@cosmicdrift/kumiko-dev-server 0.364.0 → 0.365.0

package/dist/build-server-bundle.js

@@ -110,9 +110,9 @@ export async function buildServerBundle(options = {}) {
     await mkdir(outDir, { recursive: true });
     // Ein Bun.build-Call mit allen Entries + splitting → das Framework wird
     // einmal als shared chunk abgelegt statt pro Entry inlined.
-    const optionalSiblingEntries = ["worker.ts", "bootstrap.ts"]
-        .map((file) => join(dirname(serverEntry), file))
-        .filter((path) => existsSync(path));
+    const optionalSiblingEntries = ["worker", "bootstrap"]
+        .map((baseName) => discoverSiblingEntry(dirname(serverEntry), baseName))
+        .filter((path) => path !== undefined);
     const entrypoints = [serverEntry, ...(kumikoCli ? [kumikoCli] : []), ...optionalSiblingEntries];
     const result = await Bun.build({
         entrypoints,
@@ -162,12 +162,15 @@ export async function buildServerBundle(options = {}) {
     return { outDir, entries, chunks, totalBytes, runtimeDeps };
 }
 export function discoverServerEntry(cwd) {
-    const tsEntry = join(cwd, "bin/main.ts");
-    if (existsSync(tsEntry))
-        return tsEntry;
-    const jsEntry = join(cwd, "bin/main.js");
-    if (existsSync(jsEntry))
-        return jsEntry;
+    return discoverSiblingEntry(join(cwd, "bin"), "main");
+}
+// `.ts` wins over `.js`, same precedence for the server entry and its siblings.
+function discoverSiblingEntry(dir, baseName) {
+    for (const extension of [".ts", ".js"]) {
+        const candidate = join(dir, `${baseName}${extension}`);
+        if (existsSync(candidate))
+            return candidate;
+    }
     return undefined;
 }
 // Walking up vom App-cwd bis ein Verzeichnis mit `bin/kumiko.ts` gefunden wird.

package/dist/cli.d.ts

@@ -2,4 +2,3 @@ export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildRes
 export { formatScanWarning, runCodegen } from "./codegen/index.js";
 export { createCrashTracker } from "./crash-tracker.js";
 export { runInitDeployCli } from "./init-deploy-cli.js";
-export { implicitAuthModeFeatureNames, resolveGeneratePath } from "./schema-check-core.js";

package/dist/cli.js

@@ -6,4 +6,3 @@ export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildRes
 export { formatScanWarning, runCodegen } from "./codegen/index.js";
 export { createCrashTracker } from "./crash-tracker.js";
 export { runInitDeployCli } from "./init-deploy-cli.js";
-export { implicitAuthModeFeatureNames, resolveGeneratePath } from "./schema-check-core.js";

package/dist/compose-stacks.d.ts

@@ -2,6 +2,7 @@ import { type AuthMfaFeatureOptions } from "@cosmicdrift/kumiko-bundled-features
 import { type LegalPagesOptions } from "@cosmicdrift/kumiko-bundled-features/legal-pages";
 import { type UserDataRightsOptions } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type MailBrandSuffixResolver, type MailFooterResolver } from "@cosmicdrift/kumiko-renderer-mail-html";
 export type FileProviderKind = "inmemory" | "s3" | "s3-env";
 export type MailTransportKind = "inmemory" | "smtp";
 export type GdprStackOrder = "retention-first" | "compliance-first";
@@ -48,7 +49,13 @@ export type IdentityStackOptions = {
 };
 export declare function stackFeatureNames(features: readonly FeatureDefinition[]): string[];
 export declare function composePagesStack(options?: PagesStackOptions): FeatureDefinition[];
-export declare function composeRendererStack(): FeatureDefinition[];
+export type RendererStackOptions = {
+    /** Platform imprint, privacy link and footer text under every mail; see createRendererMailHtmlFeature. */
+    readonly mailFooter?: MailFooterResolver;
+    /** Word after the tenant name in the mail's brand row, e.g. "Status". */
+    readonly mailBrandSuffix?: MailBrandSuffixResolver;
+};
+export declare function composeRendererStack(options?: RendererStackOptions): FeatureDefinition[];
 export declare function composeMailStack(options: MailStackOptions): FeatureDefinition[];
 export declare function composeFileStack(options: FileStackOptions): FeatureDefinition[];
 /** Retention + compliance (+ optional lifecycle/sessions). UDR/files mount separately — order varies per app. */

package/dist/compose-stacks.js

@@ -30,7 +30,7 @@ import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-featu
 import { createTenantLifecycleFeature } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
 import { createUserDataRightsFeature, } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
 import { createUserDataRightsDefaultsFeature } from "@cosmicdrift/kumiko-bundled-features/user-data-rights-defaults";
-import { createRendererMailHtmlFeature } from "@cosmicdrift/kumiko-renderer-mail-html";
+import { createRendererMailHtmlFeature, } from "@cosmicdrift/kumiko-renderer-mail-html";
 export function stackFeatureNames(features) {
     return features.map((f) => f.name);
 }
@@ -44,11 +44,14 @@ export function composePagesStack(options = {}) {
         createLegalPagesFeature(options.wrapLayout !== undefined ? { wrapLayout: options.wrapLayout } : {}),
     ];
 }
-export function composeRendererStack() {
+export function composeRendererStack(options = {}) {
     return [
         createTemplateResolverFeature(),
         createRendererFoundationFeature(),
-        createRendererMailHtmlFeature(),
+        createRendererMailHtmlFeature({
+            ...(options.mailFooter !== undefined && { footer: options.mailFooter }),
+            ...(options.mailBrandSuffix !== undefined && { brandSuffix: options.mailBrandSuffix }),
+        }),
     ];
 }
 export function composeMailStack(options) {

package/dist/index.d.ts

@@ -11,7 +11,7 @@ export { runInitDeployCli } from "./init-deploy-cli.js";
 export type { RunDevAppAuthOptions, RunDevAppOptions, SeedFn } from "./run-dev-app.js";
 export { runDevApp } from "./run-dev-app.js";
 export type { ScaffoldAppOptions, ScaffoldAppResult, ScaffoldFeatureEntry, } from "./scaffold-app.js";
-export { scaffoldApp } from "./scaffold-app.js";
+export { SCAFFOLD_BIOME_VERSION, scaffoldApp } from "./scaffold-app.js";
 export type { ScaffoldAppFeatureOptions, ScaffoldAppFeatureResult, } from "./scaffold-app-feature.js";
 export { runConfigPathForApp, scaffoldAppFeature } from "./scaffold-app-feature.js";
 export type { CheckDeployDriftResult, DeployDriftEntry, RenderDeployFilesOptions, RenderDeployFilesResult, RenderedDeployFile, ScaffoldDeployDetected, ScaffoldDeployOptions, ScaffoldDeployResult, ScaffoldedFile, } from "./scaffold-deploy.js";

package/dist/index.js

@@ -25,7 +25,7 @@ export { buildFewShotCorpus, pathToId } from "./few-shot-corpus.js";
 export { resolveFrameworkVersion } from "./framework-version.js";
 export { runInitDeployCli } from "./init-deploy-cli.js";
 export { runDevApp } from "./run-dev-app.js";
-export { scaffoldApp } from "./scaffold-app.js";
+export { SCAFFOLD_BIOME_VERSION, scaffoldApp } from "./scaffold-app.js";
 export { runConfigPathForApp, scaffoldAppFeature } from "./scaffold-app-feature.js";
 export { checkDeployDrift, renderDeployFiles, scaffoldDeploy } from "./scaffold-deploy.js";
 export { scaffoldFeature } from "./scaffold-feature.js";

package/dist/resolve-dev-pii-kms.d.ts

@@ -2,6 +2,8 @@ import { type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 export type DevPiiKmsResolution = {
     readonly kms: KmsAdapter | undefined;
     readonly blindIndexKey: string | undefined;
+    /** True only when the ephemeral default minted the key, not when the app passed one. */
+    readonly generatedBlindIndexKey: boolean;
     readonly mode: "app-kms" | "ephemeral-default" | "plaintext";
 };
 type DevPiiKmsOptions = {

package/dist/resolve-dev-pii-kms.js

@@ -8,7 +8,9 @@ export function captureEphemeralDevPiiKms(resolution) {
     if (resolution.mode !== "ephemeral-default")
         return () => { };
     const ownKms = configuredPiiSubjectKms();
-    const ownBlindIndexKey = configuredBlindIndexKey();
+    const ownBlindIndexKey = resolution.generatedBlindIndexKey
+        ? configuredBlindIndexKey()
+        : undefined;
     return () => {
         if (ownKms !== undefined && configuredPiiSubjectKms() === ownKms) {
             configurePiiSubjectKms(undefined);
@@ -20,14 +22,25 @@ export function captureEphemeralDevPiiKms(resolution) {
 }
 export function resolveDevPiiKms(options, env = process.env) {
     if (options.kms !== undefined && options.kms !== false) {
-        return { kms: options.kms, blindIndexKey: options.blindIndexKey, mode: "app-kms" };
+        return {
+            kms: options.kms,
+            blindIndexKey: options.blindIndexKey,
+            generatedBlindIndexKey: false,
+            mode: "app-kms",
+        };
     }
     if (options.kms === false || isPersistentDevDb(env)) {
-        return { kms: undefined, blindIndexKey: options.blindIndexKey, mode: "plaintext" };
+        return {
+            kms: undefined,
+            blindIndexKey: options.blindIndexKey,
+            generatedBlindIndexKey: false,
+            mode: "plaintext",
+        };
     }
     return {
         kms: new InMemoryKmsAdapter(),
         blindIndexKey: options.blindIndexKey ?? randomBytes(32).toString("base64"),
+        generatedBlindIndexKey: options.blindIndexKey === undefined,
         mode: "ephemeral-default",
     };
 }

package/dist/run-dev-app.js

@@ -22,7 +22,7 @@ import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { createInMemoryLoginRateLimiter, parseTrustedProxyHopsEnv, TRUSTED_PROXY_HOPS_ENV, } from "@cosmicdrift/kumiko-framework/api";
 import { configureBlindIndexKey, configurePiiSubjectKms, } from "@cosmicdrift/kumiko-framework/crypto";
 import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
-import { collectWriteHandlerQns, createRegistry, FILE_STORAGE_PROVIDER_BOOT_SENTINEL, FILE_STORAGE_PROVIDER_ENV, findTierResolverUsage, isTierResolverPlugin, validateAppCustomScreenWriteQns, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
+import { collectWriteHandlerQns, createRegistry, FILE_STORAGE_PROVIDER_BOOT_SENTINEL, FILE_STORAGE_PROVIDER_ENV, findTierResolverUsage, requireTierResolverPlugin, validateAppCustomScreenWriteQns, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { applyBootSeeds } from "@cosmicdrift/kumiko-server-runtime/boot/apply-boot-seeds";
 import { resolveBootCrypto } from "@cosmicdrift/kumiko-server-runtime/boot/boot-crypto";
@@ -202,6 +202,13 @@ export async function runDevApp(options) {
     let tokenVerifier;
     const patFeature = features.find((f) => f.name === PAT_FEATURE);
     const mfaFeature = features.find((f) => f.name === AUTH_MFA_FEATURE);
+    if (effectiveAuth &&
+        mfaFeature &&
+        registry?.getWriteHandler(AuthHandlers.switchTenantMfaGate) === undefined) {
+        throw new Error(`[runDevApp] auth-mfa is mounted but ${AuthHandlers.switchTenantMfaGate} is not registered: ` +
+            "createAuthEmailPasswordFeature registers it only when mfaStatusChecker is set, and without it " +
+            "POST /auth/switch-tenant would mint sessions without the second factor");
+    }
     const patAuthFragment = patFeature
         ? {
             tokenVerifier: (rawToken) => {
@@ -327,11 +334,7 @@ export async function runDevApp(options) {
             // on the resolver being live (e.g. seed that writes a SystemAdmin's
             // tier-assignment can immediately read tier-cuts).
             if (tierResolverUsage) {
-                const plugin = tierResolverUsage.options;
-                if (!isTierResolverPlugin(plugin)) {
-                    throw new Error("tier-resolver registration options must provide a build() factory");
-                }
-                tierResolverHolder.resolver = await plugin.build({
+                tierResolverHolder.resolver = await requireTierResolverPlugin(tierResolverUsage).build({
                     db: stack.db,
                     registry: stack.registry,
                     cacheSync: stack.cacheSync,

package/dist/scaffold-app-feature.js

@@ -8,8 +8,7 @@
 // Auto-mount via ts-morph: opens src/run-config.ts, finds
 // `export const APP_FEATURES = [...]`, prepends import + appends entry.
 // User's promise "defineFeature → nichts woanders eintragen" is met
-// for the run-config side. Drizzle FEATURE_IMPORT_REGISTRY is NOT
-// touched here — DX-4 auto-discovery resolves that.
+// for the run-config side; the schema is derived from the mounted features.
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { Project, SyntaxKind } from "ts-morph";

package/dist/scaffold-app.d.ts

@@ -16,6 +16,7 @@ export type ScaffoldTestSetupFactory = (input: {
     readonly appName: string;
     readonly frameworkVersion: string;
 }) => ScaffoldTestSetup;
+export declare const SCAFFOLD_BIOME_VERSION = "2.5.7";
 export type ScaffoldAppOptions = {
     /** kebab-case app name (e.g. "my-shop"). Becomes package-name + folder. */
     readonly name: string;

package/dist/scaffold-app.js

@@ -6,19 +6,28 @@
 // stub, package.json with @cosmicdrift/* deps, tsconfig, .env.example,
 // README.
 //
-// .ts files are built via ts-morph (same tool [[scaffoldAppFeature]] uses
-// to auto-mount features). Means a single AST representation for both
-// generate + later modify — no template-string ↔ ts-morph divergence.
+// Generated files are emitted already formatted to Biome's output (import
+// order, 100-col wrapping, trailing commas) so a fresh app passes `biome check`.
 // Static files (package.json, tsconfig, .env, README) stay text-based.
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { collectTableMetas, generateMigration, writeSnapshotJson, } from "@cosmicdrift/kumiko-framework/db";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
-import { IndentationText, Project, VariableDeclarationKind } from "ts-morph";
 import { isKebabSegment } from "./kebab.js";
 import { renderAgentsMd, renderClaudeMd } from "./scaffold-agent-docs.js";
 import { createDemoTasksFeature, renderDemoSeedFile, renderDemoTasksFeatureFile, renderDemoTasksI18n, renderDemoTasksIndex, renderDemoTasksWebIndex, } from "./scaffold-demo-tasks.js";
 import { scaffoldDeploy } from "./scaffold-deploy.js";
+// Exact pin (no caret): the generated files are formatted to this Biome's output,
+// and a scaffold-lint test keeps it equal to the monorepo's own Biome version.
+export const SCAFFOLD_BIOME_VERSION = "2.5.7";
+const SCAFFOLD_GITIGNORE = `node_modules/
+dist/
+dist-server/
+.env
+.kumiko/
+test-results/
+playwright-report/
+`;
 export async function scaffoldApp(options) {
     if (!isKebabSegment(options.name)) {
         throw new Error(`scaffoldApp: name must be kebab-case (a-z, 0-9, -); got "${options.name}"`);
@@ -42,6 +51,8 @@ export async function scaffoldApp(options) {
     files.push("kumiko.json");
     write(join(destination, "biome.json"), renderBiomeJson());
     files.push("biome.json");
+    write(join(destination, ".gitignore"), SCAFFOLD_GITIGNORE);
+    files.push(".gitignore");
     if (testSetup === undefined) {
         write(join(destination, "bunfig.toml"), renderBunfigToml());
         files.push("bunfig.toml");
@@ -132,7 +143,7 @@ function renderPackageJson(name, version, testSetup) {
             zod: "^4.4.3",
         },
         devDependencies: sortedByName({
-            "@biomejs/biome": "^2.4.15",
+            "@biomejs/biome": SCAFFOLD_BIOME_VERSION,
             "@tailwindcss/cli": "^4.3.0",
             "@types/react": "^19.2.0",
             "@types/react-dom": "^19.2.0",
@@ -168,7 +179,7 @@ function renderTsconfig() {
 }
 function renderBiomeJson() {
     return `${JSON.stringify({
-        $schema: "https://biomejs.dev/schemas/2.4.15/schema.json",
+        $schema: `https://biomejs.dev/schemas/${SCAFFOLD_BIOME_VERSION}/schema.json`,
         vcs: {
             enabled: true,
             clientKind: "git",
@@ -209,7 +220,7 @@ function renderBiomeJson() {
         linter: {
             enabled: true,
             rules: {
-                recommended: true,
+                preset: "recommended",
                 correctness: { noUnusedVariables: "error", noUnusedImports: "error" },
                 suspicious: { noExplicitAny: "error", noDebugger: "error", noConsole: "warn" },
                 complexity: { useLiteralKeys: "off" },
@@ -254,13 +265,6 @@ pathIgnorePatterns = [
 ]
 `;
 }
-function newTsProject() {
-    return new Project({
-        useInMemoryFileSystem: true,
-        compilerOptions: { target: 99, module: 99, strict: true },
-        manipulationSettings: { indentationText: IndentationText.TwoSpaces },
-    });
-}
 const FOUNDATION_FEATURES = [
     {
         name: "secrets",
@@ -289,9 +293,40 @@ const FOUNDATION_FEATURES = [
 // jemand scaffoldApp() direkt mit allen Bundled-Feature-Entries aufruft
 // rutschen die 4 nicht in run-config.ts.
 const COMPOSE_AUTO_MOUNTED_NAMES = new Set(["config", "user", "tenant", "auth-email-password"]);
+const MAX_LINE_WIDTH = 100;
+// Mirrors Biome's import sort so generated files pass `biome check` untouched:
+// packages alphabetically by specifier, relative paths last.
+function compareImportKeys(a, b) {
+    const lowerA = a.replace(/^type /, "").toLowerCase();
+    const lowerB = b.replace(/^type /, "").toLowerCase();
+    if (lowerA !== lowerB)
+        return lowerA < lowerB ? -1 : 1;
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function isRelativeSpecifier(specifier) {
+    return specifier.startsWith("./") || specifier.startsWith("../");
+}
+function renderImportLine({ specifier, names, typeOnly }) {
+    const sorted = [...names].sort(compareImportKeys);
+    const keyword = typeOnly === true ? "import type" : "import";
+    const oneLine = `${keyword} { ${sorted.join(", ")} } from "${specifier}";`;
+    if (sorted.length === 1 || oneLine.length <= MAX_LINE_WIDTH)
+        return oneLine;
+    return `${keyword} {\n${sorted.map((n) => `  ${n},`).join("\n")}\n} from "${specifier}";`;
+}
+function renderSortedImports(imports) {
+    return [...imports]
+        .sort((a, b) => {
+        const relativeA = isRelativeSpecifier(a.specifier);
+        const relativeB = isRelativeSpecifier(b.specifier);
+        if (relativeA !== relativeB)
+            return relativeA ? 1 : -1;
+        return compareImportKeys(a.specifier, b.specifier);
+    })
+        .map(renderImportLine)
+        .join("\n");
+}
 function renderRunConfig(features) {
-    const project = newTsProject();
-    const sf = project.createSourceFile("run-config.ts", "");
     // Fallback decided BEFORE filtering: if the caller passed features (even
     // if every one of them is an auto-mounted name), an all-filtered-out empty
     // result is the correct outcome — falling back to FOUNDATION_FEATURES here
@@ -306,289 +341,215 @@ function renderRunConfig(features) {
             existing.push(entry.exportName);
         grouped.set(entry.importPath, existing);
     }
-    for (const [importPath, namedImports] of grouped) {
-        sf.addImportDeclaration({ moduleSpecifier: importPath, namedImports });
-    }
-    sf.addImportDeclaration({
-        moduleSpecifier: "./features/tasks",
-        namedImports: ["tasksFeature"],
-    });
+    const imports = [
+        ...[...grouped].map(([specifier, names]) => ({ specifier, names })),
+        { specifier: "./features/tasks", names: ["tasksFeature"] },
+    ];
     const callExprs = [...effective.map((f) => f.callExpression), "tasksFeature"];
-    sf.addVariableStatement({
-        declarationKind: VariableDeclarationKind.Const,
-        isExported: true,
-        declarations: [
-            {
-                name: "APP_FEATURES",
-                initializer: `[${callExprs.join(", ")}] as const`,
-            },
-        ],
-    });
-    sf.addVariableStatement({
-        declarationKind: VariableDeclarationKind.Const,
-        isExported: true,
-        declarations: [{ name: "HAS_AUTH", initializer: "true" }],
-    });
-    sf.insertText(0, [
-        "// Single source of truth for your app's feature composition.",
-        "// config/user/tenant/auth-email-password are added automatically",
-        "// via composeFeatures(includeBundled:true) when runProdApp is called",
-        "// with `auth: {…}` (see bin/main.ts).",
-        "//",
-        "// Add new features:",
-        "//   - bunx @cosmicdrift/kumiko-cli add feature <name>  (DX-2, automatic)",
-        "//   - or: hand-edit + add the import below",
-        "",
-        "",
-    ].join("\n"));
-    return sf.getFullText();
+    const oneLineFeatures = `export const APP_FEATURES = [${callExprs.join(", ")}] as const;`;
+    const appFeatures = oneLineFeatures.length <= MAX_LINE_WIDTH
+        ? oneLineFeatures
+        : `export const APP_FEATURES = [\n${callExprs.map((c) => `  ${c},`).join("\n")}\n] as const;`;
+    return `// Single source of truth for your app's feature composition.
+// config/user/tenant/auth-email-password are added automatically
+// via composeFeatures(includeBundled:true) when runProdApp is called
+// with \`auth: {…}\` (see bin/main.ts).
+//
+// Add new features:
+//   - bunx @cosmicdrift/kumiko-cli add feature <name>  (DX-2, automatic)
+//   - or: hand-edit + add the import below
+
+${renderSortedImports(imports)}
+
+${appFeatures}
+
+export const HAS_AUTH = true;
+`;
+}
+function renderAdminAuthBlock(appName, extraAdminLines) {
+    const passwordAndExtras = extraAdminLines.map((l) => `      ${l}`).join("\n");
+    return `  auth: {
+    admin: {
+      email: "admin@${appName}.local",
+${passwordAndExtras}
+      memberships: [
+        {
+          tenantId: DEFAULT_TENANT_ID,
+          tenantKey: "${appName}",
+          tenantName: "${appName}",
+          roles: ["TenantAdmin"],
+        },
+      ],
+    },
+  },`;
 }
 function renderMain(appName) {
     const tenantId = deriveTenantId(appName);
-    const project = newTsProject();
-    const sf = project.createSourceFile("main.ts", "");
-    sf.addImportDeclaration({
-        moduleSpecifier: "@cosmicdrift/kumiko-dev-server/env-schema",
-        namedImports: ["frameworkCoreEnvSchema"],
-    });
-    sf.addImportDeclaration({
-        moduleSpecifier: "@cosmicdrift/kumiko-server-runtime",
-        namedImports: ["composeFeatures", "runProdApp"],
-    });
-    sf.addImportDeclaration({
-        moduleSpecifier: "@cosmicdrift/kumiko-framework/engine",
-        isTypeOnly: true,
-        namedImports: ["TenantId"],
-    });
-    sf.addImportDeclaration({
-        moduleSpecifier: "@cosmicdrift/kumiko-framework/env",
-        namedImports: ["composeEnvSchema"],
-    });
-    sf.addImportDeclaration({
-        moduleSpecifier: "@cosmicdrift/kumiko-framework/crypto",
-        namedImports: ["requireKmsWiring", "resolveKmsWiring"],
-    });
-    sf.addImportDeclaration({
-        moduleSpecifier: "../src/run-config",
-        namedImports: ["APP_FEATURES", "HAS_AUTH"],
-    });
-    sf.addVariableStatement({
-        declarationKind: VariableDeclarationKind.Const,
-        declarations: [
-            {
-                name: "DEFAULT_TENANT_ID",
-                initializer: `"${tenantId}" as TenantId`,
-            },
-        ],
-    });
-    // The envSchema must cover the SAME features runProdApp mounts at boot.
-    // `auth: { admin: … }` below makes runProdApp auto-mix config/user/tenant/
-    // auth-email-password via composeFeatures(includeBundled:HAS_AUTH); compose the
-    // identical set here so the auth feature's JWT_SECRET (min-32) declaration
-    // is part of the boot-gate — otherwise a too-short JWT_SECRET slips through.
-    sf.addVariableStatement({
-        declarationKind: VariableDeclarationKind.Const,
-        declarations: [
-            {
-                name: "bootFeatures",
-                initializer: "composeFeatures(APP_FEATURES, { includeBundled: HAS_AUTH })",
-            },
-        ],
-    });
-    sf.addVariableStatement({
-        declarationKind: VariableDeclarationKind.Const,
-        declarations: [
-            {
-                name: "envSchema",
-                initializer: "composeEnvSchema({ core: frameworkCoreEnvSchema, features: bootFeatures })",
-            },
-        ],
-    });
-    // Subject-key KMS for the pii-annotated entities the --yes recommended set
-    // mounts (user, tenant-invitation, fileRef). Local/dev may omit the trio
-    // (plaintext + loud warning); NODE_ENV=production uses requireKmsWiring so
-    // a real deploy cannot silently store plaintext PII (fw#2317 / #2339).
-    // assertPiiBootInvariants already warns on the plaintext path — no duplicate console.warn.
-    sf.addVariableStatement({
-        declarationKind: VariableDeclarationKind.Const,
-        declarations: [
-            {
-                name: "kmsOpts",
-                initializer: (writer) => {
-                    writer.write("{").newLine();
-                    writer.writeLine(`  logPrefix: "[${appName}]",`);
-                    writer.writeLine(`  plaintextReason: "no PLATFORM_KEK / SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY set — see .env.example",`);
-                    writer.write("} as const");
-                },
-            },
-        ],
-    });
-    sf.addVariableStatement({
-        declarationKind: VariableDeclarationKind.Const,
-        declarations: [
-            {
-                name: "kmsWiring",
-                initializer: (writer) => {
-                    writer.write(`process.env["NODE_ENV"] === "production"`);
-                    writer.newLine();
-                    writer.write("  ? requireKmsWiring(process.env, kmsOpts)");
-                    writer.newLine();
-                    writer.write("  : resolveKmsWiring(process.env, kmsOpts)");
-                },
-            },
-        ],
-    });
-    sf.addStatements((writer) => {
-        writer
-            .write("await runProdApp(")
-            .inlineBlock(() => {
-            writer.writeLine("features: APP_FEATURES,");
-            writer.writeLine("envSchema,");
-            writer.writeLine('staticDir: "./dist",');
-            writer.writeLine("...kmsWiring,");
-            writer.write("auth: ").inlineBlock(() => {
-                writer.write("admin: ").inlineBlock(() => {
-                    writer.writeLine(`email: "admin@${appName}.local",`);
-                    writer.writeLine(`password: "change-me-on-first-deploy",`);
-                    writer.writeLine(`displayName: "Admin",`);
-                    writer.write("memberships: [");
-                    writer.indent(() => {
-                        writer.inlineBlock(() => {
-                            writer.writeLine("tenantId: DEFAULT_TENANT_ID,");
-                            writer.writeLine(`tenantKey: "${appName}",`);
-                            writer.writeLine(`tenantName: "${appName}",`);
-                            writer.writeLine(`roles: ["TenantAdmin"],`);
-                        });
-                        writer.write(",");
-                    });
-                    writer.write("],");
-                });
-            });
-        })
-            .write(");");
-    });
-    sf.insertText(0, [
-        "// Production-bootstrap. KUMIKO_DRY_RUN_ENV=boot exits after",
-        "// composeFeatures + validateBoot + createRegistry without DB/Redis-connect",
-        "// (see @cosmicdrift/kumiko-server-runtime runProdApp). The real dev boot",
-        "// runs via `bunx kumiko dev` (in-repo dev-tool) with a Docker stack — DX-1.0",
-        "// only covers the boot-mode path; `kumiko dev` lands in a later DX phase.",
-        "",
-        "",
-    ].join("\n"));
-    return sf.getFullText();
+    const imports = renderSortedImports([
+        { specifier: "@cosmicdrift/kumiko-dev-server/env-schema", names: ["frameworkCoreEnvSchema"] },
+        { specifier: "@cosmicdrift/kumiko-server-runtime", names: ["composeFeatures", "runProdApp"] },
+        { specifier: "@cosmicdrift/kumiko-framework/engine", names: ["TenantId"], typeOnly: true },
+        { specifier: "@cosmicdrift/kumiko-framework/env", names: ["composeEnvSchema"] },
+        {
+            specifier: "@cosmicdrift/kumiko-framework/crypto",
+            names: ["requireKmsWiring", "resolveKmsWiring"],
+        },
+        { specifier: "zod", names: ["z"] },
+        { specifier: "../src/run-config", names: ["APP_FEATURES", "HAS_AUTH"] },
+    ]);
+    const authBlock = renderAdminAuthBlock(appName, [
+        "// runProdApp validates envSchema before seeding: a missing or short value aborts the boot.",
+        'password: process.env["DEMO_ADMIN_PASSWORD"] ?? "",',
+        'displayName: "Admin",',
+    ]);
+    // The envSchema must cover the SAME features runProdApp mounts at boot:
+    // `auth: { admin: … }` makes runProdApp auto-mix config/user/tenant/
+    // auth-email-password, so the JWT_SECRET (min-32) declaration has to be part
+    // of the boot-gate here too. Subject-key KMS is optional locally (plaintext +
+    // loud warning) but required under NODE_ENV=production (fw#2317 / #2339).
+    return `// Production-bootstrap. KUMIKO_DRY_RUN_ENV=boot exits after
+// composeFeatures + validateBoot + createRegistry without DB/Redis-connect
+// (see @cosmicdrift/kumiko-server-runtime runProdApp). The real dev boot
+// runs via \`bunx kumiko dev\` (in-repo dev-tool) with a Docker stack — DX-1.0
+// only covers the boot-mode path; \`kumiko dev\` lands in a later DX phase.
+
+${imports}
+
+const DEFAULT_TENANT_ID = "${tenantId}" as TenantId;
+
+const bootFeatures = composeFeatures(APP_FEATURES, { includeBundled: HAS_AUTH });
+
+const envSchema = composeEnvSchema({
+  core: frameworkCoreEnvSchema,
+  features: bootFeatures,
+  extend: z.object({
+    DEMO_ADMIN_PASSWORD: z
+      .string()
+      .min(12)
+      .describe(
+        "Password of the admin seeded on first boot (admin@${appName}.local). Generate with: openssl rand -hex 24",
+      )
+      .meta({ kumiko: { pulumi: { secret: true } } }),
+  }),
+});
+
+const kmsOpts = {
+  logPrefix: "[${appName}]",
+  plaintextReason:
+    "no PLATFORM_KEK / SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY set — see .env.example",
+} as const;
+
+const kmsWiring =
+  process.env["NODE_ENV"] === "production"
+    ? requireKmsWiring(process.env, kmsOpts)
+    : resolveKmsWiring(process.env, kmsOpts);
+
+await runProdApp({
+  features: APP_FEATURES,
+  envSchema,
+  staticDir: "./dist",
+  ...kmsWiring,
+${authBlock}
+});
+`;
 }
 function renderDev(appName) {
     const tenantId = deriveTenantId(appName);
-    const project = newTsProject();
-    const sf = project.createSourceFile("dev.ts", "");
-    sf.addImportDeclaration({
-        moduleSpecifier: "@cosmicdrift/kumiko-dev-server",
-        namedImports: ["runDevApp"],
-    });
-    sf.addImportDeclaration({
-        moduleSpecifier: "@cosmicdrift/kumiko-framework/engine",
-        isTypeOnly: true,
-        namedImports: ["TenantId"],
-    });
-    sf.addImportDeclaration({
-        moduleSpecifier: "../src/run-config",
-        namedImports: ["APP_FEATURES"],
-    });
-    sf.addImportDeclaration({
-        moduleSpecifier: "../src/seed",
-        namedImports: ["seedDemoTasks"],
-    });
-    sf.addVariableStatement({
-        declarationKind: VariableDeclarationKind.Const,
-        declarations: [
-            {
-                name: "DEFAULT_TENANT_ID",
-                initializer: `"${tenantId}" as TenantId`,
-            },
-        ],
-    });
-    sf.addStatements((writer) => {
-        writer
-            .write("await runDevApp(")
-            .inlineBlock(() => {
-            writer.writeLine("features: APP_FEATURES,");
-            writer.writeLine("welcomeBanner: true,");
-            writer.writeLine(`clientEntry: "./src/client.tsx",`);
-            writer.writeLine("seeds: [seedDemoTasks],");
-            writer.write("auth: ").inlineBlock(() => {
-                writer.write("admin: ").inlineBlock(() => {
-                    writer.writeLine(`email: "admin@${appName}.local",`);
-                    writer.writeLine(`password: "changeme",`);
-                    writer.writeLine(`displayName: "Admin",`);
-                    // Dev-only: skip the email-verify login gate for the seeded
-                    // admin. Prod's scaffold (renderMain) leaves this unset on
-                    // purpose — the verify flow must run there.
-                    writer.writeLine("emailVerified: true,");
-                    writer.write("memberships: [");
-                    writer.indent(() => {
-                        writer.inlineBlock(() => {
-                            writer.writeLine("tenantId: DEFAULT_TENANT_ID,");
-                            writer.writeLine(`tenantKey: "${appName}",`);
-                            writer.writeLine(`tenantName: "${appName}",`);
-                            writer.writeLine(`roles: ["TenantAdmin"],`);
-                        });
-                        writer.write(",");
-                    });
-                    writer.write("],");
-                });
-            });
-        })
-            .write(");");
-    });
-    sf.insertText(0, [
-        "// Dev bootstrap. `bun --watch bin/dev.ts` (see package.json scripts.dev)",
-        "// starts a full-featured dev server with auto-reload on code changes.",
-        "// setupTestStack creates missing entity tables automatically — a new",
-        "// r.entity(...) in a feature becomes a CREATE TABLE on the next reboot,",
-        "// no manual `kumiko schema apply` needed (that's prod-only).",
-        "// Persistent DB via KUMIKO_DEV_DB_NAME (.env) so admin + data survive reboots.",
-        "",
-        "",
-    ].join("\n"));
-    return sf.getFullText();
+    const imports = renderSortedImports([
+        { specifier: "@cosmicdrift/kumiko-dev-server", names: ["runDevApp"] },
+        { specifier: "@cosmicdrift/kumiko-framework/engine", names: ["TenantId"], typeOnly: true },
+        { specifier: "../src/run-config", names: ["APP_FEATURES"] },
+        { specifier: "../src/seed", names: ["seedDemoTasks"] },
+    ]);
+    // Dev-only emailVerified skips the login verify gate for the seeded admin;
+    // prod's bin/main.ts leaves it unset because the verify flow must run there.
+    const authBlock = renderAdminAuthBlock(appName, [
+        'password: "changeme",',
+        'displayName: "Admin",',
+        "emailVerified: true,",
+    ]);
+    return `// Dev bootstrap. \`bun --watch bin/dev.ts\` (see package.json scripts.dev)
+// starts a full-featured dev server with auto-reload on code changes.
+// setupTestStack creates missing entity tables automatically — a new
+// r.entity(...) in a feature becomes a CREATE TABLE on the next reboot,
+// no manual \`kumiko schema apply\` needed (that's prod-only).
+// Persistent DB via KUMIKO_DEV_DB_NAME (.env) so admin + data survive reboots.
+
+${imports}
+
+const DEFAULT_TENANT_ID = "${tenantId}" as TenantId;
+
+await runDevApp({
+  features: APP_FEATURES,
+  welcomeBanner: true,
+  clientEntry: "./src/client.tsx",
+  seeds: [seedDemoTasks],
+${authBlock}
+});
+`;
+}
+// Tiers mirror how Biome wraps the JSX as the name grows.
+function renderDefaultAppShellElement(appName) {
+    const spanOpen = '<span className="font-semibold tracking-tight">';
+    // html-ok: appName is kebab-validated (a-z/0-9/-); this is generated .tsx source, not runtime HTML.
+    const brandInline = `${spanOpen}${appName}</span>`;
+    const singleLine = `    <DefaultAppShell brand={${brandInline}} schema={schema}>`;
+    if (singleLine.length <= MAX_LINE_WIDTH)
+        return singleLine;
+    const brandAttrInline = `      brand={${brandInline}}`;
+    const brandAttribute = brandAttrInline.length <= MAX_LINE_WIDTH
+        ? brandAttrInline
+        : `${[
+            "      brand={",
+            ...(`        ${brandInline}`.length <= MAX_LINE_WIDTH
+                ? [`        ${brandInline}`]
+                : [`        ${spanOpen}`, `          ${appName}`, "        </span>"]),
+            "      }",
+        ].join("\n")}`;
+    return ["    <DefaultAppShell", brandAttribute, "      schema={schema}", "    >"].join("\n");
 }
 function renderClient(appName) {
-    return [
-        "// Browser entry. runDevApp's clientEntry option bundles this file to",
-        "// /client.js and the default HTML loads it. createKumikoApp fetches the",
-        "// AppSchema itself from the authenticated GET /api/schema and mounts",
-        "// the routes.",
-        "//",
-        "// AppShell wraps DefaultAppShell to supply `brand` — createKumikoApp's",
-        "// shell option only injects schema + children. Without `shell` the",
-        "// active screen renders with no layout wrapper (a bare banner after",
-        "// login instead of the app). emailPasswordClient() brings the login",
-        "// screen + session provider — without it /login stays empty.",
-        "//",
-        "// Add new client plugins (e.g. notificationsClient()) to clientFeatures",
-        "// here — symmetric to APP_FEATURES on the server side.",
-        "",
-        'import { emailPasswordClient } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";',
-        'import { tasksClient } from "./features/tasks/web";',
-        'import { type AppSchema, createKumikoApp, DefaultAppShell } from "@cosmicdrift/kumiko-renderer-web";',
-        'import type { ReactNode } from "react";',
-        "",
-        "function AppShell({ children, schema }: { children: ReactNode; schema: AppSchema }): ReactNode {",
-        "  return (",
-        // html-ok: appName is kebab-validated (a-z/0-9/-); this is generated .tsx source, not runtime HTML.
-        `    <DefaultAppShell brand={<span className="font-semibold tracking-tight">${appName}</span>} schema={schema}>`,
-        "      {children}",
-        "    </DefaultAppShell>",
-        "  );",
-        "}",
-        "",
-        "createKumikoApp({",
-        "  shell: AppShell,",
-        "  clientFeatures: [emailPasswordClient(), tasksClient],",
-        "});",
-        "",
-    ].join("\n");
+    const imports = renderSortedImports([
+        {
+            specifier: "@cosmicdrift/kumiko-bundled-features/auth-email-password/web",
+            names: ["emailPasswordClient"],
+        },
+        { specifier: "./features/tasks/web", names: ["tasksClient"] },
+        {
+            specifier: "@cosmicdrift/kumiko-renderer-web",
+            names: ["type AppSchema", "createKumikoApp", "DefaultAppShell"],
+        },
+        { specifier: "react", names: ["ReactNode"], typeOnly: true },
+    ]);
+    return `// Browser entry. runDevApp's clientEntry option bundles this file to
+// /client.js and the default HTML loads it. createKumikoApp fetches the
+// AppSchema itself from the authenticated GET /api/schema and mounts
+// the routes.
+//
+// AppShell wraps DefaultAppShell to supply \`brand\` — createKumikoApp's
+// shell option only injects schema + children. Without \`shell\` the
+// active screen renders with no layout wrapper (a bare banner after
+// login instead of the app). emailPasswordClient() brings the login
+// screen + session provider — without it /login stays empty.
+//
+// Add new client plugins (e.g. notificationsClient()) to clientFeatures
+// here — symmetric to APP_FEATURES on the server side.
+
+${imports}
+
+function AppShell({ children, schema }: { children: ReactNode; schema: AppSchema }): ReactNode {
+  return (
+${renderDefaultAppShellElement(appName)}
+      {children}
+    </DefaultAppShell>
+  );
+}
+
+createKumikoApp({
+  shell: AppShell,
+  clientFeatures: [emailPasswordClient(), tasksClient],
+});
+`;
 }
 function renderEnvExample(appName) {
     const devDb = `${appName.replace(/-/g, "_")}_dev`;
@@ -607,6 +568,11 @@ JWT_SECRET=change-me-min-32-chars-change-me-min-32
 # Generate with: openssl rand -base64 32
 KUMIKO_SECRETS_MASTER_KEY_V1=
 
+# DEMO_ADMIN_PASSWORD: password of the admin seeded on first prod boot
+# (admin@${appName}.local). Required by \`bun run boot\` and \`bun run start\`,
+# min 12 chars. Generate with: openssl rand -hex 24
+DEMO_ADMIN_PASSWORD=
+
 # Subject-keys KMS for PII fields (user, tenant-invitation, fileRef). All-or-none.
 # Unset → local boot with plaintext PII + warning; NODE_ENV=production requires
 # the trio (requireKmsWiring). Generate PLATFORM_KEK / KUMIKO_BLIND_INDEX_KEY
@@ -641,6 +607,7 @@ services:
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: app
     ports:
       - "127.0.0.1:5432:5432"
     volumes:
@@ -691,7 +658,8 @@ bun run boot
 \`\`\`
 
 Runs \`KUMIKO_DRY_RUN_ENV=boot bun bin/main.ts\` — validates feature composition
-+ env schema, exits 0 without touching DB/Redis. Useful in CI.
++ env schema, exits 0 without touching DB/Redis. Useful in CI. It needs
+\`DEMO_ADMIN_PASSWORD\` (min 12 chars, \`openssl rand -hex 24\`) in \`.env\`.
 
 Without \`PLATFORM_KEK\` / \`SUBJECT_KEYS_DATABASE_URL\` / \`KUMIKO_BLIND_INDEX_KEY\`
 set (see \`.env.example\`), both \`bun run boot\` and \`bun run start\` boot with
@@ -706,6 +674,9 @@ bun run schema:apply   # apply checked-in kumiko/migrations (needs DATABASE_URL)
 bun run start          # runProdApp against dist/
 \`\`\`
 
+The first prod boot seeds \`admin@${appName}.local\` with the password from
+\`DEMO_ADMIN_PASSWORD\` (required, min 12 chars). Log in with that.
+
 After adding entities/features, regenerate migrations:
 
 \`\`\`sh
@@ -746,9 +717,9 @@ function renderKumikoSchema() {
         "// Computes table-metas from the SAME composeFeatures(APP_FEATURES) the",
         "// runtime sees (runProdApp/runDevApp) — migration and runtime cannot drift.",
         "",
-        'import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";',
         'import { collectTableMetas, type EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";',
         'import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";',
+        'import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";',
         'import { APP_FEATURES, HAS_AUTH } from "../src/run-config";',
         "",
         "export const FEATURES: readonly FeatureDefinition[] = composeFeatures([...APP_FEATURES], {",
@@ -779,10 +750,10 @@ function renderBinKumiko() {
         "// ad-hoc SQL. kumiko-build bundles this file to dist-server/kumiko.js.",
         "",
         'import { frameworkCoreEnvSchema } from "@cosmicdrift/kumiko-dev-server/env-schema";',
-        'import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";',
         'import { runConsumerCli } from "@cosmicdrift/kumiko-framework/consumer-cli";',
         'import { composeEnvSchema, kmsSlotsOf } from "@cosmicdrift/kumiko-framework/env";',
         'import { runSchemaCli } from "@cosmicdrift/kumiko-framework/schema-cli";',
+        'import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";',
         'import { APP_FEATURES, HAS_AUTH } from "../src/run-config";',
         "",
         "const [, , cmd, ...rest] = Bun.argv;",
@@ -792,7 +763,9 @@ function renderBinKumiko() {
         'if (cmd === "schema") {',
         "  const features = composeFeatures([...APP_FEATURES], { includeBundled: HAS_AUTH });",
         "  const kmsSlots = kmsSlotsOf(composeEnvSchema({ core: frameworkCoreEnvSchema, features }).schema);",
-        "  process.exit(await runSchemaCli(rest, process.env.INIT_CWD ?? process.cwd(), out, { features, kmsSlots }));",
+        "  process.exit(",
+        "    await runSchemaCli(rest, process.env.INIT_CWD ?? process.cwd(), out, { features, kmsSlots }),",
+        "  );",
         "}",
         "",
         'if (cmd === "consumer") {',
@@ -800,7 +773,9 @@ function renderBinKumiko() {
         "}",
         "",
         "// biome-ignore lint/suspicious/noConsole: CLI output is the feature.",
-        'console.error("\\n  Unknown: kumiko " + (cmd ?? "") + " — only \'kumiko schema <sub>\' or \'kumiko consumer <sub>\' in the standalone bundle.\\n");',
+        "console.error(",
+        `  \`\\n  Unknown: kumiko \${cmd ?? ""} — only 'kumiko schema <sub>' or 'kumiko consumer <sub>' in the standalone bundle.\\n\`,`,
+        ");",
         "process.exit(1);",
         "",
     ].join("\n");

package/dist/scaffold-demo-tasks.js

@@ -127,7 +127,8 @@ const editScreen: EntityEditScreenDefinition = {
 const open = {
   access: {
     openToAll: {
-      reason: "scaffolded demo handler: every signed-in user of the demo tenant manages their tasks",
+      reason:
+        "scaffolded demo handler: every signed-in user of the demo tenant manages their tasks",
     },
   },
 } as const;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.364.0",
+  "version": "0.365.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -60,17 +60,16 @@
     "kumiko-dev": "./bin/kumiko-dev.ts",
     "kumiko-init-deploy": "./bin/kumiko-init-deploy.ts",
     "kumiko-schema": "./bin/kumiko-schema.ts",
-    "kumiko-schema-check": "./bin/kumiko-schema-check.ts",
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.364.0",
-    "@cosmicdrift/kumiko-framework": "0.364.0",
-    "@cosmicdrift/kumiko-headless": "0.364.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.364.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.364.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.364.0",
-    "@cosmicdrift/kumiko-types": "0.364.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.365.0",
+    "@cosmicdrift/kumiko-framework": "0.365.0",
+    "@cosmicdrift/kumiko-headless": "0.365.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.365.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.365.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.365.0",
+    "@cosmicdrift/kumiko-types": "0.365.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,41 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "New projects read the prod admin password from DEMO_ADMIN_PASSWORD",
+    "detail": "The scaffolded bin/main.ts no longer seeds the prod admin with a fixed password. It reads DEMO_ADMIN_PASSWORD (declared in the env schema, min 12 chars), and boot fails without it. Existing apps are untouched; apps from an older scaffold should change bin/main.ts the same way."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "A freshly scaffolded app passes bun run lint without rework",
+    "detail": "New projects now get a .gitignore, an exactly pinned @biomejs/biome and lint-clean generated files (import order, formatting). Existing apps are untouched."
+  },
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "composeRendererStack passes a mail brand suffix resolver",
+    "detail": "composeRendererStack({ mailBrandSuffix }) hands the resolver to createRendererMailHtmlFeature as brandSuffix."
+  },
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "composeRendererStack passes a mail footer resolver to the mail renderer",
+    "detail": "composeRendererStack({ mailFooter }) hands the resolver to createRendererMailHtmlFeature, so apps on the composed stack set imprint, privacy and platform line in one place."
+  },
+  {
+    "version": "0.365.0",
+    "type": "breaking",
+    "title": "The kumiko-schema-check bin and the resolveGeneratePath, usesDerivedSchemaLayout and implicitAuthModeFeatureNames exports are removed",
+    "detail": "kumiko-schema-check diffed APP_FEATURES against a hand-kept FEATURE_IMPORT_REGISTRY. Apps with kumiko/schema.ts derive their entities from the mounted features and have no registry that could drift, so the check was a no-op there. The helpers resolveGeneratePath, usesDerivedSchemaLayout and implicitAuthModeFeatureNames are no longer exported from @cosmicdrift/kumiko-dev-server/cli.",
+    "migration": "Apps with kumiko/schema.ts need nothing. Run kumiko-schema validate to check migrations against the mounted features, and remove kumiko-schema-check from package scripts and CI. Apps that keep a FEATURE_IMPORT_REGISTRY diff it against APP_FEATURES in their own coverage script."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "buildServerBundle resolves worker and bootstrap entries as .ts or .js; runDevApp stop keeps an explicit blindIndexKey",
+    "detail": "An app with bin/main.js and bin/worker.js used to get no dist-server/worker.js without any warning, because only worker.ts and bootstrap.ts were looked up. Siblings now resolve like the server entry, .ts first and then .js. In the ephemeral PII default, stopping runDevApp unset a blindIndexKey that the app passed itself; it now unsets only the key the default generated."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/bin/kumiko-schema-check.ts

@@ -1,175 +0,0 @@
-#!/usr/bin/env bun
-// biome-ignore-all lint/suspicious/noConsole: CLI-Script, console ist Feature.
-//
-// kumiko schema check — Empfehlung 3 aus Sprint-9.8-Retro
-// (luminous-watching-moler.md). Diff't APP_FEATURES (runtime, aus
-// `src/run-config.ts`) gegen FEATURE_IMPORT_REGISTRY (statisch, aus
-// `drizzle/generate.ts`). Catches:
-//
-//   1. Mount-without-registry: ein neues feature in APP_FEATURES ohne
-//      Entry in FEATURE_IMPORT_REGISTRY. Resultiert in Schema-Drift:
-//      Runtime mountet feature, Migration kennt seine Tabellen nicht.
-//   2. Stale-registry: ein Entry in FEATURE_IMPORT_REGISTRY ohne
-//      matching mount in APP_FEATURES. Dead-code; im Schema entsteht
-//      eine Tabelle ohne Runtime-Konsument.
-//
-// Studio's 9.8-Drama: FEATURE_IMPORT_REGISTRY war 18 features hinter
-// APP_FEATURES. Hätte mit diesem check eine Sekunde Lokal gefangen.
-//
-// Usage (aus dem app-workspace):
-//   bunx kumiko-schema-check
-//   # oder mit explicit pfaden:
-//   bunx kumiko-schema-check --run-config src/run-config.ts --generate drizzle/generate.ts
-//
-// Exit 0 wenn alles in sync, exit 1 wenn drift.
-
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import {
-  implicitAuthModeFeatureNames,
-  resolveGeneratePath,
-} from "@cosmicdrift/kumiko-dev-server/cli";
-
-type Args = {
-  readonly runConfigPath: string;
-  readonly generatePath: string;
-};
-
-function parseArgs(argv: readonly string[]): Args {
-  const cwd = process.cwd();
-  let runConfigPath = resolve(cwd, "src/run-config.ts");
-  let generatePath: string | undefined;
-  for (let i = 0; i < argv.length; i++) {
-    const flag = argv[i];
-    const value = argv[i + 1];
-    if (flag === "--run-config" && value) {
-      runConfigPath = resolve(cwd, value);
-      i++;
-    } else if (flag === "--generate" && value) {
-      generatePath = resolve(cwd, value);
-      i++;
-    }
-  }
-  return { runConfigPath, generatePath: generatePath ?? resolveGeneratePath(cwd) };
-}
-
-function readRegistryFeatures(generateSrc: string): Set<string> {
-  // Match object-keys mit Discriminator `kind: "factory" | "named"`.
-  // Quoted ("billing-foundation") oder unquoted (config, user) — beides
-  // ist gültig in JS. Pattern aus use-all-bundled/scripts/check-coverage.ts
-  // dupliziert hier weil per-app-CLI nicht von sample-script lesen darf.
-  const re = /(?:"([a-z][a-z0-9-]*)"|([a-z][a-z0-9]*)):\s*\{\s*kind:\s*"(factory|named)"/g;
-  const out = new Set<string>();
-  for (const m of generateSrc.matchAll(re)) {
-    const name = m[1] ?? m[2];
-    if (name) out.add(name);
-  }
-  return out;
-}
-
-async function readMountedFeatures(runConfigPath: string): Promise<Set<string>> {
-  const mod = (await import(runConfigPath)) as {
-    APP_FEATURES?: ReadonlyArray<{ name: string }>;
-    HAS_AUTH?: boolean;
-    HAS_SIGNUP?: boolean;
-  };
-  if (!mod.APP_FEATURES) {
-    throw new Error(
-      `kumiko-schema-check: ${runConfigPath} hat kein 'APP_FEATURES' export. ` +
-        `Convention: 'export const APP_FEATURES = [...] as const'.`,
-    );
-  }
-  const set = new Set<string>();
-  for (const f of mod.APP_FEATURES) {
-    set.add(f.name);
-  }
-  // HAS_AUTH defaults to true (Studio/use-all-bundled convention). When set,
-  // include the implicit auth-mode features so the diff doesn't false-positive
-  // "auth-email-password is mounted but no registry-entry".
-  if (mod.HAS_AUTH ?? true) {
-    for (const name of implicitAuthModeFeatureNames()) set.add(name);
-  }
-  // auth-self-registration is only prepended when authOptions.signup is set
-  // (composeFeatures) — opt-in via HAS_SIGNUP so apps without signup don't
-  // get a stale-registry false positive (#1521).
-  if (mod.HAS_SIGNUP === true) {
-    set.add("auth-self-registration");
-  }
-  return set;
-}
-
-const USAGE = "Usage: kumiko-schema-check [--run-config <path>] [--generate <path>]";
-
-async function main(): Promise<void> {
-  if (process.argv.slice(2).some((arg) => arg === "--help" || arg === "-h")) {
-    console.log(USAGE);
-    process.exit(0);
-  }
-  const args = parseArgs(process.argv.slice(2));
-
-  if (!existsSync(args.runConfigPath)) {
-    console.error(`✗ run-config not found: ${args.runConfigPath}`);
-    process.exit(1);
-  }
-  if (!existsSync(args.generatePath)) {
-    console.error(`✗ generate not found: ${args.generatePath}`);
-    process.exit(1);
-  }
-
-  const registry = readRegistryFeatures(readFileSync(args.generatePath, "utf-8"));
-  const mounted = await readMountedFeatures(args.runConfigPath);
-
-  // Mounted but not in registry → schema-drift (runtime ↔ migration mismatch).
-  const mountedWithoutEntry: string[] = [];
-  for (const name of mounted) {
-    if (!registry.has(name)) mountedWithoutEntry.push(name);
-  }
-  // In registry but not mounted → stale entry (dead schema-mapping).
-  const staleEntries: string[] = [];
-  for (const name of registry) {
-    if (!mounted.has(name)) staleEntries.push(name);
-  }
-
-  let ok = true;
-
-  if (mountedWithoutEntry.length > 0) {
-    console.error(
-      `\n✗ ${mountedWithoutEntry.length} feature(s) mounted in APP_FEATURES but NOT in FEATURE_IMPORT_REGISTRY:`,
-    );
-    for (const name of mountedWithoutEntry.sort()) {
-      console.error(`   - ${name}`);
-    }
-    console.error(
-      "\n  Action: in drizzle/generate.ts FEATURE_IMPORT_REGISTRY den Eintrag ergänzen,",
-    );
-    console.error("  damit Schema-Generator + Migration die feature-Tabellen kennt.");
-    ok = false;
-  }
-
-  if (staleEntries.length > 0) {
-    console.error(
-      `\n✗ ${staleEntries.length} stale FEATURE_IMPORT_REGISTRY entry/entries (kein matching mount):`,
-    );
-    for (const name of staleEntries.sort()) {
-      console.error(`   - ${name}`);
-    }
-    console.error("\n  Action: entry aus drizzle/generate.ts FEATURE_IMPORT_REGISTRY entfernen,");
-    console.error("  oder das feature in src/run-config.ts mounten.");
-    ok = false;
-  }
-
-  if (ok) {
-    console.log(
-      `✓ schema check: ${mounted.size} mounted ↔ ${registry.size} registry entries, no drift`,
-    );
-    process.exit(0);
-  } else {
-    process.exit(1);
-  }
-}
-
-// Only run when executed as a CLI, not when imported (e.g. from tests that
-// exercise the exported pure helpers).
-if (import.meta.main) {
-  await main();
-}

package/dist/schema-check-core.d.ts

@@ -1,2 +0,0 @@
-export declare function resolveGeneratePath(cwd: string): string;
-export declare function implicitAuthModeFeatureNames(): readonly string[];

package/dist/schema-check-core.js

@@ -1,24 +0,0 @@
-// Pure helpers for the `kumiko-schema-check` bin. Kept in src/ (vs. the bin)
-// so they are part of the tsc project + unit-testable without importing the
-// auto-running CLI.
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
-import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
-// The generate-script lives under different roots across apps: publicstatus
-// uses `drizzle/generate.ts`, the framework's own sample-apps use
-// `schema/generate.ts`. Pick whichever exists so a no-arg `bunx
-// kumiko-schema-check` works in both layouts; default to `drizzle/` for the
-// error message when neither is present.
-export function resolveGeneratePath(cwd) {
-    const drizzlePath = resolve(cwd, "drizzle/generate.ts");
-    const schemaPath = resolve(cwd, "schema/generate.ts");
-    if (!existsSync(drizzlePath) && existsSync(schemaPath))
-        return schemaPath;
-    return drizzlePath;
-}
-// The features composeFeatures auto-prepends in auth-mode (config + user +
-// tenant + auth-email-password). Derived from composeFeatures itself so this
-// can't drift from the real prepend-list in compose-features.ts.
-export function implicitAuthModeFeatureNames() {
-    return composeFeatures([], { includeBundled: true }).map((f) => f.name);
-}