@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/LICENSE

@@ -1,57 +1,21 @@
-Business Source License 1.1
-
-Parameters
-
-Licensor:             Marc Frost
-
-Licensed Work:        @cosmicdrift/kumiko-framework
-                      The Licensed Work is © 2026 Marc Frost.
-
-Additional Use Grant: 
-You may use the Licensed Work in production for any purpose, including 
-commercially, EXCEPT for the Restricted Use. 
-
-"Restricted Use" is defined as using the Licensed Work to provide a platform 
-or service to third parties that allows them to host, deploy, or run their 
-own applications built with the Licensed Work. This includes, but is not 
-limited to: managed hosting services, software-as-a-service (SaaS) platforms, 
-platform-as-a-service (PaaS), developer platforms, or any multi-tenant 
-managed offering of the Licensed Work.
-
-This restriction does not apply to the Licensor, any entity controlled by, 
-controlling, or under common control with the Licensor ("Affiliates"), or 
-contractors acting on their behalf. The Licensor remains free to use the 
-Licensed Work for any purpose, including for the operation of kumiko.rocks.
-
-Change Date:          2030-05-05
-Change License:       Apache License, Version 2.0
-
-
-Terms
-
-The Licensor hereby grants you the right to copy, modify, create derivative works, 
-redistribute, and make non-production use of the Licensed Work. The Licensor may 
-make an Additional Use Grant, above, permitting limited production use.
-
-Effective on the Change Date, or the fourth anniversary of the first publicly 
-available distribution of the Licensed Work under this License, whichever comes 
-first, this License will convert to the Change License.
-
-This Business Source License governs use of the Licensed Work in all cases, except 
-as to any use that is explicitly granted in the Additional Use Grant above or 
-under the Change License after the Change Date.
-
-If your use of the Licensed Work does not comply with the requirements of this 
-License, you must cease use of the Licensed Work immediately.
-
-All copies of the Licensed Work, and all derivative works thereof, must include 
-this License.
-
-This License does not grant you any right, title, or interest in any trademark, 
-logo, or branding of the Licensor, except as required to comply with this License.
-
-TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN 
-“AS IS” BASIS. LICENSOR DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 
-WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, 
-TITLE, AND NON-INFRINGEMENT. IN NO EVENT WILL LICENSOR BE LIABLE FOR ANY DAMAGES 
-ARISING OUT OF OR RELATED TO THIS LICENSE OR THE USE OF THE LICENSED WORK.
+MIT License
+
+Copyright (c) 2026 Marc Frost
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/agent-tools/tool-catalog.js

@@ -68,7 +68,7 @@ function isListHandlerQn(qn, entityName) {
 function isDetailHandlerQn(qn, entityName) {
     return qn.endsWith(`:${entityName}:detail`);
 }
-/** #2700: the entity CRUD tools are enumerated off the registry, not off the manifest, so
+/** The entity CRUD tools are enumerated off the registry, not off the manifest, so
  *  `resolveAgentExposure` never runs for them. Only an EXPLICIT opt-out may hide one here —
  *  the resolver's own default is fail-closed on a missing `description`, and CRUD-generated
  *  handlers never carry one, so reusing it would delete every entity tool in every app. */

package/dist/agent-tools/tool-dispatch.d.ts

@@ -37,11 +37,11 @@ export type ToolCallRequest = {
     /** Receives the cause of unexpected (5xx) failures, which the tool result never carries. */
     readonly log?: Pick<Logger, "error">;
 };
-/** Executes one LLM-issued tool call. Never throws — a missing tool, a missing argument, a
- *  disallowed filter field, or a rejected handler call (cap check, validation, ...) all come
- *  back as `{ ok: false }` so the agent loop can feed the error back to the model instead of
- *  crashing. Client errors (< 500) keep their message and carry a `code`; 429 adds
- *  `retryable`. Server-side failures (>= 500, unknown throws) are logged and returned as a
- *  generic message so internals never reach the model. `request.user` must be the caller's real identity — every server-kind tool runs
- *  through the same permission-checked dispatcher pipeline as a normal HTTP request. */
+/** Executes one LLM-issued tool call. Never throws: every failure comes back as `{ ok: false }`
+ *  so the agent loop can feed the error back to the model instead of crashing.
+ *  Handler and dispatcher failures carry a `code` (429 adds `retryable`); client errors (< 500)
+ *  keep their message, server failures (>= 500, unknown throws) are logged and returned as a
+ *  generic message. Local validation errors (unknown tool, bad arguments) have no `code`.
+ *  `request.user` must be the caller's real identity: server-kind tools run through the same
+ *  permission-checked pipeline as an HTTP request. */
 export declare function dispatchToolCall(request: ToolCallRequest): Promise<ToolCallResult>;

package/dist/agent-tools/tool-dispatch.js

@@ -1,5 +1,5 @@
 import { isKumikoError } from "@cosmicdrift/kumiko-framework/errors";
-import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
+import { runAsAgentToolCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
@@ -274,13 +274,13 @@ function dispatchClient(descriptor, input) {
             return dispatchClientAskUser(input);
     }
 }
-/** Executes one LLM-issued tool call. Never throws — a missing tool, a missing argument, a
- *  disallowed filter field, or a rejected handler call (cap check, validation, ...) all come
- *  back as `{ ok: false }` so the agent loop can feed the error back to the model instead of
- *  crashing. Client errors (< 500) keep their message and carry a `code`; 429 adds
- *  `retryable`. Server-side failures (>= 500, unknown throws) are logged and returned as a
- *  generic message so internals never reach the model. `request.user` must be the caller's real identity — every server-kind tool runs
- *  through the same permission-checked dispatcher pipeline as a normal HTTP request. */
+/** Executes one LLM-issued tool call. Never throws: every failure comes back as `{ ok: false }`
+ *  so the agent loop can feed the error back to the model instead of crashing.
+ *  Handler and dispatcher failures carry a `code` (429 adds `retryable`); client errors (< 500)
+ *  keep their message, server failures (>= 500, unknown throws) are logged and returned as a
+ *  generic message. Local validation errors (unknown tool, bad arguments) have no `code`.
+ *  `request.user` must be the caller's real identity: server-kind tools run through the same
+ *  permission-checked pipeline as an HTTP request. */
 export async function dispatchToolCall(request) {
     const { dispatcher, user, toolName, input, dispatchTable, runId, toolCallId } = request;
     const classifyFailure = createFailureClassifier(toolName, request.log ?? fallbackLog);
@@ -289,7 +289,7 @@ export async function dispatchToolCall(request) {
         return { ok: false, error: `Unknown tool "${toolName}"` };
     }
     try {
-        return await runAsDirectCallEntry(async () => {
+        return await runAsAgentToolCallEntry(async () => {
             switch (descriptor.kind) {
                 case "search":
                     return await dispatchSearch(descriptor, dispatcher, user, toolName, input);

package/dist/audit/handlers/audit-events.js

@@ -12,7 +12,7 @@ import { redactPiiCiphertext } from "../../shared/index.js";
 import { eventLabelKeyOf, TECHNICAL_EVENT_TYPES } from "../event-classification.js";
 import { AUDIT_EVENT_ACTIONS, INCLUDE_TECHNICAL_FILTER, } from "../web/constants.js";
 const MAX_LIMIT = 100;
-// At most 18 digits keeps the id inside bigint, so an oversized cursor or id is a 422, not a 500.
+// At most 18 digits keeps the id inside bigint, so an oversized cursor or id is a validation error (400), not a 500.
 const CURSOR_PATTERN = /^\d{1,18}$/;
 export const auditListPayloadShape = {
     cursor: z.string().regex(CURSOR_PATTERN, "cursor must be a positive integer").optional(),

package/dist/audit/screens.js

@@ -85,7 +85,7 @@ export function auditLogDetailLayout(options) {
                     "id",
                 ],
             },
-            // No section `title` here (fw#2312 label-dedup fix): each section
+            // No section `title` here (label-dedup fix): each section
             // holds exactly one field, so a title would repeat the field's own
             // label (rendered by RenderField as the Field's heading) verbatim.
             { fields: [{ field: "payload", renderer: { format: "json" } }] },

package/dist/auth-email-password/feature.js

@@ -66,7 +66,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
     const strictVerification = opts.emailVerification !== undefined && (opts.emailVerification.mode ?? "strict") === "strict";
     const feature = defineFeature("auth-email-password", (r) => {
         r.describe("Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, tenant invite, and account-unlock — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`, `accountUnlock`) to `createAuthEmailPasswordFeature(opts)`. All five magic-link flows dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify/unlock) or opaque-random in Redis (signup/invite). `accountUnlock` is the self-service escape hatch for `accountLockout`'s monotonic failure-counter (#1266): confirming the mailed token clears the Redis lockout state without touching the user entity. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.");
-        // kumiko-lint-ignore i18n-ui-strings uiHints labels are feature-registry metadata for the admin feature catalog, not yet wired to the i18n system, see #2312
+        // kumiko-lint-ignore i18n-ui-strings uiHints labels are feature-registry metadata for the admin feature catalog, not yet wired to the i18n system
         r.uiHints({
             displayLabel: "Auth \u00b7 Email + Password",
             category: "identity",

package/dist/auth-email-password/handlers/change-password.write.js

@@ -42,9 +42,9 @@ export const changePasswordWrite = defineWriteHandler({
             return invalidCredentials();
         }
         const newHash = await hashPassword(event.payload.newPassword);
-        // The user aggregate is systemStream (#497): its event stream lives on
-        // SYSTEM_TENANT_ID deterministically. Pre-#497 scattered streams need the
-        // one-time backfillUserStreamTenants migration (#762).
+        // The user aggregate is systemStream: its event stream lives on
+        // SYSTEM_TENANT_ID deterministically. Previously scattered streams need the
+        // one-time backfillUserStreamTenants migration.
         const writer = createSystemUser(SYSTEM_TENANT_ID);
         // Apply via user feature's update handler — writeAs(system) satisfies
         // the privileged-only write rule on passwordHash. Pass the current version

package/dist/auth-email-password/handlers/confirm-token-flow.js

@@ -15,11 +15,11 @@
 // else — including future branches a maintainer adds — releases
 // automatically.
 //
-// The user aggregate is systemStream (#497): its event stream lives on
+// The user aggregate uses systemStream: its event stream lives on
 // SYSTEM_TENANT_ID deterministically, so the write targets exactly one
 // stream. The former membership-probing (`tryWriteAcrossTenants`) existed
-// for pre-#497 scattered streams; those need the one-time
-// backfillUserStreamTenants migration (#762) — probing them stopped working
+// for scattered streams; those need the one-time
+// backfillUserStreamTenants migration — probing them stopped working
 // the moment the executor's stream choke-point landed anyway.
 import { createSystemUser, declareEscapeHatch, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -61,8 +61,8 @@ export async function runConfirmTokenFlow(ctx, userId, expiresAtMs, spec) {
             committed = true;
             return { isSuccess: true, data: spec.successData };
         }
-        // version_conflict = concurrent modification (or an un-migrated pre-#497
-        // stream, see header) → token-level failure. Anything else (DB down,
+        // version_conflict = concurrent modification (or an un-migrated
+        // stream) → token-level failure. Anything else (DB down,
         // access denied) bubbles unchanged so ops sees the real failure class.
         if (writeRes.error.code === "version_conflict")
             return spec.invalidToken();

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -88,7 +88,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 }
                 // Password check against userTable, through the same gates
                 // login.write.ts runs (see login-gates.test.ts for the gate contracts).
-                // Email uniqueness is partial on live rows (framework#2593) — without
+                // Email uniqueness is partial on live rows — without
                 // this filter the lookup can resolve a soft-deleted row.
                 const userRow = await ctx.db.global(userTable).fetchOne({
                     email: invitationEmail,

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -1,31 +1,31 @@
-// Tenant-Invite Step 2 — Branch 1 (logged-in user accepts).
+// Tenant invitation — logged-in user accepts.
 //
-// User ist eingeloggt (in irgendeinem Tenant), klickt Accept-Link.
+// The user is signed in to some tenant and clicks the Accept link.
 // Server:
 //   1. Token → invitationId (Redis)
 //   2. Burn (single-use)
-//   3. Invitation-Row aus DB
-//   4. Email-Match: invitation.email === user.email (sonst inviteEmailMismatch)
+//   3. Load the invitation row from the database
+//   4. Email match: invitation.email === user.email (otherwise inviteEmailMismatch)
 //   5+6. grantInvitedMembershipRole: create the membership, or add the
 //      invited role to an existing one (add-only)
-//   7. Invitation-Row → status=accepted
-//   8. Redis-Keys löschen (Burn-Key bleibt für Replay-Schutz)
+//   7. Invitation row → status=accepted
+//   8. Delete Redis keys (the burn key remains for replay protection)
 //
-// Branch 1 ist der klassische "shared workspace bei eingeloggter
-// Session"-Flow. Branch 2 (anon + existing email) und Branch 3 (anon +
-// new email) kommen als separate Handler.
+// This is the classic "shared workspace with a logged-in session" flow.
+// Branch 2 (anonymous + existing email) and Branch 3 (anonymous + new
+// email) are handled separately.
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import the invite flow lives in auth-email-password (Magic-Link), while the DB-row owner is a tenant feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add (like provisionSignupAccount)
 import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
-// kumiko-lint-ignore cross-feature-import auth handler reads user-row für email-match
+// kumiko-lint-ignore cross-feature-import the auth handler reads the user row for the email match
 import { userTable } from "../../user/schema/user.js";
 import { invalidInviteToken, inviteEmailMismatch } from "../errors.js";
 import { burnInviteToken, deleteInviteToken, getInvitationIdForToken, unburnInviteToken, } from "../invite-token-store.js";
@@ -73,9 +73,9 @@ export function createInviteAcceptHandler() {
                 const invitationEmail = await decryptStoredPii(invitation.email, "email", "auth:invite-accept");
                 const invitationRole = invitation.role;
                 const invitationVersion = invitation.version;
-                // Email-Match: User muss mit der eingeladenen Email matchen.
-                // Sonst kann ein Angreifer mit Zugriff zur invitee-Mail seinen
-                // eigenen Account dem Tenant zuschlagen.
+                // Email match: the user must match the invited email.
+                // Otherwise, anyone with access to the invitee's email could add
+                // their own account to the tenant.
                 const userRow = await ctx.db.global(userTable).fetchOne({
                     id: event.user.id,
                 });
@@ -103,10 +103,10 @@ export function createInviteAcceptHandler() {
                 });
                 if (!globalGrant.isSuccess)
                     return globalGrant;
-                // Invitation-Status → accepted via event-store-executor.
-                // Tenant-scoping: ctx.db ist auf event.user.tenantId gescopt
-                // (= NICHT der invitation-tenant). Eigene TenantDb für den
-                // invitation-tenant bauen damit der executor die row findet.
+                // Invitation status → accepted via event-store-executor.
+                // Tenant scoping: ctx.db is scoped to event.user.tenantId
+                // (not the invitation tenant). Build a TenantDb for the
+                // invitation tenant so the executor can find the row.
                 const invitationTdb = createTenantDb({
                     db: dbConn,
                     tenantId: invitationTenantId,

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -11,7 +11,7 @@ export type InviteCreateData = {
     readonly expiresAt: string;
 };
 export type InviteCreateOptions = {
-    /** TTL für den Activation-Token. Default 7 Tage. */
+    /** TTL for the activation token. Default: 7 days. */
     readonly tokenTtlMinutes?: number;
     /** App page that receives the magic-link; the handler appends `?token=…`
      *  and dispatches the invite mail via delivery (ctx.notify). Apps with
@@ -25,7 +25,7 @@ export type InviteCreateOptions = {
     readonly locale?: AuthMailLocale;
     readonly canAssignRole?: (inviterRoles: readonly string[], targetRole: string) => boolean;
     /** Opt-in allow-list for app-defined (unranked) roles the elevation guard
-     *  would otherwise reject with unassignable_membership_role (fw#2398).
+     *  would otherwise reject with unassignable_membership_role.
      *  Rank-aware alternative: declare roles via EXT_ASSIGNABLE_ROLE. */
     readonly additionalAssignableRoles?: readonly string[];
 };

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -1,10 +1,10 @@
 // Tenant-Invite Step 1 (create).
 //
-// Admin invitet email → DB-Row entsteht via event-store-executor (oder
-// wird re-used bei Re-Invite), Random-Token in Redis bidirektional, und der
-// Handler schickt die Invite-Mail an den Invitee via delivery (ctx.notify) —
-// wie reset/verify/signup. Der Token geht NICHT an den Admin zurück (er soll
-// die Annahme nicht impersonieren können).
+// An admin invites an email address → a DB row is created via
+// event-store-executor (or reused for a re-invite), a random token is stored
+// bidirectionally in Redis, and the handler sends the invite email to the
+// invitee via delivery (ctx.notify), as with reset/verify/signup. The token
+// is NOT returned to the admin, so the admin cannot impersonate acceptance.
 //
 // Re-invite for the same (tenantId, email): the existing row is reused
 // regardless of its prior status (pending/cancelled/accepted), reset to
@@ -12,10 +12,10 @@
 // still live for that invitation is invalidated first, so the previous
 // mail's link stops working (see invite-token-store.ts).
 //
-// Always-200 für unbekannten User: bei invitee-Email die nicht in users
-// existiert wird trotzdem ein Invite erstellt — Branch-3-Accept-Flow
-// erlaubt new-user-signup mit dem Token. Keine Enumeration durchs
-// invite-create.
+// Always-200 for an unknown user: an invite is created even when the
+// invitee's email does not exist in users — the Branch-3-Accept-Flow
+// permits new-user-signup with the token. invite-create does not enable
+// enumeration.
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, assignableAppRolesOf, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
@@ -23,7 +23,7 @@ import { InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/erro
 import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import invite flow lives in auth-email-password (Magic-Link-Pattern); DB-row owner is the tenant feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership version read is owned by the tenant feature
 import { membershipVersionOf } from "../../tenant/invited-membership.js";

package/dist/auth-email-password/handlers/invite-info.query.js

@@ -9,7 +9,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import invite-flow lives in auth-email-password (Magic-Link), DB-row-owner belongs to the tenant feature
 import { INVITATION_STATUS, tenantInvitationsTable } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import login-style account lookup, same as invite-accept-with-login
 import { userTable } from "../../user/schema/user.js";

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -1,21 +1,21 @@
-// Tenant-Invite Step 2 — Branch 3 (anon User, Email NICHT registriert).
+// Tenant-Invite Step 2 — Branch 3 (anonymous user, email NOT registered).
 //
-// Anders als signup-confirm: KEIN neuer Tenant entsteht. Der Tenant
-// existiert schon (im invitation-row), wir legen NUR User+Membership an.
+// Unlike signup-confirm, no new tenant is created. The tenant already
+// exists in the invitation row; only the user and membership are created.
 //
 // Flow:
-//   1. User klickt Invite-Link → /invite/signup?token=...
-//   2. Frontend zeigt Password-Form (email kommt aus invitation, kein
-//      User-Input damit kein Email-Mismatch möglich)
-//   3. User submitted password + token
+//   1. User clicks the invite link → /invite/signup?token=...
+//   2. The frontend shows the password form (the email comes from the
+//      invitation, not user input, so an email mismatch is impossible)
+//   3. User submits the password and token
 //   4. Server:
 //      a. Token → invitationId → invitation row
-//      b. User-Existence-Check: invitation.email darf NICHT in userTable
-//         existieren (sonst soll Branch 2 oder Branch 1 genutzt werden)
-//      c. Create user (emailVerified=true wegen Magic-Link)
-//      d. Add membership im invited Tenant
-//      e. Invitation → accepted, Token gelöscht
-//   5. Response: SessionUser + tenantId für Auto-Login
+//      b. User-existence check: invitation.email must NOT exist in userTable
+//         (otherwise Branch 2 or Branch 1 must be used)
+//      c. Create the user (emailVerified=true because of the magic link)
+//      d. Add membership to the invited tenant
+//      e. Mark the invitation accepted and delete the token
+//   5. Response: SessionUser + tenantId for automatic login
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles, createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -25,7 +25,7 @@ import { decryptStoredPii, registrationLocaleFromRequest } from "../../shared/in
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
 import { findForbiddenMembershipRole, reservedMembershipRoleError, } from "../../tenant/membership-roles.js";
-// kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
+// kumiko-lint-ignore cross-feature-import membership-seed-helper for privileged cross-tenant addition
 import { seedTenantMembership } from "../../tenant/seeding.js";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.js";
@@ -74,20 +74,19 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                 const invitationRole = invitation.role;
                 const invitationGlobalRoles = parseInvitedGlobalRoles(invitation.globalRoles);
                 const invitationVersion = invitation.version;
-                // User-Not-Exists-Check: wenn die Email schon registriert ist,
-                // muss der User Branch 2 (acceptWithLogin) nutzen. Hier ist
-                // explizit "neue Email" — sonst hätten wir zwei Wege ein
-                // Password zu setzen für denselben User.
-                // Email uniqueness is partial on live rows (framework#2593) — without
-                // this filter the lookup can resolve a soft-deleted row.
+                // If the email is already registered, the user must use Branch 2
+                // (acceptWithLogin). This flow explicitly requires a new email;
+                // otherwise there would be two ways to set a password for the same user.
+                // Email uniqueness is partial on live rows — without this filter,
+                // the lookup can resolve a soft-deleted row.
                 const existingUser = await ctx.db.global(userTable).fetchOne({
                     email: invitationEmail,
                     isDeleted: false,
                 });
                 if (existingUser)
                     return invalidInviteToken();
-                // User anlegen via seedUserWithPassword (gleiches Pattern wie
-                // signup-confirm), emailVerified=true wegen Magic-Link.
+                // Create the user through seedUserWithPassword so the magic-link flow
+                // records emailVerified=true.
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
                 const dbConn = ctx.db.unsafeRaw();
@@ -100,9 +99,8 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                     ...registrationLocale,
                     ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
                 });
-                // Membership-Add via seed-helper (gleiches Pattern wie
-                // provisionSignupAccount — bypassed addMember access-check
-                // weil createSystemUser nicht ["SystemAdmin"] matcht).
+                // The seed helper bypasses addMember's access check because
+                // createSystemUser does not match ["SystemAdmin"].
                 const forbiddenInviteRole = findForbiddenMembershipRole([invitationRole]);
                 if (forbiddenInviteRole !== undefined) {
                     return writeFailure(reservedMembershipRoleError(forbiddenInviteRole));
@@ -112,7 +110,7 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                     tenantId: invitationTenantId,
                     roles: [invitationRole],
                 });
-                // Invitation → accepted: TenantDb für invitation-tenant
+                // Update the invitation in the invited tenant's database context.
                 const invitationTdb = createTenantDb({
                     db: dbConn,
                     tenantId: invitationTenantId,

package/dist/auth-email-password/handlers/login.write.d.ts

@@ -45,7 +45,7 @@ type GateOutcome<T> = GateReject | GateOk<T>;
 type AuthenticatableUserRow = AuthUserRow & {
     readonly passwordHash: string;
 };
-/** Uniform response on any credential miss — burns argon2 cost (#774). */
+/** Uniform response on any credential miss — burns argon2 cost. */
 export declare function gateResolveAuthUser(found: AuthUserRow | null, password: string): Promise<GateOutcome<AuthenticatableUserRow>>;
 export declare function gateCountUnknownUser(ctx: HandlerContext, email: string, maxFailedAttempts: number, lockoutDurationMinutes: number): Promise<GateOutcome<undefined>>;
 /**

package/dist/auth-email-password/handlers/login.write.js

@@ -14,7 +14,7 @@ function reject(result) {
 function ok(value) {
     return { ok: true, value };
 }
-/** Uniform response on any credential miss — burns argon2 cost (#774). */
+/** Uniform response on any credential miss — burns argon2 cost. */
 export async function gateResolveAuthUser(found, password) {
     if (!found?.passwordHash || found.isDeleted) {
         await verifyDummyPassword(password);

package/dist/auth-email-password/handlers/self-registration-status.query.js

@@ -16,7 +16,7 @@ export const selfRegistrationStatusQuery = defineQueryHandler({
     rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     description: "Reports whether self-registration is currently switched on, readable without signing in, so a signup page can hide its own form instead of collecting an address that would be silently ignored.",
     handler: async (_query, ctx) => {
-        // Same fail-open reasoning as signup-request.write.ts (#1468): only
+        // Same fail-open reasoning as signup-request.write.ts: only
         // report disabled when the toggle feature is actually composed.
         const gated = ctx.registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) !== undefined;
         return { enabled: gated ? await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE) : true };