@cosmicdrift/kumiko-samples 0.385.0 → 0.387.0

package/packages/bundled-features/src/personal-access-tokens/roles.ts

@@ -12,8 +12,8 @@ import { isPrincipalRowBlocked, type UserStatus, userTable } from "../user/index
 // time would keep a since-revoked admin role for the token's whole (months-long)
 // life. Returns null when the user has no membership in that tenant: removed
 // from the tenant → the PAT stops authenticating there. Also null when the
-// user's lifecycle status blocks them (fw security-welle2) — collapsed onto
-// the same "no roles" outcome as missing-membership so a blocked user's PAT
+// user's lifecycle status blocks them — collapsed onto the same "no roles"
+// outcome as missing-membership so a blocked user's PAT
 // gets an identical 401 to an unknown token (no status oracle).
 export async function resolvePatRoles(
   db: DbConnection,

package/packages/bundled-features/src/readiness/handlers/status.query.ts

@@ -22,9 +22,9 @@ export const statusQuery = defineQueryHandler({
     // One gate for both halves: required keys/secrets of provider-features
     // count only while their provider is the selected one (r.extensionSelector).
     const gate = await buildProviderSelectionGate(ctx, ReadinessQueries.status, query.user, ctx.db);
-    // skipAccessFilter: das Verdict muss ALLE required Keys zählen — der
-    // Handler selbst ist TenantAdmin-gated, der Per-Key-Filter wäre hier
-    // eine ready:true-Lüge für SystemAdmin-gated Keys (277/1).
+    // skipAccessFilter: the verdict must count ALL required keys—the
+    // Handler itself is TenantAdmin-gated; the per-key filter would falsely
+    // report ready:true for SystemAdmin-gated keys.
     const missingConfig = await collectMissingRequiredConfig(
       ctx,
       ReadinessQueries.status,

package/packages/bundled-features/src/renderer-foundation/api.ts

@@ -1,7 +1,7 @@
-// RendererFoundationApi — Cross-Feature-Schnittstelle. Konsumenten
-// (delivery, mail-Sender, Solon NKA-PDF-Generator) holen sich pro
-// Render-Call den passenden Plugin via `createRendererForTenant`.
-// Pattern symmetrisch zu ai-foundation's `createLLMProviderForTenant`.
+// RendererFoundationApi — cross-feature interface. Consumers
+// (delivery, mail sender, Solon NKA PDF generator) retrieve the appropriate
+// plugin for each render call via `createRendererForTenant`.
+// The pattern mirrors ai-foundation's `createLLMProviderForTenant`.
 
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -32,10 +32,9 @@ export type RendererFoundationApi = {
   }) => RendererPlugin;
 };
 
-// Plugin-Pool wird zur Boot-Zeit aus Extension-Usages aufgebaut.
-// Aus dem Registry kommen alle registrierten Plugins. Foundation-Feature
-// baut den Pool via `collectRendererPlugins(registry)` und steckt das
-// Result in extraContext.
+// The plugin pool is built at boot time from extension usages.
+// The registry provides all registered plugins. The foundation feature builds
+// the pool via `collectRendererPlugins(registry)` and puts it in extraContext.
 export function createRendererFoundationApi(
   plugins: ReadonlyArray<RendererPlugin>,
   tenantConfigLookup: (tenantId: TenantId) => Record<string, string> | null = () => null,
@@ -50,7 +49,7 @@ export function createRendererFoundationApi(
       if (tenantPluginName) {
         const plugin = plugins.find((p) => p.name === tenantPluginName && p.kinds.includes(kind));
         if (plugin) return plugin;
-        // Tenant-Config zeigt auf nicht-registriertes Plugin — fällt durch zu Default
+        // The tenant configuration points to an unregistered plugin; fall through to the default.
       }
 
       // 2. Default-Plugin
@@ -60,7 +59,7 @@ export function createRendererFoundationApi(
         if (plugin) return plugin;
       }
 
-      // 3. Erstes Plugin im Pool das das kind bedient
+      // 3. First plugin in the pool that serves the kind
       const first = byKind.get(kind)?.[0];
       if (first) return first;
 
@@ -85,14 +84,14 @@ function indexByKind(plugins: ReadonlyArray<RendererPlugin>): Map<RenderKind, Re
   return map;
 }
 
-// Single point of truth für "dieser Handler braucht renderer-foundation".
-// Pattern symmetrisch zu requireTemplateResolver + requireTextContent.
+// Single source of truth for handlers that require renderer-foundation.
+// The pattern mirrors requireTemplateResolver + requireTextContent.
 export function requireRendererFoundation(
   ctx: { readonly rendererFoundation?: RendererFoundationApi } | object,
   callerName: string,
 ): RendererFoundationApi {
   // @cast-boundary engine-bridge — rendererFoundation kommt per extraContext
-  // aus App-Bootstrap.
+  // from the app bootstrap.
   const api = (ctx as { rendererFoundation?: RendererFoundationApi }).rendererFoundation;
   if (!api) {
     throw new InternalError({

package/packages/bundled-features/src/renderer-foundation/constants.ts

@@ -14,8 +14,8 @@ export {
   type RenderKind,
 } from "../template-resolver/index.ts";
 
-// Standard-Default-Plugin pro Kind, wenn Tenant keine explizite Config
-// gesetzt hat. App-Bootstrap kann das via TenantConfigKey überschreiben.
+// Standard default plugin for each kind when the tenant has not set explicit configuration.
+// App bootstrap can override this through TenantConfigKey.
 export const DEFAULT_PLUGIN_BY_KIND: Readonly<Record<RenderKindLocal, string>> = {
   mail: "mail-html",
   "document-pdf": "puppeteer",

package/packages/bundled-features/src/renderer-foundation/feature.ts

@@ -24,9 +24,9 @@ export function createRendererFoundationFeature() {
 
     r.extendsRegistrar(RENDERER_EXTENSION, {
       onRegister: () => {
-        // Plugin-Konformitäts-Check könnte hier: shape-validation der
-        // options (kinds, render-Funktion present). Aktuell kein
-        // shape-check — Caller's TypeScript-Type-Sicherheit greift.
+        // Plugin conformance check could go here: validate the shape of
+        // options (kinds, render function present). No shape check currently —
+        // the caller's TypeScript type safety applies.
       },
     });
 
@@ -34,11 +34,11 @@ export function createRendererFoundationFeature() {
   });
 }
 
-// Plugin-Pool-Aufbau zur Boot-Zeit. App-Bootstrap ruft das nach
-// Feature-Registration auf, baut den Pool, gibt ihn via extraContext
-// an die Handlers weiter.
+// Build the plugin pool at boot time. App bootstrap calls this after
+// feature registration, builds the pool, and passes it to handlers via
+// extraContext.
 //
-// Symmetrisch zu collectChannels / collectRenderers in delivery-service.
+// Symmetric to collectChannels / collectRenderers in delivery-service.
 export function collectRendererPlugins(registry: Registry): RendererPlugin[] {
   const usages = registry.getExtensionUsages(RENDERER_EXTENSION);
   return usages.map((usage) => {

package/packages/bundled-features/src/renderer-foundation/types.ts

@@ -10,9 +10,9 @@ import type {
 } from "../template-resolver/index.ts";
 import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.ts";
 
-// RenderRequest — Plugins erhalten das. Resource-Mode wählt der Caller
-// (renderer-foundation api) je nach kind oder explizit. Plugin selbst
-// entscheidet nicht — es bekommt eine schon aufgelöste Form.
+// RenderRequest — plugins receive this. The caller selects resource mode
+// (renderer-foundation API) by kind or explicitly. Plugins do not decide this;
+// they receive an already-resolved form.
 export type RenderRequest =
   | { kind: "mail"; payload: MailPayload }
   | { kind: "document-pdf"; payload: DocumentPdfPayload; options?: PdfOptions }
@@ -157,13 +157,12 @@ export type ImageOptions = {
   readonly quality?: number;
 };
 
-// RendererContext — schmale Surface (Kumiko-Style, matcht FileProviderContext
-// + ChannelContext). Plugins, die Service-Access brauchen, holen sich
-// templateResolver/etc. via direkten Bundle-Import + ctx.db (cross-feature-
-// public-API). KEIN extraContext-Pass-Through — Plugin importiert pure-
-// Function-Factories statt App-ctx zu casten.
+// RendererContext — a narrow surface (Kumiko-style, matching FileProviderContext
+// + ChannelContext). Plugins that need services obtain templateResolver/etc. via
+// direct bundle imports + ctx.db (cross-feature public API). No extraContext
+// pass-through: plugins import pure function factories instead of casting App-ctx.
 //
-// **Beispiel renderer-mail-html:**
+// **Example renderer-mail-html:**
 //   import { createTemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 //   const tplApi = createTemplateResolverApi(ctx.db, ctx.registry);
 //   const layout = await tplApi.resolveTemplate({ tenantId: ctx.tenantId, slug, kind });
@@ -178,9 +177,9 @@ export type RendererContext = {
   readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
 };
 
-// RendererPlugin-Contract — pro Plugin (renderer-mail-html,
-// renderer-puppeteer-client). Plugin deklariert welche kinds es bedienen
-// kann; Foundation-Resolver wählt basierend auf Tenant-Config + kind.
+// RendererPlugin contract — per plugin (renderer-mail-html,
+// renderer-puppeteer-client). The plugin declares which kinds it can handle;
+// the Foundation resolver selects one based on tenant config + kind.
 //
 // Plugin invariants:
 // - `kinds` has at least one entry, otherwise the plugin is never picked.

package/packages/bundled-features/src/secrets/feature.ts

@@ -71,15 +71,15 @@ export const JOIN_REQUEST_TRANSACTION_REASON =
   "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 
 // AppContext carries ctx.secrets via extraContext. requireSecretsContext
-// wraps that raw context so every `.get(...)` call auto-includes the
-// current user + handler as audit metadata — feature code can't forget
-// to log the read (silent bypass of audit was the v1 gap).
+// wraps that raw context so every `.get(...)` call automatically includes
+// the current user and handler as audit metadata, preventing feature code
+// from silently bypassing read auditing.
 //
-// Surface bewusst minimal: HandlerContext-Pfade (Set/Delete-Handler) +
-// FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
-// zwei Felder, also reicht die schmale ctx-shape — kein voller
-// HandlerContext-Import noetig.
-// Handler contexts carry the caller as ctx.user, provider contexts set auditUserId (takes precedence).
+// The context shape stays minimal: HandlerContext paths (Set/Delete handlers)
+// and FileProviderContext paths (the S3 plugin in the worker) provide the same
+// two fields, so importing the full HandlerContext is unnecessary.
+// Handler contexts carry the caller as ctx.user; provider contexts set
+// auditUserId, which takes precedence.
 export function requireSecretsContext(
   ctx: {
     readonly secrets?: SecretsContext;
@@ -181,7 +181,7 @@ export function createSecretsFeature(
     // Backing table: envelope/metadata/last_rotated_at + the (tenant,key)
     // uniqueIndex are not expressible via the field-DSL (jsonb-without-default,
     // now()-default), so the physical table is the DDL truth. Without this the
-    // generated migration omitted those columns → prod-500 (publicstatus#116).
+    // generated migration omitted those columns → prod-500.
     r.entity({ name: "tenant-secret", ...tenantSecretEntity, backingTable: tenantSecretsTable });
 
     // Read-audit domain-event. Registered here so ops tools + MSPs can

package/packages/bundled-features/src/secrets/web/constants.ts

@@ -1,9 +1,9 @@
-// secrets bundle constants — default RBAC for set/delete/list (#2296).
+// secrets bundle constants — default RBAC for set/delete/list.
 
 import type { AccessRule } from "@cosmicdrift/kumiko-framework/engine";
 
 // Default-RBAC of the set/delete/list handlers, hard-wired to ["TenantAdmin"]
-// before #2296. Apps with their own role vocabulary override via
+// before this default was established. Apps with their own role vocabulary override via
 // createSecretsFeature({ roles }) or createSecretsFeature({ access }) — the
 // rotate job stays untouched, it's a manual/ops path across all tenants by
 // design, not a per-tenant RBAC surface.

package/packages/bundled-features/src/seo/feature.ts

@@ -1,4 +1,4 @@
-// kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312 (feature.ts > 300 lines)
+// kumiko-lint-ignore app-feature-structure feature.ts is over 300 lines and not yet split
 import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
 import {
   defineFeature,
@@ -274,8 +274,8 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       });
     }
 
-    // Boot-Check body als named function extrahiert — direkt unit-testbar,
-    // gleiches "thin job-shell ruft testable function"-Pattern wie
+    // Boot-check body extracted as a named function—directly unit-testable,
+    // following the same "thin job-shell calls testable function" pattern as
     // legal-pages' runLegalPagesBootCheck.
     r.job(
       "seo-boot-check",

package/packages/bundled-features/src/sessions/constants.ts

@@ -9,7 +9,7 @@ export const SessionHandlers = {
   revoke: "sessions:write:user-session:revoke",
   revokeAllOthers: "sessions:write:user-session:revoke-all-others",
   /** Privileged: System-Caller (cross-feature) revokes ALL live sessions
-   *  fuer einen User. Genutzt von user-data-rights:restrict-account
+   *  for a user. Used by user-data-rights:restrict-account
    *  (DSGVO Art. 18 Account-Freeze). */
   revokeAllForUser: "sessions:write:user-session:revoke-all-for-user",
 } as const;

package/packages/bundled-features/src/sessions/feature.ts

@@ -51,7 +51,7 @@ export type SessionsFeatureOptions = {
   // runtime binding.
   readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
   // Session JWT / store_user_sessions TTL. Was previously auth.sessions.expiresInMs
-  // (#1372) — lives on the sessions feature now that sessionStore is the wiring.
+  // — lives on the sessions feature now that sessionStore is the wiring.
   readonly expiresInMs?: number;
   // Access preset for the admin list/detail queries and screens; they expose decrypted
   // IP/user-agent of every session in the tenant. A preset name, not a role array, because
@@ -119,23 +119,23 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       // events (the row columns ARE the audit trail). Registering it as
       // r.entity would make it a rebuildable implicit projection whose replay
       // finds zero session events and swaps an empty shadow over the live
-      // table — wiping every active session on the next projection rebuild
-      // (#498/#494). r.storeTable keeps the migration DDL but opts the
+      // table — wiping every active session on the next projection rebuild.
+      // r.storeTable keeps the migration DDL but opts the
       // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
       // which are direct-write stores too.
       r.storeTable(
         deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, { source: "unmanaged" }),
         {
           reason: "read_side.user_sessions_direct_write",
-          // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
+          // sessionCreator encrypts ip/userAgent via encryptForDirectWrite.
           piiEncryptedOnWrite: true,
         },
       );
 
-      // Self-registers as auth-foundation's sessionStore provider (#1371) —
+      // Self-registers as auth-foundation's sessionStore provider —
       // wraps the same createSessionCallbacks() used by the manual
-      // buildServer({ auth: { ... } }) wiring above; a future issue (#1372)
-      // removes that manual wiring once the middleware resolves generically
+      // buildServer({ auth: { ... } }) wiring above; removes that manual
+      // wiring once the middleware resolves generically
       // via resolveSessionStore().
       r.useExtension(EXT_SESSION_STORE, "default", {
         build: (deps): SessionStore => {
@@ -153,7 +153,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
         },
       } satisfies SessionStoreProvider);
 
-      // Custom domain-event for cross-instance access-invalidation (#1559).
+      // Custom domain-event for cross-instance access-invalidation.
       // r.defineEvent registers the schema so ctx.unsafeAppendEvent (revoke,
       // revoke-all-others) enforces it at append time. revoke-all-for-user
       // appends via the low-level append() instead (needs to anchor on
@@ -161,7 +161,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       // consult the registry, so that callsite parses against
       // sessionRevokedSchema explicitly, same guarantee via a different path.
       // No projection: the payload IS the read, consumed directly off the
-      // event-store NOTIFY (#1560).
+      // event-store NOTIFY.
       r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, { piiFields: "none" });
 
       const handlers = {

package/packages/bundled-features/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -64,8 +64,8 @@ export const revokeAllForUserWrite = defineWriteHandler({
       },
     );
 
-    // Lightweight append alongside the direct-write above (#1559) — see
-    // revoke.write.ts for why this isn't a lifecycle event on
+    // Lightweight append alongside the direct-write above; see revoke.write.ts
+    // for why this isn't a lifecycle event on
     // store_user_sessions. Uses the low-level append() (not
     // ctx.unsafeAppendEvent) because this handler is deliberately
     // cross-tenant: the privileged caller's own tenantId (what

package/packages/bundled-features/src/sessions/handlers/revoke-all-others.write.ts

@@ -46,8 +46,8 @@ export const revokeAllOthersWrite = defineWriteHandler({
       { userId: event.user.id, revokedAt: null, id: { ne: keepSid } },
     );
 
-    // Lightweight append alongside the direct-write above (#1559) — see
-    // revoke.write.ts for why this isn't a lifecycle event on
+    // Lightweight append alongside the direct-write above; see revoke.write.ts
+    // for why this isn't a lifecycle event on
     // store_user_sessions. Skipped when nothing was revoked (no other
     // live sessions) — a spurious invalidation would be the failure mode.
     if (updated.length > 0) {

package/packages/bundled-features/src/sessions/handlers/revoke.write.ts

@@ -50,7 +50,7 @@ export const revokeWrite = defineWriteHandler({
     );
 
     if (updated.length > 0) {
-      // Lightweight append alongside the direct-write above (#1559) — NOT a
+      // Lightweight append alongside the direct-write above — NOT a
       // lifecycle event for store_user_sessions (that table stays an
       // unmanaged direct-write store, see feature.ts). Own aggregate id per
       // revoke, no predecessor to satisfy, no version_conflict against a

package/packages/bundled-features/src/sessions/schema/user-session.ts

@@ -18,9 +18,9 @@ import { USER_SESSION_ENTITY_NAME } from "../constants.ts";
 // mutate them via ctx.db inside a transaction, but no user request can bypass
 // the revocation flow by poking the column directly.
 export const userSessionEntity = createEntity({
-  // Entity-Key ist "user-session" (mit Dash), toTableName's snake-case-
-  // Transform käme auf "read_user-sessions" → kein valides SQL ohne Quoting.
-  // Deshalb expliziter Override auf den read_-konformen Namen.
+  // The entity key is "user-session"; snake-casing it would produce
+  // "read_user-sessions", which is invalid SQL without quoting. Use an explicit
+  // override with a valid read_-prefixed table name.
   table: "store_user_sessions",
   // sid-as-PK: the sessionCreator callback generates the UUID, returns it to
   // the framework; the framework stamps it as `jti`; here the same value is
@@ -84,7 +84,7 @@ export const userSessionEntity = createEntity({
 // Unmanaged direct-write store (r.storeTable in feature.ts, no event stream —
 // revocation is a column write, not an aggregate). Handlers write via ctx.db;
 // source: "unmanaged" makes the meta Writable so those writes compile. See
-// feature.ts for the rebuild-exclusion rationale (#494/#498).
+// feature.ts for the rebuild-exclusion rationale.
 export const userSessionTable = deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, {
   source: "unmanaged",
 });

package/packages/bundled-features/src/sessions/screens.ts

@@ -28,7 +28,7 @@ export const createSessionListScreen = (
   pageSize: MAX_LIST_LIMIT,
   // Mirrors list.query's own fallback (unrecognised/absent sort → createdAt
   // desc) — kept in sync by hand, boot-validator only requires the field
-  // be present once the query accepts `sort` (fw#2230).
+  // be present once the query accepts `sort`.
   defaultSort: { field: "createdAt", dir: "desc" },
   columns: [
     { field: "id", label: i18nKey("sessions.list.col.id") },
@@ -90,7 +90,7 @@ export const createSessionDetailScreen = (
           // The shim (projection-detail-shim.ts) stamps every field as
           // type:"text" — field.renderer is the only way this screen
           // type reaches real per-type formatting instead of a raw ISO
-          // string (fw#2245).
+          // string.
           { field: "createdAt", renderer: { format: "timestamp" } },
           { field: "expiresAt", renderer: { format: "timestamp" } },
           { field: "revokedAt", renderer: { format: "timestamp" } },

package/packages/bundled-features/src/sessions/session-callbacks.ts

@@ -256,11 +256,11 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
         );
 
         // Lightweight append alongside the direct-write above, same pattern
-        // as revoke.write.ts (#1559) — this callback is the password-change
+        // as revoke.write.ts — this callback is the password-change
         // auto-revoke path (sessions/feature.ts postSave hook) and has no
         // dispatcher ctx to call unsafeAppendEvent from, so it uses the raw
         // append() like revoke-all-for-user.write.ts does. Without this, the
-        // access-invalidation consumer (#1560) never hears about a password
+        // access-invalidation consumer never hears about a password
         // change and an already-open SSE stream survives it — the exact
         // "stale JWT mid-stream" gap this feature exists to close.
         if (result.length > 0) {

package/packages/bundled-features/src/sessions/session-revoked-event.ts

@@ -2,11 +2,11 @@ import * as z from "zod";
 
 // Lightweight custom event appended alongside the direct-write
 // updateMany() in revoke.write.ts / revoke-all-others.write.ts /
-// revoke-all-for-user.write.ts (#1559). store_user_sessions itself stays
+// revoke-all-for-user.write.ts. store_user_sessions itself stays
 // an unmanaged direct-write store (see feature.ts) — the row columns are
 // the audit trail, this event is NOT a CRUD/lifecycle event for that
 // table and carries no projection. Its only job is to give cross-instance
-// consumers (access-invalidation, #1560) something to LISTEN for via the
+// consumers (access-invalidation) something to LISTEN for via the
 // existing event-store NOTIFY, keyed by the affected userId.
 //
 // _SHORT/_QN pair mirrors cap-counter's rolling-incremented event:

package/packages/bundled-features/src/shared/assert-no-where-rule-in-ownership-write.ts

@@ -1,6 +1,6 @@
 import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
 
-// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// Boot validation rejects `{ kind: "where" }` in access.write too;
 // failing at factory time names the option instead of an entity scope.
 export function assertNoWhereRuleInOwnershipWrite(
   factoryName: string,

package/packages/bundled-features/src/shared/decrypt-stored-pii.ts

@@ -8,7 +8,7 @@ import {
 // active KMS that is ciphertext (self-describing: it names its own subject,
 // so no entity/field context is needed for key selection). `field` must
 // still match the field name used at encrypt time — it is part of the
-// AAD (#1263), so a mismatch fails decrypt loud rather than silently
+// AAD, so a mismatch fails decrypt loud rather than silently
 // letting ciphertext cut-and-pasted from another field decrypt. An erased
 // subject yields the sentinel, which matches no real value.
 export async function decryptStoredPii(

package/packages/bundled-features/src/shared/encrypt-for-direct-write.ts

@@ -11,7 +11,7 @@ import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
 // go through this instead, and the feature declares { piiEncryptedOnWrite:
-// true } at the registration site (enforced by the registry, #820).
+// true } at the registration site (enforced by the registry).
 export async function encryptForDirectWrite(
   entity: EntityDefinition,
   entityName: string,

package/packages/bundled-features/src/shared/map-with-concurrency.ts

@@ -16,17 +16,18 @@ export async function mapWithConcurrency<T, R>(
   fn: (item: T, index: number) => Promise<R>,
 ): Promise<R[]> {
   const results: R[] = new Array(items.length);
-  let nextIndex = 0;
+  const unclaimed = items.entries();
   let failed = false;
   async function worker(): Promise<void> {
     for (;;) {
       // skip: another worker already failed — stop claiming new items.
       if (failed) return;
-      const index = nextIndex++;
+      const claimed = unclaimed.next();
       // skip: cursor exhausted, normal worker-loop exit
-      if (index >= items.length) return;
+      if (claimed.done) return;
+      const [index, item] = claimed.value;
       try {
-        results[index] = await fn(items[index] as T, index);
+        results[index] = await fn(item, index);
       } catch (err) {
         failed = true;
         throw err;

package/packages/bundled-features/src/shared/parent-visibility.ts

@@ -91,7 +91,7 @@ export async function hostRowIsGone(
   return row === undefined || row["isDeleted"] === true;
 }
 
-// Write-path half of the parentRef gate (fw#2766). Resolves the join entity's
+// Write-path half of the parentRef gate. Resolves the join entity's
 // own `parentRef` declaration from the registry — the same object the read
 // path's SQL gate reads — so the field names and the allowedTypes allowlist
 // exist in exactly one place instead of once per path.
@@ -104,7 +104,7 @@ export async function joinRowParentIsVisible(
 ): Promise<boolean> {
   const parentRef = registry.getEntity(joinEntityName)?.parentRef;
   // A mount whose join entity lost its declaration can't derive a gate —
-  // deny rather than silently fall back to the pre-#2766 open behaviour.
+  // deny rather than silently fall back to the open behaviour.
   if (parentRef === undefined) return false;
 
   const entityType = payload[parentRef.entityTypeField];

package/packages/bundled-features/src/shared/password-hashing.ts

@@ -43,7 +43,7 @@ export async function verifyPassword(hashString: string, password: string): Prom
   }
 }
 
-// Anti-enumeration timing equaliser (#774). The login handler runs this on
+// Anti-enumeration timing equaliser. The login handler runs this on
 // the no-user / no-hash path so a missing account costs the same argon2
 // latency as a real verify — otherwise response timing leaks whether an
 // email is registered. Derived from hashPassword once and cached, so it

package/packages/bundled-features/src/shared/signup-handover.ts

@@ -1,5 +1,4 @@
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): signup-request runs in whichever browser the activation
+// Cross-device try-first handover: signup-request runs in whichever browser the activation
 // link ends up opened in, which may not be the one holding the anonymous
 // visitor's tenant-handover grant. This extension point lets
 // auth-email-password bind a verified grant to the signup token server-side

package/packages/bundled-features/src/shared/single-use-token-store.ts

@@ -25,7 +25,7 @@
 //
 // Every key is derived from sha256(token), never the raw token — Redis key
 // names, MONITOR output, replica traffic, and memory/backup dumps never
-// carry the bearer secret in the clear (#2174). The by-subject entry stores
+// carry the bearer secret in the clear. The by-subject entry stores
 // the *hash* of the live token, not the token itself, so it can only be
 // used to invalidate (delete the matching forward entry) — never to
 // recover or resend the original token. A resend therefore always mints a

package/packages/bundled-features/src/subscription-mollie/constants.ts

@@ -1,33 +1,31 @@
 // Feature name
 export const SUBSCRIPTION_MOLLIE_FEATURE = "subscription-mollie" as const;
 
-// entityName under den der Plugin gegen "subscriptionProvider"
-// registriert. Matcht den path-segment in der webhook-URL
+// Entity name under which the plugin registers against
+// "subscriptionProvider". Matches the path segment in the webhook URL
 // `/api/subscription/webhook/mollie`.
 export const MOLLIE_PROVIDER_NAME = "mollie" as const;
 
 // =============================================================================
-// Mollie-Webhook-Pattern (anders als Stripe!)
+// Mollie webhook pattern (unlike Stripe)
 // =============================================================================
 //
-// Mollie sendet bei JEDEM event nur die ID im body (form-urlencoded
-// oder JSON). Plugin muss IMMER lazy-fetchen via Mollie-API:
-//   - `id=tr_xxx`  → payment-id, fetch payment + subscription
-//   - `id=sub_xxx` → subscription-id, fetch subscription direkt
+// Mollie sends only the ID in the body for EVERY event (form-urlencoded
+// or JSON). The plugin must ALWAYS fetch lazily via the Mollie API:
+//   - `id=tr_xxx`  → payment ID, fetch payment + subscription
+//   - `id=sub_xxx` → subscription ID, fetch subscription directly
 //
-// **Keine native HMAC-sig-verify** in Mollie-SDK 4.5.0. Mollie's
-// Sicherheits-Modell stützt sich auf nicht-guessable IDs (~10^25
-// brute-force-space) + API-Lookup-Validation (garbage-id → 401 von
-// Mollie-API). Plus: App-Builder kann zusätzlich einen URL-Token-
-// Wrapper vor die Foundation-route schalten (eigener extraRoute der
-// einen secret-token im URL-Pfad verifiziert + dann an die Foundation
-// weiterreicht).
+// **No native HMAC signature verification** in Mollie SDK 4.5.0. Mollie's
+// security model relies on non-guessable IDs (~10^25 brute-force space)
+// plus API lookup validation (garbage ID → 401 from the Mollie API). In
+// addition, the app builder can place a URL-token wrapper before the
+// foundation route (a custom extraRoute that verifies a secret token in
+// the URL path and then forwards to the foundation).
 //
-// **Event-Type-Mapping** ist heuristisch — Mollie hat keine explicit-
-// typed events:
+// **Event type mapping** is heuristic—Mollie has no explicitly typed events:
 //   - sub_xxx + status=canceled/completed     → SubscriptionEventTypes.canceled
 //   - sub_xxx + status=active/pending         → SubscriptionEventTypes.updated
 //   - tr_xxx + sequenceType=first + paid      → SubscriptionEventTypes.created
 //   - tr_xxx + sequenceType=recurring + paid  → SubscriptionEventTypes.invoicePaid
 //   - tr_xxx + sequenceType=recurring + failed → SubscriptionEventTypes.invoicePaymentFailed
-//   - alles andere                            → null (foundation 200 ignored)
+//   - everything else                         → null (foundation 200 ignored)