@cosmicdrift/kumiko-dev-server 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -0,0 +1,69 @@
+# @cosmicdrift/kumiko-dev-server
+
+## 0.2.2
+
+### Patch Changes
+
+- 7a7da3e: Re-publish 0.2.1 → 0.2.2 mit korrekt aufgelösten cross-package-Versionen.
+  0.2.1 hatte `workspace:*` als Wert in den dependencies (npm publish ohne
+  yarn-pack rewrite), Konsumenten bekamen "Workspace not found".
+
+  publish-with-oidc.sh nutzt jetzt `yarn pack` (rewrited workspace:\*) +
+  `npm publish <tarball>` (OIDC + provenance).
+
+- Updated dependencies [7a7da3e]
+  - @cosmicdrift/kumiko-framework@0.2.2
+  - @cosmicdrift/kumiko-bundled-features@0.2.2
+
+## 0.2.1
+
+### Patch Changes
+
+- 48b7f6a: CI: switch publish to npm-CLI with OIDC Trusted Publishing + provenance.
+  No source changes — verifies the new publish path produces a verified-
+  provenance attestation on npmjs.com instead of token-based publish.
+- Updated dependencies [48b7f6a]
+  - @cosmicdrift/kumiko-framework@0.2.1
+  - @cosmicdrift/kumiko-bundled-features@0.2.1
+
+## 0.2.0
+
+### Minor Changes
+
+- 6c70b6f: fix(tenant): seedTenant idempotent gegen Event-Store-Projection-Drift.
+
+  Verhindert version_conflict beim App-Boot wenn Aggregat existiert aber
+  Projection-Row fehlt (rebuild-drift, async-lag, manueller DB-Eingriff).
+
+### Patch Changes
+
+- Updated dependencies [6c70b6f]
+  - @cosmicdrift/kumiko-framework@0.2.0
+  - @cosmicdrift/kumiko-bundled-features@0.2.0
+
+## 0.1.0
+
+### Minor Changes
+
+- 59ba6d7: Initial public release of Kumiko — AI-native backend builder.
+
+  What ships in 0.1.0:
+
+  - **Engine** (`@cosmicdrift/kumiko-framework`): `defineFeature`, `r.entity`, `r.writeHandler`, `r.queryHandler`, `r.projection`, `r.multiStreamProjection`, `r.hook`, `r.translations`, `r.crud`, `r.referenceData`, `r.screen`, `r.nav`, `r.authClaims`, full lifecycle pipeline with field-level access checks
+  - **Pipeline** (`@cosmicdrift/kumiko-framework`): `createDispatcher`, JWT auth via jose, Zod schema validation, role-based access checks, command/write/query split
+  - **DB** (`@cosmicdrift/kumiko-framework`): Drizzle helpers (`buildDrizzleTable`, `applyCursorQuery`), CRUD executor, Postgres dialect, optimistic locking, soft delete, multi-tenant scoping
+  - **Event sourcing** (`@cosmicdrift/kumiko-framework`): aggregate streams, single + multi-stream projections, event upcasters, asOf queries, archive support, AsyncDaemon-pattern dispatcher
+  - **Bundled features** (`@cosmicdrift/kumiko-bundled-features`): auth-email-password, sessions, tenants, users, jobs, secrets, file-provider-s3, mail-transport-smtp/inmemory, billing-foundation, cap-counter, channel-in-app, delivery, feature-toggles, legal-pages
+  - **Renderer** (`@cosmicdrift/kumiko-renderer`, `@cosmicdrift/kumiko-renderer-web`): schema-driven CRUD UI for React + Expo Web, override paths, list debounce, theme tokens
+  - **Headless** (`@cosmicdrift/kumiko-headless`): view-models for list/edit screens, locale-aware
+  - **Dev server** (`@cosmicdrift/kumiko-dev-server`): `runDevApp`, `runProdApp`, `kumiko-build` for production bundles (client + server), Docker-ready
+  - **Realtime** (`@cosmicdrift/kumiko-dispatcher-live`): SSE broadcast across tenants, Redis Pub/Sub backend
+  - **CLI** (`bin/kumiko.ts`): interactive dev menu, test runners, check pipeline (Biome + TypeScript + 18 guards + Vitest)
+
+  This is a pre-1.0 release — APIs may change between minor versions. Breaking changes will be documented per release.
+
+### Patch Changes
+
+- Updated dependencies [59ba6d7]
+  - @cosmicdrift/kumiko-framework@0.1.0
+  - @cosmicdrift/kumiko-bundled-features@0.1.0

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/cosmicdriftgamestudio/kumiko-framework.git",
+    "url": "git+https://github.com/CosmicDriftGameStudio/kumiko-framework.git",
     "directory": "packages/dev-server"
   },
   "bugs": {
-    "url": "https://github.com/cosmicdriftgamestudio/kumiko-framework/issues"
+    "url": "https://github.com/CosmicDriftGameStudio/kumiko-framework/issues"
   },
   "homepage": "https://kumiko.so",
   "type": "module",
@@ -30,8 +30,8 @@
     "kumiko-dev": "./bin/kumiko-dev.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "workspace:*",
-    "@cosmicdrift/kumiko-framework": "workspace:*"
+    "@cosmicdrift/kumiko-bundled-features": "0.2.2",
+    "@cosmicdrift/kumiko-framework": "0.2.2"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -42,4 +42,4 @@
     "README.md",
     "LICENSE"
   ]
-}
+}

package/src/create-kumiko-server.ts

@@ -170,6 +170,14 @@ export type CreateKumikoServerOptions = {
    *  Handler `roles: ["anonymous"]` deklariert. Tenant-Resolution per
    *  Header/Cookie/Default; siehe AnonymousAccessConfig. */
   readonly anonymousAccess?: TestStackOptions["anonymousAccess"];
+  /** Feature-toggle resolver — durchgereicht an setupTestStack. Wenn
+   *  gesetzt, konsultiert der dispatcher-feature-gate, hook-filter, MSP-
+   *  filter den callback; absent = alle features always-on. Erforderlich
+   *  für Tier-Composition (Sprint 8) wo per-Tenant unterschiedliche
+   *  features aktiv sein sollen. Die typische produktive Implementierung
+   *  ist `() => globalFeatureToggleRuntime.effectiveFeatures` post-boot
+   *  (createLateBoundHolder-pattern, weil runtime stack.db braucht). */
+  readonly effectiveFeatures?: TestStackOptions["effectiveFeatures"];
   /** Wird nach dem Aufsetzen der Entity-Tabellen aufgerufen. Hook für
    *  non-entity-tables (unsafePushTables) und Seeding (admin user, initial
    *  tenant, …). Muss idempotent sein — im persistent-DB-Modus läuft
@@ -641,6 +649,9 @@ export async function createKumikoServer(
     ...(options.auth !== undefined && { authConfig: options.auth }),
     ...(options.extraContext !== undefined && { extraContext: options.extraContext }),
     ...(options.anonymousAccess !== undefined && { anonymousAccess: options.anonymousAccess }),
+    ...(options.effectiveFeatures !== undefined && {
+      effectiveFeatures: options.effectiveFeatures,
+    }),
   });
   await createEventsTable(stack.db);
   await pushEntityProjectionTables(stack, stack.registry);

package/src/run-dev-app.ts

@@ -26,7 +26,14 @@ import {
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 
 import type { SessionMetadata } from "@cosmicdrift/kumiko-framework/api";
-import type { FeatureDefinition, SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  type EffectiveFeaturesResolver,
+  type FeatureDefinition,
+  findTierResolverUsage,
+  type SessionUser,
+  type TenantId,
+  type TierResolverPlugin,
+} from "@cosmicdrift/kumiko-framework/engine";
 import type { TestStack } from "@cosmicdrift/kumiko-framework/stack";
 
 import { watchAndRegenerate } from "./codegen";
@@ -138,6 +145,13 @@ export type RunDevAppOptions = {
    *  Hono-app gehängt, läuft VOR dem static-asset-Pfad. Symmetrisch zur
    *  gleichnamigen Option in runProdApp. */
   readonly extraRoutes?: CreateKumikoServerOptions["extraRoutes"];
+  /** Feature-toggle resolver — durchgereicht an createKumikoServer →
+   *  setupTestStack. Sprint-8 Tier-Composition: per-Tenant unterschied-
+   *  liche features aktiv via globalFeatureToggleRuntime. Pattern in
+   *  bin/server.ts: createLateBoundHolder + post-boot runtime.initialize
+   *  in einem seed-fn, weil die runtime stack.db braucht und die seed-
+   *  Funktionen nach setupTestStack laufen. */
+  readonly effectiveFeatures?: CreateKumikoServerOptions["effectiveFeatures"];
 };
 
 export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServerHandle> {
@@ -163,6 +177,33 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     ...(composeAuthOptions && { authOptions: composeAuthOptions }),
   });
 
+  // Sprint-8a Tier-Composition auto-wire: scan features for a
+  // tenantTierResolver-extension. If found AND user didn't supply own
+  // effectiveFeatures, we wire a late-bound wrapper here and fill it
+  // in onAfterSetup (where stack.db + stack.registry are available).
+  // App-Author sees nothing — `createTierEngineFeature(opts)` mounts +
+  // framework auto-wires.
+  const tierResolverUsage = options.effectiveFeatures ? undefined : findTierResolverUsage(features);
+  const tierResolverHolder: { resolver: EffectiveFeaturesResolver | undefined } = {
+    resolver: undefined,
+  };
+  const finalEffectiveFeatures: EffectiveFeaturesResolver | undefined =
+    options.effectiveFeatures ??
+    (tierResolverUsage
+      ? (tenantId: TenantId) => {
+          // Defensive: Server starts AFTER onAfterSetup completes, so the
+          // resolver is filled before any request comes in. Throwing here
+          // means a programming error (boot order) rather than silent
+          // "all-features-on" misbehavior.
+          if (!tierResolverHolder.resolver) {
+            throw new Error(
+              "tier-resolver: extension found but resolver not yet built — boot order issue?",
+            );
+          }
+          return tierResolverHolder.resolver(tenantId);
+        }
+      : undefined);
+
   // configResolver-default fürs config-feature — im auth-mode immer
   // hinzufügen, im no-auth-mode dem Caller überlassen. Factory-form
   // wird gewrap't damit der spread auf das aufgerufene Result greift,
@@ -216,6 +257,9 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     ...(extraContext !== undefined && { extraContext }),
     ...(options.anonymousAccess !== undefined && { anonymousAccess: options.anonymousAccess }),
     ...(options.extraRoutes !== undefined && { extraRoutes: options.extraRoutes }),
+    ...(finalEffectiveFeatures !== undefined && {
+      effectiveFeatures: finalEffectiveFeatures,
+    }),
     ...(options.auth && {
       auth: {
         membershipQuery: TenantQueries.memberships,
@@ -261,6 +305,16 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       },
     }),
     onAfterSetup: async (stack) => {
+      // Sprint-8a: build tier-resolver BEFORE any seeds so seeds can rely
+      // on the resolver being live (e.g. seed that writes a SystemAdmin's
+      // tier-assignment can immediately read tier-cuts).
+      if (tierResolverUsage) {
+        const plugin = tierResolverUsage.options as TierResolverPlugin;
+        tierResolverHolder.resolver = await plugin.build({
+          db: stack.db,
+          registry: stack.registry,
+        });
+      }
       if (options.auth?.sessions !== undefined) {
         const expiresInMs = options.auth.sessions.expiresInMs;
         sessionCallbacks = createSessionCallbacks({

package/src/run-prod-app.ts

@@ -46,7 +46,11 @@ import { createDbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   buildAppSchema,
   createRegistry,
+  type EffectiveFeaturesResolver,
   type FeatureDefinition,
+  findTierResolverUsage,
+  type TenantId,
+  type TierResolverPlugin,
   validateBoot,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -351,6 +355,12 @@ export type RunProdAppOptions = {
    *  the fetch-handler directly (Bun.serve isn't available under vitest +
    *  node), then call handle.listen() manually if needed. */
   readonly autoListen?: boolean;
+  /** Feature-toggle resolver — durchgereicht an createApiEntrypoint's
+   *  dispatcherOptions. Sprint-8 Tier-Composition: per-Tenant unterschied-
+   *  liche features aktiv via globalFeatureToggleRuntime. Pattern:
+   *  createLateBoundHolder + post-boot runtime.initialize in einem
+   *  seed-fn (db ist erst nach migrations + features ready). */
+  readonly effectiveFeatures?: (tenantId: TenantId) => ReadonlySet<string>;
 };
 
 export type ProdAppHandle = {
@@ -403,6 +413,20 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   validateBoot(features);
   const registry = createRegistry(features);
 
+  // Sprint-8a Tier-Composition auto-wire: scan features for a
+  // tenantTierResolver-extension. If found AND user didn't supply own
+  // effectiveFeatures, build the resolver here (db + registry are
+  // available) before the dispatcher is constructed. App-Author sees
+  // nothing — `createTierEngineFeature(opts)` mounts + framework auto-wires.
+  let resolvedEffectiveFeatures: EffectiveFeaturesResolver | undefined = options.effectiveFeatures;
+  if (resolvedEffectiveFeatures === undefined) {
+    const tierResolverUsage = findTierResolverUsage(features);
+    if (tierResolverUsage) {
+      const plugin = tierResolverUsage.options as TierResolverPlugin;
+      resolvedEffectiveFeatures = await plugin.build({ db, registry });
+    }
+  }
+
   // 5. Schema-Drift-Gate. Drizzle-kit migrate (yarn kumiko migrate apply)
   //    läuft als CI-Step VOR dem Container-Rollout. Boot prüft hier nur:
   //      (a) Alle Migrations aus drizzle/migrations/meta/_journal.json
@@ -486,7 +510,10 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     jwtSecret,
     ...(jwtIssuer && { jwtIssuer }),
     ...(instanceId && { instanceId }),
-    dispatcherOptions: { idempotency },
+    dispatcherOptions: {
+      idempotency,
+      ...(resolvedEffectiveFeatures && { effectiveFeatures: resolvedEffectiveFeatures }),
+    },
     eventDedup,
     ...(options.auth && {
       auth: {