@cosmicdrift/kumiko-dev-server 0.359.0 → 0.361.0

package/dist/create-kumiko-server.d.ts

@@ -6,6 +6,7 @@ import { type TestStack, type TestStackOptions } from "@cosmicdrift/kumiko-frame
 import { type PageHeadResolver, type PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
 import { type SystemWireDeps } from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
 type BunServer = typeof Bun extends undefined ? unknown : ReturnType<typeof Bun.serve>;
+export declare const logInfo: (msg: string) => void;
 /** Multi-entry mode for apps that ship several separate bundles (e.g.
  *  publicstatus: `admin.<base>` loads the admin UI, otherwise the public
  *  page).

package/dist/create-kumiko-server.js

@@ -20,7 +20,7 @@ import { readFile, realpath, watch } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
-import { createClientIpResolver, generateToken, } from "@cosmicdrift/kumiko-framework/api";
+import { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, createClientIpResolver, generateToken, sessionCookieName, } from "@cosmicdrift/kumiko-framework/api";
 import { buildAppSchema } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { pushEntityProjectionTables, setupTestStack, TestUsers, } from "@cosmicdrift/kumiko-framework/stack";
@@ -32,6 +32,7 @@ import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_URL_PREFIX, resolveR
 import { buildRequestBoundSystemQuery } from "@cosmicdrift/kumiko-server-runtime/request-bound-system-query";
 import { canResolveTailwindStylesheet, resolveTailwindCli, } from "@cosmicdrift/kumiko-server-runtime/resolve-tailwind-cli";
 import { stripNoRouteMatchHeader, tryHonoFirst, } from "@cosmicdrift/kumiko-server-runtime/try-hono-first";
+import { isPersistentDevDb } from "./is-persistent-dev-db.js";
 // Runtime-detection. The dev-server is meant to run under Bun (Kumiko's
 // target runtime), but the test-suite runs under vitest on Node — we
 // gate every Bun.* call so the module at least LOADS under Node, and
@@ -40,12 +41,13 @@ import { stripNoRouteMatchHeader, tryHonoFirst, } from "@cosmicdrift/kumiko-serv
 const hasBun = typeof globalThis.Bun !== "undefined";
 // @wrapper-known semantic-alias
 // biome-ignore lint/suspicious/noConsole: dev-server status logging
-const logInfo = (msg) => console.log(msg);
+export const logInfo = (msg) => console.log(msg);
 // @wrapper-known semantic-alias
 // biome-ignore lint/suspicious/noConsole: dev-server error logging
 const logError = (...args) => console.error(...args);
-const CSRF_COOKIE = "kumiko_csrf";
-const AUTH_COOKIE = "kumiko_auth";
+// The dev server speaks plain http, so its minted cookies are never Secure and keep the unprefixed names.
+const CSRF_COOKIE = sessionCookieName(CSRF_COOKIE_BASE, { secure: false });
+const AUTH_COOKIE = sessionCookieName(AUTH_COOKIE_BASE, { secure: false });
 // Duplicated in packages/testing/src/e2e/constants.ts: the Playwright config
 // runs under Node and cannot import this module.
 export const STYLESHEET_WATCH_ENV = "KUMIKO_DEV_STYLESHEET_WATCH";
@@ -588,7 +590,7 @@ export async function createKumikoServer(options) {
     // on purpose — every dev-server pattern benefits from the same
     // toggle, not just one sample.
     const devDbName = process.env["KUMIKO_DEV_DB_NAME"];
-    const persistentDb = devDbName !== undefined && devDbName !== "";
+    const persistentDb = isPersistentDevDb(process.env);
     // Redis is shared across boots AND across apps (unlike the per-boot test
     // DB, which is ephemeral or persistent per KUMIKO_DEV_DB_NAME), so every
     // boot needs its own queue-name prefix — otherwise two dev/e2e servers

package/dist/is-persistent-dev-db.d.ts

@@ -0,0 +1 @@
+export declare function isPersistentDevDb(env?: Record<string, string | undefined>): boolean;

package/dist/is-persistent-dev-db.js

@@ -0,0 +1,4 @@
+export function isPersistentDevDb(env = process.env) {
+    const devDbName = env["KUMIKO_DEV_DB_NAME"];
+    return devDbName !== undefined && devDbName !== "";
+}

package/dist/resolve-dev-pii-kms.d.ts

@@ -0,0 +1,13 @@
+import { type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+export type DevPiiKmsResolution = {
+    readonly kms: KmsAdapter | undefined;
+    readonly blindIndexKey: string | undefined;
+    readonly mode: "app-kms" | "ephemeral-default" | "plaintext";
+};
+type DevPiiKmsOptions = {
+    readonly kms?: KmsAdapter | false;
+    readonly blindIndexKey?: string;
+};
+export declare function captureEphemeralDevPiiKms(resolution: DevPiiKmsResolution): () => void;
+export declare function resolveDevPiiKms(options: DevPiiKmsOptions, env?: Record<string, string | undefined>): DevPiiKmsResolution;
+export {};

package/dist/resolve-dev-pii-kms.js

@@ -0,0 +1,33 @@
+import { randomBytes } from "node:crypto";
+import { configureBlindIndexKey, configuredBlindIndexKey, configuredPiiSubjectKms, configurePiiSubjectKms, InMemoryKmsAdapter, } from "@cosmicdrift/kumiko-framework/crypto";
+import { isPersistentDevDb } from "./is-persistent-dev-db.js";
+// Call right after configuring the resolved values. The returned restore only
+// unsets what the ephemeral default installed, so a KMS a later test or the app
+// configured survives.
+export function captureEphemeralDevPiiKms(resolution) {
+    if (resolution.mode !== "ephemeral-default")
+        return () => { };
+    const ownKms = configuredPiiSubjectKms();
+    const ownBlindIndexKey = configuredBlindIndexKey();
+    return () => {
+        if (ownKms !== undefined && configuredPiiSubjectKms() === ownKms) {
+            configurePiiSubjectKms(undefined);
+        }
+        if (ownBlindIndexKey !== undefined && configuredBlindIndexKey() === ownBlindIndexKey) {
+            configureBlindIndexKey(undefined);
+        }
+    };
+}
+export function resolveDevPiiKms(options, env = process.env) {
+    if (options.kms !== undefined && options.kms !== false) {
+        return { kms: options.kms, blindIndexKey: options.blindIndexKey, mode: "app-kms" };
+    }
+    if (options.kms === false || isPersistentDevDb(env)) {
+        return { kms: undefined, blindIndexKey: options.blindIndexKey, mode: "plaintext" };
+    }
+    return {
+        kms: new InMemoryKmsAdapter(),
+        blindIndexKey: options.blindIndexKey ?? randomBytes(32).toString("base64"),
+        mode: "ephemeral-default",
+    };
+}

package/dist/run-dev-app.d.ts

@@ -120,12 +120,12 @@ export type RunDevAppOptions = {
      *  `createEnvMasterKeyProvider`. Override für KMS-Backends. Nur relevant
      *  wenn das secrets-Feature gemountet ist. Symmetrisch zu runProdApp. */
     readonly masterKey?: MasterKeyProvider;
-    /** Subject-Key-KMS für pii-annotierte Felder (Crypto-Shredding) — dev-
-     *  Pendant zu runProdApp({ kms }). Ephemere DB: InMemoryKmsAdapter reicht.
-     *  Persistente Dev-DB: createPgKmsAdapter gegen dieselbe DB, sonst sind
-     *  alte Rows nach dem Restart unlesbar (DEKs weg). Ohne Adapter: Klartext
-     *  + Boot-Warnung. */
-    readonly kms?: KmsAdapter;
+    /** Subject KMS for PII-annotated fields, the dev counterpart of runProdApp({ kms }).
+     *  Unset: an ephemeral DB gets an InMemoryKmsAdapter plus a throwaway blind-index key;
+     *  a persistent dev DB (KUMIKO_DEV_DB_NAME) stays plaintext with a boot warning, pass
+     *  createPgKmsAdapter against that DB there (in-memory DEKs vanish on restart).
+     *  `false`: explicit plaintext, with the boot warning. */
+    readonly kms?: KmsAdapter | false;
     /** 32-Byte-Key (base64) für Blind-Index-HMACs — Pflicht sobald `kms`
      *  gesetzt ist und lookupable-Felder gemountet sind (sonst Boot-Abbruch,
      *  symmetrisch zu runProdApp). */

package/dist/run-dev-app.js

@@ -30,7 +30,8 @@ import { buildComposeAuthOptions, composeFeatures, } from "@cosmicdrift/kumiko-s
 import { assertPiiBootInvariants } from "@cosmicdrift/kumiko-server-runtime/pii-boot-gate";
 import { assertSessionBootInvariants } from "@cosmicdrift/kumiko-server-runtime/session-boot-gate";
 import { watchAndRegenerate } from "./codegen/index.js";
-import { createKumikoServer, } from "./create-kumiko-server.js";
+import { createKumikoServer, logInfo, } from "./create-kumiko-server.js";
+import { captureEphemeralDevPiiKms, resolveDevPiiKms } from "./resolve-dev-pii-kms.js";
 import { renderWelcomeBanner } from "./welcome-banner.js";
 import { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, requireEnv, resolveAuthMail, } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 export async function runDevApp(options) {
@@ -128,13 +129,18 @@ export async function runDevApp(options) {
     // Subject-KMS + Blind-Index (symmetrisch zu runProdApp). Dev warnt bei
     // Klartext-PII statt zu failen; kms+lookupable ohne blindIndexKey bricht
     // auch hier (Lookups wären in jedem Modus kaputt).
-    configurePiiSubjectKms(options.kms);
-    configureBlindIndexKey(options.blindIndexKey);
+    const piiKms = resolveDevPiiKms(options);
+    configurePiiSubjectKms(piiKms.kms);
+    configureBlindIndexKey(piiKms.blindIndexKey);
+    const releaseEphemeralPiiKms = captureEphemeralDevPiiKms(piiKms);
     assertPiiBootInvariants(features, {
-        kms: options.kms,
-        blindIndexKey: options.blindIndexKey,
+        kms: piiKms.kms,
+        blindIndexKey: piiKms.blindIndexKey,
         mode: "dev",
     });
+    if (piiKms.mode === "ephemeral-default") {
+        logInfo("[runDevApp] PII encrypted with in-memory KMS (ephemeral DB); pass kms: false to opt out");
+    }
     // Throwaway registry, built once and reused below — mirrors runProdApp's
     // `createRegistry(features)` right after validateBoot (#2027). Symmetric
     // sessionStoreProviderMounted check to runProdApp's (registry.getExtension-
@@ -364,6 +370,9 @@ export async function runDevApp(options) {
                 await seed(stack);
             }
         },
+    }).catch((error) => {
+        releaseEphemeralPiiKms();
+        throw error;
     });
     if (options.welcomeBanner) {
         const overrides = typeof options.welcomeBanner === "object" ? options.welcomeBanner : {};
@@ -382,7 +391,17 @@ export async function runDevApp(options) {
         // biome-ignore lint/suspicious/noConsole: boot-time UX print, opt-in via welcomeBanner.
         console.log(`\n${banner}\n`);
     }
-    return handle;
+    return {
+        ...handle,
+        stop: async () => {
+            try {
+                await handle.stop();
+            }
+            finally {
+                releaseEphemeralPiiKms();
+            }
+        },
+    };
 }
 // Exported for the wiring-contract test (config-resolver-default.integration):
 // pins that the dev configResolver-default carries the ENV→app-override bridge

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.359.0",
+  "version": "0.361.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -64,11 +64,11 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.359.0",
-    "@cosmicdrift/kumiko-framework": "0.359.0",
-    "@cosmicdrift/kumiko-headless": "0.359.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.359.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.359.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.361.0",
+    "@cosmicdrift/kumiko-framework": "0.361.0",
+    "@cosmicdrift/kumiko-headless": "0.361.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.361.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.361.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "breaking",
+    "title": "runDevApp encrypts PII on ephemeral dev DBs by default",
+    "detail": "Without a kms option, runDevApp now configures an InMemoryKmsAdapter and a random blind-index key when KUMIKO_DEV_DB_NAME is unset. With a persistent dev DB nothing changes (plaintext plus warning, pass createPgKmsAdapter to encrypt). RunDevAppOptions.kms also accepts false for explicit plaintext. An app-provided kms keeps its previous behavior, including the boot abort for lookupable fields without a blindIndexKey.",
+    "migration": "e2e or dev scripts that read PII columns raw must decrypt them or pass kms false to runDevApp. Apps that pass their own kms are unaffected."
+  },
   {
     "version": "0.354.0",
     "type": "fix",