@cosmicdrift/kumiko-framework 0.327.0 → 0.328.1

package/src/api/sse-broker.ts

@@ -1,175 +0,0 @@
-import { userAccessChannel } from "../engine/constants";
-import { generateId } from "../utils";
-
-export type SseClient = {
-  id: string;
-  send: (event: SseEvent) => void;
-  close: () => void;
-};
-
-export type SseEvent = {
-  type: string;
-  data: Record<string, unknown>;
-};
-
-// What a publish invalidates. "user" is the broadest (and the historical
-// default — every scope narrower than this is an opt-in from a caller that
-// knows exactly which credential(s) it revoked).
-export type AccessInvalidationScope =
-  | { readonly kind: "user" }
-  | { readonly kind: "all-except-session"; readonly keptSessionId: string }
-  | { readonly kind: "sessions"; readonly sessionIds: readonly string[] }
-  | { readonly kind: "pat-tokens"; readonly tokenIds: readonly string[] };
-
-// What a stream's own listener is authenticated as — used to decide whether
-// a narrow scope (sessions/pat-tokens) applies to it. A listener with
-// neither field (should not normally happen — dispatch-stream.ts always
-// passes at least one) is treated as unidentifiable and closed by every
-// narrow scope, same fail-closed stance as a PAT stream facing a
-// sessions-scope.
-export type AccessInvalidationCredential = {
-  readonly sid?: string;
-  readonly patTokenId?: string;
-};
-
-export type SseBroker = {
-  addClient(channel: string, send: (event: SseEvent) => void, close: () => void): string;
-  removeClient(channel: string, clientId: string): void;
-  pushToChannel(channel: string, event: SseEvent): void;
-  getClientCount(channel: string): number;
-  getTotalClientCount(): number;
-  // Separate from addClient so it doesn't count towards getClientCount.
-  // Required (fw#1601): an app-injected SseBroker (e.g. a Redis-backed
-  // multi-replica broker) that skips these silently turns the mid-stream
-  // access-teardown security control (#1561) into a no-op — a revoked
-  // session keeps receiving live SSE data with no error or log. A no-op
-  // stub is one line for a broker that genuinely doesn't need it.
-  subscribeAccessInvalidation(
-    userId: string,
-    onInvalidate: () => void,
-    credential?: AccessInvalidationCredential,
-  ): () => void;
-  // `scope` narrows which credential(s) close; omitted = userwide (every
-  // listener), the historical default and still what unrelated
-  // reasons (role change, membership removal) use.
-  publishAccessInvalidation(userId: string, scope?: AccessInvalidationScope): void;
-};
-
-// Fail-closed: a narrow scope only spares/limits a listener it can positively
-// match against its own credential. A listener with neither sid nor
-// patTokenId of its own can't be matched by "sessions"/"pat-tokens", so it
-// closes — same reasoning "all-except-session" already used for a sidless
-// (PAT/bearer) listener.
-export function shouldInvalidateListener(
-  credential: AccessInvalidationCredential,
-  scope: AccessInvalidationScope,
-): boolean {
-  switch (scope.kind) {
-    case "user":
-      return true;
-    case "all-except-session":
-      return credential.sid !== scope.keptSessionId;
-    case "sessions":
-      return credential.sid !== undefined
-        ? scope.sessionIds.includes(credential.sid)
-        : credential.patTokenId === undefined;
-    case "pat-tokens":
-      return credential.patTokenId !== undefined
-        ? scope.tokenIds.includes(credential.patTokenId)
-        : credential.sid === undefined;
-  }
-}
-
-export function createSseBroker(): SseBroker {
-  // Purely local: no cross-replica fanout. buildServer wraps this in
-  // createRedisSseBroker (fw#2625) whenever REDIS_URL is set, which is what
-  // makes pushToChannel/publishAccessInvalidation reach every replica's
-  // clients — this reference implementation stays single-process only.
-  const channels = new Map<string, Map<string, SseClient>>();
-  // Keyed by callback reference, value is the subscriber's own credential.
-  // Every subscriber must pass a distinct closure (dispatch-stream.ts does,
-  // one per stream). Two subscribes with the SAME reference for the same
-  // user collapse into one listener, and the first unsubscribe kills both.
-  const accessInvalidationListeners = new Map<
-    string,
-    Map<() => void, AccessInvalidationCredential>
-  >();
-
-  function getOrCreateChannel(channel: string): Map<string, SseClient> {
-    let clients = channels.get(channel);
-    if (!clients) {
-      clients = new Map();
-      channels.set(channel, clients);
-    }
-    return clients;
-  }
-
-  return {
-    addClient(channel, send, close) {
-      const clientId = generateId();
-      const clients = getOrCreateChannel(channel);
-      clients.set(clientId, { id: clientId, send, close });
-      return clientId;
-    },
-
-    removeClient(channel, clientId) {
-      const clients = channels.get(channel);
-      // skip: channel was never registered or already cleaned up
-      if (!clients) return;
-      clients.delete(clientId);
-      if (clients.size === 0) channels.delete(channel);
-    },
-
-    pushToChannel(channel, event) {
-      const clients = channels.get(channel);
-      // skip: no listeners on this channel, event has no audience
-      if (!clients) return;
-      for (const client of clients.values()) {
-        client.send(event);
-      }
-    },
-
-    getClientCount(channel) {
-      return channels.get(channel)?.size ?? 0;
-    },
-
-    getTotalClientCount() {
-      let total = 0;
-      for (const clients of channels.values()) {
-        total += clients.size;
-      }
-      return total;
-    },
-
-    subscribeAccessInvalidation(userId, onInvalidate, credential) {
-      const channel = userAccessChannel(userId);
-      let listeners = accessInvalidationListeners.get(channel);
-      if (!listeners) {
-        listeners = new Map();
-        accessInvalidationListeners.set(channel, listeners);
-      }
-      listeners.set(onInvalidate, credential ?? {});
-      return () => {
-        const current = accessInvalidationListeners.get(channel);
-        // skip: already unsubscribed (e.g. stream ended after a publish already fired)
-        if (!current) return;
-        current.delete(onInvalidate);
-        if (current.size === 0) accessInvalidationListeners.delete(channel);
-      };
-    },
-
-    publishAccessInvalidation(userId, scope) {
-      const channel = userAccessChannel(userId);
-      const listeners = accessInvalidationListeners.get(channel);
-      // skip: no live stream is watching this user right now
-      if (!listeners) return;
-      const resolvedScope: AccessInvalidationScope = scope ?? { kind: "user" };
-      // Snapshot before iterating — a fired listener unsubscribes itself,
-      // which would mutate `listeners` mid-iteration otherwise.
-      for (const [onInvalidate, credential] of [...listeners]) {
-        if (!shouldInvalidateListener(credential, resolvedScope)) continue;
-        onInvalidate();
-      }
-    },
-  };
-}

package/src/api/sse-route.ts

@@ -1,74 +0,0 @@
-import { Hono } from "hono";
-import { streamSSE } from "hono/streaming";
-import { tenantChannel } from "../engine/constants";
-import { Routes } from "./api-constants";
-import { getUser } from "./auth-middleware";
-import type { SseBroker } from "./sse-broker";
-
-/**
- * Heartbeat-Cadence für SSE-Streams.
- *
- * Spec: muss UNTER jedem realistischen Idle-Timeout der Hop-by-Hop-Layer
- * liegen, sonst killt einer davon die Connection und der Browser sieht
- * ERR_HTTP2_PROTOCOL_ERROR. Bekannte Limits:
- *   - Bun.serve default: 10 s (lokal disabled via idleTimeout: 0,
- *     aber Spec-konform auch ohne Override)
- *   - Caddy reverse_proxy: kein default-Timeout für SSE (auto-detect
- *     via Content-Type), aber langlebige idle Streams können von
- *     Connection-Tracking dichtgemacht werden
- *   - Cloudflare Edge: 100 s
- *   - AWS ALB: 60 s
- *
- * 15 s liegt komfortabel unter allen davon. Server-side Cost ist
- * marginal (1 Frame pro Client alle 15 s).
- *
- * Spec-Test in __tests__/sse-route-spec.test.ts pinst diesen Wert
- * gegen versehentliches Hochsetzen.
- */
-export const SSE_HEARTBEAT_INTERVAL_MS = 15_000;
-
-// Entity events carry aggregateType in data (system-hooks.ts's SSE-broadcast
-// consumer) — the wire frame is named after the entity so the client can
-// wire a single listener per entity instead of one per verb. Non-entity
-// events (e.g. channel-in-app:event:delivered) have no aggregateType and
-// keep their event.type as the frame name.
-function isEntityEventData(data: Record<string, unknown>): data is { aggregateType: string } {
-  return typeof data["aggregateType"] === "string";
-}
-
-export function createSseRoute(broker: SseBroker) {
-  const route = new Hono();
-
-  route.get(Routes.sse, async (c) => {
-    const user = getUser(c);
-    // Channel is server-derived from authenticated user — never trust client input.
-    // Allowing ?channel=... would let any authenticated user subscribe to other tenants' feeds.
-    const channel = tenantChannel(user.tenantId);
-
-    return streamSSE(c, async (stream) => {
-      const clientId = broker.addClient(
-        channel,
-        (event) => {
-          const wireEventName = isEntityEventData(event.data)
-            ? event.data.aggregateType
-            : event.type;
-          stream.writeSSE({ event: wireEventName, data: JSON.stringify(event.data) });
-        },
-        () => stream.close(),
-      );
-
-      stream.onAbort(() => {
-        broker.removeClient(channel, clientId);
-      });
-
-      // Keep connection alive with heartbeat — siehe SSE_HEARTBEAT_INTERVAL_MS
-      // header für die Layer-für-Layer-Begründung der 15s-Cadence.
-      while (true) {
-        await stream.writeSSE({ event: "ping", data: "" });
-        await stream.sleep(SSE_HEARTBEAT_INTERVAL_MS);
-      }
-    });
-  });
-
-  return route;
-}

package/src/api/tokens.ts

@@ -1,16 +0,0 @@
-import { randomBytes } from "node:crypto";
-
-// Security tokens (CSRF cookie, one-shot correlation tokens that must
-// not be guessable from wall-clock time). Backend-only — imports
-// `node:crypto` and must not be pulled into a Metro/Expo-Web bundle.
-//
-// Unlike `generateId` (v7), this must not leak the creation timestamp:
-// a CSRF value whose first 6 bytes are "the millisecond the login
-// happened" is predictable. Every bit here is unpredictable.
-//
-// 32 bytes = 256 bits — session-class strength. base64url = 43 chars,
-// cookie- and URL-safe, matches the encoding of JWT segments / OAuth
-// state / WebAuthn challenges.
-export function generateToken(): string {
-  return randomBytes(32).toString("base64url");
-}

package/src/api/websocket-route.ts

@@ -1,327 +0,0 @@
-import {
-  WEBSOCKET_BACKPRESSURE_LIMIT_BYTES,
-  WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER,
-  WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES,
-  WEBSOCKET_MAX_PAYLOAD_BYTES,
-  WEBSOCKET_ROUTE_PATH_PREFIX,
-  type WebSocketConnection,
-  type WebSocketMessageData,
-  type WebSocketSessionHandlers,
-} from "@cosmicdrift/kumiko-types/websocket-route";
-import type { SessionUser } from "../engine/types";
-import { createFallbackLogger } from "../logging";
-import {
-  type AuthSessionChecker,
-  resolveTenantTeardownStatus,
-  sessionCheckStatus,
-  type TenantLifecycleStatusResolver,
-} from "./auth-middleware";
-import { type RequestContextData, requestContext } from "./request-context";
-
-export {
-  WEBSOCKET_BACKPRESSURE_LIMIT_BYTES,
-  WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER,
-  WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES,
-  WEBSOCKET_MAX_PAYLOAD_BYTES,
-  WEBSOCKET_ROUTE_PATH_PREFIX,
-};
-
-// Must stay below ingress-nginx's default 60 s proxy-read-timeout, or idle sockets get cut.
-export const WEBSOCKET_HEARTBEAT_INTERVAL_MS = 25_000;
-
-const CLOSE_POLICY_VIOLATION = 1008;
-const CLOSE_MESSAGE_TOO_BIG = 1009;
-const CLOSE_INTERNAL_ERROR = 1011;
-const CLOSE_TRY_AGAIN_LATER = 1013;
-
-// Consecutive failed session-store checks before a socket is closed: rides out a
-// short store blip, but a socket must not stay unverified forever.
-export const WEBSOCKET_REVALIDATION_FAILURE_LIMIT = 3;
-
-const log = createFallbackLogger("websocket");
-
-export type KumikoWebSocketData = {
-  readonly handlers: WebSocketSessionHandlers;
-  readonly maxMessageBytes: number;
-  // Socket callbacks run outside the Hono request, so the dispatcher's
-  // AsyncLocalStorage context is captured at upgrade time and re-entered.
-  readonly requestContextData: RequestContextData | undefined;
-  readonly revalidateSession: WebSocketSessionRevalidator | undefined;
-  // Frees this socket's per-user connection slot; called once on close.
-  readonly releaseConnectionSlot?: (() => void) | undefined;
-};
-
-export type WebSocketRevalidation = "live" | "expired" | "invalid";
-export type WebSocketSessionRevalidator = () => Promise<WebSocketRevalidation>;
-
-// Structural so Bun.Server satisfies it without this package depending on bun types.
-export type WebSocketUpgradeServer = {
-  upgrade(req: Request, options: { data: KumikoWebSocketData }): boolean;
-};
-
-// Second argument to `app.fetch(req, env)` on upgrade requests; plain requests
-// keep passing the bare socket-address string.
-export type KumikoServeEnv = {
-  readonly socketAddress?: string;
-  readonly server?: WebSocketUpgradeServer;
-};
-
-export type KumikoServerWebSocket = {
-  readonly data: KumikoWebSocketData;
-  send(data: WebSocketMessageData): unknown;
-  close(code?: number, reason?: string): void;
-  ping(): unknown;
-};
-
-export function isWebSocketUpgradeRequest(req: Request): boolean {
-  return req.headers.get("upgrade")?.toLowerCase() === "websocket";
-}
-
-export function hasWebSocketUpgradeServer(
-  honoEnv: unknown,
-): honoEnv is { readonly server: WebSocketUpgradeServer } {
-  return (
-    typeof honoEnv === "object" &&
-    honoEnv !== null &&
-    "server" in honoEnv &&
-    typeof honoEnv.server === "object" &&
-    honoEnv.server !== null &&
-    "upgrade" in honoEnv.server &&
-    typeof honoEnv.server.upgrade === "function"
-  );
-}
-
-function sameRoles(a: readonly string[], b: readonly string[]): boolean {
-  const left = new Set(a);
-  return left.size === new Set(b).size && b.every((role) => left.has(role));
-}
-
-// Same checks the HTTP guard runs per request, plus the JWT's own expiry (the
-// upgrade request passed the guard once, the socket outlives that). query/write
-// stay bound to the upgrade-time user, so changed roles close the socket
-// instead of silently serving stale permissions.
-export function buildWebSocketSessionRevalidator(deps: {
-  readonly user: SessionUser;
-  readonly sessionChecker?: AuthSessionChecker | undefined;
-  readonly resolveTenantLifecycleStatus?: TenantLifecycleStatusResolver | undefined;
-  /** JWT exp, epoch seconds. */
-  readonly tokenExpiresAtSec?: number | undefined;
-  readonly nowMs?: () => number;
-}): WebSocketSessionRevalidator | undefined {
-  const { user, sessionChecker, resolveTenantLifecycleStatus, tokenExpiresAtSec } = deps;
-  const nowMs = deps.nowMs ?? Date.now;
-  const checkSession = sessionChecker && user.sid ? sessionChecker : undefined;
-  if (!checkSession && !resolveTenantLifecycleStatus && tokenExpiresAtSec === undefined) {
-    return undefined;
-  }
-  return async () => {
-    if (tokenExpiresAtSec !== undefined && nowMs() >= tokenExpiresAtSec * 1000) return "expired";
-    if (checkSession && user.sid) {
-      const result = await checkSession(user.sid, user.id);
-      if (sessionCheckStatus(result) !== "live") return "invalid";
-      if (typeof result === "object" && !sameRoles(result.roles, user.roles)) return "invalid";
-    }
-    const teardown = await resolveTenantTeardownStatus(user.tenantId, resolveTenantLifecycleStatus);
-    return teardown === undefined ? "live" : "invalid";
-  };
-}
-
-// ponytail: per-process counter, so the cap is per pod, not cluster-wide; move to Redis if that matters.
-export type WebSocketConnectionLimiter = {
-  readonly tryAcquire: (key: string, max: number) => (() => void) | undefined;
-};
-
-export function createWebSocketConnectionLimiter(): WebSocketConnectionLimiter {
-  const counts = new Map<string, number>();
-  return {
-    tryAcquire(key, max) {
-      const current = counts.get(key) ?? 0;
-      if (current >= max) return undefined;
-      counts.set(key, current + 1);
-      let released = false;
-      return () => {
-        // skip: slot already released
-        if (released) return;
-        released = true;
-        const remaining = (counts.get(key) ?? 1) - 1;
-        if (remaining <= 0) counts.delete(key);
-        else counts.set(key, remaining);
-      };
-    },
-  };
-}
-
-type ConnectionState = {
-  timer: ReturnType<typeof setInterval> | undefined;
-  revalidationFailures: number;
-  revalidating: boolean;
-  // onOpen/onMessage run one after another in arrival order; steps never reject.
-  chain: Promise<void>;
-  closed: boolean;
-  readonly controller: AbortController;
-};
-
-const connectionStates = new WeakMap<KumikoWebSocketData, ConnectionState>();
-
-function stateOf(ws: KumikoServerWebSocket): ConnectionState {
-  let state = connectionStates.get(ws.data);
-  if (!state) {
-    state = {
-      timer: undefined,
-      revalidationFailures: 0,
-      revalidating: false,
-      chain: Promise.resolve(),
-      closed: false,
-      controller: new AbortController(),
-    };
-    connectionStates.set(ws.data, state);
-  }
-  return state;
-}
-
-function toConnection(ws: KumikoServerWebSocket): WebSocketConnection {
-  return {
-    send: (data) => {
-      ws.send(data);
-    },
-    close: (code, reason) => ws.close(code, reason),
-    signal: stateOf(ws).controller.signal,
-  };
-}
-
-function reportHandlerFailure(error: unknown): void {
-  log.error("websocket handler failed", {
-    error: error instanceof Error ? error.message : String(error),
-  });
-}
-
-// Runs outside the chain: a hung onMessage must not hold back onClose cleanup.
-function runInRequestContext(ws: KumikoServerWebSocket, run: () => Promise<void>): Promise<void> {
-  const { requestContextData } = ws.data;
-  return requestContextData ? requestContext.run(requestContextData, run) : run();
-}
-
-function enqueue(ws: KumikoServerWebSocket, run: () => void | Promise<void>): void {
-  const state = stateOf(ws);
-  // skip: the socket is gone, nothing may start after close
-  if (state.closed) return;
-  const step = async (): Promise<void> => {
-    // skip: queued behind a slower handler and the socket closed meanwhile
-    if (state.closed) return;
-    try {
-      await run();
-    } catch (error) {
-      reportHandlerFailure(error);
-      ws.close(CLOSE_INTERNAL_ERROR, "internal error");
-    }
-  };
-  state.chain = state.chain.then(() => runInRequestContext(ws, step));
-}
-
-function recordRevalidationFailure(
-  ws: KumikoServerWebSocket,
-  state: ConnectionState,
-  reason: string,
-): void {
-  // One failing check must not drop every live socket during a store blip, but persistent failure must.
-  state.revalidationFailures += 1;
-  log.error("websocket heartbeat failed", {
-    error: reason,
-    consecutiveFailures: state.revalidationFailures,
-  });
-  if (state.revalidationFailures >= WEBSOCKET_REVALIDATION_FAILURE_LIMIT) {
-    ws.close(CLOSE_TRY_AGAIN_LATER, "try again later");
-  }
-}
-
-async function heartbeat(ws: KumikoServerWebSocket): Promise<void> {
-  const state = stateOf(ws);
-  try {
-    ws.ping();
-  } catch (error) {
-    log.error("websocket ping failed", {
-      error: error instanceof Error ? error.message : String(error),
-    });
-  }
-  const { revalidateSession } = ws.data;
-  // skip: no revalidation wired for this socket
-  if (!revalidateSession) return;
-  // A store that never answers must not pile up checks; an unanswered one counts as a failed check.
-  if (state.revalidating) {
-    recordRevalidationFailure(ws, state, "previous session check still pending");
-    // skip: the pending check owns the verdict; the failure was logged above
-    return;
-  }
-  state.revalidating = true;
-  try {
-    const verdict = await revalidateSession();
-    state.revalidationFailures = 0;
-    if (verdict === "expired") ws.close(CLOSE_POLICY_VIOLATION, "session expired");
-    else if (verdict === "invalid") ws.close(CLOSE_POLICY_VIOLATION, "session changed");
-  } catch (error) {
-    recordRevalidationFailure(ws, state, error instanceof Error ? error.message : String(error));
-  } finally {
-    state.revalidating = false;
-  }
-}
-
-function toMessageData(message: string | Uint8Array): WebSocketMessageData {
-  if (typeof message === "string") return message;
-  // Copy: a Buffer view can sit on a larger pooled ArrayBuffer and be reused after the handler returns.
-  return new Uint8Array(message);
-}
-
-function messageByteLength(message: string | Uint8Array): number {
-  return typeof message === "string" ? Buffer.byteLength(message) : message.byteLength;
-}
-
-export function createKumikoWebSocketHandler(
-  options: { readonly heartbeatIntervalMs?: number } = {},
-) {
-  const heartbeatIntervalMs = options.heartbeatIntervalMs ?? WEBSOCKET_HEARTBEAT_INTERVAL_MS;
-  return {
-    open(ws: KumikoServerWebSocket): void {
-      stateOf(ws).timer = setInterval(() => {
-        void heartbeat(ws);
-      }, heartbeatIntervalMs);
-      const { onOpen } = ws.data.handlers;
-      if (onOpen) enqueue(ws, () => onOpen(toConnection(ws)));
-    },
-    message(ws: KumikoServerWebSocket, message: string | Uint8Array): void {
-      const byteLength = messageByteLength(message);
-      if (byteLength > ws.data.maxMessageBytes) {
-        ws.close(CLOSE_MESSAGE_TOO_BIG, "message too big");
-        log.warn("websocket message over cap", {
-          byteLength,
-          maxMessageBytes: ws.data.maxMessageBytes,
-        });
-        return;
-      }
-      const { onMessage } = ws.data.handlers;
-      if (onMessage) enqueue(ws, () => onMessage(toMessageData(message), toConnection(ws)));
-    },
-    close(ws: KumikoServerWebSocket, code: number, reason: string): void {
-      const state = stateOf(ws);
-      if (state.timer !== undefined) {
-        clearInterval(state.timer);
-        state.timer = undefined;
-      }
-      ws.data.releaseConnectionSlot?.();
-      state.closed = true;
-      state.controller.abort();
-      const { onClose } = ws.data.handlers;
-      if (onClose) {
-        const cleanup = async (): Promise<void> => {
-          try {
-            await onClose(code, reason, toConnection(ws));
-          } catch (error) {
-            reportHandlerFailure(error);
-          }
-        };
-        void runInRequestContext(ws, cleanup);
-      }
-    },
-  };
-}
-
-export const kumikoWebSocketHandler = createKumikoWebSocketHandler();

package/src/arg-parser.ts

@@ -1,66 +0,0 @@
-// Small arg parser for CLI commands. Not as feature-rich as commander or
-// yargs — just:
-//   - Positional args:  cmd "value1" "value2"
-//   - Flags:            --flag (boolean) / --key value
-//   - Negatable:        --no-flag
-//
-// Shared arg parser (also re-exported from bin/commands/arg-parser.ts). upgrade-cli.ts
-// lives in the published @cosmicdrift/kumiko-framework package and can't
-// import from bin/commands/ (outside the package's export surface).
-
-export type ParsedArgs = {
-  readonly positional: ReadonlyArray<string>;
-  readonly flags: ReadonlyMap<string, string | boolean>;
-};
-
-export function parseArgs(argv: ReadonlyArray<string>): ParsedArgs {
-  const positional: string[] = [];
-  const flags = new Map<string, string | boolean>();
-
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (!a) continue;
-    if (a.startsWith("--")) {
-      const key = a.slice(2);
-      // `--no-foo` form
-      if (key.startsWith("no-")) {
-        flags.set(key.slice(3), false);
-        continue;
-      }
-      // `--key=value` inline form
-      const eq = key.indexOf("=");
-      if (eq !== -1) {
-        flags.set(key.slice(0, eq), key.slice(eq + 1));
-        continue;
-      }
-      // `--key value` if next isn't a flag, else boolean
-      const next = argv[i + 1];
-      if (next !== undefined && !next.startsWith("--")) {
-        flags.set(key, next);
-        i++;
-      } else {
-        flags.set(key, true);
-      }
-    } else {
-      positional.push(a);
-    }
-  }
-
-  return { positional, flags };
-}
-
-export function getFlag(args: ParsedArgs, name: string): boolean {
-  return args.flags.get(name) === true;
-}
-
-export function getStringFlag(args: ParsedArgs, name: string): string | undefined {
-  const v = args.flags.get(name);
-  return typeof v === "string" ? v : undefined;
-}
-
-export function getNumberFlag(args: ParsedArgs, name: string): number | undefined {
-  const v = args.flags.get(name);
-  if (typeof v !== "string") return undefined;
-  const n = Number.parseInt(v, 10);
-  return Number.isNaN(n) ? undefined : n;
-}

package/src/auth/__tests__/roles.test.ts

@@ -1,24 +0,0 @@
-// Snapshot-Tests fuer ROLES — faengt stille Drift ab.
-
-import { describe, expect, test } from "bun:test";
-import { ROLES } from "../roles";
-
-describe("ROLES constants", () => {
-  test("Snapshot — explizit zu updaten bei Aenderungen", () => {
-    expect(ROLES).toMatchInlineSnapshot(`
-      {
-        "DataProtectionOfficer": "DataProtectionOfficer",
-        "Member": "Member",
-        "SystemAdmin": "SystemAdmin",
-        "TenantAdmin": "TenantAdmin",
-        "TenantOwner": "TenantOwner",
-      }
-    `);
-  });
-
-  test("ROLES-Werte sind identisch zu den Keys (keine Drift im Mapping)", () => {
-    for (const [key, value] of Object.entries(ROLES)) {
-      expect(value as string).toBe(key);
-    }
-  });
-});

package/src/auth/index.ts

@@ -1,7 +0,0 @@
-// `@cosmicdrift/kumiko-framework/auth` — Auth-Foundation (Roles, Token-
-// Helpers, Session-Types). Wird von Bundled-Features (auth-email-password,
-// tenant, user) und Datenschutz-Sprints (S1+ user-data-rights, S5 tenant-
-// lifecycle, S6 legal-hold) genutzt.
-
-export type { Role } from "./roles";
-export { ROLES } from "./roles";