@cosmicdrift/kumiko-dev-server 0.152.0 → 0.153.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.152.0",
-  "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
+  "version": "0.153.0",
+  "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Not shipped into production node_modules — see @cosmicdrift/kumiko-server-runtime for the prod boot path.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
@@ -26,10 +26,6 @@
       "types": "./src/build.ts",
       "default": "./src/build.ts"
     },
-    "./compose-features": {
-      "types": "./src/compose-features.ts",
-      "default": "./src/compose-features.ts"
-    },
     "./compose-stacks": {
       "types": "./src/compose-stacks.ts",
       "default": "./src/compose-stacks.ts"
@@ -58,8 +54,9 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.152.0",
-    "@cosmicdrift/kumiko-framework": "0.152.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.153.0",
+    "@cosmicdrift/kumiko-framework": "0.153.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.153.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/build-prod-bundle.integration.test.ts

@@ -19,7 +19,7 @@ import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildProdBundle } from "../build-prod-bundle";
+import { buildProdBundle } from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);

package/src/__tests__/compose-stacks.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
-import { composeFeatures } from "../compose-features";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import {
   composeFileStack,
   composeGdprStack,

package/src/__tests__/discover-format.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { formatBuildResult } from "../build-prod-bundle";
+import { formatBuildResult } from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
 import { discoverServerEntry } from "../build-server-bundle";
 
 describe("discoverServerEntry", () => {

package/src/__tests__/env-schema.integration.test.ts

@@ -7,10 +7,10 @@
 import { describe, expect, it } from "bun:test";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { composeEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
+import { runProdApp } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 import { z } from "zod";
 import { frameworkCoreEnvSchema } from "../env-schema";
 import * as devServerPublicApi from "../index";
-import { runProdApp } from "../run-prod-app";
 
 const secretsFeature = defineFeature("secrets", (r) => {
   r.envSchema(

package/src/__tests__/walkthrough.integration.test.ts

@@ -16,7 +16,7 @@ import { join } from "node:path";
 import { createSecretsFeature } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { createRegistry, defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
-import { composeFeatures } from "../compose-features";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { scaffoldApp } from "../scaffold-app";
 import { scaffoldAppFeature } from "../scaffold-app-feature";
 

package/src/build.ts

@@ -13,7 +13,7 @@ export {
   discoverHtmlTemplate,
   formatBuildResult,
   injectAssetTags,
-} from "./build-prod-bundle";
+} from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
 
 export {
   type BuildServerBundleEntry,

package/src/create-kumiko-server.ts

@@ -29,12 +29,18 @@ import {
   type TestStackOptions,
   TestUsers,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { startDevJobRunners } from "./boot/job-run-logger";
-import { type ExtraRoutesSystemDeps, makeDispatchSystemWrite } from "./extra-routes-deps";
-import { injectSchema } from "./inject-schema";
-import { canResolveTailwindStylesheet, resolveTailwindCli } from "./resolve-tailwind-cli";
-import { buildBunServeOptions } from "./run-prod-app";
-import { tryHonoFirst } from "./try-hono-first";
+import { startDevJobRunners } from "@cosmicdrift/kumiko-server-runtime/boot/job-run-logger";
+import { buildBunServeOptions } from "@cosmicdrift/kumiko-server-runtime/bun-serve-options";
+import {
+  type ExtraRoutesSystemDeps,
+  makeDispatchSystemWrite,
+} from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
+import { injectSchema } from "@cosmicdrift/kumiko-server-runtime/inject-schema";
+import {
+  canResolveTailwindStylesheet,
+  resolveTailwindCli,
+} from "@cosmicdrift/kumiko-server-runtime/resolve-tailwind-cli";
+import { tryHonoFirst } from "@cosmicdrift/kumiko-server-runtime/try-hono-first";
 
 // Runtime-detection. The dev-server is meant to run under Bun (Kumiko's
 // target runtime), but the test-suite runs under vitest on Node — we

package/src/index.ts

@@ -13,6 +13,10 @@
 //     Login-Routes + Error-Map, ruft seedAdmin im onAfterSetup. Default
 //     für Sample-Apps und Showcases — 5-10 Zeilen Bootstrap statt 50.
 
+export {
+  type ComposeFeaturesOptions,
+  composeFeatures,
+} from "@cosmicdrift/kumiko-server-runtime/compose-features";
 // Build-Toolchain (buildProdBundle, Bun.build, Tailwind-Pipeline, ts-morph) lebt
 // im Sub-Path-Export `@cosmicdrift/kumiko-dev-server/build`. Damit zieht der Main-Barrel
 // kein Bun-Toolchain-Bundle mehr in Production-Reads (z.B. wenn drizzle-kit
@@ -25,7 +29,6 @@ export {
   type ScanWarning,
   scanEvents,
 } from "./codegen";
-export { type ComposeFeaturesOptions, composeFeatures } from "./compose-features";
 export {
   composeFileStack,
   composeGdprStack,
@@ -62,17 +65,6 @@ export type {
 export { buildFewShotCorpus, pathToId } from "./few-shot-corpus";
 export type { RunDevAppAuthOptions, RunDevAppOptions, SeedFn } from "./run-dev-app";
 export { runDevApp } from "./run-dev-app";
-export type {
-  EmailVerificationSetup,
-  InviteSetup,
-  PasswordResetSetup,
-  ProdAppHandle,
-  ProdSeedFn,
-  RunProdAppAuthOptions,
-  RunProdAppOptions,
-  SignupSetup,
-} from "./run-prod-app";
-export { runProdApp } from "./run-prod-app";
 export type {
   ScaffoldAppOptions,
   ScaffoldAppResult,

package/src/run-dev-app.ts

@@ -69,28 +69,32 @@ import {
 import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
-import { applyBootSeeds } from "./boot/apply-boot-seeds";
-import { resolveBootCrypto } from "./boot/boot-crypto";
+import { applyBootSeeds } from "@cosmicdrift/kumiko-server-runtime/boot/apply-boot-seeds";
+import { resolveBootCrypto } from "@cosmicdrift/kumiko-server-runtime/boot/boot-crypto";
+import {
+  buildComposeAuthOptions,
+  composeFeatures,
+} from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import { assertPiiBootInvariants } from "@cosmicdrift/kumiko-server-runtime/pii-boot-gate";
 import { watchAndRegenerate } from "./codegen";
-import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
 import {
   type CreateKumikoServerOptions,
   createKumikoServer,
   type KumikoServerHandle,
 } from "./create-kumiko-server";
-import { assertPiiBootInvariants } from "./pii-boot-gate";
 import { renderWelcomeBanner } from "./welcome-banner";
 
 // Re-export der shared Auth-Setup-Types damit Apps nur einen Import-Pfad
 // brauchen. PasswordResetSetup / EmailVerificationSetup leben in
-// run-prod-app.ts (single source of truth) — hier nur durchgereicht.
+// @cosmicdrift/kumiko-server-runtime (single source of truth) — hier nur
+// durchgereicht.
 export type {
   AuthMailOptions,
   EmailVerificationSetup,
   InviteSetup,
   PasswordResetSetup,
   SignupSetup,
-} from "./run-prod-app";
+} from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 
 import type {
   AuthMailOptions,
@@ -98,13 +102,13 @@ import type {
   InviteSetup,
   PasswordResetSetup,
   SignupSetup,
-} from "./run-prod-app";
+} from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 import {
   addConfigAccessorFactory,
   buildBootExtraContext,
   requireEnv,
   resolveAuthMail,
-} from "./run-prod-app";
+} from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 
 export type RunDevAppAuthOptions = {
   /** Admin user to seed at boot. Idempotent — re-runs in persistent-DB

package/src/scaffold-app.ts

@@ -19,8 +19,8 @@ import {
   writeSnapshotJson,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { IndentationText, Project, VariableDeclarationKind } from "ts-morph";
-import { composeFeatures } from "./compose-features";
 import { isKebabSegment } from "./kebab";
 import {
   createDemoTasksFeature,
@@ -177,6 +177,7 @@ function renderPackageJson(name: string, version: string): string {
         "@cosmicdrift/kumiko-dev-server": version,
         "@cosmicdrift/kumiko-framework": version,
         "@cosmicdrift/kumiko-renderer-web": version,
+        "@cosmicdrift/kumiko-server-runtime": version,
         react: "^19.2.6",
         "react-dom": "^19.2.6",
         zod: "^4.4.3",
@@ -410,7 +411,11 @@ function renderMain(appName: string): string {
 
   sf.addImportDeclaration({
     moduleSpecifier: "@cosmicdrift/kumiko-dev-server",
-    namedImports: ["composeFeatures", "frameworkCoreEnvSchema", "runProdApp"],
+    namedImports: ["frameworkCoreEnvSchema"],
+  });
+  sf.addImportDeclaration({
+    moduleSpecifier: "@cosmicdrift/kumiko-server-runtime",
+    namedImports: ["composeFeatures", "runProdApp"],
   });
   sf.addImportDeclaration({
     moduleSpecifier: "@cosmicdrift/kumiko-framework/engine",
@@ -773,7 +778,7 @@ function renderKumikoSchema(): string {
     "// Computes table-metas from the SAME composeFeatures(APP_FEATURES) the",
     "// runtime sees (runProdApp/runDevApp) — migration and runtime cannot drift.",
     "",
-    'import { composeFeatures } from "@cosmicdrift/kumiko-dev-server/compose-features";',
+    'import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";',
     'import { collectTableMetas, type EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";',
     'import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";',
     'import { APP_FEATURES, HAS_AUTH } from "../src/run-config";',
@@ -795,7 +800,7 @@ function renderBinKumiko(): string {
     "// migrate-step runs `bun /app/kumiko.js schema apply`; kumiko-build bundles",
     "// this file to dist-server/kumiko.js.",
     "",
-    'import { composeFeatures } from "@cosmicdrift/kumiko-dev-server/compose-features";',
+    'import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";',
     'import { runSchemaCli } from "@cosmicdrift/kumiko-framework/schema-cli";',
     'import { APP_FEATURES, HAS_AUTH } from "../src/run-config";',
     "",

package/src/schema-apply.ts

@@ -22,7 +22,10 @@ import {
   createProjectionStateTable,
   rebuildProjection,
 } from "@cosmicdrift/kumiko-framework/pipeline";
-import { type ComposeFeaturesOptions, composeFeatures } from "./compose-features";
+import {
+  type ComposeFeaturesOptions,
+  composeFeatures,
+} from "@cosmicdrift/kumiko-server-runtime/compose-features";
 
 export type SchemaApplyOptions = ComposeFeaturesOptions & {
   /** App-Features (z.B. APP_FEATURES aus run-config) — composed mit den

package/src/schema-check-core.ts

@@ -4,7 +4,7 @@
 
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { composeFeatures } from "./compose-features";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 
 // The generate-script lives under different roots across apps: publicstatus
 // uses `drizzle/generate.ts`, the framework's own sample-apps use

package/src/setup-test-stack-from-features.ts

@@ -9,7 +9,10 @@ import {
   type TestStack,
   type TestStackOptions,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { type ComposeFeaturesOptions, composeFeatures } from "./compose-features";
+import {
+  type ComposeFeaturesOptions,
+  composeFeatures,
+} from "@cosmicdrift/kumiko-server-runtime/compose-features";
 
 export type TestStackPreset = "config" | "text-content";
 

package/src/__tests__/boot-extra-context.test.ts

@@ -1,140 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { createDeliveryFeature } from "@cosmicdrift/kumiko-bundled-features/delivery";
-import { createSecretsFeature } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { createRegistry, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
-import { buildBootExtraContext } from "../run-prod-app";
-
-// Pins runProdApp's framework-default-provider autowire (buildBootExtraContext):
-// textContent unconditional, secrets feature-gated, KEK-env trap avoided, the
-// money-horse regression (no secrets feature → no forced KEK → no throw), and
-// the delivery _notifyFactory wiring that makes ctx.notify work in prod (only
-// test-wired before — runProdApp/runDevApp call THIS, not createDeliveryTestContext).
-
-// db is never touched at construction time — createTextContentApi /
-// createSecretsContext only store the handle and query lazily. A bare stub
-// keeps this a fast unit test (no Postgres) instead of a full boot.
-const fakeDb = {} as unknown as DbConnection;
-const registry = createRegistry([]);
-const KEK = Buffer.alloc(32, 7).toString("base64");
-
-const otherFeature = defineFeature("widgets", () => {});
-
-describe("buildBootExtraContext — framework-default provider autowire", () => {
-  test("textContent is wired unconditionally (no secrets feature, no auth)", () => {
-    const ctx = buildBootExtraContext({
-      db: fakeDb,
-      features: [otherFeature],
-      envSource: {},
-      registry,
-      hasAuth: false,
-    });
-    expect(typeof (ctx["textContent"] as { getBlock?: unknown }).getBlock).toBe("function");
-    expect(ctx["secrets"]).toBeUndefined();
-    expect(ctx["configResolver"]).toBeUndefined();
-    expect(ctx["_notifyFactory"]).toBeUndefined();
-  });
-
-  test("delivery feature mounted → _notifyFactory wired (ctx.notify works in prod)", () => {
-    const ctx = buildBootExtraContext({
-      db: fakeDb,
-      features: [createDeliveryFeature()],
-      envSource: {},
-      registry,
-      hasAuth: false,
-    });
-    expect(typeof ctx["_notifyFactory"]).toBe("function");
-  });
-
-  test("no delivery feature → _notifyFactory not wired", () => {
-    const ctx = buildBootExtraContext({
-      db: fakeDb,
-      features: [otherFeature],
-      envSource: {},
-      registry,
-      hasAuth: false,
-    });
-    expect(ctx["_notifyFactory"]).toBeUndefined();
-  });
-
-  test("secrets feature mounted + valid KEK env → ctx.secrets wired", () => {
-    const ctx = buildBootExtraContext({
-      db: fakeDb,
-      features: [createSecretsFeature()],
-      envSource: {
-        KUMIKO_SECRETS_MASTER_KEY_V1: KEK,
-        KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
-      },
-      registry,
-      hasAuth: false,
-    });
-    const secrets = ctx["secrets"] as {
-      get?: unknown;
-      set?: unknown;
-      has?: unknown;
-      delete?: unknown;
-    };
-    expect(typeof secrets.get).toBe("function");
-    expect(typeof secrets.set).toBe("function");
-  });
-
-  test("secrets feature mounted, only V1 set (no CURRENT_VERSION) → wired (default '1')", () => {
-    const ctx = buildBootExtraContext({
-      db: fakeDb,
-      features: [createSecretsFeature()],
-      envSource: { KUMIKO_SECRETS_MASTER_KEY_V1: KEK },
-      registry,
-      hasAuth: false,
-    });
-    expect(ctx["secrets"]).toBeDefined();
-  });
-
-  test("secrets feature mounted but NO KEK + no override → skipped, no throw (dev DEV_KEY path)", () => {
-    // dev wires its own DEV_KEY secrets explicitly; the auto-wire must not
-    // eagerly construct an env-provider and crash the boot when no env KEK
-    // exists. ctx.secrets stays unset so the app's explicit wiring wins.
-    let ctx: Record<string, unknown> | undefined;
-    expect(() => {
-      ctx = buildBootExtraContext({
-        db: fakeDb,
-        features: [createSecretsFeature()],
-        envSource: {},
-        registry,
-        hasAuth: false,
-      });
-    }).not.toThrow();
-    expect(ctx?.["secrets"]).toBeUndefined();
-  });
-
-  test("no secrets feature → no KEK ever read, boots green (money-horse regression)", () => {
-    const ctx = buildBootExtraContext({
-      db: fakeDb,
-      features: [otherFeature],
-      envSource: {}, // no KEK — must NOT matter when secrets isn't mounted
-      registry,
-      hasAuth: false,
-    });
-    expect(ctx["secrets"]).toBeUndefined();
-  });
-
-  test("masterKey override is used verbatim — no env-provider built", () => {
-    const override: MasterKeyProvider = {
-      wrapDek: async () => ({ encryptedDek: Buffer.alloc(0), kekVersion: 1 }),
-      unwrapDek: async () => Buffer.alloc(0),
-      currentVersion: () => 1,
-      isAvailable: async () => true,
-    };
-    // envSource is empty: if the override weren't honoured, createEnvMasterKeyProvider
-    // would throw "no KEK". It doesn't → the override path is taken.
-    const ctx = buildBootExtraContext({
-      db: fakeDb,
-      features: [createSecretsFeature()],
-      envSource: {},
-      registry,
-      hasAuth: false,
-      masterKey: override,
-    });
-    expect(ctx["secrets"]).toBeDefined();
-  });
-});