@cosmicdrift/kumiko-framework 0.73.0 → 0.75.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.73.0",
+  "version": "0.75.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -181,7 +181,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.73.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.75.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/auth-routes-cookie.test.ts

@@ -259,9 +259,8 @@ describe("auth-routes cookieDomain", () => {
     });
     expect(res.status).toBe(200);
     expect(getSetCookieRaw(res, AUTH_COOKIE_NAME)).toMatch(/Domain=example\.eu/i);
-    // Das CSRF-Cookie wird via denselben common-Optionen rotiert wie das Auth-
-    // Cookie. Ohne Domain-Attribut bliebe es host-only neben dem Domain-Auth-
-    // Cookie → der Double-Submit-Check läse umgebungsabhängig das falsche.
+    // CSRF cookie is rotated with the same common options as the auth cookie:
+    // without a Domain attribute it would be host-only and the double-submit check could read the wrong one.
     expect(getSetCookieRaw(res, CSRF_COOKIE_NAME)).toMatch(/Domain=example\.eu/i);
   });
 

package/src/engine/__tests__/build-app-schema-settings-hub.test.ts

@@ -201,10 +201,10 @@ describe("buildAppSchema — Settings-Hub inline placement", () => {
 });
 
 describe("buildAppSchema — dangling audience-ref dev-warning (#408/3)", () => {
-  // billing registriert nur system+tenant-Keys → audience-user wird NIE
-  // generiert. Eine Workspace, die config:nav:audience-user referenziert, boot't
-  // (Boot-Validator exempt't die Audience-QNs), aber der Eintrag rendert
-  // unsichtbar — der Dev muss eine Warnung sehen, nicht still nichts.
+  // billing registers only system+tenant keys → audience-user is NEVER
+  // generated. A workspace referencing config:nav:audience-user still boots
+  // (the boot-validator exempts the audience QNs), but the entry renders
+  // invisibly — the dev must see a warning, not silently nothing.
   function warnsFor(scopes: string[]): string[] {
     const prevEnv = process.env.NODE_ENV;
     process.env.NODE_ENV = "development";

package/src/engine/__tests__/build-config-feature-schema.test.ts

@@ -240,7 +240,7 @@ describe("buildConfigFeatureSchema — access + workspace", () => {
 
   test("a screen mixing an openToAll key with role-restricted keys collapses to openToAll", () => {
     // unionAccessRules short-circuits: one openToAll writer opens the whole gate,
-    // even next to role-restricted keys — the mixed case the all-or-nothing tests miss.
+    // even next to role-restricted keys.
     const mixedWrite = defineFeature("mixedwrite", (r) => {
       r.config({
         keys: {

package/src/engine/build-app-schema.ts

@@ -156,10 +156,10 @@ function placeSettingsHub(
   }
 
   const placedAudiences = new Set<string>();
-  // Config-Hub-Navs, die eine Workspace referenziert, die aber nie generiert
-  // wurden (weder Audience noch bekanntes Kind) — z.B. `config:nav:audience-user`
-  // ohne registrierte User-Scope-Config-Keys. Sonst verschwindet die Referenz
-  // lautlos (silent-skip).
+  // Config-hub navs a workspace references but that were never generated (no
+  // audience and no known child) — e.g. `config:nav:audience-user` without any
+  // registered user-scope config keys. Otherwise the reference vanishes
+  // silently (silent-skip).
   const danglingRefs = new Set<string>();
   const workspaces = appWorkspaces.map((ws) => {
     const additions: string[] = [];

package/src/engine/build-config-feature-schema.ts

@@ -135,15 +135,15 @@ export function buildConfigFeatureSchema(registry: Registry): ConfigFeatureSchem
   return { screens, navs, workspace: buildSettingsWorkspace(navs) };
 }
 
-// Keys, die an `scope` sichtbar sind, gepaart mit ihren effektiven Schreib-
-// Rollen AN diesem Scope (Home = volles write; breiter = elevated ∩ write).
+// Keys visible at `scope`, paired with their effective write roles AT that
+// scope (Home = full write; broader = elevated ∩ write).
 function scopedKeysAt(masked: readonly MaskedKey[], scope: ConfigScope): ScopedKey[] {
   const out: ScopedKey[] = [];
   for (const key of masked) {
     const roles = effectiveWriteRoles(key.def, scope);
-    // MACHINE_WRITE_ROLE aus den Screen-Rollen strippen: ein gemischter
-    // write-Set (z.B. ["system", "SystemAdmin"]) darf "system" nicht ins
-    // Screen-Access-Gate leaken — analog zum machine-gefilterten Workspace-Gate.
+    // Strip MACHINE_WRITE_ROLE from the screen roles: a mixed write set
+    // (e.g. ["system", "SystemAdmin"]) must not leak "system" into the
+    // screen access gate — mirrors the machine-filtered workspace gate.
     const humanRoles = roles.filter((r) => r !== MACHINE_WRITE_ROLE);
     if (humanRoles.length > 0) out.push({ key, roles: humanRoles });
   }

package/src/migrations/__tests__/pending-rebuilds.integration.test.ts

@@ -296,7 +296,7 @@ describe("enqueueProjectionRebuild — inline fallback (no jobs feature)", () =>
   });
 });
 
-// #391/2: jobRunner present but the projection-rebuild job not registered (a
+// jobRunner present but the projection-rebuild job not registered (a
 // caller that wired a jobRunner yet forgot to compose createJobsFeature()). The
 // getJob-capability guard must still fall to the inline rebuild — NOT dispatch
 // onto a runner whose queue has no handler for the job (silent no-op forever).