@cosmicdrift/kumiko-dev-server 0.163.3 → 0.165.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.163.3",
+  "version": "0.165.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Not shipped into production node_modules — see @cosmicdrift/kumiko-server-runtime for the prod boot path.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -54,9 +54,9 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.163.3",
-    "@cosmicdrift/kumiko-framework": "0.163.3",
-    "@cosmicdrift/kumiko-server-runtime": "0.163.3",
+    "@cosmicdrift/kumiko-bundled-features": "0.165.0",
+    "@cosmicdrift/kumiko-framework": "0.165.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.165.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/compose-stacks.test.ts

@@ -144,6 +144,31 @@ describe("composeStacks boots for real", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("money-horse-shaped composeGdprStack({sessions:true}) without a tokenVerifier provider fails boot", () => {
+    // Regression pin for the open design question this stack shape raised:
+    // composeGdprStack({sessions:true}) mounts auth-foundation, which
+    // hard-requires at least one tokenVerifier provider. Without composing
+    // one in (money-horse/solon's real run-config passes none), boot must
+    // fail loudly instead of silently shipping an unauthenticatable app.
+    const features = composeFeatures([...composeGdprStack({ sessions: true })], {
+      includeBundled: true,
+    });
+    expect(() => validateBoot(features)).toThrow(/no tokenVerifier providers registered/i);
+  });
+
+  test("composeGdprStack({sessions:true, providers:[...]}) passes boot with a tokenVerifier mounted", () => {
+    const features = composeFeatures(
+      [
+        ...composeGdprStack({
+          sessions: true,
+          providers: [createPersonalAccessTokensFeature({ scopes: {} })],
+        }),
+      ],
+      { includeBundled: true },
+    );
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
   // auth-mfa's encrypted fields need a runtime KEK (env or configureEntityFieldEncryption
   // + secrets). Name-list + saas-identity-wire.integration.test.ts cover identity boot.
   test("identity stack names compose with ops + renderer under includeBundled", () => {

package/src/__tests__/create-kumiko-server-errors.test.ts

@@ -1,24 +1,15 @@
 // createKumikoServer error / graceful-degradation paths — boot rejects,
 // stylesheet pipeline failures, missing CSS route.
 
-import { afterEach, describe, expect, test } from "bun:test";
+import { describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { createKumikoServer, type KumikoServerHandle } from "../create-kumiko-server";
+import { createKumikoServer } from "../create-kumiko-server";
 
 const emptyFeature = defineFeature("dev-server-errors-probe", () => {});
 
-let handle: KumikoServerHandle | undefined;
-
-afterEach(async () => {
-  if (handle) {
-    await handle.stop();
-    handle = undefined;
-  }
-});
-
 describe("createKumikoServer — client bundle failure", () => {
   test("broken clientEntry rejects at boot with client bundle failed", async () => {
     const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-bundle-fail-"));

package/src/compose-stacks.ts

@@ -59,6 +59,11 @@ export type GdprStackOptions = {
   readonly order?: GdprStackOrder;
   readonly sessions?: boolean;
   readonly tenantLifecycle?: boolean;
+  /** tokenVerifier provider(s) for auth-foundation when `sessions` is on.
+   *  Without at least one, auth-foundation's boot check throws ("no
+   *  tokenVerifier providers registered"). Omit only if the app mounts a
+   *  provider itself elsewhere. */
+  readonly providers?: readonly FeatureDefinition[];
 };
 
 export type UserDataRightsStackOptions = {
@@ -79,15 +84,14 @@ export type OpsStackOptions = {
 /** sessions (+ optional auth-mfa). config/user/tenant/auth-email-password stay
  *  on composeFeatures(includeBundled). Pass `mfa` options to mount TOTP.
  *  When `sessions` is on (the default), auth-foundation is mounted alongside it —
- *  the framework's registry now hard-requires it (sessions.requires("auth-foundation")).
- *  Pass `providers` for the tokenVerifier(s) auth-foundation itself requires at least
- *  one of (e.g. createPersonalAccessTokensFeature({ scopes })) — PAT scopes are
- *  app-specific (which write-handlers an API token may call), so they stay caller-owned
- *  instead of a framework default. */
+ *  the framework's registry now hard-requires it (sessions.requires("auth-foundation")),
+ *  which in turn needs at least one tokenVerifier provider mounted by the caller
+ *  (e.g. createPersonalAccessTokensFeature({ scopes })) — PAT scopes are app-specific
+ *  (which write-handlers an API token may call), so they stay caller-owned instead of
+ *  a framework default. */
 export type IdentityStackOptions = {
   readonly sessions?: boolean;
   readonly mfa?: AuthMfaFeatureOptions;
-  readonly providers?: readonly FeatureDefinition[];
 };
 
 export function stackFeatureNames(features: readonly FeatureDefinition[]): string[] {
@@ -139,7 +143,10 @@ export function composeGdprStack(options: GdprStackOptions = {}): FeatureDefinit
   const out: FeatureDefinition[] =
     order === "compliance-first" ? [compliance, retention] : [retention, compliance];
   if (options.tenantLifecycle) out.push(createTenantLifecycleFeature());
-  if (options.sessions) out.push(authFoundationFeature, createSessionsFeature());
+  if (options.sessions) {
+    out.push(authFoundationFeature, createSessionsFeature());
+    if (options.providers) out.push(...options.providers);
+  }
   return out;
 }
 
@@ -172,7 +179,6 @@ export function composeIdentityStack(options: IdentityStackOptions = {}): Featur
   const out: FeatureDefinition[] = [];
   if (sessions) {
     out.push(authFoundationFeature, createSessionsFeature());
-    if (options.providers) out.push(...options.providers);
   }
   if (options.mfa !== undefined) out.push(createAuthMfaFeature(options.mfa));
   return out;