@cosmicdrift/kumiko-framework 0.385.0 → 0.387.0

package/dist/compliance/profiles.d.ts

@@ -64,27 +64,25 @@ export interface ComplianceProfile {
     };
 }
 /**
- * Profile-Schluessel die der Tenant-Admin im Onboarding waehlen darf.
- * `minimal-no-region` ist bewusst NICHT in der Liste — es ist der
- * Default-Fallback fuer "noch keine Wahl getroffen", mit sichtbarer
- * Warning. Production-Tenants sollen ein echtes Profile waehlen.
+ * Profile keys that the tenant admin may select during onboarding.
+ * `minimal-no-region` is intentionally excluded: it is the default fallback
+ * for "no choice made yet" and produces a visible warning. Production
+ * tenants must select an actual profile.
  */
 export declare const SELECTABLE_PROFILE_KEYS: readonly ["eu-dsgvo", "swiss-dsg", "de-hr-dsgvo-hgb"];
 /**
- * Top-Level-Properties des `ComplianceProfile`-Type, die ein Tenant-
- * Override modifizieren darf. Identifikations-Felder (key, region,
- * label, extends) sind ausgeschlossen — wer die overriden wuerde,
- * würde die Profile-Identität zerstoeren.
+ * Top-level `ComplianceProfile` properties that a tenant override may modify.
+ * Identity fields (key, region, label, extends) are excluded because
+ * overriding them would destroy the profile's identity.
  *
- * Single source of truth fuer:
- *   - set-profile-Handler-Whitelist (Tippfehler-Reject)
- *   - Snapshot-Test gegen Profile-Top-Level (Drift-Guard)
+ * This is the single source of truth for:
+ *   - the set-profile handler whitelist, which rejects typos
+ *   - the snapshot test that guards against drift from the profile's top level
  *
- * Wenn ein neues Top-Level-Property zu `ComplianceProfile` kommt
- * (z.B. `dataSubjectRights` oder `crossBorderTransferRules`), MUSS es
- * hier ergaenzt werden — sonst lehnt set-profile valide Overrides ab.
- * Der Snapshot-Test in profiles.test.ts faengt Drift in beide
- * Richtungen.
+ * When a new top-level property is added to `ComplianceProfile` (for example,
+ * `dataSubjectRights` or `crossBorderTransferRules`), it must be added here;
+ * otherwise set-profile rejects valid overrides. The snapshot test in
+ * profiles.test.ts detects drift in either direction.
  */
 export declare const OVERRIDABLE_PROFILE_KEYS: ReadonlySet<string>;
 type DeepReadonly<T> = T extends object ? {
@@ -95,9 +93,9 @@ type DeepPartial<T> = T extends object ? {
     [K in keyof T]?: DeepPartial<T[K]>;
 } : T;
 /**
- * Pre-baked Profile-Liste (extends bereits aufgelöst). Beim Modul-Load
- * einmal berechnet — wirft bei Definition-Fehlern (Cycle, missing target)
- * sofort, nicht erst beim ersten Resolver-Call.
+ * Precomputed profile list with `extends` already resolved. It is computed
+ * once when the module loads, so definition errors (cycles or missing
+ * targets) are thrown immediately rather than on the first resolver call.
  */
 export declare const COMPLIANCE_PROFILES: Readonly<Record<ComplianceProfileKey, ComplianceProfile>>;
 export interface EffectiveComplianceProfile {
@@ -105,19 +103,18 @@ export interface EffectiveComplianceProfile {
     readonly warning?: "no-profile-selected";
 }
 /**
- * Liefert das effektive Compliance-Profile fuer einen Tenant inklusive
- * Tenant-Override.
+ * Returns the effective compliance profile for a tenant, including its
+ * tenant override.
  *
- * Edge-Case-Verhalten (gepinnt):
+ * Edge-case behavior:
  *   - selection=undefined → minimal-no-region + warning="no-profile-selected"
- *   - selection=valid + override=undefined → effective profile, kein warning
- *   - selection=valid + override → deep-merged effective, kein warning
+ *   - selection=valid + override=undefined → effective profile, no warning
+ *   - selection=valid + override → deep-merged effective profile, no warning
  *
- * Production-Marker: das frueher hier vorgesehene "minimal-in-production"-
- * warning ist entfallen weil set-profile (Sprint 1.7 X1) minimal-no-region
- * nicht mehr als Tenant-Wahl akzeptiert. Wer Production-spezifisches
- * Verhalten braucht (z.B. Block-bei-Default), addiert den Marker spaeter
- * bei Bedarf.
+ * The former "minimal-in-production" warning was removed because
+ * set-profile no longer accepts minimal-no-region as a tenant selection.
+ * Production-specific behavior, such as blocking the default, can be added
+ * later if needed.
  */
 export declare function resolveComplianceProfile(args: {
     readonly selection?: ComplianceProfileKey;

package/dist/compliance/profiles.js

@@ -1,37 +1,34 @@
-// Compliance-Profiles — DSGVO + sektorspezifische Regelwerke.
+// Compliance profiles — GDPR + sector-specific regulations.
 //
-// Tenant-Admin waehlt ein Profile beim Onboarding (Pflicht). Profile
-// buendelt User-Rights (Forget-Grace, Restriction, Auskunftsfrist),
-// Notification-Sprache, Breach-Disclosure, Audit-Log-Retention,
-// Sub-Processor-Anforderungen und Tenant-Destroy-Grace.
+// The tenant admin must select a profile during onboarding. A profile
+// bundles user rights (forget grace period, restriction, access-request
+// deadline), notification languages, breach disclosure, audit-log retention,
+// subprocessor requirements, and the tenant-destruction grace period.
 //
-// MVP-Set: 3 Profile + 1 Default-Fallback. Erweiterung via `extends`
-// trivial — neue Laender (uk-gdpr, ca-pipeda, us-ccpa, hipaa-healthcare)
-// kommen on-demand wenn Customer fragt.
+// Current set: three profiles plus one default fallback. Extending via
+// `extends` is straightforward; additional jurisdictions (uk-gdpr,
+// ca-pipeda, us-ccpa, hipaa-healthcare) can be added when needed.
 //
-// Edge-Case-Decisions (advisor-pinned 2026-05-06):
+// Edge-case decisions:
 //
-//   1. Default-Fallback: `resolveComplianceProfile(undefined)` returnt
-//      `minimal-no-region` mit `warning: "no-profile-selected"`. Caller
-//      sieht das und kann Onboarding-Banner triggern. Nie still
-//      resolven.
+//   1. Default fallback: `resolveComplianceProfile(undefined)` returns
+//      `minimal-no-region` with `warning: "no-profile-selected"`. The caller
+//      can use this to trigger an onboarding banner; resolution is never
+//      silent.
 //
-//   2. extends-Chain-Tiefe: nur 1-Level. de-hr-dsgvo-hgb extends
-//      eu-dsgvo, aber eu-dsgvo darf NICHT selbst extends haben. Boot-
-//      Validator (Sprint 1.3) prueft.
+//   2. Extends-chain depth: only one level is allowed. de-hr-dsgvo-hgb
+//      extends eu-dsgvo, but eu-dsgvo must not extend another profile. The
+//      boot validator checks this.
 //
-//   3. Deep-merge-Semantik vom Override: rekursiv. Override
-//      `{ userRights: { gracePeriod: { days: 60 } } }` auf eu-dsgvo
-//      laesst andere userRights-Felder unveraendert. Top-Level-Replace
-//      gibt es NICHT — Override muss strukturell exakt das Pfad-Tree
-//      treffen.
+//   3. Override deep-merge semantics: merging is recursive. An override such
+//      as `{ userRights: { gracePeriod: { days: 60 } } }` on eu-dsgvo leaves
+//      the other userRights fields unchanged. Top-level replacement is not
+//      supported; the override must target the corresponding property path.
 //
-//   4. Required-Field-Override: Override-Type ist `DeepPartial<...>`.
-//      TypeScript verhindert null-Drops zur Compile-Time. Runtime-Cast
-//      durch Tenant-Admin-Override-Endpoint laeuft durch Zod-Schema
-//      mit allen-Properties-optional (kein nullable).
-//
-// Siehe docs/plans/datenschutz/compliance-profiles.md.
+//   4. Required-field overrides: the override type is `DeepPartial<...>`.
+//      TypeScript prevents null drops at compile time. Runtime casts from
+//      the tenant-admin override endpoint pass through a Zod schema with
+//      all properties optional, but not nullable.
 import { isPlainObject } from "../utils/is-plain-object.js";
 // --- Profile-Definitions (raw, before extends-Resolution) ---
 const RAW_PROFILES = {
@@ -155,12 +152,12 @@ const RAW_PROFILES = {
         tenantDestroyGracePeriod: { days: 30 },
     },
 };
-// --- Tenant-Auswählbare Liste (ohne minimal-no-region) ---
+// --- Tenant-selectable list (excluding minimal-no-region) ---
 /**
- * Profile-Schluessel die der Tenant-Admin im Onboarding waehlen darf.
- * `minimal-no-region` ist bewusst NICHT in der Liste — es ist der
- * Default-Fallback fuer "noch keine Wahl getroffen", mit sichtbarer
- * Warning. Production-Tenants sollen ein echtes Profile waehlen.
+ * Profile keys that the tenant admin may select during onboarding.
+ * `minimal-no-region` is intentionally excluded: it is the default fallback
+ * for "no choice made yet" and produces a visible warning. Production
+ * tenants must select an actual profile.
  */
 export const SELECTABLE_PROFILE_KEYS = [
     "eu-dsgvo",
@@ -168,20 +165,18 @@ export const SELECTABLE_PROFILE_KEYS = [
     "de-hr-dsgvo-hgb",
 ];
 /**
- * Top-Level-Properties des `ComplianceProfile`-Type, die ein Tenant-
- * Override modifizieren darf. Identifikations-Felder (key, region,
- * label, extends) sind ausgeschlossen — wer die overriden wuerde,
- * würde die Profile-Identität zerstoeren.
+ * Top-level `ComplianceProfile` properties that a tenant override may modify.
+ * Identity fields (key, region, label, extends) are excluded because
+ * overriding them would destroy the profile's identity.
  *
- * Single source of truth fuer:
- *   - set-profile-Handler-Whitelist (Tippfehler-Reject)
- *   - Snapshot-Test gegen Profile-Top-Level (Drift-Guard)
+ * This is the single source of truth for:
+ *   - the set-profile handler whitelist, which rejects typos
+ *   - the snapshot test that guards against drift from the profile's top level
  *
- * Wenn ein neues Top-Level-Property zu `ComplianceProfile` kommt
- * (z.B. `dataSubjectRights` oder `crossBorderTransferRules`), MUSS es
- * hier ergaenzt werden — sonst lehnt set-profile valide Overrides ab.
- * Der Snapshot-Test in profiles.test.ts faengt Drift in beide
- * Richtungen.
+ * When a new top-level property is added to `ComplianceProfile` (for example,
+ * `dataSubjectRights` or `crossBorderTransferRules`), it must be added here;
+ * otherwise set-profile rejects valid overrides. The snapshot test in
+ * profiles.test.ts detects drift in either direction.
  */
 export const OVERRIDABLE_PROFILE_KEYS = new Set([
     "userRights",
@@ -192,11 +187,11 @@ export const OVERRIDABLE_PROFILE_KEYS = new Set([
     "tenantDestroyGracePeriod",
     "forgetDiscovery",
 ]);
-// Pfade die als ganzes Atom ersetzt werden (NICHT rekursiv gemergt).
-// Notwendig fuer Diskriminierte-Union-Types wo das Patch ein Schwester-
-// Property statt einer Override sein kann — z.B. retention von
-// { months: 24 } auf { years: 10 } wuerde sonst zu { months: 24, years: 10 }
-// werden, semantisch nonsense.
+// These paths are replaced as atomic values rather than merged recursively.
+// This is required for discriminated unions, where a patch may provide a
+// sibling property instead of an override; for example, changing retention
+// from { months: 24 } to { years: 10 } would otherwise produce
+// { months: 24, years: 10 }, which is semantically invalid.
 const ATOMIC_PATHS = new Set([
     "userRights.gracePeriod",
     "userRights.auskunftFrist",
@@ -213,7 +208,7 @@ function deepMerge(base, patch, path = "") {
         const fullPath = path ? `${path}.${k}` : k;
         const existing = out[k];
         if (ATOMIC_PATHS.has(fullPath)) {
-            // Atomic — replace komplett statt rekursiv mergen.
+            // Atomic — replace completely instead of merging recursively.
             out[k] = v;
         }
         else if (isPlainObject(existing) && isPlainObject(v)) {
@@ -226,13 +221,12 @@ function deepMerge(base, patch, path = "") {
     return out; // @cast-boundary generic-record
 }
 /**
- * Resolved ein Profile inklusive `extends`-Auflösung. Wirft wenn die
- * extends-Chain tiefer als 1 Level ist (vermeidet Cycles + macht
- * Boot-Validation einfach).
+ * Resolves a profile, including its `extends` chain. Throws when the chain
+ * is deeper than one level to prevent cycles and keep boot validation simple.
  *
- * Edge-Case (gepinnt): das `extends`-Target darf selbst KEIN extends
- * haben. Wer doch eine Mehrstufen-Hierarchie braucht, definiert die
- * Stufen explizit (z.B. `de-hr-strict extends eu-dsgvo`, statt
+ * The `extends` target itself must not extend another profile. A required
+ * multi-level hierarchy must instead be defined explicitly (for example,
+ * `de-hr-strict extends eu-dsgvo` rather than
  * `de-hr-strict extends de-hr-dsgvo-hgb extends eu-dsgvo`).
  */
 function resolveExtends(key) {
@@ -248,25 +242,24 @@ function resolveExtends(key) {
     raw);
 }
 /**
- * Pre-baked Profile-Liste (extends bereits aufgelöst). Beim Modul-Load
- * einmal berechnet — wirft bei Definition-Fehlern (Cycle, missing target)
- * sofort, nicht erst beim ersten Resolver-Call.
+ * Precomputed profile list with `extends` already resolved. It is computed
+ * once when the module loads, so definition errors (cycles or missing
+ * targets) are thrown immediately rather than on the first resolver call.
  */
 export const COMPLIANCE_PROFILES = Object.fromEntries(Object.keys(RAW_PROFILES).map((k) => [k, resolveExtends(k)])); // @cast-boundary dynamic-key
 /**
- * Liefert das effektive Compliance-Profile fuer einen Tenant inklusive
- * Tenant-Override.
+ * Returns the effective compliance profile for a tenant, including its
+ * tenant override.
  *
- * Edge-Case-Verhalten (gepinnt):
+ * Edge-case behavior:
  *   - selection=undefined → minimal-no-region + warning="no-profile-selected"
- *   - selection=valid + override=undefined → effective profile, kein warning
- *   - selection=valid + override → deep-merged effective, kein warning
+ *   - selection=valid + override=undefined → effective profile, no warning
+ *   - selection=valid + override → deep-merged effective profile, no warning
  *
- * Production-Marker: das frueher hier vorgesehene "minimal-in-production"-
- * warning ist entfallen weil set-profile (Sprint 1.7 X1) minimal-no-region
- * nicht mehr als Tenant-Wahl akzeptiert. Wer Production-spezifisches
- * Verhalten braucht (z.B. Block-bei-Default), addiert den Marker spaeter
- * bei Bedarf.
+ * The former "minimal-in-production" warning was removed because
+ * set-profile no longer accepts minimal-no-region as a tenant selection.
+ * Production-specific behavior, such as blocking the default, can be added
+ * later if needed.
  */
 export function resolveComplianceProfile(args) {
     if (!args.selection) {

package/dist/compliance/sub-processors.d.ts

@@ -1,69 +1,67 @@
 /**
- * Bundle-Tier-Marker fuer SubProcessor.appliesTo. "all-tiers" matched
- * unabhaengig vom konkreten Tenant-Bundle (z.B. Hetzner als Hosting-
- * Provider). Konkrete Tier-Namen koennen per-Tenant gefiltert werden.
+ * Bundle tier marker for SubProcessor.appliesTo. "all-tiers" matches
+ * regardless of the tenant's specific bundle (for example, Hetzner as a
+ * hosting provider). Specific tier names can be filtered per tenant.
  */
 export type BundleTier = "all-tiers" | "standard" | "business" | "enterprise";
 /**
- * Beschreibt einen Auftragsverarbeiter (Art. 28 DSGVO) der von Kumiko
- * fuer den Plattform-Betrieb eingesetzt wird.
+ * Describes a processor within the meaning of GDPR Article 28 that Kumiko
+ * uses for platform operations.
  */
 export interface SubProcessor {
     /** Voller juristischer Name. */
     readonly name: string;
-    /** Was macht der Sub-Processor fuer uns? */
+    /** What the sub-processor does for us. */
     readonly purpose: string;
     /** Sitz / Datenverarbeitungs-Region. */
     readonly region: string;
-    /** Link zum Auftragsverarbeitungsvertrag (DPA/AVV). */
+    /** Link to the data processing agreement (DPA/AVV). */
     readonly dpa: string;
-    /** Wann wurde der Sub-Processor zu unserer Plattform hinzugefuegt? */
+    /** Date when the sub-processor was added to the platform. */
     readonly addedAt: string;
     /**
-     * Welche Bundle-Tiers nutzen diesen Sub-Processor?
-     * Tenants nicht-betroffener Tiers brauchen keine Notification bei
-     * Aenderungen.
+     * Bundle tiers that use this sub-processor.
+     * Tenants in unaffected tiers do not need notifications about changes.
      */
     readonly appliesTo: readonly BundleTier[];
     /**
-     * Standard Contractual Clauses (SCC) fuer Drittlandsuebermittlung
-     * abgeschlossen. Pflicht fuer alle Sub-Processors mit Sitz ausserhalb
-     * EU/EWR.
+     * Whether Standard Contractual Clauses (SCC) for transfers to third
+     * countries have been concluded. Required for all sub-processors based
+     * outside the EU/EEA.
      */
     readonly sccRequired?: boolean;
     /**
-     * Tenant muss explizit aktivieren (z.B. AI-Feature). Ohne Opt-In
-     * werden keine Daten an diesen Sub-Processor gesendet.
+     * The tenant must explicitly activate this sub-processor (for example,
+     * for an AI feature). No data is sent to it without opt-in.
      */
     readonly optInOnly?: boolean;
     /**
-     * Business Associate Agreement fuer HIPAA-Customers verfuegbar.
-     * Relevant nur fuer hipaa-healthcare Compliance-Profile.
+     * Whether a Business Associate Agreement is available for HIPAA customers.
+     * Relevant only for hipaa-healthcare compliance profiles.
      */
     readonly hipaaBaaAvailable?: boolean;
     /**
-     * Geplant aber noch nicht aktiv (Vorbereitung fuer kommenden Sprint).
-     * Wird im Sub-Processor-Endpoint als "planned"-Sektion separat
-     * ausgegeben damit Tenants schon Lead-Time bekommen.
+     * Planned but not yet active.
+     * The sub-processor endpoint outputs it in a separate "planned" section
+     * so tenants receive lead time for configuration.
      */
     readonly status?: "active" | "planned";
 }
 /**
- * Plattform-weite Sub-Processor-Liste.
+ * Platform-wide sub-processor list.
  *
- * Reihenfolge: nach addedAt (aelteste zuerst). Bei Aenderungen
- * Snapshot-Test im Test-File explizit updaten — der detektiert
- * stille Aenderungen.
+ * Ordered by addedAt (oldest first). Update the snapshot test explicitly
+ * when changing this list; it detects silent changes.
  */
 export declare const KUMIKO_SUB_PROCESSORS: readonly SubProcessor[];
 /**
- * Filter helper — nur aktive Sub-Processors (kein status="planned").
- * Genutzt vom oeffentlichen JSON-Endpoint (Sprint 1).
+ * Filter helper — active sub-processors only (excluding status="planned").
+ * Used by the public JSON endpoint.
  */
 export declare function getActiveSubProcessors(): readonly SubProcessor[];
 /**
- * Filter helper — nur geplante Sub-Processors (status="planned"). Werden
- * separat als "demnaechst aktiv"-Sektion ausgegeben damit Tenant-Admins
- * schon Lead-Time fuer Compliance-Profile-Konfiguration bekommen.
+ * Filter helper — planned sub-processors only (status="planned"). They are
+ * output separately in a "coming soon" section so tenant admins receive
+ * lead time for compliance profile configuration.
  */
 export declare function getPlannedSubProcessors(): readonly SubProcessor[];

package/dist/compliance/sub-processors.js

@@ -1,31 +1,27 @@
-// Sub-Processor-Liste der Kumiko-Plattform.
+// Kumiko platform sub-processors.
 //
-// Auftragsverarbeiter im Sinne von DSGVO Art. 28 die Kumiko fuer den
-// Plattform-Betrieb einsetzt. Wird oeffentlich exposed unter
-//   /api/compliance/sub-processors        (JSON, Sprint 1)
-//   /api/compliance/sub-processors.rss    (RSS, Sprint 1)
+// Processors within the meaning of GDPR Article 28 that Kumiko uses for
+// platform operations. Publicly exposed at:
+//   /api/compliance/sub-processors        (JSON)
+//   /api/compliance/sub-processors.rss    (RSS)
 //
 // Separate from the public marketing overview (kumiko.rocks/subprocessors),
 // which is compiled independently from templates/legal/_shared/subprocessors/
 // catalog.*.md. The two lists are not synced.
 //
-// Tenant-Admins muessen ueber Add/Change/Remove informiert werden mit
-// Lead-Time aus dem Compliance-Profile (typisch 30d). Cron-Job kommt
-// in Sprint 1 (compliance-profiles).
+// Tenant admins must be informed of additions, changes, and removals with
+// the lead time from the compliance profile (typically 30d). The notification
+// cron is not available yet.
 //
 // SubProcessor has no "removed" state yet: a removed entry is deleted from
 // the array, so until the notification cron exists a removal is documented
 // only in the changelog. Removed so far: Mailbox.org (mailbox hosting),
-// replaced by ALL-INKL.COM on 2026-09-02.
-//
-// Quelle: docs/plans/datenschutz/compliance-profiles.md "Sub-Processor-
-// Management" + docs/plans/datenschutz/legal-artifacts.md.
+// replaced by ALL-INKL.COM.
 /**
- * Plattform-weite Sub-Processor-Liste.
+ * Platform-wide sub-processor list.
  *
- * Reihenfolge: nach addedAt (aelteste zuerst). Bei Aenderungen
- * Snapshot-Test im Test-File explizit updaten — der detektiert
- * stille Aenderungen.
+ * Ordered by addedAt (oldest first). Update the snapshot test explicitly
+ * when changing this list; it detects silent changes.
  */
 export const KUMIKO_SUB_PROCESSORS = [
     {
@@ -107,16 +103,16 @@ export const KUMIKO_SUB_PROCESSORS = [
     },
 ];
 /**
- * Filter helper — nur aktive Sub-Processors (kein status="planned").
- * Genutzt vom oeffentlichen JSON-Endpoint (Sprint 1).
+ * Filter helper — active sub-processors only (excluding status="planned").
+ * Used by the public JSON endpoint.
  */
 export function getActiveSubProcessors() {
     return KUMIKO_SUB_PROCESSORS.filter((sp) => sp.status !== "planned");
 }
 /**
- * Filter helper — nur geplante Sub-Processors (status="planned"). Werden
- * separat als "demnaechst aktiv"-Sektion ausgegeben damit Tenant-Admins
- * schon Lead-Time fuer Compliance-Profile-Konfiguration bekommen.
+ * Filter helper — planned sub-processors only (status="planned"). They are
+ * output separately in a "coming soon" section so tenant admins receive
+ * lead time for compliance profile configuration.
  */
 export function getPlannedSubProcessors() {
     return KUMIKO_SUB_PROCESSORS.filter((sp) => sp.status === "planned");

package/dist/consumer-cli.js

@@ -12,7 +12,7 @@ import { ensureTemporalPolyfill } from "./time/index.js";
 // "--instance-id=<id>") out of argv regardless of position, leaving the
 // remaining positionals for sub/name — instead of two independent
 // positional/flag reads that silently misparse "--instance-id" with no
-// value, the "=" form, or a flag placed before the positionals (#1412).
+// value, the "=" form, or a flag placed before the positionals.
 function parseConsumerCliArgs(argv) {
     const positionals = [];
     let instanceId;
@@ -57,9 +57,9 @@ export async function runConsumerCli(argv, out) {
     if (sub !== "status" && sub !== "restart") {
         // Unknown subcommand must be visible on stderr, not just a bare exit 1 —
         // ops invocations piping `2>&1 >/dev/null` or log pipelines that only
-        // watch stderr would otherwise see a failure with zero explanation
-        // (#1412). A bare help call (no subcommand at all) is not an error, so
-        // it keeps exit 0 + stdout.
+        // watch stderr would otherwise see a failure with zero explanation.
+        // A bare help call (no subcommand at all) is not an error, so it keeps
+        // exit 0 + stdout.
         const write = sub === undefined ? out.log : out.err;
         if (sub !== undefined)
             out.err(`  Unknown subcommand: ${sub}`);

package/dist/crypto/blind-index.js

@@ -1,23 +1,24 @@
-// Blind-Index für PII-Equality-Lookups (kumiko-framework#818).
-// `lookupable: true` auf einem Subject-annotierten text-Feld erzeugt eine
-// generierte Spalte `<snake>_bidx` mit deterministischem HMAC über den
-// KLARTEXT-Wert — Equality-Queries matchen `(col = $1 OR col_bidx = $2)`
-// und funktionieren damit für Klartext-Alt-Rows UND verschlüsselte Rows.
+// Blind index for PII equality lookups.
+// `lookupable: true` on a Subject-annotated text field generates a
+// `<snake>_bidx` column containing a deterministic HMAC of the
+// PLAINTEXT value. Equality queries match `(col = $1 OR col_bidx = $2)`
+// and therefore work for both plaintext legacy rows and encrypted rows.
 //
-// Wertformat: kumiko-bidx:v1:<base64url(HMAC-SHA256(key, value))>
+// Value format: kumiko-bidx:v1:<base64url(HMAC-SHA256(key, value))>
 //
-// HMAC ist byte-exact ohne Normalisierung — repliziert exakt die heutige
-// case-sensitive Equality-Semantik (Lowercasing wäre eine Verhaltensänderung).
+// HMAC computation is byte-exact and performs no normalization, preserving
+// the existing case-sensitive equality semantics (lowercasing would change
+// the behavior).
 //
-// Der Key ist bewusst ein EIGENER 32-Byte-Key (env: KUMIKO_BLIND_INDEX_KEY),
-// nicht vom PLATFORM_KEK abgeleitet und nicht Teil des KmsAdapter-Contracts —
-// BYOK-Adapter dürfen ihn nie sehen. Rotation = Recompute aller bidx-Spalten
-// (Rollout-Fahrplan Schritt 7).
+// The key is deliberately a SEPARATE 32-byte key (env:
+// KUMIKO_BLIND_INDEX_KEY), not derived from PLATFORM_KEK and not part of the
+// KmsAdapter contract, so BYOK adapters must never see it. Rotation requires
+// recomputing all bidx columns.
 //
-// bidx-Werte leben NUR in der Projektion, nie in Event-Payloads: ein
-// deterministischer HMAC im immutablen Event wäre permanente Linkage und
-// bräche Forget. applyEntityEvent berechnet sie beim Apply (live + rebuild),
-// nach Key-Erase recomputet der Rebuild sie zu NULL.
+// bidx values exist ONLY in the projection, never in event payloads: a
+// deterministic HMAC in an immutable event would create permanent linkage
+// and break erasure. applyEntityEvent computes them during Apply (live and
+// rebuild); after key erasure, the rebuild recomputes them as NULL.
 import { createHmac } from "node:crypto";
 import { requestContext } from "../api/request-context.js";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
@@ -38,7 +39,7 @@ export function decodeBlindIndexKey(base64Key) {
 // Boot-injected app-wide key, mirroring configurePiiSubjectKms: run{Prod,Dev}App
 // call configureBlindIndexKey once; query compilers + applyEntityEvent resolve
 // lazily. Absent key = blind-indexing off (bidx columns stay NULL, equality
-// lookups match plaintext rows only — pre-#818 behavior).
+// lookups match plaintext rows only).
 let injectedKey;
 export function configureBlindIndexKey(base64Key) {
     injectedKey = base64Key === undefined ? undefined : decodeBlindIndexKey(base64Key);

package/dist/crypto/ciphertext-pattern.js

@@ -9,7 +9,7 @@ export function quoteIdent(name) {
 export function escapeLikePattern(value) {
     return value.replace(/[\\%_]/g, (m) => `\\${m}`);
 }
-// "v%" matches any format version (v1 no-AAD, v2 AAD-bound, #1263) — the
+// "v%" matches any format version (v1 no-AAD, v2 AAD-bound) — the
 // subject key placement is stable across versions.
 export function subjectCiphertextLikePattern(subjectKey) {
     return `kumiko-pii:v%:${escapeLikePattern(subjectKey)}:%`;

package/dist/crypto/event-pii.js

@@ -1,4 +1,4 @@
-// PII on custom-event payloads (#799). Entity CRUD events get their PII
+// PII on custom-event payloads. Entity CRUD events get their PII
 // encrypted by the executor; events written via ctx.appendEvent / MSP-apply /
 // low-level append() (delivery attempt-log, jobs run-logger) had no encrypt
 // path at all. `r.defineEvent(name, schema, { piiFields })` declares which
@@ -8,7 +8,7 @@
 // events skip the registry and take their stance from system-event-pii.ts
 // instead (fail-closed when missing).
 //
-// `piiFields` is a mandatory, explicit stance (fw#2558): a payload can only
+// `piiFields` is a mandatory, explicit stance: a payload can only
 // go uncatalogued through a declared `piiFields: "none"`, never by omission —
 // defineEvent refuses to register an event without one. What used to be a
 // silent no-op (forgetting the option) is now either an explicit "none" or a
@@ -48,7 +48,7 @@ function isStructuredJsonValue(value) {
     return typeof value === "object" && value !== null;
 }
 // Encrypts catalogued payload fields under the declared subject's DEK
-// (user/tenant/self — resolveEventSubject, fw#2801). No-op when the event
+// (user/tenant/self — resolveEventSubject). No-op when the event
 // type is uncatalogued or no subject KMS is configured (plaintext rollout
 // mode — the hard boot gate governs whether that is acceptable). A
 // user-subject field with an empty owner follows its declared `whenAbsent`

package/dist/crypto/kek-source.d.ts

@@ -14,7 +14,7 @@ export type KekSourceEnv = {
 export type KekSourceOptions = {
     readonly fetch?: typeof globalThis.fetch;
     readonly logPrefix?: string;
-    /** Where the boot line naming the KEK source goes. Defaults to `console.info`. */
+    /** Where the boot line naming the KEK source goes. Defaults to the process logger, or `console.info` before one is wired. */
     readonly log?: (message: string) => void;
     /** Env names to resolve, e.g. `kmsSlotsOf(schema)`. */
     readonly slots: readonly string[];

package/dist/crypto/kek-source.js

@@ -4,6 +4,8 @@
 // made at all. Any `*_CIPHERTEXT` in the env that names no requested slot is
 // ignored — a foreign ciphertext must never fail boot.
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { createFallbackLogger } from "../logging/utils.js";
+const kekLog = createFallbackLogger("kumiko:kek");
 const SCALEWAY_KEY_MANAGER_API_VERSION = "v1alpha1";
 const DEFAULT_REGION = "fr-par";
 const DECRYPT_TIMEOUT_MS = 5_000;
@@ -107,8 +109,7 @@ export async function resolvePlatformKeks(env, options) {
         throw new Error(`${prefix}PLATFORM_KEK_PREVIOUS_VERSION must be set when PLATFORM_KEK_PREVIOUS is set.`);
     }
     const results = await Promise.all(slots.map((name) => resolveSlot(name, env, options, fetchImpl)));
-    // biome-ignore lint/suspicious/noConsole: ops-visible fallback when no logger is wired
-    const log = options.log ?? console.info;
+    const log = options.log ?? ((message) => kekLog.info(message));
     const resolved = {};
     slots.forEach((name, index) => {
         const result = results[index];

package/dist/crypto/kms-adapter.d.ts

@@ -6,7 +6,7 @@ export declare const subjectIdSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     userId: z.ZodUUID;
 }, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"tenant">;
-    tenantId: z.ZodPipe<z.ZodUUID, z.ZodTransform<string, string>>;
+    tenantId: z.ZodUUID;
 }, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"record">;
     entity: z.ZodString;