@cosmicdrift/kumiko-framework 0.386.0 → 0.387.0

package/dist/api/server.js

@@ -93,6 +93,7 @@ function assertNoPayloadRateLimitsWithoutResolver(registry) {
 }
 export function buildServer(options) {
     assertSeedModeNotInProduction();
+    const bootLog = createFallbackLogger("kumiko:boot", options.context.log);
     // Single effective hop-count for every IP-derived rate-limit + requestMeta
     // below — the top-level option wins over the deprecated
     // `auth.trustedProxyHops` fallback.
@@ -119,11 +120,11 @@ export function buildServer(options) {
             "mount `file-foundation` + a `file-provider-*` feature (inmemory/s3/s3-env) and " +
             "select one per tenant via the 'file-foundation:config:provider' config-key.");
     }
-    // #2051 — a screen whose search box renders (kumiko-screen.tsx gates it on
+    // A screen whose search box renders (kumiko-screen.tsx gates it on
     // `screen.searchable ?? entity-has-searchable-field`, the same condition
     // used below) sends `payload.search` on every query. Without a
     // context.searchAdapter that throws UnprocessableError at request time
-    // (#2032) — surface the misconfig at boot instead of on the first search.
+    // — surface the misconfig at boot instead of on the first search.
     // Warn, not throw: unlike missing file-storage (uploads always fail),
     // list screens still work without search: only the search box is broken.
     // Several deployed apps (offlot-app, publicstatus, kumiko-studio,
@@ -131,7 +132,7 @@ export function buildServer(options) {
     if (!options.context.searchAdapter) {
         const unwiredEntities = entitiesWithSearchableScreen(options.registry);
         if (unwiredEntities.length > 0) {
-            console.warn(`[kumiko:boot] ${unwiredEntities.length} entit${unwiredEntities.length === 1 ? "y" : "ies"} ` +
+            bootLog.warn(`${unwiredEntities.length} entit${unwiredEntities.length === 1 ? "y" : "ies"} ` +
                 `have a searchable list screen but no SearchAdapter is wired on context.searchAdapter: ` +
                 `${unwiredEntities.join(", ")}. Search requests against ${unwiredEntities.length === 1 ? "it" : "them"} will fail with a 422 (search_adapter_not_wired) at runtime. ` +
                 "Wire a SearchAdapter (e.g. createMeilisearchAdapter) on context.searchAdapter, or remove `searchable: true` from the affected fields.");
@@ -145,8 +146,8 @@ export function buildServer(options) {
     // An explicit ServerOptions.sseBroker always wins (caller owns its
     // lifecycle) — createDefaultSseBroker is the single decision point every
     // other caller must funnel through instead of picking a broker on its
-    // own, so the REDIS_URL-gated cross-replica default (fw#2625) can't be
-    // silently bypassed the way runProdApp bypassed it before this existed.
+    // own, so the REDIS_URL-gated cross-replica default can't be silently
+    // bypassed the way runProdApp bypassed it before this existed.
     let sseBroker;
     let ownedRedisSseBroker;
     if (options.sseBroker) {
@@ -157,7 +158,7 @@ export function buildServer(options) {
         sseBroker = defaults.sseBroker;
         ownedRedisSseBroker = defaults.ownedRedisSseBroker;
         if (!ownedRedisSseBroker) {
-            console.warn("[kumiko:boot] REDIS_URL is not set: cross-replica fanout disabled. SSE, access-invalidation and toggle-sync reach only the cursor-owning process, so with more than one replica clients on the other replicas miss events and revoked sessions stay open there.");
+            bootLog.warn("REDIS_URL is not set: cross-replica fanout disabled. SSE, access-invalidation and toggle-sync reach only the cursor-owning process, so with more than one replica clients on the other replicas miss events and revoked sessions stay open there.");
         }
     }
     // Same decision as the SSE broker: an explicit dispatcherOptions value
@@ -176,7 +177,7 @@ export function buildServer(options) {
             `pick any other stable string.`);
     }
     // Warn when we fell back to a random UUID. The built-in SSE consumer is
-    // delivery="shared" (one cursor for all pods, fw#2625), so it no longer
+    // delivery="shared" (one cursor for all pods), so it no longer
     // writes a row per instance. The id still labels this process in the
     // app.started event and in per-instance consumers (opt-in delivery), where a
     // fresh id per boot leaves an orphaned cursor-row that pins pruneEvents
@@ -185,7 +186,7 @@ export function buildServer(options) {
     // deliberate choices (the test suite sets KUMIKO_INSTANCE_ID="test-instance").
     const instanceIdWasRandom = options.instanceId === undefined && !process.env["KUMIKO_INSTANCE_ID"];
     if (instanceIdWasRandom) {
-        console.warn(`[kumiko:boot] No ServerOptions.instanceId / KUMIKO_INSTANCE_ID set — generated a random UUID (${resolvedInstanceId}). ` +
+        bootLog.warn(`No ServerOptions.instanceId / KUMIKO_INSTANCE_ID set — generated a random UUID (${resolvedInstanceId}). ` +
             `SSE no longer needs a per-instance cursor, but the id labels this process in the app.started event and in per-instance consumers; without a stable id each restart leaves an orphaned cursor-row behind for those and pins events-retention on its last cursor. ` +
             `Set KUMIKO_INSTANCE_ID to the pod name (e.g. from the Kubernetes downward API metadata.name) in production.`);
     }
@@ -252,7 +253,7 @@ export function buildServer(options) {
             Object.keys(feature.writeHandlers).length + Object.keys(feature.queryHandlers).length > 0)
             .map((feature) => feature.name);
         if (unlimitedSystemScopeFeatures.length > 0) {
-            console.warn(`[kumiko:boot] r.systemScope() features have handlers but no RateLimitResolver is configured, ` +
+            bootLog.warn(`r.systemScope() features have handlers but no RateLimitResolver is configured, ` +
                 `so their default rate limit is not enforced: ${unlimitedSystemScopeFeatures.join(", ")}. ` +
                 "Wire a Redis client on context.redis and declare rateLimit on at least one handler (or pass " +
                 "context.rateLimit) to enable the resolver.");
@@ -331,7 +332,7 @@ export function buildServer(options) {
     if (jobTriggerConsumerEnabled && jobRunnerForTriggers) {
         systemConsumers.push(createJobTriggerEventConsumer(jobRunnerForTriggers, options.registry));
     }
-    // Default ON (#1524 global-by-default). Tests that opt out of SSE via
+    // Default ON (global-by-default). Tests that opt out of SSE via
     // systemConsumers.accessInvalidation=false (test-stack mirrors sse off)
     // skip the row so retention prune suites are not blocked by a lagging
     // cursor=0 consumer they never drain.
@@ -345,7 +346,7 @@ export function buildServer(options) {
     // baseDb DbRunner; tenant consistency comes from the triggering event's
     // own tenantId, not a per-event TenantDb scope.
     //
-    // Lane-filter (Welle 2.6.b): MSPs declare `runIn` to pin them to a
+    // Lane-filter: MSPs declare `runIn` to pin them to a
     // deploy-lane. An MSP with `runIn: "api"` won't be wired into the
     // worker-process dispatcher (and vice versa). `runIn: "both"` (or the
     // legacy undefined default of "worker") runs wherever a dispatcher is
@@ -484,7 +485,7 @@ export function buildServer(options) {
         registerMetricsRoute(app, observability.meter, options.metrics);
     }
     else if (process.env["NODE_ENV"] === "production") {
-        console.warn("[kumiko:boot] /metrics is off: no `metrics` option, so nothing is measured or scraped. " +
+        bootLog.warn("/metrics is off: no `metrics` option, so nothing is measured or scraped. " +
             "Set PROMETHEUS_METRICS_TOKEN (min 32 chars) and spread resolveObservabilityWiring(token) into the server options.");
     }
     app.use("/api/*", requestIdMiddleware({
@@ -529,7 +530,7 @@ export function buildServer(options) {
         meter: observability.meter,
     }));
     // Tripwire: a kumiko-pii: ciphertext in a JSON response is always a bug
-    // (raw read leaked past a decrypt) — dev fails loud, prod redacts (#820).
+    // (raw read leaked past a decrypt) — dev fails loud, prod redacts.
     app.use("/api/*", piiCiphertextResponseGuard());
     // Auth middleware skips public paths (login, health) — those routes need
     // to be callable without a valid JWT. Every other /api/* request requires
@@ -684,7 +685,7 @@ export function buildServer(options) {
     // also gets rejected below — the schema never reaches an unauthenticated
     // caller. The FULL schema is built lazily once — the registry is
     // immutable for this server's lifetime, so it's the same on every
-    // request — then projected per caller-role-set (fw#3314: a role only
+    // request — then projected per caller-role-set (a role only
     // sees the screens/navs/workspaces/content-collections it may reach,
     // not the whole app's schema) and cached per role key. Tenant is
     // deliberately NOT part of the key: the projection depends only on
@@ -756,16 +757,15 @@ export function buildServer(options) {
             ...(routeOptions.maxUploadSize ? { maxUploadSize: routeOptions.maxUploadSize } : {}),
         }));
     }
-    // Feature-deklarierte HTTP-Routes (r.httpRoute). Mount nach /api/* damit
-    // /api/* immer Vorrang hat — feature-Routes liegen ohnehin außerhalb
-    // (Boot-Validator blockt /api-Prefix). deps.app ist die Outer-App, sodass
-    // der Handler /api/query intern via app.fetch(...) nutzen kann (gleicher
-    // Auth-Pfad wie ein echter HTTP-Call). deps.systemQuery umgeht diesen
-    // Pfad bewusst — für Routes die einen FESTEN Tenant erzwingen müssen
-    // (z.B. legal-pages → immer SYSTEM_TENANT_ID), statt ihn per X-Tenant-
-    // Header vorzutäuschen (das sieht für die anonymousAccess-Auflösung
-    // wie ein normaler Client-Header aus und wird von resolverTrust:
-    // "authoritative"-Configs zurecht als Tenant-Override abgelehnt).
+    // Feature-declared HTTP routes (r.httpRoute). Mount after /api/* so /api/* always
+    // takes precedence; feature routes must be outside that prefix (the boot validator
+    // enforces this). deps.app is the outer app, so the handler can call /api/query
+    // internally through app.fetch(...) and use the same auth path as a real HTTP call.
+    // deps.systemQuery deliberately bypasses that path for routes that must enforce a
+    // FIXED tenant (for example, legal-pages always uses SYSTEM_TENANT_ID), rather than
+    // spoofing it through the X-Tenant header. That header looks like a normal client
+    // header to anonymousAccess resolution, so resolverTrust: "authoritative" configs
+    // correctly reject it as a tenant override.
     for (const feature of options.registry.features.values()) {
         for (const route of Object.values(feature.httpRoutes)) {
             // @wrapper-known semantic-alias
@@ -831,8 +831,8 @@ export function buildServer(options) {
             }));
         }
     }
-    // extraRoutes (kumiko-framework#3050) — declarative HTTP-routes with a
-    // Pflicht `entry` tier. Mounted after r.httpRoute for the same reason: an
+    // extraRoutes — declarative HTTP-routes with a
+    // required `entry` tier. Mounted after r.httpRoute for the same reason: an
     // extraRoute dispatching through `dispatcher` builds Hono's matcher, so
     // this must run before any seed that also dispatches (runProdApp/
     // createKumikoServer call buildServer before seeding).
@@ -886,17 +886,18 @@ export function buildServer(options) {
             mountHonoRoute(app, route.method, route.path, honoHandler, bodyLimitForRoutePath(route.path, options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES));
         }
     }
-    // /version-Default registriert NACH feature-routes — Hono "first match
-    // wins", also gewinnt feature-deklariertes /version (z.B. App-spezifisches
-    // version-format mit Tenant-Stats) wenn vorhanden, sonst greift der
-    // Default-Handler aus BUILD_VERSION/BUILD_TIME-env-vars.
+    // The default /version route is registered AFTER feature routes — Hono uses
+    // "first match wins", so a feature-declared /version route (for example, an
+    // app-specific version format with tenant statistics) takes precedence when
+    // present; otherwise the default handler uses BUILD_VERSION/BUILD_TIME environment
+    // variables.
     registerVersionRoute(app);
     // Marks "no route matched this path" so tryHonoFirst (server-runtime)
     // can tell it apart from a matched route's OWN deliberate 404 (e.g.
     // default-deny reads like file-derivatives' public-variant route) —
     // without this, tryHonoFirst's only signal was the status code, and a
     // matched route answering 404 got silently rewritten to the SPA shell
-    // with status 200 (kumiko-framework#2435). Must be the LAST thing wired
+    // with status 200. Must be the LAST thing wired
     // on `app`: this only fires when the router found no handler at all, so
     // a route's own `c.text(..., 404)` never passes through here. A handler
     // that calls `c.notFound()` instead of building its own Response DOES
@@ -1234,8 +1235,8 @@ function registryDeclaresFileFields(registry) {
 // === false` is excluded — the boot-validator (entity-list-screens.ts) only
 // allows that on the whitelisted download-attempt-list-style screens, which
 // never render the box. This is the config-only half of the rule; the
-// client additionally gates on FeatureSchema.searchAdapterMissing (#2062,
-// set from the same `!options.context.searchAdapter` check below) so the
+// client additionally gates on FeatureSchema.searchAdapterMissing
+// (set from the same `!options.context.searchAdapter` check below) so the
 // box is actually suppressed once this function finds a hit.
 function entitiesWithSearchableScreen(registry) {
     const entities = new Set();

package/dist/api/sse-broker.js

@@ -37,7 +37,7 @@ export function shouldInvalidateListener(credential, scope) {
 }
 export function createSseBroker() {
     // Purely local: no cross-replica fanout. buildServer wraps this in
-    // createRedisSseBroker (fw#2625) whenever REDIS_URL is set, which is what
+    // createRedisSseBroker whenever REDIS_URL is set, which is what
     // makes pushToChannel/publishAccessInvalidation reach every replica's
     // clients — this reference implementation stays single-process only.
     const channels = new Map();

package/dist/api/sse-route.d.ts

@@ -2,24 +2,24 @@ import { Hono } from "hono";
 import type { AccessRule } from "../engine/types/index.ts";
 import { type SseBroker } from "./sse-broker.ts";
 /**
- * Heartbeat-Cadence für SSE-Streams.
+ * Heartbeat cadence for SSE streams.
  *
- * Spec: muss UNTER jedem realistischen Idle-Timeout der Hop-by-Hop-Layer
- * liegen, sonst killt einer davon die Connection und der Browser sieht
- * ERR_HTTP2_PROTOCOL_ERROR. Bekannte Limits:
- *   - Bun.serve default: 10 s (lokal disabled via idleTimeout: 0,
- *     aber Spec-konform auch ohne Override)
- *   - Caddy reverse_proxy: kein default-Timeout für SSE (auto-detect
- *     via Content-Type), aber langlebige idle Streams können von
- *     Connection-Tracking dichtgemacht werden
+ * Must stay below every realistic idle timeout in the hop-by-hop layers;
+ * otherwise one of them terminates the connection and the browser reports
+ * ERR_HTTP2_PROTOCOL_ERROR. Known limits:
+ *   - Bun.serve default: 10 s (disabled locally via idleTimeout: 0,
+ *     but the cadence also conforms without that override)
+ *   - Caddy reverse_proxy: no default timeout for SSE (auto-detects
+ *     via Content-Type), but long-lived idle streams may be closed by
+ *     connection tracking
  *   - Cloudflare Edge: 100 s
  *   - AWS ALB: 60 s
  *
- * 15 s liegt komfortabel unter allen davon. Server-side Cost ist
- * marginal (1 Frame pro Client alle 15 s).
+ * 15 s is comfortably below all of these. The server-side cost is marginal
+ * (1 frame per client every 15 s).
  *
- * Spec-Test in __tests__/sse-route-spec.test.ts pinst diesen Wert
- * gegen versehentliches Hochsetzen.
+ * The spec test in __tests__/sse-route-spec.test.ts pins this value to
+ * prevent accidentally increasing it.
  */
 export declare const SSE_HEARTBEAT_INTERVAL_MS = 15000;
 export declare const SSE_STALLED_CLIENT_TIMEOUT_MS = 15000;

package/dist/api/sse-route.js

@@ -9,24 +9,24 @@ import { clearSessionCookies, getSessionCookies } from "./session-cookies.js";
 import { accessInvalidationCredentialFor } from "./sse-broker.js";
 import { scheduleTokenExpiry } from "./token-expiry-timer.js";
 /**
- * Heartbeat-Cadence für SSE-Streams.
+ * Heartbeat cadence for SSE streams.
  *
- * Spec: muss UNTER jedem realistischen Idle-Timeout der Hop-by-Hop-Layer
- * liegen, sonst killt einer davon die Connection und der Browser sieht
- * ERR_HTTP2_PROTOCOL_ERROR. Bekannte Limits:
- *   - Bun.serve default: 10 s (lokal disabled via idleTimeout: 0,
- *     aber Spec-konform auch ohne Override)
- *   - Caddy reverse_proxy: kein default-Timeout für SSE (auto-detect
- *     via Content-Type), aber langlebige idle Streams können von
- *     Connection-Tracking dichtgemacht werden
+ * Must stay below every realistic idle timeout in the hop-by-hop layers;
+ * otherwise one of them terminates the connection and the browser reports
+ * ERR_HTTP2_PROTOCOL_ERROR. Known limits:
+ *   - Bun.serve default: 10 s (disabled locally via idleTimeout: 0,
+ *     but the cadence also conforms without that override)
+ *   - Caddy reverse_proxy: no default timeout for SSE (auto-detects
+ *     via Content-Type), but long-lived idle streams may be closed by
+ *     connection tracking
  *   - Cloudflare Edge: 100 s
  *   - AWS ALB: 60 s
  *
- * 15 s liegt komfortabel unter allen davon. Server-side Cost ist
- * marginal (1 Frame pro Client alle 15 s).
+ * 15 s is comfortably below all of these. The server-side cost is marginal
+ * (1 frame per client every 15 s).
  *
- * Spec-Test in __tests__/sse-route-spec.test.ts pinst diesen Wert
- * gegen versehentliches Hochsetzen.
+ * The spec test in __tests__/sse-route-spec.test.ts pins this value to
+ * prevent accidentally increasing it.
  */
 export const SSE_HEARTBEAT_INTERVAL_MS = 15_000;
 // Entity events carry aggregateType in data (system-hooks.ts's SSE-broadcast
@@ -184,8 +184,8 @@ export function createSseRoute(broker, options) {
                 unsubscribeAccessInvalidation();
             };
             stream.onAbort(release);
-            // Keep connection alive with heartbeat — siehe SSE_HEARTBEAT_INTERVAL_MS
-            // header für die Layer-für-Layer-Begründung der 15s-Cadence.
+            // Keep the connection alive with a heartbeat — see SSE_HEARTBEAT_INTERVAL_MS
+            // for the layer-by-layer rationale for the 15 s cadence.
             try {
                 while (!stream.closed && !stream.aborted) {
                     if (isStalled()) {

package/dist/auth/index.js

@@ -1,5 +1,5 @@
-// `@cosmicdrift/kumiko-framework/auth` — Auth-Foundation (Roles, Token-
-// Helpers, Session-Types). Wird von Bundled-Features (auth-email-password,
-// tenant, user) und Datenschutz-Sprints (S1+ user-data-rights, S5 tenant-
-// lifecycle, S6 legal-hold) genutzt.
+// `@cosmicdrift/kumiko-framework/auth` — Auth foundation (roles, token-
+// helpers, session types). Used by bundled features (auth-email-password,
+// tenant, user) and data-protection features (user-data-rights, tenant-
+// lifecycle, legal-hold).
 export { ROLES } from "./roles.js";

package/dist/auth/roles.d.ts

@@ -1,6 +1,6 @@
 /**
- * Plattform-weit standardisierte Role-Namen. Alle Datenschutz-Sprints
- * (1+) nutzen ausschliesslich diese Constants statt String-Literale.
+ * Platform-wide standardized role names. All privacy-related code uses
+ * these constants exclusively instead of string literals.
  */
 export declare const ROLES: {
     readonly TenantOwner: "TenantOwner";
@@ -10,7 +10,7 @@ export declare const ROLES: {
     readonly Member: "Member";
 };
 /**
- * Type-Union aller bekannten Role-Namen (Compile-Time-Check fuer
- * Handler-Access-Rules + Ownership-Maps).
+ * Union of all known role names for compile-time checks of
+ * handler access rules and ownership maps.
  */
 export type Role = (typeof ROLES)[keyof typeof ROLES];

package/dist/auth/roles.js

@@ -1,30 +1,30 @@
-// Zentrale Role-Konstanten der Plattform.
+// Central role constants for the platform.
 //
-// Hintergrund: Bundled-Features driften zwischen "Admin" (text-content,
-// secrets, ai-foundation, file-provider-s3) und "TenantAdmin" (tenant-
-// handler, publicstatus, platform). App-Builder fallen in diese Falle.
-// Diese Datei ist die Single Source of Truth — Bundled-Features
-// migrieren schrittweise auf die ROLES-Constants in den Sprint-
-// Touchpoints, an denen sie ohnehin angefasst werden.
+// Background: Bundled features have drifted between "Admin" (text-content,
+// secrets, ai-foundation, file-provider-s3) and "TenantAdmin" (tenant-
+// handler, publicstatus, platform), which can trap app builders.
+// This file is the single source of truth. Bundled features are migrated
+// gradually to the ROLES constants at touchpoints where they are already
+// being changed.
 //
-// Canonical-Names:
-//   TenantOwner            — Volle Tenant-Hoheit, einzige Rolle die
-//                            Tenant-Destroy triggern darf.
-//   TenantAdmin            — Tenant-Konfiguration + User-Management.
-//                            Bestehender String "Admin" wird hierauf
-//                            migriert.
-//   DataProtectionOfficer  — DPO; setzt Legal-Holds, sieht Authority-
-//                            Audit-Stream auch im silentMode (Sprint 6).
-//   SystemAdmin            — Plattform-Operator (NICHT Tenant-scoped).
-//                            Authority-Export, KMS-Recovery, Cross-
-//                            Tenant-Setup. Matched den bestehenden
-//                            "SystemAdmin"-String in text-content,
-//                            secrets, auth-email-password, etc.
-//   Member                 — Standard-Mitglied eines Tenants ohne
-//                            Admin-Rechte.
+// Canonical names:
+//   TenantOwner            — Full tenant authority; the only role allowed
+//                            to trigger tenant destruction.
+//   TenantAdmin            — Tenant configuration and user management.
+//                            The existing "Admin" string is migrated
+//                            to this role.
+//   DataProtectionOfficer  — DPO; sets legal holds and can view the
+//                            authority audit stream even in silentMode.
+//   SystemAdmin            — Platform operator (NOT tenant-scoped).
+//                            Authority export, KMS recovery, cross-tenant
+//                            setup. Matches the existing "SystemAdmin"
+//                            string in text-content, secrets,
+//                            auth-email-password, etc.
+//   Member                 — Standard tenant member without
+//                            administrative rights.
 /**
- * Plattform-weit standardisierte Role-Namen. Alle Datenschutz-Sprints
- * (1+) nutzen ausschliesslich diese Constants statt String-Literale.
+ * Platform-wide standardized role names. All privacy-related code uses
+ * these constants exclusively instead of string literals.
  */
 export const ROLES = {
     TenantOwner: "TenantOwner",

package/dist/compliance/duration-spec.js

@@ -1,35 +1,33 @@
-// DurationSpec ↔ SQL-Interval ↔ Temporal.Duration converter.
+// Converts between DurationSpec, SQL intervals, and Temporal.Duration.
 //
-// Hintergrund: ComplianceProfile.userRights.gracePeriod ist
-// `{ days: number } | { hours: number }` (Discriminated Union). Caller
-// die das in eine Postgres-`interval`-SQL einsetzen brauchen einen
-// einzigen vertrauenswuerdigen Punkt, sonst springt ein
-// `{ hours: 6 }`-Override stillschweigend auf einen days-Default.
+// `ComplianceProfile.userRights.gracePeriod` is
+// `{ days: number } | { hours: number }` (a discriminated union). Callers
+// inserting it into a Postgres `interval` need one trusted conversion point;
+// otherwise an `{ hours: 6 }` override could silently use a days default.
 //
-// Single source of truth: hier. Andere Spec-Forms (months/years) im
-// retention-Pfad gehen ueber den breiteren `keep-for`-Parser, sind hier
-// bewusst nicht abgedeckt — das engt den Type ein und macht die SQL-
-// Renderung total.
+// This is the single source of truth. Other spec forms (months/years) in the
+// retention path use the broader `keep-for` parser and are deliberately not
+// supported here, keeping the type narrow and SQL rendering total.
 import { getTemporal } from "../time/index.js";
-// Spec in Millisekunden. Source of truth fuer alle Konvertierungen
-// (Instant-add, optional fuer JS-Datumsrechnung).
+// Millisecond representation of the spec. All conversions use this source
+// of truth, including Instant addition and optional JavaScript date handling.
 export function durationSpecToMs(spec) {
     if ("days" in spec)
         return spec.days * 24 * 60 * 60 * 1000;
     return spec.hours * 60 * 60 * 1000;
 }
-// Frist berechnen ohne DB-now() — der App-Server-Clock ist
-// authoritative. Fuer Forget-Grace, Token-TTLs und Frist-Setzungen
-// where eine Toleranz von wenigen ms zwischen App und DB irrelevant
-// ist (Grace-Periods >= 6h, Tokens >= Minuten).
+// Computes the deadline without DB-now(); the app server clock is
+// authoritative. This is used for Forget-Grace, token TTLs, and deadline
+// assignments where a difference of a few milliseconds between the app and
+// database is irrelevant (grace periods >= 6h, tokens >= minutes).
 //
-// Schreibt direkt in `instant()`-customType-Spalten — kein interval-
-// SQL-Fragment, kein Codec-Bypass.
+// Writes directly to `instant()` custom-type columns—no interval SQL
+// fragment or codec bypass.
 export function addDurationSpec(now, spec) {
     return getTemporal().Instant.fromEpochMilliseconds(now.epochMilliseconds + durationSpecToMs(spec));
 }
-// Lesbare Beschreibung fuer Logs / Error-Messages. Nicht i18n —
-// English-only-Operator-Output.
+// Human-readable descriptions for logs and error messages. Not localized;
+// operator output is English-only.
 export function describeDurationSpec(spec) {
     if ("days" in spec)
         return `${spec.days} day${spec.days === 1 ? "" : "s"}`;

package/dist/compliance/index.js

@@ -1,6 +1,5 @@
-// `@cosmicdrift/kumiko-framework/compliance` — Datenschutz/Compliance-
-// Foundation. Wird von Sprint-1+ Features genutzt (compliance-profiles,
-// data-retention, user-data-rights, ...).
+// `@cosmicdrift/kumiko-framework/compliance` — Data protection and compliance foundation.
+// Used by compliance-profiles, data-retention, user-data-rights, and related features.
 export { addDurationSpec, describeDurationSpec, durationSpecToMs, subtractRetentionSpec, } from "./duration-spec.js";
 export { complianceProfileOverrideSchema } from "./override-schema.js";
 export { COMPLIANCE_PROFILES, OVERRIDABLE_PROFILE_KEYS, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.js";

package/dist/compliance/override-schema.d.ts

@@ -1,9 +1,9 @@
 import * as z from "zod";
 /**
- * Komplett-Schema fuer ComplianceProfileOverride. Alle Top-Level- UND
- * Sub-Level-Keys sind gewhitelisted via .strict() — Tippfehler werfen
- * sofort. Set-profile-Handler (Sprint 1.9 Z3) validiert das Override
- * gegen dieses Schema vor dem Persist.
+ * Complete schema for ComplianceProfileOverride. All top-level and
+ * sub-level keys are whitelisted with `.strict()`, so typos throw
+ * immediately. The set-profile handler validates the override against
+ * this schema before persisting it.
  */
 export declare const complianceProfileOverrideSchema: z.ZodObject<{
     userRights: z.ZodOptional<z.ZodObject<{

package/dist/compliance/override-schema.js

@@ -1,21 +1,18 @@
-// Zod-Schema fuer ComplianceProfileOverride mit .strict() rekursiv —
-// Sprint 1.9 Z3.
+// Zod schema for ComplianceProfileOverride with recursive `.strict()` validation.
 //
-// Vorher: set-profile.write.ts pruefte nur Top-Level-Keys gegen
-// OVERRIDABLE_PROFILE_KEYS. Sub-Level-Tippfehler (z.B.
-// `{ userRights: { weeks: 3 } }` statt `{ userRights: { gracePeriod: { days: 30 } } }`)
-// kamen durch — der deepMerge spliced das nonsense ins effektive
-// Profile, und ein Caller der `userRights.gracePeriod.days` liest
-// crashed mit `undefined`.
+// Previously, set-profile.write.ts checked only top-level keys against
+// OVERRIDABLE_PROFILE_KEYS. Sub-level typos (for example,
+// `{ userRights: { weeks: 3 } }` instead of
+// `{ userRights: { gracePeriod: { days: 30 } } }`) passed through —
+// deepMerge spliced the nonsense into the effective profile, and a caller
+// reading `userRights.gracePeriod.days` crashed with `undefined`.
 //
-// Lösung: Zod-Schema das die ComplianceProfile-Struktur in DeepPartial-
-// Form abbildet, mit .strict() auf jedem Object damit unbekannte Keys
-// werfen. Single source of truth wie OVERRIDABLE_PROFILE_KEYS, plus
-// Sub-Level-Coverage.
+// The schema maps the ComplianceProfile structure to DeepPartial form and
+// uses `.strict()` on every object so unknown keys throw. It is a single
+// source of truth like OVERRIDABLE_PROFILE_KEYS, with sub-level coverage.
 //
-// Identifikations-Felder (key, region, label, extends) sind NICHT im
-// Schema — wer die overriden will, würde die Profile-Identitaet
-// zerstören.
+// Identification fields (`key`, `region`, `label`, `extends`) are excluded
+// from the schema because overriding them would destroy profile identity.
 import * as z from "zod";
 // DurationSpec: { days } | { hours } — strict bedeutet beide Forms
 // muessen exakt 1 property haben (kein "{ days: 30, hours: 1 }").
@@ -23,8 +20,8 @@ const durationSpecSchema = z.union([
     z.object({ days: z.number().int().nonnegative() }).strict(),
     z.object({ hours: z.number().int().nonnegative() }).strict(),
 ]);
-// retention.* erlaubt zusaetzlich "months" und "years". Wieder eine
-// strikte Disjunktion.
+// retention.* additionally allows `"months"` and `"years"`; this remains
+// a strict disjunction.
 const auditRetentionSchema = z.union([
     durationSpecSchema,
     z.object({ months: z.number().int().nonnegative() }).strict(),
@@ -54,7 +51,7 @@ const userRightsOverrideSchema = z
     employeeAccessRight: z.boolean().optional(),
     explicitConsentForAutomatedDecision: z.boolean().optional(),
     doNotSellRequired: z.boolean().optional(),
-    // Async-Export-Pipeline (S2.U3+U4) — TTL Compliance-relevant,
+    // Async-Export-Pipeline — TTL Compliance-relevant,
     // Stale/Cleanup Operations-Settings.
     exportDownloadTtl: durationSpecSchema.optional(),
     exportStaleTimeoutMinutes: z.number().int().nonnegative().optional(),
@@ -106,10 +103,10 @@ const forgetDiscoveryOverrideSchema = z
 })
     .strict();
 /**
- * Komplett-Schema fuer ComplianceProfileOverride. Alle Top-Level- UND
- * Sub-Level-Keys sind gewhitelisted via .strict() — Tippfehler werfen
- * sofort. Set-profile-Handler (Sprint 1.9 Z3) validiert das Override
- * gegen dieses Schema vor dem Persist.
+ * Complete schema for ComplianceProfileOverride. All top-level and
+ * sub-level keys are whitelisted with `.strict()`, so typos throw
+ * immediately. The set-profile handler validates the override against
+ * this schema before persisting it.
  */
 export const complianceProfileOverrideSchema = z
     .object({