@cosmicdrift/kumiko-samples 0.385.0 → 0.387.0

package/packages/bundled-features/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -1,23 +1,22 @@
-// Magic-Link-Signup, Step 2 (confirm).
+// Magic-Link signup, step 2 (confirmation).
 //
-// Token aus URL + Password vom User → wir lösen den Token in Redis ein
-// und legen Tenant + User + TenantAdmin membership atomically. emailVerified
-// wird sofort auf true gesetzt — der Magic-Link IST der Beweis.
+// Token from the URL + password from the user → redeem the token in Redis
+// and atomically create the tenant, user, and TenantAdmin membership.
+// emailVerified is set to true immediately—the magic link IS the proof.
 //
 // Pipeline:
 //   1. Redis check: token → email lookup
-//   2. Single-Use-Burn (SETNX) — gleichzeitiger Klick aus zwei Tabs
-//      gewinnt nur einer
-//   3. Tenant-Key generieren (generateUniqueName mit DB-isAvailable-
-//      check gegen tenants.key)
-//   4. provisionSignupAccount: Tenant + User + Membership in einem
-//      Rutsch (durch event-store-executor; events + projection +
-//      MSPs sehen das wie einen regulären create)
-//   5. Token-Keys löschen (burn-key bleibt für TTL-Replay-Protection)
+//   2. Single-use burn (SETNX)—only one of two simultaneous tab clicks wins
+//   3. Generate the tenant key (generateUniqueName with a DB isAvailable
+//      check against tenants.key)
+//   4. provisionSignupAccount: create the tenant, user, and membership in one
+//      operation (through event-store-executor; events, projection, and MSPs
+//      see this as a regular create)
+//   5. Delete the token keys (the burn key remains for TTL replay protection)
 //
-// Failure-Recovery: jeder Pfad nach dem burn checked `committed`-Flag;
-// bei !committed wird der burn released damit ein legitimer Retry
-// nicht durch einen stale Marker geblockt wird (wie reset/verify).
+// Failure recovery: every path after the burn checks the `committed` flag;
+// when !committed, the burn is released so a legitimate retry is not blocked
+// by a stale marker, as with reset/verify.
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
@@ -155,21 +154,21 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
         );
       }
 
-      // Token-Lookup: nicht-existent / abgelaufen / schon konsumiert →
-      // alle collapsen auf invalid_signup_token. Anti-enumeration.
+      // Token lookup: nonexistent, expired, and already-consumed tokens all
+      // collapse to invalid_signup_token to prevent enumeration.
       const email = await getEmailForSignupToken(ctx.redis, event.payload.token);
       if (!email) return invalidSignupToken();
 
-      // Single-Use-Burn: zwei parallele Confirms aus verschiedenen
-      // Tabs — einer wins, der andere kriegt invalid_signup_token.
+      // Single-use burn: of two parallel confirmations from different tabs,
+      // one succeeds and the other receives invalid_signup_token.
       const burn = await burnSignupToken(ctx.redis, event.payload.token);
       if (burn === "already-used") return invalidSignupToken();
 
       let committed = false;
       try {
-        // Tenant-Key: 2-Wort-Slug aus framework/random, mit DB-Conflict-
-        // Check gegen tenants.key. 22.500 Default-Combos + Suffix-
-        // Fallback bei Kollision (siehe generateUniqueName).
+        // Tenant key: a two-word slug from framework/random, with a DB conflict
+        // check against tenants.key. 22,500 default combinations plus a
+        // suffix fallback in case of collision (see generateUniqueName).
         // @cast-boundary db-runner — helpers use only the query API that
         // DbConnection and DbTx share.
         const dbConn = ctx.db.unsafeRaw() as DbConnection;
@@ -182,8 +181,8 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
         });
 
         const tenantId = generateId() as TenantId; // @cast-boundary engine-payload
-        // Display-Name aus email-prefix als sinnvolles Default; User kann
-        // den Tenant-Namen + sein eigenes displayName später ändern.
+        // Use the email prefix as a meaningful default display name; the user can
+        // change the tenant name and their own displayName later.
         const displayName = email.split("@")[0] ?? email;
 
         const registrationLocale = registrationLocaleFromRequest();
@@ -202,25 +201,24 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
               tenantName: tenantKey,
               ...registrationLocale,
             },
-            // #1463: seedTenant's postSave hooks (tier-engine's auto-default-
+            // seedTenant's postSave hooks (tier-engine's auto-default-
             // tier, an app's auto-default-compliance) must fire on self-signup
             // exactly like they do on the regular TenantHandlers.create path.
             { registry: ctx.registry, context: ctx },
           );
         } catch (err) {
-          // Email hat bereits ein Konto — provisionSignupAccount ist create-only
-          // (#365): sauberer User-Fehler, KEINE Session für den fremden Account.
-          // committed bleibt false → der burn wird im finally released (ein
-          // Retry scheitert wieder gleich, kein stale-Marker-Block).
+          // The email already has an account—provisionSignupAccount is create-only:
+          // return a clean user error and never create a session for that account.
+          // committed remains false, so finally releases the burn; a retry fails
+          // the same way without being blocked by a stale marker.
           if (err instanceof ConflictError) return signupEmailAlreadyRegistered();
           throw err;
         }
 
-        // SessionUser für JWT-Mint. Roles aus INITIAL_SIGNUP_ROLES
-        // damit DB-write (provisionSignupAccount) und Session-claim
-        // dieselbe Quelle teilen — sonst hätten zwei Stellen "TenantAdmin"
-        // hardcoded und ein Refactor würde role-mismatch zwischen DB
-        // und JWT erzeugen.
+        // Build the SessionUser for JWT minting. Use roles from INITIAL_SIGNUP_ROLES
+        // so the database write (provisionSignupAccount) and session claim share
+        // one source; otherwise two hardcoded "TenantAdmin" values could drift
+        // during a refactor and create a role mismatch between the DB and JWT.
         const session: SessionUser = {
           id: provisioned.userId,
           tenantId: provisioned.tenantId,
@@ -278,9 +276,8 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
         };
       } finally {
         if (!committed && ctx.redis) {
-          // Burn-release damit ein retry nach DB-Hiccup nicht blockt.
-          // Token-Lookup-Keys bleiben — der User kann seinen Mail-Link
-          // erneut klicken.
+          // Release the burn so a retry after a DB hiccup is not blocked.
+          // Keep the token lookup keys so the user can click the email link again.
           await unburnSignupToken(ctx.redis, event.payload.token);
         }
       }

package/packages/bundled-features/src/auth-email-password/handlers/signup-request.write.ts

@@ -15,7 +15,7 @@
 // Always-200 (enumeration-safe): the response looks the same for every
 // email, whether it's already registered or not. An email CAN already have
 // an account (seeding or an earlier signup) — the actual gate sits
-// deliberately in the confirm step (#365): signup-confirm rejects an
+// deliberately in the confirm step: signup-confirm rejects an
 // already-registered email instead of reusing the existing user. Here it
 // stays always-200 + resend-idempotent so the request path leaks nothing;
 // suppressing the link on the request side would be defense-in-depth, but
@@ -34,10 +34,9 @@ import { storeSignupHandover, takeOverSignupHandoverForResend } from "../signup-
 
 const SignupRequestSchema = z.object({
   email: z.email(),
-  // Cross-device try-first handover (kumiko-framework#3035 follow-up,
-  // offlot-app#454) — see shared/signup-handover.ts for why the grant is
-  // verified here and rebound to the signup token instead of the client
-  // carrying it through the activation link.
+  // Cross-device try-first handover: see shared/signup-handover.ts for why the
+  // grant is verified here and rebound to the signup token instead of the
+  // client carrying it through the activation link.
   handover: z
     .object({
       entityType: z.string().min(1),
@@ -96,8 +95,8 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
       // ctx.hasFeature() is fail-closed for *unregistered* names the moment
       // feature-toggles/tier-engine is wired, which silently kills
       // self-signup for every existing app that mounts auth-email-password
-      // without also composing createAuthSelfRegistrationToggleFeature()
-      // (#1468). Only gate when the toggle actually exists.
+      // without also composing createAuthSelfRegistrationToggleFeature().
+      // Only gate when the toggle actually exists.
       const gated = ctx.registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) !== undefined;
       if (gated && !(await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE))) {
         // No email address here — this fires on every no-op request, PII

package/packages/bundled-features/src/auth-email-password/handlers/switch-tenant-mfa-gate.write.ts

@@ -3,7 +3,6 @@ import {
   createSystemUser,
   defineWriteHandler,
   SYSTEM_ROLE,
-  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -14,10 +13,7 @@ import { gateEnforceMfa, type LoginHandlerOptions } from "./login.write.ts";
 
 const SwitchTenantMfaGateSchema = z.object({
   userId: z.string().min(1),
-  tenantId: z
-    .string()
-    .min(1)
-    .transform((id) => id as TenantId),
+  tenantId: z.string().min(1),
 });
 
 export type SwitchTenantMfaGateData =

package/packages/bundled-features/src/auth-email-password/index.ts

@@ -35,11 +35,11 @@ export {
   AUTH_SELF_REGISTRATION_FEATURE,
   createAuthSelfRegistrationToggleFeature,
 } from "./self-registration-toggle.ts";
-// Generic HMAC-signed single-purpose token helpers. Re-exported damit
-// app-spezifische out-of-band-Flows (subscriber-confirm, magic-links,
-// invite-tokens) denselben battle-tested signer/verifier nutzen können
-// statt eigene HMAC-Logik zu duplizieren. Purpose-string diskriminiert
-// Cross-Replay zwischen Flows.
+// Generic HMAC-signed single-purpose token helpers. Re-exported so
+// app-specific out-of-band flows (subscriber-confirm, magic-links,
+// invite-tokens) can use the same battle-tested signer/verifier
+// instead of duplicating HMAC logic. The purpose string prevents
+// cross-replay between flows.
 export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.ts";
 export {
   type IssuedSignupActivation,

package/packages/bundled-features/src/auth-email-password/lockout-store.ts

@@ -17,7 +17,7 @@
 // semantics) live in shared/lockout-counter.ts — this file only wires the
 // account-lockout key prefixes onto it. See that file for why a lock
 // re-arms immediately after expiry, and why a successful login (or the
-// account-unlock magic-link flow, #1266, see
+// account-unlock magic-link flow in
 // handlers/confirm-account-unlock.write.ts) is what resets the streak.
 
 import { createLockoutCounter, type LockoutCounterState } from "../shared/index.ts";

package/packages/bundled-features/src/auth-email-password/seeding.ts

@@ -1,16 +1,16 @@
-// Stable seeding helpers fürs auth-email-password-Feature. Liegen unter
-// `/seeding` (nicht `/testing`) damit der Vertrag klar ist: hier ist
-// non-test code der bei jedem Dev-Boot + jedem Integration-Test läuft.
-// Test-spezifische Variationen (account-locked-Setup, expired-token,
-// race-conditions) werden NICHT als Knöpfe an diesen Helpers angebaut —
-// sie kommen als neue Funktionen daneben oder inline ins Test-File.
+// Stable seeding helpers for the auth-email-password feature. They live under
+// `/seeding` rather than `/testing` to make the contract clear: this is
+// non-test code that runs on every dev boot and integration test.
+// Test-specific variations (account-locked setup, expired-token,
+// race-conditions) are NOT added as options to these helpers —
+// they belong in separate functions or inline in the test file.
 //
-// Bündelt drei Schritte in einem Aufruf:
-//   1. argon2-Hash des Plain-Passworts
-//   2. seedUser() aus user/seeding
-//   3. seedTenant + seedTenantMembership aus tenant/seeding
-// Damit Sample-Server und Tests keine drei sub-paths zusammensammeln
-// müssen.
+// Bundles three steps into one call:
+//   1. argon2 hash of the plaintext password
+//   2. seedUser() from user/seeding
+//   3. seedTenant + seedTenantMembership from tenant/seeding
+// This keeps sample servers and tests from having to assemble three
+// sub-paths themselves.
 
 import {
   configuredBlindIndexKey,
@@ -38,10 +38,10 @@ import {
 
 const log = createFallbackLogger("auth-email-password-seeding");
 
-// Re-export für ergonomische Single-Import-Site in tests/seed-scripts.
-// Das Auth-Feature ist der natürliche Aufrufer für "seed admin user mit
-// password + tenant + membership" — wer das nutzt soll nicht aus drei
-// verschiedenen sub-paths zusammensammeln müssen.
+// Re-export for a convenient single import site in tests/seed-scripts.
+// The auth feature is the natural caller for "seed admin user with
+// password + tenant + membership", so consumers do not need to assemble
+// these helpers from three different sub-paths.
 // kumiko-lint-ignore cross-feature-import re-export of test-helpers
 export { seedTenant, seedTenantMembership } from "../tenant/seeding.ts";
 // kumiko-lint-ignore cross-feature-import re-export of test-helpers
@@ -52,24 +52,24 @@ export type SeedUserWithPasswordOptions = {
   readonly password: string;
   readonly displayName: string;
   readonly locale?: string;
-  /** Globale Rollen — siehe SeedUserOptions.roles. */
+  /** Global roles — see SeedUserOptions.roles. */
   readonly roles?: readonly string[];
-  /** Initial-emailVerified-Flag. Default false (Verify-Flow läuft).
-   *  Magic-Link-Signup setzt true weil der Mail-Klick die Email-
-   *  Ownership beweist. Siehe SeedUserOptions.emailVerified. */
+  /** Initial emailVerified flag. Defaults to false (the verification flow runs).
+   *  Magic-link signup sets it to true because clicking the email proves
+   *  ownership. See SeedUserOptions.emailVerified. */
   readonly emailVerified?: boolean;
   readonly by?: SessionUser;
 };
 
 /**
- * Seed a user mit Plain-Password (wird vor dem Insert mit argon2
- * gehasht). Liefert die userId, idempotent über email.
+ * Seed a user with a plaintext password (hashed with argon2 before insertion).
+ * Returns the userId and is idempotent by email.
  */
 export async function seedUserWithPassword(
   db: DbConnection,
   options: SeedUserWithPasswordOptions,
   // Optional, append-only — same rationale as provisionSignupAccount's
-  // hooks param (#1478): the self-signup path passes it through so `user`'s
+  // hooks param: the self-signup path passes it through so `user`'s
   // postSave hooks fire on self-signup same as on the regular create path.
   hooks?: SeedTenantHooks,
 ): Promise<{ id: string }> {
@@ -89,38 +89,36 @@ export async function seedUserWithPassword(
   );
 }
 
-/** Provisioning-Helper für Self-Signup-Confirm. Legt einen frischen
- *  Tenant + Admin-User + Membership in einem Rutsch an — verwendet die
- *  bestehende Event-Store-Pipeline (wie seedAdmin) und ist daher
- *  konsistent mit dem regulären create-Pfad: events werden geschrieben,
- *  Projections sind populated, MSPs/Audit sehen die neuen Rows.
+/** Provisions a fresh tenant, admin user, and membership for self-signup
+ *  confirmation in one operation. It uses the existing event-store pipeline
+ *  (as seedAdmin), keeping it consistent with the regular create path:
+ *  events are written, projections are populated, and MSPs/audit see the
+ *  new rows.
  *
- *  Naming-Hinweis: nutzt intern `seedTenant` / `seedUser*` —
- *  diese Helpers sind production-grade (event-store-pipeline), das "seed"
- *  im Namen ist historisch (zuerst für Tests + Bootstrap gebaut, dann
- *  als General-Purpose-Helper exportiert). Rename `seed*` → `provision*`
- *  ist als dedizierter Cleanup-PR geplant — disproportional zum Wert
- *  innerhalb dieses Sprints, weil alle existing tests berührt würden.
+ *  Naming note: internally uses `seedTenant` / `seedUser*`; these helpers are
+ *  production-grade (event-store pipeline), and "seed" is historical because
+ *  they were first built for tests and bootstrap before being exported as
+ *  general-purpose helpers.
  *
- *  Atomicity: läuft inside einer Drizzle-Tx wenn der Caller das angibt
- *  (db.begin(tx => provisionSignupAccount(tx, ...)) — die seed-
- *  helpers nehmen DbConnection|DbTx strukturell. Bei pure DbConnection
- *  sind die 3 writes nicht atomic; bei Failure zwischen Schritten kann
- *  ein orphan-Tenant zurückbleiben (Tenant ohne User → unused row;
- *  User ohne Membership → "no_membership" beim ersten Login).
+ *  Atomicity: runs inside a Drizzle transaction when the caller provides one
+ *  (db.begin(tx => provisionSignupAccount(tx, ...)); the seed helpers accept
+ *  DbConnection|DbTx structurally. With a plain DbConnection, the three writes
+ *  are not atomic; a failure between steps can leave an orphan tenant (tenant
+ *  without a user → unused row; user without a membership → "no_membership"
+ *  on first login).
  *
- *  Create-only: existiert bereits ein User mit dieser Email (Seeding oder
- *  früherer Signup), wirft die Funktion einen ConflictError BEVOR ein Tenant
- *  entsteht. Der Self-Signup-Pfad darf einen bestehenden User nicht still
- *  wiederverwenden — sonst würde der Confirm-Schritt eine Session für ihn
- *  minten (Account-Takeover, #365). `seedUser` selbst bleibt idempotent
- *  add-only (für Bootstrap/Tests); die create-only-Garantie sitzt hier.
- *  tenantKey-Kollisionen löst der Caller via generateUniqueName. */
+ *  Create-only: if a user with this email already exists (from seeding or an
+ *  earlier signup), the function throws a ConflictError BEFORE creating a
+ *  tenant. The self-signup path must not silently reuse an existing user —
+ *  otherwise the confirmation step could mint a session for that user
+ *  (account takeover). `seedUser` itself remains idempotent and add-only
+ *  (for bootstrap/tests); the create-only guarantee belongs here.
+ *  The caller resolves tenantKey collisions via generateUniqueName. */
 /** Default membership roles for self-signup tenant owners. Shared between
- *  provisionSignupAccount (DB-write) und signup-confirm-handler
- *  (SessionUser-Konstruktion für JWT-Mint) — sonst hätten zwei
- *  Stellen unabhängig "TenantAdmin" hardcoded und würden bei einem
- *  Refactor zu role-mismatch zwischen DB und Session leiden. */
+ *  provisionSignupAccount (DB write) and signup-confirm-handler
+ *  (SessionUser construction for JWT minting); otherwise two locations would
+ *  independently hardcode "TenantAdmin" and a refactor could cause a role
+ *  mismatch between the database and the session. */
 // TenantAdmin is the canonical owner role; Admin stays for handlers that still
 // gate on the legacy literal until those call sites move to access.admin.
 export const INITIAL_SIGNUP_ROLES = ["TenantAdmin", "Admin"] as const;
@@ -142,17 +140,17 @@ export async function provisionSignupAccount(
   options: ProvisionSignupAccountOptions,
   // Optional, append-only — existing callers (tests, seed scripts) that
   // don't pass hooks keep today's behavior. The real signup-confirm
-  // handler DOES pass it (#1463) so seedTenant/seedUserWithPassword/
+  // handler DOES pass it so seedTenant/seedUserWithPassword/
   // seedTenantMembership's postSave hooks (tier-engine's auto-default-tier,
   // app auto-default-compliance, a Welcome-notification hook, ...) fire on
   // self-signup for all three entities, same as they do on the regular
-  // create paths (#1478 — this was only wired for tenant before).
+  // create paths — this was only wired for tenant before.
   hooks?: SeedTenantHooks,
 ): Promise<{ readonly userId: string; readonly tenantId: TenantId }> {
   // Create-only guard BEFORE seedTenant: hard-abort on an already-registered
   // email, otherwise an orphaned tenant would be created and seedUser
   // (idempotent add-only) would silently return the existing userId ->
-  // confirm mints a session for the wrong account (#365).
+  // confirm mints a session for the wrong account.
   // isDeleted: false — the partial bidx unique index only covers live rows,
   // so a soft-deleted row must not block re-registering its email.
   const existingUser = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
@@ -195,20 +193,19 @@ export type SeedAdminOptions = {
   readonly email: string;
   readonly password: string;
   readonly displayName: string;
-  /** Tenants, in die der Admin als Mitglied eingetragen wird. Pro
-   *  Tenant kann eine eigene Rollenliste gesetzt werden — hilft beim
-   *  Sample-TenantSwitcher der pro Tenant unterschiedliche
-   *  Rollen-Listen zeigt. */
+  /** Tenants where the admin is added as a member. Each tenant can have
+   *  its own role list, which lets the sample TenantSwitcher show different
+   *  role lists for each tenant. */
   readonly memberships: ReadonlyArray<{
     readonly tenantId: TenantId;
     readonly tenantKey: string;
     readonly tenantName: string;
     readonly roles: readonly string[];
   }>;
-  /** Globale Rollen die in users.roles landen — tenant-unabhängig.
-   *  Login-Handler mergt sie in jede Session parallel zu den tenant-
-   *  membership-Rollen. Typischer use-case: `["SystemAdmin"]` für
-   *  einen Plattform-Operator. Default: leer. */
+  /** Global roles stored in users.roles, independent of the tenant.
+   *  The login handler merges them into every session alongside the tenant
+   *  membership roles. Typical use case: `["SystemAdmin"]` for a platform
+   *  operator. Default: empty. */
   readonly globalRoles?: readonly string[];
   /** Initial emailVerified state — defaults to false (unverified). Same
    *  mechanism as seedUserWithPassword.emailVerified. Re-running the seed
@@ -219,9 +216,9 @@ export type SeedAdminOptions = {
 };
 
 /**
- * Seed-Convenience für Sample-Server: Admin-User mit gehashtem
- * Password + N Tenants + N Memberships. Alles idempotent (Re-Run im
- * persistent-DB-Modus läuft durch). Liefert die userId zurück.
+ * Seeding convenience for sample servers: an admin user with a hashed
+ * password, N tenants, and N memberships. Idempotent, so rerunning it in
+ * persistent-DB mode succeeds. Returns the userId.
  */
 export async function seedAdmin(
   db: DbConnection,
@@ -254,7 +251,7 @@ export async function seedAdmin(
   return { id: userId };
 }
 
-// offlot#114 — seedAdmin's idempotency check is a plain fetchOne(email),
+// seedAdmin's idempotency check is a plain fetchOne(email),
 // which the query layer rewrites into `(email = $plaintext OR
 // email_bidx = $hmac)` once a blind-index key is configured. Under KMS
 // encryption `email` holds per-row ciphertext, so only the bidx arm can

package/packages/bundled-features/src/auth-email-password/signup-token-store.ts

@@ -79,14 +79,14 @@ export async function deleteSignupToken(
  *  retry isn't blocked by a stale burn marker. */
 export const unburnSignupToken = store.unburn;
 
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): signup-request binds a verified tenant-handover grant to
-// its own signup token, in a SIBLING Redis namespace keyed the same way
-// (sha256(token)) so it stays byte-compatible with the token store above
-// without going through it — the binding has its own lifecycle (survives a
-// resend, is read once by signup-confirm) that doesn't fit the token↔email
-// pairing. Only {entityType, rowId, sourceTenantId} is ever stored — never
-// the grant token or the email (see shared/signup-handover.ts).
+// Cross-device try-first handover:
+// signup-request binds a verified tenant-handover grant to its own signup token,
+// in a SIBLING Redis namespace keyed the same way (sha256(token)) so it stays
+// byte-compatible with the token store above without going through it — the
+// binding has its own lifecycle (survives a resend, is read once by
+// signup-confirm) that doesn't fit the token↔email pairing. Only
+// {entityType, rowId, sourceTenantId} is ever stored — never the grant token
+// or the email (see shared/signup-handover.ts).
 const SIGNUP_HANDOVER_KEY_PREFIX = "signup:handover:";
 
 const signupHandoverBindingSchema = z.object({

package/packages/bundled-features/src/auth-email-password/testing.ts

@@ -1,5 +1,5 @@
-// /testing re-exportiert /seeding. Siehe ../tenant/testing.ts für die
-// Begründung — Helpers sind shared zwischen Tests und Dev-Server-
-// Bootstrap, /seeding ist die stabile Heimat.
+// /testing re-exports /seeding. See ../tenant/testing.ts for the reason:
+// Helpers are shared between tests and Dev-Server bootstrap, so /seeding is
+// the stable home.
 
 export * from "./seeding.ts";