@cosmicdrift/kumiko-dev-server 0.152.0 → 0.153.0

package/src/compose-features.ts

@@ -1,164 +0,0 @@
-// composeFeatures — single source of truth für die Feature-Liste die
-// Boot UND Schema-Generator sehen.
-//
-// Sowohl runDevApp als auch runProdApp mischen im auth-mode dieselben
-// vier Bundled-Features dazu (config + user + tenant + auth-email-pw).
-// Damit der drizzle-Schema-Generator pro App genau dieselbe Feature-
-// Liste sieht wie die Runtime, leben die Komposition hier — beide
-// Bootstrap-Wrapper UND der per-app drizzle/generate.ts rufen sie auf.
-//
-// Reihenfolge: Infrastruktur-Features (config/user/tenant) zuerst, dann
-// auth-email-password, dann die App-Features. Spätere Features dürfen
-// auf Frühere referenzieren (z.B. authClaims-Hooks an user/tenant).
-
-import {
-  type AuthEmailPasswordOptions,
-  type AuthMailLocale,
-  createAuthEmailPasswordFeature,
-  type EmailVerificationOptions,
-  type InviteOptions,
-  type PasswordResetOptions,
-  type SignupOptions,
-} from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import {
-  AUTH_MFA_FEATURE,
-  mfaStatusCheckerFromFeature,
-} from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
-import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
-import { createTenantFeature } from "@cosmicdrift/kumiko-bundled-features/tenant";
-import { createUserFeature } from "@cosmicdrift/kumiko-bundled-features/user";
-import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-
-export type ComposeFeaturesOptions = {
-  /** When true, prepends config + user + tenant + auth-email-password
-   *  before the app features. Mirror of "auth-mode" in run{Dev,Prod}App. */
-  readonly includeBundled: boolean;
-  /** Optional auth-feature-options durchgereicht an
-   *  createAuthEmailPasswordFeature. Wenn passwordReset / emailVerification
-   *  hier gesetzt sind, registriert das Feature die request-/confirm-
-   *  Handler — sonst NICHT (500 wenn die routes via auth-routes.ts
-   *  gemounted sind aber kein Handler dispatcht). Hand-in-hand mit dem
-   *  passwordReset-Block in RunProdAppAuthOptions / RunDevAppAuthOptions. */
-  readonly authOptions?: AuthEmailPasswordOptions;
-};
-
-export function composeFeatures(
-  appFeatures: readonly FeatureDefinition[],
-  options: ComposeFeaturesOptions,
-): FeatureDefinition[] {
-  // ponytail: includeBundled:false skips the auth-mfa auto-wiring below —
-  // an app composing its own foundation and mounting auth-mfa itself is
-  // responsible for threading mfaStatusCheckerFromFeature(...) into its
-  // own createAuthEmailPasswordFeature(...) call, or login silently
-  // bypasses MFA. Upgrade if this trips someone: warn here when appFeatures
-  // contains AUTH_MFA_FEATURE but includeBundled is false.
-  if (!options.includeBundled) return [...appFeatures];
-
-  // Bundled foundation goes first so its instances carry the runDevApp /
-  // runProdApp `authOptions` (passwordReset wiring etc.). App-features that
-  // ALSO declare one of these names — e.g. the create-kumiko-app picker
-  // hands back `createAuthEmailPasswordFeature()` because the user ticked
-  // it — would otherwise crash createRegistry with "Duplicate feature".
-  // Drop the app-side duplicates and warn so the user can clean run-config.
-  //
-  // auth-mfa is NOT part of the bundled foundation (apps opt in explicitly
-  // via APP_FEATURES) — but if it's there, the login handler needs its
-  // status-checker wired in at construction time, since createAuthEmail-
-  // PasswordFeature is built right here, before the caller ever sees it.
-  const mfaFeature = appFeatures.find((f) => f.name === AUTH_MFA_FEATURE);
-  const authOptions = mfaFeature
-    ? { ...options.authOptions, mfaStatusChecker: mfaStatusCheckerFromFeature(mfaFeature) }
-    : options.authOptions;
-  const bundled = [
-    createConfigFeature(),
-    createUserFeature(),
-    createTenantFeature(),
-    createAuthEmailPasswordFeature(authOptions ?? {}),
-  ];
-  const bundledNames = new Set(bundled.map((f) => f.name));
-  const filteredApp: FeatureDefinition[] = [];
-  for (const f of appFeatures) {
-    if (bundledNames.has(f.name)) {
-      // biome-ignore lint/suspicious/noConsole: boot-time UX warning
-      console.warn(
-        `[composeFeatures] "${f.name}" already auto-mounted via includeBundled — dropping the explicit copy from APP_FEATURES. Remove it from run-config.ts to silence this warning.`,
-      );
-      continue;
-    }
-    filteredApp.push(f);
-  }
-  return [...bundled, ...filteredApp];
-}
-
-/** Shape eines beliebigen run{Prod,Dev}App-Auth-Blocks der eine
- *  PasswordReset/EmailVerification-Konfiguration tragen kann. Die
- *  Wrapper-API (PasswordResetSetup) extends die Feature-API
- *  (PasswordResetOptions), darum reicht ein structural-typed
- *  Lookup auf den auth-only-Subset. Erlaubt buildComposeAuthOptions
- *  mit RunProd- UND RunDev-AuthOptions zu callen ohne den Helper
- *  doppelt zu bauen. */
-export type AuthOptionsCarrier = {
-  readonly passwordReset?: PasswordResetOptions;
-  readonly emailVerification?: EmailVerificationOptions;
-  readonly signup?: SignupOptions;
-  readonly invite?: InviteOptions;
-};
-
-/** Baut den authOptions-Block für composeFeatures aus einem
- *  Wrapper-Auth-Block. Reicht NUR die feature-side-Felder
- *  (hmacSecret, tokenTtlMinutes, mode) durch — die mail-side
- *  (sendResetEmail/appResetUrl) gehört in die auth-routes-config
- *  und wird vom Wrapper separat verdrahtet.
- *
- *  Returnt undefined wenn weder passwordReset noch emailVerification
- *  gesetzt sind (composeFeatures default-deny: KEINE handler in der
- *  Registry registriert, /api/auth/request-password-reset etc. bleiben
- *  401/404). */
-type MailFlowFields = {
-  readonly appUrl: string;
-  readonly tokenTtlMinutes?: number;
-  readonly appName?: string;
-  readonly locale?: AuthMailLocale;
-};
-
-// The magic-link mail fields shared by all four flows. Conditional spreads omit
-// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
-// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
-// reset/verify layer hmacSecret (+ mode) on top.
-function pickMailFields(src: MailFlowFields): MailFlowFields {
-  return {
-    appUrl: src.appUrl,
-    ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
-    ...(src.appName !== undefined && { appName: src.appName }),
-    ...(src.locale !== undefined && { locale: src.locale }),
-  };
-}
-
-export function buildComposeAuthOptions(
-  auth: AuthOptionsCarrier | undefined,
-): AuthEmailPasswordOptions | undefined {
-  if (!auth) return undefined;
-  const opts: { -readonly [K in keyof AuthEmailPasswordOptions]: AuthEmailPasswordOptions[K] } = {};
-  if (auth.passwordReset) {
-    opts.passwordReset = {
-      hmacSecret: auth.passwordReset.hmacSecret,
-      ...pickMailFields(auth.passwordReset),
-    };
-  }
-  if (auth.emailVerification) {
-    opts.emailVerification = {
-      hmacSecret: auth.emailVerification.hmacSecret,
-      ...pickMailFields(auth.emailVerification),
-      ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
-    };
-  }
-  if (auth.signup) {
-    opts.signup = pickMailFields(auth.signup);
-  }
-  if (auth.invite) {
-    opts.invite = pickMailFields(auth.invite);
-  }
-  return opts.passwordReset || opts.emailVerification || opts.signup || opts.invite
-    ? opts
-    : undefined;
-}

package/src/extra-routes-deps.ts

@@ -1,47 +0,0 @@
-import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import {
-  createSystemUser,
-  type Registry,
-  type SessionUser,
-  type TenantId,
-  type WriteResult,
-} from "@cosmicdrift/kumiko-framework/engine";
-import type Redis from "ioredis";
-
-/** Deps für `extraRoutes` — geteilt zwischen runProdApp (prod) und
- *  createKumikoServer (dev), damit die beiden Pfade nicht driften.
- *  Naming: `deps` statt `ctx` weil im Framework `ctx` der HandlerContext
- *  mit user/tenant/registry ist — hier ist der Scope absichtlich kleiner
- *  (Routes laufen außerhalb der Auth/Tenant-Pipeline). */
-export type ExtraRoutesSystemDeps = {
-  readonly db: DbConnection;
-  readonly redis: Redis;
-  /** Feature-registry — z.B. für Plugin-Lookups via
-   *  `registry.getExtensionUsages("subscriptionProvider")`. */
-  readonly registry: Registry;
-  /** Schreibt durch den /api/*-Command-Dispatcher (gleiche Idempotency/
-   *  Job-Hooks) — aber als auto-konstruierter SystemAdmin des Ziel-
-   *  Tenants, OHNE Access-Check der Route. Privilege-Scope: SystemAdmin
-   *  ist die höchste nicht-tenant-scoped Rolle — der Call erreicht JEDEN
-   *  SystemAdmin-gegateten Handler auf jedem Tenant; das Rollen-Set ist
-   *  nicht konfigurierbar. Nur für Pfade, die ihre Authentizität selbst
-   *  beweisen (Provider-Webhook-Signaturen,
-   *  createSubscriptionWebhookHandler et al.). */
-  readonly dispatchSystemWrite: (args: {
-    readonly handlerQn: string;
-    readonly payload: unknown;
-    readonly tenantId: TenantId;
-  }) => Promise<WriteResult>;
-};
-
-type SystemWriteDispatcher = {
-  readonly write: (handlerQn: string, payload: unknown, user: SessionUser) => Promise<WriteResult>;
-};
-
-export function makeDispatchSystemWrite(
-  dispatcher: SystemWriteDispatcher,
-): ExtraRoutesSystemDeps["dispatchSystemWrite"] {
-  return ({ handlerQn, payload, tenantId }) =>
-    dispatcher.write(handlerQn, payload, createSystemUser(tenantId, [ROLES.SystemAdmin]));
-}

package/src/inject-schema.ts

@@ -1,30 +0,0 @@
-// Injiziert das Server-aufgelöste AppSchema in das HTML-Template damit
-// createKumikoApp() es synchron unter `window.__KUMIKO_SCHEMA__` vorfindet.
-// JSON ist valides JS — direkt eingebettet, der Browser parsed das
-// Object-Literal nativ.
-//
-// Geteilt zwischen dev-server (Schema kommt frisch aus dem laufenden
-// Prozess) und prod-server (Schema wird beim Boot einmal berechnet und
-// in die statisch ausgelieferte index.html injiziert). Beide Pfade
-// nutzen dieselbe Tag-Form damit `createKumikoApp` den Lookup nicht je
-// nach Kontext anders machen muss.
-//
-// Idempotenz: wenn das HTML schon einen __KUMIKO_SCHEMA__-Marker hat,
-// wird nicht doppelt injected — verhindert dass repeated index.html-
-// Reads (prod) oder bereits-vorbereitete templates (custom CI-builds)
-// stacking-Tags produzieren.
-
-// `<` als < serialisieren: verhindert `</script>`-Breakout aus dem
-// RAWTEXT-Block, JSON bleibt valides JS.
-function scriptSafeJsonHtml(json: string): string {
-  return json.replace(/</g, "\\u003c");
-}
-
-export function injectSchema(html: string, schemaJson: string): string {
-  if (html.includes("__KUMIKO_SCHEMA__")) return html;
-  const tag = `<script>window.__KUMIKO_SCHEMA__=${scriptSafeJsonHtml(schemaJson)};</script>`;
-  if (html.includes('<script src="/client.js"')) {
-    return html.replace('<script src="/client.js"', `${tag}<script src="/client.js"`);
-  }
-  return html.includes("</body>") ? html.replace("</body>", `${tag}</body>`) : html + tag;
-}

package/src/pii-boot-gate.ts

@@ -1,62 +0,0 @@
-import {
-  collectLookupableFields,
-  collectPiiSubjectFields,
-  type KmsAdapter,
-} from "@cosmicdrift/kumiko-framework/crypto";
-import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-
-type PiiGateOptions = {
-  readonly kms?: KmsAdapter | undefined;
-  readonly blindIndexKey?: string | undefined;
-  readonly allowPlaintextPii?: string | undefined;
-  /** prod fails hard on plaintext PII (opt-out via allowPlaintextPii);
-   *  dev only warns — local data, and an InMemory KMS against a persistent
-   *  dev DB would strand every row after a restart. */
-  readonly mode: "prod" | "dev";
-};
-
-export function assertPiiBootInvariants(
-  features: readonly FeatureDefinition[],
-  opts: PiiGateOptions,
-): void {
-  const tag = opts.mode === "prod" ? "runProdApp" : "runDevApp";
-
-  const lookupableEntities = features.flatMap((feature) =>
-    Object.entries(feature.entities ?? {})
-      .filter(([, entity]) => collectLookupableFields(entity).length > 0)
-      .map(([name]) => name),
-  );
-  if (opts.kms && !opts.blindIndexKey && lookupableEntities.length > 0) {
-    throw new Error(
-      `[${tag}] BOOT ABORTED — entities [${lookupableEntities.join(", ")}] declare lookupable fields and a KMS is configured, but no blindIndexKey was passed. Equality lookups on encrypted fields would silently stop matching. Pass { blindIndexKey } (env: KUMIKO_BLIND_INDEX_KEY, generate: openssl rand -base64 32).`,
-    );
-  }
-
-  // skip: KMS configured — PII fields are encrypted, nothing left to gate.
-  if (opts.kms) return;
-  const piiEntities = features.flatMap((feature) =>
-    Object.entries(feature.entities ?? {})
-      .filter(([, entity]) => collectPiiSubjectFields(entity).length > 0)
-      .map(([name]) => name),
-  );
-  // skip: no PII-annotated entities mounted — plaintext gate is moot.
-  if (piiEntities.length === 0) return;
-
-  if (opts.mode === "dev") {
-    // biome-ignore lint/suspicious/noConsole: boot-time security warning
-    console.warn(
-      `[${tag}] ${piiEntities.length} entities carry pii/userOwned/tenantOwned annotations but no \`kms\` adapter is configured — fields are stored in PLAINTEXT locally. Pass { kms: new InMemoryKmsAdapter() } (ephemeral DB) or createPgKmsAdapter(...) to exercise crypto-shredding in dev.`,
-    );
-    return;
-  }
-  if (opts.allowPlaintextPii) {
-    // biome-ignore lint/suspicious/noConsole: boot-time security warning
-    console.warn(
-      `[${tag}] ${piiEntities.length} entities carry PII annotations but no \`kms\` adapter is configured — fields are stored in PLAINTEXT (allowPlaintextPii: "${opts.allowPlaintextPii}"). GDPR erasure via crypto-shredding is NOT possible until a KMS is provisioned.`,
-    );
-    return;
-  }
-  throw new Error(
-    `[${tag}] BOOT ABORTED — entities [${piiEntities.join(", ")}] carry pii/userOwned/tenantOwned annotations but no \`kms\` adapter is configured. The fields would be stored in PLAINTEXT and GDPR erasure (crypto-shredding) could not work. Pass runProdApp({ kms: createPgKmsAdapter({ databaseUrl, platformKek }) }) — or acknowledge explicitly with { allowPlaintextPii: "<reason>" } until your KMS is provisioned.`,
-  );
-}

package/src/resolve-tailwind-cli.ts

@@ -1,45 +0,0 @@
-// Resolved den lokal installierten @tailwindcss/cli-Bin auf seinen
-// absoluten Dateipfad. Wir vermeiden `bunx`, weil das auch bei lokal
-// installiertem Package noch das Registry-Manifest fragt und ohne Netz
-// mit `FailedToOpenSocket` stirbt.
-//
-// Ausgelagert aus create-kumiko-server.ts, damit unter vitest/Node
-// testbar (Bun-Branch + Resolve-Fail-Branch) ohne den Server zu
-// booten.
-
-import { dirname, resolve } from "node:path";
-
-type BunResolver = { resolveSync: (id: string, from: string) => string };
-
-export type ResolveTailwindCliDeps = {
-  readonly bun?: BunResolver;
-  readonly cwd: string;
-};
-
-export function resolveTailwindCli(deps: ResolveTailwindCliDeps): string | undefined {
-  if (deps.bun === undefined) return undefined;
-  try {
-    const pkgJsonPath = deps.bun.resolveSync("@tailwindcss/cli/package.json", deps.cwd);
-    // bin: { tailwindcss: "./dist/index.mjs" } → absoluter Pfad
-    return resolve(pkgJsonPath, "..", "dist", "index.mjs");
-  } catch {
-    return undefined;
-  }
-}
-
-/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
- *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
- *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer-web` outside a hoisted node_modules tree. */
-export function canResolveTailwindStylesheet(
-  entryCss: string,
-  deps: ResolveTailwindCliDeps,
-): boolean {
-  if (deps.bun === undefined) return false;
-  try {
-    deps.bun.resolveSync("tailwindcss", dirname(entryCss));
-    return true;
-  } catch {
-    return false;
-  }
-}

package/src/run-prod-app-boot-context.ts

@@ -1,241 +0,0 @@
-import { makeAuthPaths } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import { bindMfaRevokeAllOtherSessionsFromFeature } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
-import { createSmtpTransportFromEnv } from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import {
-  buildEnvConfigOverrides,
-  createConfigAccessorFactory,
-  createConfigResolver,
-} from "@cosmicdrift/kumiko-bundled-features/config";
-import {
-  collectChannels,
-  createDeliveryService,
-  DELIVERY_FEATURE,
-} from "@cosmicdrift/kumiko-bundled-features/delivery";
-import {
-  createSecretsContext,
-  SECRETS_FEATURE_NAME,
-} from "@cosmicdrift/kumiko-bundled-features/secrets";
-import {
-  bindAutoRevokeFromFeature,
-  createSessionCallbacks,
-} from "@cosmicdrift/kumiko-bundled-features/sessions";
-import { createTextContentApi } from "@cosmicdrift/kumiko-bundled-features/text-content";
-import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
-import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type {
-  ConfigResolver,
-  FeatureDefinition,
-  NotifyFactory,
-  Registry,
-} from "@cosmicdrift/kumiko-framework/engine";
-import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
-import { type BootCrypto, resolveBootCrypto } from "./boot/boot-crypto";
-import type {
-  AuthMailOptions,
-  EmailVerificationSetup,
-  InviteSetup,
-  PasswordResetSetup,
-  SignupSetup,
-} from "./run-prod-app";
-import type { ProdSessionsConfig } from "./session-wiring";
-
-// Boot-time context helpers for runProdApp: ctx-extra-context wiring
-// (textContent/delivery/secrets/config-resolver), auth-mail convenience
-// normalization, and prod session-auth wiring. Split out of run-prod-app.ts
-// (#1005, Welle 2) — mechanical relocation, these are self-contained pure
-// functions, no closure over runProdApp's local boot state.
-
-// Shared with runDevApp (mergeConfigResolverDefault) for dev/prod parity.
-export function addConfigAccessorFactory<T extends { readonly configResolver?: ConfigResolver }>(
-  resolved: T,
-  registry: Registry,
-): T {
-  if (!resolved.configResolver) return resolved;
-  return {
-    ...resolved,
-    _configAccessorFactory: createConfigAccessorFactory(registry, resolved.configResolver),
-  };
-}
-
-// Framework-Default-Provider für den AppContext — gleicher Mechanismus wie
-// der tenantTierResolver-Autowire (findTierResolverUsage): deklarierter
-// Bedarf (Feature gemountet) → Default aus db/env, App überschreibt nur die
-// Ausnahme. textContent ist unbedingt (createTextContentApi wirft nie, baut
-// nur einen db-gebundenen Accessor). secrets wird nur auto-verdrahtet wenn
-// das secrets-Feature gemountet ist UND ein KEK tatsächlich verfügbar ist
-// (masterKey-Override ODER env-KEK present) — sonst skip, damit der eager
-// KEK-Detection + Provider/Cipher-Aufbau leben in boot/boot-crypto.ts
-// (envHasMasterKek, resolveBootCrypto) — gemeinsam mit runDevApp.
-// Prod-Misconfig (secrets gemountet, kein KEK) fängt schon secretsEnvSchema
-// beim Boot; fehlt der env-Schema-Pfad, wirft requireSecretsContext beim
-// ersten ctx.secrets-Zugriff mit Wiring-Hinweis. configResolver nur im
-// Auth-Mode. Exportiert + pure für Unit-Tests; der merge mit App-Werten
-// passiert beim Caller (App gewinnt).
-
-// Prod/dev parity for ctx.notify: without this `_notifyFactory` is only wired
-// in tests (createDeliveryTestContext), so ctx.notify is undefined at runtime
-// and every notification silently skips. sseBroker optional (email/push don't
-// need it, in-app SSE does); no jobRunner → queued channels send inline.
-function buildDeliveryNotifyFactory(opts: {
-  readonly db: DbConnection;
-  readonly registry: Registry;
-  readonly sseBroker?: SseBroker;
-}): NotifyFactory {
-  const deliveryService = createDeliveryService({
-    db: opts.db,
-    registry: opts.registry,
-    channels: collectChannels(opts.registry),
-    ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
-  });
-  return (user, tenantId) => (notificationType, options) =>
-    deliveryService.notify(notificationType, options, user, tenantId);
-}
-
-export function buildBootExtraContext(opts: {
-  readonly db: DbConnection;
-  readonly features: readonly FeatureDefinition[];
-  readonly envSource: Record<string, string | undefined>;
-  readonly registry: Registry;
-  readonly hasAuth: boolean;
-  // Resolved once per boot via resolveBootCrypto — shared by secrets,
-  // config-resolver, config-set-handler and boot-seeds. Absent (tests
-  // that don't care about encryption) ⇒ resolved from envSource here.
-  readonly crypto?: BootCrypto;
-  readonly masterKey?: MasterKeyProvider;
-  readonly sseBroker?: SseBroker;
-  readonly kms?: KmsAdapter;
-}): Record<string, unknown> {
-  const crypto = opts.crypto ?? resolveBootCrypto(opts.envSource, opts.masterKey);
-  const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
-  const wireSecrets = hasSecretsFeature && crypto.masterKeyProvider !== undefined;
-  const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
-  return {
-    textContent: createTextContentApi(opts.db),
-    ...(opts.kms && { kms: opts.kms }),
-    ...(hasDeliveryFeature && {
-      _notifyFactory: buildDeliveryNotifyFactory({
-        db: opts.db,
-        registry: opts.registry,
-        ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
-      }),
-    }),
-    // Top-level provider so feature jobs (secrets rotate, config reencrypt)
-    // reach it via ctx — previously only test-stack wired it.
-    ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
-    // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
-    // whenever a master key exists — NOT gated on the secrets feature,
-    // config encryption must work without mounting ctx.secrets.
-    ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
-    ...(wireSecrets &&
-      crypto.masterKeyProvider && {
-        secrets: createSecretsContext({
-          db: opts.db,
-          masterKeyProvider: crypto.masterKeyProvider,
-          dekCache: crypto.dekCache,
-        }),
-      }),
-    ...(opts.hasAuth && {
-      configResolver: createConfigResolver({
-        appOverrides: buildEnvConfigOverrides(opts.registry, opts.envSource),
-        ...(crypto.configCipher && { cipher: crypto.configCipher }),
-      }),
-    }),
-  };
-}
-
-// auth.mail-Convenience → normalisiert in die expliziten passwordReset/
-// emailVerification/signup/invite-Felder, BEVOR buildComposeAuthOptions
-// (Feature-Side: hmacSecret/mode) und das auth-routes-Fragment sie lesen —
-// so speist EIN mail-Block beide Pfade. App-explizite Flows gewinnen über
-// den Default. Null-Transport-Guard: ohne SMTP_HOST-env bleibt alles
-// unverdrahtet (sonst lieferten die reset/verify-Routes 500).
-/** Die Auth-Felder die resolveAuthMail liest/normalisiert — beide
- *  App-Auth-Typen (prod + dev) erfüllen das strukturell. */
-type AuthMailNormalizable = {
-  readonly mail?: AuthMailOptions;
-  readonly passwordReset?: PasswordResetSetup;
-  readonly emailVerification?: EmailVerificationSetup;
-  readonly signup?: SignupSetup;
-  readonly invite?: InviteSetup;
-};
-
-export function resolveAuthMail<T extends AuthMailNormalizable>(
-  auth: T,
-  hmacSecret: string,
-  envSource: Record<string, string | undefined>,
-): T {
-  if (!auth.mail) return auth;
-  // SMTP-presence gate: ohne SMTP_HOST-env wird KEIN Flow verdrahtet (Routes
-  // blieben sonst 500). Der eigentliche Mail-Versand läuft über delivery
-  // (channel-email), nicht über diesen Transport — er ist nur der Detektor
-  // "ist Mail konfiguriert?".
-  if (
-    !createSmtpTransportFromEnv(envSource, { fallbackFrom: auth.mail.from ?? "noreply@localhost" })
-  ) {
-    return auth;
-  }
-  const paths = makeAuthPaths(auth.mail.paths);
-  // appName/locale fließen in alle vier Flow-Options (alle mailen via delivery).
-  const mailPresentation = {
-    ...(auth.mail.appName !== undefined && { appName: auth.mail.appName }),
-    ...(auth.mail.locale !== undefined && { locale: auth.mail.locale }),
-  };
-  return {
-    ...auth,
-    passwordReset: auth.passwordReset ?? {
-      hmacSecret,
-      appUrl: `${auth.mail.baseUrl}${paths.resetPassword}`,
-      ...mailPresentation,
-    },
-    emailVerification: auth.emailVerification ?? {
-      hmacSecret,
-      appUrl: `${auth.mail.baseUrl}${paths.verifyEmail}`,
-      ...(auth.mail.emailVerificationMode !== undefined && {
-        mode: auth.mail.emailVerificationMode,
-      }),
-      ...mailPresentation,
-    },
-    signup: auth.signup ?? {
-      appUrl: `${auth.mail.baseUrl}${paths.signupComplete}`,
-      ...mailPresentation,
-    },
-    invite: auth.invite ?? {
-      appUrl: `${auth.mail.baseUrl}${paths.inviteAccept}`,
-      ...mailPresentation,
-    },
-  };
-}
-
-export function buildProdSessionAuth(
-  db: DbConnection,
-  opts: ProdSessionsConfig,
-  sessionsFeature: FeatureDefinition | undefined,
-  mfaFeature: FeatureDefinition | undefined,
-): {
-  readonly sessionCreator: ReturnType<typeof createSessionCallbacks>["sessionCreator"];
-  readonly sessionRevoker: ReturnType<typeof createSessionCallbacks>["sessionRevoker"];
-  readonly sessionChecker: ReturnType<typeof createSessionCallbacks>["sessionChecker"];
-  readonly sessionStrictMode: true;
-} {
-  const cbs = createSessionCallbacks({
-    db,
-    ...(opts.expiresInMs !== undefined && { expiresInMs: opts.expiresInMs }),
-  });
-  // Secure-by-default: password-change/-reset mass-revokes the user's live
-  // sessions without the app opting in via autoRevokeOnPasswordChange.
-  if (sessionsFeature) {
-    bindAutoRevokeFromFeature(sessionsFeature)?.(cbs.sessionMassRevoker);
-  }
-  // MFA enable/disable/regenerate mass-revokes every OTHER live session
-  // (stolen-session defense) — only wired when auth-mfa is mounted.
-  if (mfaFeature) {
-    bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(cbs.sessionRevokeAllOthers);
-  }
-  return {
-    sessionCreator: cbs.sessionCreator,
-    sessionRevoker: cbs.sessionRevoker,
-    sessionChecker: cbs.sessionChecker,
-    sessionStrictMode: true,
-  };
-}