@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -1,23 +1,22 @@
-// Magic-Link-Signup, Step 2 (confirm).
+// Magic-Link signup, step 2 (confirmation).
 //
-// Token aus URL + Password vom User → wir lösen den Token in Redis ein
-// und legen Tenant + User + TenantAdmin membership atomically. emailVerified
-// wird sofort auf true gesetzt — der Magic-Link IST der Beweis.
+// Token from the URL + password from the user → redeem the token in Redis
+// and atomically create the tenant, user, and TenantAdmin membership.
+// emailVerified is set to true immediately—the magic link IS the proof.
 //
 // Pipeline:
 //   1. Redis check: token → email lookup
-//   2. Single-Use-Burn (SETNX) — gleichzeitiger Klick aus zwei Tabs
-//      gewinnt nur einer
-//   3. Tenant-Key generieren (generateUniqueName mit DB-isAvailable-
-//      check gegen tenants.key)
-//   4. provisionSignupAccount: Tenant + User + Membership in einem
-//      Rutsch (durch event-store-executor; events + projection +
-//      MSPs sehen das wie einen regulären create)
-//   5. Token-Keys löschen (burn-key bleibt für TTL-Replay-Protection)
+//   2. Single-use burn (SETNX)—only one of two simultaneous tab clicks wins
+//   3. Generate the tenant key (generateUniqueName with a DB isAvailable
+//      check against tenants.key)
+//   4. provisionSignupAccount: create the tenant, user, and membership in one
+//      operation (through event-store-executor; events, projection, and MSPs
+//      see this as a regular create)
+//   5. Delete the token keys (the burn key remains for TTL replay protection)
 //
-// Failure-Recovery: jeder Pfad nach dem burn checked `committed`-Flag;
-// bei !committed wird der burn released damit ein legitimer Retry
-// nicht durch einen stale Marker geblockt wird (wie reset/verify).
+// Failure recovery: every path after the burn checks the `committed` flag;
+// when !committed, the burn is released so a legitimate retry is not blocked
+// by a stale marker, as with reset/verify.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, InternalError, reraiseAsKumikoError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
@@ -87,21 +86,21 @@ export function createSignupConfirmHandler(opts = {}) {
                     message: "signup-confirm requires ctx.redis for token consumption",
                 }));
             }
-            // Token-Lookup: nicht-existent / abgelaufen / schon konsumiert →
-            // alle collapsen auf invalid_signup_token. Anti-enumeration.
+            // Token lookup: nonexistent, expired, and already-consumed tokens all
+            // collapse to invalid_signup_token to prevent enumeration.
             const email = await getEmailForSignupToken(ctx.redis, event.payload.token);
             if (!email)
                 return invalidSignupToken();
-            // Single-Use-Burn: zwei parallele Confirms aus verschiedenen
-            // Tabs — einer wins, der andere kriegt invalid_signup_token.
+            // Single-use burn: of two parallel confirmations from different tabs,
+            // one succeeds and the other receives invalid_signup_token.
             const burn = await burnSignupToken(ctx.redis, event.payload.token);
             if (burn === "already-used")
                 return invalidSignupToken();
             let committed = false;
             try {
-                // Tenant-Key: 2-Wort-Slug aus framework/random, mit DB-Conflict-
-                // Check gegen tenants.key. 22.500 Default-Combos + Suffix-
-                // Fallback bei Kollision (siehe generateUniqueName).
+                // Tenant key: a two-word slug from framework/random, with a DB conflict
+                // check against tenants.key. 22,500 default combinations plus a
+                // suffix fallback in case of collision (see generateUniqueName).
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
                 const dbConn = ctx.db.unsafeRaw();
@@ -112,8 +111,8 @@ export function createSignupConfirmHandler(opts = {}) {
                     },
                 });
                 const tenantId = generateId(); // @cast-boundary engine-payload
-                // Display-Name aus email-prefix als sinnvolles Default; User kann
-                // den Tenant-Namen + sein eigenes displayName später ändern.
+                // Use the email prefix as a meaningful default display name; the user can
+                // change the tenant name and their own displayName later.
                 const displayName = email.split("@")[0] ?? email;
                 const registrationLocale = registrationLocaleFromRequest();
                 let provisioned;
@@ -128,25 +127,24 @@ export function createSignupConfirmHandler(opts = {}) {
                         tenantName: tenantKey,
                         ...registrationLocale,
                     }, 
-                    // #1463: seedTenant's postSave hooks (tier-engine's auto-default-
+                    // seedTenant's postSave hooks (tier-engine's auto-default-
                     // tier, an app's auto-default-compliance) must fire on self-signup
                     // exactly like they do on the regular TenantHandlers.create path.
                     { registry: ctx.registry, context: ctx });
                 }
                 catch (err) {
-                    // Email hat bereits ein Konto — provisionSignupAccount ist create-only
-                    // (#365): sauberer User-Fehler, KEINE Session für den fremden Account.
-                    // committed bleibt false → der burn wird im finally released (ein
-                    // Retry scheitert wieder gleich, kein stale-Marker-Block).
+                    // The email already has an account—provisionSignupAccount is create-only:
+                    // return a clean user error and never create a session for that account.
+                    // committed remains false, so finally releases the burn; a retry fails
+                    // the same way without being blocked by a stale marker.
                     if (err instanceof ConflictError)
                         return signupEmailAlreadyRegistered();
                     throw err;
                 }
-                // SessionUser für JWT-Mint. Roles aus INITIAL_SIGNUP_ROLES
-                // damit DB-write (provisionSignupAccount) und Session-claim
-                // dieselbe Quelle teilen — sonst hätten zwei Stellen "TenantAdmin"
-                // hardcoded und ein Refactor würde role-mismatch zwischen DB
-                // und JWT erzeugen.
+                // Build the SessionUser for JWT minting. Use roles from INITIAL_SIGNUP_ROLES
+                // so the database write (provisionSignupAccount) and session claim share
+                // one source; otherwise two hardcoded "TenantAdmin" values could drift
+                // during a refactor and create a role mismatch between the DB and JWT.
                 const session = {
                     id: provisioned.userId,
                     tenantId: provisioned.tenantId,
@@ -195,9 +193,8 @@ export function createSignupConfirmHandler(opts = {}) {
             }
             finally {
                 if (!committed && ctx.redis) {
-                    // Burn-release damit ein retry nach DB-Hiccup nicht blockt.
-                    // Token-Lookup-Keys bleiben — der User kann seinen Mail-Link
-                    // erneut klicken.
+                    // Release the burn so a retry after a DB hiccup is not blocked.
+                    // Keep the token lookup keys so the user can click the email link again.
                     await unburnSignupToken(ctx.redis, event.payload.token);
                 }
             }

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -15,7 +15,7 @@
 // Always-200 (enumeration-safe): the response looks the same for every
 // email, whether it's already registered or not. An email CAN already have
 // an account (seeding or an earlier signup) — the actual gate sits
-// deliberately in the confirm step (#365): signup-confirm rejects an
+// deliberately in the confirm step: signup-confirm rejects an
 // already-registered email instead of reusing the existing user. Here it
 // stays always-200 + resend-idempotent so the request path leaks nothing;
 // suppressing the link on the request side would be defense-in-depth, but
@@ -31,10 +31,9 @@ import { issueSignupActivation } from "../signup-activation.js";
 import { storeSignupHandover, takeOverSignupHandoverForResend } from "../signup-token-store.js";
 const SignupRequestSchema = z.object({
     email: z.email(),
-    // Cross-device try-first handover (kumiko-framework#3035 follow-up,
-    // offlot-app#454) — see shared/signup-handover.ts for why the grant is
-    // verified here and rebound to the signup token instead of the client
-    // carrying it through the activation link.
+    // Cross-device try-first handover: see shared/signup-handover.ts for why the
+    // grant is verified here and rebound to the signup token instead of the
+    // client carrying it through the activation link.
     handover: z
         .object({
         entityType: z.string().min(1),
@@ -64,8 +63,8 @@ export function createSignupRequestHandler(opts) {
             // ctx.hasFeature() is fail-closed for *unregistered* names the moment
             // feature-toggles/tier-engine is wired, which silently kills
             // self-signup for every existing app that mounts auth-email-password
-            // without also composing createAuthSelfRegistrationToggleFeature()
-            // (#1468). Only gate when the toggle actually exists.
+            // without also composing createAuthSelfRegistrationToggleFeature().
+            // Only gate when the toggle actually exists.
             const gated = ctx.registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) !== undefined;
             if (gated && !(await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE))) {
                 // No email address here — this fires on every no-op request, PII

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -6,5 +6,5 @@ export type SwitchTenantMfaGateData = {
 } | NonNullable<Awaited<ReturnType<typeof gateEnforceMfa>>>;
 export declare function createSwitchTenantMfaGateHandler(opts: Pick<LoginHandlerOptions, "mfaStatusChecker">): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"switch-tenant-mfa-gate", z.ZodObject<{
     userId: z.ZodString;
-    tenantId: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    tenantId: z.ZodString;
 }, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.js

@@ -7,10 +7,7 @@ import { noMembership } from "../errors.js";
 import { gateEnforceMfa } from "./login.write.js";
 const SwitchTenantMfaGateSchema = z.object({
     userId: z.string().min(1),
-    tenantId: z
-        .string()
-        .min(1)
-        .transform((id) => id),
+    tenantId: z.string().min(1),
 });
 // Dispatched by POST /auth/switch-tenant with the system identity. The handler
 // resolves membership and roles itself, so the gate never trusts caller-supplied

package/dist/auth-email-password/index.js

@@ -9,11 +9,11 @@ export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./boo
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
 export { AuthMailNotificationTypes } from "./mail-notifications.js";
 export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.js";
-// Generic HMAC-signed single-purpose token helpers. Re-exported damit
-// app-spezifische out-of-band-Flows (subscriber-confirm, magic-links,
-// invite-tokens) denselben battle-tested signer/verifier nutzen können
-// statt eigene HMAC-Logik zu duplizieren. Purpose-string diskriminiert
-// Cross-Replay zwischen Flows.
+// Generic HMAC-signed single-purpose token helpers. Re-exported so
+// app-specific out-of-band flows (subscriber-confirm, magic-links,
+// invite-tokens) can use the same battle-tested signer/verifier
+// instead of duplicating HMAC logic. The purpose string prevents
+// cross-replay between flows.
 export { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
 export { issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
 export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";

package/dist/auth-email-password/lockout-store.js

@@ -17,7 +17,7 @@
 // semantics) live in shared/lockout-counter.ts — this file only wires the
 // account-lockout key prefixes onto it. See that file for why a lock
 // re-arms immediately after expiry, and why a successful login (or the
-// account-unlock magic-link flow, #1266, see
+// account-unlock magic-link flow in
 // handlers/confirm-account-unlock.write.ts) is what resets the streak.
 import { createLockoutCounter } from "../shared/index.js";
 const COUNT_KEY_PREFIX = "kumiko:auth:lockout:count:";

package/dist/auth-email-password/seeding.d.ts

@@ -8,53 +8,51 @@ export type SeedUserWithPasswordOptions = {
     readonly password: string;
     readonly displayName: string;
     readonly locale?: string;
-    /** Globale Rollen — siehe SeedUserOptions.roles. */
+    /** Global roles — see SeedUserOptions.roles. */
     readonly roles?: readonly string[];
-    /** Initial-emailVerified-Flag. Default false (Verify-Flow läuft).
-     *  Magic-Link-Signup setzt true weil der Mail-Klick die Email-
-     *  Ownership beweist. Siehe SeedUserOptions.emailVerified. */
+    /** Initial emailVerified flag. Defaults to false (the verification flow runs).
+     *  Magic-link signup sets it to true because clicking the email proves
+     *  ownership. See SeedUserOptions.emailVerified. */
     readonly emailVerified?: boolean;
     readonly by?: SessionUser;
 };
 /**
- * Seed a user mit Plain-Password (wird vor dem Insert mit argon2
- * gehasht). Liefert die userId, idempotent über email.
+ * Seed a user with a plaintext password (hashed with argon2 before insertion).
+ * Returns the userId and is idempotent by email.
  */
 export declare function seedUserWithPassword(db: DbConnection, options: SeedUserWithPasswordOptions, hooks?: SeedTenantHooks): Promise<{
     id: string;
 }>;
-/** Provisioning-Helper für Self-Signup-Confirm. Legt einen frischen
- *  Tenant + Admin-User + Membership in einem Rutsch an — verwendet die
- *  bestehende Event-Store-Pipeline (wie seedAdmin) und ist daher
- *  konsistent mit dem regulären create-Pfad: events werden geschrieben,
- *  Projections sind populated, MSPs/Audit sehen die neuen Rows.
+/** Provisions a fresh tenant, admin user, and membership for self-signup
+ *  confirmation in one operation. It uses the existing event-store pipeline
+ *  (as seedAdmin), keeping it consistent with the regular create path:
+ *  events are written, projections are populated, and MSPs/audit see the
+ *  new rows.
  *
- *  Naming-Hinweis: nutzt intern `seedTenant` / `seedUser*` —
- *  diese Helpers sind production-grade (event-store-pipeline), das "seed"
- *  im Namen ist historisch (zuerst für Tests + Bootstrap gebaut, dann
- *  als General-Purpose-Helper exportiert). Rename `seed*` → `provision*`
- *  ist als dedizierter Cleanup-PR geplant — disproportional zum Wert
- *  innerhalb dieses Sprints, weil alle existing tests berührt würden.
+ *  Naming note: internally uses `seedTenant` / `seedUser*`; these helpers are
+ *  production-grade (event-store pipeline), and "seed" is historical because
+ *  they were first built for tests and bootstrap before being exported as
+ *  general-purpose helpers.
  *
- *  Atomicity: läuft inside einer Drizzle-Tx wenn der Caller das angibt
- *  (db.begin(tx => provisionSignupAccount(tx, ...)) — die seed-
- *  helpers nehmen DbConnection|DbTx strukturell. Bei pure DbConnection
- *  sind die 3 writes nicht atomic; bei Failure zwischen Schritten kann
- *  ein orphan-Tenant zurückbleiben (Tenant ohne User → unused row;
- *  User ohne Membership → "no_membership" beim ersten Login).
+ *  Atomicity: runs inside a Drizzle transaction when the caller provides one
+ *  (db.begin(tx => provisionSignupAccount(tx, ...)); the seed helpers accept
+ *  DbConnection|DbTx structurally. With a plain DbConnection, the three writes
+ *  are not atomic; a failure between steps can leave an orphan tenant (tenant
+ *  without a user → unused row; user without a membership → "no_membership"
+ *  on first login).
  *
- *  Create-only: existiert bereits ein User mit dieser Email (Seeding oder
- *  früherer Signup), wirft die Funktion einen ConflictError BEVOR ein Tenant
- *  entsteht. Der Self-Signup-Pfad darf einen bestehenden User nicht still
- *  wiederverwenden — sonst würde der Confirm-Schritt eine Session für ihn
- *  minten (Account-Takeover, #365). `seedUser` selbst bleibt idempotent
- *  add-only (für Bootstrap/Tests); die create-only-Garantie sitzt hier.
- *  tenantKey-Kollisionen löst der Caller via generateUniqueName. */
+ *  Create-only: if a user with this email already exists (from seeding or an
+ *  earlier signup), the function throws a ConflictError BEFORE creating a
+ *  tenant. The self-signup path must not silently reuse an existing user —
+ *  otherwise the confirmation step could mint a session for that user
+ *  (account takeover). `seedUser` itself remains idempotent and add-only
+ *  (for bootstrap/tests); the create-only guarantee belongs here.
+ *  The caller resolves tenantKey collisions via generateUniqueName. */
 /** Default membership roles for self-signup tenant owners. Shared between
- *  provisionSignupAccount (DB-write) und signup-confirm-handler
- *  (SessionUser-Konstruktion für JWT-Mint) — sonst hätten zwei
- *  Stellen unabhängig "TenantAdmin" hardcoded und würden bei einem
- *  Refactor zu role-mismatch zwischen DB und Session leiden. */
+ *  provisionSignupAccount (DB write) and signup-confirm-handler
+ *  (SessionUser construction for JWT minting); otherwise two locations would
+ *  independently hardcode "TenantAdmin" and a refactor could cause a role
+ *  mismatch between the database and the session. */
 export declare const INITIAL_SIGNUP_ROLES: readonly ["TenantAdmin", "Admin"];
 export type ProvisionSignupAccountOptions = {
     readonly email: string;
@@ -75,20 +73,19 @@ export type SeedAdminOptions = {
     readonly email: string;
     readonly password: string;
     readonly displayName: string;
-    /** Tenants, in die der Admin als Mitglied eingetragen wird. Pro
-     *  Tenant kann eine eigene Rollenliste gesetzt werden — hilft beim
-     *  Sample-TenantSwitcher der pro Tenant unterschiedliche
-     *  Rollen-Listen zeigt. */
+    /** Tenants where the admin is added as a member. Each tenant can have
+     *  its own role list, which lets the sample TenantSwitcher show different
+     *  role lists for each tenant. */
     readonly memberships: ReadonlyArray<{
         readonly tenantId: TenantId;
         readonly tenantKey: string;
         readonly tenantName: string;
         readonly roles: readonly string[];
     }>;
-    /** Globale Rollen die in users.roles landen — tenant-unabhängig.
-     *  Login-Handler mergt sie in jede Session parallel zu den tenant-
-     *  membership-Rollen. Typischer use-case: `["SystemAdmin"]` für
-     *  einen Plattform-Operator. Default: leer. */
+    /** Global roles stored in users.roles, independent of the tenant.
+     *  The login handler merges them into every session alongside the tenant
+     *  membership roles. Typical use case: `["SystemAdmin"]` for a platform
+     *  operator. Default: empty. */
     readonly globalRoles?: readonly string[];
     /** Initial emailVerified state — defaults to false (unverified). Same
      *  mechanism as seedUserWithPassword.emailVerified. Re-running the seed
@@ -98,9 +95,9 @@ export type SeedAdminOptions = {
     readonly by?: SessionUser;
 };
 /**
- * Seed-Convenience für Sample-Server: Admin-User mit gehashtem
- * Password + N Tenants + N Memberships. Alles idempotent (Re-Run im
- * persistent-DB-Modus läuft durch). Liefert die userId zurück.
+ * Seeding convenience for sample servers: an admin user with a hashed
+ * password, N tenants, and N memberships. Idempotent, so rerunning it in
+ * persistent-DB mode succeeds. Returns the userId.
  */
 export declare function seedAdmin(db: DbConnection, options: SeedAdminOptions): Promise<{
     id: string;

package/dist/auth-email-password/seeding.js

@@ -1,16 +1,16 @@
-// Stable seeding helpers fürs auth-email-password-Feature. Liegen unter
-// `/seeding` (nicht `/testing`) damit der Vertrag klar ist: hier ist
-// non-test code der bei jedem Dev-Boot + jedem Integration-Test läuft.
-// Test-spezifische Variationen (account-locked-Setup, expired-token,
-// race-conditions) werden NICHT als Knöpfe an diesen Helpers angebaut —
-// sie kommen als neue Funktionen daneben oder inline ins Test-File.
+// Stable seeding helpers for the auth-email-password feature. They live under
+// `/seeding` rather than `/testing` to make the contract clear: this is
+// non-test code that runs on every dev boot and integration test.
+// Test-specific variations (account-locked setup, expired-token,
+// race-conditions) are NOT added as options to these helpers —
+// they belong in separate functions or inline in the test file.
 //
-// Bündelt drei Schritte in einem Aufruf:
-//   1. argon2-Hash des Plain-Passworts
-//   2. seedUser() aus user/seeding
-//   3. seedTenant + seedTenantMembership aus tenant/seeding
-// Damit Sample-Server und Tests keine drei sub-paths zusammensammeln
-// müssen.
+// Bundles three steps into one call:
+//   1. argon2 hash of the plaintext password
+//   2. seedUser() from user/seeding
+//   3. seedTenant + seedTenantMembership from tenant/seeding
+// This keeps sample servers and tests from having to assemble three
+// sub-paths themselves.
 import { configuredBlindIndexKey, configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
@@ -24,21 +24,21 @@ import { USER_STATUS, userTable } from "../user/schema/user.js";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { reconcileSeededUserEmailVerified, rewriteSeededUserEmail, seedUser, } from "../user/seeding.js";
 const log = createFallbackLogger("auth-email-password-seeding");
-// Re-export für ergonomische Single-Import-Site in tests/seed-scripts.
-// Das Auth-Feature ist der natürliche Aufrufer für "seed admin user mit
-// password + tenant + membership" — wer das nutzt soll nicht aus drei
-// verschiedenen sub-paths zusammensammeln müssen.
+// Re-export for a convenient single import site in tests/seed-scripts.
+// The auth feature is the natural caller for "seed admin user with
+// password + tenant + membership", so consumers do not need to assemble
+// these helpers from three different sub-paths.
 // kumiko-lint-ignore cross-feature-import re-export of test-helpers
 export { seedTenant, seedTenantMembership } from "../tenant/seeding.js";
 // kumiko-lint-ignore cross-feature-import re-export of test-helpers
 export { seedUser } from "../user/seeding.js";
 /**
- * Seed a user mit Plain-Password (wird vor dem Insert mit argon2
- * gehasht). Liefert die userId, idempotent über email.
+ * Seed a user with a plaintext password (hashed with argon2 before insertion).
+ * Returns the userId and is idempotent by email.
  */
 export async function seedUserWithPassword(db, options, 
 // Optional, append-only — same rationale as provisionSignupAccount's
-// hooks param (#1478): the self-signup path passes it through so `user`'s
+// hooks param: the self-signup path passes it through so `user`'s
 // postSave hooks fire on self-signup same as on the regular create path.
 hooks) {
     const passwordHash = await hashPassword(options.password);
@@ -52,54 +52,52 @@ hooks) {
         ...(options.by !== undefined && { by: options.by }),
     }, hooks);
 }
-/** Provisioning-Helper für Self-Signup-Confirm. Legt einen frischen
- *  Tenant + Admin-User + Membership in einem Rutsch an — verwendet die
- *  bestehende Event-Store-Pipeline (wie seedAdmin) und ist daher
- *  konsistent mit dem regulären create-Pfad: events werden geschrieben,
- *  Projections sind populated, MSPs/Audit sehen die neuen Rows.
+/** Provisions a fresh tenant, admin user, and membership for self-signup
+ *  confirmation in one operation. It uses the existing event-store pipeline
+ *  (as seedAdmin), keeping it consistent with the regular create path:
+ *  events are written, projections are populated, and MSPs/audit see the
+ *  new rows.
  *
- *  Naming-Hinweis: nutzt intern `seedTenant` / `seedUser*` —
- *  diese Helpers sind production-grade (event-store-pipeline), das "seed"
- *  im Namen ist historisch (zuerst für Tests + Bootstrap gebaut, dann
- *  als General-Purpose-Helper exportiert). Rename `seed*` → `provision*`
- *  ist als dedizierter Cleanup-PR geplant — disproportional zum Wert
- *  innerhalb dieses Sprints, weil alle existing tests berührt würden.
+ *  Naming note: internally uses `seedTenant` / `seedUser*`; these helpers are
+ *  production-grade (event-store pipeline), and "seed" is historical because
+ *  they were first built for tests and bootstrap before being exported as
+ *  general-purpose helpers.
  *
- *  Atomicity: läuft inside einer Drizzle-Tx wenn der Caller das angibt
- *  (db.begin(tx => provisionSignupAccount(tx, ...)) — die seed-
- *  helpers nehmen DbConnection|DbTx strukturell. Bei pure DbConnection
- *  sind die 3 writes nicht atomic; bei Failure zwischen Schritten kann
- *  ein orphan-Tenant zurückbleiben (Tenant ohne User → unused row;
- *  User ohne Membership → "no_membership" beim ersten Login).
+ *  Atomicity: runs inside a Drizzle transaction when the caller provides one
+ *  (db.begin(tx => provisionSignupAccount(tx, ...)); the seed helpers accept
+ *  DbConnection|DbTx structurally. With a plain DbConnection, the three writes
+ *  are not atomic; a failure between steps can leave an orphan tenant (tenant
+ *  without a user → unused row; user without a membership → "no_membership"
+ *  on first login).
  *
- *  Create-only: existiert bereits ein User mit dieser Email (Seeding oder
- *  früherer Signup), wirft die Funktion einen ConflictError BEVOR ein Tenant
- *  entsteht. Der Self-Signup-Pfad darf einen bestehenden User nicht still
- *  wiederverwenden — sonst würde der Confirm-Schritt eine Session für ihn
- *  minten (Account-Takeover, #365). `seedUser` selbst bleibt idempotent
- *  add-only (für Bootstrap/Tests); die create-only-Garantie sitzt hier.
- *  tenantKey-Kollisionen löst der Caller via generateUniqueName. */
+ *  Create-only: if a user with this email already exists (from seeding or an
+ *  earlier signup), the function throws a ConflictError BEFORE creating a
+ *  tenant. The self-signup path must not silently reuse an existing user —
+ *  otherwise the confirmation step could mint a session for that user
+ *  (account takeover). `seedUser` itself remains idempotent and add-only
+ *  (for bootstrap/tests); the create-only guarantee belongs here.
+ *  The caller resolves tenantKey collisions via generateUniqueName. */
 /** Default membership roles for self-signup tenant owners. Shared between
- *  provisionSignupAccount (DB-write) und signup-confirm-handler
- *  (SessionUser-Konstruktion für JWT-Mint) — sonst hätten zwei
- *  Stellen unabhängig "TenantAdmin" hardcoded und würden bei einem
- *  Refactor zu role-mismatch zwischen DB und Session leiden. */
+ *  provisionSignupAccount (DB write) and signup-confirm-handler
+ *  (SessionUser construction for JWT minting); otherwise two locations would
+ *  independently hardcode "TenantAdmin" and a refactor could cause a role
+ *  mismatch between the database and the session. */
 // TenantAdmin is the canonical owner role; Admin stays for handlers that still
 // gate on the legacy literal until those call sites move to access.admin.
 export const INITIAL_SIGNUP_ROLES = ["TenantAdmin", "Admin"];
 export async function provisionSignupAccount(db, options, 
 // Optional, append-only — existing callers (tests, seed scripts) that
 // don't pass hooks keep today's behavior. The real signup-confirm
-// handler DOES pass it (#1463) so seedTenant/seedUserWithPassword/
+// handler DOES pass it so seedTenant/seedUserWithPassword/
 // seedTenantMembership's postSave hooks (tier-engine's auto-default-tier,
 // app auto-default-compliance, a Welcome-notification hook, ...) fire on
 // self-signup for all three entities, same as they do on the regular
-// create paths (#1478 — this was only wired for tenant before).
+// create paths — this was only wired for tenant before.
 hooks) {
     // Create-only guard BEFORE seedTenant: hard-abort on an already-registered
     // email, otherwise an orphaned tenant would be created and seedUser
     // (idempotent add-only) would silently return the existing userId ->
-    // confirm mints a session for the wrong account (#365).
+    // confirm mints a session for the wrong account.
     // isDeleted: false — the partial bidx unique index only covers live rows,
     // so a soft-deleted row must not block re-registering its email.
     const existingUser = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
@@ -126,9 +124,9 @@ hooks) {
     return { userId, tenantId: options.tenantId };
 }
 /**
- * Seed-Convenience für Sample-Server: Admin-User mit gehashtem
- * Password + N Tenants + N Memberships. Alles idempotent (Re-Run im
- * persistent-DB-Modus läuft durch). Liefert die userId zurück.
+ * Seeding convenience for sample servers: an admin user with a hashed
+ * password, N tenants, and N memberships. Idempotent, so rerunning it in
+ * persistent-DB mode succeeds. Returns the userId.
  */
 export async function seedAdmin(db, options) {
     const by = options.by ?? TestUsers.systemAdmin;

package/dist/auth-email-password/signup-token-store.js

@@ -57,14 +57,14 @@ export async function deleteSignupToken(redis, args) {
 /** Burn release for failed-confirm paths (DB error etc.) so a legitimate
  *  retry isn't blocked by a stale burn marker. */
 export const unburnSignupToken = store.unburn;
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): signup-request binds a verified tenant-handover grant to
-// its own signup token, in a SIBLING Redis namespace keyed the same way
-// (sha256(token)) so it stays byte-compatible with the token store above
-// without going through it — the binding has its own lifecycle (survives a
-// resend, is read once by signup-confirm) that doesn't fit the token↔email
-// pairing. Only {entityType, rowId, sourceTenantId} is ever stored — never
-// the grant token or the email (see shared/signup-handover.ts).
+// Cross-device try-first handover:
+// signup-request binds a verified tenant-handover grant to its own signup token,
+// in a SIBLING Redis namespace keyed the same way (sha256(token)) so it stays
+// byte-compatible with the token store above without going through it — the
+// binding has its own lifecycle (survives a resend, is read once by
+// signup-confirm) that doesn't fit the token↔email pairing. Only
+// {entityType, rowId, sourceTenantId} is ever stored — never the grant token
+// or the email (see shared/signup-handover.ts).
 const SIGNUP_HANDOVER_KEY_PREFIX = "signup:handover:";
 const signupHandoverBindingSchema = z.object({
     entityType: z.string().min(1),

package/dist/auth-email-password/testing.js

@@ -1,4 +1,4 @@
-// /testing re-exportiert /seeding. Siehe ../tenant/testing.ts für die
-// Begründung — Helpers sind shared zwischen Tests und Dev-Server-
-// Bootstrap, /seeding ist die stabile Heimat.
+// /testing re-exports /seeding. See ../tenant/testing.ts for the reason:
+// Helpers are shared between tests and Dev-Server bootstrap, so /seeding is
+// the stable home.
 export * from "./seeding.js";

package/dist/auth-email-password/web/auth-client.d.ts

@@ -1,8 +1,8 @@
 export type TenantSummary = {
     readonly tenantId: string;
     readonly roles: readonly string[];
-    /** Display-Name aus /auth/tenants — fehlt nur bei App-eigenen
-     *  membership-Queries ohne tenantName-Anreicherung. */
+    /** Display name from /auth/tenants; absent only for app-owned membership
+     * queries without tenantName enrichment. */
     readonly name?: string;
     readonly key?: string;
 };