@cosmicdrift/kumiko-guards 0.371.1 → 0.373.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.371.1",
+  "version": "0.373.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.371.1",
+    "@cosmicdrift/kumiko-repo-manifest": "0.373.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/guard-i18n-locale-terminology.ts

@@ -2,8 +2,9 @@
 /**
  * Guard: locale bundle values must follow Mandant/Organización terminology (#2200, fw#2355).
  *
- * German UI copy always says "Mandant" (never "Tenant"/"Organisation"); Spanish always
- * says "Organización" (never the "tenant" loanword). Only translation *values* are
+ * German UI copy always says "Mandant" (never "Tenant"/"Organisation"); Spanish, French
+ * and Italian always say "Organización"/"organisation"/"organizzazione" (never the
+ * "tenant" loanword). Only translation *values* are
  * checked — JSON key names like `tenant.members.*` are ignored. Role identifiers
  * such as TenantAdmin/SystemAdmin in prose are allowed.
  *
@@ -29,7 +30,12 @@ const SCAN: ScanSpec = {
   scope: "source",
   extensions: ["ts"],
   kinds: ["framework"],
-  frameworkWithin: ["packages/locale-de/src/strings.ts", "packages/locale-es/src/strings.ts"],
+  frameworkWithin: [
+    "packages/locale-de/src/strings.ts",
+    "packages/locale-es/src/strings.ts",
+    "packages/locale-fr/src/strings.ts",
+    "packages/locale-it/src/strings.ts",
+  ],
 };
 const IGNORE_TAG = "kumiko-lint-ignore i18n-locale-terminology";
 
@@ -38,7 +44,9 @@ type LocaleRule = {
   readonly forbidden: readonly RegExp[];
 };
 
-const RULES: Record<"de" | "es", LocaleRule> = {
+type TerminologyLocale = "de" | "es" | "fr" | "it";
+
+const RULES: Record<TerminologyLocale, LocaleRule> = {
   de: {
     preferred: "Mandant",
     // Tenants? covers plural; Organisation(en|s)? without trailing \b so
@@ -50,11 +58,21 @@ const RULES: Record<"de" | "es", LocaleRule> = {
     preferred: "Organización",
     forbidden: [/\btenants?\b/i],
   },
+  fr: {
+    preferred: "organisation",
+    forbidden: [/\btenants?\b/i],
+  },
+  it: {
+    preferred: "organizzazione",
+    forbidden: [/\btenants?\b/i],
+  },
 };
 
-function localeFromPath(filePath: string): "de" | "es" | undefined {
+function localeFromPath(filePath: string): TerminologyLocale | undefined {
   if (filePath.includes("locale-de/src/strings.ts")) return "de";
   if (filePath.includes("locale-es/src/strings.ts")) return "es";
+  if (filePath.includes("locale-fr/src/strings.ts")) return "fr";
+  if (filePath.includes("locale-it/src/strings.ts")) return "it";
   return undefined;
 }
 
@@ -104,7 +122,7 @@ export function findViolations(files: readonly SourceFile[]): GuardViolation[] {
 export const guard: AstGuard = {
   name: "i18n-Locale-Terminology Guard",
   scan: SCAN,
-  hint: "DE: Mandant instead of Tenant/Organisation; ES: Organización instead of the tenant loanword. Roles like TenantAdmin are fine.",
+  hint: "DE: Mandant instead of Tenant/Organisation; ES/FR/IT: Organización/organisation/organizzazione instead of the tenant loanword. Roles like TenantAdmin are fine.",
   run(files, roots: readonly RepoRoot[] = resolveRepoRoots()) {
     const violations = findViolations(files)
       .map((v) => ({ ...v, file: relFromRepoRoot(v.file, roots) }))

package/src/runtime-isolation-classify.ts

@@ -60,7 +60,7 @@ const PATH_RULES: readonly (readonly [RegExp, Runtime])[] = [
   [/(?:^|\/)ui-types\//, "client"],
 
   // Same reasoning, two more shapes: a `web.ts`/`web/` subpath is the
-  // established convention (locale-de, locale-es, bundled-features) for the
+  // established convention (locale-de, locale-es, locale-fr, locale-it, bundled-features) for the
   // client-safe slice of an otherwise `"runtime"`-marked package — the
   // package.json marker classifies the whole package, this carves the
   // deliberately-named exception back out. Deliberately workspace-wide (any
@@ -79,10 +79,10 @@ const PATH_RULES: readonly (readonly [RegExp, Runtime])[] = [
   // More single-file carve-outs, same "package marker is coarser than the
   // file" shape, verified case by case rather than by a directory
   // convention:
-  //  - locale-{de,es}/src/strings.ts: pure string-constant data (zero
+  //  - locale-{de,es,fr,it}/src/strings.ts: pure string-constant data (zero
   //    imports), re-exported by the already-client `web.ts` sibling in the
   //    same package but shadowed by the package's own `"runtime"` marker.
-  [/^packages\/locale-(?:de|es)\/src\/strings\.ts$/, "client"],
+  [/^packages\/locale-(?:de|es|fr|it)\/src\/strings\.ts$/, "client"],
   //  - dev-server/src/env-schema.ts: a zod-only schema, no dev-server-
   //    internal imports — safe to carve out on its own.
   [/^packages\/dev-server\/src\/env-schema\.ts$/, "client"],