@cosmicdrift/kumiko-dev-server 0.165.0 → 2.0.0

package/bin/kumiko-schema-check.ts

@@ -68,6 +68,7 @@ async function readMountedFeatures(runConfigPath: string): Promise<Set<string>>
   const mod = (await import(runConfigPath)) as {
     APP_FEATURES?: ReadonlyArray<{ name: string }>;
     HAS_AUTH?: boolean;
+    HAS_SIGNUP?: boolean;
   };
   if (!mod.APP_FEATURES) {
     throw new Error(
@@ -85,6 +86,12 @@ async function readMountedFeatures(runConfigPath: string): Promise<Set<string>>
   if (mod.HAS_AUTH ?? true) {
     for (const name of implicitAuthModeFeatureNames()) set.add(name);
   }
+  // auth-self-registration is only prepended when authOptions.signup is set
+  // (composeFeatures) — opt-in via HAS_SIGNUP so apps without signup don't
+  // get a stale-registry false positive (#1521).
+  if (mod.HAS_SIGNUP === true) {
+    set.add("auth-self-registration");
+  }
   return set;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.165.0",
+  "version": "2.0.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Not shipped into production node_modules — see @cosmicdrift/kumiko-server-runtime for the prod boot path.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -54,9 +54,9 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.165.0",
-    "@cosmicdrift/kumiko-framework": "0.165.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.165.0",
+    "@cosmicdrift/kumiko-bundled-features": "2.0.0",
+    "@cosmicdrift/kumiko-framework": "2.0.0",
+    "@cosmicdrift/kumiko-server-runtime": "2.0.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/build-server-bundle.test.ts

@@ -95,4 +95,32 @@ describe("buildServerBundle (multi-entry + splitting)", () => {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+
+  test("prefers node_modules/@cosmicdrift/* over packages/* when both declare a version", async () => {
+    // Framework-monorepo checkout: both the installed node_modules package
+    // (symlinked in real life, diverging here) and packages/framework exist.
+    // node_modules must win — it reflects what actually gets shipped/installed
+    // for the consumer, packages/framework is only a repo-root fallback.
+    const dir = makeFixture();
+    try {
+      const frameworkPkgDir = join(dir, "node_modules/@cosmicdrift/kumiko-framework");
+      mkdirSync(frameworkPkgDir, { recursive: true });
+      writeFileSync(
+        join(frameworkPkgDir, "package.json"),
+        `${JSON.stringify({ name: "@cosmicdrift/kumiko-framework", dependencies: { meilisearch: "^0.58.0" } })}\n`,
+      );
+
+      mkdirSync(join(dir, "packages/framework"), { recursive: true });
+      writeFileSync(
+        join(dir, "packages/framework/package.json"),
+        `${JSON.stringify({ name: "@cosmicdrift/kumiko-framework", dependencies: { meilisearch: "^0.30.0" } })}\n`,
+      );
+
+      const result = await buildServerBundle({ cwd: dir, outDir: join(dir, "dist-server") });
+
+      expect(result.runtimeDeps["meilisearch"]).toBe("^0.58.0");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });

package/src/__tests__/compose-stacks.test.ts

@@ -144,16 +144,14 @@ describe("composeStacks boots for real", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
-  test("money-horse-shaped composeGdprStack({sessions:true}) without a tokenVerifier provider fails boot", () => {
-    // Regression pin for the open design question this stack shape raised:
-    // composeGdprStack({sessions:true}) mounts auth-foundation, which
-    // hard-requires at least one tokenVerifier provider. Without composing
-    // one in (money-horse/solon's real run-config passes none), boot must
-    // fail loudly instead of silently shipping an unauthenticatable app.
+  test("money-horse-shaped composeGdprStack({sessions:true}) without a tokenVerifier provider passes boot", () => {
+    // Session-only stacks (#1570): composeGdprStack({sessions:true}) mounts
+    // auth-foundation + sessions (sessionStore). Cookie auth does not need a
+    // tokenVerifier; money-horse/solon run-configs pass none and must boot.
     const features = composeFeatures([...composeGdprStack({ sessions: true })], {
       includeBundled: true,
     });
-    expect(() => validateBoot(features)).toThrow(/no tokenVerifier providers registered/i);
+    expect(() => validateBoot(features)).not.toThrow();
   });
 
   test("composeGdprStack({sessions:true, providers:[...]}) passes boot with a tokenVerifier mounted", () => {

package/src/__tests__/create-kumiko-server.integration.test.ts

@@ -385,6 +385,13 @@ describe("createKumikoServer — real Bun.build (buildClient)", () => {
       const body = await res.text();
       expect(body.length).toBeGreaterThan(0);
       expect(body).toMatch(/ping/);
+
+      // Stop the watcher before teardown rmSync deletes clientEntry out from
+      // under it — a bare "client.tsx" delete event classifies as "restart"
+      // (classifyChange only special-cases endsWith("/client.tsx")) and
+      // process.exit(75) kills the whole bun test runner mid-suite.
+      await handle.stop();
+      handle = undefined;
     } finally {
       rmSync(tmpDir, { recursive: true, force: true });
     }

package/src/__tests__/scaffold-app.test.ts

@@ -186,6 +186,27 @@ describe("scaffoldApp", () => {
     expect(readme).toContain("- `delivery`");
   });
 
+  test("callExpression/export-callability mismatch throws instead of silently mis-instantiating", async () => {
+    const dest = join(tmp, "my-shop");
+    await expect(
+      scaffoldApp({
+        name: "my-shop",
+        destination: dest,
+        features: [
+          {
+            name: "delivery",
+            importPath: "@cosmicdrift/kumiko-bundled-features/delivery",
+            exportName: "createDeliveryFeature",
+            // createDeliveryFeature is a factory function, but this claims it's
+            // a plain object export (no trailing "()") — must not silently push
+            // the function itself as a FeatureDefinition.
+            callExpression: "createDeliveryFeature",
+          },
+        ],
+      }),
+    ).rejects.toThrow(/is.*callable but callExpression/);
+  });
+
   test("bin/main.ts contains runProdApp + auth.admin stub + staticDir", async () => {
     const dest = join(tmp, "my-shop");
     await scaffoldApp({ name: "my-shop", destination: dest });

package/src/build-server-bundle.ts

@@ -237,14 +237,16 @@ async function resolveRuntimeDepsVersions(
   const out: Record<string, string> = {};
 
   const pinSources = [
-    join(cwd, "node_modules/@cosmicdrift/kumiko-framework/package.json"),
-    join(cwd, "node_modules/@cosmicdrift/kumiko-bundled-features/package.json"),
     ...(repoRoot
       ? [
           join(repoRoot, "packages/framework/package.json"),
           join(repoRoot, "packages/bundled-features/package.json"),
         ]
       : []),
+    // node_modules applied last so its versions win over the repo-root
+    // fallback — see the function comment above (#1217 bug class).
+    join(cwd, "node_modules/@cosmicdrift/kumiko-framework/package.json"),
+    join(cwd, "node_modules/@cosmicdrift/kumiko-bundled-features/package.json"),
   ];
   const allDeps: Record<string, string> = {};
   for (const path of pinSources) {

package/src/compose-stacks.ts

@@ -59,10 +59,10 @@ export type GdprStackOptions = {
   readonly order?: GdprStackOrder;
   readonly sessions?: boolean;
   readonly tenantLifecycle?: boolean;
-  /** tokenVerifier provider(s) for auth-foundation when `sessions` is on.
-   *  Without at least one, auth-foundation's boot check throws ("no
-   *  tokenVerifier providers registered"). Omit only if the app mounts a
-   *  provider itself elsewhere. */
+  /** Optional tokenVerifier provider(s) (e.g. PAT) when `sessions` is on.
+   *  Session-only stacks need none — sessions registers sessionStore, which
+   *  satisfies auth-foundation's boot check (#1570). Pass providers when the
+   *  app also wants Bearer/PAT auth. */
   readonly providers?: readonly FeatureDefinition[];
 };
 
@@ -84,11 +84,10 @@ export type OpsStackOptions = {
 /** sessions (+ optional auth-mfa). config/user/tenant/auth-email-password stay
  *  on composeFeatures(includeBundled). Pass `mfa` options to mount TOTP.
  *  When `sessions` is on (the default), auth-foundation is mounted alongside it —
- *  the framework's registry now hard-requires it (sessions.requires("auth-foundation")),
- *  which in turn needs at least one tokenVerifier provider mounted by the caller
- *  (e.g. createPersonalAccessTokensFeature({ scopes })) — PAT scopes are app-specific
- *  (which write-handlers an API token may call), so they stay caller-owned instead of
- *  a framework default. */
+ *  the framework's registry now hard-requires it (sessions.requires("auth-foundation")).
+ *  Session-only is enough for boot (#1570); optional Bearer/PAT still needs a
+ *  tokenVerifier provider from the caller (e.g. createPersonalAccessTokensFeature
+ *  ({ scopes })) — PAT scopes are app-specific, so they stay caller-owned. */
 export type IdentityStackOptions = {
   readonly sessions?: boolean;
   readonly mfa?: AuthMfaFeatureOptions;

package/src/run-dev-app.ts

@@ -132,23 +132,28 @@ export type RunDevAppAuthOptions = {
    *  der request/confirm-Handler im auth-email-password-Feature wird
    *  registriert. Symmetrisch zu RunProdAppAuthOptions.passwordReset. */
   readonly passwordReset?: PasswordResetSetup;
-  /** Email-verification flow. Symmetric zu passwordReset. */
+  /** Email-verification flow. Symmetric to passwordReset. */
   readonly emailVerification?: EmailVerificationSetup;
-  /** Self-Signup flow (Magic-Link). Symmetric zu RunProdAppAuthOptions. */
+  /** Self-signup flow (magic link). Symmetric to RunProdAppAuthOptions. */
   readonly signup?: SignupSetup;
-  /** Tenant-Invite flow (Magic-Link). Symmetric. */
+  /** Tenant-invite flow (magic link). Symmetric. */
   readonly invite?: InviteSetup;
-  /** Account-unlock flow (#1266). Symmetric zu RunProdAppAuthOptions. */
+  /** Account-unlock flow (#1266). Symmetric to RunProdAppAuthOptions. */
   readonly accountUnlock?: AccountUnlockSetup;
   /** Domain attribute for both auth cookies (see
-   *  AuthRoutesConfig.cookieDomain). Symmetric zu RunProdAppAuthOptions. */
+   *  AuthRoutesConfig.cookieDomain). Symmetric to RunProdAppAuthOptions. */
   readonly cookieDomain?: string;
   /** Server-side Origin allowlist for the CSRF guard (see
-   *  AuthRoutesConfig.allowedOrigins). Symmetric zu RunProdAppAuthOptions —
+   *  AuthRoutesConfig.allowedOrigins). Symmetric to RunProdAppAuthOptions —
    *  required once `cookieDomain` is set. */
   readonly allowedOrigins?: readonly string[];
-  /** Opt out of the Origin guard. Symmetric zu RunProdAppAuthOptions. */
+  /** Opt out of the Origin guard. Symmetric to RunProdAppAuthOptions. */
   readonly unsafeSkipOriginCheck?: boolean;
+  /** Number of trusted reverse-proxy hops for client-IP derivation (see
+   *  AuthRoutesConfig.trustedProxyHops, kumiko-framework#1539). Symmetric to
+   *  RunProdAppAuthOptions — dev usually runs unproxied, so this is normally
+   *  left unset (default 0). */
+  readonly trustedProxyHops?: number;
 };
 
 /** Hook for app-specific seeding (demo data, fixtures). Runs after the
@@ -484,6 +489,9 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
         ...(effectiveAuth.unsafeSkipOriginCheck !== undefined && {
           unsafeSkipOriginCheck: effectiveAuth.unsafeSkipOriginCheck,
         }),
+        ...(effectiveAuth.trustedProxyHops !== undefined && {
+          trustedProxyHops: effectiveAuth.trustedProxyHops,
+        }),
         ...sessionAuthFragment,
         ...patAuthFragment,
         ...tenantLifecycleAuthFragment,

package/src/scaffold-app.ts

@@ -852,6 +852,14 @@ async function instantiateScaffoldFeatures(
         `scaffoldApp: ${entry.importPath} missing export ${entry.exportName} for ${entry.callExpression}`,
       );
     }
+    const looksCallable = entry.callExpression.endsWith(")");
+    if (looksCallable !== (typeof exp === "function")) {
+      throw new Error(
+        `scaffoldApp: ${entry.importPath} export ${entry.exportName} is ${
+          typeof exp === "function" ? "" : "not "
+        }callable but callExpression "${entry.callExpression}" says otherwise`,
+      );
+    }
     if (typeof exp === "function") {
       instances.push((exp as (...args: unknown[]) => FeatureDefinition)(...(entry.callArgs ?? [])));
     } else {