v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/model/auth.ts

@@ -1,35 +1,35 @@
 /**
- * The payloads of the tokens the server signs, and their guards.
+ * Types the payloads of session and password reset tokens, and guards them.
+ * `lib/jwt.ts` signs the tokens and runs the guards when it verifies one.
  *
  * @module
  */
 
 import { isRole, type Role } from "../../shared/user.ts";
 
-/** What a session token carries. */
+/**
+ * Signed into a session token by `createJWT`, and returned by `authenticate`
+ * to the auth middleware as `ctx.state.user`. By then `role` is the user's live
+ * role, while `username` is still the one at issue time.
+ */
 export interface AuthPayload {
-  /** The user's id. */
   userId: string;
-  /** The user's name when the token was issued. */
   username: string;
-  /**
-   * The user's role; the live one replaces it once the token is authenticated.
-   */
   role: Role;
-  /** When the token expires, in seconds since the epoch. */
+  /** Seconds since the epoch. */
   exp: number;
-  /** When the token was issued, in seconds since the epoch. */
+  /** Seconds since the epoch, compared with `users.tokens_valid_after`. */
   iat?: number;
 }
 
 /**
- * Checks whether `obj` is an {@link AuthPayload}, and not a purpose-scoped
- * token's payload.
+ * Checks whether `obj` is an {@link AuthPayload}. A media or reset token's
+ * payload, which has a `purpose`, never is.
  */
 export function isAuthPayload(obj: unknown): obj is AuthPayload {
   return !!obj &&
     typeof obj === "object" &&
-    // Purpose-scoped tokens (password reset, media) are never session tokens.
+    // A media or reset token must not pass for a session token.
     !("purpose" in obj) &&
     "userId" in obj && typeof obj.userId === "string" &&
     "username" in obj && typeof obj.username === "string" &&
@@ -37,17 +37,21 @@ export function isAuthPayload(obj: unknown): obj is AuthPayload {
     "exp" in obj && typeof obj.exp === "number";
 }
 
-/** What a password reset token carries. */
+/**
+ * Signed into a reset link's token by `createPasswordResetToken`, and returned
+ * by `verifyPasswordResetToken` to `resetPassword`.
+ */
 export interface PasswordResetPayload {
-  /** The token's purpose, which makes it a reset token. */
   purpose: "password-reset";
-  /** The id of the user whose password it resets. */
   userId: string;
-  /** When the token expires, in seconds since the epoch. */
+  /** Seconds since the epoch. */
   exp: number;
 }
 
-/** Checks whether `obj` is a {@link PasswordResetPayload}. */
+/**
+ * Checks whether `obj` is a {@link PasswordResetPayload}. It doesn't check
+ * `exp`, which `jwtVerify` has already enforced.
+ */
 export function isPasswordResetPayload(
   obj: unknown,
 ): obj is PasswordResetPayload {