@cosmicdrift/kumiko-framework 0.386.0 → 0.388.0

package/dist/api/session-cookies.js

@@ -53,10 +53,10 @@ export function expireLegacySessionCookieVariants(c, cookies) {
         // skip: the unprefixed names are the only legacy variant when the config writes __Host- names.
         return;
     }
-    if (cookies.secure) {
-        deleteCookie(c, sessionCookieName(AUTH_COOKIE_BASE, { secure: true }), hostPrefixedDelete);
-        deleteCookie(c, sessionCookieName(CSRF_COOKIE_BASE, { secure: true }), hostPrefixedDelete);
-    }
+    // Sent even with secureCookies:false: TLS may still terminate at a proxy, and over plain HTTP the
+    // browser drops the Secure delete without effect.
+    deleteCookie(c, sessionCookieName(AUTH_COOKIE_BASE, { secure: true }), hostPrefixedDelete);
+    deleteCookie(c, sessionCookieName(CSRF_COOKIE_BASE, { secure: true }), hostPrefixedDelete);
 }
 const hostPrefixedDelete = { path: "/", secure: true };
 // Expire every variant: the Domain cookie (current) and the host-only one

package/dist/api/sse-broker.js

@@ -37,7 +37,7 @@ export function shouldInvalidateListener(credential, scope) {
 }
 export function createSseBroker() {
     // Purely local: no cross-replica fanout. buildServer wraps this in
-    // createRedisSseBroker (fw#2625) whenever REDIS_URL is set, which is what
+    // createRedisSseBroker whenever REDIS_URL is set, which is what
     // makes pushToChannel/publishAccessInvalidation reach every replica's
     // clients — this reference implementation stays single-process only.
     const channels = new Map();

package/dist/api/sse-route.d.ts

@@ -2,24 +2,24 @@ import { Hono } from "hono";
 import type { AccessRule } from "../engine/types/index.ts";
 import { type SseBroker } from "./sse-broker.ts";
 /**
- * Heartbeat-Cadence für SSE-Streams.
+ * Heartbeat cadence for SSE streams.
  *
- * Spec: muss UNTER jedem realistischen Idle-Timeout der Hop-by-Hop-Layer
- * liegen, sonst killt einer davon die Connection und der Browser sieht
- * ERR_HTTP2_PROTOCOL_ERROR. Bekannte Limits:
- *   - Bun.serve default: 10 s (lokal disabled via idleTimeout: 0,
- *     aber Spec-konform auch ohne Override)
- *   - Caddy reverse_proxy: kein default-Timeout für SSE (auto-detect
- *     via Content-Type), aber langlebige idle Streams können von
- *     Connection-Tracking dichtgemacht werden
+ * Must stay below every realistic idle timeout in the hop-by-hop layers;
+ * otherwise one of them terminates the connection and the browser reports
+ * ERR_HTTP2_PROTOCOL_ERROR. Known limits:
+ *   - Bun.serve default: 10 s (disabled locally via idleTimeout: 0,
+ *     but the cadence also conforms without that override)
+ *   - Caddy reverse_proxy: no default timeout for SSE (auto-detects
+ *     via Content-Type), but long-lived idle streams may be closed by
+ *     connection tracking
  *   - Cloudflare Edge: 100 s
  *   - AWS ALB: 60 s
  *
- * 15 s liegt komfortabel unter allen davon. Server-side Cost ist
- * marginal (1 Frame pro Client alle 15 s).
+ * 15 s is comfortably below all of these. The server-side cost is marginal
+ * (1 frame per client every 15 s).
  *
- * Spec-Test in __tests__/sse-route-spec.test.ts pinst diesen Wert
- * gegen versehentliches Hochsetzen.
+ * The spec test in __tests__/sse-route-spec.test.ts pins this value to
+ * prevent accidentally increasing it.
  */
 export declare const SSE_HEARTBEAT_INTERVAL_MS = 15000;
 export declare const SSE_STALLED_CLIENT_TIMEOUT_MS = 15000;

package/dist/api/sse-route.js

@@ -9,24 +9,24 @@ import { clearSessionCookies, getSessionCookies } from "./session-cookies.js";
 import { accessInvalidationCredentialFor } from "./sse-broker.js";
 import { scheduleTokenExpiry } from "./token-expiry-timer.js";
 /**
- * Heartbeat-Cadence für SSE-Streams.
+ * Heartbeat cadence for SSE streams.
  *
- * Spec: muss UNTER jedem realistischen Idle-Timeout der Hop-by-Hop-Layer
- * liegen, sonst killt einer davon die Connection und der Browser sieht
- * ERR_HTTP2_PROTOCOL_ERROR. Bekannte Limits:
- *   - Bun.serve default: 10 s (lokal disabled via idleTimeout: 0,
- *     aber Spec-konform auch ohne Override)
- *   - Caddy reverse_proxy: kein default-Timeout für SSE (auto-detect
- *     via Content-Type), aber langlebige idle Streams können von
- *     Connection-Tracking dichtgemacht werden
+ * Must stay below every realistic idle timeout in the hop-by-hop layers;
+ * otherwise one of them terminates the connection and the browser reports
+ * ERR_HTTP2_PROTOCOL_ERROR. Known limits:
+ *   - Bun.serve default: 10 s (disabled locally via idleTimeout: 0,
+ *     but the cadence also conforms without that override)
+ *   - Caddy reverse_proxy: no default timeout for SSE (auto-detects
+ *     via Content-Type), but long-lived idle streams may be closed by
+ *     connection tracking
  *   - Cloudflare Edge: 100 s
  *   - AWS ALB: 60 s
  *
- * 15 s liegt komfortabel unter allen davon. Server-side Cost ist
- * marginal (1 Frame pro Client alle 15 s).
+ * 15 s is comfortably below all of these. The server-side cost is marginal
+ * (1 frame per client every 15 s).
  *
- * Spec-Test in __tests__/sse-route-spec.test.ts pinst diesen Wert
- * gegen versehentliches Hochsetzen.
+ * The spec test in __tests__/sse-route-spec.test.ts pins this value to
+ * prevent accidentally increasing it.
  */
 export const SSE_HEARTBEAT_INTERVAL_MS = 15_000;
 // Entity events carry aggregateType in data (system-hooks.ts's SSE-broadcast
@@ -136,6 +136,20 @@ export function createSseRoute(broker, options) {
             let pendingWrites = 0;
             let lastProgressAt = now();
             const isStalled = () => pendingWrites > 0 && now() - lastProgressAt > SSE_STALLED_CLIENT_TIMEOUT_MS;
+            // Pings go through the same accounting: an awaited ping would block on a client that
+            // stopped reading, and the stall check below would never run again.
+            const writeTracked = (event, data) => {
+                if (pendingWrites === 0)
+                    lastProgressAt = now();
+                pendingWrites += 1;
+                stream
+                    .writeSSE({ event, data })
+                    .catch(closeStream)
+                    .finally(() => {
+                    pendingWrites -= 1;
+                    lastProgressAt = now();
+                });
+            };
             const clientId = broker.addClient(channel, (event) => {
                 // skip: the stream is already being torn down
                 if (stream.aborted || stream.closed)
@@ -152,17 +166,7 @@ export function createSseRoute(broker, options) {
                         // skip: this client is gone, the frame has no audience
                         return;
                     }
-                    const data = JSON.stringify(frame.data);
-                    if (pendingWrites === 0)
-                        lastProgressAt = now();
-                    pendingWrites += 1;
-                    stream
-                        .writeSSE({ event: frame.name, data })
-                        .catch(closeStream)
-                        .finally(() => {
-                        pendingWrites -= 1;
-                        lastProgressAt = now();
-                    });
+                    writeTracked(frame.name, JSON.stringify(frame.data));
                 }
                 catch {
                     // skip: an unserializable frame ends this client's stream, not the broadcast
@@ -184,15 +188,15 @@ export function createSseRoute(broker, options) {
                 unsubscribeAccessInvalidation();
             };
             stream.onAbort(release);
-            // Keep connection alive with heartbeat — siehe SSE_HEARTBEAT_INTERVAL_MS
-            // header für die Layer-für-Layer-Begründung der 15s-Cadence.
+            // Keep the connection alive with a heartbeat — see SSE_HEARTBEAT_INTERVAL_MS
+            // for the layer-by-layer rationale for the 15 s cadence.
             try {
                 while (!stream.closed && !stream.aborted) {
                     if (isStalled()) {
                         stream.abort();
                         break;
                     }
-                    await stream.writeSSE({ event: "ping", data: "" });
+                    writeTracked("ping", "");
                     await Promise.race([stream.sleep(SSE_HEARTBEAT_INTERVAL_MS), ended]);
                 }
             }

package/dist/auth/index.js

@@ -1,5 +1,5 @@
-// `@cosmicdrift/kumiko-framework/auth` — Auth-Foundation (Roles, Token-
-// Helpers, Session-Types). Wird von Bundled-Features (auth-email-password,
-// tenant, user) und Datenschutz-Sprints (S1+ user-data-rights, S5 tenant-
-// lifecycle, S6 legal-hold) genutzt.
+// `@cosmicdrift/kumiko-framework/auth` — Auth foundation (roles, token-
+// helpers, session types). Used by bundled features (auth-email-password,
+// tenant, user) and data-protection features (user-data-rights, tenant-
+// lifecycle, legal-hold).
 export { ROLES } from "./roles.js";

package/dist/auth/roles.d.ts

@@ -1,6 +1,6 @@
 /**
- * Plattform-weit standardisierte Role-Namen. Alle Datenschutz-Sprints
- * (1+) nutzen ausschliesslich diese Constants statt String-Literale.
+ * Platform-wide standardized role names. All privacy-related code uses
+ * these constants exclusively instead of string literals.
  */
 export declare const ROLES: {
     readonly TenantOwner: "TenantOwner";
@@ -10,7 +10,7 @@ export declare const ROLES: {
     readonly Member: "Member";
 };
 /**
- * Type-Union aller bekannten Role-Namen (Compile-Time-Check fuer
- * Handler-Access-Rules + Ownership-Maps).
+ * Union of all known role names for compile-time checks of
+ * handler access rules and ownership maps.
  */
 export type Role = (typeof ROLES)[keyof typeof ROLES];

package/dist/auth/roles.js

@@ -1,30 +1,30 @@
-// Zentrale Role-Konstanten der Plattform.
+// Central role constants for the platform.
 //
-// Hintergrund: Bundled-Features driften zwischen "Admin" (text-content,
-// secrets, ai-foundation, file-provider-s3) und "TenantAdmin" (tenant-
-// handler, publicstatus, platform). App-Builder fallen in diese Falle.
-// Diese Datei ist die Single Source of Truth — Bundled-Features
-// migrieren schrittweise auf die ROLES-Constants in den Sprint-
-// Touchpoints, an denen sie ohnehin angefasst werden.
+// Background: Bundled features have drifted between "Admin" (text-content,
+// secrets, ai-foundation, file-provider-s3) and "TenantAdmin" (tenant-
+// handler, publicstatus, platform), which can trap app builders.
+// This file is the single source of truth. Bundled features are migrated
+// gradually to the ROLES constants at touchpoints where they are already
+// being changed.
 //
-// Canonical-Names:
-//   TenantOwner            — Volle Tenant-Hoheit, einzige Rolle die
-//                            Tenant-Destroy triggern darf.
-//   TenantAdmin            — Tenant-Konfiguration + User-Management.
-//                            Bestehender String "Admin" wird hierauf
-//                            migriert.
-//   DataProtectionOfficer  — DPO; setzt Legal-Holds, sieht Authority-
-//                            Audit-Stream auch im silentMode (Sprint 6).
-//   SystemAdmin            — Plattform-Operator (NICHT Tenant-scoped).
-//                            Authority-Export, KMS-Recovery, Cross-
-//                            Tenant-Setup. Matched den bestehenden
-//                            "SystemAdmin"-String in text-content,
-//                            secrets, auth-email-password, etc.
-//   Member                 — Standard-Mitglied eines Tenants ohne
-//                            Admin-Rechte.
+// Canonical names:
+//   TenantOwner            — Full tenant authority; the only role allowed
+//                            to trigger tenant destruction.
+//   TenantAdmin            — Tenant configuration and user management.
+//                            The existing "Admin" string is migrated
+//                            to this role.
+//   DataProtectionOfficer  — DPO; sets legal holds and can view the
+//                            authority audit stream even in silentMode.
+//   SystemAdmin            — Platform operator (NOT tenant-scoped).
+//                            Authority export, KMS recovery, cross-tenant
+//                            setup. Matches the existing "SystemAdmin"
+//                            string in text-content, secrets,
+//                            auth-email-password, etc.
+//   Member                 — Standard tenant member without
+//                            administrative rights.
 /**
- * Plattform-weit standardisierte Role-Namen. Alle Datenschutz-Sprints
- * (1+) nutzen ausschliesslich diese Constants statt String-Literale.
+ * Platform-wide standardized role names. All privacy-related code uses
+ * these constants exclusively instead of string literals.
  */
 export const ROLES = {
     TenantOwner: "TenantOwner",

package/dist/compliance/duration-spec.js

@@ -1,35 +1,33 @@
-// DurationSpec ↔ SQL-Interval ↔ Temporal.Duration converter.
+// Converts between DurationSpec, SQL intervals, and Temporal.Duration.
 //
-// Hintergrund: ComplianceProfile.userRights.gracePeriod ist
-// `{ days: number } | { hours: number }` (Discriminated Union). Caller
-// die das in eine Postgres-`interval`-SQL einsetzen brauchen einen
-// einzigen vertrauenswuerdigen Punkt, sonst springt ein
-// `{ hours: 6 }`-Override stillschweigend auf einen days-Default.
+// `ComplianceProfile.userRights.gracePeriod` is
+// `{ days: number } | { hours: number }` (a discriminated union). Callers
+// inserting it into a Postgres `interval` need one trusted conversion point;
+// otherwise an `{ hours: 6 }` override could silently use a days default.
 //
-// Single source of truth: hier. Andere Spec-Forms (months/years) im
-// retention-Pfad gehen ueber den breiteren `keep-for`-Parser, sind hier
-// bewusst nicht abgedeckt — das engt den Type ein und macht die SQL-
-// Renderung total.
+// This is the single source of truth. Other spec forms (months/years) in the
+// retention path use the broader `keep-for` parser and are deliberately not
+// supported here, keeping the type narrow and SQL rendering total.
 import { getTemporal } from "../time/index.js";
-// Spec in Millisekunden. Source of truth fuer alle Konvertierungen
-// (Instant-add, optional fuer JS-Datumsrechnung).
+// Millisecond representation of the spec. All conversions use this source
+// of truth, including Instant addition and optional JavaScript date handling.
 export function durationSpecToMs(spec) {
     if ("days" in spec)
         return spec.days * 24 * 60 * 60 * 1000;
     return spec.hours * 60 * 60 * 1000;
 }
-// Frist berechnen ohne DB-now() — der App-Server-Clock ist
-// authoritative. Fuer Forget-Grace, Token-TTLs und Frist-Setzungen
-// where eine Toleranz von wenigen ms zwischen App und DB irrelevant
-// ist (Grace-Periods >= 6h, Tokens >= Minuten).
+// Computes the deadline without DB-now(); the app server clock is
+// authoritative. This is used for Forget-Grace, token TTLs, and deadline
+// assignments where a difference of a few milliseconds between the app and
+// database is irrelevant (grace periods >= 6h, tokens >= minutes).
 //
-// Schreibt direkt in `instant()`-customType-Spalten — kein interval-
-// SQL-Fragment, kein Codec-Bypass.
+// Writes directly to `instant()` custom-type columns—no interval SQL
+// fragment or codec bypass.
 export function addDurationSpec(now, spec) {
     return getTemporal().Instant.fromEpochMilliseconds(now.epochMilliseconds + durationSpecToMs(spec));
 }
-// Lesbare Beschreibung fuer Logs / Error-Messages. Nicht i18n —
-// English-only-Operator-Output.
+// Human-readable descriptions for logs and error messages. Not localized;
+// operator output is English-only.
 export function describeDurationSpec(spec) {
     if ("days" in spec)
         return `${spec.days} day${spec.days === 1 ? "" : "s"}`;

package/dist/compliance/index.js

@@ -1,6 +1,5 @@
-// `@cosmicdrift/kumiko-framework/compliance` — Datenschutz/Compliance-
-// Foundation. Wird von Sprint-1+ Features genutzt (compliance-profiles,
-// data-retention, user-data-rights, ...).
+// `@cosmicdrift/kumiko-framework/compliance` — Data protection and compliance foundation.
+// Used by compliance-profiles, data-retention, user-data-rights, and related features.
 export { addDurationSpec, describeDurationSpec, durationSpecToMs, subtractRetentionSpec, } from "./duration-spec.js";
 export { complianceProfileOverrideSchema } from "./override-schema.js";
 export { COMPLIANCE_PROFILES, OVERRIDABLE_PROFILE_KEYS, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.js";

package/dist/compliance/override-schema.d.ts

@@ -1,9 +1,9 @@
 import * as z from "zod";
 /**
- * Komplett-Schema fuer ComplianceProfileOverride. Alle Top-Level- UND
- * Sub-Level-Keys sind gewhitelisted via .strict() — Tippfehler werfen
- * sofort. Set-profile-Handler (Sprint 1.9 Z3) validiert das Override
- * gegen dieses Schema vor dem Persist.
+ * Complete schema for ComplianceProfileOverride. All top-level and
+ * sub-level keys are whitelisted with `.strict()`, so typos throw
+ * immediately. The set-profile handler validates the override against
+ * this schema before persisting it.
  */
 export declare const complianceProfileOverrideSchema: z.ZodObject<{
     userRights: z.ZodOptional<z.ZodObject<{

package/dist/compliance/override-schema.js

@@ -1,21 +1,18 @@
-// Zod-Schema fuer ComplianceProfileOverride mit .strict() rekursiv —
-// Sprint 1.9 Z3.
+// Zod schema for ComplianceProfileOverride with recursive `.strict()` validation.
 //
-// Vorher: set-profile.write.ts pruefte nur Top-Level-Keys gegen
-// OVERRIDABLE_PROFILE_KEYS. Sub-Level-Tippfehler (z.B.
-// `{ userRights: { weeks: 3 } }` statt `{ userRights: { gracePeriod: { days: 30 } } }`)
-// kamen durch — der deepMerge spliced das nonsense ins effektive
-// Profile, und ein Caller der `userRights.gracePeriod.days` liest
-// crashed mit `undefined`.
+// Previously, set-profile.write.ts checked only top-level keys against
+// OVERRIDABLE_PROFILE_KEYS. Sub-level typos (for example,
+// `{ userRights: { weeks: 3 } }` instead of
+// `{ userRights: { gracePeriod: { days: 30 } } }`) passed through —
+// deepMerge spliced the nonsense into the effective profile, and a caller
+// reading `userRights.gracePeriod.days` crashed with `undefined`.
 //
-// Lösung: Zod-Schema das die ComplianceProfile-Struktur in DeepPartial-
-// Form abbildet, mit .strict() auf jedem Object damit unbekannte Keys
-// werfen. Single source of truth wie OVERRIDABLE_PROFILE_KEYS, plus
-// Sub-Level-Coverage.
+// The schema maps the ComplianceProfile structure to DeepPartial form and
+// uses `.strict()` on every object so unknown keys throw. It is a single
+// source of truth like OVERRIDABLE_PROFILE_KEYS, with sub-level coverage.
 //
-// Identifikations-Felder (key, region, label, extends) sind NICHT im
-// Schema — wer die overriden will, würde die Profile-Identitaet
-// zerstören.
+// Identification fields (`key`, `region`, `label`, `extends`) are excluded
+// from the schema because overriding them would destroy profile identity.
 import * as z from "zod";
 // DurationSpec: { days } | { hours } — strict bedeutet beide Forms
 // muessen exakt 1 property haben (kein "{ days: 30, hours: 1 }").
@@ -23,8 +20,8 @@ const durationSpecSchema = z.union([
     z.object({ days: z.number().int().nonnegative() }).strict(),
     z.object({ hours: z.number().int().nonnegative() }).strict(),
 ]);
-// retention.* erlaubt zusaetzlich "months" und "years". Wieder eine
-// strikte Disjunktion.
+// retention.* additionally allows `"months"` and `"years"`; this remains
+// a strict disjunction.
 const auditRetentionSchema = z.union([
     durationSpecSchema,
     z.object({ months: z.number().int().nonnegative() }).strict(),
@@ -54,7 +51,7 @@ const userRightsOverrideSchema = z
     employeeAccessRight: z.boolean().optional(),
     explicitConsentForAutomatedDecision: z.boolean().optional(),
     doNotSellRequired: z.boolean().optional(),
-    // Async-Export-Pipeline (S2.U3+U4) — TTL Compliance-relevant,
+    // Async-Export-Pipeline — TTL Compliance-relevant,
     // Stale/Cleanup Operations-Settings.
     exportDownloadTtl: durationSpecSchema.optional(),
     exportStaleTimeoutMinutes: z.number().int().nonnegative().optional(),
@@ -106,10 +103,10 @@ const forgetDiscoveryOverrideSchema = z
 })
     .strict();
 /**
- * Komplett-Schema fuer ComplianceProfileOverride. Alle Top-Level- UND
- * Sub-Level-Keys sind gewhitelisted via .strict() — Tippfehler werfen
- * sofort. Set-profile-Handler (Sprint 1.9 Z3) validiert das Override
- * gegen dieses Schema vor dem Persist.
+ * Complete schema for ComplianceProfileOverride. All top-level and
+ * sub-level keys are whitelisted with `.strict()`, so typos throw
+ * immediately. The set-profile handler validates the override against
+ * this schema before persisting it.
  */
 export const complianceProfileOverrideSchema = z
     .object({

package/dist/compliance/profiles.d.ts

@@ -64,27 +64,25 @@ export interface ComplianceProfile {
     };
 }
 /**
- * Profile-Schluessel die der Tenant-Admin im Onboarding waehlen darf.
- * `minimal-no-region` ist bewusst NICHT in der Liste — es ist der
- * Default-Fallback fuer "noch keine Wahl getroffen", mit sichtbarer
- * Warning. Production-Tenants sollen ein echtes Profile waehlen.
+ * Profile keys that the tenant admin may select during onboarding.
+ * `minimal-no-region` is intentionally excluded: it is the default fallback
+ * for "no choice made yet" and produces a visible warning. Production
+ * tenants must select an actual profile.
  */
 export declare const SELECTABLE_PROFILE_KEYS: readonly ["eu-dsgvo", "swiss-dsg", "de-hr-dsgvo-hgb"];
 /**
- * Top-Level-Properties des `ComplianceProfile`-Type, die ein Tenant-
- * Override modifizieren darf. Identifikations-Felder (key, region,
- * label, extends) sind ausgeschlossen — wer die overriden wuerde,
- * würde die Profile-Identität zerstoeren.
+ * Top-level `ComplianceProfile` properties that a tenant override may modify.
+ * Identity fields (key, region, label, extends) are excluded because
+ * overriding them would destroy the profile's identity.
  *
- * Single source of truth fuer:
- *   - set-profile-Handler-Whitelist (Tippfehler-Reject)
- *   - Snapshot-Test gegen Profile-Top-Level (Drift-Guard)
+ * This is the single source of truth for:
+ *   - the set-profile handler whitelist, which rejects typos
+ *   - the snapshot test that guards against drift from the profile's top level
  *
- * Wenn ein neues Top-Level-Property zu `ComplianceProfile` kommt
- * (z.B. `dataSubjectRights` oder `crossBorderTransferRules`), MUSS es
- * hier ergaenzt werden — sonst lehnt set-profile valide Overrides ab.
- * Der Snapshot-Test in profiles.test.ts faengt Drift in beide
- * Richtungen.
+ * When a new top-level property is added to `ComplianceProfile` (for example,
+ * `dataSubjectRights` or `crossBorderTransferRules`), it must be added here;
+ * otherwise set-profile rejects valid overrides. The snapshot test in
+ * profiles.test.ts detects drift in either direction.
  */
 export declare const OVERRIDABLE_PROFILE_KEYS: ReadonlySet<string>;
 type DeepReadonly<T> = T extends object ? {
@@ -95,9 +93,9 @@ type DeepPartial<T> = T extends object ? {
     [K in keyof T]?: DeepPartial<T[K]>;
 } : T;
 /**
- * Pre-baked Profile-Liste (extends bereits aufgelöst). Beim Modul-Load
- * einmal berechnet — wirft bei Definition-Fehlern (Cycle, missing target)
- * sofort, nicht erst beim ersten Resolver-Call.
+ * Precomputed profile list with `extends` already resolved. It is computed
+ * once when the module loads, so definition errors (cycles or missing
+ * targets) are thrown immediately rather than on the first resolver call.
  */
 export declare const COMPLIANCE_PROFILES: Readonly<Record<ComplianceProfileKey, ComplianceProfile>>;
 export interface EffectiveComplianceProfile {
@@ -105,19 +103,18 @@ export interface EffectiveComplianceProfile {
     readonly warning?: "no-profile-selected";
 }
 /**
- * Liefert das effektive Compliance-Profile fuer einen Tenant inklusive
- * Tenant-Override.
+ * Returns the effective compliance profile for a tenant, including its
+ * tenant override.
  *
- * Edge-Case-Verhalten (gepinnt):
+ * Edge-case behavior:
  *   - selection=undefined → minimal-no-region + warning="no-profile-selected"
- *   - selection=valid + override=undefined → effective profile, kein warning
- *   - selection=valid + override → deep-merged effective, kein warning
+ *   - selection=valid + override=undefined → effective profile, no warning
+ *   - selection=valid + override → deep-merged effective profile, no warning
  *
- * Production-Marker: das frueher hier vorgesehene "minimal-in-production"-
- * warning ist entfallen weil set-profile (Sprint 1.7 X1) minimal-no-region
- * nicht mehr als Tenant-Wahl akzeptiert. Wer Production-spezifisches
- * Verhalten braucht (z.B. Block-bei-Default), addiert den Marker spaeter
- * bei Bedarf.
+ * The former "minimal-in-production" warning was removed because
+ * set-profile no longer accepts minimal-no-region as a tenant selection.
+ * Production-specific behavior, such as blocking the default, can be added
+ * later if needed.
  */
 export declare function resolveComplianceProfile(args: {
     readonly selection?: ComplianceProfileKey;