@cosmicdrift/kumiko-bundled-features 0.385.0 → 0.387.0

package/dist/cap-counter/handlers/increment-rolling.write.js

@@ -1,22 +1,21 @@
-// increment-rolling — Rolling-Window-Counter-Increment via Custom-
-// Event statt CRUD/projection. Designed für Caps deren Wert sich
-// kontinuierlich erneuern soll (KI-Tokens-7-Tage, Egress pro 24h).
+// increment-rolling — Rolling-window counter increment via a custom
+// event instead of CRUD/projection. Designed for caps whose values
+// continuously renew (AI tokens over 7 days, egress over 24 hours).
 //
-// **Warum kein r.entity / CRUD wie der Calendar-Counter:** Der
-// Calendar-Counter speichert den kumulierten value in seiner
-// projection-row. Beim Period-Rollover wechselt die aggregate-id auf
-// den neuen Period-Start, das ist der "Reset". Bei Rolling-Window
-// gibt es keinen Rollover-Punkt — der Counter "rollt" kontinuierlich
-// raus. Ein einzelner kumulativer value wäre falsch (würde monoton
-// wachsen ohne Expiration). Die korrekte Read-Semantik ist: SUM aller
-// Increment-Amounts der letzten N Tage. Dafür brauchen wir die
-// einzelnen Increments als separate Events mit ihrem eigenen
-// `amount`-Feld; CRUD-Events tragen nur den kumulativen value.
+// **Why not r.entity / CRUD like the calendar counter:** The calendar
+// counter stores the cumulative value in its projection row. At the
+// period rollover, the aggregate ID changes to the new period start;
+// that is the "reset". A rolling window has no rollover point—the
+// counter continuously rolls out. A single cumulative value would be
+// incorrect because it would grow monotonically without expiration.
+// The correct read semantics are SUM of all increment amounts from the
+// last N days. Therefore, each increment must be a separate event with
+// its own `amount` field; CRUD events carry only the cumulative value.
 //
-// **Aggregate-Stream:** ein Stream pro (tenant, capName) — siehe
-// `rollingCapAggregateId`. Alle Increments hängen am selben Stream
-// in monoton-steigender version. enforceRollingCap liest die letzten
-// N Tage aus diesem Stream.
+// **Aggregate stream:** one stream per (tenant, capName)—see
+// `rollingCapAggregateId`. All increments use the same stream in
+// monotonically increasing version order. enforceRollingCap reads the
+// last N days from this stream.
 import * as z from "zod";
 import { rollingCapAggregateId } from "../aggregate-id.js";
 import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, ROLLING_INCREMENTED_EVENT_QN } from "../constants.js";
@@ -28,8 +27,8 @@ const incrementRollingSchema = z.object({
      *  Window-Sum is exact. */
     amount: z.number().int().positive().default(1),
 });
-/** Schema des emittierten Custom-Events. Identisch zum Input-Schema:
- *  der Caller zahlt amount, wir hängen es 1:1 an den Stream. */
+/** Schema of the emitted custom event. Identical to the input schema:
+ *  the caller supplies amount, which we append unchanged to the stream. */
 export const rollingIncrementedSchema = incrementRollingSchema;
 /** Payload of the event that gives a reserved rolling amount back. */
 export const rollingReleasedSchema = incrementRollingSchema.extend({
@@ -37,27 +36,28 @@ export const rollingReleasedSchema = incrementRollingSchema.extend({
     /** When the released increment was booked; absent on events written before it was recorded. */
     incrementedAt: z.string().optional(),
 });
-// Rolling-Increment-Handler — append-only. Race-frei: zwei parallele
-// Increments für (tenant, cap) hängen sich am selben aggregate-stream
-// in unterschiedlichen versions auf, das event-store ordert.
+// Rolling-increment handler — append-only. Race-free: two parallel
+// increments for (tenant, cap) attach to the same aggregate stream at
+// different versions, and the event store orders them.
 //
-// **Kein version_conflict-Pfad** wie beim Calendar-Counter: hier
-// liest niemand den projection-state vor dem Schreiben. Der
-// expectedVersion ist implizit "next-after-current", was der event-
-// store atomar ermittelt.
+// **No version_conflict path** as with the calendar counter: nothing
+// reads projection state before writing. The expectedVersion is
+// implicitly "next-after-current", which the event store determines
+// atomically.
 export const incrementRollingCapHandler = {
     name: "increment-rolling",
     agent: { expose: false },
     schema: incrementRollingSchema,
-    // Internal handler — System-Caller (Plattform-foundations nach
-    // erfolgreichem Side-Effect) ruft das auf. Tenant-end-users niemals
-    // direkt. Audit-row zeigt welche subsystem-call-site zugehängt hat.
+    // Internal handler — a system caller (platform foundations after a
+    // successful side effect) invokes it. Tenant end users must never
+    // call it directly. The audit row shows which subsystem call site
+    // attached the operation.
     access: { roles: ["SystemAdmin"] },
     handler: async (event, ctx) => {
         // @cast-boundary engine-payload — dispatcher hands handler the
         // already-Zod-validated payload as `unknown`; cast to the typed
-        // shape we declared via incrementRollingSchema. Mirror der
-        // existing increment.write.ts-Cast — gleiche dispatcher-boundary.
+        // shape declared via incrementRollingSchema. Mirror the cast in
+        // existing increment.write.ts—the same dispatcher boundary.
         const payload = event.payload;
         const aggregateId = rollingCapAggregateId(event.user.tenantId, payload.capName);
         // unsafeAppendEvent: the strict appendEvent is bound to an app's own event map, which

package/dist/cap-counter/handlers/mark-soft-warned.write.js

@@ -2,12 +2,11 @@ import * as z from "zod";
 import { markCapSoftWarned } from "../book-cap-usage.js";
 // mark-soft-warned — sets lastSoftWarnedAt on the counter so subsequent
 // soft-cap-hits in the same period don't re-trigger notifications.
-// Anti-Notification-Storm-Schutz aus Memory `project_pricing_byok_caps`.
+// This prevents notification storms.
 //
-// **Caller-Pattern:** enforceCap-Helper checks if value crosses the
-// soft threshold AND lastSoftWarnedAt is null → calls this handler →
-// emits whatever notification (delivery-feature, ops-alert, etc.). The
-// emit-side is app-specific; this handler only sets the flag.
+// **Caller pattern:** enforceCap-Helper checks whether the value crosses the
+// soft threshold while lastSoftWarnedAt is null, then calls this handler and
+// emits the application-specific notification. This handler only sets the flag.
 const markSoftWarnedSchema = z.object({
     capName: z.string().min(1).max(100),
     periodStartIso: z.string().min(1),

package/dist/cap-counter/stock-cap-guard.js

@@ -1,5 +1,5 @@
 // Generic stock-cap write-guard factory. Extracted from the near-identical
-// cap-guard.ts app copies in show-pony and publicstatus (infra#446) — the
+// cap-guard.ts app copies in show-pony and publicstatus — the
 // only per-app variable was the Caps shape and how to resolve it for a
 // tenant, so both are now factory parameters.
 import { UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";

package/dist/cap-counter/with-cap-enforcement.d.ts

@@ -1,11 +1,9 @@
 import type { HandlerContext, WriteEvent, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { type CapToleranceProfileName, type SoftHitNotifier } from "./enforce-cap.ts";
 /**
- * Pro-call dynamische Cap-Definition. Wird vor jedem Handler-Aufruf
- * neu evaluiert — typischer Caller liest hier den Tenant-Tier aus
- * dem ctx, mappt ihn auf einen Limit-Wert. `amount` default 1 (count-
- * events); für byte/token-cap übergibt der Caller die Größe aus
- * `event.payload`.
+ * Dynamic cap definition resolved for each handler invocation. A typical caller reads the tenant
+ * tier from `ctx` and maps it to a limit. `amount` defaults to 1 (counting events); for byte or
+ * token caps, the caller supplies the size from `event.payload`.
  */
 export type CalendarCapDef = {
     readonly capName: string;

package/dist/channel-email/smtp-transport.d.ts

@@ -1,16 +1,16 @@
 import type { EmailTransport } from "./types.ts";
 export type SmtpTransportOptions = {
-    /** SMTP-Server-Host (z.B. "smtp.gmail.com", "in-v3.mailjet.com",
-     *  "localhost" für Mailhog/MailCatcher in dev). */
+    /** SMTP server host (for example, "smtp.gmail.com", "in-v3.mailjet.com",
+     *  or "localhost" for Mailhog/MailCatcher in development). */
     readonly host: string;
-    /** Default 587 (STARTTLS). 465 für implicit-TLS, 25 für unencrypted
-     *  (nur lokal/intern, nie public). */
+    /** Default 587 (STARTTLS). 465 uses implicit TLS; 25 is unencrypted
+     *  (for local/internal use only, never public). */
     readonly port?: number;
-    /** TLS-Mode: true = implicit TLS auf port 465, false = STARTTLS auf
-     *  587 (oder plain auf 25). Default false (STARTTLS standard). */
+    /** TLS mode: true = implicit TLS on port 465, false = STARTTLS on
+     *  587 (or plain on 25). The default is false (STARTTLS). */
     readonly secure?: boolean;
-    /** Optional auth — manche internal-relays nehmen IP-whitelisting statt
-     *  Login. Wenn gesetzt, beide felder pflicht. */
+    /** Optional authentication — some internal relays use IP allowlisting
+     *  instead of login. When set, both fields are required. */
     readonly auth?: {
         readonly user: string;
         readonly pass: string;
@@ -28,8 +28,8 @@ export type SmtpTransportOptions = {
     readonly servername?: string;
 };
 export declare function createSmtpTransport(options: SmtpTransportOptions): EmailTransport;
-/** Env-Felder die `createSmtpTransportFromEnv` liest. Apps die SMTP
- *  nutzen extenden ihr env-Schema um genau diese Keys. */
+/** Environment fields read by `createSmtpTransportFromEnv`. Apps that use
+ *  SMTP should extend their environment schema with exactly these keys. */
 export type SmtpEnv = {
     readonly SMTP_HOST?: string;
     readonly SMTP_PORT?: string;
@@ -39,14 +39,15 @@ export type SmtpEnv = {
     readonly SMTP_FROM?: string;
 };
 /**
- * Boot-Time-Transport aus env. Ohne `SMTP_HOST` → `null` (Caller behandelt
- * das als "kein Mail-Versand", statt zu crashen). Port wird zu Number
- * gecoerced (default 587), `secure` ist `SMTP_SECURE === "true"`, auth nur
- * wenn user UND pass gesetzt sind.
+ * Creates a transport at boot time from the environment. Without
+ * `SMTP_HOST`, returns `null` so the caller can treat this as no mail
+ * delivery instead of crashing. The port is coerced to a number (default
+ * 587); `secure` is `SMTP_SECURE === "true"`; authentication is included
+ * only when both the user and password are set.
  *
- * Ersetzt den identischen `env.SMTP_HOST ? createSmtpTransport({...}) : null`
- * Block den jede App in bin/main.ts + bin/server.ts hand-rollte — nur die
- * From-Default (`fallbackFrom`) variiert pro App.
+ * Replaces the repeated `env.SMTP_HOST ? createSmtpTransport({...}) : null`
+ * block that each app previously implemented in bin/main.ts and
+ * bin/server.ts. Only the From default (`fallbackFrom`) varies by app.
  */
 export declare function createSmtpTransportFromEnv(env: SmtpEnv, opts: {
     readonly fallbackFrom: string;

package/dist/channel-email/smtp-transport.js

@@ -1,20 +1,22 @@
-// SMTP-Transport für EmailTransport-Interface. nodemailer-basiert
-// (battle-tested, TLS-AUTH-Pool-Reconnect handled). Universaler default
-// für apps die keinen Vendor-spezifischen Sender wollen — funktioniert
-// gegen jeden SMTP-Server (Gmail, eigener Postfix, Brevo-SMTP-relay,
-// Office 365, Mailhog für lokales testing).
+// SMTP transport for the EmailTransport interface, based on nodemailer
+// (battle-tested, handles TLS, auth and pool reconnects). It is the universal
+// default for apps that do not need a vendor-specific sender and works with
+// any SMTP server (Gmail, a private
+// Postfix server, a Brevo SMTP relay, Office 365, or Mailhog for local
+// testing).
 //
-// Why SMTP statt Vendor-API als default:
-//   1. EU-Story: kein Daten an US-Vendor, App-Owner wählt Server.
-//   2. Self-Hosting: Customer kann eigenen Mailserver nutzen, kein
+// Why SMTP instead of a vendor API as the default:
+//   1. EU data control: the app owner chooses the server instead of sending
+//      data to a US vendor.
+//   2. Self-hosting: customers can use their own mail server without an
 //      external account.
-//   3. Universalität: jeder Vendor (Brevo, Resend, Mailgun, Postmark)
-//      bietet auch SMTP — wer Brevo will, setzt Brevos SMTP-Credentials.
+//   3. Universality: every vendor (Brevo, Resend, Mailgun, Postmark) also
+//      offers SMTP, so Brevo users can provide Brevo SMTP credentials.
 //
-// Transport-Pool: nodemailer.createTransport({pool: true}) hält bis zu
-// 5 Verbindungen offen + reused. Bei kleinen Apps reicht das; für High-
-// Volume-Apps muss der Caller eine eigene Implementation mit
-// dedizierter Queue (BullMQ + retry) drüberlegen.
+// The transport pool (createTransport({ pool: true })) keeps up to 5
+// connections open and reuses them. That is enough for small apps; for
+// high-volume apps the caller must layer its own implementation with a
+// dedicated queue (BullMQ + retry) on top.
 import { createTransport } from "nodemailer";
 import addressparser from "nodemailer/lib/addressparser";
 function isControlCharacter(char) {
@@ -80,14 +82,15 @@ export function createSmtpTransport(options) {
     };
 }
 /**
- * Boot-Time-Transport aus env. Ohne `SMTP_HOST` → `null` (Caller behandelt
- * das als "kein Mail-Versand", statt zu crashen). Port wird zu Number
- * gecoerced (default 587), `secure` ist `SMTP_SECURE === "true"`, auth nur
- * wenn user UND pass gesetzt sind.
+ * Creates a transport at boot time from the environment. Without
+ * `SMTP_HOST`, returns `null` so the caller can treat this as no mail
+ * delivery instead of crashing. The port is coerced to a number (default
+ * 587); `secure` is `SMTP_SECURE === "true"`; authentication is included
+ * only when both the user and password are set.
  *
- * Ersetzt den identischen `env.SMTP_HOST ? createSmtpTransport({...}) : null`
- * Block den jede App in bin/main.ts + bin/server.ts hand-rollte — nur die
- * From-Default (`fallbackFrom`) variiert pro App.
+ * Replaces the repeated `env.SMTP_HOST ? createSmtpTransport({...}) : null`
+ * block that each app previously implemented in bin/main.ts and
+ * bin/server.ts. Only the From default (`fallbackFrom`) varies by app.
  */
 export function createSmtpTransportFromEnv(env, opts) {
     if (!env.SMTP_HOST)

package/dist/channel-in-app/handlers/unread-count.query.js

@@ -13,10 +13,9 @@ export const unreadCountQuery = defineQueryHandler({
     },
     description: "Counts the calling user's unread in-app notification messages; use it for an inbox badge or to check whether a user has pending notifications.",
     handler: async (query, ctx) => {
-        // The query helpers in db/query.ts have no aggregate helper — selectMany alle matching rows,
-        // count() in JS. Pragma: unread-counts sind low-cardinality (user-
-        // scoped, max ~hunderte rows). Wenn das wachsen sollte: raw .unsafe()
-        // mit COUNT(*).
+        // The query helpers in db/query.ts have no aggregate helper, so selectMany returns all matching
+        // rows and count() runs in JS. This is acceptable because unread counts are low-cardinality and
+        // user-scoped, with at most a few hundred rows; use raw .unsafe() with COUNT(*) if that grows.
         const rows = await selectMany(ctx.db, inAppMessagesTable, {
             userId: query.user.id,
             isRead: false,

package/dist/compliance-profiles/feature.js

@@ -18,10 +18,10 @@ export function createComplianceProfilesFeature(options) {
             category: "compliance",
             recommended: false,
         });
-        // Standalone — kein r.requires noetig: tenantId kommt aus dem User-
-        // Context, Profile-Selection ist eigene Entity, sub-processor-Liste
-        // sind Constants. Wenn S1.4+ Cross-Feature-Reads dazukommen, kommt
-        // r.requires hier rein.
+        // Standalone — r.requires is not needed: tenantId comes from the user
+        // context, profile selection is a separate entity, and the sub-processor
+        // list consists of constants. Add r.requires if cross-feature reads are
+        // introduced.
         r.entity({ name: "tenant-compliance-profile", ...tenantComplianceProfileEntity });
         r.exposesApi("compliance.forTenant");
         const handlers = {

package/dist/compliance-profiles/handlers/for-tenant.query.js

@@ -4,13 +4,10 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { parseComplianceProfileOverride } from "../_internal/parse-override.js";
 import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
-// Liefert das effektive Compliance-Profile fuer den aktuellen Tenant.
-// Macht den exposesApi-Marker aus feature.ts mit echtem Inhalt.
+// Returns the effective compliance profile for the current tenant.
 //
-// Default-Verhalten (Edge-Case-Decision aus S1.1): kein Profile-
-// Eintrag → minimal-no-region + warning="no-profile-selected".
-// Caller (z.B. user-data-rights in Sprint 2) sieht das warning und
-// kann Onboarding-Banner triggern.
+// If no profile is selected, returns minimal-no-region with
+// warning="no-profile-selected" so callers can trigger an onboarding banner.
 export const forTenantQuery = defineQueryHandler({
     name: "for-tenant",
     schema: z.object({}),

package/dist/compliance-profiles/handlers/list-profiles.query.js

@@ -1,12 +1,12 @@
 import { COMPLIANCE_PROFILES, SELECTABLE_PROFILE_KEYS, } from "@cosmicdrift/kumiko-framework/compliance";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-// Liefert alle waehlbaren Compliance-Profile fuer das Tenant-Onboarding.
-// Pure In-Memory-Read der Constants — keine DB-Abfrage. Kein Caching
-// noetig (modulo Pre-Boot bereits aufgeloest).
+// Returns all selectable compliance profiles for tenant onboarding.
+// Pure in-memory read of the constants—no database query or caching is needed
+// because they are already resolved before boot.
 //
-// Filtert minimal-no-region raus — das ist Default-Fallback, nicht
-// auswählbar (Production soll explizite Wahl treffen).
+// Excludes minimal-no-region because it is the default fallback, not selectable;
+// production must make an explicit choice.
 export const listProfilesQuery = defineQueryHandler({
     name: "list-profiles",
     schema: z.object({}),

package/dist/compliance-profiles/handlers/needs-profile.query.js

@@ -5,7 +5,7 @@ import * as z from "zod";
 import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
 // Onboarding banner trigger for tenant admin.
 //
-// Sprint 1.5 — minimal API endpoint, the UI banner comes in a later UI
+// Minimal API endpoint, the UI banner comes in a later UI
 // sprint. Pure read query: does an entry exist in tenantComplianceProfile
 // for the current tenant?
 //
@@ -18,7 +18,7 @@ import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
 // option of createComplianceProfilesFeature) — passing the option through
 // would widen call access by default to all three access.admin roles
 // (including SystemAdmin). Instead the handler takes `pickerReachableRoles`
-// and deliberately resolves the #2063 special case: if the *caller's*
+// and deliberately resolves the special case: if the *caller's*
 // roles no longer intersect the picker's `access` option, the query stops
 // reporting needsSelection — otherwise a tenant admin would be told to
 // open a screen they can't reach.
@@ -33,8 +33,8 @@ export function createNeedsProfileQuery(pickerReachableRoles) {
                 tenantId: query.user.tenantId,
             })); // @cast-boundary db-runner
             if (row) {
-                // S1.7 X1: minimal-no-region is no longer settable via set-profile
-                // (Zod). If Sprint 2 ships a seedComplianceProfile helper that
+                // Minimal-no-region is no longer settable via set-profile
+                // (Zod). If a seedComplianceProfile helper ships that
                 // reintroduces the migration edge case, a defensive path belongs
                 // here again — until then, every existing entry is a deliberately
                 // chosen production profile.

package/dist/compliance-profiles/handlers/set-profile.write.js

@@ -8,10 +8,10 @@ import { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "..
 const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, {
     entityName: "tenant-compliance-profile",
 });
-// Schema engt sich auf die 3 oeffentlich waehlbaren Profile (Sprint 1.7
-// X1) — minimal-no-region ist Default-Fallback fuer "noch keine Wahl",
-// nicht eine waehlbare Production-Option. Symmetrisch zu
-// SELECTABLE_PROFILE_KEYS aus der framework/compliance-Liste.
+// The schema is limited to the three publicly selectable profiles.
+// `minimal-no-region` is the default fallback while no choice has been
+// made yet, not a selectable production option. This mirrors
+// SELECTABLE_PROFILE_KEYS from the framework/compliance list.
 const profileKeySchema = z.enum(SELECTABLE_PROFILE_KEYS);
 // Upsert: the first call inserts, later calls update, so repeating the same values
 // is idempotent apart from the extra audit events.
@@ -30,22 +30,21 @@ export const setProfileWrite = defineWriteHandler({
         override: z.string().nullable().optional(),
         tenantIdOverride: z.string().min(1).optional(),
     }),
-    // SystemAdmin kann Profile fuer Customer-Setup setzen (Plattform-
-    // Operator-Pfad). TenantAdmin nur fuer eigenen Tenant.
+    // SystemAdmin can set profiles for customer setup through the platform-
+    // operator path; TenantAdmin can set them only for their own tenant.
     access: { roles: access.admin },
     description: "Sets or replaces a tenant's compliance profile key plus an optional JSON override, for onboarding or a later region change; a system admin may target a different tenant through tenantIdOverride.",
     handler: async (event, ctx) => {
         const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId); // @cast-boundary engine-payload
         const { db, streamTenantId } = requireForTenant(ctx, tenantId);
-        // Override-Validation: muss parseables JSON-Object sein UND dem
-        // ComplianceProfileOverride-Schema entsprechen (S1.9 Z3 — strict-Zod
-        // mit Top-Level + Sub-Level-Whitelist via .strict()). Tippfehler
-        // wie `{ userRights: { weeks: 3 } }` werden hier rejected statt vom
-        // deepMerge silent ins Profile gespliced.
+        // The override must be parseable JSON representing an object and must
+        // conform to the ComplianceProfileOverride schema. The strict Zod
+        // top-level and nested allowlists reject typos such as
+        // `{ userRights: { weeks: 3 } }` instead of silently letting
+        // deepMerge splice them into the profile.
         //
-        // Errors via writeFailure + Kumiko-Error-Klassen (S1.10 M3) statt
-        // throw — landen so mit Path-Detail im response-body statt als
-        // generic internal_error.
+        // writeFailure and Kumiko error classes preserve path details in the
+        // response body instead of producing a generic internal_error.
         if (event.payload.override) {
             let parsed;
             try {

package/dist/compliance-profiles/handlers/sub-processors.query.js

@@ -2,19 +2,17 @@ import { getActiveSubProcessors, getPlannedSubProcessors, KUMIKO_SUB_PROCESSORS,
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
-// Public Sub-Processor-Liste — anonymous accessible (Memory:
-// project_anonymous_access). Matched die DSGVO Art. 28(2) Pflicht
-// dass die Liste der Auftragsverarbeiter oeffentlich einsehbar ist
-// (typisch verlinkt aus Datenschutzerklaerung + AVV).
+// Public sub-processor list, accessible anonymously. This satisfies the GDPR Art. 28(2) requirement
+// that the list of processors be publicly accessible, typically linked from
+// the privacy policy and data-processing agreement.
 //
-// Format: JSON mit getrennten active/planned-Sektionen. Tenant-Admins
-// kriegen Notification ueber Aenderungen via Cron-Job (Sprint 1.5+
-// oder S9 compliance-as-product). RSS-Feed kommt in S9.
+// Format: JSON with separate active/planned sections. Tenant admins receive
+// change notifications via a cron job.
 //
-// Zwei Auflistungen statt einer flachen Liste:
-//   - `active`: aktuell eingesetzte Sub-Processors
-//   - `planned`: bekannte zukünftige Sub-Processors (Tenant-Admin-
-//     Lead-Time bevor sie aktiv werden — typisch bei AI/Stripe)
+// Two lists are used instead of one flat list:
+//   - `active`: sub-processors currently in use
+//   - `planned`: known future sub-processors, giving tenant admins lead time
+//     before activation, as is typical for AI and Stripe providers.
 export const subProcessorsQuery = defineQueryHandler({
     name: "sub-processors",
     schema: z.object({}),

package/dist/compliance-profiles/resolve-for-tenant.js

@@ -1,12 +1,12 @@
-// Direkter Resolver-Helper fuer Bulk-Iteration ohne dispatcher-Roundtrip.
+// Direct resolver helper for bulk iteration without a dispatcher round trip.
 //
-// `for-tenant`-Query (handlers/for-tenant.query.ts) ist die Cross-Feature-
-// API fuer Handler-Pfade. Worker (S2.U3 Atom 3b) lebt im JobContext
-// ohne `queryAs` — braucht direkten DB-Lookup + resolveComplianceProfile.
+// The `for-tenant` query (handlers/for-tenant.query.ts) is the cross-feature
+// API for handler paths. Workers run in JobContext (without `queryAs`), so
+// they need a direct database lookup followed by `resolveComplianceProfile`.
 //
-// Pattern matched data-retention's `resolveRetentionPolicyForTenant`.
-// Beide Pfade nutzen `resolveComplianceProfile` aus framework/compliance,
-// also kein Drift zwischen Query-API und Worker-Pfad.
+// This follows data-retention's `resolveRetentionPolicyForTenant` pattern.
+// Both paths use `resolveComplianceProfile` from framework/compliance, keeping
+// the query API and worker path consistent.
 import { resolveComplianceProfile, } from "@cosmicdrift/kumiko-framework/compliance";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { isTenantDb } from "../shared/index.js";

package/dist/compliance-profiles/schema/profile-selection.js

@@ -1,23 +1,18 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createLongTextField, createSelectField, } from "@cosmicdrift/kumiko-framework/engine";
-// Tenant-1-zu-1: Pro Tenant genau eine Profile-Wahl.
+// One-to-one relationship: each tenant has exactly one profile selection.
 //
-// Architektur-Entscheidung (2026-05-06): Profile-Selection lebt als
-// separate Entity im compliance-profiles-Feature, NICHT als config-key
-// im tenant-Feature. Begruendung:
-//   (a) override ist strukturiertes JSON, config-key-Pattern (timezone/
-//       locale) ist key-value-flach
-//   (b) Profile-Wechsel ist audit-relevant — Event-Store gibt das
-//       automatisch fuer Entity-Writes
-//   (c) Plan-Files in docs/plans/datenschutz/compliance-profiles.md
-//       nennen sie explizit als tenantComplianceProfile-Entity
+// Profile selection is a separate entity in the compliance-profiles feature,
+// not a config key in the tenant feature, because:
+//   (a) override is structured JSON, while the config-key pattern
+//       (timezone/locale) is flat key-value data
+//   (b) profile changes are audit-relevant, which the event store handles
+//       automatically for entity writes
 //
-// Wer in 6 Monaten zweifelt warum nicht config-key: siehe oben.
-//
-// override als JSON-String in longText: kein dedizierter jsonField-Typ
-// im Framework; embedded hat festes Schema, das hier dynamisch ist.
-// Zod-Validation beim set-profile-Handler stellt Schema-Konformitaet
-// sicher.
+// override is stored as a JSON string in longText because the framework has
+// no dedicated jsonField type; embedded has a fixed schema, while this schema
+// is dynamic. Zod validation in the set-profile handler ensures schema
+// conformity.
 export const tenantComplianceProfileEntity = createEntity({
     table: "read_tenant_compliance_profiles",
     fields: {
@@ -25,19 +20,19 @@ export const tenantComplianceProfileEntity = createEntity({
             required: true,
             options: ["eu-dsgvo", "swiss-dsg", "de-hr-dsgvo-hgb", "minimal-no-region"],
         }),
-        // override: JSON-String mit Partial-ComplianceProfile. NULL/leer
-        // bedeutet "Default-Profile, keine Override". Validiert beim
-        // set-profile-Handler via Zod.
+        // override: JSON string containing a partial ComplianceProfile. NULL/empty
+        // means "default profile, no override". Validated by the
+        // set-profile handler via Zod.
         override: createLongTextField({
             personal: false,
             reason: "is_business_data",
         }),
     },
     indexes: [
-        // Pro Tenant nur EIN Profile-Datensatz. Boot-Validator-Comment in
-        // EntityIndexDef warnt vor single-column-tenantId-Index als redundant
-        // — UNIQUE-Constraint ist hier aber semantisch noetig (1:1-Relation)
-        // und nicht nur Performance-Hint, daher explizit deklariert.
+        // Only one profile record is allowed per tenant. Although the boot validator
+        // warns that a single-column tenantId index is redundant, the UNIQUE
+        // constraint is semantically required here for the one-to-one relationship,
+        // not merely a performance hint, so it is declared explicitly.
         { unique: true, columns: ["tenantId"] },
     ],
 });

package/dist/compliance-profiles/seeding.js

@@ -1,22 +1,21 @@
-// Test-Helper für compliance-profiles. Legt einen Profile-Eintrag direkt
-// über den Event-Store-Executor an — gleicher Pfad wie der echte
-// set-profile-Handler, aber ohne Zod-Schema-Engung (akzeptiert
-// minimal-no-region für Migration-Edge-Case-Tests) und ohne Access-
-// Check. Default ifExists="skip": nur fehlende Profile anlegen.
+// Test helper for compliance-profiles. Creates a profile entry directly
+// through the Event Store executor—the same path as the real
+// set-profile handler, but without Zod schema restrictions (accepts
+// minimal-no-region for migration edge-case tests) and without an access
+// check. Default ifExists="skip": creates only missing profiles.
 //
-// Sprint 2 user-data-rights nutzt das fuer Test-Setup ("user kann
-// Daten exportieren mit profile X" — pro Test ein frischer Tenant +
-// Profile-Wahl in einem Helper-Call).
+// user-data-rights uses this for test setup ("user can export data with
+// profile X": a fresh tenant and profile selection per test in one helper
+// call).
 //
-// Pattern matched seedTextBlock aus text-content.
+// The pattern matches seedTextBlock in template-resolver/seeding.ts.
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { runEventStoreSeed, TestUsers, } from "@cosmicdrift/kumiko-framework/seeding";
 import { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "./schema/profile-selection.js";
 const executor = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, { entityName: "tenant-compliance-profile" });
 export async function seedComplianceProfile(db, opts) {
-    // user.tenantId muss === opts.tenantId sein damit Event-Store-Stream
-    // + Projection im selben Tenant-Bucket landen (Memory:
-    // feedback_event_store_tenant_consistency).
+    // user.tenantId must equal opts.tenantId so the Event Store stream
+    // and projection remain in the same tenant bucket.
     const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
     const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
     const overrideJson = opts.override !== undefined ? JSON.stringify(opts.override) : null;
@@ -35,9 +34,9 @@ export async function seedComplianceProfile(db, opts) {
             if (!result.isSuccess) {
                 throw new Error(`seedComplianceProfile create failed: ${JSON.stringify(result)}`);
             }
-            // @cast-boundary db-row: executor.create result.data ist die
-            // inserted Projection-Row (Record<string, unknown>); id ist nach
-            // INSERT garantiert (Runtime-Check direkt darunter).
+            // @cast-boundary db-row: executor.create result.data is the
+            // inserted projection row (Record<string, unknown>); id is guaranteed
+            // after INSERT (runtime check directly below).
             const data = result.data;
             if (data.id === undefined) {
                 throw new Error("seedComplianceProfile: executor.create did not return an id");

package/dist/compliance-profiles-ops/handlers/tenants-missing-profile.query.js

@@ -4,12 +4,12 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tenantComplianceProfileTable } from "../../compliance-profiles/index.js";
 import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
-// SystemAdmin platform-wide counterpart to needs-profile (#2089).
+// SystemAdmin platform-wide counterpart to needs-profile.
 //
-// #2084 stopped needs-profile from nagging a TenantAdmin who can no longer
+// The change stopped needs-profile from nagging a TenantAdmin who can no longer
 // reach a picker narrowed to access.systemAdmin — correct, but it left no
 // one else able to notice: needs-profile stays TenantAdmin-only on purpose
-// (widening its call-access was explicitly rejected in #2084), so a
+// (widening its call-access was explicitly rejected), so a
 // SystemAdmin who owns the platform-only picker has no way to see which
 // tenants still run on minimal-no-region. This query fills that gap
 // instead of touching needs-profile: every enabled tenant that has no row