@cosmicdrift/kumiko-bundled-features 0.260.0 → 0.262.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.260.0",
+  "version": "0.262.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -129,12 +129,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.260.0",
-    "@cosmicdrift/kumiko-framework": "0.260.0",
-    "@cosmicdrift/kumiko-headless": "0.260.0",
-    "@cosmicdrift/kumiko-renderer": "0.260.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.260.0",
-    "@cosmicdrift/kumiko-types": "0.260.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.262.0",
+    "@cosmicdrift/kumiko-framework": "0.262.0",
+    "@cosmicdrift/kumiko-headless": "0.262.0",
+    "@cosmicdrift/kumiko-renderer": "0.262.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.262.0",
+    "@cosmicdrift/kumiko-types": "0.262.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -163,7 +163,7 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.260.0",
-    "@cosmicdrift/kumiko-locale-es": "0.260.0"
+    "@cosmicdrift/kumiko-locale-de": "0.262.0",
+    "@cosmicdrift/kumiko-locale-es": "0.262.0"
   }
 }

package/src/presets/__tests__/security-baseline.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { SECURITY_BASELINE_FEATURE_NAMES } from "@cosmicdrift/kumiko-framework/engine";
+import { dsgvoSelfServiceFeatures } from "../dsgvo-self-service";
+import { securityBaselineFeatures } from "../security-baseline";
+
+describe("securityBaselineFeatures", () => {
+  test("returns exactly the SECURITY_BASELINE_FEATURE_NAMES feature names", () => {
+    const names = securityBaselineFeatures().map((f) => f.name);
+    expect(names).toEqual([...SECURITY_BASELINE_FEATURE_NAMES]);
+  });
+
+  test("includeSessions:false omits sessions but keeps the other three", () => {
+    const names = securityBaselineFeatures({ includeSessions: false }).map((f) => f.name);
+    expect(names).not.toContain("sessions");
+    expect(names).toEqual(["crypto-shredding", "rate-limiting", "audit"]);
+  });
+
+  test("combined with dsgvoSelfServiceFeatures({ includeSessions: false }) has no duplicate names and covers the baseline", () => {
+    const combined = [
+      ...dsgvoSelfServiceFeatures(),
+      ...securityBaselineFeatures({ includeSessions: false }),
+    ];
+    const names = combined.map((f) => f.name);
+    expect(new Set(names).size).toBe(names.length);
+    for (const name of SECURITY_BASELINE_FEATURE_NAMES) {
+      expect(names).toContain(name);
+    }
+  });
+
+  test("each call yields fresh feature instances (no shared mutable state)", () => {
+    const a = securityBaselineFeatures();
+    const b = securityBaselineFeatures();
+    expect(a[0]).not.toBe(b[0]);
+  });
+});

package/src/presets/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.262.0",
+    "type": "improvement",
+    "title": "securityBaselineFeatures() preset: sessions, crypto-shredding, rate-limiting, audit (fw#2857).",
+    "detail": "`securityBaselineFeatures(opts?: { includeSessions?: boolean })` (`@cosmicdrift/kumiko-bundled-features/presets`) returns `[createSessionsFeature(), createCryptoShreddingFeature(), createRateLimitingFeature(), createAuditFeature()]` in that order — fresh instances per call, mirroring `dsgvoSelfServiceFeatures()`. `includeSessions: false` drops `createSessionsFeature()` from the returned array for apps that already mount `sessions` via `dsgvoSelfServiceFeatures()` (mounting the same feature name twice throws at boot). The host app still needs to mount `user`, `tenant`, and `auth-foundation` itself — `sessions` requires `user`/`auth-foundation`, `audit` requires `tenant`. Pairs with the new boot-validator warning that fires at `NODE_ENV=production` when any of the four feature names (`SECURITY_BASELINE_FEATURE_NAMES`, `@cosmicdrift/kumiko-framework/engine`) is missing from the mounted feature list."
+  }
+]

package/src/presets/index.ts

@@ -1 +1,2 @@
 export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service";
+export { type SecurityBaselineOptions, securityBaselineFeatures } from "./security-baseline";

package/src/presets/security-baseline.ts

@@ -0,0 +1,20 @@
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { createAuditFeature } from "../audit";
+import { createCryptoShreddingFeature } from "../crypto-shredding";
+import { createRateLimitingFeature } from "../rate-limiting";
+import { createSessionsFeature } from "../sessions";
+
+export type SecurityBaselineOptions = {
+  readonly includeSessions?: boolean;
+};
+
+// includeSessions: false when dsgvoSelfServiceFeatures() already mounts sessions (duplicate
+// feature names throw); host app must mount user, tenant, auth-foundation (sessions/audit requires).
+export function securityBaselineFeatures(opts: SecurityBaselineOptions = {}): FeatureDefinition[] {
+  return [
+    ...(opts.includeSessions !== false ? [createSessionsFeature()] : []),
+    createCryptoShreddingFeature(),
+    createRateLimitingFeature(),
+    createAuditFeature(),
+  ];
+}