@@ -79,9 +79,9 @@ export function createPersonalAccessTokensFeature(options) {
         // Password-change auto-revoke — mirrors sessions' own
         // autoRevokeOnPasswordChange postSave hook, including WHY it's a
         // late-bind callback rather than direct ctx.db use: user:write:user:update
-        // is r.systemScope()'d (the user aggregate is a systemStream, framework
-        // #497), so a postSave hook on "user" gets a poisoned ctx.db here. The
-        // concrete revoker is bound once run{Prod,Dev}App has a real db handle.
+        // is r.systemScope()'d (the user aggregate is a systemStream), so a postSave hook
+        // on "user" gets a poisoned ctx.db here. The concrete revoker is bound once
+        // run{Prod,Dev}App has a real db handle.
         // Explicit option wins; the runtime binding is replaceable so a second boot of the same
         // feature instance binds its own database.
         let boundAutoRevoke;

package/dist/personal-access-tokens/roles.js

@@ -10,8 +10,8 @@ import { isPrincipalRowBlocked, userTable } from "../user/index.js";
 // time would keep a since-revoked admin role for the token's whole (months-long)
 // life. Returns null when the user has no membership in that tenant: removed
 // from the tenant → the PAT stops authenticating there. Also null when the
-// user's lifecycle status blocks them (fw security-welle2) — collapsed onto
-// the same "no roles" outcome as missing-membership so a blocked user's PAT
+// user's lifecycle status blocks them — collapsed onto the same "no roles"
+// outcome as missing-membership so a blocked user's PAT
 // gets an identical 401 to an unknown token (no status oracle).
 export async function resolvePatRoles(db, userId, tenantId) {
     const memberships = await selectMany(db, tenantMembershipsTable, {

package/dist/readiness/handlers/status.query.js

@@ -15,9 +15,9 @@ export const statusQuery = defineQueryHandler({
         // One gate for both halves: required keys/secrets of provider-features
         // count only while their provider is the selected one (r.extensionSelector).
         const gate = await buildProviderSelectionGate(ctx, ReadinessQueries.status, query.user, ctx.db);
-        // skipAccessFilter: das Verdict muss ALLE required Keys zählen — der
-        // Handler selbst ist TenantAdmin-gated, der Per-Key-Filter wäre hier
-        // eine ready:true-Lüge für SystemAdmin-gated Keys (277/1).
+        // skipAccessFilter: the verdict must count ALL required keys—the
+        // Handler itself is TenantAdmin-gated; the per-key filter would falsely
+        // report ready:true for SystemAdmin-gated keys.
         const missingConfig = await collectMissingRequiredConfig(ctx, ReadinessQueries.status, query.user, ctx.db, gate, { skipAccessFilter: true });
         // has() is metadata-only: no decryption, no read-audit event — a
         // readiness probe must not pollute the credential-read trail.

package/dist/renderer-foundation/api.js

@@ -1,14 +1,13 @@
-// RendererFoundationApi — Cross-Feature-Schnittstelle. Konsumenten
-// (delivery, mail-Sender, Solon NKA-PDF-Generator) holen sich pro
-// Render-Call den passenden Plugin via `createRendererForTenant`.
-// Pattern symmetrisch zu ai-foundation's `createLLMProviderForTenant`.
+// RendererFoundationApi — cross-feature interface. Consumers
+// (delivery, mail sender, Solon NKA PDF generator) retrieve the appropriate
+// plugin for each render call via `createRendererForTenant`.
+// The pattern mirrors ai-foundation's `createLLMProviderForTenant`.
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { DEFAULT_PLUGIN_BY_KIND } from "./constants.js";
 import { RendererError } from "./types.js";
-// Plugin-Pool wird zur Boot-Zeit aus Extension-Usages aufgebaut.
-// Aus dem Registry kommen alle registrierten Plugins. Foundation-Feature
-// baut den Pool via `collectRendererPlugins(registry)` und steckt das
-// Result in extraContext.
+// The plugin pool is built at boot time from extension usages.
+// The registry provides all registered plugins. The foundation feature builds
+// the pool via `collectRendererPlugins(registry)` and puts it in extraContext.
 export function createRendererFoundationApi(plugins, tenantConfigLookup = () => null) {
     const byKind = indexByKind(plugins);
     return {
@@ -20,7 +19,7 @@ export function createRendererFoundationApi(plugins, tenantConfigLookup = () =>
                 const plugin = plugins.find((p) => p.name === tenantPluginName && p.kinds.includes(kind));
                 if (plugin)
                     return plugin;
-                // Tenant-Config zeigt auf nicht-registriertes Plugin — fällt durch zu Default
+                // The tenant configuration points to an unregistered plugin; fall through to the default.
             }
             // 2. Default-Plugin
             const defaultName = DEFAULT_PLUGIN_BY_KIND[kind];
@@ -29,7 +28,7 @@ export function createRendererFoundationApi(plugins, tenantConfigLookup = () =>
                 if (plugin)
                     return plugin;
             }
-            // 3. Erstes Plugin im Pool das das kind bedient
+            // 3. First plugin in the pool that serves the kind
             const first = byKind.get(kind)?.[0];
             if (first)
                 return first;
@@ -49,11 +48,11 @@ function indexByKind(plugins) {
     }
     return map;
 }
-// Single point of truth für "dieser Handler braucht renderer-foundation".
-// Pattern symmetrisch zu requireTemplateResolver + requireTextContent.
+// Single source of truth for handlers that require renderer-foundation.
+// The pattern mirrors requireTemplateResolver + requireTextContent.
 export function requireRendererFoundation(ctx, callerName) {
     // @cast-boundary engine-bridge — rendererFoundation kommt per extraContext
-    // aus App-Bootstrap.
+    // from the app bootstrap.
     const api = ctx.rendererFoundation;
     if (!api) {
         throw new InternalError({

package/dist/renderer-foundation/constants.js

@@ -1,8 +1,8 @@
 // Extension-point name for renderer plugins (@cosmicdrift/kumiko-renderer-mail-html, @cosmicdrift/kumiko-renderer-puppeteer-client, ...).
 export const RENDERER_EXTENSION = "renderer";
 export { CONTENT_FORMATS, RENDER_KINDS, } from "../template-resolver/index.js";
-// Standard-Default-Plugin pro Kind, wenn Tenant keine explizite Config
-// gesetzt hat. App-Bootstrap kann das via TenantConfigKey überschreiben.
+// Standard default plugin for each kind when the tenant has not set explicit configuration.
+// App bootstrap can override this through TenantConfigKey.
 export const DEFAULT_PLUGIN_BY_KIND = {
     mail: "mail-html",
     "document-pdf": "puppeteer",

package/dist/renderer-foundation/feature.js

@@ -20,19 +20,19 @@ export function createRendererFoundationFeature() {
         r.requires({ features: ["template-resolver"] });
         r.extendsRegistrar(RENDERER_EXTENSION, {
             onRegister: () => {
-                // Plugin-Konformitäts-Check könnte hier: shape-validation der
-                // options (kinds, render-Funktion present). Aktuell kein
-                // shape-check — Caller's TypeScript-Type-Sicherheit greift.
+                // Plugin conformance check could go here: validate the shape of
+                // options (kinds, render function present). No shape check currently —
+                // the caller's TypeScript type safety applies.
             },
         });
         return {};
     });
 }
-// Plugin-Pool-Aufbau zur Boot-Zeit. App-Bootstrap ruft das nach
-// Feature-Registration auf, baut den Pool, gibt ihn via extraContext
-// an die Handlers weiter.
+// Build the plugin pool at boot time. App bootstrap calls this after
+// feature registration, builds the pool, and passes it to handlers via
+// extraContext.
 //
-// Symmetrisch zu collectChannels / collectRenderers in delivery-service.
+// Symmetric to collectChannels / collectRenderers in delivery-service.
 export function collectRendererPlugins(registry) {
     const usages = registry.getExtensionUsages(RENDERER_EXTENSION);
     return usages.map((usage) => {

package/dist/secrets/feature.js

@@ -49,15 +49,15 @@ export { tenantSecretsTable } from "./table.js";
 // write has to join that transaction so a rejected command rolls it back too.
 export const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 // AppContext carries ctx.secrets via extraContext. requireSecretsContext
-// wraps that raw context so every `.get(...)` call auto-includes the
-// current user + handler as audit metadata — feature code can't forget
-// to log the read (silent bypass of audit was the v1 gap).
+// wraps that raw context so every `.get(...)` call automatically includes
+// the current user and handler as audit metadata, preventing feature code
+// from silently bypassing read auditing.
 //
-// Surface bewusst minimal: HandlerContext-Pfade (Set/Delete-Handler) +
-// FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
-// zwei Felder, also reicht die schmale ctx-shape — kein voller
-// HandlerContext-Import noetig.
-// Handler contexts carry the caller as ctx.user, provider contexts set auditUserId (takes precedence).
+// The context shape stays minimal: HandlerContext paths (Set/Delete handlers)
+// and FileProviderContext paths (the S3 plugin in the worker) provide the same
+// two fields, so importing the full HandlerContext is unnecessary.
+// Handler contexts carry the caller as ctx.user; provider contexts set
+// auditUserId, which takes precedence.
 export function requireSecretsContext(ctx, handlerName) {
     if (!ctx.secrets) {
         throw new InternalError({
@@ -129,7 +129,7 @@ export function createSecretsFeature(opts = {}) {
         // Backing table: envelope/metadata/last_rotated_at + the (tenant,key)
         // uniqueIndex are not expressible via the field-DSL (jsonb-without-default,
         // now()-default), so the physical table is the DDL truth. Without this the
-        // generated migration omitted those columns → prod-500 (publicstatus#116).
+        // generated migration omitted those columns → prod-500.
         r.entity({ name: "tenant-secret", ...tenantSecretEntity, backingTable: tenantSecretsTable });
         // Read-audit domain-event. Registered here so ops tools + MSPs can
         // discover the type; secrets-context.get parses payloads against

package/dist/secrets/web/constants.js

@@ -1,6 +1,6 @@
-// secrets bundle constants — default RBAC for set/delete/list (#2296).
+// secrets bundle constants — default RBAC for set/delete/list.
 // Default-RBAC of the set/delete/list handlers, hard-wired to ["TenantAdmin"]
-// before #2296. Apps with their own role vocabulary override via
+// before this default was established. Apps with their own role vocabulary override via
 // createSecretsFeature({ roles }) or createSecretsFeature({ access }) — the
 // rotate job stays untouched, it's a manual/ops path across all tenants by
 // design, not a per-tenant RBAC surface.

package/dist/seo/feature.js

@@ -1,4 +1,4 @@
-// kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312 (feature.ts > 300 lines)
+// kumiko-lint-ignore app-feature-structure feature.ts is over 300 lines and not yet split
 import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
@@ -201,8 +201,8 @@ export function createSeoFeature(opts) {
                 },
             });
         }
-        // Boot-Check body als named function extrahiert — direkt unit-testbar,
-        // gleiches "thin job-shell ruft testable function"-Pattern wie
+        // Boot-check body extracted as a named function—directly unit-testable,
+        // following the same "thin job-shell calls testable function" pattern as
         // legal-pages' runLegalPagesBootCheck.
         r.job("seo-boot-check", { trigger: { manual: true }, runOnBoot: true, runIn: "api" }, async (_payload, ctx) => runSeoBootCheck({
             sitemapEntries: opts.sitemapEntries,

package/dist/sessions/constants.d.ts

@@ -5,7 +5,7 @@ export declare const SessionHandlers: {
     readonly revoke: "sessions:write:user-session:revoke";
     readonly revokeAllOthers: "sessions:write:user-session:revoke-all-others";
     /** Privileged: System-Caller (cross-feature) revokes ALL live sessions
-     *  fuer einen User. Genutzt von user-data-rights:restrict-account
+     *  for a user. Used by user-data-rights:restrict-account
      *  (DSGVO Art. 18 Account-Freeze). */
     readonly revokeAllForUser: "sessions:write:user-session:revoke-all-for-user";
 };

package/dist/sessions/constants.js

@@ -7,7 +7,7 @@ export const SessionHandlers = {
     revoke: "sessions:write:user-session:revoke",
     revokeAllOthers: "sessions:write:user-session:revoke-all-others",
     /** Privileged: System-Caller (cross-feature) revokes ALL live sessions
-     *  fuer einen User. Genutzt von user-data-rights:restrict-account
+     *  for a user. Used by user-data-rights:restrict-account
      *  (DSGVO Art. 18 Account-Freeze). */
     revokeAllForUser: "sessions:write:user-session:revoke-all-for-user",
 };

package/dist/sessions/feature.js

@@ -65,19 +65,19 @@ export function createSessionsFeature(options) {
         // events (the row columns ARE the audit trail). Registering it as
         // r.entity would make it a rebuildable implicit projection whose replay
         // finds zero session events and swaps an empty shadow over the live
-        // table — wiping every active session on the next projection rebuild
-        // (#498/#494). r.storeTable keeps the migration DDL but opts the
+        // table — wiping every active session on the next projection rebuild.
+        // r.storeTable keeps the migration DDL but opts the
         // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
         // which are direct-write stores too.
         r.storeTable(deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, { source: "unmanaged" }), {
             reason: "read_side.user_sessions_direct_write",
-            // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
+            // sessionCreator encrypts ip/userAgent via encryptForDirectWrite.
             piiEncryptedOnWrite: true,
         });
-        // Self-registers as auth-foundation's sessionStore provider (#1371) —
+        // Self-registers as auth-foundation's sessionStore provider —
         // wraps the same createSessionCallbacks() used by the manual
-        // buildServer({ auth: { ... } }) wiring above; a future issue (#1372)
-        // removes that manual wiring once the middleware resolves generically
+        // buildServer({ auth: { ... } }) wiring above; removes that manual
+        // wiring once the middleware resolves generically
         // via resolveSessionStore().
         r.useExtension(EXT_SESSION_STORE, "default", {
             build: (deps) => {
@@ -94,7 +94,7 @@ export function createSessionsFeature(options) {
                 };
             },
         });
-        // Custom domain-event for cross-instance access-invalidation (#1559).
+        // Custom domain-event for cross-instance access-invalidation.
         // r.defineEvent registers the schema so ctx.unsafeAppendEvent (revoke,
         // revoke-all-others) enforces it at append time. revoke-all-for-user
         // appends via the low-level append() instead (needs to anchor on
@@ -102,7 +102,7 @@ export function createSessionsFeature(options) {
         // consult the registry, so that callsite parses against
         // sessionRevokedSchema explicitly, same guarantee via a different path.
         // No projection: the payload IS the read, consumed directly off the
-        // event-store NOTIFY (#1560).
+        // event-store NOTIFY.
         r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, { piiFields: "none" });
         const handlers = {
             revoke: r.writeHandler(revokeWrite),

package/dist/sessions/handlers/revoke-all-for-user.write.js

@@ -50,8 +50,8 @@ export const revokeAllForUserWrite = defineWriteHandler({
                 id: { ne: event.payload.exceptSessionId },
             }),
         });
-        // Lightweight append alongside the direct-write above (#1559) — see
-        // revoke.write.ts for why this isn't a lifecycle event on
+        // Lightweight append alongside the direct-write above; see revoke.write.ts
+        // for why this isn't a lifecycle event on
         // store_user_sessions. Uses the low-level append() (not
         // ctx.unsafeAppendEvent) because this handler is deliberately
         // cross-tenant: the privileged caller's own tenantId (what

package/dist/sessions/handlers/revoke-all-others.write.js

@@ -31,8 +31,8 @@ export const revokeAllOthersWrite = defineWriteHandler({
             }));
         }
         const updated = await updateMany(ctx.db, userSessionTable, { revokedAt: Temporal.Now.instant() }, { userId: event.user.id, revokedAt: null, id: { ne: keepSid } });
-        // Lightweight append alongside the direct-write above (#1559) — see
-        // revoke.write.ts for why this isn't a lifecycle event on
+        // Lightweight append alongside the direct-write above; see revoke.write.ts
+        // for why this isn't a lifecycle event on
         // store_user_sessions. Skipped when nothing was revoked (no other
         // live sessions) — a spurious invalidation would be the failure mode.
         if (updated.length > 0) {

package/dist/sessions/handlers/revoke.write.js

@@ -38,7 +38,7 @@ export const revokeWrite = defineWriteHandler({
     handler: async (event, ctx) => {
         const updated = await updateMany(ctx.db, userSessionTable, { revokedAt: Temporal.Now.instant() }, { id: event.payload.id, userId: event.user.id, revokedAt: null });
         if (updated.length > 0) {
-            // Lightweight append alongside the direct-write above (#1559) — NOT a
+            // Lightweight append alongside the direct-write above — NOT a
             // lifecycle event for store_user_sessions (that table stays an
             // unmanaged direct-write store, see feature.ts). Own aggregate id per
             // revoke, no predecessor to satisfy, no version_conflict against a

package/dist/sessions/schema/user-session.js

@@ -12,9 +12,9 @@ import { USER_SESSION_ENTITY_NAME } from "../constants.js";
 // mutate them via ctx.db inside a transaction, but no user request can bypass
 // the revocation flow by poking the column directly.
 export const userSessionEntity = createEntity({
-    // Entity-Key ist "user-session" (mit Dash), toTableName's snake-case-
-    // Transform käme auf "read_user-sessions" → kein valides SQL ohne Quoting.
-    // Deshalb expliziter Override auf den read_-konformen Namen.
+    // The entity key is "user-session"; snake-casing it would produce
+    // "read_user-sessions", which is invalid SQL without quoting. Use an explicit
+    // override with a valid read_-prefixed table name.
     table: "store_user_sessions",
     // sid-as-PK: the sessionCreator callback generates the UUID, returns it to
     // the framework; the framework stamps it as `jti`; here the same value is
@@ -77,7 +77,7 @@ export const userSessionEntity = createEntity({
 // Unmanaged direct-write store (r.storeTable in feature.ts, no event stream —
 // revocation is a column write, not an aggregate). Handlers write via ctx.db;
 // source: "unmanaged" makes the meta Writable so those writes compile. See
-// feature.ts for the rebuild-exclusion rationale (#494/#498).
+// feature.ts for the rebuild-exclusion rationale.
 export const userSessionTable = deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, {
     source: "unmanaged",
 });

package/dist/sessions/screens.js

@@ -12,7 +12,7 @@ export const createSessionListScreen = (adminRoles = access.admin) => ({
     pageSize: MAX_LIST_LIMIT,
     // Mirrors list.query's own fallback (unrecognised/absent sort → createdAt
     // desc) — kept in sync by hand, boot-validator only requires the field
-    // be present once the query accepts `sort` (fw#2230).
+    // be present once the query accepts `sort`.
     defaultSort: { field: "createdAt", dir: "desc" },
     columns: [
         { field: "id", label: i18nKey("sessions.list.col.id") },
@@ -71,7 +71,7 @@ export const createSessionDetailScreen = (adminRoles = access.admin) => ({
                     // The shim (projection-detail-shim.ts) stamps every field as
                     // type:"text" — field.renderer is the only way this screen
                     // type reaches real per-type formatting instead of a raw ISO
-                    // string (fw#2245).
+                    // string.
                     { field: "createdAt", renderer: { format: "timestamp" } },
                     { field: "expiresAt", renderer: { format: "timestamp" } },
                     { field: "revokedAt", renderer: { format: "timestamp" } },

package/dist/sessions/session-callbacks.js

@@ -155,11 +155,11 @@ export function createSessionCallbacks(opts) {
             return transaction(db, async (tx) => {
                 const result = await updateMany(tx, userSessionTable, { revokedAt: Temporal.Now.instant() }, { userId, revokedAt: null });
                 // Lightweight append alongside the direct-write above, same pattern
-                // as revoke.write.ts (#1559) — this callback is the password-change
+                // as revoke.write.ts — this callback is the password-change
                 // auto-revoke path (sessions/feature.ts postSave hook) and has no
                 // dispatcher ctx to call unsafeAppendEvent from, so it uses the raw
                 // append() like revoke-all-for-user.write.ts does. Without this, the
-                // access-invalidation consumer (#1560) never hears about a password
+                // access-invalidation consumer never hears about a password
                 // change and an already-open SSE stream survives it — the exact
                 // "stale JWT mid-stream" gap this feature exists to close.
                 if (result.length > 0) {

package/dist/sessions/session-revoked-event.js

@@ -1,11 +1,11 @@
 import * as z from "zod";
 // Lightweight custom event appended alongside the direct-write
 // updateMany() in revoke.write.ts / revoke-all-others.write.ts /
-// revoke-all-for-user.write.ts (#1559). store_user_sessions itself stays
+// revoke-all-for-user.write.ts. store_user_sessions itself stays
 // an unmanaged direct-write store (see feature.ts) — the row columns are
 // the audit trail, this event is NOT a CRUD/lifecycle event for that
 // table and carries no projection. Its only job is to give cross-instance
-// consumers (access-invalidation, #1560) something to LISTEN for via the
+// consumers (access-invalidation) something to LISTEN for via the
 // existing event-store NOTIFY, keyed by the affected userId.
 //
 // _SHORT/_QN pair mirrors cap-counter's rolling-incremented event:

package/dist/shared/assert-no-where-rule-in-ownership-write.js

@@ -1,4 +1,4 @@
-// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// Boot validation rejects `{ kind: "where" }` in access.write too;
 // failing at factory time names the option instead of an entity scope.
 export function assertNoWhereRuleInOwnershipWrite(factoryName, writeOwnership) {
     // skip: no write ownership declared, nothing to validate

package/dist/shared/decrypt-stored-pii.js

@@ -4,7 +4,7 @@ import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/ku
 // active KMS that is ciphertext (self-describing: it names its own subject,
 // so no entity/field context is needed for key selection). `field` must
 // still match the field name used at encrypt time — it is part of the
-// AAD (#1263), so a mismatch fails decrypt loud rather than silently
+// AAD, so a mismatch fails decrypt loud rather than silently
 // letting ciphertext cut-and-pasted from another field decrypt. An erased
 // subject yields the sentinel, which matches no real value.
 export async function decryptStoredPii(value, field, fallbackRequestId) {

package/dist/shared/encrypt-for-direct-write.js

@@ -4,7 +4,7 @@ import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
 // go through this instead, and the feature declares { piiEncryptedOnWrite:
-// true } at the registration site (enforced by the registry, #820).
+// true } at the registration site (enforced by the registry).
 export async function encryptForDirectWrite(entity, entityName, row, fallbackRequestId) {
     const kms = configuredPiiSubjectKms();
     if (!kms)

package/dist/shared/map-with-concurrency.js

@@ -12,19 +12,20 @@
 // an unhandled rejection — verified in `mapWithConcurrency.test.ts`).
 export async function mapWithConcurrency(items, limit, fn) {
     const results = new Array(items.length);
-    let nextIndex = 0;
+    const unclaimed = items.entries();
     let failed = false;
     async function worker() {
         for (;;) {
             // skip: another worker already failed — stop claiming new items.
             if (failed)
                 return;
-            const index = nextIndex++;
+            const claimed = unclaimed.next();
             // skip: cursor exhausted, normal worker-loop exit
-            if (index >= items.length)
+            if (claimed.done)
                 return;
+            const [index, item] = claimed.value;
             try {
-                results[index] = await fn(items[index], index);
+                results[index] = await fn(item, index);
             }
             catch (err) {
                 failed = true;