@cosmicdrift/kumiko-dev-server 0.113.1 → 1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.113.1",
+  "version": "1.0.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.113.1",
-    "@cosmicdrift/kumiko-framework": "0.113.1",
+    "@cosmicdrift/kumiko-bundled-features": "1.0.0",
+    "@cosmicdrift/kumiko-framework": "1.0.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/compose-features.test.ts

@@ -98,11 +98,12 @@ describe("composeFeatures", () => {
   });
 
   test("app feature duplicating a bundled name is dropped (no createRegistry crash)", () => {
-    // create-kumiko-app's picker hands back createAuthEmailPasswordFeature()
-    // because the user ticked it in the recommended set; runDevApp then adds
-    // its OWN bundled copy via includeBundled:true, and createRegistry throws
-    // "Duplicate feature: auth-email-password". The dedupe path keeps the
-    // bundled instance (it carries authOptions wiring) and drops the app stub.
+    // Bug discovered during Phase 3 recording: create-kumiko-app's picker
+    // hands back createAuthEmailPasswordFeature() because the user ticked
+    // it in the recommended set; runDevApp then adds its OWN bundled
+    // copy via includeBundled:true, and createRegistry throws "Duplicate
+    // feature: auth-email-password". The dedupe path keeps the bundled
+    // instance (it carries authOptions wiring) and drops the app stub.
     const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
     const features = composeFeatures([pickerAuthDupe, noopFeature], {
       includeBundled: true,

package/src/__tests__/schema-apply.integration.test.ts

@@ -6,7 +6,7 @@
 // `relation "kumiko_events" does not exist`. Dieser Test fährt den echten
 // Pfad gegen eine leere DB + den idempotenten Re-Run.
 
-import { afterAll, beforeAll, describe, expect, spyOn, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -76,7 +76,7 @@ describe("runSchemaApply", () => {
     expect(await tableExists(conn.db, "public.read_thing")).toBe(true);
   });
 
-  test("rebuild-Marker für nicht-registrierte Tabelle → kein Crash, 0, aber laut warnen (522/3)", async () => {
+  test("rebuild-Marker für nicht-registrierte Tabelle → kein Crash, 0", async () => {
     writeFileSync(
       join(migDir, "0002_more.sql"),
       `CREATE TABLE "read_more" ("id" text PRIMARY KEY);`,
@@ -86,10 +86,7 @@ describe("runSchemaApply", () => {
       JSON.stringify({ version: 1, tables: ["read_more"] }),
     );
 
-    const warn = spyOn(console, "warn").mockImplementation(() => {});
     expect(await runSchemaApply({ ...APPLY, appCwd })).toBe(0);
     expect(await tableExists(conn.db, "public.read_more")).toBe(true);
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('Table "read_more"'));
-    warn.mockRestore();
   });
 });

package/src/boot/apply-boot-seeds.ts

@@ -1,7 +1,6 @@
 import { seedAllConfigValues } from "@cosmicdrift/kumiko-bundled-features/config";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection, EncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
-import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 
 // Single boot-seed entry-point. runDevApp + runProdApp both call this
 // from their post-stack hook, so the wiring lives in exactly one place
@@ -13,7 +12,7 @@ import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 export async function applyBootSeeds(deps: {
   registry: Registry;
   db: DbConnection;
-  cipher?: EnvelopeCipher;
+  encryption?: EncryptionProvider;
 }): Promise<void> {
-  await seedAllConfigValues(deps.registry, deps.db, deps.cipher);
+  await seedAllConfigValues(deps.registry, deps.db, deps.encryption);
 }

package/src/run-dev-app.ts

@@ -23,21 +23,11 @@ import {
   createConfigResolver,
 } from "@cosmicdrift/kumiko-bundled-features/config";
 import {
-  createPatResolver,
-  PAT_FEATURE,
-  patRateLimitFromFeature,
-  patScopesFromFeature,
-} from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
-import {
-  bindAutoRevokeFromFeature,
   createSessionCallbacks,
-  SESSIONS_FEATURE,
   type SessionCallbacks,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
-import type { PatResolver, SessionMetadata } from "@cosmicdrift/kumiko-framework/api";
-import { createInMemoryLoginRateLimiter } from "@cosmicdrift/kumiko-framework/api";
-import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionMetadata } from "@cosmicdrift/kumiko-framework/api";
 import {
   collectWriteHandlerQns,
   createRegistry,
@@ -51,11 +41,10 @@ import {
   validateAppCustomScreenWriteQns,
   validateBoot,
 } from "@cosmicdrift/kumiko-framework/engine";
-import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { applyBootSeeds } from "./boot/apply-boot-seeds";
-import { resolveBootCrypto } from "./boot/boot-crypto";
 
 import { watchAndRegenerate } from "./codegen";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
@@ -237,14 +226,10 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     ...(composeAuthOptions && { authOptions: composeAuthOptions }),
   });
 
-  // An explicitly wired file provider (options.files) satisfies the
-  // FILE_STORAGE_PROVIDER boot gate — set it before validateBoot runs. Only
-  // if WE set it (532/2): deleting it after use instead of leaving a
-  // permanent process.env mutation, so a second runDevApp call in the same
-  // process (no files this time) doesn't fall through the gate falsely.
-  const setFileStorageProviderEnv =
-    options.files !== undefined && process.env["FILE_STORAGE_PROVIDER"] === undefined;
-  if (setFileStorageProviderEnv) {
+  // Ein explizit gewireter File-Provider (options.files) erfüllt das
+  // FILE_STORAGE_PROVIDER-Boot-Gate — der Provider IST konfiguriert, nur
+  // nicht über die env-Bridge. Setzen bevor validateBoot greift.
+  if (options.files !== undefined && process.env["FILE_STORAGE_PROVIDER"] === undefined) {
     process.env["FILE_STORAGE_PROVIDER"] = "configured";
   }
 
@@ -253,11 +238,7 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
   // die früher nur runProdApp fing und sonst erst den Prod-Pod im
   // CrashLoopBackOff sterben ließ (#359). Wirft synchron, bevor ein
   // Socket oder Watcher (codegen-Write) aufgeht.
-  try {
-    validateBoot(features);
-  } finally {
-    if (setFileStorageProviderEnv) delete process.env["FILE_STORAGE_PROVIDER"];
-  }
+  validateBoot(features);
   warnIfNonUtcServerTimeZone();
   validateAppCustomScreenWriteQns(process.cwd(), collectWriteHandlerQns(features));
 
@@ -322,17 +303,8 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
   // throwaway-Registry hier extrahiert nur die config-Keys, weil der
   // configResolver vor dem Server-Boot konstruiert wird (stack.registry
   // gibt's erst onAfterSetup) — createKumikoServer baut intern seine eigene.
-  const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
-  // App-wide cipher for `encrypted: true` entity fields (symmetrisch zu
-  // runProdApp) — executors resolve it lazily.
-  configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
   const cfgExtra = effectiveAuth
-    ? mergeConfigResolverDefault(
-        options.extraContext,
-        createRegistry(features),
-        envSource,
-        bootCrypto.configCipher,
-      )
+    ? mergeConfigResolverDefault(options.extraContext, createRegistry(features), envSource)
     : options.extraContext;
   // Auto-wire textContent (immer) + secrets (feature-gated), symmetrisch zu
   // runProdApp. Anders als prod existiert die db hier erst im Factory-deps
@@ -347,7 +319,7 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       registry: deps.registry,
       hasAuth: false,
       sseBroker: deps.sseBroker,
-      crypto: bootCrypto,
+      ...(options.masterKey && { masterKey: options.masterKey }),
     });
     const base = typeof cfgExtra === "function" ? cfgExtra(deps) : (cfgExtra ?? {});
     return { ...boot, ...base };
@@ -367,26 +339,6 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     }
     return sessionCallbacks;
   };
-  // PAT opt-in: same late-bound holder pattern — the resolver needs the real
-  // db (only concrete after setupTestStack). Wired when the feature is mounted;
-  // scopes come from the feature's exports (single source with its handlers).
-  let patResolver: PatResolver | undefined;
-  const patFeature = features.find((f) => f.name === PAT_FEATURE);
-  const patAuthFragment = patFeature
-    ? {
-        patResolver: (rawToken: string) => {
-          if (!patResolver) {
-            throw new Error("[runDevApp] pat-resolver accessed before onAfterSetup");
-          }
-          return patResolver(rawToken);
-        },
-        patRateLimiter: (() => {
-          const rl = patRateLimitFromFeature(patFeature);
-          return createInMemoryLoginRateLimiter(rl.maxRequests, rl.windowMs);
-        })(),
-      }
-    : {};
-
   const sessionAuthFragment =
     effectiveAuth?.sessions !== undefined
       ? {
@@ -440,7 +392,6 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
           unsafeSkipOriginCheck: effectiveAuth.unsafeSkipOriginCheck,
         }),
         ...sessionAuthFragment,
-        ...patAuthFragment,
         ...(effectiveAuth.passwordReset && {
           passwordReset: {
             requestHandler: AuthHandlers.requestPasswordReset,
@@ -485,15 +436,6 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
           db: stack.db,
           ...(expiresInMs !== undefined && { expiresInMs }),
         });
-        // Secure-by-default (symmetrisch zu runProdApp): Password-Change/
-        // -Reset mass-revoked die Sessions des Users ohne App-Opt-in.
-        const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
-        if (sessionsFeature) {
-          bindAutoRevokeFromFeature(sessionsFeature)?.(sessionCallbacks.sessionMassRevoker);
-        }
-      }
-      if (patFeature) {
-        patResolver = createPatResolver({ db: stack.db, scopes: patScopesFromFeature(patFeature) });
       }
       if (effectiveAuth) {
         await seedAdmin(stack.db, effectiveAuth.admin);
@@ -502,11 +444,7 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       // Runs before user-supplied seed callbacks so those can read /
       // override the deploy-defaults. The helper indirection is what
       // config-seed-boot.integration.ts pins — keep it as a single call.
-      await applyBootSeeds({
-        registry: stack.registry,
-        db: stack.db,
-        ...(bootCrypto.configCipher && { cipher: bootCrypto.configCipher }),
-      });
+      await applyBootSeeds({ registry: stack.registry, db: stack.db });
       for (const seed of options.seeds ?? []) {
         await seed(stack);
       }
@@ -542,12 +480,10 @@ export function mergeConfigResolverDefault(
   ctx: CreateKumikoServerOptions["extraContext"],
   registry: Registry,
   envSource: Record<string, string | undefined>,
-  cipher?: EnvelopeCipher,
 ): CreateKumikoServerOptions["extraContext"] {
   const defaults = {
     configResolver: createConfigResolver({
       appOverrides: buildEnvConfigOverrides(registry, envSource),
-      ...(cipher && { cipher }),
     }),
   };
   // ctx.config wird per-Request aus _configAccessorFactory geminted (siehe

package/src/run-prod-app.ts

@@ -50,18 +50,11 @@ import {
   createDeliveryService,
   DELIVERY_FEATURE,
 } from "@cosmicdrift/kumiko-bundled-features/delivery";
-import {
-  createPatResolver,
-  PAT_FEATURE,
-  patRateLimitFromFeature,
-  patScopesFromFeature,
-} from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import {
   createSecretsContext,
   SECRETS_FEATURE_NAME,
 } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import {
-  bindAutoRevokeFromFeature,
   createSessionCallbacks,
   SESSIONS_FEATURE,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
@@ -73,12 +66,10 @@ import {
   cachedResponse,
   computeStrongEtag,
   computeWeakEtag,
-  createInMemoryLoginRateLimiter,
   createSseBroker,
   type SseBroker,
 } from "@cosmicdrift/kumiko-framework/api";
 import {
-  configureEntityFieldEncryption,
   createDbConnection,
   type DbConnection,
   type DbRunner,
@@ -124,11 +115,13 @@ import {
   createEventDedup,
   createIdempotencyGuard,
 } from "@cosmicdrift/kumiko-framework/pipeline";
-import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  createEnvMasterKeyProvider,
+  type MasterKeyProvider,
+} from "@cosmicdrift/kumiko-framework/secrets";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import Redis from "ioredis";
 import { applyBootSeeds } from "./boot/apply-boot-seeds";
-import { type BootCrypto, resolveBootCrypto } from "./boot/boot-crypto";
 import { ASSETS_DIR } from "./build-prod-bundle";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
 import { type ExtraRoutesSystemDeps, makeDispatchSystemWrite } from "./extra-routes-deps";
@@ -577,7 +570,14 @@ export type ProdAppHandle = {
   readonly stop: () => Promise<void>;
 };
 
-// Shared with runDevApp (mergeConfigResolverDefault) for dev/prod parity.
+// Mint `ctx.config` per request: the dispatcher only builds a per-user
+// ConfigAccessor when `_configAccessorFactory` is on the AppContext
+// (pipeline/dispatcher.ts). Without it `ctx.config` stays undefined and any
+// handler reading it — e.g. createFileProviderForTenant for the GDPR export
+// download — throws "ctx.config is missing". Built from the EFFECTIVE resolver
+// so an app-supplied configResolver override (its appOverrides) is the one
+// ctx.config reads. Shared with runDevApp (mergeConfigResolverDefault) for
+// dev/prod parity.
 export function addConfigAccessorFactory<T extends { readonly configResolver?: ConfigResolver }>(
   resolved: T,
   registry: Registry,
@@ -596,13 +596,18 @@ export function addConfigAccessorFactory<T extends { readonly configResolver?: C
 // nur einen db-gebundenen Accessor). secrets wird nur auto-verdrahtet wenn
 // das secrets-Feature gemountet ist UND ein KEK tatsächlich verfügbar ist
 // (masterKey-Override ODER env-KEK present) — sonst skip, damit der eager
-// KEK-Detection + Provider/Cipher-Aufbau leben in boot/boot-crypto.ts
-// (envHasMasterKek, resolveBootCrypto) — gemeinsam mit runDevApp.
+// createEnvMasterKeyProvider nicht wirft. Das deckt zwei Fälle: (a) App ohne
+// secrets → kein KEK-Zwang; (b) dev mit App-eigenem DEV-KEK in extraContext
+// (kein env-KEK) → kein Boot-Crash, die App-explizite secrets-Wiring gewinnt.
 // Prod-Misconfig (secrets gemountet, kein KEK) fängt schon secretsEnvSchema
 // beim Boot; fehlt der env-Schema-Pfad, wirft requireSecretsContext beim
 // ersten ctx.secrets-Zugriff mit Wiring-Hinweis. configResolver nur im
 // Auth-Mode. Exportiert + pure für Unit-Tests; der merge mit App-Werten
 // passiert beim Caller (App gewinnt).
+const MASTER_KEK_VAR = /^KUMIKO_SECRETS_MASTER_KEY_V\d+$/;
+function envHasMasterKek(env: Record<string, string | undefined>): boolean {
+  return Object.entries(env).some(([k, v]) => MASTER_KEK_VAR.test(k) && !!v);
+}
 
 // Prod/dev parity for ctx.notify: without this `_notifyFactory` is only wired
 // in tests (createDeliveryTestContext), so ctx.notify is undefined at runtime
@@ -629,16 +634,12 @@ export function buildBootExtraContext(opts: {
   readonly envSource: Record<string, string | undefined>;
   readonly registry: Registry;
   readonly hasAuth: boolean;
-  // Resolved once per boot via resolveBootCrypto — shared by secrets,
-  // config-resolver, config-set-handler and boot-seeds. Absent (tests
-  // that don't care about encryption) ⇒ resolved from envSource here.
-  readonly crypto?: BootCrypto;
   readonly masterKey?: MasterKeyProvider;
   readonly sseBroker?: SseBroker;
 }): Record<string, unknown> {
-  const crypto = opts.crypto ?? resolveBootCrypto(opts.envSource, opts.masterKey);
   const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
-  const wireSecrets = hasSecretsFeature && crypto.masterKeyProvider !== undefined;
+  const wireSecrets =
+    hasSecretsFeature && (opts.masterKey !== undefined || envHasMasterKek(opts.envSource));
   const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
   return {
     textContent: createTextContentApi(opts.db),
@@ -649,25 +650,25 @@ export function buildBootExtraContext(opts: {
         ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
       }),
     }),
-    // Top-level provider so feature jobs (secrets rotate, config reencrypt)
-    // reach it via ctx — previously only test-stack wired it.
-    ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
-    // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
-    // whenever a master key exists — NOT gated on the secrets feature,
-    // config encryption must work without mounting ctx.secrets.
-    ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
-    ...(wireSecrets &&
-      crypto.masterKeyProvider && {
-        secrets: createSecretsContext({
-          db: opts.db,
-          masterKeyProvider: crypto.masterKeyProvider,
-          dekCache: crypto.dekCache,
-        }),
+    ...(wireSecrets && {
+      secrets: createSecretsContext({
+        db: opts.db,
+        masterKeyProvider:
+          opts.masterKey ??
+          createEnvMasterKeyProvider({
+            // CURRENT_VERSION default "1" spiegelt secretsEnvSchema — ohne
+            // ihn wirft der raw-env-Provider, obwohl V1 gesetzt ist.
+            env: {
+              ...opts.envSource,
+              KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION:
+                opts.envSource["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
+            },
+          }),
       }),
+    }),
     ...(opts.hasAuth && {
       configResolver: createConfigResolver({
         appOverrides: buildEnvConfigOverrides(opts.registry, opts.envSource),
-        ...(crypto.configCipher && { cipher: crypto.configCipher }),
       }),
     }),
   };
@@ -918,10 +919,6 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
 
   // Framework-Default-Provider zuerst, App-Werte (resolvedExtraContext)
   // gewinnen immer (z.B. money-horse's eigener configResolver).
-  const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
-  // App-wide cipher for `encrypted: true` entity fields — executors resolve
-  // it lazily, entities without encrypted fields never touch it.
-  configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
   const autoExtraContext = buildBootExtraContext({
     db,
     features,
@@ -929,7 +926,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     registry,
     hasAuth: !!effectiveAuth,
     sseBroker,
-    crypto: bootCrypto,
+    ...(options.masterKey && { masterKey: options.masterKey }),
   });
   const extraContext = addConfigAccessorFactory(
     { ...autoExtraContext, ...resolvedExtraContext },
@@ -945,40 +942,21 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // sessionStrictMode=true: Prod-Sessions sollen nicht stillschweigend
   // von einem JWT-ohne-sid umgangen werden können. sessionMassRevoker
   // (4. callback aus createSessionCallbacks) ist nicht Teil der
-  // AuthRoutesConfig-Surface — der geht via bindAutoRevokeFromFeature ans
-  // sessions-Feature (Password-Change/-Reset revoked alle Sessions), nicht
-  // über die auth-routes.
+  // AuthRoutesConfig-Surface — der wird vom sessions-Feature selbst über
+  // die `autoRevokeOnPasswordChange`-Option konsumiert, nicht über die
+  // auth-routes.
   // Secure-by-default: if the sessions feature is mounted, server-side revocation +
-  // sessionStrictMode + auto-revoke-on-password-change are wired automatically;
-  // `auth.sessions` only overrides the config, and `auth.sessions: false` is the
-  // explicit opt-out (back to stateless JWTs).
-  const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
+  // sessionStrictMode are wired automatically; `auth.sessions` only overrides the config,
+  // and `auth.sessions: false` is the explicit opt-out (back to stateless JWTs).
+  const sessionsFeatureMounted = features.some((f) => f.name === SESSIONS_FEATURE);
   const sessionAuthFragment = shouldWireProdSessions(
     Boolean(effectiveAuth),
-    sessionsFeature !== undefined,
+    sessionsFeatureMounted,
     effectiveAuth?.sessions,
   )
-    ? buildProdSessionAuth(db, resolveProdSessionsConfig(effectiveAuth?.sessions), sessionsFeature)
+    ? buildProdSessionAuth(db, resolveProdSessionsConfig(effectiveAuth?.sessions))
     : undefined;
 
-  // PAT opt-in: if the personal-access-tokens feature is mounted, wire its
-  // resolver (bearer PATs → SessionUser, before jwt.verify). Scopes come from
-  // the feature's exports — the same declaration its handlers use.
-  const patFeature = features.find((f) => f.name === PAT_FEATURE);
-  let patAuthFragment:
-    | {
-        patResolver: ReturnType<typeof createPatResolver>;
-        patRateLimiter: ReturnType<typeof createInMemoryLoginRateLimiter>;
-      }
-    | undefined;
-  if (effectiveAuth && patFeature) {
-    const rl = patRateLimitFromFeature(patFeature);
-    patAuthFragment = {
-      patResolver: createPatResolver({ db, scopes: patScopesFromFeature(patFeature) }),
-      patRateLimiter: createInMemoryLoginRateLimiter(rl.maxRequests, rl.windowMs),
-    };
-  }
-
   const baseEntrypointOptions = {
     registry,
     context: {
@@ -1016,7 +994,6 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
           unsafeSkipOriginCheck: effectiveAuth.unsafeSkipOriginCheck,
         }),
         ...sessionAuthFragment,
-        ...patAuthFragment,
         ...(effectiveAuth.passwordReset && {
           passwordReset: {
             requestHandler: AuthHandlers.requestPasswordReset,
@@ -1108,11 +1085,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   if (effectiveAuth) {
     await seedAdmin(db, effectiveAuth.admin);
   }
-  await applyBootSeeds({
-    registry,
-    db,
-    ...(bootCrypto.configCipher && { cipher: bootCrypto.configCipher }),
-  });
+  await applyBootSeeds({ registry, db });
   for (const seed of options.seeds ?? []) {
     await seed({ db });
   }
@@ -1500,7 +1473,6 @@ export function staticCachePolicy(pathname: string): CachePolicy {
 function buildProdSessionAuth(
   db: import("@cosmicdrift/kumiko-framework/db").DbConnection,
   opts: ProdSessionsConfig,
-  sessionsFeature: import("@cosmicdrift/kumiko-framework/engine").FeatureDefinition | undefined,
 ): {
   readonly sessionCreator: ReturnType<typeof createSessionCallbacks>["sessionCreator"];
   readonly sessionRevoker: ReturnType<typeof createSessionCallbacks>["sessionRevoker"];
@@ -1511,11 +1483,6 @@ function buildProdSessionAuth(
     db,
     ...(opts.expiresInMs !== undefined && { expiresInMs: opts.expiresInMs }),
   });
-  // Secure-by-default: password-change/-reset mass-revokes the user's live
-  // sessions without the app opting in via autoRevokeOnPasswordChange.
-  if (sessionsFeature) {
-    bindAutoRevokeFromFeature(sessionsFeature)?.(cbs.sessionMassRevoker);
-  }
   return {
     sessionCreator: cbs.sessionCreator,
     sessionRevoker: cbs.sessionRevoker,

package/src/scaffold-app.ts

@@ -611,20 +611,19 @@ KUMIKO_DEV_DB_NAME=${devDb}
 `;
 }
 
-// Ports + credentials match the *_URL defaults in renderEnvExample, so
-// `docker compose up -d` just works with the generated .env. Named pg volume
-// so dev data survives `docker compose down` (pairs with KUMIKO_DEV_DB_NAME
-// persistence) — the loopback-binding rationale is in the generated file's
-// own comment (657/1), no need to duplicate it here.
+// Local Postgres + Redis for `bun dev`. Ports + credentials match the *_URL
+// defaults in renderEnvExample, so `docker compose up -d` (referenced by the
+// README) just works with the generated .env. Named pg volume so dev data
+// survives `docker compose down` (pairs with KUMIKO_DEV_DB_NAME persistence).
+// Ports bind to 127.0.0.1 only: the dev DB (postgres/postgres) and auth-less
+// Redis must not be reachable from the LAN on a machine without a firewall.
 function renderDockerCompose(): string {
   return `# Local Postgres + Redis for \`bun dev\`. Matches the *_URL defaults in .env.example.
 # Start: docker compose up -d   ·   Stop: docker compose down   ·   Reset: docker compose down -v
 # Ports bind to 127.0.0.1 only — weak dev credentials must not be exposed on the LAN.
 services:
   postgres:
-    # Pinned to the project's own compose-file tag (663/1) — Alpine variant
-    # (~90MB vs ~400MB) and a reproducible patch version, bump on PG18 minors.
-    image: postgres:18.3-alpine
+    image: postgres:18
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres

package/src/schema-apply.ts

@@ -100,16 +100,7 @@ async function rebuildAffectedProjections(
   const projections = new Set<string>();
   for (const table of changedTables) {
     const name = tableToProjection.get(table);
-    if (name) {
-      projections.add(name);
-    } else {
-      // 522/3: a table in a .rebuild.json marker that no longer matches any
-      // registered projection would otherwise rebuild nothing and exit 0 —
-      // indistinguishable from "nothing needed a rebuild".
-      console.warn(
-        `  ⚠ Table "${table}" is in a rebuild marker but matches no registered projection — skipped.`,
-      );
-    }
+    if (name) projections.add(name);
   }
   if (projections.size === 0) return;
 

package/src/welcome-banner.ts

@@ -37,7 +37,10 @@ export function renderWelcomeBanner(input: WelcomeBannerInput): string {
   return [top, ...padded, bottom].join("\n");
 }
 
-// ponytail: codepoint width; ok for ASCII + arrows, add a width-lib if CJK ever lands here.
+// Plain monospace-cell width — counts each codepoint as one cell. Good
+// enough for ASCII + the small set of arrows/checkmarks used above; if a
+// real wide-char ever lands in the banner the row alignment will drift,
+// caught visually by the snapshot test.
 function stringWidth(s: string): number {
   return [...s].length;
 }

package/src/boot/boot-crypto.ts

@@ -1,82 +0,0 @@
-// One place that turns env/options into the app-wide crypto objects:
-// the MasterKeyProvider (KUMIKO_SECRETS_MASTER_KEY_V<n> keyring) and the
-// EnvelopeCipher for `encrypted: true` config keys. runProdApp and
-// runDevApp both resolve this once and thread it into
-// buildBootExtraContext + applyBootSeeds so resolver, set-handler and
-// seeds share the same cipher instance (and DEK cache).
-
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
-import {
-  createDekCache,
-  createEnvelopeCipher,
-  createEnvMasterKeyProvider,
-  type DekCache,
-  type EnvelopeCipher,
-  type MasterKeyProvider,
-} from "@cosmicdrift/kumiko-framework/secrets";
-
-// Keyring detection without throwing: only build the env provider when at
-// least one versioned KEK is actually set. Covers (a) apps without any
-// encryption — no KEK requirement, and (b) dev with an app-supplied
-// provider in options.masterKey — env stays irrelevant.
-const MASTER_KEK_VAR = /^KUMIKO_SECRETS_MASTER_KEY_V\d+$/;
-export function envHasMasterKek(env: Record<string, string | undefined>): boolean {
-  return Object.entries(env).some(([k, v]) => MASTER_KEK_VAR.test(k) && !!v);
-}
-
-export type BootCrypto = {
-  readonly masterKeyProvider?: MasterKeyProvider;
-  // Cipher for encrypted config keys. Present exactly when a master key is
-  // available. Decrypts legacy CONFIG_ENCRYPTION_KEY values as fallback
-  // until the config re-encrypt job migrated them.
-  readonly configCipher?: EnvelopeCipher;
-  // Cipher for `encrypted: true` entity fields — same master key, but the
-  // legacy fallback reads the pre-envelope ENCRYPTION_KEY format. Identical
-  // to configCipher when no ENCRYPTION_KEY is set.
-  readonly entityFieldCipher?: EnvelopeCipher;
-  readonly dekCache: DekCache;
-};
-
-export function resolveBootCrypto(
-  envSource: Record<string, string | undefined>,
-  masterKeyOverride?: MasterKeyProvider,
-): BootCrypto {
-  const masterKeyProvider =
-    masterKeyOverride ??
-    (envHasMasterKek(envSource)
-      ? createEnvMasterKeyProvider({
-          // CURRENT_VERSION default "1" spiegelt secretsEnvSchema — ohne
-          // ihn wirft der raw-env-Provider, obwohl V1 gesetzt ist.
-          env: {
-            ...envSource,
-            KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION:
-              envSource["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
-          },
-        })
-      : undefined);
-
-  const dekCache = createDekCache();
-  const legacyConfigKey = envSource["CONFIG_ENCRYPTION_KEY"];
-  const configCipher = masterKeyProvider
-    ? createEnvelopeCipher(masterKeyProvider, {
-        dekCache,
-        ...(legacyConfigKey ? { legacy: createEncryptionProvider(legacyConfigKey) } : {}),
-      })
-    : undefined;
-
-  const legacyEntityKey = envSource["ENCRYPTION_KEY"];
-  const entityFieldCipher =
-    masterKeyProvider && legacyEntityKey
-      ? createEnvelopeCipher(masterKeyProvider, {
-          dekCache,
-          legacy: createEncryptionProvider(legacyEntityKey),
-        })
-      : configCipher;
-
-  return {
-    ...(masterKeyProvider && { masterKeyProvider }),
-    ...(configCipher && { configCipher }),
-    ...(entityFieldCipher && { entityFieldCipher }),
-    dekCache,
-  };
-}