@cosmicdrift/kumiko-samples 0.385.0 → 0.387.0

package/LICENSE

@@ -1,57 +1,21 @@
-Business Source License 1.1
-
-Parameters
-
-Licensor:             Marc Frost
-
-Licensed Work:        @cosmicdrift/kumiko-samples
-                      The Licensed Work is © 2026 Marc Frost.
-
-Additional Use Grant: 
-You may use the Licensed Work in production for any purpose, including 
-commercially, EXCEPT for the Restricted Use. 
-
-"Restricted Use" is defined as using the Licensed Work to provide a platform 
-or service to third parties that allows them to host, deploy, or run their 
-own applications built with the Licensed Work. This includes, but is not 
-limited to: managed hosting services, software-as-a-service (SaaS) platforms, 
-platform-as-a-service (PaaS), developer platforms, or any multi-tenant 
-managed offering of the Licensed Work.
-
-This restriction does not apply to the Licensor, any entity controlled by, 
-controlling, or under common control with the Licensor ("Affiliates"), or 
-contractors acting on their behalf. The Licensor remains free to use the 
-Licensed Work for any purpose, including for the operation of kumiko.rocks.
-
-Change Date:          2030-05-05
-Change License:       Apache License, Version 2.0
-
-
-Terms
-
-The Licensor hereby grants you the right to copy, modify, create derivative works, 
-redistribute, and make non-production use of the Licensed Work. The Licensor may 
-make an Additional Use Grant, above, permitting limited production use.
-
-Effective on the Change Date, or the fourth anniversary of the first publicly 
-available distribution of the Licensed Work under this License, whichever comes 
-first, this License will convert to the Change License.
-
-This Business Source License governs use of the Licensed Work in all cases, except 
-as to any use that is explicitly granted in the Additional Use Grant above or 
-under the Change License after the Change Date.
-
-If your use of the Licensed Work does not comply with the requirements of this 
-License, you must cease use of the Licensed Work immediately.
-
-All copies of the Licensed Work, and all derivative works thereof, must include 
-this License.
-
-This License does not grant you any right, title, or interest in any trademark, 
-logo, or branding of the Licensor, except as required to comply with this License.
-
-TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN 
-“AS IS” BASIS. LICENSOR DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 
-WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, 
-TITLE, AND NON-INFRINGEMENT. IN NO EVENT WILL LICENSOR BE LIABLE FOR ANY DAMAGES 
-ARISING OUT OF OR RELATED TO THIS LICENSE OR THE USE OF THE LICENSED WORK.
+MIT License
+
+Copyright (c) 2026 Marc Frost
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -11,4 +11,4 @@ packages/bundled-features/src/**
 
 This package contains plain sources only. It has no runtime API and no entry point; tests, build output and dotfiles are left out. Point tooling at the installed package directory (resolve `@cosmicdrift/kumiko-samples/package.json`), for example `buildFewShotCorpus({ repoRoot })` from `@cosmicdrift/kumiko-dev-server`, to get the same entry ids and source paths as in the monorepo.
 
-License: BUSL-1.1
+License: MIT

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.385.0",
+  "version": "0.387.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
-  "license": "BUSL-1.1",
+  "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
     "type": "git",

package/packages/bundled-features/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.385.0",
+  "version": "0.387.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
-  "license": "BUSL-1.1",
+  "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
     "type": "git",

package/packages/bundled-features/src/agent-tools/tool-catalog.ts

@@ -100,7 +100,7 @@ function isDetailHandlerQn(qn: string, entityName: string): boolean {
   return qn.endsWith(`:${entityName}:detail`);
 }
 
-/** #2700: the entity CRUD tools are enumerated off the registry, not off the manifest, so
+/** The entity CRUD tools are enumerated off the registry, not off the manifest, so
  *  `resolveAgentExposure` never runs for them. Only an EXPLICIT opt-out may hide one here —
  *  the resolver's own default is fail-closed on a missing `description`, and CRUD-generated
  *  handlers never carry one, so reusing it would delete every entity tool in every app. */

package/packages/bundled-features/src/agent-tools/tool-dispatch.ts

@@ -427,8 +427,6 @@ export async function dispatchToolCall(request: ToolCallRequest): Promise<ToolCa
   }
 
   try {
-    // The invoked tool, not the surrounding turn/approve write handler, must
-    // be what the irreversible-operation gate sees as the entry handler.
     return await runAsDirectCallEntry(async () => {
       switch (descriptor.kind) {
         case "search":

package/packages/bundled-features/src/audit/screens.ts

@@ -100,7 +100,7 @@ export function auditLogDetailLayout(options: { readonly withTenant: boolean }):
           "id",
         ],
       },
-      // No section `title` here (fw#2312 label-dedup fix): each section
+      // No section `title` here (label-dedup fix): each section
       // holds exactly one field, so a title would repeat the field's own
       // label (rendered by RenderField as the Field's heading) verbatim.
       { fields: [{ field: "payload", renderer: { format: "json" } }] },

package/packages/bundled-features/src/auth-email-password/auth-user-row.ts

@@ -17,19 +17,19 @@ export type AuthUserRow = {
   readonly isDeleted?: boolean | null;
   readonly emailVerified?: boolean | null;
   readonly lastActiveTenantId?: TenantId | string | null;
-  // IANA zone — threaded into SessionUser.timezone at login (fw#1636).
+  // IANA zone — threaded into SessionUser.timezone at login.
   readonly timezone?: string | null;
-  // BCP-47 tag — threaded into SessionUser.locale at login (fw#2333).
+  // BCP-47 tag — threaded into SessionUser.locale at login.
   readonly locale?: string | null;
-  // JSON-encoded string[] — globale Rollen die parallel zu tenant-membership-
-  // roles gelten (z.B. SystemAdmin, BillingAdmin). Caller deserialisiert via
-  // parseRoles() vor dem Merge in die Session.
+  // JSON-encoded string[] — global roles that apply alongside tenant-membership-
+  // roles (for example, SystemAdmin and BillingAdmin). The caller deserializes
+  // them with parseRoles() before merging them into the session.
   readonly roles?: string | null;
-  // user.status (S2.U1) — "active" | "restricted" | "deletion_requested" |
-  // "deleted". Login.write.ts blockt Restricted (DSGVO Art. 18) sowie
-  // DeletionRequested + Deleted. Untyped string hier weil die Quelle
-  // user-feature-internes Enum ist; auth importiert den Constants-Wert
-  // an der Verwendungsstelle.
+  // user.status — "active" | "restricted" | "deletion_requested" |
+  // "deleted". Login.write.ts blocks Restricted (DSGVO Art. 18),
+  // DeletionRequested, and Deleted. It remains an untyped string because the
+  // source enum is internal to the user feature; auth imports the constants at
+  // the point of use.
   readonly status?: string | null;
 };
 

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -120,13 +120,13 @@ export type AccountLockoutOptions = {
 // (256 bit) and Redis is the source of truth, so tokenTtlMinutes is the only knob.
 export type SignupOptions = SignupRequestOptions;
 
-// Tenant-Invite Magic-Link. Wenn gesetzt, registriert das Feature die
-// invite-create + invite-accept-Handler. Branch 2+3 (anon-flows) kommen
-// als separate Handler in einem Folge-Schritt. tokenTtlMinutes Default
-// 7 Tage (industry standard).
+// Tenant-invite magic link. When set, the feature registers the
+// invite-create and invite-accept handlers. Branches 2 and 3 (anonymous
+// flows) will be added as separate handlers later. The default
+// tokenTtlMinutes is 7 days (industry standard).
 export type InviteOptions = InviteCreateOptions;
 
-// Account-Unlock Magic-Link (#1266). When set, registers the
+// Account-Unlock Magic-Link. When set, registers the
 // request-account-unlock + confirm-account-unlock handlers — the
 // self-service escape hatch for the monotonic lockout counter (see
 // lockout-store.ts). Only meaningful paired with `accountLockout`, but
@@ -180,7 +180,7 @@ export function createAuthEmailPasswordFeature(
     r.describe(
       "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, tenant invite, and account-unlock — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`, `accountUnlock`) to `createAuthEmailPasswordFeature(opts)`. All five magic-link flows dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify/unlock) or opaque-random in Redis (signup/invite). `accountUnlock` is the self-service escape hatch for `accountLockout`'s monotonic failure-counter (#1266): confirming the mailed token clears the Redis lockout state without touching the user entity. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
     );
-    // kumiko-lint-ignore i18n-ui-strings uiHints labels are feature-registry metadata for the admin feature catalog, not yet wired to the i18n system, see #2312
+    // kumiko-lint-ignore i18n-ui-strings uiHints labels are feature-registry metadata for the admin feature catalog, not yet wired to the i18n system
     r.uiHints({
       displayLabel: "Auth \u00b7 Email + Password",
       category: "identity",

package/packages/bundled-features/src/auth-email-password/handlers/change-password.write.ts

@@ -55,9 +55,9 @@ export const changePasswordWrite = defineWriteHandler({
 
     const newHash = await hashPassword(event.payload.newPassword);
 
-    // The user aggregate is systemStream (#497): its event stream lives on
-    // SYSTEM_TENANT_ID deterministically. Pre-#497 scattered streams need the
-    // one-time backfillUserStreamTenants migration (#762).
+    // The user aggregate is systemStream: its event stream lives on
+    // SYSTEM_TENANT_ID deterministically. Previously scattered streams need the
+    // one-time backfillUserStreamTenants migration.
     const writer = createSystemUser(SYSTEM_TENANT_ID);
 
     // Apply via user feature's update handler — writeAs(system) satisfies

package/packages/bundled-features/src/auth-email-password/handlers/confirm-token-flow.ts

@@ -15,11 +15,11 @@
 // else — including future branches a maintainer adds — releases
 // automatically.
 //
-// The user aggregate is systemStream (#497): its event stream lives on
+// The user aggregate uses systemStream: its event stream lives on
 // SYSTEM_TENANT_ID deterministically, so the write targets exactly one
 // stream. The former membership-probing (`tryWriteAcrossTenants`) existed
-// for pre-#497 scattered streams; those need the one-time
-// backfillUserStreamTenants migration (#762) — probing them stopped working
+// for scattered streams; those need the one-time
+// backfillUserStreamTenants migration — probing them stopped working
 // the moment the executor's stream choke-point landed anyway.
 
 import {
@@ -108,8 +108,8 @@ export async function runConfirmTokenFlow<TSuccessData>(
       committed = true;
       return { isSuccess: true, data: spec.successData };
     }
-    // version_conflict = concurrent modification (or an un-migrated pre-#497
-    // stream, see header) → token-level failure. Anything else (DB down,
+    // version_conflict = concurrent modification (or an un-migrated
+    // stream) → token-level failure. Anything else (DB down,
     // access denied) bubbles unchanged so ops sees the real failure class.
     if (writeRes.error.code === "version_conflict") return spec.invalidToken();
     return writeRes;

package/packages/bundled-features/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -191,7 +191,7 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
 
         // Password check against userTable, through the same gates
         // login.write.ts runs (see login-gates.test.ts for the gate contracts).
-        // Email uniqueness is partial on live rows (framework#2593) — without
+        // Email uniqueness is partial on live rows — without
         // this filter the lookup can resolve a soft-deleted row.
         const userRow = await ctx.db.global(userTable).fetchOne<UserAuthRow>({
           email: invitationEmail,

package/packages/bundled-features/src/auth-email-password/handlers/invite-accept.write.ts

@@ -1,19 +1,19 @@
-// Tenant-Invite Step 2 — Branch 1 (logged-in user accepts).
+// Tenant invitation — logged-in user accepts.
 //
-// User ist eingeloggt (in irgendeinem Tenant), klickt Accept-Link.
+// The user is signed in to some tenant and clicks the Accept link.
 // Server:
 //   1. Token → invitationId (Redis)
 //   2. Burn (single-use)
-//   3. Invitation-Row aus DB
-//   4. Email-Match: invitation.email === user.email (sonst inviteEmailMismatch)
+//   3. Load the invitation row from the database
+//   4. Email match: invitation.email === user.email (otherwise inviteEmailMismatch)
 //   5+6. grantInvitedMembershipRole: create the membership, or add the
 //      invited role to an existing one (add-only)
-//   7. Invitation-Row → status=accepted
-//   8. Redis-Keys löschen (Burn-Key bleibt für Replay-Schutz)
+//   7. Invitation row → status=accepted
+//   8. Delete Redis keys (the burn key remains for replay protection)
 //
-// Branch 1 ist der klassische "shared workspace bei eingeloggter
-// Session"-Flow. Branch 2 (anon + existing email) und Branch 3 (anon +
-// new email) kommen als separate Handler.
+// This is the classic "shared workspace with a logged-in session" flow.
+// Branch 2 (anonymous + existing email) and Branch 3 (anonymous + new
+// email) are handled separately.
 
 import {
   createEventStoreExecutor,
@@ -29,7 +29,7 @@ import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/error
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import the invite flow lives in auth-email-password (Magic-Link), while the DB-row owner is a tenant feature
 import {
   INVITATION_STATUS,
   tenantInvitationEntity,
@@ -42,7 +42,7 @@ import {
   grantInvitedGlobalRoles,
   parseInvitedGlobalRoles,
 } from "../../user/invited-global-roles.ts";
-// kumiko-lint-ignore cross-feature-import auth handler reads user-row für email-match
+// kumiko-lint-ignore cross-feature-import the auth handler reads the user row for the email match
 import { userTable } from "../../user/schema/user.ts";
 import { invalidInviteToken, inviteEmailMismatch } from "../errors.ts";
 import {
@@ -138,9 +138,9 @@ export function createInviteAcceptHandler() {
         const invitationRole = invitation.role;
         const invitationVersion = invitation.version;
 
-        // Email-Match: User muss mit der eingeladenen Email matchen.
-        // Sonst kann ein Angreifer mit Zugriff zur invitee-Mail seinen
-        // eigenen Account dem Tenant zuschlagen.
+        // Email match: the user must match the invited email.
+        // Otherwise, anyone with access to the invitee's email could add
+        // their own account to the tenant.
         const userRow = await ctx.db.global(userTable).fetchOne<UserEmailRow>({
           id: event.user.id,
         });
@@ -169,10 +169,10 @@ export function createInviteAcceptHandler() {
         });
         if (!globalGrant.isSuccess) return globalGrant;
 
-        // Invitation-Status → accepted via event-store-executor.
-        // Tenant-scoping: ctx.db ist auf event.user.tenantId gescopt
-        // (= NICHT der invitation-tenant). Eigene TenantDb für den
-        // invitation-tenant bauen damit der executor die row findet.
+        // Invitation status → accepted via event-store-executor.
+        // Tenant scoping: ctx.db is scoped to event.user.tenantId
+        // (not the invitation tenant). Build a TenantDb for the
+        // invitation tenant so the executor can find the row.
         const invitationTdb = createTenantDb({
           db: dbConn,
           tenantId: invitationTenantId,

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -1,10 +1,10 @@
 // Tenant-Invite Step 1 (create).
 //
-// Admin invitet email → DB-Row entsteht via event-store-executor (oder
-// wird re-used bei Re-Invite), Random-Token in Redis bidirektional, und der
-// Handler schickt die Invite-Mail an den Invitee via delivery (ctx.notify) —
-// wie reset/verify/signup. Der Token geht NICHT an den Admin zurück (er soll
-// die Annahme nicht impersonieren können).
+// An admin invites an email address → a DB row is created via
+// event-store-executor (or reused for a re-invite), a random token is stored
+// bidirectionally in Redis, and the handler sends the invite email to the
+// invitee via delivery (ctx.notify), as with reset/verify/signup. The token
+// is NOT returned to the admin, so the admin cannot impersonate acceptance.
 //
 // Re-invite for the same (tenantId, email): the existing row is reused
 // regardless of its prior status (pending/cancelled/accepted), reset to
@@ -12,10 +12,10 @@
 // still live for that invitation is invalidated first, so the previous
 // mail's link stops working (see invite-token-store.ts).
 //
-// Always-200 für unbekannten User: bei invitee-Email die nicht in users
-// existiert wird trotzdem ein Invite erstellt — Branch-3-Accept-Flow
-// erlaubt new-user-signup mit dem Token. Keine Enumeration durchs
-// invite-create.
+// Always-200 for an unknown user: an invite is created even when the
+// invitee's email does not exist in users — the Branch-3-Accept-Flow
+// permits new-user-signup with the token. invite-create does not enable
+// enumeration.
 
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
@@ -35,7 +35,7 @@ import {
 import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import invite flow lives in auth-email-password (Magic-Link-Pattern); DB-row owner is the tenant feature
 import {
   INVITATION_STATUS,
   tenantInvitationEntity,
@@ -77,7 +77,7 @@ export type InviteCreateData = {
 };
 
 export type InviteCreateOptions = {
-  /** TTL für den Activation-Token. Default 7 Tage. */
+  /** TTL for the activation token. Default: 7 days. */
   readonly tokenTtlMinutes?: number;
   /** App page that receives the magic-link; the handler appends `?token=…`
    *  and dispatches the invite mail via delivery (ctx.notify). Apps with
@@ -95,7 +95,7 @@ export type InviteCreateOptions = {
   // further restrict assignable ranked roles.
   readonly canAssignRole?: (inviterRoles: readonly string[], targetRole: string) => boolean;
   /** Opt-in allow-list for app-defined (unranked) roles the elevation guard
-   *  would otherwise reject with unassignable_membership_role (fw#2398).
+   *  would otherwise reject with unassignable_membership_role.
    *  Rank-aware alternative: declare roles via EXT_ASSIGNABLE_ROLE. */
   readonly additionalAssignableRoles?: readonly string[];
 };

package/packages/bundled-features/src/auth-email-password/handlers/invite-info.query.ts

@@ -10,7 +10,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
-// kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
+// kumiko-lint-ignore cross-feature-import invite-flow lives in auth-email-password (Magic-Link), DB-row-owner belongs to the tenant feature
 import { INVITATION_STATUS, tenantInvitationsTable } from "../../tenant/invitation-table.ts";
 // kumiko-lint-ignore cross-feature-import login-style account lookup, same as invite-accept-with-login
 import { userTable } from "../../user/schema/user.ts";

package/packages/bundled-features/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -1,21 +1,21 @@
-// Tenant-Invite Step 2 — Branch 3 (anon User, Email NICHT registriert).
+// Tenant-Invite Step 2 — Branch 3 (anonymous user, email NOT registered).
 //
-// Anders als signup-confirm: KEIN neuer Tenant entsteht. Der Tenant
-// existiert schon (im invitation-row), wir legen NUR User+Membership an.
+// Unlike signup-confirm, no new tenant is created. The tenant already
+// exists in the invitation row; only the user and membership are created.
 //
 // Flow:
-//   1. User klickt Invite-Link → /invite/signup?token=...
-//   2. Frontend zeigt Password-Form (email kommt aus invitation, kein
-//      User-Input damit kein Email-Mismatch möglich)
-//   3. User submitted password + token
+//   1. User clicks the invite link → /invite/signup?token=...
+//   2. The frontend shows the password form (the email comes from the
+//      invitation, not user input, so an email mismatch is impossible)
+//   3. User submits the password and token
 //   4. Server:
 //      a. Token → invitationId → invitation row
-//      b. User-Existence-Check: invitation.email darf NICHT in userTable
-//         existieren (sonst soll Branch 2 oder Branch 1 genutzt werden)
-//      c. Create user (emailVerified=true wegen Magic-Link)
-//      d. Add membership im invited Tenant
-//      e. Invitation → accepted, Token gelöscht
-//   5. Response: SessionUser + tenantId für Auto-Login
+//      b. User-existence check: invitation.email must NOT exist in userTable
+//         (otherwise Branch 2 or Branch 1 must be used)
+//      c. Create the user (emailVerified=true because of the magic link)
+//      d. Add membership to the invited tenant
+//      e. Mark the invitation accepted and delete the token
+//   5. Response: SessionUser + tenantId for automatic login
 
 import {
   createEventStoreExecutor,
@@ -44,7 +44,7 @@ import {
   findForbiddenMembershipRole,
   reservedMembershipRoleError,
 } from "../../tenant/membership-roles.ts";
-// kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
+// kumiko-lint-ignore cross-feature-import membership-seed-helper for privileged cross-tenant addition
 import { seedTenantMembership } from "../../tenant/seeding.ts";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.ts";
@@ -144,20 +144,19 @@ export function createInviteSignupCompleteHandler(opts: InviteSignupCompleteOpti
         const invitationGlobalRoles = parseInvitedGlobalRoles(invitation.globalRoles);
         const invitationVersion = invitation.version;
 
-        // User-Not-Exists-Check: wenn die Email schon registriert ist,
-        // muss der User Branch 2 (acceptWithLogin) nutzen. Hier ist
-        // explizit "neue Email" — sonst hätten wir zwei Wege ein
-        // Password zu setzen für denselben User.
-        // Email uniqueness is partial on live rows (framework#2593) — without
-        // this filter the lookup can resolve a soft-deleted row.
+        // If the email is already registered, the user must use Branch 2
+        // (acceptWithLogin). This flow explicitly requires a new email;
+        // otherwise there would be two ways to set a password for the same user.
+        // Email uniqueness is partial on live rows — without this filter,
+        // the lookup can resolve a soft-deleted row.
         const existingUser = await ctx.db.global(userTable).fetchOne({
           email: invitationEmail,
           isDeleted: false,
         });
         if (existingUser) return invalidInviteToken();
 
-        // User anlegen via seedUserWithPassword (gleiches Pattern wie
-        // signup-confirm), emailVerified=true wegen Magic-Link.
+        // Create the user through seedUserWithPassword so the magic-link flow
+        // records emailVerified=true.
         // @cast-boundary db-runner — helpers use only the query API that
         // DbConnection and DbTx share.
         const dbConn = ctx.db.unsafeRaw() as DbConnection;
@@ -171,9 +170,8 @@ export function createInviteSignupCompleteHandler(opts: InviteSignupCompleteOpti
           ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
         });
 
-        // Membership-Add via seed-helper (gleiches Pattern wie
-        // provisionSignupAccount — bypassed addMember access-check
-        // weil createSystemUser nicht ["SystemAdmin"] matcht).
+        // The seed helper bypasses addMember's access check because
+        // createSystemUser does not match ["SystemAdmin"].
         const forbiddenInviteRole = findForbiddenMembershipRole([invitationRole]);
         if (forbiddenInviteRole !== undefined) {
           return writeFailure(reservedMembershipRoleError(forbiddenInviteRole));
@@ -184,7 +182,7 @@ export function createInviteSignupCompleteHandler(opts: InviteSignupCompleteOpti
           roles: [invitationRole],
         });
 
-        // Invitation → accepted: TenantDb für invitation-tenant
+        // Update the invitation in the invited tenant's database context.
         const invitationTdb = createTenantDb({
           db: dbConn,
           tenantId: invitationTenantId,

package/packages/bundled-features/src/auth-email-password/handlers/login.write.ts

@@ -93,7 +93,7 @@ function ok<T>(value: T): GateOk<T> {
 
 type AuthenticatableUserRow = AuthUserRow & { readonly passwordHash: string };
 
-/** Uniform response on any credential miss — burns argon2 cost (#774). */
+/** Uniform response on any credential miss — burns argon2 cost. */
 export async function gateResolveAuthUser(
   found: AuthUserRow | null,
   password: string,

package/packages/bundled-features/src/auth-email-password/handlers/self-registration-status.query.ts

@@ -18,7 +18,7 @@ export const selfRegistrationStatusQuery = defineQueryHandler({
   description:
     "Reports whether self-registration is currently switched on, readable without signing in, so a signup page can hide its own form instead of collecting an address that would be silently ignored.",
   handler: async (_query, ctx) => {
-    // Same fail-open reasoning as signup-request.write.ts (#1468): only
+    // Same fail-open reasoning as signup-request.write.ts: only
     // report disabled when the toggle feature is actually composed.
     const gated = ctx.registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) !== undefined;
     return { enabled: gated ? await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE) : true };