@cosmicdrift/kumiko-dev-server 0.146.4 → 0.147.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.146.4",
+  "version": "0.147.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -58,8 +58,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.146.4",
-    "@cosmicdrift/kumiko-framework": "0.146.4",
+    "@cosmicdrift/kumiko-bundled-features": "0.147.0",
+    "@cosmicdrift/kumiko-framework": "0.147.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/compose-stacks.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { composeFeatures } from "../compose-features";
 import {
   composeFileStack,
   composeGdprStack,
@@ -77,8 +79,25 @@ describe("composeStacks", () => {
   });
 });
 
-/** Parity: preset name-sets match blocks used in studio / money-horse / publicstatus run-config. */
-describe("composeStacks parity (feature names)", () => {
+/** Snapshot, not a live parity check: intended block combinations, mirrored by hand from studio/money-horse/publicstatus run-configs. A drifted run-config stays green here. */
+describe("composeStacks boots for real", () => {
+  test("studio-shaped combined stack passes validateBoot (not just name-list comparison)", () => {
+    const features = composeFeatures(
+      [
+        ...composeOpsStack({ rateLimiting: true }),
+        ...composePagesStack(),
+        ...composeMailStack({ transports: ["inmemory"] }),
+        ...composeFileStack({ providers: ["inmemory"] }),
+        ...composeGdprStack({ order: "compliance-first", sessions: true }),
+        ...composeUserDataRightsStack(),
+      ],
+      { includeBundled: true },
+    );
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+});
+
+describe("composeStacks intended block names (snapshot, not live parity)", () => {
   test("studio SaaS blocks are covered by presets", () => {
     const names = stackFeatureNames([
       ...composeOpsStack({ rateLimiting: true }),
@@ -135,7 +154,7 @@ describe("composeStacks parity (feature names)", () => {
     const names = stackFeatureNames([
       ...composePagesStack(),
       ...composeGdprStack({ tenantLifecycle: true }),
-      ...composeOpsStack({ delivery: true, audit: true, jobs: true, sessions: false }),
+      ...composeOpsStack({ delivery: true, audit: true, jobs: true }),
       ...composeRendererStack(),
       ...composeFileStack({ providers: ["inmemory"] }),
       ...composeUserDataRightsStack(),

package/src/__tests__/few-shot-corpus.test.ts

@@ -44,7 +44,7 @@ describe("buildFewShotCorpus — smoke", () => {
     });
     plantPackage(workdir, "samples/recipes/legacy-demo", {
       pkgName: "@cosmicdrift/kumiko-sample-legacy-demo",
-      pkgDescription: "Identifier-ref-style legacy feature.",
+      pkgDescription: "Handler-object-reference-style legacy feature.",
       featureSource: buildLegacyFeature("legacyDemo"),
     });
 
@@ -293,19 +293,24 @@ defineFeature("${featureName}", (r) => {
 }
 
 function buildLegacyFeature(featureName: string): string {
-  // Identifier-ref style — the parser refuses (entity definition is a
-  // captured const), produces a ParseError, and the corpus marks the
-  // entry as authoringStyle: "legacy".
+  // Handler-object-reference style — writeHandler receives a single
+  // identifier referencing a pre-built handler object rather than an
+  // inline string name + schema + handler. The parser has no extractor
+  // shape for that (it only reads a literal name as the first arg, or
+  // an inline object-literal form), so it produces a ParseError and the
+  // corpus marks the entry as authoringStyle: "legacy".
+  //
+  // Note: a captured-const *entity definition* (`r.entity("x", xEntity)`)
+  // used to be the legacy example here, but #998 taught the parser to
+  // resolve such references via a raw-ref sentinel — that idiom parses
+  // cleanly now and no longer exercises the legacy path.
   return `
-import { defineFeature, createEntity, createTextField } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 
-const itemEntity = createEntity({
-  table: "items",
-  fields: { title: createTextField({ required: true }) },
-});
+const itemCreateHandler = { name: "item:create" };
 
 defineFeature("${featureName}", (r) => {
-  r.entity("item", itemEntity);
+  r.writeHandler(itemCreateHandler);
 });
 `;
 }

package/src/__tests__/merge-extra-context.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+import { mergeExtraContext } from "../setup-test-stack-from-features";
+
+// #882/4: the integration test only asserted getFeature("config") — which
+// includeBundled already provides — never that presets:["config"] actually
+// merges configResolver/textContent into extraContext. Unit-test the merge
+// directly instead.
+
+const fakeDeps = {
+  registry: {} as never,
+  db: { marker: "fake-db" } as never,
+  sseBroker: {} as never,
+  redis: {} as never,
+};
+
+describe("mergeExtraContext", () => {
+  test("no presets → returns base untouched (function passthrough)", () => {
+    const base = () => ({ foo: "bar" });
+    const merged = mergeExtraContext(base, []);
+    expect(merged).toBe(base);
+  });
+
+  test("no presets → returns base untouched (object passthrough)", () => {
+    const base = { foo: "bar" };
+    const merged = mergeExtraContext(base, []);
+    expect(merged).toBe(base);
+  });
+
+  test("config preset merges configResolver, keeping base-object fields", () => {
+    const merged = mergeExtraContext({ foo: "bar" }, ["config"]);
+    expect(typeof merged).toBe("function");
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["foo"]).toBe("bar");
+    expect(result["configResolver"]).toBeDefined();
+  });
+
+  test("config preset merges configResolver, keeping base-fn fields", () => {
+    const merged = mergeExtraContext(() => ({ fromFn: 1 }), ["config"]);
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["fromFn"]).toBe(1);
+    expect(result["configResolver"]).toBeDefined();
+  });
+
+  test("text-content preset merges textContent, built from deps.db", () => {
+    const merged = mergeExtraContext(undefined, ["text-content"]);
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["textContent"]).toBeDefined();
+  });
+
+  test("both presets merge both fields", () => {
+    const merged = mergeExtraContext(undefined, ["config", "text-content"]);
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["configResolver"]).toBeDefined();
+    expect(result["textContent"]).toBeDefined();
+  });
+});

package/src/codegen/__tests__/strict-mode-diagnostics.test.ts

@@ -1,6 +1,11 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+// TS7's package.json exports only version.cjs at ".", so the classic
+// createProgram/ScriptTarget Compiler API is unreachable via `import *
+// as ts from "typescript"` anymore; ts-morph's vendored (older) compiler
+// build is the only way to get that surface, so diagnostics here run
+// against a different compiler than the repo's own tsc.
 import { ts } from "ts-morph";
 import { runCodegen } from "../run-codegen";
 

package/src/compose-stacks.ts

@@ -61,11 +61,14 @@ export type UserDataRightsStackOptions = {
   readonly includeDefaults?: boolean;
 };
 
+// `sessions` lives ONLY on GdprStackOptions — composeOpsStack used to accept
+// it too, and combining both presets with sessions:true double-pushed the
+// "sessions" feature name into the registry, which createRegistry rejects
+// with "duplicate feature" (a boot-time crash, not a warning).
 export type OpsStackOptions = {
   readonly delivery?: boolean;
   readonly audit?: boolean;
   readonly jobs?: boolean;
-  readonly sessions?: boolean;
   readonly rateLimiting?: boolean;
 };
 
@@ -135,13 +138,11 @@ export function composeOpsStack(options: OpsStackOptions = {}): FeatureDefinitio
   const delivery = options.delivery ?? true;
   const audit = options.audit ?? true;
   const jobs = options.jobs ?? true;
-  const sessions = options.sessions ?? false;
   const rateLimiting = options.rateLimiting ?? false;
   const out: FeatureDefinition[] = [];
   if (delivery) out.push(createDeliveryFeature());
   if (audit) out.push(createAuditFeature());
   if (jobs) out.push(createJobsFeature());
-  if (sessions) out.push(createSessionsFeature());
   if (rateLimiting) out.push(createRateLimitingFeature());
   return out;
 }

package/src/create-kumiko-server.ts

@@ -670,6 +670,12 @@ export async function createKumikoServer(
     ...(options.effectiveFeatures !== undefined && {
       effectiveFeatures: options.effectiveFeatures,
     }),
+    // Wires ctx.jobRunner so write handlers' `ctx.jobRunner.dispatch(...)`
+    // works under the dev server (#983) — no-ops when no jobs are
+    // registered. `jobs: {}` (no `consumerLane`) builds an enqueuer-only
+    // runner — `startDevJobRunners` below stays the sole consumer/cron-
+    // scheduler for every lane, so `runOnBoot`/cron jobs don't double-fire.
+    jobs: {},
   });
   await createEventsTable(stack.db);
   await pushEntityProjectionTables(stack, stack.registry);

package/src/run-prod-app-boot-context.ts

@@ -0,0 +1,234 @@
+import { makeAuthPaths } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { createSmtpTransportFromEnv } from "@cosmicdrift/kumiko-bundled-features/channel-email";
+import {
+  buildEnvConfigOverrides,
+  createConfigAccessorFactory,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  collectChannels,
+  createDeliveryService,
+  DELIVERY_FEATURE,
+} from "@cosmicdrift/kumiko-bundled-features/delivery";
+import {
+  createSecretsContext,
+  SECRETS_FEATURE_NAME,
+} from "@cosmicdrift/kumiko-bundled-features/secrets";
+import {
+  bindAutoRevokeFromFeature,
+  createSessionCallbacks,
+} from "@cosmicdrift/kumiko-bundled-features/sessions";
+import { createTextContentApi } from "@cosmicdrift/kumiko-bundled-features/text-content";
+import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
+import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type {
+  ConfigResolver,
+  FeatureDefinition,
+  NotifyFactory,
+  Registry,
+} from "@cosmicdrift/kumiko-framework/engine";
+import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import { type BootCrypto, resolveBootCrypto } from "./boot/boot-crypto";
+import type {
+  AuthMailOptions,
+  EmailVerificationSetup,
+  InviteSetup,
+  PasswordResetSetup,
+  SignupSetup,
+} from "./run-prod-app";
+import type { ProdSessionsConfig } from "./session-wiring";
+
+// Boot-time context helpers for runProdApp: ctx-extra-context wiring
+// (textContent/delivery/secrets/config-resolver), auth-mail convenience
+// normalization, and prod session-auth wiring. Split out of run-prod-app.ts
+// (#1005, Welle 2) — mechanical relocation, these are self-contained pure
+// functions, no closure over runProdApp's local boot state.
+
+// Shared with runDevApp (mergeConfigResolverDefault) for dev/prod parity.
+export function addConfigAccessorFactory<T extends { readonly configResolver?: ConfigResolver }>(
+  resolved: T,
+  registry: Registry,
+): T {
+  if (!resolved.configResolver) return resolved;
+  return {
+    ...resolved,
+    _configAccessorFactory: createConfigAccessorFactory(registry, resolved.configResolver),
+  };
+}
+
+// Framework-Default-Provider für den AppContext — gleicher Mechanismus wie
+// der tenantTierResolver-Autowire (findTierResolverUsage): deklarierter
+// Bedarf (Feature gemountet) → Default aus db/env, App überschreibt nur die
+// Ausnahme. textContent ist unbedingt (createTextContentApi wirft nie, baut
+// nur einen db-gebundenen Accessor). secrets wird nur auto-verdrahtet wenn
+// das secrets-Feature gemountet ist UND ein KEK tatsächlich verfügbar ist
+// (masterKey-Override ODER env-KEK present) — sonst skip, damit der eager
+// KEK-Detection + Provider/Cipher-Aufbau leben in boot/boot-crypto.ts
+// (envHasMasterKek, resolveBootCrypto) — gemeinsam mit runDevApp.
+// Prod-Misconfig (secrets gemountet, kein KEK) fängt schon secretsEnvSchema
+// beim Boot; fehlt der env-Schema-Pfad, wirft requireSecretsContext beim
+// ersten ctx.secrets-Zugriff mit Wiring-Hinweis. configResolver nur im
+// Auth-Mode. Exportiert + pure für Unit-Tests; der merge mit App-Werten
+// passiert beim Caller (App gewinnt).
+
+// Prod/dev parity for ctx.notify: without this `_notifyFactory` is only wired
+// in tests (createDeliveryTestContext), so ctx.notify is undefined at runtime
+// and every notification silently skips. sseBroker optional (email/push don't
+// need it, in-app SSE does); no jobRunner → queued channels send inline.
+function buildDeliveryNotifyFactory(opts: {
+  readonly db: DbConnection;
+  readonly registry: Registry;
+  readonly sseBroker?: SseBroker;
+}): NotifyFactory {
+  const deliveryService = createDeliveryService({
+    db: opts.db,
+    registry: opts.registry,
+    channels: collectChannels(opts.registry),
+    ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+  });
+  return (user, tenantId) => (notificationType, options) =>
+    deliveryService.notify(notificationType, options, user, tenantId);
+}
+
+export function buildBootExtraContext(opts: {
+  readonly db: DbConnection;
+  readonly features: readonly FeatureDefinition[];
+  readonly envSource: Record<string, string | undefined>;
+  readonly registry: Registry;
+  readonly hasAuth: boolean;
+  // Resolved once per boot via resolveBootCrypto — shared by secrets,
+  // config-resolver, config-set-handler and boot-seeds. Absent (tests
+  // that don't care about encryption) ⇒ resolved from envSource here.
+  readonly crypto?: BootCrypto;
+  readonly masterKey?: MasterKeyProvider;
+  readonly sseBroker?: SseBroker;
+  readonly kms?: KmsAdapter;
+}): Record<string, unknown> {
+  const crypto = opts.crypto ?? resolveBootCrypto(opts.envSource, opts.masterKey);
+  const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
+  const wireSecrets = hasSecretsFeature && crypto.masterKeyProvider !== undefined;
+  const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
+  return {
+    textContent: createTextContentApi(opts.db),
+    ...(opts.kms && { kms: opts.kms }),
+    ...(hasDeliveryFeature && {
+      _notifyFactory: buildDeliveryNotifyFactory({
+        db: opts.db,
+        registry: opts.registry,
+        ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+      }),
+    }),
+    // Top-level provider so feature jobs (secrets rotate, config reencrypt)
+    // reach it via ctx — previously only test-stack wired it.
+    ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
+    // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
+    // whenever a master key exists — NOT gated on the secrets feature,
+    // config encryption must work without mounting ctx.secrets.
+    ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
+    ...(wireSecrets &&
+      crypto.masterKeyProvider && {
+        secrets: createSecretsContext({
+          db: opts.db,
+          masterKeyProvider: crypto.masterKeyProvider,
+          dekCache: crypto.dekCache,
+        }),
+      }),
+    ...(opts.hasAuth && {
+      configResolver: createConfigResolver({
+        appOverrides: buildEnvConfigOverrides(opts.registry, opts.envSource),
+        ...(crypto.configCipher && { cipher: crypto.configCipher }),
+      }),
+    }),
+  };
+}
+
+// auth.mail-Convenience → normalisiert in die expliziten passwordReset/
+// emailVerification/signup/invite-Felder, BEVOR buildComposeAuthOptions
+// (Feature-Side: hmacSecret/mode) und das auth-routes-Fragment sie lesen —
+// so speist EIN mail-Block beide Pfade. App-explizite Flows gewinnen über
+// den Default. Null-Transport-Guard: ohne SMTP_HOST-env bleibt alles
+// unverdrahtet (sonst lieferten die reset/verify-Routes 500).
+/** Die Auth-Felder die resolveAuthMail liest/normalisiert — beide
+ *  App-Auth-Typen (prod + dev) erfüllen das strukturell. */
+type AuthMailNormalizable = {
+  readonly mail?: AuthMailOptions;
+  readonly passwordReset?: PasswordResetSetup;
+  readonly emailVerification?: EmailVerificationSetup;
+  readonly signup?: SignupSetup;
+  readonly invite?: InviteSetup;
+};
+
+export function resolveAuthMail<T extends AuthMailNormalizable>(
+  auth: T,
+  hmacSecret: string,
+  envSource: Record<string, string | undefined>,
+): T {
+  if (!auth.mail) return auth;
+  // SMTP-presence gate: ohne SMTP_HOST-env wird KEIN Flow verdrahtet (Routes
+  // blieben sonst 500). Der eigentliche Mail-Versand läuft über delivery
+  // (channel-email), nicht über diesen Transport — er ist nur der Detektor
+  // "ist Mail konfiguriert?".
+  if (
+    !createSmtpTransportFromEnv(envSource, { fallbackFrom: auth.mail.from ?? "noreply@localhost" })
+  ) {
+    return auth;
+  }
+  const paths = makeAuthPaths(auth.mail.paths);
+  // appName/locale fließen in alle vier Flow-Options (alle mailen via delivery).
+  const mailPresentation = {
+    ...(auth.mail.appName !== undefined && { appName: auth.mail.appName }),
+    ...(auth.mail.locale !== undefined && { locale: auth.mail.locale }),
+  };
+  return {
+    ...auth,
+    passwordReset: auth.passwordReset ?? {
+      hmacSecret,
+      appUrl: `${auth.mail.baseUrl}${paths.resetPassword}`,
+      ...mailPresentation,
+    },
+    emailVerification: auth.emailVerification ?? {
+      hmacSecret,
+      appUrl: `${auth.mail.baseUrl}${paths.verifyEmail}`,
+      ...(auth.mail.emailVerificationMode !== undefined && {
+        mode: auth.mail.emailVerificationMode,
+      }),
+      ...mailPresentation,
+    },
+    signup: auth.signup ?? {
+      appUrl: `${auth.mail.baseUrl}${paths.signupComplete}`,
+      ...mailPresentation,
+    },
+    invite: auth.invite ?? {
+      appUrl: `${auth.mail.baseUrl}${paths.inviteAccept}`,
+      ...mailPresentation,
+    },
+  };
+}
+
+export function buildProdSessionAuth(
+  db: DbConnection,
+  opts: ProdSessionsConfig,
+  sessionsFeature: FeatureDefinition | undefined,
+): {
+  readonly sessionCreator: ReturnType<typeof createSessionCallbacks>["sessionCreator"];
+  readonly sessionRevoker: ReturnType<typeof createSessionCallbacks>["sessionRevoker"];
+  readonly sessionChecker: ReturnType<typeof createSessionCallbacks>["sessionChecker"];
+  readonly sessionStrictMode: true;
+} {
+  const cbs = createSessionCallbacks({
+    db,
+    ...(opts.expiresInMs !== undefined && { expiresInMs: opts.expiresInMs }),
+  });
+  // Secure-by-default: password-change/-reset mass-revokes the user's live
+  // sessions without the app opting in via autoRevokeOnPasswordChange.
+  if (sessionsFeature) {
+    bindAutoRevokeFromFeature(sessionsFeature)?.(cbs.sessionMassRevoker);
+  }
+  return {
+    sessionCreator: cbs.sessionCreator,
+    sessionRevoker: cbs.sessionRevoker,
+    sessionChecker: cbs.sessionChecker,
+    sessionStrictMode: true,
+  };
+}