@cosmicdrift/kumiko-dev-server 0.368.0 → 0.370.0

package/dist/build.d.ts

@@ -1,2 +1,2 @@
 export { ASSETS_DIR, type BuildManifest, type BuildProdBundleOptions, type BuildResult, buildProdBundle, type ClientEntry, type ClientEntryDeclaration, discoverHtmlTemplate, formatBuildResult, injectAssetTags, readClientEntriesConfig, resolveClientEntries, } from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
-export { type BuildServerBundleEntry, type BuildServerBundleOptions, type BuildServerBundleResult, buildServerBundle, discoverServerEntry, formatServerBuildResult, readExtraRuntimeExternals, } from "./build-server-bundle.js";
+export { type BuildServerBundleEntry, type BuildServerBundleOptions, type BuildServerBundleResult, buildServerBundle, discoverServerEntry, formatServerBuildResult, readExtraRuntimeExternals, } from "./build-server-bundle.ts";

package/dist/cli.d.ts

@@ -1,3 +1,3 @@
-export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildResult, formatServerBuildResult, readClientEntriesConfig, readExtraRuntimeExternals, resolveClientEntries, } from "./build.js";
-export { createCrashTracker } from "./crash-tracker.js";
-export { runInitDeployCli } from "./init-deploy-cli.js";
+export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildResult, formatServerBuildResult, readClientEntriesConfig, readExtraRuntimeExternals, resolveClientEntries, } from "./build.ts";
+export { createCrashTracker } from "./crash-tracker.ts";
+export { runInitDeployCli } from "./init-deploy-cli.ts";

package/dist/compose-stacks.d.ts

@@ -1,13 +1,20 @@
+import { type AccountSecurityFeatureOptions } from "@cosmicdrift/kumiko-bundled-features/account-security";
 import { type AuthMfaFeatureOptions } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
+import { type BillingFoundationOptions } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { type CreateCapOverviewOptions } from "@cosmicdrift/kumiko-bundled-features/cap-overview";
 import { type LegalPagesOptions } from "@cosmicdrift/kumiko-bundled-features/legal-pages";
+import { type SubscriptionMollieOptions } from "@cosmicdrift/kumiko-bundled-features/subscription-mollie";
+import { type CreateTierEngineOptions } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
 import { type UserDataRightsOptions } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
+import { type WaitlistOptions } from "@cosmicdrift/kumiko-bundled-features/waitlist";
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { type MailBrandSuffixResolver, type MailFooterResolver } from "@cosmicdrift/kumiko-renderer-mail-html";
 export type FileProviderKind = "inmemory" | "s3" | "s3-env";
 export type MailTransportKind = "inmemory" | "smtp";
 export type GdprStackOrder = "retention-first" | "compliance-first";
 export type FileStackOptions = {
-    readonly providers: readonly FileProviderKind[];
+    /** Without providers the stack needs runProdApp's `fileStorage` option. */
+    readonly providers?: readonly FileProviderKind[];
     readonly includeFilesFeature?: boolean;
 };
 export type MailStackOptions = {
@@ -20,6 +27,11 @@ export type GdprStackOptions = {
     readonly order?: GdprStackOrder;
     readonly sessions?: boolean;
     readonly tenantLifecycle?: boolean;
+    /** Adds sessions, user-data-rights and user-profile in the order the
+     *  self-service privacy center needs; user-data-rights needs `mail`. */
+    readonly selfService?: {
+        readonly userDataRights?: UserDataRightsOptions;
+    };
     /** Optional tokenVerifier provider(s) (e.g. PAT) when `sessions` is on.
      *  Session-only stacks need none — sessions registers sessionStore, which
      *  satisfies auth-foundation's boot check (#1570). Pass providers when the
@@ -56,12 +68,54 @@ export type RendererStackOptions = {
     readonly mailBrandSuffix?: MailBrandSuffixResolver;
 };
 export declare function composeRendererStack(options?: RendererStackOptions): FeatureDefinition[];
+/** Tenant mail transports reach users through channel-email, so the stack needs `mail`. */
 export declare function composeMailStack(options: MailStackOptions): FeatureDefinition[];
-export declare function composeFileStack(options: FileStackOptions): FeatureDefinition[];
-/** Retention + compliance (+ optional lifecycle/sessions). UDR/files mount separately — order varies per app. */
+export declare function composeFileStack(options?: FileStackOptions): FeatureDefinition[];
+/** Retention + compliance (+ optional lifecycle/sessions/self-service). Needs an
+ *  explicit KMS decision (`kmsMode`, or the low-level `kms` / `allowPlaintextPii`).
+ *  `selfService` mounts user-profile, which requires user-data-rights-defaults and
+ *  auth-email-password: composeUserDataRightsStack mounts the defaults, the login comes from the `auth` option. */
 export declare function composeGdprStack(options?: GdprStackOptions): FeatureDefinition[];
 export declare function composeUserDataRightsStack(options?: UserDataRightsStackOptions): FeatureDefinition[];
 export declare function composeOpsStack(options?: OpsStackOptions): FeatureDefinition[];
 /** Identity opt-ins: sessions by default; auth-mfa when `mfa` options given.
  *  Do not also pass `sessions: true` to composeGdprStack — duplicate feature. */
 export declare function composeIdentityStack(options?: IdentityStackOptions): FeatureDefinition[];
+export type AuthStackOptions = {
+    readonly sessions?: boolean;
+    readonly mfa?: AuthMfaFeatureOptions;
+    /** Self-service screen for MFA and own sessions; mounted when `mfa` and `sessions` are on. */
+    readonly accountSecurity?: AccountSecurityFeatureOptions;
+};
+/** auth-foundation + sessions, optional auth-mfa and account-security.
+ *  auth-email-password stays with runProdApp's `auth` option, which also wires
+ *  the MFA status checker into the login handler. */
+export declare function composeAuthStack(options?: AuthStackOptions): FeatureDefinition[];
+export type SaasStackBilling = {
+    readonly billing: "stripe";
+} | {
+    readonly billing: "mollie";
+    readonly mollie: SubscriptionMollieOptions;
+};
+export type SaasStackOptions<TCaps extends Readonly<Record<string, unknown>> = Readonly<Record<string, unknown>>> = SaasStackBilling & {
+    readonly tiers: CreateTierEngineOptions<TCaps>;
+    readonly billingFoundation?: BillingFoundationOptions;
+    /** Mounts cap-counter and cap-overview. */
+    readonly caps?: CreateCapOverviewOptions;
+    /** Mounts waitlist; it needs auth-email-password and user-data-rights. */
+    readonly waitlist?: WaitlistOptions;
+};
+/** billing-foundation + tier-engine (+ caps, waitlist). `"stripe"` leaves
+ *  subscription-stripe and its webhook route to runProdApp's `billing` option;
+ *  `"mollie"` mounts subscription-mollie, whose webhook route the app adds.
+ *  billing-foundation requires tenant-lifecycle and compliance-profiles, which
+ *  composeGdprStack({ tenantLifecycle: true }) mounts. */
+export declare function composeSaasStack<TCaps extends Readonly<Record<string, unknown>>>(options: SaasStackOptions<TCaps>): FeatureDefinition[];
+export type SecurityStackOptions = {
+    /** Default true; pass false when another stack already mounts sessions with other options. */
+    readonly includeSessions?: boolean;
+};
+/** sessions, crypto-shredding, rate-limiting, audit: the security baseline the
+ *  production boot warning checks. Relies on runProdApp's default L1/L2 rate
+ *  limits and an explicit KMS decision. */
+export declare function composeSecurityStack(options?: SecurityStackOptions): FeatureDefinition[];

package/dist/compose-stacks.js

@@ -5,12 +5,18 @@
 // (kumiko-framework#2337).
 //
 // Composable SaaS stack presets — explicit opt-in blocks for run-config.ts.
-// Presets export feature instances only; no implicit PAT scopes, anonymousAccess,
-// or tier maps (those stay in bin/server.ts / app run-config).
+// Presets export feature instances only; no implicit PAT scopes or
+// anonymousAccess. A stack that needs a runProdApp boot option tags the
+// feature that depends on it with `bootRequires`; runProdApp names the gap.
+import { createAccountSecurityFeature, } from "@cosmicdrift/kumiko-bundled-features/account-security";
 import { createAuditFeature } from "@cosmicdrift/kumiko-bundled-features/audit";
 import { createAuthFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { createAuthMfaFeature, } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
+import { createBillingFoundationFeature, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { createCapCounterFeature } from "@cosmicdrift/kumiko-bundled-features/cap-counter";
+import { createCapOverviewFeature, } from "@cosmicdrift/kumiko-bundled-features/cap-overview";
 import { createComplianceProfilesFeature } from "@cosmicdrift/kumiko-bundled-features/compliance-profiles";
+import { createCryptoShreddingFeature } from "@cosmicdrift/kumiko-bundled-features/crypto-shredding";
 import { createDataRetentionFeature } from "@cosmicdrift/kumiko-bundled-features/data-retention";
 import { createDeliveryFeature } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { createFileFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/file-foundation";
@@ -25,11 +31,18 @@ import { createMailTransportSmtpFeature } from "@cosmicdrift/kumiko-bundled-feat
 import { createRateLimitingFeature } from "@cosmicdrift/kumiko-bundled-features/rate-limiting";
 import { createRendererFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/renderer-foundation";
 import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
+import { createSubscriptionMollieFeature, } from "@cosmicdrift/kumiko-bundled-features/subscription-mollie";
 import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { createTenantLifecycleFeature } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
+import { createTierEngineFeature, } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
 import { createUserDataRightsFeature, } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
 import { createUserDataRightsDefaultsFeature } from "@cosmicdrift/kumiko-bundled-features/user-data-rights-defaults";
+import { createUserProfileFeature } from "@cosmicdrift/kumiko-bundled-features/user-profile";
+import { createWaitlistFeature, } from "@cosmicdrift/kumiko-bundled-features/waitlist";
 import { createRendererMailHtmlFeature, } from "@cosmicdrift/kumiko-renderer-mail-html";
+function withBootRequires(feature, stack, options) {
+    return { ...feature, bootRequires: { stack, options } };
+}
 export function stackFeatureNames(features) {
     return features.map((f) => f.name);
 }
@@ -53,8 +66,11 @@ export function composeRendererStack(options = {}) {
         }),
     ];
 }
+/** Tenant mail transports reach users through channel-email, so the stack needs `mail`. */
 export function composeMailStack(options) {
-    const out = [createMailFoundationFeature()];
+    const out = [
+        withBootRequires(createMailFoundationFeature(), "composeMailStack", ["mail"]),
+    ];
     for (const transport of options.transports) {
         if (transport === "inmemory")
             out.push(createMailTransportInMemoryFeature());
@@ -63,9 +79,15 @@ export function composeMailStack(options) {
     }
     return out;
 }
-export function composeFileStack(options) {
-    const out = [createFileFoundationFeature()];
-    for (const provider of options.providers) {
+export function composeFileStack(options = {}) {
+    const providers = options.providers ?? [];
+    const foundation = createFileFoundationFeature();
+    const out = [
+        providers.length === 0
+            ? withBootRequires(foundation, "composeFileStack", ["fileStorage"])
+            : foundation,
+    ];
+    for (const provider of providers) {
         if (provider === "inmemory")
             out.push(createFileProviderInMemoryFeature());
         if (provider === "s3")
@@ -77,10 +99,13 @@ export function composeFileStack(options) {
         out.push(createFilesFeature());
     return out;
 }
-/** Retention + compliance (+ optional lifecycle/sessions). UDR/files mount separately — order varies per app. */
+/** Retention + compliance (+ optional lifecycle/sessions/self-service). Needs an
+ *  explicit KMS decision (`kmsMode`, or the low-level `kms` / `allowPlaintextPii`).
+ *  `selfService` mounts user-profile, which requires user-data-rights-defaults and
+ *  auth-email-password: composeUserDataRightsStack mounts the defaults, the login comes from the `auth` option. */
 export function composeGdprStack(options = {}) {
     const order = options.order ?? "retention-first";
-    const retention = createDataRetentionFeature();
+    const retention = withBootRequires(createDataRetentionFeature(), "composeGdprStack", ["kmsMode"]);
     const compliance = createComplianceProfilesFeature();
     const out = order === "compliance-first" ? [compliance, retention] : [retention, compliance];
     if (options.tenantLifecycle)
@@ -90,11 +115,19 @@ export function composeGdprStack(options = {}) {
         if (options.providers)
             out.push(...options.providers);
     }
+    if (options.selfService) {
+        if (!options.sessions)
+            out.push(createSessionsFeature());
+        out.push(withBootRequires(createUserDataRightsFeature(options.selfService.userDataRights ?? {}), "composeGdprStack", ["mail"]), createUserProfileFeature());
+    }
     return out;
 }
 export function composeUserDataRightsStack(options = {}) {
     const includeDefaults = options.includeDefaults ?? true;
-    const out = [createUserDataRightsFeature(options.userDataRights ?? {})];
+    // Export-ready and deletion mails go through delivery + channel-email.
+    const out = [
+        withBootRequires(createUserDataRightsFeature(options.userDataRights ?? {}), "composeUserDataRightsStack", ["mail"]),
+    ];
     if (includeDefaults)
         out.push(createUserDataRightsDefaultsFeature());
     return out;
@@ -127,3 +160,49 @@ export function composeIdentityStack(options = {}) {
         out.push(createAuthMfaFeature(options.mfa));
     return out;
 }
+/** auth-foundation + sessions, optional auth-mfa and account-security.
+ *  auth-email-password stays with runProdApp's `auth` option, which also wires
+ *  the MFA status checker into the login handler. */
+export function composeAuthStack(options = {}) {
+    const sessions = options.sessions ?? true;
+    const out = composeIdentityStack({
+        sessions,
+        ...(options.mfa !== undefined && { mfa: options.mfa }),
+    });
+    if (options.mfa !== undefined && sessions) {
+        out.push(createAccountSecurityFeature(options.accountSecurity ?? {}));
+    }
+    return out;
+}
+/** billing-foundation + tier-engine (+ caps, waitlist). `"stripe"` leaves
+ *  subscription-stripe and its webhook route to runProdApp's `billing` option;
+ *  `"mollie"` mounts subscription-mollie, whose webhook route the app adds.
+ *  billing-foundation requires tenant-lifecycle and compliance-profiles, which
+ *  composeGdprStack({ tenantLifecycle: true }) mounts. */
+export function composeSaasStack(options) {
+    const foundation = createBillingFoundationFeature(options.billingFoundation ?? {});
+    const out = [
+        options.billing === "stripe"
+            ? withBootRequires(foundation, "composeSaasStack", ["billing"])
+            : foundation,
+        createTierEngineFeature(options.tiers),
+    ];
+    if (options.billing === "mollie")
+        out.push(createSubscriptionMollieFeature(options.mollie));
+    if (options.caps)
+        out.push(createCapCounterFeature(), createCapOverviewFeature(options.caps));
+    if (options.waitlist)
+        out.push(createWaitlistFeature(options.waitlist));
+    return out;
+}
+/** sessions, crypto-shredding, rate-limiting, audit: the security baseline the
+ *  production boot warning checks. Relies on runProdApp's default L1/L2 rate
+ *  limits and an explicit KMS decision. */
+export function composeSecurityStack(options = {}) {
+    return [
+        ...(options.includeSessions === false ? [] : [createSessionsFeature()]),
+        withBootRequires(createCryptoShreddingFeature(), "composeSecurityStack", ["kmsMode"]),
+        withBootRequires(createRateLimitingFeature(), "composeSecurityStack", ["rateLimit"]),
+        createAuditFeature(),
+    ];
+}

package/dist/host-dispatch-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { HostRoutingDispatchFn } from "@cosmicdrift/kumiko-bundled-features/host-routing";
+import type { DevHostDispatch } from "./create-kumiko-server.ts";
+export type ToDevHostDispatchOptions = {
+    readonly entries?: Readonly<Record<string, string>>;
+    readonly staticDir: string;
+};
+export declare function toDevHostDispatch(dispatch: HostRoutingDispatchFn, options: ToDevHostDispatchOptions): DevHostDispatch;

package/dist/host-dispatch-adapter.js

@@ -0,0 +1,31 @@
+import { join } from "node:path";
+// Runs the prod host-routing decision in the dev server, so dev and prod
+// cannot route differently. Per-host CSP is a prod concern and dropped here.
+export function toDevHostDispatch(dispatch, options) {
+    const entries = options.entries ?? {};
+    const toDev = (result) => {
+        switch (result.kind) {
+            case "redirect":
+                return result;
+            case "html": {
+                const entryName = entries[result.file];
+                return entryName === undefined
+                    ? { kind: "static-html", file: join(options.staticDir, result.file) }
+                    : { kind: "html", entryName };
+            }
+            case "not-found": {
+                if (result.file === undefined)
+                    return { kind: "not-found" };
+                const entryName = entries[result.file];
+                return entryName === undefined
+                    ? { kind: "not-found", file: join(options.staticDir, result.file) }
+                    : { kind: "not-found", entryName };
+            }
+        }
+    };
+    return async (req, deps) => {
+        const url = new URL(req.url);
+        const host = req.headers.get("host") ?? url.host;
+        return toDev(await dispatch({ host, path: url.pathname, search: url.search }, deps));
+    };
+}

package/dist/index.d.ts

@@ -1,21 +1,22 @@
 export { type ComposeFeaturesOptions, composeFeatures, } from "@cosmicdrift/kumiko-server-runtime/compose-features";
-export { composeFileStack, composeGdprStack, composeIdentityStack, composeMailStack, composeOpsStack, composePagesStack, composeRendererStack, composeUserDataRightsStack, type FileProviderKind, type FileStackOptions, type GdprStackOptions, type GdprStackOrder, type IdentityStackOptions, type MailStackOptions, type MailTransportKind, type OpsStackOptions, type PagesStackOptions, stackFeatureNames, type UserDataRightsStackOptions, } from "./compose-stacks.js";
-export { type CreateKumikoServerOptions, createKumikoServer, type KumikoServerHandle, PROD_BUNDLES_ENV, resolveStylesheet, STYLESHEET_WATCH_ENV, } from "./create-kumiko-server.js";
-export { type FrameworkCoreEnv, frameworkCoreEnvSchema } from "./env-schema.js";
-export type { AuthoringStyle, BuildFewShotCorpusOptions, CorpusWarning, FewShotCorpus, FewShotEntry, } from "./few-shot-corpus.js";
-export { buildFewShotCorpus, pathToId } from "./few-shot-corpus.js";
-export { resolveFrameworkVersion } from "./framework-version.js";
-export type { CliOutput, RunInitDeployCliOptions } from "./init-deploy-cli.js";
-export { runInitDeployCli } from "./init-deploy-cli.js";
-export type { RunDevAppAuthOptions, RunDevAppOptions, SeedFn } from "./run-dev-app.js";
-export { runDevApp } from "./run-dev-app.js";
-export type { ScaffoldAppOptions, ScaffoldAppResult, ScaffoldFeatureEntry, } from "./scaffold-app.js";
-export { SCAFFOLD_BIOME_VERSION, scaffoldApp } from "./scaffold-app.js";
-export type { ScaffoldAppFeatureOptions, ScaffoldAppFeatureResult, } from "./scaffold-app-feature.js";
-export { runConfigPathForApp, scaffoldAppFeature } from "./scaffold-app-feature.js";
-export type { CheckDeployDriftResult, DeployDriftEntry, RenderDeployFilesOptions, RenderDeployFilesResult, RenderedDeployFile, ScaffoldDeployDetected, ScaffoldDeployOptions, ScaffoldDeployResult, ScaffoldedFile, } from "./scaffold-deploy.js";
-export { checkDeployDrift, renderDeployFiles, scaffoldDeploy } from "./scaffold-deploy.js";
-export type { ScaffoldFeatureOptions, ScaffoldFeatureResult } from "./scaffold-feature.js";
-export { scaffoldFeature } from "./scaffold-feature.js";
-export { type SetupTestStackFromFeaturesOptions, setupTestStackFromFeatures, type TestStackPreset, } from "./setup-test-stack-from-features.js";
-export { renderWelcomeBanner, type WelcomeBannerInput } from "./welcome-banner.js";
+export { type AuthStackOptions, composeAuthStack, composeFileStack, composeGdprStack, composeIdentityStack, composeMailStack, composeOpsStack, composePagesStack, composeRendererStack, composeSaasStack, composeSecurityStack, composeUserDataRightsStack, type FileProviderKind, type FileStackOptions, type GdprStackOptions, type GdprStackOrder, type IdentityStackOptions, type MailStackOptions, type MailTransportKind, type OpsStackOptions, type PagesStackOptions, type SaasStackBilling, type SaasStackOptions, type SecurityStackOptions, stackFeatureNames, type UserDataRightsStackOptions, } from "./compose-stacks.ts";
+export { type CreateKumikoServerOptions, createKumikoServer, type KumikoServerHandle, PROD_BUNDLES_ENV, resolveStylesheet, STYLESHEET_WATCH_ENV, } from "./create-kumiko-server.ts";
+export { type FrameworkCoreEnv, frameworkCoreEnvSchema } from "./env-schema.ts";
+export type { AuthoringStyle, BuildFewShotCorpusOptions, CorpusWarning, FewShotCorpus, FewShotEntry, } from "./few-shot-corpus.ts";
+export { buildFewShotCorpus, pathToId } from "./few-shot-corpus.ts";
+export { resolveFrameworkVersion } from "./framework-version.ts";
+export { type ToDevHostDispatchOptions, toDevHostDispatch } from "./host-dispatch-adapter.ts";
+export type { CliOutput, RunInitDeployCliOptions } from "./init-deploy-cli.ts";
+export { runInitDeployCli } from "./init-deploy-cli.ts";
+export type { RunDevAppAuthOptions, RunDevAppOptions, SeedFn } from "./run-dev-app.ts";
+export { runDevApp } from "./run-dev-app.ts";
+export type { ScaffoldAppOptions, ScaffoldAppResult, ScaffoldFeatureEntry, } from "./scaffold-app.ts";
+export { SCAFFOLD_BIOME_VERSION, scaffoldApp } from "./scaffold-app.ts";
+export type { ScaffoldAppFeatureOptions, ScaffoldAppFeatureResult, } from "./scaffold-app-feature.ts";
+export { runConfigPathForApp, scaffoldAppFeature } from "./scaffold-app-feature.ts";
+export type { CheckDeployDriftResult, DeployDriftEntry, RenderDeployFilesOptions, RenderDeployFilesResult, RenderedDeployFile, ScaffoldDeployDetected, ScaffoldDeployOptions, ScaffoldDeployResult, ScaffoldedFile, } from "./scaffold-deploy.ts";
+export { checkDeployDrift, renderDeployFiles, scaffoldDeploy } from "./scaffold-deploy.ts";
+export type { ScaffoldFeatureOptions, ScaffoldFeatureResult } from "./scaffold-feature.ts";
+export { scaffoldFeature } from "./scaffold-feature.ts";
+export { type SetupTestStackFromFeaturesOptions, setupTestStackFromFeatures, type TestStackPreset, } from "./setup-test-stack-from-features.ts";
+export { renderWelcomeBanner, type WelcomeBannerInput } from "./welcome-banner.ts";

package/dist/index.js

@@ -17,11 +17,12 @@ export { composeFeatures, } from "@cosmicdrift/kumiko-server-runtime/compose-fea
 // im Sub-Path-Export `@cosmicdrift/kumiko-dev-server/build`. Damit zieht der Main-Barrel
 // kein Bun-Toolchain-Bundle mehr in Production-Reads (z.B. wenn drizzle-kit
 // die App-Config unter Node lädt).
-export { composeFileStack, composeGdprStack, composeIdentityStack, composeMailStack, composeOpsStack, composePagesStack, composeRendererStack, composeUserDataRightsStack, stackFeatureNames, } from "./compose-stacks.js";
+export { composeAuthStack, composeFileStack, composeGdprStack, composeIdentityStack, composeMailStack, composeOpsStack, composePagesStack, composeRendererStack, composeSaasStack, composeSecurityStack, composeUserDataRightsStack, stackFeatureNames, } from "./compose-stacks.js";
 export { createKumikoServer, PROD_BUNDLES_ENV, resolveStylesheet, STYLESHEET_WATCH_ENV, } from "./create-kumiko-server.js";
 export { frameworkCoreEnvSchema } from "./env-schema.js";
 export { buildFewShotCorpus, pathToId } from "./few-shot-corpus.js";
 export { resolveFrameworkVersion } from "./framework-version.js";
+export { toDevHostDispatch } from "./host-dispatch-adapter.js";
 export { runInitDeployCli } from "./init-deploy-cli.js";
 export { runDevApp } from "./run-dev-app.js";
 export { SCAFFOLD_BIOME_VERSION, scaffoldApp } from "./scaffold-app.js";

package/dist/init-deploy-cli.js

@@ -8,8 +8,13 @@ import { getFlag, getNumberFlag, getStringFlag, parseArgs, } from "@cosmicdrift/
 import * as z from "zod";
 import { checkDeployDrift, scaffoldDeploy } from "./scaffold-deploy.js";
 const USAGE = "Usage: kumiko-init-deploy --app <name> [--port <n>] [--github-org <org>] [--out <dir>] [--force | --check]";
+// Kept for one release so existing pipelines keep running; deploy/ is now a
+// managed-files group that `kumiko new app` writes and `kumiko sync-managed` updates.
+const DEPRECATION_NOTICE = "  ! kumiko-init-deploy is deprecated and will be removed in the next release: deploy/ files are managed files now. Use `kumiko check managed` and `kumiko sync-managed --write`.";
 const HELP = `${USAGE}
 
+${DEPRECATION_NOTICE}
+
   --app <name>         app name (default: package.json "name" without its @scope/)
   --port <n>           port the container exposes
   --github-org <org>   GitHub org for the image reference
@@ -87,6 +92,7 @@ export async function runInitDeployCli({ argv, cwd, out, }) {
         out.log(HELP);
         return 0;
     }
+    out.err(DEPRECATION_NOTICE);
     const args = parseArgs(argv);
     const force = getFlag(args, "force");
     const check = getFlag(args, "check");

package/dist/managed-files/app-scripts.d.ts

@@ -0,0 +1,13 @@
+export declare const STANDARD_APP_SCRIPTS: readonly ["dev", "build", "start", "typecheck", "lint", "check", "test", "test:unit", "test:integration", "test:integration:ci", "test:dom", "test:real", "e2e", "e2e:real", "screenshots", "prepare"];
+export type StandardAppScript = (typeof STANDARD_APP_SCRIPTS)[number];
+/** Extras every app may carry; they are listed but expected. */
+export declare const KNOWN_EXTRA_APP_SCRIPTS: readonly ["test:verbose", "test:bunfig", "test:lib-coverage", "shots"];
+export type AppScriptsReport = {
+    readonly missing: readonly StandardAppScript[];
+    readonly knownExtras: readonly string[];
+    readonly appExtras: readonly string[];
+};
+export declare function checkAppScripts(scripts: Readonly<Record<string, string>>, options: {
+    readonly hasUi: boolean;
+}): AppScriptsReport;
+export declare const PREPARE_SCRIPT = "[ \"$HUSKY\" = \"0\" ] || git config core.hooksPath .husky 2>/dev/null || true";

package/dist/managed-files/app-scripts.js

@@ -0,0 +1,40 @@
+// The package.json scripts every app exposes, so agents and CI call the same
+// names in every repo.
+export const STANDARD_APP_SCRIPTS = [
+    "dev",
+    "build",
+    "start",
+    "typecheck",
+    "lint",
+    "check",
+    "test",
+    "test:unit",
+    "test:integration",
+    "test:integration:ci",
+    "test:dom",
+    "test:real",
+    "e2e",
+    "e2e:real",
+    "screenshots",
+    "prepare",
+];
+/** Extras every app may carry; they are listed but expected. */
+export const KNOWN_EXTRA_APP_SCRIPTS = [
+    "test:verbose",
+    "test:bunfig",
+    "test:lib-coverage",
+    "shots",
+];
+export function checkAppScripts(scripts, options) {
+    const required = STANDARD_APP_SCRIPTS.filter((name) => name !== "test:dom" || options.hasUi);
+    const standard = new Set(STANDARD_APP_SCRIPTS);
+    const known = new Set(KNOWN_EXTRA_APP_SCRIPTS);
+    const extras = Object.keys(scripts).filter((name) => !standard.has(name));
+    return {
+        missing: required.filter((name) => scripts[name] === undefined),
+        knownExtras: extras.filter((name) => known.has(name)),
+        appExtras: extras.filter((name) => !known.has(name)),
+    };
+}
+// The hooks path line every app already carries; HUSKY=0 (CI) skips it.
+export const PREPARE_SCRIPT = '[ "$HUSKY" = "0" ] || git config core.hooksPath .husky 2>/dev/null || true';

package/dist/managed-files/check.d.ts

@@ -0,0 +1,34 @@
+import { type ManagedAppFacts, type ManagedFile } from "./registry.ts";
+export type ManagedFileState = {
+    readonly state: "ok";
+} | {
+    readonly state: "missing";
+}
+/** `-` lines: template, `+` lines: repo. */
+ | {
+    readonly state: "differs";
+    readonly diff: string;
+}
+/** Exists without the marker; `diff` is set when the content also differs. */
+ | {
+    readonly state: "unmarked";
+    readonly diff?: string;
+} | {
+    readonly state: "local";
+    readonly reason: string;
+} | {
+    readonly state: "invalid";
+    readonly message: string;
+};
+export type ManagedFileReport = ManagedFileState & {
+    readonly path: string;
+    readonly kind: ManagedFile["kind"];
+};
+export type ManagedCheckResult = {
+    /** kumiko.config.ts calls defineAppConfig: drift fails the check from then on. */
+    readonly adopted: boolean;
+    readonly files: readonly ManagedFileReport[];
+};
+export declare function checkManagedFiles(facts: ManagedAppFacts): ManagedCheckResult;
+/** States that fail `kumiko check managed` once the app has adopted kumiko.config.ts. */
+export declare function isManagedDrift(report: ManagedFileReport): boolean;

package/dist/managed-files/check.js

@@ -0,0 +1,109 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { mergeBunfig } from "@cosmicdrift/kumiko-testing/bunfig";
+import { parseJsonc } from "./jsonc.js";
+import { renderLineDiff } from "./line-diff.js";
+import { readManagedMarker, stripManagedMarker } from "./marker.js";
+import { BIOME_PRESET, listManagedFiles, renderManagedBunfig, TSCONFIG_PRESET, } from "./registry.js";
+function readIfExists(path) {
+    return existsSync(path) ? readFileSync(path, "utf-8") : undefined;
+}
+function compareBodies(expected, actual) {
+    return expected === actual ? undefined : renderLineDiff(expected, actual);
+}
+function checkTemplate(file, existing) {
+    const marker = readManagedMarker(existing);
+    if (marker.kind === "invalid")
+        return { state: "invalid", message: marker.message };
+    if (marker.kind === "local")
+        return { state: "local", reason: marker.reason };
+    const diff = compareBodies(stripManagedMarker(file.content), stripManagedMarker(existing));
+    if (marker.kind === "unmarked")
+        return diff === undefined ? { state: "unmarked" } : { state: "unmarked", diff };
+    return diff === undefined ? { state: "ok" } : { state: "differs", diff };
+}
+function checkBunfig(file, existing) {
+    const marker = readManagedMarker(existing);
+    if (marker.kind === "invalid")
+        return { state: "invalid", message: marker.message };
+    if (marker.kind === "local")
+        return { state: "local", reason: marker.reason };
+    const merged = mergeBunfig(renderManagedBunfig(file, existing), existing);
+    if (!merged.ok) {
+        const keys = merged.unknownKeys.map(({ section, key }) => `[${section}] ${key}`).join(", ");
+        return { state: "invalid", message: `keys the generator does not own: ${keys}` };
+    }
+    const diff = compareBodies(merged.content, existing);
+    if (marker.kind === "unmarked")
+        return diff === undefined ? { state: "unmarked" } : { state: "unmarked", diff };
+    return diff === undefined ? { state: "ok" } : { state: "differs", diff };
+}
+function extendsList(value) {
+    if (typeof value !== "object" || value === null || !("extends" in value))
+        return [];
+    const extendsValue = value.extends;
+    return Array.isArray(extendsValue) ? extendsValue : [extendsValue];
+}
+function checkStructural(file, facts, existing) {
+    if (file.path === "kumiko.config.ts") {
+        switch (facts.config.kind) {
+            case "defined":
+                return { state: "ok" };
+            case "legacy":
+                return {
+                    state: "invalid",
+                    message: "default-export defineAppConfig({ features, client, ports }) from @cosmicdrift/kumiko-framework/config",
+                };
+            case "invalid":
+                return { state: "invalid", message: facts.config.message };
+            case "missing":
+                return { state: "missing" };
+        }
+    }
+    const preset = file.path === "biome.json" ? BIOME_PRESET : TSCONFIG_PRESET;
+    let parsed;
+    try {
+        parsed = parseJsonc(existing, file.path);
+    }
+    catch (error) {
+        return {
+            state: "invalid",
+            message: `cannot parse: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    return extendsList(parsed).includes(preset)
+        ? { state: "ok" }
+        : { state: "invalid", message: `must extend "${preset}"; keep app overrides below extends` };
+}
+function checkFile(file, facts) {
+    if (file.kind === "structural" && file.path === "kumiko.config.ts") {
+        return checkStructural(file, facts, "");
+    }
+    const existing = readIfExists(join(facts.appRoot, file.path));
+    if (existing === undefined)
+        return { state: "missing" };
+    switch (file.kind) {
+        case "template":
+            return checkTemplate(file, existing);
+        case "bunfig":
+            return checkBunfig(file, existing);
+        case "structural":
+            return checkStructural(file, facts, existing);
+        case "seed":
+            return { state: "ok" };
+    }
+}
+export function checkManagedFiles(facts) {
+    return {
+        adopted: facts.config.kind === "defined",
+        files: listManagedFiles(facts).map((file) => ({
+            path: file.path,
+            kind: file.kind,
+            ...checkFile(file, facts),
+        })),
+    };
+}
+/** States that fail `kumiko check managed` once the app has adopted kumiko.config.ts. */
+export function isManagedDrift(report) {
+    return report.state !== "ok" && report.state !== "local";
+}

package/dist/managed-files/index.d.ts

@@ -0,0 +1,8 @@
+export { listAppPorts } from "@cosmicdrift/kumiko-framework/config";
+export { type AppScriptsReport, checkAppScripts, KNOWN_EXTRA_APP_SCRIPTS, PREPARE_SCRIPT, STANDARD_APP_SCRIPTS, type StandardAppScript, } from "./app-scripts.ts";
+export { checkManagedFiles, isManagedDrift, type ManagedCheckResult, type ManagedFileReport, type ManagedFileState, } from "./check.ts";
+export { addManagedMarker, MANAGED_MARKER, readManagedMarker, stripManagedMarker, } from "./marker.ts";
+export { findPortCollisions, type PortClaim, type PortCollision, type ScannedApp, scanWorkspaceApps, } from "./port-registry.ts";
+export { BIOME_PRESET, listManagedFiles, type ManagedAppFacts, type ManagedAppInput, type ManagedFile, type ManagedTemplateFile, renderBiomePresetJson, renderManagedBunfig, renderManagedTemplates, renderTsconfigPresetJson, resolveManagedAppFacts, TSCONFIG_PRESET, } from "./registry.ts";
+export { parseStaticAppConfig, readStaticAppConfig, type StaticAppConfig, } from "./static-app-config.ts";
+export { type SyncAction, type SyncManagedOptions, syncManagedFiles } from "./sync.ts";

package/dist/managed-files/index.js

@@ -0,0 +1,8 @@
+export { listAppPorts } from "@cosmicdrift/kumiko-framework/config";
+export { checkAppScripts, KNOWN_EXTRA_APP_SCRIPTS, PREPARE_SCRIPT, STANDARD_APP_SCRIPTS, } from "./app-scripts.js";
+export { checkManagedFiles, isManagedDrift, } from "./check.js";
+export { addManagedMarker, MANAGED_MARKER, readManagedMarker, stripManagedMarker, } from "./marker.js";
+export { findPortCollisions, scanWorkspaceApps, } from "./port-registry.js";
+export { BIOME_PRESET, listManagedFiles, renderBiomePresetJson, renderManagedBunfig, renderManagedTemplates, renderTsconfigPresetJson, resolveManagedAppFacts, TSCONFIG_PRESET, } from "./registry.js";
+export { parseStaticAppConfig, readStaticAppConfig, } from "./static-app-config.js";
+export { syncManagedFiles } from "./sync.js";

package/dist/managed-files/jsonc.d.ts

@@ -0,0 +1 @@
+export declare function parseJsonc(source: string, context: string): unknown;

package/dist/managed-files/jsonc.js

@@ -0,0 +1,12 @@
+import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+// Strings come first in each alternation, so comment and comma patterns
+// inside string literals are matched as part of the string and kept.
+const STRING_OR_COMMENT = /"(?:\\.|[^"\\])*"|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+const STRING_OR_TRAILING_COMMA = /"(?:\\.|[^"\\])*"|,(\s*[}\]])/g;
+// biome.json and tsconfig.json accept comments and trailing commas; strip both
+// (outside strings) so they parse as JSON.
+export function parseJsonc(source, context) {
+    const withoutComments = source.replace(STRING_OR_COMMENT, (match) => match.startsWith('"') ? match : "");
+    const withoutTrailingCommas = withoutComments.replace(STRING_OR_TRAILING_COMMA, (match, afterComma) => afterComma ?? match);
+    return parseJsonOrThrow(withoutTrailingCommas, context);
+}

package/dist/managed-files/line-diff.d.ts

@@ -0,0 +1,2 @@
+/** `-` lines are what the template expects, `+` lines what the repo has. */
+export declare function renderLineDiff(expected: string, actual: string): string;