@cosmicdrift/kumiko-dev-server 0.378.0 → 0.380.0

package/bin/kumiko-dev.ts

@@ -54,7 +54,9 @@ const crashTracker = createCrashTracker({
 const spawnServer = (): void => {
   const child = spawn(bunPath, ["run", entry, ...passthroughArgs], {
     stdio: "inherit",
-    env: process.env,
+    // Error responses carry cause details only under an explicit development/test NODE_ENV,
+    // so a local dev run without one would hide them.
+    env: { ...process.env, NODE_ENV: process.env["NODE_ENV"] ?? "development" },
   });
 
   child.on("exit", (code, signal) => {

package/dist/create-kumiko-server.d.ts

@@ -37,7 +37,7 @@ export type DevHostDispatchResult = {
     readonly kind: "html";
     readonly entryName: string;
     /** @deprecated Ignored — HTML never carries the schema; createKumikoApp
-     *  fetches it from the authenticated GET /api/schema. */
+     *  fetches it from the authenticated GET /api/schema. Removed in 0.390.0. */
     readonly injectSchema?: boolean;
 } | {
     /** Static HTML: serves a file verbatim, no bundle injection. Mirrors

package/dist/managed-files/check.d.ts

@@ -28,8 +28,8 @@ export type ManagedCheckResult = {
     /** kumiko.config.ts calls defineAppConfig: drift fails the check from then on. */
     readonly adopted: boolean;
     readonly files: readonly ManagedFileReport[];
-    /** Findings that do not fail the check. */
-    readonly warnings: readonly string[];
+    /** Findings that fail the check on their own. */
+    readonly errors: readonly string[];
 };
 export declare function checkManagedFiles(facts: ManagedAppFacts): ManagedCheckResult;
 /** States that fail `kumiko check managed` once the app has adopted kumiko.config.ts. */

package/dist/managed-files/check.js

@@ -5,7 +5,7 @@ import { stripAppJobs } from "./app-jobs.js";
 import { parseJsonc } from "./jsonc.js";
 import { renderLineDiff } from "./line-diff.js";
 import { readManagedMarker, stripManagedMarker } from "./marker.js";
-import { BIOME_PRESET, listManagedFiles, listManagedWarnings, renderManagedBunfig, TSCONFIG_PRESET, } from "./registry.js";
+import { BIOME_PRESET, listManagedErrors, listManagedFiles, renderManagedBunfig, TSCONFIG_PRESET, } from "./registry.js";
 function readIfExists(path) {
     return existsSync(path) ? readFileSync(path, "utf-8") : undefined;
 }
@@ -102,7 +102,7 @@ export function checkManagedFiles(facts) {
             kind: file.kind,
             ...checkFile(file, facts),
         })),
-        warnings: listManagedWarnings(facts),
+        errors: listManagedErrors(facts),
     };
 }
 /** States that fail `kumiko check managed` once the app has adopted kumiko.config.ts. */

package/dist/managed-files/index.d.ts

@@ -2,5 +2,6 @@ export { findPortCollisions, listAppPorts, type PortClaim, type PortCollision, p
 export { type AppScriptsReport, checkAppScripts, KNOWN_EXTRA_APP_SCRIPTS, PREPARE_SCRIPT, STANDARD_APP_SCRIPTS, type StandardAppScript, } from "./app-scripts.ts";
 export { checkManagedFiles, isManagedDrift, type ManagedCheckResult, type ManagedFileReport, type ManagedFileState, } from "./check.ts";
 export { addManagedMarker, MANAGED_MARKER, readManagedMarker, stripManagedMarker, } from "./marker.ts";
-export { BIOME_PRESET, listManagedFiles, listManagedWarnings, type ManagedAppFacts, type ManagedAppInput, type ManagedFile, type ManagedTemplateFile, renderBiomePresetJson, renderManagedBunfig, renderManagedTemplates, renderTsconfigPresetJson, resolveManagedAppFacts, TSCONFIG_PRESET, } from "./registry.ts";
+export { findKumikoPinErrors } from "./pins.ts";
+export { BIOME_PRESET, CURRENT_INFRA_REF, listManagedErrors, listManagedFiles, type ManagedAppFacts, type ManagedAppInput, type ManagedFile, type ManagedTemplateFile, renderBiomePresetJson, renderManagedBunfig, renderManagedTemplates, renderTsconfigPresetJson, resolveManagedAppFacts, TSCONFIG_PRESET, } from "./registry.ts";
 export { type SyncAction, type SyncManagedOptions, syncManagedFiles } from "./sync.ts";

package/dist/managed-files/index.js

@@ -2,5 +2,6 @@ export { findPortCollisions, listAppPorts, parseStaticAppConfig, readStaticAppCo
 export { checkAppScripts, KNOWN_EXTRA_APP_SCRIPTS, PREPARE_SCRIPT, STANDARD_APP_SCRIPTS, } from "./app-scripts.js";
 export { checkManagedFiles, isManagedDrift, } from "./check.js";
 export { addManagedMarker, MANAGED_MARKER, readManagedMarker, stripManagedMarker, } from "./marker.js";
-export { BIOME_PRESET, listManagedFiles, listManagedWarnings, renderBiomePresetJson, renderManagedBunfig, renderManagedTemplates, renderTsconfigPresetJson, resolveManagedAppFacts, TSCONFIG_PRESET, } from "./registry.js";
+export { findKumikoPinErrors } from "./pins.js";
+export { BIOME_PRESET, CURRENT_INFRA_REF, listManagedErrors, listManagedFiles, renderBiomePresetJson, renderManagedBunfig, renderManagedTemplates, renderTsconfigPresetJson, resolveManagedAppFacts, TSCONFIG_PRESET, } from "./registry.js";
 export { syncManagedFiles } from "./sync.js";

package/dist/managed-files/pins.d.ts

@@ -0,0 +1,2 @@
+/** Errors for Kumiko dependencies of an app: every one exact, and one version per scope. */
+export declare function findKumikoPinErrors(packageJson: unknown): readonly string[];

package/dist/managed-files/pins.js

@@ -0,0 +1,43 @@
+import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
+// peerDependencies stay out: libraries declare a lower bound (>=x.y.z) on purpose.
+const DEPENDENCY_BLOCKS = ["dependencies", "devDependencies", "optionalDependencies"];
+const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+function pinScopeOf(name) {
+    if (name === "create-kumiko-app" || name.startsWith("@cosmicdrift/kumiko-")) {
+        return "@cosmicdrift";
+    }
+    if (name.startsWith("@cosmicdriftgamestudio/kumiko-"))
+        return "@cosmicdriftgamestudio";
+    return undefined;
+}
+function dependencyEntries(block) {
+    if (!isPlainObject(block))
+        return [];
+    return Object.entries(block).flatMap(([name, spec]) => typeof spec === "string" ? [[name, spec]] : []);
+}
+/** Errors for Kumiko dependencies of an app: every one exact, and one version per scope. */
+export function findKumikoPinErrors(packageJson) {
+    const errors = [];
+    const versionsByScope = new Map();
+    for (const blockName of DEPENDENCY_BLOCKS) {
+        const block = propertyOf(packageJson, blockName);
+        for (const [name, spec] of dependencyEntries(block)) {
+            const scope = pinScopeOf(name);
+            if (scope === undefined || spec.startsWith("workspace:"))
+                continue;
+            if (!EXACT_VERSION.test(spec)) {
+                errors.push(`package.json#${blockName}: ${name}@${spec} is not an exact version. Pin it without ^ or ~ (kumiko-upgrade --apply rewrites the pins).`);
+                continue;
+            }
+            const versions = versionsByScope.get(scope) ?? new Set();
+            versions.add(spec);
+            versionsByScope.set(scope, versions);
+        }
+    }
+    for (const [scope, versions] of versionsByScope) {
+        if (versions.size > 1) {
+            errors.push(`package.json: ${scope} packages are pinned to ${versions.size} versions (${[...versions].sort().join(", ")}). Use one version per scope.`);
+        }
+    }
+    return errors;
+}

package/dist/managed-files/registry.d.ts

@@ -18,6 +18,8 @@ export type ManagedAppFacts = {
 };
 /** Ref used in the workflow templates while `kumiko.deploy.infraRef` is unset. */
 export declare const DEFAULT_INFRA_REF = "main";
+/** Infra tag a new app is scaffolded with; Renovate keeps it current via the reusables-v* rule. */
+export declare const CURRENT_INFRA_REF = "reusables-v1.2.0";
 /** Byte-compared after the marker lines are stripped. */
 export type ManagedTemplateFile = {
     readonly kind: "template";
@@ -44,8 +46,8 @@ export type ManagedSeedFile = {
 };
 export type ManagedFile = ManagedTemplateFile | ManagedBunfigFile | ManagedStructuralFile | ManagedSeedFile;
 export declare function resolveManagedAppFacts(input: ManagedAppInput): ManagedAppFacts;
-/** Findings that do not fail `kumiko check managed`. */
-export declare function listManagedWarnings(facts: ManagedAppFacts): readonly string[];
+/** Findings that fail `kumiko check managed` whether or not the app adopted kumiko.config.ts. */
+export declare function listManagedErrors(facts: ManagedAppFacts): readonly string[];
 export declare function renderManagedTemplates(facts: ManagedAppFacts): readonly ManagedTemplateFile[];
 export declare function managedBunfigFiles(facts: ManagedAppFacts): readonly ManagedBunfigFile[];
 /** Options are the app's choice; read them from the file so the check only flags real drift. */

package/dist/managed-files/registry.js

@@ -10,10 +10,13 @@ import { BUNFIG_FILES, renderBunfig } from "@cosmicdrift/kumiko-testing/bunfig";
 import { isKebabSegment } from "../kebab.js";
 import { readReleaseTarget, render, renderDeployFiles, } from "../scaffold-deploy.js";
 import { addManagedMarker } from "./marker.js";
+import { findKumikoPinErrors } from "./pins.js";
 export const BIOME_PRESET = "@cosmicdrift/kumiko-framework/biome";
 export const TSCONFIG_PRESET = "@cosmicdrift/kumiko-framework/tsconfig.app.json";
 /** Ref used in the workflow templates while `kumiko.deploy.infraRef` is unset. */
 export const DEFAULT_INFRA_REF = "main";
+/** Infra tag a new app is scaffolded with; Renovate keeps it current via the reusables-v* rule. */
+export const CURRENT_INFRA_REF = "reusables-v1.2.0";
 function templatesDir() {
     return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "templates", "managed");
 }
@@ -44,14 +47,20 @@ export function resolveManagedAppFacts(input) {
         deploy: readReleaseTarget(input.appRoot, appName),
     };
 }
-/** Findings that do not fail `kumiko check managed`. */
-export function listManagedWarnings(facts) {
+function readPackageJsonOrEmpty(appRoot) {
+    const path = join(appRoot, "package.json");
+    return existsSync(path) ? parseJsonOrThrow(readFileSync(path, "utf-8"), path) : {};
+}
+/** Findings that fail `kumiko check managed` whether or not the app adopted kumiko.config.ts. */
+export function listManagedErrors(facts) {
+    const errors = [];
     if (facts.deploy.visibility === "private" && facts.deploy.infraRef === undefined) {
-        return [
-            `package.json#kumiko.deploy.infraRef is not set: ci.yml and release.yml call the infra workflows at @${DEFAULT_INFRA_REF}. Set it to an infra tag; a missing value will fail this check in a later release.`,
-        ];
+        errors.push("package.json#kumiko.deploy.infraRef is not set. Set kumiko.deploy.infraRef to an infra tag (reusables-vX.Y.Z); ci.yml and release.yml would otherwise call the infra workflows at @" +
+            DEFAULT_INFRA_REF +
+            ".");
     }
-    return [];
+    errors.push(...findKumikoPinErrors(readPackageJsonOrEmpty(facts.appRoot)));
+    return errors;
 }
 function marked(path, body, style, executable = false) {
     return { kind: "template", path, content: addManagedMarker(body, style), executable };

package/dist/run-dev-app.js

@@ -187,7 +187,13 @@ export async function runDevApp(options) {
     configurePiiSubjectKms(piiKms.kms);
     configureBlindIndexKey(piiKms.blindIndexKey);
     const releaseEphemeralPiiKms = captureEphemeralDevPiiKms(piiKms);
+    // The auth features bind database-backed revokers onto their (possibly shared) instances;
+    // stop() swaps them for inert ones so a later stack in the same process never reaches this
+    // app's closed connection.
+    const resetLateBindings = [];
     const releasePiiKms = async () => {
+        for (const reset of resetLateBindings)
+            reset();
         releaseEphemeralPiiKms();
         await wiring.kms.close();
     };
@@ -419,13 +425,13 @@ export async function runDevApp(options) {
                 });
                 const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
                 if (sessionsFeature) {
-                    bindAutoRevokeFromFeature(sessionsFeature)?.(store.massRevoker);
+                    bindReleasable(bindAutoRevokeFromFeature(sessionsFeature), store.massRevoker, INERT_REVOKER, resetLateBindings);
                 }
                 if (mfaFeature) {
-                    bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(store.revokeAllOthers);
+                    bindReleasable(bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature), store.revokeAllOthers, INERT_REVOKER, resetLateBindings);
                 }
                 if (mfaFeature && patFeature) {
-                    bindRevokeAllPatTokensFromFeature(mfaFeature)?.((userId) => revokeAllPatTokensForUser(stack.db, userId));
+                    bindReleasable(bindRevokeAllPatTokensFromFeature(mfaFeature), (userId) => revokeAllPatTokensForUser(stack.db, userId), INERT_REVOKER, resetLateBindings);
                 }
                 sessionStore = store;
             }
@@ -433,7 +439,7 @@ export async function runDevApp(options) {
                 tokenVerifier = (rawToken) => resolveTokenVerifier({ db: stack.db, registry: stack.registry }, rawToken);
                 // Password-change → PAT-revoke: independent of sessions/MFA being
                 // mounted, so wired unconditionally here whenever PAT itself is.
-                bindPatAutoRevokeOnPasswordChangeFromFeature(patFeature)?.((userId) => revokeAllPatTokensForUser(stack.db, userId));
+                bindReleasable(bindPatAutoRevokeOnPasswordChangeFromFeature(patFeature), (userId) => revokeAllPatTokensForUser(stack.db, userId), INERT_REVOKER, resetLateBindings);
             }
             if (effectiveAuth) {
                 await seedAdminGuarded(stack.db, effectiveAuth.admin);
@@ -487,6 +493,14 @@ export async function runDevApp(options) {
         },
     };
 }
+const INERT_REVOKER = async () => 0;
+// Binds a late-bound revoker and records how to swap it for an inert one when the app stops.
+function bindReleasable(bind, revoker, inert, resets) {
+    if (bind) {
+        bind(revoker);
+        resets.push(() => bind(inert));
+    }
+}
 // Exported for the wiring-contract test (config-resolver-default.integration):
 // pins that the dev configResolver-default carries the ENV→app-override bridge
 // and that a caller-supplied configResolver still overrides it. Not re-exported

package/dist/scaffold-app-feature.js

@@ -149,8 +149,7 @@ function renderSchemaIndex(name) {
 }
 function renderWebIndex(name) {
     const camel = kebabToCamel(name);
-    return `// @runtime client
-// Client-Seite des Features: translations, components (custom-Screens),
+    return `// Client-Seite des Features: translations, components (custom-Screens),
 // columnRenderers. In src/app/client.tsx bei
 // createKumikoApp({ clientFeatures: [...] }) einhängen — das passiert
 // NICHT automatisch. Screens: eine Datei pro Screen in diesem Ordner.

package/dist/scaffold-app.d.ts

@@ -37,8 +37,7 @@ export type ScaffoldAppOptions = {
      *  @cosmicdrift/kumiko-testing/scaffold. Without it the app gets the managed
      *  bunfigs but no example tests and fewer standard scripts. */
     readonly testSetup?: ScaffoldTestSetupFactory;
-    /** Infra tag written to `package.json#kumiko.deploy.infraRef`. Unset: the managed
-     *  workflows call infra at `main` and `kumiko check managed` warns. */
+    /** Infra tag written to `package.json#kumiko.deploy.infraRef`. Default: CURRENT_INFRA_REF. */
     readonly infraRef?: string;
 };
 export type ScaffoldAppResult = {

package/dist/scaffold-app.js

@@ -23,7 +23,7 @@ import { APP_CONFIG_FILE } from "@cosmicdrift/kumiko-framework/config";
 import { collectTableMetas, generateMigration, writeSnapshotJson, } from "@cosmicdrift/kumiko-framework/db";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { isKebabSegment } from "./kebab.js";
-import { PREPARE_SCRIPT, resolveManagedAppFacts, syncManagedFiles } from "./managed-files/index.js";
+import { CURRENT_INFRA_REF, PREPARE_SCRIPT, resolveManagedAppFacts, syncManagedFiles, } from "./managed-files/index.js";
 import { renderAgentsMd, renderClaudeMd, renderMountedFeatureList } from "./scaffold-agent-docs.js";
 import { createDemoTasksFeature, renderDemoSeedFile, renderDemoTasksFeatureFile, renderDemoTasksI18n, renderDemoTasksIndex, renderDemoTasksWebIndex, } from "./scaffold-demo-tasks.js";
 // Exact pin (no caret): the generated files are formatted to this Biome's output,
@@ -51,7 +51,7 @@ export async function scaffoldApp(options) {
     mkdirSync(join(destination, "src"), { recursive: true });
     mkdirSync(join(destination, "kumiko"), { recursive: true });
     const files = [];
-    write(join(destination, "package.json"), renderPackageJson(options.name, version, testSetup, options.infraRef));
+    write(join(destination, "package.json"), renderPackageJson(options.name, version, testSetup, options.infraRef ?? CURRENT_INFRA_REF));
     files.push("package.json");
     write(join(destination, "kumiko.json"), renderKumikoManifest());
     files.push("kumiko.json");
@@ -143,7 +143,7 @@ function renderPackageJson(name, version, testSetup, infraRef) {
         version: "0.1.0",
         private: true,
         type: "module",
-        ...(infraRef === undefined ? {} : { kumiko: { deploy: { infraRef } } }),
+        kumiko: { deploy: { infraRef } },
         scripts: appScripts(testSetup),
         dependencies: {
             "@cosmicdrift/kumiko-bundled-features": version,

package/dist/setup-test-stack-from-features.js

@@ -30,7 +30,7 @@ export function mergeExtraContext(base, presets) {
             Object.assign(merged, addConfigAccessorFactory({ configResolver }, deps.registry));
         }
         if (presets.includes("template-resolver")) {
-            merged["templateResolver"] = createTemplateResolverApi(deps.db);
+            merged["templateResolver"] = createTemplateResolverApi(deps.db, deps.registry);
         }
         return merged;
     };

package/dist/testing.d.ts

@@ -6,6 +6,9 @@ import { type TestStack } from "@cosmicdrift/kumiko-testing/stack";
 import { type SetupTestStackFromFeaturesOptions } from "./setup-test-stack-from-features.ts";
 export type SetupAppTestStackOptions = SetupTestStackFromFeaturesOptions & {
     readonly registryTables?: boolean;
+    /** Same as `RunDevAppOptions["featureToggles"]`: mounts `feature-toggles` (do not list it in `features`)
+     *  and layers its operator switches over the dispatcher's feature gate. Replaces `effectiveFeatures`. */
+    readonly featureToggles?: boolean;
 };
 export declare function setupAppTestStack(features: readonly FeatureDefinition[], options?: SetupAppTestStackOptions): Promise<TestStack>;
 export declare function seedTenant(stack: TestStack, options?: SeedTenantOptions): Promise<InProcessSeededTenant>;

package/dist/testing.js

@@ -4,21 +4,43 @@ import { hashPassword } from "@cosmicdrift/kumiko-bundled-features/auth-email-pa
 import { createMailTransportInMemoryFeature, getInbox, } from "@cosmicdrift/kumiko-bundled-features/mail-transport-inmemory";
 import { TenantHandlers, TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { UserHandlers } from "@cosmicdrift/kumiko-bundled-features/user";
+import { resolveFeatureTogglesOption } from "@cosmicdrift/kumiko-server-runtime";
 import { persistTenantRowsWith, seedTenantWith, } from "@cosmicdrift/kumiko-testing";
 import { createE2eSeedRoutes as createE2eSeedRoutesWith, } from "@cosmicdrift/kumiko-testing/e2e/seed-route";
 import { pushEntityProjectionTables } from "@cosmicdrift/kumiko-testing/stack";
 import { setupTestStackFromFeatures, } from "./setup-test-stack-from-features.js";
 export async function setupAppTestStack(features, options = {}) {
-    const { registryTables = true, includeBundled = true, ...stackOptions } = options;
-    const stack = await setupTestStackFromFeatures(features, {
+    const { registryTables = true, includeBundled = true, featureToggles = false, ...stackOptions } = options;
+    if (featureToggles && stackOptions.effectiveFeatures !== undefined) {
+        throw new Error("setupAppTestStack: featureToggles replaces effectiveFeatures, set only one of them.");
+    }
+    const toggles = featureToggles ? resolveFeatureTogglesOption() : undefined;
+    const toggleResolver = { current: undefined };
+    const stack = await setupTestStackFromFeatures(toggles === undefined ? features : [...features, toggles.feature], {
         ...stackOptions,
         includeBundled,
         entityTables: registryTables,
+        ...(toggles !== undefined && {
+            effectiveFeatures: (tenantId) => {
+                if (toggleResolver.current === undefined) {
+                    throw new Error("feature-toggles: resolver not bound yet (boot order).");
+                }
+                return toggleResolver.current(tenantId);
+            },
+        }),
     });
-    if (!registryTables)
-        return stack;
     try {
-        await pushEntityProjectionTables(stack, stack.registry);
+        if (registryTables)
+            await pushEntityProjectionTables(stack, stack.registry);
+        if (toggles !== undefined) {
+            const bound = await toggles.bind({
+                db: stack.db,
+                registry: stack.registry,
+                cacheSync: stack.cacheSync,
+                tierResolver: undefined,
+            });
+            toggleResolver.current = bound.resolver;
+        }
     }
     catch (error) {
         await stack.cleanup();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.378.0",
+  "version": "0.380.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,14 +77,14 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.378.0",
-    "@cosmicdrift/kumiko-framework": "0.378.0",
-    "@cosmicdrift/kumiko-renderer": "0.378.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.378.0",
-    "@cosmicdrift/kumiko-guards": "0.378.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.378.0",
-    "@cosmicdrift/kumiko-testing": "0.378.0",
-    "@cosmicdrift/kumiko-types": "0.378.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.380.0",
+    "@cosmicdrift/kumiko-framework": "0.380.0",
+    "@cosmicdrift/kumiko-renderer": "0.380.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.380.0",
+    "@cosmicdrift/kumiko-guards": "0.380.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.380.0",
+    "@cosmicdrift/kumiko-testing": "0.380.0",
+    "@cosmicdrift/kumiko-types": "0.380.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "runDevApp stop releases the late-bound revokers",
+    "detail": "stop() swaps the session and PAT revokers that boot bound onto the auth-mfa, sessions and personal-access-tokens feature instances for inert ones, and those features now accept a new binding on a second boot instead of keeping the first. A later app or test stack on the same feature instances no longer reaches the closed database connection."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "setupAppTestStack featureToggles option",
+    "detail": "featureToggles true mounts the feature-toggles feature and binds it, so a disabled feature is unreachable in the test stack. It cannot be combined with effectiveFeatures."
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "kumiko check managed rejects loose Kumiko pins and a missing infraRef",
+    "detail": "In an app, all @cosmicdrift/kumiko-*, create-kumiko-app and @cosmicdriftgamestudio/kumiko-* dependencies must be exact versions (workspace specs are allowed) on one version per scope. A private app without kumiko.deploy.infraRef is an error instead of a warning. In @cosmicdrift/kumiko-dev-server, listManagedWarnings is now listManagedErrors and ManagedCheckResult.warnings is now errors.",
+    "migration": "Pin the Kumiko dependencies without ^ or ~ and to one version per scope. Set kumiko.deploy.infraRef to an infra tag (reusables-vX.Y.Z) in package.json. Programmatic callers: rename listManagedWarnings to listManagedErrors and ManagedCheckResult.warnings to errors."
+  },
   {
     "version": "0.378.0",
     "type": "improvement",