@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/tier-engine/feature.js

@@ -1,45 +1,44 @@
-// tier-engine — Pricing-Tier-Mechanik als reguläres Bundled-Feature.
+// tier-engine — pricing-tier mechanics as a regular bundled feature.
 //
-// **Was diese Feature macht:**
-//   Speichert pro Plattform-Tenant ein Tier-Assignment (welcher Tier ist
-//   aktiv). Optional (mit `tierMap` in Options): per-tenant feature-set
-//   resolution via Framework's `tenantTierResolver`-extension — das
-//   dispatcher-feature-gate fragt automatisch pro request den resolver
-//   nach dem effective Set für den aktiven Tenant.
+// **What this feature does:**
+//   Stores one tier assignment per platform tenant (the active tier). With
+//   `tierMap` in the options, it also resolves the per-tenant feature set via
+//   the framework's `tenantTierResolver` extension; the dispatcher feature gate
+//   automatically asks the resolver for the active tenant's effective set.
 //
-// **Zwei Use-Modes:**
-//   1. `createTierEngineFeature()` ohne opts — nur Storage (Standard-CRUD
-//      für tier-assignment-Entity). Apps die composeApp() oder eigene
-//      logic nutzen.
-//   2. `createTierEngineFeature({ defaultTier, tierMap })` — vollständige
-//      Tier-Composition. Sprint-8a Pattern für multi-tenant SaaS-Apps.
-//      Framework auto-wires effectiveFeatures via extension-pickup.
+// **Two usage modes:**
+//   1. `createTierEngineFeature()` without options — storage only (standard CRUD
+//      for the tier-assignment entity). Apps can use `composeApp()` or their
+//      own logic.
+//   2. `createTierEngineFeature({ defaultTier, tierMap })` — complete tier
+//      composition for multi-tenant SaaS apps. The framework auto-wires
+//      effectiveFeatures through extension pickup.
 //
-// **Generic über Tier-Werte:** das Feature kennt keine "free"/"pro"/etc.
-//   konkreten Tier-Werte. App definiert ihre TierMap.
+// **Generic over tier values:** the feature knows no concrete `free`/`pro`/etc.
+//   tier values. The app defines its tier map.
 //
-// **Auto-Default-Tier on Tenant-Signup:** wenn `opts.defaultTier` gesetzt
-//   ist, schreibt ein r.entityHook("postSave", "tenant", phase: inTransaction)
-//   automatisch eine tier-assignment für den neuen Tenant. Atomic mit
-//   tenant-create — wenn tier-assignment fail't, tenant-create rolled back.
-//   Idempotent via deterministic aggregate-id (re-replay re-checkt stream-
-//   version, skip wenn schon da). Plus: cache-miss-fallback returnt
-//   defaultTier-features wenn assignment-row fehlt (defense-in-depth gegen
-//   replay-races wo der hook noch nicht durch ist).
+// **Auto-default tier on tenant signup:** when `opts.defaultTier` is set, an
+//   `r.entityHook("postSave", "tenant", phase: inTransaction)` automatically
+//   writes a tier assignment for the new tenant. The write is atomic with
+//   tenant creation: if it fails, tenant creation is rolled back. It is
+//   idempotent through a deterministic aggregate ID; replay re-checks the
+//   stream version and skips the write if it already exists. A cache-miss
+//   fallback also returns the default tier's features when the assignment row
+//   is missing, protecting against races while the hook is still running.
 //
-// **In-Memory-Cache mit Push-Invalidation:**
-//   Closure-state pro feature-instance hält die effective Sets pro Tenant.
-//   r.entityHook auf tier-assignment:postSave/postDelete hält cache aktuell.
-//   Erste-Request-Cold-Cache: pre-load via build(deps) im extension-pickup
-//   Pfad (boot-time via runDevApp/runProdApp).
+// **In-memory cache with push invalidation:**
+//   Closure state per feature instance stores each tenant's effective sets.
+//   `r.entityHook` on tier-assignment postSave/postDelete keeps the cache
+//   current. The extension-pickup path pre-loads the cache through build(deps)
+//   at boot via runDevApp/runProdApp.
 //
-// **SYSTEM_TENANT_ID-Convention:**
-//   resolver-callback bei call mit SYSTEM_TENANT_ID returnt union aller
-//   tier-features (für event-dispatcher async-pass + operator-tooling).
-//   Siehe DispatcherOptions.effectiveFeatures-doc.
+// **SYSTEM_TENANT_ID convention:**
+//   A resolver callback invoked with SYSTEM_TENANT_ID returns the union of all
+//   tier features for asynchronous event dispatch and operator tooling.
+//   See the DispatcherOptions.effectiveFeatures documentation.
 //
-// **Boot-Dependencies:** config + tenant.
-// kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312 (feature.ts > 300 lines)
+// **Boot dependencies:** config + tenant.
+// kumiko-lint-ignore app-feature-structure feature.ts is over 300 lines and not yet split
 import { buildEntityTable, createEventStoreExecutor, createTenantDb, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { defineEntityCreateHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, defineQueryHandler, HookPhases, SYSTEM_TENANT_ID, TENANT_TIER_RESOLVER_EXT, } from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
@@ -61,25 +60,25 @@ import { TIER_ENGINE_I18N } from "./web/i18n.js";
 // in the App's drizzle/schema.generated.ts.
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 const log = createFallbackLogger("tier-engine");
-// Event-store-executor für direct-write aus dem auto-default-tier-hook.
-// Pattern wie tenant/seeding.ts: hook sieht AppContext (kein ctx.write),
-// muss aber atomisch mit tenant-create im selben TX schreiben → executor
-// direkt aufrufen, nicht via dispatcher.
+// Event-store executor for direct writes from the auto-default-tier hook.
+// Like tenant/seeding.ts, the hook receives AppContext (not ctx.write), but it
+// must write atomically with tenant creation in the same transaction. Call the
+// executor directly rather than going through the dispatcher.
 const tierAssignmentExecutor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEntity, {
     entityName: "tier-assignment",
 });
 const adminAccess = { access: { roles: ["TenantAdmin", "SystemAdmin"] } };
-// Tier-Wechsel ist Plattform-/Billing-Hoheit — ein Tenant-Admin darf den
-// eigenen Tier NIE setzen (sonst Gratis-Self-Upgrade). Daher sind die
-// Writes SystemAdmin-only; Reads (list, get-active-tier) bleiben
-// TenantAdmin-sichtbar. Auto-default-Hook + Billing schreiben als System,
-// hängen also nicht an diesem Handler-Access.
+// Tier changes are controlled by the platform and billing: a TenantAdmin must
+// never set its own tier, which would allow a free self-upgrade. Writes are
+// therefore SystemAdmin-only, while reads (list, get-active-tier) remain visible
+// to TenantAdmin. The auto-default hook and billing write as the system, so they
+// are not subject to this handler access.
 const writeAccess = { access: { roles: ["SystemAdmin"] } };
 /**
- * Compute the union of features across all tiers — verwendet bei
- * SYSTEM_TENANT_ID-resolver-call (operator-tooling, async-event-dispatch).
- * Operator-UI sieht alle features unabhängig vom tier-cut, async-events
- * laufen tier-agnostic durch.
+ * Computes the union of features across all tiers for a
+ * SYSTEM_TENANT_ID resolver call used by operator tooling and asynchronous
+ * event dispatch. The operator UI sees every feature regardless of tier, and
+ * asynchronous events run without tier restrictions.
  */
 function unionAllTierFeatures(tierMap) {
     const all = new Set();
@@ -90,9 +89,9 @@ function unionAllTierFeatures(tierMap) {
     return all;
 }
 /**
- * Compute the feature-set for a given tier-name. Unknown tier → empty Set
- * (defensive — verwendete tier-namen werden nicht an boot-time validiert
- * weil tier-engine generic über tier-Werte ist).
+ * Computes the feature set for a tier name. An unknown tier returns an empty
+ * Set defensively because tier names are not validated at boot; tier-engine is
+ * generic over tier values.
  */
 function featuresForTier(tierMap, tierName) {
     const tier = tierMap[tierName];
@@ -101,10 +100,10 @@ function featuresForTier(tierMap, tierName) {
     return new Set(tier.features);
 }
 /**
- * Merge always-on features (non-toggleable framework-base) mit tier-cut
- * features (toggleable per tier). Canonical Kumiko: dispatcher-gate
- * blockt nur features die explizit `r.toggleable()` haben — alle anderen
- * sind immer aktiv. Tier-resolver muss das selbe pattern liefern.
+ * Merges always-on features (non-toggleable framework base) with tier-specific
+ * features (toggleable per tier). The dispatcher gate blocks only features
+ * that explicitly register `r.toggleable()`; all others are always active.
+ * The tier resolver must provide the same shape.
  */
 function mergeAlwaysOn(alwaysOn, tierFeatures) {
     const merged = new Set(alwaysOn);
@@ -144,13 +143,14 @@ export function createTierEngineFeature(opts = {}) {
             description: "Lists the tier-assignment rows visible to the caller with tier name and assignment source; use it to see which plan is stored for a tenant.",
         }));
         r.queryHandler(getActiveTierQuery);
-        // \u2500\u2500 Manueller Tier-Grant (SystemAdmin, ohne Billing) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-        // Cross-tenant set + read f\u00fcr den tier-admin-Screen. tier-options liefert
-        // dem Client die App-Tier-Namen aus der tierMap-Closure (sonst hartkodiert).
+        // ── Manual tier grant (SystemAdmin, without billing) ───────────────────────
+        // Cross-tenant set and read for the tier-admin screen. tier-options gives
+        // the client the app's tier names from the tierMap closure rather than
+        // hard-coding them.
         //
         // onAssigned runs after commit (the direct executor write fires no postSave
-        // hook). Late-bound: without tierMap it stays a no-op, the tierMap block
-        // below installs the real cache update + publish.
+        // hook). It is late-bound: without tierMap it remains a no-op; the tierMap
+        // block below installs the actual cache update and publication.
         const onTierAssigned = { fn: () => { } };
         r.writeHandler(createSetTenantTierWrite({
             onAssigned: (tenantId, tier) => onTierAssigned.fn(tenantId, tier),
@@ -208,11 +208,11 @@ export function createTierEngineFeature(opts = {}) {
             dormant: true,
         });
         // ───────────────────────────────────────────────────────────────────
-        // Resolver-extension (only when tierMap is configured)
+        // Resolver extension (only when tierMap is configured)
         // ───────────────────────────────────────────────────────────────────
-        // skip: ohne tierMap ist die feature nur Storage (legacy back-compat
-        // zu `tierEngineFeature`). Resolver-extension + invalidation-hooks
-        // brauchen die tierMap zum Mapping tier-name → feature-set.
+        // skip: without tierMap, the feature provides storage only (backward
+        // compatibility with `tierEngineFeature`). The resolver extension and
+        // invalidation hooks need tierMap to map tier names to feature sets.
         if (!opts.tierMap)
             return;
         const tierMap = opts.tierMap;
@@ -307,7 +307,7 @@ export function createTierEngineFeature(opts = {}) {
         // tier-assignment.
         //
         // **Cross-tenant write:** the executor needs a systemUser WITH tenantId =
-        // the new tenant (memory `feedback_event_store_tenant_consistency`).
+        // the new tenant.
         if (opts.defaultTier !== undefined) {
             const defaultTier = opts.defaultTier;
             const autoDefaultTierHookReason = "seeds the default tier-assignment stream of the tenant just created";
@@ -352,8 +352,7 @@ export function createTierEngineFeature(opts = {}) {
                     // SystemUser for the NEW tenant — the hook is triggered by the signup
                     // user (another tenant, or SystemAdmin), but the tier-assignment has
                     // to land in the stream of the newly created tenant (= aggregate id
-                    // deterministic on newTenantId). Memory
-                    // `feedback_event_store_tenant_consistency`: by.tenantId must equal
+                    // deterministic on newTenantId), so by.tenantId must equal
                     // the target tenant.
                     const systemUser = {
                         id: "00000000-0000-4000-8000-000000000001",
@@ -458,8 +457,8 @@ export function createTierEngineFeature(opts = {}) {
                     }
                     // Cache miss: the tenant is not in the cache yet (e.g. brand new after
                     // boot, or the defaultTier hook has not fired yet). The default set
-                    // is least-privileged — typically free-tier features. Memory
-                    // `feedback_security_default_on`: secure by default. The trial is NOT
+                    // is least-privileged, secure by default: typically free-tier features.
+                    // The trial is NOT
                     // added here (sync/boot-cached, cannot see the passage of time) — the
                     // trialGate below does that on the disabled-gate path.
                     const fallbackTier = opts.defaultTier;

package/dist/tier-engine/handlers/active-tier.query.js

@@ -1,13 +1,12 @@
 import * as z from "zod";
-// get-active-tier — return the current tier-assignment for the calling tenant.
+// get-active-tier — returns the current tier assignment for the calling tenant.
 //
-// **Convenience-wrapper** über `ctx.queryProjection` für die häufigste Frage
-// gegen die Engine: „welcher Tier ist gerade aktiv?". Returns null wenn
-// noch kein Tier gesetzt — der Caller (composeApp) mappt null → Default-Tier.
+// Wraps `ctx.queryProjection` for the most common engine query: which tier is
+// currently active. Returns null when no tier is assigned; the caller (composeApp)
+// maps null to the default tier.
 //
-// **Tenant-scope:** ctx.queryProjection filtert automatisch nach tenantId.
-// Pro Plattform-Tenant existiert per Konvention genau eine
-// tier-assignment-Row.
+// **Tenant scope:** `ctx.queryProjection` automatically filters by tenantId.
+// By convention, each platform tenant has exactly one tier-assignment row.
 export const getActiveTierQuery = {
     name: "get-active-tier",
     description: "Returns the tier-assignment row currently active for the caller's own tenant, or null when none is assigned; use it to answer which plan the caller is on.",

package/dist/tier-engine/handlers/get-tenant-tier.query.js

@@ -2,10 +2,10 @@ import { buildEntityTable, createTenantDb, fetchOne } from "@cosmicdrift/kumiko-
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { tierAssignmentEntity } from "../entity.js";
-// Liest das Tier-Assignment eines BELIEBIGEN Tenants (cross-tenant) für den
-// tier-admin-Screen. SystemAdmin-only. get-active-tier liest nur den eigenen
-// Tenant — hier ein "system"-mode TenantDb auf den Ziel-Tenant (kein Filter),
-// damit der Admin das Tier fremder Tenants sehen kann. null wenn noch keins.
+// Reads the tier assignment of ANY tenant (cross-tenant) for the
+// tier-admin screen. SystemAdmin-only. get-active-tier reads only its own
+// tenant; this uses a "system"-mode TenantDb for the target tenant (no filter),
+// so the admin can view another tenant's tier. Returns null if none exists yet.
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 const GET_TENANT_TIER_REASON = "SystemAdmin reads the tier of the tenant named in the payload";
 export const getTenantTierQuery = defineQueryHandler({

package/dist/tier-engine/handlers/set-tenant-tier.write.d.ts

@@ -5,20 +5,19 @@ export type SetTenantTierOptions = {
      *  and notify the other processes. Without a tierMap there is no resolver
      *  and this is a no-op. */
     readonly onAssigned?: (tenantId: TenantId, tier: string) => void;
-    /** Tier-Namen aus der tierMap-Closure — ohne sie (storage-only-Mode) bleibt
-     *  `tier` unvalidiert außer Length/Non-Empty. Mit ihr rejected der Handler
-     *  einen unbekannten Tier-Namen statt ihn stillschweigend durchzuschreiben
-     *  (featuresForTier gibt für unbekannte Namen defensiv ein leeres Set
-     *  zurück — der Tenant verliert sonst lautlos alle Tier-Gates). */
+    /** Without the tierMap closure (storage-only mode), `tier` is validated only for
+     *  length and non-emptiness. With it, the handler rejects unknown tier names
+     *  instead of silently writing them through. (featuresForTier defensively
+     *  returns an empty set for unknown names; otherwise the tenant would silently
+     *  lose all tier gates.) */
     readonly validTiers?: ReadonlySet<string>;
 };
 export declare function createSetTenantTierWrite(opts?: SetTenantTierOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"set-tenant-tier", z.ZodObject<{
     tenantId: z.ZodString;
     tier: z.ZodString;
     source: z.ZodDefault<z.ZodEnum<{
-        readonly manual: "manual";
-        readonly billing: "billing";
-        readonly default: "default";
+        billing: "billing";
+        manual: "manual";
     }>>;
 }, z.core.$strip>, {
     tenantId: string;

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -5,9 +5,9 @@ import { requireForTenant } from "../../shared/index.js";
 import { tierAssignmentAggregateId } from "../aggregate-id.js";
 import { tierAssignmentEntity } from "../entity.js";
 import { TierAssignmentSources } from "../web/constants.js";
-// SystemAdmin setzt das Tier eines BELIEBIGEN Tenants — manueller Grant ohne
-// Billing. Cross-tenant, daher SystemAdmin-only (kein TenantAdmin: sonst
-// Gratis-Self-Upgrade).
+// A SystemAdmin can set the tier of ANY tenant as a manual grant without
+// billing. This is cross-tenant, so it is restricted to SystemAdmin (not
+// TenantAdmin, which would allow free self-upgrades).
 //
 // Cross-tenant mechanics: ctx.forTenant(tenantId) yields a tenant-mode db bound to the target plus
 // the streamTenantId, so the event lands in the target's stream with the operator as actor.
@@ -38,7 +38,10 @@ export function createSetTenantTierWrite(opts = {}) {
                 .min(1)
                 .max(50)
                 .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
-            source: z.enum(TierAssignmentSources).default(TierAssignmentSources.manual),
+            // `default` is reserved for the signup default tier; the billing sync treats it like `billing`.
+            source: z
+                .enum([TierAssignmentSources.manual, TierAssignmentSources.billing])
+                .default(TierAssignmentSources.manual),
         }),
         access: { roles: ["SystemAdmin"] },
         agent: { risk: "high" },

package/dist/tier-engine/tier-resolver.js

@@ -1,6 +1,6 @@
 // Generic tier-resolver factory. Extracted from the near-identical
-// tier-resolver.ts app copies in show-pony and publicstatus (infra#446) — the
-// only per-app variables were the TierName union and its caps/defaults, so
+// tier-resolver.ts app copies in show-pony and publicstatus — the only
+// per-app variables were the TierName union and its caps/defaults, so
 // both are now factory parameters.
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { tierAssignmentEntity } from "./entity.js";

package/dist/tier-engine/trial.js

@@ -1,11 +1,11 @@
-// Trial-Phase: ein neuer Tenant bekommt für eine Karenzzeit ab seinem
-// Anlage-Datum (inserted_at der tier-assignment-Row — rebuild-stabil aus dem
-// Create-Event) zusätzlich die Features eines höheren Tiers, unabhängig vom
-// gespeicherten Tier. Rein zeit-abgeleitet: kein Stored-Flag, kein Scheduler,
-// automatischer Ablauf. Die App definiert die Policy (welcher Tier, wie lange);
-// die tier-engine wendet sie im Resolver an.
-// Reine Millis-Arithmetik auf epochMilliseconds (die beide Seiten — Projektions-
-// Row und Now — liefern). Kein Date, keine TZ.
+// Trial phase: a new tenant receives the features of a higher tier for a grace
+// period starting at its creation date (`inserted_at` of the tier-assignment Row —
+// stable across rebuilds because it comes from the Create Event), regardless of
+// the stored tier. It is derived solely from time: no stored flag, no scheduler,
+// and automatic expiration. The app defines the policy (which tier, how long);
+// the tier-engine applies it in the resolver.
+// Pure millisecond arithmetic on epochMilliseconds, which both sides—the
+// projection Row and Now—provide. No Date and no time zone.
 export function isTrialActive(startedAtEpochMs, nowEpochMs, durationHours) {
     return nowEpochMs < startedAtEpochMs + durationHours * 3_600_000;
 }

package/dist/tier-engine/web/constants.js

@@ -3,6 +3,7 @@
 // category in the kumiko isolation model (runtime may import client, client
 // may only import client) — otherwise the runtime isolation guard throws on
 // the client imports. Same pattern as text-content/constants.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 // Feature name
 export const TIER_ENGINE_FEATURE = "tier-engine";
 // Qualified write handler names (QN format: scope:type:name).
@@ -18,9 +19,8 @@ export const TierAssignmentSources = {
     billing: "billing",
     default: "default",
 };
-const TIER_ASSIGNMENT_SOURCE_VALUES = Object.values(TierAssignmentSources);
 export function isTierAssignmentSource(value) {
-    return typeof value === "string" && TIER_ASSIGNMENT_SOURCE_VALUES.includes(value);
+    return isOneOf(Object.values(TierAssignmentSources), value);
 }
 // Qualified query handler names.
 export const TierEngineQueries = {

package/dist/tier-engine/web/index.js

@@ -1,5 +1,5 @@
-// Public exports für die Browser-Seite des tier-engine Features. Konsumiert
-// über `@cosmicdrift/kumiko-bundled-features/tier-engine/web` — die
-// Server-Seite (createTierEngineFeature) lebt unter
-// `@cosmicdrift/kumiko-bundled-features/tier-engine` und hat keine React-Deps.
+// Public exports for the browser side of the tier-engine feature. Import via
+// `@cosmicdrift/kumiko-bundled-features/tier-engine/web` — the server side
+// (createTierEngineFeature) is under
+// `@cosmicdrift/kumiko-bundled-features/tier-engine` and has no React deps.
 export { tierEngineClient } from "./client-plugin.js";

package/dist/user/db/queries/stream-tenant-backfill.js

@@ -1,11 +1,11 @@
-// #762 — one-time migration tooling for pre-#497 user event streams.
+// One-time migration tooling for older user event streams.
 //
-// #497 made `user` a systemStream entity: every executor op addresses the
+// Making `user` a systemStream entity means every executor op addresses the
 // stream on SYSTEM_TENANT_ID. Streams created before that live on whichever
-// tenant created them ("scattered"), so post-#497 writes version-conflict
-// against the empty SYSTEM stream. The raw UPDATE documented in the #497
-// changeset breaks as soon as an aggregate has BOTH a legacy stream and
-// post-#497 SYSTEM events (split stream — e.g. a skipOptimisticLock
+// tenant created them ("scattered"), so newer writes version-conflict
+// against the empty SYSTEM stream. The raw UPDATE breaks as soon as an
+// aggregate has BOTH a legacy stream and newer SYSTEM events
+// (split stream — e.g. a skipOptimisticLock
 // lifecycle write appended v1 on SYSTEM while v1..n live on the old
 // tenant): retenanting then trips events_aggregate_version_uq.
 //
@@ -54,12 +54,12 @@ async function migrateAggregate(db, aggregateId) {
         WHERE "aggregate_type" = 'user' AND "aggregate_id" = $1::uuid
         ORDER BY "id" ASC
         FOR UPDATE`, [aggregateId]);
-        // Phase 1: negative interim versions — real versions are always >= 1, so
+        // Negative interim versions — real versions are always >= 1, so
         // nothing can collide with events_aggregate_version_uq mid-migration.
         for (const [i, ev] of events.entries()) {
             await raw.unsafe(`UPDATE "kumiko_events" SET "tenant_id" = $1::uuid, "version" = $2 WHERE "id" = $3`, [SYSTEM_TENANT_ID, -(i + 1), ev.id]);
         }
-        // Phase 2: final contiguous 1..n.
+        // Final contiguous 1..n.
         for (const [i, ev] of events.entries()) {
             await raw.unsafe(`UPDATE "kumiko_events" SET "version" = $1 WHERE "id" = $2`, [i + 1, ev.id]);
         }

package/dist/user/handlers/create.write.js

@@ -11,14 +11,14 @@ import { UserErrors } from "../web/constants.js";
 const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 // Only the Auth features (running as SYSTEM) or a SystemAdmin may create users.
 //
-// Email uniqueness has two layers (fw#2134):
+// Email uniqueness has two layers:
 // 1. A pre-flight fetchOne — fast-fails with a friendly error on the
 // common case, but is race-prone on its own: two concurrent requests
 // can both see "no duplicate" and both proceed to crud.create.
 // 2. The real guard is the unique index over email's blind-index column
 // (schema/user.ts). A losing concurrent create hits that constraint
-// and crud.create returns a UniqueViolationError (framework's F8
-// pg-23505 mapping) instead of throwing — remapped below to the same
+// and crud.create returns a UniqueViolationError (framework's pg-23505
+// mapping) instead of throwing — remapped below to the same
 // emailAlreadyExists shape the pre-flight path returns, so callers see
 // one consistent error regardless of which layer caught the race.
 export const createWrite = defineWriteHandler({
@@ -89,7 +89,7 @@ export const createWrite = defineWriteHandler({
 // schema/user.ts's `read_users_email_unique` (+ its generated `_bidx`
 // pendant) is the actual race-safety net behind the pre-flight check
 // above — a losing concurrent create surfaces here as a generic
-// UniqueViolationError (framework F8 pg-23505 mapping). Only the email
+// UniqueViolationError (framework pg-23505 mapping). Only the email
 // constraint gets remapped; any other unique_violation on this entity
 // passes through unchanged.
 function isRecord(value) {

package/dist/user/schema/user.d.ts

@@ -1,8 +1,7 @@
 /**
- * User-Lifecycle-Status (S2.U1). Single source of truth — Auth-Middleware
- * (S2.U6), Forget-Job (S2.U5) und Restriction-Handler nutzen diese
- * Constants statt Magic-Strings (Memory feedback_role_naming_drift —
- * gleiches Pattern wie ROLES.SystemAdmin).
+ * User lifecycle status. This is the single source of truth used by the
+ * auth middleware, forget job, and restriction handler instead of duplicated
+ * magic strings, following the same pattern as ROLES.SystemAdmin.
  */
 export declare const USER_STATUS: {
     readonly Active: "active";
@@ -12,17 +11,18 @@ export declare const USER_STATUS: {
 };
 export type UserStatus = (typeof USER_STATUS)[keyof typeof USER_STATUS];
 /**
- * Anonymize-Display-Strings fuer userDeleteHook (S2.H1). Constants statt
- * Magic-Strings damit i18n-Mapping moeglich + drift-fest. Default-DE,
- * App-Author kann via i18n-System uebersetzen wenn gewuenscht.
+ * Display strings anonymized by userDeleteHook. Constants keep i18n mapping
+ * possible and prevent drift. The default is German; app authors can
+ * translate it through the i18n system if desired.
  */
 export declare const USER_DELETED_DISPLAY_NAME = "[Geloescht]";
 export declare const USER_ANONYMIZED_DISPLAY_NAME = "[Anonymisiert]";
 /**
- * Email-Pseudonyme nach Forget. `<prefix>-<userId>@anonymized.invalid`
- * — der userId-Suffix ist als Pseudo-Audit-Marker fuer Operator
- * (Tracing-fall) erlaubt; user-id selbst ist UUID, kein PII.
- * `.invalid`-TLD ist RFC2606-reserviert — niemals deliverbare Email.
+ * Email pseudonyms used after forgetting. `<prefix>-<userId>@anonymized.invalid`
+ * — the userId suffix is permitted as a pseudo-audit marker for operator
+ * tracing; the user ID itself is a UUID, not PII.
+ * The `.invalid` TLD is reserved by RFC2606, so the address can never be
+ * delivered.
  */
 export declare const USER_DELETED_EMAIL_PREFIX = "deleted";
 export declare const USER_ANONYMIZED_EMAIL_PREFIX = "anonymized";