@cosmicdrift/kumiko-dev-server 0.159.1 → 0.161.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.159.1",
+  "version": "0.161.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Not shipped into production node_modules — see @cosmicdrift/kumiko-server-runtime for the prod boot path.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -54,9 +54,9 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.159.1",
-    "@cosmicdrift/kumiko-framework": "0.159.1",
-    "@cosmicdrift/kumiko-server-runtime": "0.159.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.161.0",
+    "@cosmicdrift/kumiko-framework": "0.161.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.161.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/compose-stacks.test.ts

@@ -1,5 +1,4 @@
 import { describe, expect, test } from "bun:test";
-import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { createPersonalAccessTokensFeature } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
@@ -56,6 +55,7 @@ describe("composeStacks", () => {
       "data-retention",
       "compliance-profiles",
       "tenant-lifecycle",
+      "auth-foundation",
       "sessions",
     ]);
   });
@@ -87,12 +87,13 @@ describe("composeStacks", () => {
     ]);
   });
 
-  test("composeIdentityStack defaults sessions only", () => {
-    expect(stackFeatureNames(composeIdentityStack())).toEqual(["sessions"]);
+  test("composeIdentityStack defaults auth-foundation + sessions", () => {
+    expect(stackFeatureNames(composeIdentityStack())).toEqual(["auth-foundation", "sessions"]);
   });
 
   test("composeIdentityStack mounts auth-mfa when mfa options given", () => {
     expect(stackFeatureNames(composeIdentityStack({ mfa: TEST_MFA }))).toEqual([
+      "auth-foundation",
       "sessions",
       "auth-mfa",
     ]);
@@ -114,7 +115,6 @@ describe("composeStacks", () => {
       validateBoot(
         composeFeatures(
           [
-            authFoundationFeature,
             createPersonalAccessTokensFeature({ scopes: {} }),
             ...composeIdentityStack(),
             ...composeGdprStack({ sessions: true }),
@@ -131,7 +131,6 @@ describe("composeStacks boots for real", () => {
   test("studio-shaped combined stack passes validateBoot (not just name-list comparison)", () => {
     const features = composeFeatures(
       [
-        authFoundationFeature,
         createPersonalAccessTokensFeature({ scopes: {} }),
         ...composeOpsStack({ rateLimiting: true }),
         ...composePagesStack(),

package/src/__tests__/create-kumiko-server-errors.test.ts

@@ -0,0 +1,63 @@
+// createKumikoServer error / graceful-degradation paths — boot rejects,
+// stylesheet pipeline failures, missing CSS route.
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createKumikoServer, type KumikoServerHandle } from "../create-kumiko-server";
+
+const emptyFeature = defineFeature("dev-server-errors-probe", () => {});
+
+let handle: KumikoServerHandle | undefined;
+
+afterEach(async () => {
+  if (handle) {
+    await handle.stop();
+    handle = undefined;
+  }
+});
+
+describe("createKumikoServer — client bundle failure", () => {
+  test("broken clientEntry rejects at boot with client bundle failed", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-bundle-fail-"));
+    const entry = join(tmpDir, "client.tsx");
+    writeFileSync(entry, "const x = {{{\n");
+    try {
+      await expect(
+        createKumikoServer({
+          features: [emptyFeature],
+          port: 0,
+          installSignalHandlers: false,
+          clientEntry: entry,
+          stylesheet: false,
+        }),
+      ).rejects.toThrow(/client bundle failed|Bundle failed/);
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  test("_buildBundle throw propagates at boot", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-stub-fail-"));
+    const entry = join(tmpDir, "client.tsx");
+    writeFileSync(entry, "// noop\n");
+    try {
+      await expect(
+        createKumikoServer({
+          features: [emptyFeature],
+          port: 0,
+          installSignalHandlers: false,
+          clientEntry: entry,
+          stylesheet: false,
+          _buildBundle: async () => {
+            throw new Error("stub build blew up");
+          },
+        }),
+      ).rejects.toThrow(/stub build blew up/);
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/__tests__/create-kumiko-server.integration.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -336,3 +336,123 @@ describe("createKumikoServer extraRoutes-deps", () => {
     expect(body.data?.roles).toContain("SystemAdmin");
   });
 });
+
+describe("createKumikoServer — stylesheet tailwind failure (graceful)", () => {
+  test("missing stylesheet entry boots without CSS — GET /styles.css → 404", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-css-fail-"));
+    const entry = join(tmpDir, "client.tsx");
+    writeFileSync(entry, "export const x = 1;\n");
+    try {
+      handle = await createKumikoServer({
+        features: [probeFeature],
+        port: 0,
+        installSignalHandlers: false,
+        clientEntry: entry,
+        stylesheet: join(tmpDir, "does-not-exist.css"),
+        _buildBundle: async () => ({ js: "// stub", map: "" }),
+      });
+      const cssRes = await handle.fetch(new Request("http://localhost/styles.css"));
+      expect(cssRes.status).toBe(404);
+      expect(await cssRes.text()).toBe("no stylesheet");
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("createKumikoServer — real Bun.build (buildClient)", () => {
+  test("clientEntry without _buildBundle produces a JS bundle via Bun.build", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-real-build-"));
+    const entry = join(tmpDir, "client.tsx");
+    // Minimal entry Bun.build can emit — no JSX, no imports.
+    writeFileSync(entry, "export const ping = 1;\n");
+    // Empty dirs matching a glob — exercises expandWatchPatterns without
+    // writing files (avoids process.exit(75) from bare .tsx events).
+    mkdirSync(join(tmpDir, "pkg-a"));
+    mkdirSync(join(tmpDir, "pkg-b"));
+    try {
+      handle = await createKumikoServer({
+        features: [probeFeature],
+        port: 0,
+        installSignalHandlers: false,
+        clientEntry: entry,
+        stylesheet: false,
+        watchDirs: [join(tmpDir, "pkg-*")],
+      });
+      const res = await handle.fetch(new Request("http://localhost/client.js"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toMatch(/application\/javascript/);
+      const body = await res.text();
+      expect(body.length).toBeGreaterThan(0);
+      expect(body).toMatch(/ping/);
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("createKumikoServer — hot-reload broadcast", () => {
+  test("file change under web/ rebuilds and broadcasts SSE reload", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-watch-"));
+    const entry = join(tmpDir, "client.tsx");
+    const webDir = join(tmpDir, "web");
+    mkdirSync(webDir);
+    writeFileSync(entry, "export const ping = 1;\n");
+
+    let builds = 0;
+    try {
+      handle = await createKumikoServer({
+        features: [probeFeature],
+        port: 0,
+        installSignalHandlers: false,
+        clientEntry: entry,
+        stylesheet: false,
+        // Only the entry dir is watched (no extra watchDirs) — a nested
+        // web/page.tsx event arrives as "web/page.tsx" → hot-reload.
+        // Watching web/ separately would fire bare "page.tsx" → restart
+        // → process.exit(75) and kill the test runner.
+        _buildBundle: async () => {
+          builds += 1;
+          return { js: `// build-${builds}`, map: "" };
+        },
+      });
+
+      const sseRes = await handle.fetch(new Request("http://localhost/_reload"));
+      expect(sseRes.status).toBe(200);
+      const reader = sseRes.body?.getReader();
+      expect(reader).toBeDefined();
+      if (!reader) return;
+
+      await reader.read(); // drain connected comment
+
+      const initialBuilds = builds;
+      writeFileSync(join(webDir, "page.tsx"), "export const x = 1;\n");
+
+      const deadline = Date.now() + 3000;
+      let sawReload = false;
+      while (Date.now() < deadline && !sawReload) {
+        const readPromise = reader.read();
+        const timeout = new Promise<{ done: true; value: undefined }>((resolve) =>
+          setTimeout(() => resolve({ done: true, value: undefined }), 200),
+        );
+        const { value, done } = await Promise.race([readPromise, timeout]);
+        if (done || value === undefined) continue;
+        const chunk = new TextDecoder().decode(value);
+        if (chunk.includes("event: reload")) sawReload = true;
+      }
+      await reader.cancel();
+
+      expect(builds).toBeGreaterThan(initialBuilds);
+      expect(sawReload).toBe(true);
+
+      const js = await handle.fetch(new Request("http://localhost/client.js"));
+      expect(await js.text()).toMatch(/build-/);
+
+      // Abort watchers before teardown rmSync can fire a restart event.
+      await handle.stop();
+      handle = undefined;
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/__tests__/resolve-stylesheet.test.ts

@@ -64,6 +64,22 @@ describe("resolveStylesheet", () => {
     }
   });
 
+  test("Bun.resolveSync failure → undefined (catch path, no throw)", () => {
+    const tmpDir = realpathSync(mkdtempSync(join(tmpdir(), "kumiko-resolve-catch-")));
+    const cwdBefore = process.cwd();
+    process.chdir(tmpDir);
+    try {
+      const out = resolveStylesheet({
+        features: [],
+        clientEntry: "./entry.tsx",
+      });
+      expect(out).toBeUndefined();
+    } finally {
+      process.chdir(cwdBefore);
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
   test("undefined + clientEntry + src/styles.css existiert → returns App-Theme-Override", () => {
     // Auto-Detection greift VOR dem renderer-web-Fallback: Wenn die App
     // ein eigenes src/styles.css hat (App-Theme-Pattern), wird das

package/src/__tests__/saas-identity-wire.integration.test.ts

@@ -12,7 +12,6 @@ import {
   seedAdmin,
   seedUserWithPassword,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
-import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import {
   AuthMfaHandlers,
   base32Decode,
@@ -118,7 +117,6 @@ beforeAll(async () => {
 
   const features = composeFeatures(
     [
-      authFoundationFeature,
       ...identity,
       ...composeOpsStack({ delivery: true, audit: false, jobs: false }),
       ...composeRendererStack(),

package/src/compose-stacks.ts

@@ -3,6 +3,7 @@
 // or tier maps (those stay in bin/server.ts / app run-config).
 
 import { createAuditFeature } from "@cosmicdrift/kumiko-bundled-features/audit";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import {
   type AuthMfaFeatureOptions,
   createAuthMfaFeature,
@@ -76,10 +77,17 @@ export type OpsStackOptions = {
 };
 
 /** sessions (+ optional auth-mfa). config/user/tenant/auth-email-password stay
- *  on composeFeatures(includeBundled). Pass `mfa` options to mount TOTP. */
+ *  on composeFeatures(includeBundled). Pass `mfa` options to mount TOTP.
+ *  When `sessions` is on (the default), auth-foundation is mounted alongside it —
+ *  the framework's registry now hard-requires it (sessions.requires("auth-foundation")).
+ *  Pass `providers` for the tokenVerifier(s) auth-foundation itself requires at least
+ *  one of (e.g. createPersonalAccessTokensFeature({ scopes })) — PAT scopes are
+ *  app-specific (which write-handlers an API token may call), so they stay caller-owned
+ *  instead of a framework default. */
 export type IdentityStackOptions = {
   readonly sessions?: boolean;
   readonly mfa?: AuthMfaFeatureOptions;
+  readonly providers?: readonly FeatureDefinition[];
 };
 
 export function stackFeatureNames(features: readonly FeatureDefinition[]): string[] {
@@ -131,7 +139,7 @@ export function composeGdprStack(options: GdprStackOptions = {}): FeatureDefinit
   const out: FeatureDefinition[] =
     order === "compliance-first" ? [compliance, retention] : [retention, compliance];
   if (options.tenantLifecycle) out.push(createTenantLifecycleFeature());
-  if (options.sessions) out.push(createSessionsFeature());
+  if (options.sessions) out.push(authFoundationFeature, createSessionsFeature());
   return out;
 }
 
@@ -162,7 +170,10 @@ export function composeOpsStack(options: OpsStackOptions = {}): FeatureDefinitio
 export function composeIdentityStack(options: IdentityStackOptions = {}): FeatureDefinition[] {
   const sessions = options.sessions ?? true;
   const out: FeatureDefinition[] = [];
-  if (sessions) out.push(createSessionsFeature());
+  if (sessions) {
+    out.push(authFoundationFeature, createSessionsFeature());
+    if (options.providers) out.push(...options.providers);
+  }
   if (options.mfa !== undefined) out.push(createAuthMfaFeature(options.mfa));
   return out;
 }

package/src/create-kumiko-server.ts

@@ -19,6 +19,7 @@ import { existsSync, mkdtempSync, statSync } from "node:fs";
 import { readFile, watch } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { type AuthRoutesConfig, generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { buildAppSchema, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -673,6 +674,7 @@ export async function createKumikoServer(
     ...(options.auth !== undefined && { authConfig: options.auth }),
     ...(options.extraContext !== undefined && { extraContext: options.extraContext }),
     ...(options.anonymousAccess !== undefined && { anonymousAccess: options.anonymousAccess }),
+    enrichAnonymousAccess: (base, deps) => resolveAnonymousAccessFromRegistry(base, deps),
     ...(options.files !== undefined && { files: options.files }),
     ...(options.effectiveFeatures !== undefined && {
       effectiveFeatures: options.effectiveFeatures,

package/src/run-dev-app.ts

@@ -18,7 +18,12 @@ import {
   type SeedAdminOptions,
   seedAdmin,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
-import { resolveTokenVerifier } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import {
+  EXT_SESSION_STORE,
+  resolveSessionStore,
+  resolveTokenVerifier,
+  type SessionStore,
+} from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import {
   AUTH_MFA_FEATURE,
   AuthMfaHandlers,
@@ -34,9 +39,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import {
   bindAutoRevokeFromFeature,
-  createSessionCallbacks,
   SESSIONS_FEATURE,
-  type SessionCallbacks,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import {
@@ -118,17 +121,6 @@ export type RunDevAppAuthOptions = {
   /** Optional override of the login error → HTTP status map. Default
    *  maps invalidCredentials → 401, noMembership → 403. */
   readonly loginErrorStatusMap?: Readonly<Record<string, number>>;
-  /** Opt-in: revocable server-side sessions. Caller MUSS
-   *  `createSessionsFeature()` zu `features` adden — runDevApp wired
-   *  hier nur die Auth-Callbacks (creator/revoker/checker) gegen
-   *  stack.db (sidless JWTs werden dann abgelehnt).
-   *
-   *  Standardverhalten ohne diese Option: stateless JWTs ohne sid,
-   *  Logout ist client-side cookie-clear, Karten­haus existing-Apps
-   *  bleibt unangefasst. */
-  readonly sessions?: {
-    readonly expiresInMs?: number;
-  };
   /** Auth-Mail-Convenience — symmetrisch zu RunProdAppAuthOptions.mail.
    *  Verdrahtet alle 4 Mail-Flows aus env-SMTP + Standard-Templates;
    *  hmacSecret = `JWT_SECRET`-env (Dev-Fallback wenn ungesetzt). Ohne
@@ -395,19 +387,15 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     return { ...boot, ...base };
   };
 
-  // Sessions opt-in: Holder lebt im closure, `createSessionCallbacks`
-  // kennt erst nach setupTestStack die echte db-connection. Inline
-  // statt @cosmicdrift/kumiko-framework/testing's createLateBoundHolder zu reusen,
-  // weil dev-server (dev-runtime) keine Tooling aus framework/testing
-  // (test-runtime) importieren darf — Runtime-Isolation Guard.
-  // Server-Start passiert NACH onAfterSetup (siehe create-kumiko-server.ts),
-  // daher ist `sessionCallbacks` zur ersten Login-Request konkret.
-  let sessionCallbacks: SessionCallbacks | undefined;
-  const requireSessions = (): SessionCallbacks => {
-    if (!sessionCallbacks) {
-      throw new Error("[runDevApp] session-callbacks accessed before onAfterSetup");
+  // Sessions: late-bound holder — resolveSessionStore needs concrete db+
+  // registry (only after setupTestStack). Wired when sessions feature is
+  // mounted (#1372); no auth.sessions opt-in anymore.
+  let sessionStore: SessionStore | undefined;
+  const requireSessionStore = (): SessionStore => {
+    if (!sessionStore) {
+      throw new Error("[runDevApp] sessionStore accessed before onAfterSetup");
     }
-    return sessionCallbacks;
+    return sessionStore;
   };
   // Token-verifier opt-in: same late-bound holder pattern — resolveTokenVerifier
   // needs the real db+registry (only concrete after setupTestStack). Wired
@@ -444,14 +432,19 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       }
     : {};
 
+  // Parity with runProdApp (#1372 review): gate on sessionStore provider, not
+  // the sessions feature name — a custom provider must also wire auth callbacks.
+  const sessionStoreProviderMounted = features.some((f) =>
+    f.extensionUsages.some((u) => u.extensionName === EXT_SESSION_STORE),
+  );
   const sessionAuthFragment =
-    effectiveAuth?.sessions !== undefined
+    effectiveAuth && sessionStoreProviderMounted
       ? {
           sessionCreator: (user: SessionUser, meta: SessionMetadata) =>
-            requireSessions().sessionCreator(user, meta),
-          sessionRevoker: (sid: string) => requireSessions().sessionRevoker(sid),
+            requireSessionStore().creator(user, meta),
+          sessionRevoker: (sid: string) => requireSessionStore().revoker(sid),
           sessionChecker: (sid: string, userId: string) =>
-            requireSessions().sessionChecker(sid, userId),
+            requireSessionStore().checker(sid, userId),
         }
       : {};
 
@@ -540,26 +533,21 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
           registry: stack.registry,
         });
       }
-      if (effectiveAuth?.sessions !== undefined) {
-        const expiresInMs = effectiveAuth.sessions.expiresInMs;
-        sessionCallbacks = createSessionCallbacks({
+      if (effectiveAuth && stack.registry.getExtensionUsages(EXT_SESSION_STORE).length > 0) {
+        // Secure-by-default (#1372): resolve sessionStore provider; bind
+        // password-change mass-revoke + MFA revokeAllOthers.
+        const store = await resolveSessionStore({
           db: stack.db,
-          ...(expiresInMs !== undefined && { expiresInMs }),
+          registry: stack.registry,
         });
-        // Secure-by-default (symmetrisch zu runProdApp): Password-Change/
-        // -Reset mass-revoked die Sessions des Users ohne App-Opt-in.
         const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
         if (sessionsFeature) {
-          bindAutoRevokeFromFeature(sessionsFeature)?.(sessionCallbacks.sessionMassRevoker);
+          bindAutoRevokeFromFeature(sessionsFeature)?.(store.massRevoker);
         }
-        // MFA enable/disable/regenerate mass-revokes every OTHER live
-        // session (stolen-session defense) — only wired when auth-mfa is
-        // mounted.
         if (mfaFeature) {
-          bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(
-            sessionCallbacks.sessionRevokeAllOthers,
-          );
+          bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(store.revokeAllOthers);
         }
+        sessionStore = store;
       }
       if (patFeature) {
         tokenVerifier = (rawToken) =>

package/src/scaffold-app.ts

@@ -42,6 +42,8 @@ export type ScaffoldFeatureEntry = {
   readonly importPath: string;
   readonly exportName: string;
   readonly callExpression: string;
+  /** Runtime args for factory-style exports that need config the codegen text can't parse back out (e.g. `{ scopes: {} }`). Omit for zero-arg factories and object-style exports. */
+  readonly callArgs?: readonly unknown[];
 };
 
 export type ScaffoldAppOptions = {
@@ -850,11 +852,8 @@ async function instantiateScaffoldFeatures(
         `scaffoldApp: ${entry.importPath} missing export ${entry.exportName} for ${entry.callExpression}`,
       );
     }
-    if (entry.callExpression.endsWith("()")) {
-      if (typeof exp !== "function") {
-        throw new Error(`scaffoldApp: ${entry.exportName} is not callable (${entry.importPath})`);
-      }
-      instances.push((exp as () => FeatureDefinition)());
+    if (typeof exp === "function") {
+      instances.push((exp as (...args: unknown[]) => FeatureDefinition)(...(entry.callArgs ?? [])));
     } else {
       instances.push(exp as FeatureDefinition);
     }