@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.387.0

package/dist/shared/parent-visibility.js

@@ -60,14 +60,14 @@ export async function hostRowIsGone(registry, entityType, entityId, db) {
     const row = await db.fetchOne(table, { id: entityId });
     return row === undefined || row["isDeleted"] === true;
 }
-// Write-path half of the parentRef gate (fw#2766). Resolves the join entity's
+// Write-path half of the parentRef gate. Resolves the join entity's
 // own `parentRef` declaration from the registry — the same object the read
 // path's SQL gate reads — so the field names and the allowedTypes allowlist
 // exist in exactly one place instead of once per path.
 export async function joinRowParentIsVisible(registry, joinEntityName, payload, user, db) {
     const parentRef = registry.getEntity(joinEntityName)?.parentRef;
     // A mount whose join entity lost its declaration can't derive a gate —
-    // deny rather than silently fall back to the pre-#2766 open behaviour.
+    // deny rather than silently fall back to the open behaviour.
     if (parentRef === undefined)
         return false;
     const entityType = payload[parentRef.entityTypeField];

package/dist/shared/password-hashing.js

@@ -40,7 +40,7 @@ export async function verifyPassword(hashString, password) {
         return false;
     }
 }
-// Anti-enumeration timing equaliser (#774). The login handler runs this on
+// Anti-enumeration timing equaliser. The login handler runs this on
 // the no-user / no-hash path so a missing account costs the same argon2
 // latency as a real verify — otherwise response timing leaks whether an
 // email is registered. Derived from hashPassword once and cached, so it

package/dist/shared/signup-handover.js

@@ -1,5 +1,4 @@
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): signup-request runs in whichever browser the activation
+// Cross-device try-first handover: signup-request runs in whichever browser the activation
 // link ends up opened in, which may not be the one holding the anonymous
 // visitor's tenant-handover grant. This extension point lets
 // auth-email-password bind a verified grant to the signup token server-side

package/dist/shared/single-use-token-store.js

@@ -25,7 +25,7 @@
 //
 // Every key is derived from sha256(token), never the raw token — Redis key
 // names, MONITOR output, replica traffic, and memory/backup dumps never
-// carry the bearer secret in the clear (#2174). The by-subject entry stores
+// carry the bearer secret in the clear. The by-subject entry stores
 // the *hash* of the live token, not the token itself, so it can only be
 // used to invalidate (delete the matching forward entry) — never to
 // recover or resend the original token. A resend therefore always mints a

package/dist/subscription-mollie/constants.js

@@ -1,31 +1,29 @@
 // Feature name
 export const SUBSCRIPTION_MOLLIE_FEATURE = "subscription-mollie";
-// entityName under den der Plugin gegen "subscriptionProvider"
-// registriert. Matcht den path-segment in der webhook-URL
+// Entity name under which the plugin registers against
+// "subscriptionProvider". Matches the path segment in the webhook URL
 // `/api/subscription/webhook/mollie`.
 export const MOLLIE_PROVIDER_NAME = "mollie";
 // =============================================================================
-// Mollie-Webhook-Pattern (anders als Stripe!)
+// Mollie webhook pattern (unlike Stripe)
 // =============================================================================
 //
-// Mollie sendet bei JEDEM event nur die ID im body (form-urlencoded
-// oder JSON). Plugin muss IMMER lazy-fetchen via Mollie-API:
-//   - `id=tr_xxx`  → payment-id, fetch payment + subscription
-//   - `id=sub_xxx` → subscription-id, fetch subscription direkt
+// Mollie sends only the ID in the body for EVERY event (form-urlencoded
+// or JSON). The plugin must ALWAYS fetch lazily via the Mollie API:
+//   - `id=tr_xxx`  → payment ID, fetch payment + subscription
+//   - `id=sub_xxx` → subscription ID, fetch subscription directly
 //
-// **Keine native HMAC-sig-verify** in Mollie-SDK 4.5.0. Mollie's
-// Sicherheits-Modell stützt sich auf nicht-guessable IDs (~10^25
-// brute-force-space) + API-Lookup-Validation (garbage-id → 401 von
-// Mollie-API). Plus: App-Builder kann zusätzlich einen URL-Token-
-// Wrapper vor die Foundation-route schalten (eigener extraRoute der
-// einen secret-token im URL-Pfad verifiziert + dann an die Foundation
-// weiterreicht).
+// **No native HMAC signature verification** in Mollie SDK 4.5.0. Mollie's
+// security model relies on non-guessable IDs (~10^25 brute-force space)
+// plus API lookup validation (garbage ID → 401 from the Mollie API). In
+// addition, the app builder can place a URL-token wrapper before the
+// foundation route (a custom extraRoute that verifies a secret token in
+// the URL path and then forwards to the foundation).
 //
-// **Event-Type-Mapping** ist heuristisch — Mollie hat keine explicit-
-// typed events:
+// **Event type mapping** is heuristic—Mollie has no explicitly typed events:
 //   - sub_xxx + status=canceled/completed     → SubscriptionEventTypes.canceled
 //   - sub_xxx + status=active/pending         → SubscriptionEventTypes.updated
 //   - tr_xxx + sequenceType=first + paid      → SubscriptionEventTypes.created
 //   - tr_xxx + sequenceType=recurring + paid  → SubscriptionEventTypes.invoicePaid
 //   - tr_xxx + sequenceType=recurring + failed → SubscriptionEventTypes.invoicePaymentFailed
-//   - alles andere                            → null (foundation 200 ignored)
+//   - everything else                         → null (foundation 200 ignored)

package/dist/subscription-mollie/feature.d.ts

@@ -11,29 +11,28 @@ export declare const subscriptionMollieEnvSchema: z.ZodObject<{
     MOLLIE_API_KEY: z.ZodString;
 }, z.core.$strip>;
 export type SubscriptionMollieOptions = {
-    /** Mollie-API-key (`test_...` oder `live_...`). App-wide, beim Plugin-
-     *  mount aus process.env oder system-config. */
+    /** Mollie API key (`test_...` or `live_...`). App-wide, mounted from
+     *  process.env or system configuration. */
     readonly apiKey: string;
-    /** Foundation-webhook-URL die der App-Builder unter Mollie-Dashboard
-     *  als webhook eingetragen hat. Plugin reicht das beim payment-
-     *  create an Mollie weiter — Mollie sendet beim payment-event
-     *  webhooks an diese URL. Typisch:
+    /** Foundation webhook URL registered by the app builder in the Mollie
+     *  dashboard. The plugin passes it to Mollie when creating a payment;
+     *  Mollie sends payment-event webhooks to this URL. Typically:
      *  `https://app.example.com/api/subscription/webhook/mollie`. */
     readonly webhookUrl: string;
-    /** Price-to-tier-Map. Plugin liest die priceId aus dem subscription-
-     *  metadata (= `metadata.priceId` den der App-Builder beim
-     *  createCheckoutSession setzt) und mappt auf einen tier-name. */
+    /** Price-to-tier map. The plugin reads the priceId from the subscription
+     *  metadata (= `metadata.priceId` set by the app builder when calling
+     *  createCheckoutSession) and maps it to a tier name. */
     readonly priceToTier: Readonly<Record<string, string>>;
-    /** Mollie-Subscription-Setup pro priceId. Mollie hat keinen nativen
-     *  price-id-Konzept — App-Builder muss pro virtuellem priceId einen
-     *  amount/interval/description bereitstellen. */
+    /** Mollie subscription setup per priceId. Mollie has no native price-ID
+     *  concept, so the app builder must provide an amount/interval/description
+     *  for each virtual priceId. */
     readonly priceToConfig: Readonly<Record<string, MolliePriceConfig>>;
-    /** @internal Test-only injection-port: ersetzt den verify-webhook-
-     *  fetch-client durch eine Mock-instance. Production left undefined —
-     *  factory baut den Adapter aus `createMollieClient(apiKey)`. Wird
-     *  vom IT (mollie-foundation.integration.ts) genutzt damit der echte
-     *  factory-Code (drift-validation, plugin-registration) im Test-pfad
-     *  durchläuft, ohne dass Mollie-API-Calls passieren. */
+    /** @internal Test-only injection port: replaces the verify-webhook fetch
+     *  client with a mock instance. Production leaves this undefined; the
+     *  factory builds the adapter from `createMollieClient(apiKey)`. The
+     *  integration test (mollie-foundation.integration.ts) uses it so the real
+     *  factory code (drift validation, plugin registration) runs in the test
+     *  path without making Mollie API calls. */
     readonly _clientShapeForTests?: MollieClientShape;
 };
 export declare function createSubscriptionMollieFeature(options: SubscriptionMollieOptions): FeatureDefinition;

package/dist/subscription-mollie/feature.js

@@ -1,26 +1,26 @@
 // kumiko-feature-version: 1
 //
-// subscription-mollie — Mollie-Plugin für die subscription-foundation
-// Plugin-API (EU-Compliance-Story für DACH-Mid-Market).
+// subscription-mollie — Mollie plugin for subscription-foundation
+// plugin API (EU compliance for the DACH mid-market).
 //
-// **Factory-Pattern (analog subscription-stripe):** liest API-key beim
-// mount-time aus den factory-options (typisch process.env aus dem App-
-// Builder-bin/server.ts). Mollie hat KEIN webhook-secret — Mollie-SDK
-// 4.5.0 bietet keine native HMAC-sig-verify-API. Sicherheit kommt aus
-// nicht-guessable IDs + API-Validation; App-Builder kann optional
-// einen URL-Token-Wrapper davor schalten.
+// **Factory pattern (analogous to subscription-stripe):** reads the API key
+// at mount time from the factory options (typically process.env from the app
+// builder's bin/server.ts). Mollie has NO webhook secret — Mollie SDK
+// 4.5.0 provides no native HMAC signature verification API. Security comes
+// from non-guessable IDs + API validation; the app builder can optionally
+// add a URL-token wrapper in front.
 //
-// **Phase-5.3-Scope:**
+// **Scope:**
 //   - verifyAndParseWebhook ✓ (lazy-fetch payment + subscription via
-//     Mollie-API, heuristisches event-type-mapping)
-//   - createCheckoutSession ✓ (Mollie's mehrstufiger flow: customer
-//     anlegen + first-payment mit sequenceType="first" → redirectUrl)
-//   - createPortalSession ✗ (Mollie hat keinen Customer-Portal)
-//   - cancelSubscription ✗ (Mollie braucht customerId zusätzlich zur
-//     subId; Plugin-Contract reicht's nicht durch — App-Builder cancelt
-//     via Mollie-Dashboard oder custom-route)
+//     Mollie API, heuristic event-type mapping)
+//   - createCheckoutSession ✓ (Mollie's multistep flow: create customer
+//     + first payment with sequenceType="first" → redirectUrl)
+//   - createPortalSession ✗ (Mollie has no customer portal)
+//   - cancelSubscription ✗ (Mollie additionally requires customerId besides
+//     subId; the plugin contract does not pass it through — the app builder
+//     cancels via the Mollie dashboard or a custom route)
 //
-// **Beispiel-Verwendung in run-config.ts:**
+// **Example usage in run-config.ts:**
 //
 //   const features = [
 //     billingFoundationFeature,
@@ -64,8 +64,8 @@ export function createSubscriptionMollieFeature(options) {
     if (options.webhookUrl.length === 0) {
         throw new Error("subscription-mollie: webhookUrl is empty. Set the foundation-webhook-URL where Mollie sends events.");
     }
-    // Drift-Guard: priceToTier + priceToConfig müssen identische Keys
-    // haben — sonst silent-null-returns aus verifyAndParseWebhook.
+    // Drift guard: priceToTier and priceToConfig must have identical keys;
+    // otherwise verifyAndParseWebhook silently returns null.
     const tierKeys = new Set(Object.keys(options.priceToTier));
     const configKeys = new Set(Object.keys(options.priceToConfig));
     const missingInConfig = [...tierKeys].filter((k) => !configKeys.has(k));
@@ -76,9 +76,9 @@ export function createSubscriptionMollieFeature(options) {
             `priceIds in config but missing tier: [${missingInTier.join(", ")}]`);
     }
     const client = createMollieClient({ apiKey: options.apiKey });
-    // Adapter um den Plugin's verify-fetch-client an den vollen Mollie-
-    // Client zu binden. Plugin-fetch-API ist minimal damit Tests ohne
-    // den vollen MollieClient mocken können.
+    // Adapter that binds the plugin's minimal fetch client to the full Mollie
+    // client. The minimal plugin fetch API lets tests mock it without mocking
+    // the full MollieClient.
     const fetchAdapter = options._clientShapeForTests ?? {
         payments: { get: (id) => client.payments.get(id) },
         customerSubscriptions: {
@@ -107,8 +107,8 @@ export function createSubscriptionMollieFeature(options) {
         const plugin = {
             verifyAndParseWebhook: verifyAndParse,
             createCheckoutSession: checkoutSession,
-            // createPortalSession + cancelSubscription bewusst nicht — siehe
-            // plugin-methods.ts für Begründung.
+            // createPortalSession and cancelSubscription are intentionally omitted;
+            // see plugin-methods.ts for why.
             priceToTier: options.priceToTier,
         };
         r.useExtension("subscriptionProvider", MOLLIE_PROVIDER_NAME, plugin);

package/dist/subscription-mollie/index.js

@@ -1,8 +1,8 @@
 // Public API of the subscription-mollie bundled-feature.
 //
-// **Internal-only** (NICHT im public-barrel — App-Builder nutzt das nie direkt):
-//   - verifyAndParseMollieWebhook (intern vom feature.ts factory aufgerufen)
+// **Internal-only** (not in the public barrel—the App Builder never uses it directly):
+//   - verifyAndParseMollieWebhook (called internally by the feature.ts factory)
 //   - mapMollieEventType / mapMollieStatus / extractMollieId (pure helpers,
-//     test-only — direct-import aus dem File wenn echt mal extern gebraucht)
+//     test-only—direct-import from the file if ever genuinely needed externally)
 export { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.js";
 export { createSubscriptionMollieFeature, subscriptionMollieEnvSchema, } from "./feature.js";

package/dist/subscription-mollie/plugin-methods.d.ts

@@ -2,8 +2,8 @@ import type { SubscriptionProviderPlugin } from "@cosmicdrift/kumiko-bundled-fea
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import type { MollieClient } from "@mollie/api-client";
 export type MollieCheckoutOptions = Parameters<NonNullable<SubscriptionProviderPlugin["createCheckoutSession"]>>[1];
-/** Mollie hat keinen nativen price-id-Konzept — App-Builder pflegt
- *  pro virtuellem priceId einen amount/interval/description. */
+/** Mollie has no native price ID concept; the App Builder maintains
+ *  an amount/interval/description for each virtual priceId. */
 export type MolliePriceConfig = {
     /** Mollie-format: 2-decimal string, z.B. `"9.99"`. */
     readonly amountValue: string;

package/dist/subscription-mollie/plugin-methods.js

@@ -1,17 +1,18 @@
-// Mollie-Plugin-Methoden für die POST-tenant-resolution-Phase:
-// createCheckoutSession (only). createPortalSession + cancelSubscription
-// nicht implementiert weil Mollie's API die Patterns nicht 1:1 bietet:
+// Mollie plugin methods for the POST-tenant-resolution phase:
+// createCheckoutSession only. createPortalSession and cancelSubscription
+// are not implemented because Mollie's API does not provide these patterns
+// 1:1:
 //
-// - **Portal:** Mollie hat keinen Customer-Portal — App-Builder UI muss
-//   das selbst rendern.
-// - **Cancel:** Mollie braucht (customerId, subId), Plugin-Contract
-//   reicht aber nur subId durch — App-Builder cancelt via Mollie-
-//   Dashboard oder eigener Route bis Foundation-Contract erweitert ist.
+// - **Portal:** Mollie has no customer portal, so the App Builder UI must
+//   render it itself.
+// - **Cancel:** Mollie requires (customerId, subId), but the plugin contract
+//   passes through only subId. The App Builder cancels through the Mollie
+//   dashboard or a custom route until the Foundation contract is extended.
 //
-// **Mollie-Checkout-Flow ist mehrstufig:** Customer anlegen → first-
-// payment mit sequenceType="first" (= Mandate-setup) → User bezahlt →
-// Mollie-webhook → verify-webhook erstellt die Mollie-Subscription
-// idempotent (siehe verify-webhook.ts ensureSubscriptionForMandate).
+// **The Mollie checkout flow has multiple steps:** create customer → first
+// payment with sequenceType="first" (= mandate setup) → user pays →
+// Mollie webhook → verify-webhook creates the Mollie subscription
+// idempotently (see verify-webhook.ts ensureSubscriptionForMandate).
 import { SequenceType } from "@mollie/api-client";
 export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl) {
     return async (_ctx, options) => {
@@ -36,8 +37,8 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
         // sequenceType "first", so verifyAndParseMollieWebhook drops them before
         // any mandate/subscription handling.
         const sequenceType = options.mode === "payment" ? SequenceType.oneoff : SequenceType.first;
-        // payments.create ist overloaded (Promise OR void mit callback);
-        // explicit cast auf Promise<Payment>-overload.
+        // payments.create is overloaded (Promise or void with a callback);
+        // explicitly cast to the Promise<Payment> overload.
         const payment = (await client.payments.create({
             amount: { currency: priceCfg.amountCurrency, value: priceCfg.amountValue },
             description: priceCfg.description,

package/dist/subscription-mollie/verify-webhook.d.ts

@@ -1,9 +1,9 @@
 import { type SubscriptionEvent, type SubscriptionEventType, type SubscriptionStatus } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import type { Payment as MolliePayment, Subscription as MollieSubscription } from "@mollie/api-client";
 import type { MolliePriceConfig } from "./plugin-methods.ts";
-/** Minimal-Subset des Mollie-Clients, das der Plugin nutzt — separat
- *  damit Tests ohne den vollen MollieClient mocken können. Adapter in
- *  feature.ts bridged das gegen den echten SDK. */
+/** Minimal subset of the Mollie client used by the plugin — kept separate
+ *  so tests can mock it without the full MollieClient. The adapter in
+ *  feature.ts bridges it to the real SDK. */
 export type MollieClientShape = {
     readonly payments: {
         readonly get: (id: string) => Promise<MolliePayment>;
@@ -23,18 +23,18 @@ export type MollieClientShape = {
     };
 };
 export type MollieWebhookOptions = {
-    /** priceId (= virtueller Schlüssel aus subscription.metadata) → tier-name. */
+    /** priceId (= virtual key from subscription.metadata) → tier name. */
     readonly priceToTier: Readonly<Record<string, string>>;
-    /** priceId → amount/interval/description. Wird beim mandate-setup-
-     *  flow zum `customerSubscriptions.create`-Call gebraucht. App-
-     *  Builder pflegt die Map einmal in den factory-options. */
+    /** priceId → amount/interval/description. Needed for the mandate-setup
+     *  flow's `customerSubscriptions.create` call. The app builder maintains
+     *  this map once in the factory options. */
     readonly priceToConfig: Readonly<Record<string, MolliePriceConfig>>;
 };
 export declare function verifyAndParseMollieWebhook(client: MollieClientShape, options: MollieWebhookOptions): (rawBody: string, headers: Record<string, string>) => Promise<SubscriptionEvent | null>;
-/** Extract `id` aus rawBody — handelt form-urlencoded + JSON. */
+/** Extracts `id` from rawBody — supports form-urlencoded and JSON. */
 export declare function extractMollieId(rawBody: string, headers: Record<string, string>): string | null;
-/** Mollie-subscription + optional payment → SubscriptionEventType.
- *  Heuristik (Mollie hat keine explicit-typed events). */
+/** Mollie subscription + optional payment → SubscriptionEventType.
+ *  Heuristic because Mollie has no explicitly typed events. */
 export declare function mapMollieEventType(subscription: MollieSubscription, triggerPayment: MolliePayment | null): SubscriptionEventType | null;
 /** Mollie-status → normalized. */
 export declare function mapMollieStatus(mollieStatus: MollieSubscription["status"]): SubscriptionStatus;

package/dist/subscription-mollie/verify-webhook.js

@@ -1,18 +1,18 @@
-// verifyAndParseMollieWebhook — Mollie-spezifische lazy-fetch +
-// event-type-Heuristik. Wird vom Plugin-Build (feature.ts) als
-// `verifyAndParseWebhook` registriert.
+// verifyAndParseMollieWebhook: Mollie-specific lazy fetch plus event-type
+// heuristic. The plugin build (feature.ts) registers it as
+// `verifyAndParseWebhook`.
 //
-// Mollie's classic-webhook sendet nur eine `id` (form-urlencoded oder
-// JSON). Wir lazy-fetchen payment + subscription via Mollie-API. Sub-
-// xxx-events werden NICHT supported — App-Builder bekommt sie indirekt
-// via tr_xxx-payment-events (Mollie sendet beide parallel bei normalen
-// Lifecycle-Events).
+// Mollie's classic webhook sends only an `id` (form-urlencoded or JSON), so
+// the payment and subscription are lazily fetched through the Mollie API.
+// sub_xxx events are NOT supported; app builders get them indirectly through
+// tr_xxx payment events (Mollie sends both in parallel for normal lifecycle
+// events).
 //
-// **Mandate-setup-flow:** first-payment-paid kommt mit
-// `payment.subscriptionId === null` (Mollie's Pattern: App-Builder
-// muss `customerSubscriptions.create` selbst aufrufen). Wir machen
-// das im Plugin (idempotent via list-check), damit Foundation einen
-// Created-Event mit subscription-id bekommt.
+// **Mandate setup flow:** the first paid payment arrives with
+// `payment.subscriptionId === null` (Mollie's pattern: the app builder must
+// call `customerSubscriptions.create` itself). The plugin does that
+// (idempotent via a list check) so the foundation receives a created event
+// with a subscription id.
 import { parseProviderConsentId, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -53,7 +53,7 @@ export function verifyAndParseMollieWebhook(client, options) {
                     return null;
             }
             else {
-                // One-shot oder first-payment-failed → nicht unsere Domain.
+                // One-shot or first-payment-failed events are outside our domain.
                 return null;
             }
         }
@@ -80,8 +80,8 @@ export function verifyAndParseMollieWebhook(client, options) {
         const status = mapMollieStatus(subscription.status);
         const periodEndSource = subscription.nextPaymentDate ?? subscription.startDate;
         if (!periodEndSource) {
-            // Mollie-API-Drift: valid Subs haben mindestens startDate. Loud-
-            // fail damit App-Owner's monitoring den drift sieht.
+            // Mollie API drift: valid subscriptions have at least startDate. Fail
+            // loudly so the app owner's monitoring can detect the drift.
             throw new Error(`subscription-mollie: subscription ${subscription.id} has neither nextPaymentDate nor startDate`);
         }
         const currentPeriodEnd = mollieDateStringToInstantIso(periodEndSource);
@@ -103,9 +103,9 @@ export function verifyAndParseMollieWebhook(client, options) {
 // =============================================================================
 // Mandate-setup: subscription on-the-fly erstellen
 // =============================================================================
-/** first-payment-paid OHNE subscriptionId → Mollie-Sub erstellen.
- *  Idempotent via list-check (replay-safe). Returns null bei
- *  unvollständiger metadata oder unbekanntem priceId. */
+/** `first-payment-paid` without subscriptionId → create a Mollie subscription.
+ *  Idempotent via a list check (replay-safe). Returns null for incomplete
+ *  metadata or an unknown priceId. */
 async function ensureSubscriptionForMandate(client, options, payment) {
     const customerId = payment.customerId;
     if (!customerId)
@@ -136,9 +136,9 @@ async function ensureSubscriptionForMandate(client, options, payment) {
     });
 }
 // =============================================================================
-// Helpers (exported für Tests)
+// Helpers (exported for tests)
 // =============================================================================
-/** Extract `id` aus rawBody — handelt form-urlencoded + JSON. */
+/** Extracts `id` from rawBody — supports form-urlencoded and JSON. */
 export function extractMollieId(rawBody, headers) {
     const contentType = headers["content-type"] ?? "";
     if (contentType.includes("application/json")) {
@@ -156,8 +156,8 @@ export function extractMollieId(rawBody, headers) {
     const params = new URLSearchParams(rawBody);
     return params.get("id");
 }
-/** Mollie-subscription + optional payment → SubscriptionEventType.
- *  Heuristik (Mollie hat keine explicit-typed events). */
+/** Mollie subscription + optional payment → SubscriptionEventType.
+ *  Heuristic because Mollie has no explicitly typed events. */
 export function mapMollieEventType(subscription, triggerPayment) {
     if (subscription.status === "canceled" || subscription.status === "completed") {
         return SubscriptionEventTypes.canceled;
@@ -184,10 +184,10 @@ export function mapMollieStatus(mollieStatus) {
             return SubscriptionStatuses.active;
         case "canceled":
         case "completed":
-            // completed = alle `times`-charges durchgelaufen → wie canceled.
+            // completed = all `times` charges have run → treat it like canceled.
             return SubscriptionStatuses.canceled;
         case "suspended":
-            // Mandate ungültig / payment-method failed → grace-period.
+            // Invalid mandate / payment method failed → grace period.
             return SubscriptionStatuses.pastDue;
         case "pending":
             return SubscriptionStatuses.incomplete;
@@ -195,8 +195,8 @@ export function mapMollieStatus(mollieStatus) {
             return SubscriptionStatuses.incomplete;
     }
 }
-/** Mollie liefert dates als YYYY-MM-DD; foundation will ISO-Instant.
- *  Throws bei malformed input (= Mollie-API-Drift, soll loud-fail). */
+/** Mollie provides dates as YYYY-MM-DD; Foundation requires an ISO Instant.
+ *  Throws on malformed input (= Mollie API drift, which should fail loudly). */
 function mollieDateStringToInstantIso(dateString) {
     return Temporal.Instant.from(`${dateString.slice(0, 10)}T00:00:00Z`).toString();
 }

package/dist/subscription-stripe/constants.js

@@ -1,7 +1,7 @@
 // Feature name
 export const SUBSCRIPTION_STRIPE_FEATURE = "subscription-stripe";
-// entityName under den der Plugin gegen "subscriptionProvider"
-// registriert. Matcht den path-segment in der webhook-URL
+// entityName under which the plugin registers itself as
+// "subscriptionProvider". It must match the path segment in the webhook URL
 // `/api/subscription/webhook/stripe`.
 export const STRIPE_PROVIDER_NAME = "stripe";
 // Config-key short-names, qualified to `subscription-stripe:config:<name>`
@@ -11,10 +11,8 @@ export const STRIPE_PROVIDER_NAME = "stripe";
 export const STRIPE_API_KEY_CONFIG = "api-key";
 export const STRIPE_WEBHOOK_SECRET_CONFIG = "webhook-secret";
 export const STRIPE_BILLING_LIVE_CONFIG = "billingLive";
-// =============================================================================
-// Stripe-event-types die wir auf normalisierte SubscriptionEventTypes
-// mappen. Stripe hat ~80 event-types insgesamt; wir filtern auf 5.
-// =============================================================================
+// Stripe event types that map to normalized SubscriptionEventTypes.
+// Stripe has approximately 80 event types; we filter to five.
 export const StripeEventTypes = {
     customerSubscriptionCreated: "customer.subscription.created",
     customerSubscriptionUpdated: "customer.subscription.updated",

package/dist/subscription-stripe/feature.d.ts

@@ -28,17 +28,17 @@ export declare function stripeEnvSchema<const TPrice extends string>(options: {
     STRIPE_API_KEY: z.ZodOptional<z.ZodString>;
 } & StripePriceEnvShape<TPrice> extends infer T ? { -readonly [P in keyof T]: T[P]; } : never, z.core.$strip>;
 export type SubscriptionStripeOptions = {
-    /** Bridge-fallback webhook-secret. Optional: v2 liest aus dem
-     *  `subscription-stripe:config:webhook-secret`-Key (backing:"secrets").
-     *  Gesetzt nur während der env→secrets-Übergangsphase / in Tests. */
+    /** Bridge-fallback webhook secret. Optional: v2 reads from the
+     *  `subscription-stripe:config:webhook-secret` key (backing:"secrets").
+     *  Set only during the env→secrets transition phase / in tests. */
     readonly webhookSecret?: string;
-    /** Bridge-fallback api-key. Optional: v2 liest aus dem
-     *  `subscription-stripe:config:api-key`-Key (backing:"secrets"). */
+    /** Bridge-fallback API key. Optional: v2 reads from the
+     *  `subscription-stripe:config:api-key` key (backing:"secrets"). */
     readonly apiKey?: string;
-    /** Price-to-tier-Mapping. Plugin liest die price-id aus dem Stripe-event
-     *  (subscription.items.data[0].price.id) und mappt auf einen tier-name.
-     *  App-spezifisch → bleibt factory-option. Fehlt die price-id im Mapping
-     *  → null (event ignored). */
+    /** Price-to-tier mapping. The plugin reads the price ID from the Stripe
+     *  event (subscription.items.data[0].price.id) and maps it to a tier name.
+     *  App-specific, so it remains a factory option. If the price ID is absent
+     *  from the mapping → null (event ignored). */
     readonly priceToTier?: Readonly<Record<string, string>>;
     /** Whether a mode:"payment" checkout (one-off top-ups etc.) gets a Stripe
      *  invoice — a receipt/invoice document Stripe generates and sends to the
@@ -56,11 +56,11 @@ export type SubscriptionStripeOptions = {
     readonly oneOffPriceIds?: readonly string[];
 };
 /**
- * Factory für das subscription-stripe-feature. Mountet IMMER (kein
- * key-presence-Guard mehr) — die Aktivität wird runtime über config/secrets
- * gegatet (Muster wie feature-toggles). Der returnte FeatureDefinition
- * registriert den Plugin gegen billing-foundation's "subscriptionProvider"-
- * extension unter entityName "stripe".
+ * Factory for the subscription-stripe feature. Always mounts (no
+ * key-presence guard) — activity is gated at runtime through config/secrets
+ * (following the feature-toggles pattern). The returned FeatureDefinition
+ * registers the plugin under billing-foundation's "subscriptionProvider"
+ * extension with entityName "stripe".
  */
 export declare function createSubscriptionStripeFeature(options?: SubscriptionStripeOptions): FeatureWithEnvSchema<FeatureDefinition, typeof subscriptionStripeEnvSchema.shape>;
 export {};