@cosmicdrift/kumiko-dev-server 0.363.0 → 0.365.0

package/dist/build-server-bundle.js

@@ -110,9 +110,9 @@ export async function buildServerBundle(options = {}) {
     await mkdir(outDir, { recursive: true });
     // Ein Bun.build-Call mit allen Entries + splitting → das Framework wird
     // einmal als shared chunk abgelegt statt pro Entry inlined.
-    const optionalSiblingEntries = ["worker.ts", "bootstrap.ts"]
-        .map((file) => join(dirname(serverEntry), file))
-        .filter((path) => existsSync(path));
+    const optionalSiblingEntries = ["worker", "bootstrap"]
+        .map((baseName) => discoverSiblingEntry(dirname(serverEntry), baseName))
+        .filter((path) => path !== undefined);
     const entrypoints = [serverEntry, ...(kumikoCli ? [kumikoCli] : []), ...optionalSiblingEntries];
     const result = await Bun.build({
         entrypoints,
@@ -162,12 +162,15 @@ export async function buildServerBundle(options = {}) {
     return { outDir, entries, chunks, totalBytes, runtimeDeps };
 }
 export function discoverServerEntry(cwd) {
-    const tsEntry = join(cwd, "bin/main.ts");
-    if (existsSync(tsEntry))
-        return tsEntry;
-    const jsEntry = join(cwd, "bin/main.js");
-    if (existsSync(jsEntry))
-        return jsEntry;
+    return discoverSiblingEntry(join(cwd, "bin"), "main");
+}
+// `.ts` wins over `.js`, same precedence for the server entry and its siblings.
+function discoverSiblingEntry(dir, baseName) {
+    for (const extension of [".ts", ".js"]) {
+        const candidate = join(dir, `${baseName}${extension}`);
+        if (existsSync(candidate))
+            return candidate;
+    }
     return undefined;
 }
 // Walking up vom App-cwd bis ein Verzeichnis mit `bin/kumiko.ts` gefunden wird.

package/dist/cli.d.ts

@@ -2,4 +2,3 @@ export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildRes
 export { formatScanWarning, runCodegen } from "./codegen/index.js";
 export { createCrashTracker } from "./crash-tracker.js";
 export { runInitDeployCli } from "./init-deploy-cli.js";
-export { implicitAuthModeFeatureNames, resolveGeneratePath } from "./schema-check-core.js";

package/dist/cli.js

@@ -6,4 +6,3 @@ export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildRes
 export { formatScanWarning, runCodegen } from "./codegen/index.js";
 export { createCrashTracker } from "./crash-tracker.js";
 export { runInitDeployCli } from "./init-deploy-cli.js";
-export { implicitAuthModeFeatureNames, resolveGeneratePath } from "./schema-check-core.js";

package/dist/compose-stacks.d.ts

@@ -2,6 +2,7 @@ import { type AuthMfaFeatureOptions } from "@cosmicdrift/kumiko-bundled-features
 import { type LegalPagesOptions } from "@cosmicdrift/kumiko-bundled-features/legal-pages";
 import { type UserDataRightsOptions } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type MailBrandSuffixResolver, type MailFooterResolver } from "@cosmicdrift/kumiko-renderer-mail-html";
 export type FileProviderKind = "inmemory" | "s3" | "s3-env";
 export type MailTransportKind = "inmemory" | "smtp";
 export type GdprStackOrder = "retention-first" | "compliance-first";
@@ -48,7 +49,13 @@ export type IdentityStackOptions = {
 };
 export declare function stackFeatureNames(features: readonly FeatureDefinition[]): string[];
 export declare function composePagesStack(options?: PagesStackOptions): FeatureDefinition[];
-export declare function composeRendererStack(): FeatureDefinition[];
+export type RendererStackOptions = {
+    /** Platform imprint, privacy link and footer text under every mail; see createRendererMailHtmlFeature. */
+    readonly mailFooter?: MailFooterResolver;
+    /** Word after the tenant name in the mail's brand row, e.g. "Status". */
+    readonly mailBrandSuffix?: MailBrandSuffixResolver;
+};
+export declare function composeRendererStack(options?: RendererStackOptions): FeatureDefinition[];
 export declare function composeMailStack(options: MailStackOptions): FeatureDefinition[];
 export declare function composeFileStack(options: FileStackOptions): FeatureDefinition[];
 /** Retention + compliance (+ optional lifecycle/sessions). UDR/files mount separately — order varies per app. */

package/dist/compose-stacks.js

@@ -30,7 +30,7 @@ import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-featu
 import { createTenantLifecycleFeature } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
 import { createUserDataRightsFeature, } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
 import { createUserDataRightsDefaultsFeature } from "@cosmicdrift/kumiko-bundled-features/user-data-rights-defaults";
-import { createRendererMailHtmlFeature } from "@cosmicdrift/kumiko-renderer-mail-html";
+import { createRendererMailHtmlFeature, } from "@cosmicdrift/kumiko-renderer-mail-html";
 export function stackFeatureNames(features) {
     return features.map((f) => f.name);
 }
@@ -44,11 +44,14 @@ export function composePagesStack(options = {}) {
         createLegalPagesFeature(options.wrapLayout !== undefined ? { wrapLayout: options.wrapLayout } : {}),
     ];
 }
-export function composeRendererStack() {
+export function composeRendererStack(options = {}) {
     return [
         createTemplateResolverFeature(),
         createRendererFoundationFeature(),
-        createRendererMailHtmlFeature(),
+        createRendererMailHtmlFeature({
+            ...(options.mailFooter !== undefined && { footer: options.mailFooter }),
+            ...(options.mailBrandSuffix !== undefined && { brandSuffix: options.mailBrandSuffix }),
+        }),
     ];
 }
 export function composeMailStack(options) {

package/dist/index.d.ts

@@ -11,7 +11,7 @@ export { runInitDeployCli } from "./init-deploy-cli.js";
 export type { RunDevAppAuthOptions, RunDevAppOptions, SeedFn } from "./run-dev-app.js";
 export { runDevApp } from "./run-dev-app.js";
 export type { ScaffoldAppOptions, ScaffoldAppResult, ScaffoldFeatureEntry, } from "./scaffold-app.js";
-export { scaffoldApp } from "./scaffold-app.js";
+export { SCAFFOLD_BIOME_VERSION, scaffoldApp } from "./scaffold-app.js";
 export type { ScaffoldAppFeatureOptions, ScaffoldAppFeatureResult, } from "./scaffold-app-feature.js";
 export { runConfigPathForApp, scaffoldAppFeature } from "./scaffold-app-feature.js";
 export type { CheckDeployDriftResult, DeployDriftEntry, RenderDeployFilesOptions, RenderDeployFilesResult, RenderedDeployFile, ScaffoldDeployDetected, ScaffoldDeployOptions, ScaffoldDeployResult, ScaffoldedFile, } from "./scaffold-deploy.js";

package/dist/index.js

@@ -25,7 +25,7 @@ export { buildFewShotCorpus, pathToId } from "./few-shot-corpus.js";
 export { resolveFrameworkVersion } from "./framework-version.js";
 export { runInitDeployCli } from "./init-deploy-cli.js";
 export { runDevApp } from "./run-dev-app.js";
-export { scaffoldApp } from "./scaffold-app.js";
+export { SCAFFOLD_BIOME_VERSION, scaffoldApp } from "./scaffold-app.js";
 export { runConfigPathForApp, scaffoldAppFeature } from "./scaffold-app-feature.js";
 export { checkDeployDrift, renderDeployFiles, scaffoldDeploy } from "./scaffold-deploy.js";
 export { scaffoldFeature } from "./scaffold-feature.js";

package/dist/resolve-dev-pii-kms.d.ts

@@ -2,6 +2,8 @@ import { type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 export type DevPiiKmsResolution = {
     readonly kms: KmsAdapter | undefined;
     readonly blindIndexKey: string | undefined;
+    /** True only when the ephemeral default minted the key, not when the app passed one. */
+    readonly generatedBlindIndexKey: boolean;
     readonly mode: "app-kms" | "ephemeral-default" | "plaintext";
 };
 type DevPiiKmsOptions = {

package/dist/resolve-dev-pii-kms.js

@@ -8,7 +8,9 @@ export function captureEphemeralDevPiiKms(resolution) {
     if (resolution.mode !== "ephemeral-default")
         return () => { };
     const ownKms = configuredPiiSubjectKms();
-    const ownBlindIndexKey = configuredBlindIndexKey();
+    const ownBlindIndexKey = resolution.generatedBlindIndexKey
+        ? configuredBlindIndexKey()
+        : undefined;
     return () => {
         if (ownKms !== undefined && configuredPiiSubjectKms() === ownKms) {
             configurePiiSubjectKms(undefined);
@@ -20,14 +22,25 @@ export function captureEphemeralDevPiiKms(resolution) {
 }
 export function resolveDevPiiKms(options, env = process.env) {
     if (options.kms !== undefined && options.kms !== false) {
-        return { kms: options.kms, blindIndexKey: options.blindIndexKey, mode: "app-kms" };
+        return {
+            kms: options.kms,
+            blindIndexKey: options.blindIndexKey,
+            generatedBlindIndexKey: false,
+            mode: "app-kms",
+        };
     }
     if (options.kms === false || isPersistentDevDb(env)) {
-        return { kms: undefined, blindIndexKey: options.blindIndexKey, mode: "plaintext" };
+        return {
+            kms: undefined,
+            blindIndexKey: options.blindIndexKey,
+            generatedBlindIndexKey: false,
+            mode: "plaintext",
+        };
     }
     return {
         kms: new InMemoryKmsAdapter(),
         blindIndexKey: options.blindIndexKey ?? randomBytes(32).toString("base64"),
+        generatedBlindIndexKey: options.blindIndexKey === undefined,
         mode: "ephemeral-default",
     };
 }

package/dist/run-dev-app.js

@@ -22,7 +22,7 @@ import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { createInMemoryLoginRateLimiter, parseTrustedProxyHopsEnv, TRUSTED_PROXY_HOPS_ENV, } from "@cosmicdrift/kumiko-framework/api";
 import { configureBlindIndexKey, configurePiiSubjectKms, } from "@cosmicdrift/kumiko-framework/crypto";
 import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
-import { collectWriteHandlerQns, createRegistry, FILE_STORAGE_PROVIDER_BOOT_SENTINEL, FILE_STORAGE_PROVIDER_ENV, findTierResolverUsage, isTierResolverPlugin, validateAppCustomScreenWriteQns, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
+import { collectWriteHandlerQns, createRegistry, FILE_STORAGE_PROVIDER_BOOT_SENTINEL, FILE_STORAGE_PROVIDER_ENV, findTierResolverUsage, requireTierResolverPlugin, validateAppCustomScreenWriteQns, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { applyBootSeeds } from "@cosmicdrift/kumiko-server-runtime/boot/apply-boot-seeds";
 import { resolveBootCrypto } from "@cosmicdrift/kumiko-server-runtime/boot/boot-crypto";
@@ -67,7 +67,13 @@ export async function runDevApp(options) {
     // die früher nur runProdApp fing und sonst erst den Prod-Pod im
     // CrashLoopBackOff sterben ließ (#359). Wirft synchron, bevor ein
     // Socket oder Watcher (codegen-Write) aufgeht.
-    validateBoot(features, bootOptions);
+    // Resolved before validateBoot: an app-supplied masterKey provider must satisfy the
+    // encrypted-field gate here exactly as it does in runProdApp.
+    const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
+    validateBoot(features, {
+        ...(bootCrypto.entityFieldCipher && { entityFieldCipher: bootCrypto.entityFieldCipher }),
+        ...bootOptions,
+    });
     warnIfNonUtcServerTimeZone();
     validateAppCustomScreenWriteQns(process.cwd(), collectWriteHandlerQns(features));
     // Codegen + File-Watcher — schreibt `<appRoot>/.kumiko/types.generated.d.ts`
@@ -122,7 +128,6 @@ export async function runDevApp(options) {
     // throwaway-Registry hier extrahiert nur die config-Keys, weil der
     // configResolver vor dem Server-Boot konstruiert wird (stack.registry
     // gibt's erst onAfterSetup) — createKumikoServer baut intern seine eigene.
-    const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
     // App-wide cipher for `encrypted: true` entity fields (symmetrisch zu
     // runProdApp) — executors resolve it lazily.
     configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
@@ -197,6 +202,13 @@ export async function runDevApp(options) {
     let tokenVerifier;
     const patFeature = features.find((f) => f.name === PAT_FEATURE);
     const mfaFeature = features.find((f) => f.name === AUTH_MFA_FEATURE);
+    if (effectiveAuth &&
+        mfaFeature &&
+        registry?.getWriteHandler(AuthHandlers.switchTenantMfaGate) === undefined) {
+        throw new Error(`[runDevApp] auth-mfa is mounted but ${AuthHandlers.switchTenantMfaGate} is not registered: ` +
+            "createAuthEmailPasswordFeature registers it only when mfaStatusChecker is set, and without it " +
+            "POST /auth/switch-tenant would mint sessions without the second factor");
+    }
     const patAuthFragment = patFeature
         ? {
             tokenVerifier: (rawToken) => {
@@ -322,11 +334,7 @@ export async function runDevApp(options) {
             // on the resolver being live (e.g. seed that writes a SystemAdmin's
             // tier-assignment can immediately read tier-cuts).
             if (tierResolverUsage) {
-                const plugin = tierResolverUsage.options;
-                if (!isTierResolverPlugin(plugin)) {
-                    throw new Error("tier-resolver registration options must provide a build() factory");
-                }
-                tierResolverHolder.resolver = await plugin.build({
+                tierResolverHolder.resolver = await requireTierResolverPlugin(tierResolverUsage).build({
                     db: stack.db,
                     registry: stack.registry,
                     cacheSync: stack.cacheSync,

package/dist/scaffold-agent-docs.d.ts

@@ -0,0 +1,3 @@
+export declare const FRAMEWORK_AGENTS_IMPORT = "@node_modules/@cosmicdrift/kumiko-framework/AGENTS.md";
+export declare function renderAgentsMd(): string;
+export declare function renderClaudeMd(): string;

package/dist/scaffold-agent-docs.js

@@ -0,0 +1,17 @@
+export const FRAMEWORK_AGENTS_IMPORT = "@node_modules/@cosmicdrift/kumiko-framework/AGENTS.md";
+const FRAMEWORK_AGENTS_PATH = "node_modules/@cosmicdrift/kumiko-framework/AGENTS.md";
+const FRAMEWORK_AGENTS_DIR = "node_modules/@cosmicdrift/kumiko-framework/agents/";
+export function renderAgentsMd() {
+    return `# Agent instructions
+
+This app is built on Kumiko. The framework guide for coding agents ships with the installed package and matches its version:
+
+- \`${FRAMEWORK_AGENTS_PATH}\`: start here.
+- \`${FRAMEWORK_AGENTS_DIR}\`: generated indexes of bundled features, widgets and tested examples.
+
+Read the framework guide before you add or change a feature. App-specific rules go below.
+`;
+}
+export function renderClaudeMd() {
+    return `${FRAMEWORK_AGENTS_IMPORT}\n@AGENTS.md\n`;
+}

package/dist/scaffold-app-feature.js

@@ -8,8 +8,7 @@
 // Auto-mount via ts-morph: opens src/run-config.ts, finds
 // `export const APP_FEATURES = [...]`, prepends import + appends entry.
 // User's promise "defineFeature → nichts woanders eintragen" is met
-// for the run-config side. Drizzle FEATURE_IMPORT_REGISTRY is NOT
-// touched here — DX-4 auto-discovery resolves that.
+// for the run-config side; the schema is derived from the mounted features.
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { Project, SyntaxKind } from "ts-morph";

package/dist/scaffold-app.d.ts

@@ -16,6 +16,7 @@ export type ScaffoldTestSetupFactory = (input: {
     readonly appName: string;
     readonly frameworkVersion: string;
 }) => ScaffoldTestSetup;
+export declare const SCAFFOLD_BIOME_VERSION = "2.5.7";
 export type ScaffoldAppOptions = {
     /** kebab-case app name (e.g. "my-shop"). Becomes package-name + folder. */
     readonly name: string;