@cosmicdrift/kumiko-types 0.297.0 → 0.304.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.297.0",
+  "version": "0.304.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/feature.ts

@@ -840,13 +840,13 @@ export type FeatureRegistrar<TFeature extends string = string> = {
   workspace(definition: WorkspaceDefinition): void;
 
   // Register an HTTP-route owned by this feature. The route is mounted
-  // outside the dispatcher pipeline (= außerhalb /api/write|query|batch),
-  // direkt an die app — Use-Case: RSS/Atom-Feeds, OG-Images, OpenAPI-Specs.
+  // outside the dispatcher pipeline (= outside /api/write|query|batch),
+  // directly on the app — use case: RSS/Atom feeds, OG images, OpenAPI specs.
   // Duplicate "method path"-Combinations are rejected per feature at setup
   // time; there is no cross-feature check.
-  // Symmetric to queryHandler/writeHandler — Routes leben mit dem Feature,
-  // nicht im Bootstrap. Escape-hatch für nicht-feature-bound Routes
-  // bleibt runProdApp.extraRoutes.
+  // Symmetric to queryHandler/writeHandler — routes live with the feature,
+  // not in the bootstrap. Escape-hatch for non-feature-bound routes stays
+  // runProdApp.extraRoutes (declarative list with `entry` tier).
   httpRoute(definition: HttpRouteDefinition): void;
 
   // Declare an "unmanaged" framework-native table that bypasses the

package/src/handlers.ts

@@ -28,11 +28,19 @@ export type OpenToAllAccessRule = {
   readonly openToAll: OpenToAllDeclaration;
 };
 
+// "public-intake": anonymous callers may write personal data; the required rateLimit is the only protection.
+export type RoleAccessPersonalData = "public-intake";
+
+export type RoleAccessRule = {
+  readonly roles: readonly string[];
+  readonly personalData?: RoleAccessPersonalData;
+};
+
 // AccessRule is DEFAULT-DENY: a handler without an access rule is not reachable.
 // To grant access, set one of:
 //   - { roles: ["Admin", ...] }             — role-based allowlist (empty array denies everyone)
 //   - { openToAll: { reason: "..." } }      — any authenticated user may call (still requires a valid JWT)
-export type AccessRule = { readonly roles: readonly string[] } | OpenToAllAccessRule;
+export type AccessRule = RoleAccessRule | OpenToAllAccessRule;
 
 export type EscapeHatchDeclaration = { readonly reason: string };
 

package/src/http-route.ts

@@ -1,15 +1,15 @@
-// HTTP-Route-Definition — feature-deklarierte HTTP-Endpoints außerhalb
-// der /api/write|query|batch-Pipeline. Use-Case: RSS/Atom-Feeds, OpenAPI-
-// Specs, OG-Image-Generators, Webhook-Receiver — alles wo der Feature-
-// Author das Wire-Format selbst kontrolliert.
+// HTTP route definition — feature-declared HTTP endpoints outside
+// the /api/write|query|batch pipeline. Use case: RSS/Atom feeds, OpenAPI
+// specs, OG image generators, webhook receivers — anything where the
+// feature author controls the wire format themselves.
 //
-// Pattern symmetrisch zu r.queryHandler / r.writeHandler: Definition als
-// Teil des Features (nicht des App-Bootstrapping). Phase-3 Multi-Tenant
-// wird trivial weil tenant-context via host-resolution greift.
+// Pattern symmetric to r.queryHandler / r.writeHandler: definition as
+// part of the feature (not the app bootstrapping). Phase-3 multi-tenant
+// becomes trivial because tenant context is picked up via host resolution.
 //
-// Escape-hatch bleibt: runProdApp.extraRoutes für hand-rolled Routes die
-// nichts mit einem Feature zu tun haben (z.B. plattform-spezifische
-// Static-Serving-Logic).
+// Escape-hatch stays: runProdApp.extraRoutes (declarative list with
+// `entry` tier) for hand-rolled routes that have nothing to do with a
+// feature (e.g. platform-specific static-serving logic).
 
 import type { Context } from "hono";
 
@@ -61,11 +61,11 @@ export type HttpRouteDefinition = {
   readonly method: HttpRouteMethod;
   /** URL-Pfad (Hono-Pattern, z.B. "/feed.xml" oder "/og/:tenantId.png"). */
   readonly path: string;
-  /** Wenn true, bypasses die /api/*-Auth-Middleware. Default false —
-   *  Routes liegen außerhalb /api/* und sehen die Auth-Middleware
-   *  ohnehin nicht; das Flag ist semantisch (= "diese Route ist
-   *  bewusst öffentlich") für Boot-Validator + Doku. */
-  readonly anonymous?: boolean;
+  /** true = public, no session required. false = mounted behind the
+   *  session auth chain (no anonymous fallthrough, PAT rate limit,
+   *  origin + CSRF guards) — a request without a session gets 401. The
+   *  handler reads the caller via getUser(c). */
+  readonly anonymous: boolean;
   /** Hono-Handler. Bekommt Hono-Context + Framework-Deps; returnt
    *  Response (sync oder async). */
   readonly handler: HttpRouteHandler;