@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.387.0

package/LICENSE

@@ -1,57 +1,21 @@
-Business Source License 1.1
-
-Parameters
-
-Licensor:             Marc Frost
-
-Licensed Work:        @cosmicdrift/kumiko-framework
-                      The Licensed Work is © 2026 Marc Frost.
-
-Additional Use Grant: 
-You may use the Licensed Work in production for any purpose, including 
-commercially, EXCEPT for the Restricted Use. 
-
-"Restricted Use" is defined as using the Licensed Work to provide a platform 
-or service to third parties that allows them to host, deploy, or run their 
-own applications built with the Licensed Work. This includes, but is not 
-limited to: managed hosting services, software-as-a-service (SaaS) platforms, 
-platform-as-a-service (PaaS), developer platforms, or any multi-tenant 
-managed offering of the Licensed Work.
-
-This restriction does not apply to the Licensor, any entity controlled by, 
-controlling, or under common control with the Licensor ("Affiliates"), or 
-contractors acting on their behalf. The Licensor remains free to use the 
-Licensed Work for any purpose, including for the operation of kumiko.rocks.
-
-Change Date:          2030-05-05
-Change License:       Apache License, Version 2.0
-
-
-Terms
-
-The Licensor hereby grants you the right to copy, modify, create derivative works, 
-redistribute, and make non-production use of the Licensed Work. The Licensor may 
-make an Additional Use Grant, above, permitting limited production use.
-
-Effective on the Change Date, or the fourth anniversary of the first publicly 
-available distribution of the Licensed Work under this License, whichever comes 
-first, this License will convert to the Change License.
-
-This Business Source License governs use of the Licensed Work in all cases, except 
-as to any use that is explicitly granted in the Additional Use Grant above or 
-under the Change License after the Change Date.
-
-If your use of the Licensed Work does not comply with the requirements of this 
-License, you must cease use of the Licensed Work immediately.
-
-All copies of the Licensed Work, and all derivative works thereof, must include 
-this License.
-
-This License does not grant you any right, title, or interest in any trademark, 
-logo, or branding of the Licensor, except as required to comply with this License.
-
-TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN 
-“AS IS” BASIS. LICENSOR DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 
-WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, 
-TITLE, AND NON-INFRINGEMENT. IN NO EVENT WILL LICENSOR BE LIABLE FOR ANY DAMAGES 
-ARISING OUT OF OR RELATED TO THIS LICENSE OR THE USE OF THE LICENSED WORK.
+MIT License
+
+Copyright (c) 2026 Marc Frost
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/agent-tools/tool-catalog.js

@@ -68,7 +68,7 @@ function isListHandlerQn(qn, entityName) {
 function isDetailHandlerQn(qn, entityName) {
     return qn.endsWith(`:${entityName}:detail`);
 }
-/** #2700: the entity CRUD tools are enumerated off the registry, not off the manifest, so
+/** The entity CRUD tools are enumerated off the registry, not off the manifest, so
  *  `resolveAgentExposure` never runs for them. Only an EXPLICIT opt-out may hide one here —
  *  the resolver's own default is fail-closed on a missing `description`, and CRUD-generated
  *  handlers never carry one, so reusing it would delete every entity tool in every app. */

package/dist/audit/screens.js

@@ -85,7 +85,7 @@ export function auditLogDetailLayout(options) {
                     "id",
                 ],
             },
-            // No section `title` here (fw#2312 label-dedup fix): each section
+            // No section `title` here (label-dedup fix): each section
             // holds exactly one field, so a title would repeat the field's own
             // label (rendered by RenderField as the Field's heading) verbatim.
             { fields: [{ field: "payload", renderer: { format: "json" } }] },

package/dist/auth-email-password/feature.js

@@ -66,7 +66,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
     const strictVerification = opts.emailVerification !== undefined && (opts.emailVerification.mode ?? "strict") === "strict";
     const feature = defineFeature("auth-email-password", (r) => {
         r.describe("Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, tenant invite, and account-unlock — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`, `accountUnlock`) to `createAuthEmailPasswordFeature(opts)`. All five magic-link flows dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify/unlock) or opaque-random in Redis (signup/invite). `accountUnlock` is the self-service escape hatch for `accountLockout`'s monotonic failure-counter (#1266): confirming the mailed token clears the Redis lockout state without touching the user entity. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.");
-        // kumiko-lint-ignore i18n-ui-strings uiHints labels are feature-registry metadata for the admin feature catalog, not yet wired to the i18n system, see #2312
+        // kumiko-lint-ignore i18n-ui-strings uiHints labels are feature-registry metadata for the admin feature catalog, not yet wired to the i18n system
         r.uiHints({
             displayLabel: "Auth \u00b7 Email + Password",
             category: "identity",

package/dist/auth-email-password/handlers/change-password.write.js

@@ -42,9 +42,9 @@ export const changePasswordWrite = defineWriteHandler({
             return invalidCredentials();
         }
         const newHash = await hashPassword(event.payload.newPassword);
-        // The user aggregate is systemStream (#497): its event stream lives on
-        // SYSTEM_TENANT_ID deterministically. Pre-#497 scattered streams need the
-        // one-time backfillUserStreamTenants migration (#762).
+        // The user aggregate is systemStream: its event stream lives on
+        // SYSTEM_TENANT_ID deterministically. Previously scattered streams need the
+        // one-time backfillUserStreamTenants migration.
         const writer = createSystemUser(SYSTEM_TENANT_ID);
         // Apply via user feature's update handler — writeAs(system) satisfies
         // the privileged-only write rule on passwordHash. Pass the current version

package/dist/auth-email-password/handlers/confirm-token-flow.js

@@ -15,11 +15,11 @@
 // else — including future branches a maintainer adds — releases
 // automatically.
 //
-// The user aggregate is systemStream (#497): its event stream lives on
+// The user aggregate uses systemStream: its event stream lives on
 // SYSTEM_TENANT_ID deterministically, so the write targets exactly one
 // stream. The former membership-probing (`tryWriteAcrossTenants`) existed
-// for pre-#497 scattered streams; those need the one-time
-// backfillUserStreamTenants migration (#762) — probing them stopped working
+// for scattered streams; those need the one-time
+// backfillUserStreamTenants migration — probing them stopped working
 // the moment the executor's stream choke-point landed anyway.
 import { createSystemUser, declareEscapeHatch, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -61,8 +61,8 @@ export async function runConfirmTokenFlow(ctx, userId, expiresAtMs, spec) {
             committed = true;
             return { isSuccess: true, data: spec.successData };
         }
-        // version_conflict = concurrent modification (or an un-migrated pre-#497
-        // stream, see header) → token-level failure. Anything else (DB down,
+        // version_conflict = concurrent modification (or an un-migrated
+        // stream) → token-level failure. Anything else (DB down,
         // access denied) bubbles unchanged so ops sees the real failure class.
         if (writeRes.error.code === "version_conflict")
             return spec.invalidToken();

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -88,7 +88,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 }
                 // Password check against userTable, through the same gates
                 // login.write.ts runs (see login-gates.test.ts for the gate contracts).
-                // Email uniqueness is partial on live rows (framework#2593) — without
+                // Email uniqueness is partial on live rows — without
                 // this filter the lookup can resolve a soft-deleted row.
                 const userRow = await ctx.db.global(userTable).fetchOne({
                     email: invitationEmail,

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -1,31 +1,31 @@
-// Tenant-Invite Step 2 — Branch 1 (logged-in user accepts).
+// Tenant invitation — logged-in user accepts.
 //
-// User ist eingeloggt (in irgendeinem Tenant), klickt Accept-Link.
+// The user is signed in to some tenant and clicks the Accept link.
 // Server:
 //   1. Token → invitationId (Redis)
 //   2. Burn (single-use)
-//   3. Invitation-Row aus DB
-//   4. Email-Match: invitation.email === user.email (sonst inviteEmailMismatch)
+//   3. Load the invitation row from the database
+//   4. Email match: invitation.email === user.email (otherwise inviteEmailMismatch)
 //   5+6. grantInvitedMembershipRole: create the membership, or add the
 //      invited role to an existing one (add-only)
-//   7. Invitation-Row → status=accepted
-//   8. Redis-Keys löschen (Burn-Key bleibt für Replay-Schutz)
+//   7. Invitation row → status=accepted
+//   8. Delete Redis keys (the burn key remains for replay protection)
 //
-// Branch 1 ist der klassische "shared workspace bei eingeloggter
-// Session"-Flow. Branch 2 (anon + existing email) und Branch 3 (anon +
-// new email) kommen als separate Handler.
+// This is the classic "shared workspace with a logged-in session" flow.
+// Branch 2 (anonymous + existing email) and Branch 3 (anonymous + new
+// email) are handled separately.
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import the invite flow lives in auth-email-password (Magic-Link), while the DB-row owner is a tenant feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add (like provisionSignupAccount)
 import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
-// kumiko-lint-ignore cross-feature-import auth handler reads user-row für email-match
+// kumiko-lint-ignore cross-feature-import the auth handler reads the user row for the email match
 import { userTable } from "../../user/schema/user.js";
 import { invalidInviteToken, inviteEmailMismatch } from "../errors.js";
 import { burnInviteToken, deleteInviteToken, getInvitationIdForToken, unburnInviteToken, } from "../invite-token-store.js";
@@ -73,9 +73,9 @@ export function createInviteAcceptHandler() {
                 const invitationEmail = await decryptStoredPii(invitation.email, "email", "auth:invite-accept");
                 const invitationRole = invitation.role;
                 const invitationVersion = invitation.version;
-                // Email-Match: User muss mit der eingeladenen Email matchen.
-                // Sonst kann ein Angreifer mit Zugriff zur invitee-Mail seinen
-                // eigenen Account dem Tenant zuschlagen.
+                // Email match: the user must match the invited email.
+                // Otherwise, anyone with access to the invitee's email could add
+                // their own account to the tenant.
                 const userRow = await ctx.db.global(userTable).fetchOne({
                     id: event.user.id,
                 });
@@ -103,10 +103,10 @@ export function createInviteAcceptHandler() {
                 });
                 if (!globalGrant.isSuccess)
                     return globalGrant;
-                // Invitation-Status → accepted via event-store-executor.
-                // Tenant-scoping: ctx.db ist auf event.user.tenantId gescopt
-                // (= NICHT der invitation-tenant). Eigene TenantDb für den
-                // invitation-tenant bauen damit der executor die row findet.
+                // Invitation status → accepted via event-store-executor.
+                // Tenant scoping: ctx.db is scoped to event.user.tenantId
+                // (not the invitation tenant). Build a TenantDb for the
+                // invitation tenant so the executor can find the row.
                 const invitationTdb = createTenantDb({
                     db: dbConn,
                     tenantId: invitationTenantId,

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -11,7 +11,7 @@ export type InviteCreateData = {
     readonly expiresAt: string;
 };
 export type InviteCreateOptions = {
-    /** TTL für den Activation-Token. Default 7 Tage. */
+    /** TTL for the activation token. Default: 7 days. */
     readonly tokenTtlMinutes?: number;
     /** App page that receives the magic-link; the handler appends `?token=…`
      *  and dispatches the invite mail via delivery (ctx.notify). Apps with
@@ -25,7 +25,7 @@ export type InviteCreateOptions = {
     readonly locale?: AuthMailLocale;
     readonly canAssignRole?: (inviterRoles: readonly string[], targetRole: string) => boolean;
     /** Opt-in allow-list for app-defined (unranked) roles the elevation guard
-     *  would otherwise reject with unassignable_membership_role (fw#2398).
+     *  would otherwise reject with unassignable_membership_role.
      *  Rank-aware alternative: declare roles via EXT_ASSIGNABLE_ROLE. */
     readonly additionalAssignableRoles?: readonly string[];
 };

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -1,10 +1,10 @@
 // Tenant-Invite Step 1 (create).
 //
-// Admin invitet email → DB-Row entsteht via event-store-executor (oder
-// wird re-used bei Re-Invite), Random-Token in Redis bidirektional, und der
-// Handler schickt die Invite-Mail an den Invitee via delivery (ctx.notify) —
-// wie reset/verify/signup. Der Token geht NICHT an den Admin zurück (er soll
-// die Annahme nicht impersonieren können).
+// An admin invites an email address → a DB row is created via
+// event-store-executor (or reused for a re-invite), a random token is stored
+// bidirectionally in Redis, and the handler sends the invite email to the
+// invitee via delivery (ctx.notify), as with reset/verify/signup. The token
+// is NOT returned to the admin, so the admin cannot impersonate acceptance.
 //
 // Re-invite for the same (tenantId, email): the existing row is reused
 // regardless of its prior status (pending/cancelled/accepted), reset to
@@ -12,10 +12,10 @@
 // still live for that invitation is invalidated first, so the previous
 // mail's link stops working (see invite-token-store.ts).
 //
-// Always-200 für unbekannten User: bei invitee-Email die nicht in users
-// existiert wird trotzdem ein Invite erstellt — Branch-3-Accept-Flow
-// erlaubt new-user-signup mit dem Token. Keine Enumeration durchs
-// invite-create.
+// Always-200 for an unknown user: an invite is created even when the
+// invitee's email does not exist in users — the Branch-3-Accept-Flow
+// permits new-user-signup with the token. invite-create does not enable
+// enumeration.
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, assignableAppRolesOf, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
@@ -23,7 +23,7 @@ import { InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/erro
 import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import invite flow lives in auth-email-password (Magic-Link-Pattern); DB-row owner is the tenant feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership version read is owned by the tenant feature
 import { membershipVersionOf } from "../../tenant/invited-membership.js";

package/dist/auth-email-password/handlers/invite-info.query.js

@@ -9,7 +9,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import invite-flow lives in auth-email-password (Magic-Link), DB-row-owner belongs to the tenant feature
 import { INVITATION_STATUS, tenantInvitationsTable } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import login-style account lookup, same as invite-accept-with-login
 import { userTable } from "../../user/schema/user.js";

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -1,21 +1,21 @@
-// Tenant-Invite Step 2 — Branch 3 (anon User, Email NICHT registriert).
+// Tenant-Invite Step 2 — Branch 3 (anonymous user, email NOT registered).
 //
-// Anders als signup-confirm: KEIN neuer Tenant entsteht. Der Tenant
-// existiert schon (im invitation-row), wir legen NUR User+Membership an.
+// Unlike signup-confirm, no new tenant is created. The tenant already
+// exists in the invitation row; only the user and membership are created.
 //
 // Flow:
-//   1. User klickt Invite-Link → /invite/signup?token=...
-//   2. Frontend zeigt Password-Form (email kommt aus invitation, kein
-//      User-Input damit kein Email-Mismatch möglich)
-//   3. User submitted password + token
+//   1. User clicks the invite link → /invite/signup?token=...
+//   2. The frontend shows the password form (the email comes from the
+//      invitation, not user input, so an email mismatch is impossible)
+//   3. User submits the password and token
 //   4. Server:
 //      a. Token → invitationId → invitation row
-//      b. User-Existence-Check: invitation.email darf NICHT in userTable
-//         existieren (sonst soll Branch 2 oder Branch 1 genutzt werden)
-//      c. Create user (emailVerified=true wegen Magic-Link)
-//      d. Add membership im invited Tenant
-//      e. Invitation → accepted, Token gelöscht
-//   5. Response: SessionUser + tenantId für Auto-Login
+//      b. User-existence check: invitation.email must NOT exist in userTable
+//         (otherwise Branch 2 or Branch 1 must be used)
+//      c. Create the user (emailVerified=true because of the magic link)
+//      d. Add membership to the invited tenant
+//      e. Mark the invitation accepted and delete the token
+//   5. Response: SessionUser + tenantId for automatic login
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles, createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -25,7 +25,7 @@ import { decryptStoredPii, registrationLocaleFromRequest } from "../../shared/in
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
 import { findForbiddenMembershipRole, reservedMembershipRoleError, } from "../../tenant/membership-roles.js";
-// kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
+// kumiko-lint-ignore cross-feature-import membership-seed-helper for privileged cross-tenant addition
 import { seedTenantMembership } from "../../tenant/seeding.js";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.js";
@@ -74,20 +74,19 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                 const invitationRole = invitation.role;
                 const invitationGlobalRoles = parseInvitedGlobalRoles(invitation.globalRoles);
                 const invitationVersion = invitation.version;
-                // User-Not-Exists-Check: wenn die Email schon registriert ist,
-                // muss der User Branch 2 (acceptWithLogin) nutzen. Hier ist
-                // explizit "neue Email" — sonst hätten wir zwei Wege ein
-                // Password zu setzen für denselben User.
-                // Email uniqueness is partial on live rows (framework#2593) — without
-                // this filter the lookup can resolve a soft-deleted row.
+                // If the email is already registered, the user must use Branch 2
+                // (acceptWithLogin). This flow explicitly requires a new email;
+                // otherwise there would be two ways to set a password for the same user.
+                // Email uniqueness is partial on live rows — without this filter,
+                // the lookup can resolve a soft-deleted row.
                 const existingUser = await ctx.db.global(userTable).fetchOne({
                     email: invitationEmail,
                     isDeleted: false,
                 });
                 if (existingUser)
                     return invalidInviteToken();
-                // User anlegen via seedUserWithPassword (gleiches Pattern wie
-                // signup-confirm), emailVerified=true wegen Magic-Link.
+                // Create the user through seedUserWithPassword so the magic-link flow
+                // records emailVerified=true.
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
                 const dbConn = ctx.db.unsafeRaw();
@@ -100,9 +99,8 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                     ...registrationLocale,
                     ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
                 });
-                // Membership-Add via seed-helper (gleiches Pattern wie
-                // provisionSignupAccount — bypassed addMember access-check
-                // weil createSystemUser nicht ["SystemAdmin"] matcht).
+                // The seed helper bypasses addMember's access check because
+                // createSystemUser does not match ["SystemAdmin"].
                 const forbiddenInviteRole = findForbiddenMembershipRole([invitationRole]);
                 if (forbiddenInviteRole !== undefined) {
                     return writeFailure(reservedMembershipRoleError(forbiddenInviteRole));
@@ -112,7 +110,7 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                     tenantId: invitationTenantId,
                     roles: [invitationRole],
                 });
-                // Invitation → accepted: TenantDb für invitation-tenant
+                // Update the invitation in the invited tenant's database context.
                 const invitationTdb = createTenantDb({
                     db: dbConn,
                     tenantId: invitationTenantId,

package/dist/auth-email-password/handlers/login.write.d.ts

@@ -45,7 +45,7 @@ type GateOutcome<T> = GateReject | GateOk<T>;
 type AuthenticatableUserRow = AuthUserRow & {
     readonly passwordHash: string;
 };
-/** Uniform response on any credential miss — burns argon2 cost (#774). */
+/** Uniform response on any credential miss — burns argon2 cost. */
 export declare function gateResolveAuthUser(found: AuthUserRow | null, password: string): Promise<GateOutcome<AuthenticatableUserRow>>;
 export declare function gateCountUnknownUser(ctx: HandlerContext, email: string, maxFailedAttempts: number, lockoutDurationMinutes: number): Promise<GateOutcome<undefined>>;
 /**

package/dist/auth-email-password/handlers/login.write.js

@@ -14,7 +14,7 @@ function reject(result) {
 function ok(value) {
     return { ok: true, value };
 }
-/** Uniform response on any credential miss — burns argon2 cost (#774). */
+/** Uniform response on any credential miss — burns argon2 cost. */
 export async function gateResolveAuthUser(found, password) {
     if (!found?.passwordHash || found.isDeleted) {
         await verifyDummyPassword(password);

package/dist/auth-email-password/handlers/self-registration-status.query.js

@@ -16,7 +16,7 @@ export const selfRegistrationStatusQuery = defineQueryHandler({
     rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     description: "Reports whether self-registration is currently switched on, readable without signing in, so a signup page can hide its own form instead of collecting an address that would be silently ignored.",
     handler: async (_query, ctx) => {
-        // Same fail-open reasoning as signup-request.write.ts (#1468): only
+        // Same fail-open reasoning as signup-request.write.ts: only
         // report disabled when the toggle feature is actually composed.
         const gated = ctx.registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) !== undefined;
         return { enabled: gated ? await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE) : true };

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -1,23 +1,22 @@
-// Magic-Link-Signup, Step 2 (confirm).
+// Magic-Link signup, step 2 (confirmation).
 //
-// Token aus URL + Password vom User → wir lösen den Token in Redis ein
-// und legen Tenant + User + TenantAdmin membership atomically. emailVerified
-// wird sofort auf true gesetzt — der Magic-Link IST der Beweis.
+// Token from the URL + password from the user → redeem the token in Redis
+// and atomically create the tenant, user, and TenantAdmin membership.
+// emailVerified is set to true immediately—the magic link IS the proof.
 //
 // Pipeline:
 //   1. Redis check: token → email lookup
-//   2. Single-Use-Burn (SETNX) — gleichzeitiger Klick aus zwei Tabs
-//      gewinnt nur einer
-//   3. Tenant-Key generieren (generateUniqueName mit DB-isAvailable-
-//      check gegen tenants.key)
-//   4. provisionSignupAccount: Tenant + User + Membership in einem
-//      Rutsch (durch event-store-executor; events + projection +
-//      MSPs sehen das wie einen regulären create)
-//   5. Token-Keys löschen (burn-key bleibt für TTL-Replay-Protection)
+//   2. Single-use burn (SETNX)—only one of two simultaneous tab clicks wins
+//   3. Generate the tenant key (generateUniqueName with a DB isAvailable
+//      check against tenants.key)
+//   4. provisionSignupAccount: create the tenant, user, and membership in one
+//      operation (through event-store-executor; events, projection, and MSPs
+//      see this as a regular create)
+//   5. Delete the token keys (the burn key remains for TTL replay protection)
 //
-// Failure-Recovery: jeder Pfad nach dem burn checked `committed`-Flag;
-// bei !committed wird der burn released damit ein legitimer Retry
-// nicht durch einen stale Marker geblockt wird (wie reset/verify).
+// Failure recovery: every path after the burn checks the `committed` flag;
+// when !committed, the burn is released so a legitimate retry is not blocked
+// by a stale marker, as with reset/verify.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, InternalError, reraiseAsKumikoError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
@@ -87,21 +86,21 @@ export function createSignupConfirmHandler(opts = {}) {
                     message: "signup-confirm requires ctx.redis for token consumption",
                 }));
             }
-            // Token-Lookup: nicht-existent / abgelaufen / schon konsumiert →
-            // alle collapsen auf invalid_signup_token. Anti-enumeration.
+            // Token lookup: nonexistent, expired, and already-consumed tokens all
+            // collapse to invalid_signup_token to prevent enumeration.
             const email = await getEmailForSignupToken(ctx.redis, event.payload.token);
             if (!email)
                 return invalidSignupToken();
-            // Single-Use-Burn: zwei parallele Confirms aus verschiedenen
-            // Tabs — einer wins, der andere kriegt invalid_signup_token.
+            // Single-use burn: of two parallel confirmations from different tabs,
+            // one succeeds and the other receives invalid_signup_token.
             const burn = await burnSignupToken(ctx.redis, event.payload.token);
             if (burn === "already-used")
                 return invalidSignupToken();
             let committed = false;
             try {
-                // Tenant-Key: 2-Wort-Slug aus framework/random, mit DB-Conflict-
-                // Check gegen tenants.key. 22.500 Default-Combos + Suffix-
-                // Fallback bei Kollision (siehe generateUniqueName).
+                // Tenant key: a two-word slug from framework/random, with a DB conflict
+                // check against tenants.key. 22,500 default combinations plus a
+                // suffix fallback in case of collision (see generateUniqueName).
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
                 const dbConn = ctx.db.unsafeRaw();
@@ -112,8 +111,8 @@ export function createSignupConfirmHandler(opts = {}) {
                     },
                 });
                 const tenantId = generateId(); // @cast-boundary engine-payload
-                // Display-Name aus email-prefix als sinnvolles Default; User kann
-                // den Tenant-Namen + sein eigenes displayName später ändern.
+                // Use the email prefix as a meaningful default display name; the user can
+                // change the tenant name and their own displayName later.
                 const displayName = email.split("@")[0] ?? email;
                 const registrationLocale = registrationLocaleFromRequest();
                 let provisioned;
@@ -128,25 +127,24 @@ export function createSignupConfirmHandler(opts = {}) {
                         tenantName: tenantKey,
                         ...registrationLocale,
                     }, 
-                    // #1463: seedTenant's postSave hooks (tier-engine's auto-default-
+                    // seedTenant's postSave hooks (tier-engine's auto-default-
                     // tier, an app's auto-default-compliance) must fire on self-signup
                     // exactly like they do on the regular TenantHandlers.create path.
                     { registry: ctx.registry, context: ctx });
                 }
                 catch (err) {
-                    // Email hat bereits ein Konto — provisionSignupAccount ist create-only
-                    // (#365): sauberer User-Fehler, KEINE Session für den fremden Account.
-                    // committed bleibt false → der burn wird im finally released (ein
-                    // Retry scheitert wieder gleich, kein stale-Marker-Block).
+                    // The email already has an account—provisionSignupAccount is create-only:
+                    // return a clean user error and never create a session for that account.
+                    // committed remains false, so finally releases the burn; a retry fails
+                    // the same way without being blocked by a stale marker.
                     if (err instanceof ConflictError)
                         return signupEmailAlreadyRegistered();
                     throw err;
                 }
-                // SessionUser für JWT-Mint. Roles aus INITIAL_SIGNUP_ROLES
-                // damit DB-write (provisionSignupAccount) und Session-claim
-                // dieselbe Quelle teilen — sonst hätten zwei Stellen "TenantAdmin"
-                // hardcoded und ein Refactor würde role-mismatch zwischen DB
-                // und JWT erzeugen.
+                // Build the SessionUser for JWT minting. Use roles from INITIAL_SIGNUP_ROLES
+                // so the database write (provisionSignupAccount) and session claim share
+                // one source; otherwise two hardcoded "TenantAdmin" values could drift
+                // during a refactor and create a role mismatch between the DB and JWT.
                 const session = {
                     id: provisioned.userId,
                     tenantId: provisioned.tenantId,
@@ -195,9 +193,8 @@ export function createSignupConfirmHandler(opts = {}) {
             }
             finally {
                 if (!committed && ctx.redis) {
-                    // Burn-release damit ein retry nach DB-Hiccup nicht blockt.
-                    // Token-Lookup-Keys bleiben — der User kann seinen Mail-Link
-                    // erneut klicken.
+                    // Release the burn so a retry after a DB hiccup is not blocked.
+                    // Keep the token lookup keys so the user can click the email link again.
                     await unburnSignupToken(ctx.redis, event.payload.token);
                 }
             }

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -15,7 +15,7 @@
 // Always-200 (enumeration-safe): the response looks the same for every
 // email, whether it's already registered or not. An email CAN already have
 // an account (seeding or an earlier signup) — the actual gate sits
-// deliberately in the confirm step (#365): signup-confirm rejects an
+// deliberately in the confirm step: signup-confirm rejects an
 // already-registered email instead of reusing the existing user. Here it
 // stays always-200 + resend-idempotent so the request path leaks nothing;
 // suppressing the link on the request side would be defense-in-depth, but
@@ -31,10 +31,9 @@ import { issueSignupActivation } from "../signup-activation.js";
 import { storeSignupHandover, takeOverSignupHandoverForResend } from "../signup-token-store.js";
 const SignupRequestSchema = z.object({
     email: z.email(),
-    // Cross-device try-first handover (kumiko-framework#3035 follow-up,
-    // offlot-app#454) — see shared/signup-handover.ts for why the grant is
-    // verified here and rebound to the signup token instead of the client
-    // carrying it through the activation link.
+    // Cross-device try-first handover: see shared/signup-handover.ts for why the
+    // grant is verified here and rebound to the signup token instead of the
+    // client carrying it through the activation link.
     handover: z
         .object({
         entityType: z.string().min(1),
@@ -64,8 +63,8 @@ export function createSignupRequestHandler(opts) {
             // ctx.hasFeature() is fail-closed for *unregistered* names the moment
             // feature-toggles/tier-engine is wired, which silently kills
             // self-signup for every existing app that mounts auth-email-password
-            // without also composing createAuthSelfRegistrationToggleFeature()
-            // (#1468). Only gate when the toggle actually exists.
+            // without also composing createAuthSelfRegistrationToggleFeature().
+            // Only gate when the toggle actually exists.
             const gated = ctx.registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) !== undefined;
             if (gated && !(await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE))) {
                 // No email address here — this fires on every no-op request, PII