@cosmicdrift/kumiko-dev-server 0.386.0 → 0.388.0

package/dist/dev-server-runtime.d.ts

@@ -0,0 +1,5 @@
+/// <reference types="bun-types" preserve="true" />
+export declare const hasBun: boolean;
+export type BunServer = typeof Bun extends undefined ? unknown : ReturnType<typeof Bun.serve>;
+export declare const logInfo: (msg: string) => void;
+export declare const logError: (...args: unknown[]) => void;

package/dist/dev-server-runtime.js

@@ -0,0 +1,11 @@
+/// <reference types="bun-types" preserve="true" />
+// The dev server is meant to run under Bun, but this module must at least
+// load without it: every Bun.* call is gated, and tests drive the fetch
+// handler directly instead of going through Bun.serve and real sockets.
+export const hasBun = typeof Bun !== "undefined";
+// @wrapper-known semantic-alias
+// biome-ignore lint/suspicious/noConsole: dev-server status logging
+export const logInfo = (msg) => console.log(msg);
+// @wrapper-known semantic-alias
+// biome-ignore lint/suspicious/noConsole: dev-server error logging
+export const logError = (...args) => console.error(...args);

package/dist/env-schema.d.ts

@@ -4,7 +4,7 @@ import * as z from "zod";
  *
  *  PORT-default "3000" is the same fallback as
  *  `packages/dev-server/src/run-prod-app.ts:533` — keep in sync when the
- *  call-site is refactored to consume parsed env (Sprint 9.5 Phase 4). */
+ *  call-site is refactored to consume parsed env. */
 export declare const frameworkCoreEnvSchema: z.ZodObject<{
     PORT: z.ZodDefault<z.ZodString>;
     DATABASE_URL: z.ZodURL;

package/dist/env-schema.js

@@ -1,26 +1,26 @@
 // @runtime runtime
 // Consumed at prod boot via composeEnvSchema (same as compose-stacks),
-// not only by tooling — keep runtime-isolation-safe (kumiko-framework#2340).
+// not only by tooling — keep runtime-isolation-safe.
 //
 // Framework-core env-schema — the vars that runProdApp + buildServer
 // + the connection-pool read directly from process.env today. Apps merge
 // this into their app-wide schema via `composeEnvSchema({ core, ... })`.
 //
-// Sprint 9.2 is purely additive: the schema is exposed, but the call-sites
+// The schema is purely additive: it is exposed, but the call-sites
 // in run-prod-app.ts (requireEnv("DATABASE_URL"), …) and api/server.ts
 // (process.env["KUMIKO_INSTANCE_ID"]) keep reading process.env directly.
 // Apps that opt into the schema get aggregated boot-validation errors
 // BEFORE those legacy reads run; apps that don't, behave as before.
 //
 // Feature-specific vars (JWT_SECRET, KUMIKO_SECRETS_MASTER_KEY_*) live
-// in their owning feature's envSchema — Phase 2 (bundled-features).
+// in their owning feature's envSchema (bundled-features).
 import * as z from "zod";
 /** Env-vars read by framework-core (api/server, db/connection,
  *  dev-server/run-prod-app). NOT including feature-specific vars.
  *
  *  PORT-default "3000" is the same fallback as
  *  `packages/dev-server/src/run-prod-app.ts:533` — keep in sync when the
- *  call-site is refactored to consume parsed env (Sprint 9.5 Phase 4). */
+ *  call-site is refactored to consume parsed env. */
 export const frameworkCoreEnvSchema = z.object({
     PORT: z
         .string()

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { type ComposeFeaturesOptions, composeFeatures, } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 export { type AuthStackOptions, composeAuthStack, composeFileStack, composeGdprStack, composeIdentityStack, composeMailStack, composeOpsStack, composePagesStack, composeRendererStack, composeSaasStack, composeSecurityStack, composeUserDataRightsStack, type FileProviderKind, type FileStackOptions, type GdprStackOptions, type GdprStackOrder, type IdentityStackOptions, type MailStackOptions, type MailTransportKind, type OpsStackOptions, type PagesStackOptions, type SaasStackBilling, type SaasStackOptions, type SecurityStackOptions, stackFeatureNames, type UserDataRightsStackOptions, } from "./compose-stacks.ts";
-export { type CreateKumikoServerOptions, createKumikoServer, type DevHostDispatch, type DevHostDispatchResult, type KumikoServerHandle, PROD_BUNDLES_ENV, resolveStylesheet, STYLESHEET_WATCH_ENV, } from "./create-kumiko-server.ts";
+export { type CreateKumikoServerOptions, createKumikoServer, type DevHostDispatch, type DevHostDispatchResult, type KumikoServerHandle, } from "./create-kumiko-server.ts";
+export { PROD_BUNDLES_ENV } from "./create-kumiko-server-client-bundles.ts";
+export { resolveStylesheet, STYLESHEET_WATCH_ENV } from "./create-kumiko-server-stylesheet.ts";
 export { type FrameworkCoreEnv, frameworkCoreEnvSchema } from "./env-schema.ts";
 export type { AuthoringStyle, BuildFewShotCorpusOptions, CorpusWarning, FewShotCorpus, FewShotEntry, } from "./few-shot-corpus.ts";
 export { buildFewShotCorpus, pathToId } from "./few-shot-corpus.ts";

package/dist/index.js

@@ -1,24 +1,26 @@
-// Public API für den Kumiko-Dev-Server. Zwei Schichten:
+// Public API for the Kumiko development server, with two layers:
 //
 //   - createKumikoServer (low-level)
-//     Bun.serve-Wrapper der Client-Bundle, /styles.css, AppSchema-
-//     Injection, SSE-Reload und einen Auto-Mint-JWT-Modus liefert. Nimmt
-//     features + clientEntry direkt an, kein Auth-Auto-Wiring. Wer
-//     einen ungewöhnlichen Auth-Setup braucht (alternative Membership-
-//     Query, eigener Rate-Limiter, custom Login-Routes) geht hier rein.
+//     Bun.serve wrapper that provides the client bundle, /styles.css,
+//     AppSchema injection, SSE reload, and auto-minted JWTs. Accepts
+//     features + clientEntry directly without automatic auth wiring. Use it
+//     for unusual auth setups (alternative Membership query, custom rate
+//     limiter, or custom login routes).
 //
 //   - runDevApp (high-level)
-//     Mischt die Standard-Features (config/user/tenant/auth-email-
-//     password) automatisch dazu wenn `auth` gesetzt ist, wired die
-//     Login-Routes + Error-Map, ruft seedAdminGuarded im onAfterSetup. Default
-//     für Sample-Apps und Showcases — 5-10 Zeilen Bootstrap statt 50.
+//     Automatically adds the standard features (config/user/tenant/
+//     auth-email-password) when `auth` is set, wires the login routes and
+//     error map, and calls seedAdminGuarded in onAfterSetup. The default for
+//     sample apps and showcases: 5–10 lines of bootstrap instead of 50.
 export { composeFeatures, } from "@cosmicdrift/kumiko-server-runtime/compose-features";
-// Build-Toolchain (buildProdBundle, Bun.build, Tailwind-Pipeline, ts-morph) lebt
-// im Sub-Path-Export `@cosmicdrift/kumiko-dev-server/build`. Damit zieht der Main-Barrel
-// kein Bun-Toolchain-Bundle mehr in Production-Reads (z.B. wenn drizzle-kit
-// die App-Config unter Node lädt).
+// The build toolchain (buildProdBundle, Bun.build, Tailwind pipeline, ts-morph)
+// lives in the subpath export `@cosmicdrift/kumiko-dev-server/build`. This keeps
+// the Bun toolchain bundle out of production imports from the main barrel (for
+// example, when drizzle-kit loads the app config under Node).
 export { composeAuthStack, composeFileStack, composeGdprStack, composeIdentityStack, composeMailStack, composeOpsStack, composePagesStack, composeRendererStack, composeSaasStack, composeSecurityStack, composeUserDataRightsStack, stackFeatureNames, } from "./compose-stacks.js";
-export { createKumikoServer, PROD_BUNDLES_ENV, resolveStylesheet, STYLESHEET_WATCH_ENV, } from "./create-kumiko-server.js";
+export { createKumikoServer, } from "./create-kumiko-server.js";
+export { PROD_BUNDLES_ENV } from "./create-kumiko-server-client-bundles.js";
+export { resolveStylesheet, STYLESHEET_WATCH_ENV } from "./create-kumiko-server-stylesheet.js";
 export { frameworkCoreEnvSchema } from "./env-schema.js";
 export { buildFewShotCorpus, pathToId } from "./few-shot-corpus.js";
 export { resolveFrameworkVersion } from "./framework-version.js";

package/dist/managed-files/app-jobs.js

@@ -1,7 +1,7 @@
 // Jobs named `app-<name>` in a managed workflow belong to the app: drift
 // checks ignore them and a sync carries them over.
 const JOBS_HEADER = /^jobs:\s*$/;
-const JOB_START = /^ {2}([A-Za-z0-9_-]+):\s*$/;
+const JOB_START = /^ {2}["']?([A-Za-z0-9_-]+)["']?:\s*(?:#.*)?$/;
 const TOP_LEVEL_KEY = /^[^\s#]/;
 const APP_JOB_PREFIX = "app-";
 function isDetachedComment(line) {

package/dist/managed-files/check.js

@@ -53,7 +53,7 @@ function checkStructural(file, facts, existing) {
             case "legacy":
                 return {
                     state: "invalid",
-                    message: "default-export defineAppConfig({ features, client, ports }) from @cosmicdrift/kumiko-framework/config",
+                    message: "default-export defineAppConfig({ features: [...], client: { entries: [...] }, ports: { dev: 4173, e2e: 4174 } }) from @cosmicdrift/kumiko-framework/config",
                 };
             case "invalid":
                 return { state: "invalid", message: facts.config.message };

package/dist/run-dev-app-auth.d.ts

@@ -0,0 +1,38 @@
+import { type SessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SessionMetadata, TokenVerifier } from "@cosmicdrift/kumiko-framework/api";
+import type { EffectiveFeaturesResolver, FeatureDefinition, Registry, SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { resolveBootCrypto } from "@cosmicdrift/kumiko-server-runtime/boot/boot-crypto";
+import type { TestStack } from "@cosmicdrift/kumiko-testing/stack";
+import type { DevBootConfig } from "./run-dev-app-config.ts";
+export type DevLateBindings = {
+    tierResolver: EffectiveFeaturesResolver | undefined;
+    sessionStore: SessionStore | undefined;
+    tokenVerifier: TokenVerifier | undefined;
+    readonly resets: Array<() => void>;
+};
+export declare function createDevLateBindings(): DevLateBindings;
+export declare function createLateBoundEffectiveFeatures(lateBindings: DevLateBindings, enabled: boolean): EffectiveFeaturesResolver | undefined;
+declare function createDevSessionAuthFragment(lateBindings: DevLateBindings): {
+    sessionCreator: (user: SessionUser, meta: SessionMetadata) => Promise<string>;
+    sessionRevoker: (sid: string) => Promise<void>;
+    sessionChecker: (sid: string, userId: string) => Promise<import("@cosmicdrift/kumiko-framework/api").AuthSessionCheckResult>;
+};
+declare function createDevPatAuthFragment(patFeature: FeatureDefinition, lateBindings: DevLateBindings): {
+    tokenVerifier: (rawToken: string) => Promise<SessionUser | null>;
+    patRateLimiter: import("@cosmicdrift/kumiko-framework/api").LoginRateLimiter;
+};
+export type DevAuthWiring = {
+    readonly patFeature: FeatureDefinition | undefined;
+    readonly mfaFeature: FeatureDefinition | undefined;
+    readonly sessionAuthFragment: ReturnType<typeof createDevSessionAuthFragment> | undefined;
+    readonly patAuthFragment: ReturnType<typeof createDevPatAuthFragment> | undefined;
+};
+export declare function wireDevAuth(config: Pick<DevBootConfig, "features" | "effectiveAuth" | "envSource">, registry: Registry | undefined, sessionStoreProviderMounted: boolean, lateBindings: DevLateBindings): DevAuthWiring;
+export type DevAfterSetupContext = {
+    readonly config: DevBootConfig;
+    readonly bootCrypto: ReturnType<typeof resolveBootCrypto>;
+    readonly auth: DevAuthWiring;
+    readonly lateBindings: DevLateBindings;
+};
+export declare function runDevAfterSetup(stack: TestStack, ctx: DevAfterSetupContext): Promise<void>;
+export {};

package/dist/run-dev-app-auth.js

@@ -0,0 +1,155 @@
+import { EXT_SESSION_STORE, resolveSessionStore, resolveTokenVerifier, } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { AUTH_MFA_FEATURE, bindMfaRevokeAllOtherSessionsFromFeature, bindMfaTokenSecretsFromFeature, bindRevokeAllPatTokensFromFeature, } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
+import { bindPatAutoRevokeOnPasswordChangeFromFeature, PAT_FEATURE, patRateLimitFromFeature, revokeAllPatTokensForUser, } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
+import { bindAutoRevokeFromFeature, SESSIONS_FEATURE, } from "@cosmicdrift/kumiko-bundled-features/sessions";
+import { createInMemoryLoginRateLimiter } from "@cosmicdrift/kumiko-framework/api";
+import { applyStandardBootSeeds, assertMfaSwitchTenantGate, buildEffectiveFeaturesResolver, } from "@cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps";
+export function createDevLateBindings() {
+    return { tierResolver: undefined, sessionStore: undefined, tokenVerifier: undefined, resets: [] };
+}
+// Tier-Composition auto-wire: scan features for a
+// tenantTierResolver-extension and wire a late-bound wrapper here; it is
+// filled in onAfterSetup (where stack.db + stack.registry are available).
+// The global operator toggles layer over the same wrapper.
+// App-Author sees nothing — `createTierEngineFeature(opts)` mounts +
+// framework auto-wires.
+export function createLateBoundEffectiveFeatures(lateBindings, enabled) {
+    if (!enabled)
+        return undefined;
+    return Object.assign((tenantId) => {
+        // Defensive: Server starts AFTER onAfterSetup completes, so the
+        // resolver is filled before any request comes in. Throwing here
+        // means a programming error (boot order) rather than silent
+        // "all-features-on" misbehavior.
+        if (!lateBindings.tierResolver) {
+            throw new Error("tier-resolver: extension found but resolver not yet built — boot order issue?");
+        }
+        return lateBindings.tierResolver(tenantId);
+    }, {
+        // The real trialGate lands on the holder's resolver only after plugin.build(). Delegate rather than
+        // copy it because this wrapper closure is created before build().
+        // Return false when no trial gate is available.
+        trialGate: (tenantId, featureName) => lateBindings.tierResolver?.trialGate?.(tenantId, featureName) ?? Promise.resolve(false),
+    });
+}
+// Sessions: late-bound holder — resolveSessionStore needs concrete db+
+// registry (only after setupTestStack). Wired when sessions feature is
+// mounted; no auth.sessions opt-in anymore.
+function createDevSessionAuthFragment(lateBindings) {
+    const requireSessionStore = () => {
+        if (!lateBindings.sessionStore) {
+            throw new Error("[runDevApp] sessionStore accessed before onAfterSetup");
+        }
+        return lateBindings.sessionStore;
+    };
+    return {
+        sessionCreator: (user, meta) => requireSessionStore().creator(user, meta),
+        sessionRevoker: (sid) => requireSessionStore().revoker(sid),
+        sessionChecker: (sid, userId) => requireSessionStore().checker(sid, userId),
+    };
+}
+// Token-verifier opt-in: same late-bound holder pattern — resolveTokenVerifier
+// needs the real db+registry (only concrete after setupTestStack). Wired
+// whenever a provider feature (personal-access-tokens today) is mounted.
+function createDevPatAuthFragment(patFeature, lateBindings) {
+    const rl = patRateLimitFromFeature(patFeature);
+    return {
+        tokenVerifier: (rawToken) => {
+            if (!lateBindings.tokenVerifier) {
+                throw new Error("[runDevApp] token-verifier accessed before onAfterSetup");
+            }
+            return lateBindings.tokenVerifier(rawToken);
+        },
+        patRateLimiter: createInMemoryLoginRateLimiter(rl.maxRequests, rl.windowMs),
+    };
+}
+export function wireDevAuth(config, registry, sessionStoreProviderMounted, lateBindings) {
+    const { features, effectiveAuth, envSource } = config;
+    const patFeature = features.find((f) => f.name === PAT_FEATURE);
+    const mfaFeature = features.find((f) => f.name === AUTH_MFA_FEATURE);
+    // Same master secret as runProdApp. Without JWT_SECRET the feature keeps
+    // its explicit secrets, or its handlers report the missing binding.
+    const devMasterSecret = envSource["JWT_SECRET"];
+    if (mfaFeature && devMasterSecret) {
+        bindMfaTokenSecretsFromFeature(mfaFeature)?.(devMasterSecret, envSource);
+    }
+    if (effectiveAuth && mfaFeature && registry) {
+        assertMfaSwitchTenantGate(registry, "runDevApp");
+    }
+    const patAuthFragment = patFeature
+        ? createDevPatAuthFragment(patFeature, lateBindings)
+        : undefined;
+    // Parity with runProdApp: gate on sessionStore provider, not
+    // the sessions feature name — a custom provider must also wire auth
+    // callbacks. sessionStoreProviderMounted computed via the registry
+    // (same check as runProdApp) — not recomputed here.
+    const sessionAuthFragment = effectiveAuth && sessionStoreProviderMounted
+        ? createDevSessionAuthFragment(lateBindings)
+        : undefined;
+    return { patFeature, mfaFeature, sessionAuthFragment, patAuthFragment };
+}
+// Binds a late-bound revoker and records its unbind for when the app stops.
+function bindReleasable(bind, revoker, resets) {
+    if (bind)
+        resets.push(bind(revoker));
+}
+async function bindDevSessionStore(stack, ctx) {
+    const { config, auth, lateBindings } = ctx;
+    const { patFeature, mfaFeature } = auth;
+    // Secure-by-default: resolve sessionStore provider; bind
+    // password-change mass-revoke + MFA revokeAllOthers.
+    const store = await resolveSessionStore({
+        db: stack.db,
+        registry: stack.registry,
+    });
+    const sessionsFeature = config.features.find((f) => f.name === SESSIONS_FEATURE);
+    if (sessionsFeature) {
+        bindReleasable(bindAutoRevokeFromFeature(sessionsFeature), store.massRevoker, lateBindings.resets);
+    }
+    if (mfaFeature) {
+        bindReleasable(bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature), store.revokeAllOthers, lateBindings.resets);
+    }
+    if (mfaFeature && patFeature) {
+        bindReleasable(bindRevokeAllPatTokensFromFeature(mfaFeature), (userId) => revokeAllPatTokensForUser(stack.db, userId), lateBindings.resets);
+    }
+    lateBindings.sessionStore = store;
+}
+function bindDevPatVerifier(stack, patFeature, lateBindings) {
+    lateBindings.tokenVerifier = (rawToken) => resolveTokenVerifier({ db: stack.db, registry: stack.registry }, rawToken);
+    // Password-change → PAT-revoke: independent of sessions/MFA being
+    // mounted, so wired unconditionally here whenever PAT itself is.
+    bindReleasable(bindPatAutoRevokeOnPasswordChangeFromFeature(patFeature), (userId) => revokeAllPatTokensForUser(stack.db, userId), lateBindings.resets);
+}
+export async function runDevAfterSetup(stack, ctx) {
+    const { config, bootCrypto, auth, lateBindings } = ctx;
+    const { wiring, effectiveAuth, features } = config;
+    // Build tier-resolver BEFORE any seeds so seeds can rely
+    // on the resolver being live (e.g. seed that writes a SystemAdmin's
+    // tier-assignment can immediately read tier-cuts).
+    lateBindings.tierResolver = await buildEffectiveFeaturesResolver({
+        features,
+        featureToggles: wiring.featureToggles,
+        db: stack.db,
+        registry: stack.registry,
+        cacheSync: stack.cacheSync,
+    });
+    if (effectiveAuth && stack.registry.getExtensionUsages(EXT_SESSION_STORE).length > 0) {
+        await bindDevSessionStore(stack, ctx);
+    }
+    if (auth.patFeature) {
+        bindDevPatVerifier(stack, auth.patFeature, lateBindings);
+    }
+    // Apply r.config({ seeds }) declared by any registered feature.
+    // Runs before user-supplied seed callbacks so those can read /
+    // override the deploy-defaults.
+    await applyStandardBootSeeds({
+        db: stack.db,
+        registry: stack.registry,
+        admin: effectiveAuth?.admin,
+        shortcutSeeds: wiring.shortcutSeeds,
+        cipher: bootCrypto.configCipher,
+    });
+    for (const seed of config.stackSeeds) {
+        await seed(stack);
+    }
+}

package/dist/run-dev-app-config.d.ts

@@ -0,0 +1,26 @@
+import { type FeatureDefinition, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { type BootOptionWiring } from "@cosmicdrift/kumiko-server-runtime";
+import { resolveBootCrypto } from "@cosmicdrift/kumiko-server-runtime/boot/boot-crypto";
+import { resolveAuthMail, resolveUnsubscribeWiring } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
+import type { RunDevAppAuthOptions, RunDevAppOptions, SeedFn } from "./run-dev-app.ts";
+export type BootFailureCleanup = {
+    release: (() => Promise<void>) | undefined;
+};
+export type DevBootConfig = {
+    readonly stackSeeds: readonly SeedFn[];
+    readonly wiring: BootOptionWiring;
+    readonly envSource: Record<string, string | undefined>;
+    readonly effectiveAuth: ReturnType<typeof resolveAuthMail<RunDevAppAuthOptions>> | undefined;
+    readonly unsubscribeLinks: ReturnType<typeof resolveUnsubscribeWiring>["unsubscribeLinks"];
+    readonly extraRoutes: RunDevAppOptions["extraRoutes"];
+    readonly features: readonly FeatureDefinition[];
+};
+export declare function resolveDevBootConfig(options: RunDevAppOptions, bootFailure: BootFailureCleanup): Promise<DevBootConfig>;
+export declare function validateDevBoot(options: RunDevAppOptions, config: DevBootConfig): ReturnType<typeof resolveBootCrypto>;
+export declare function configureDevBootCrypto(options: RunDevAppOptions, config: DevBootConfig, bootCrypto: ReturnType<typeof resolveBootCrypto>, resetLateBindings: ReadonlyArray<() => void>, bootFailure: BootFailureCleanup): {
+    readonly releasePiiKms: () => Promise<void>;
+};
+export declare function resolveDevAuthRegistry(config: DevBootConfig): {
+    readonly registry: Registry | undefined;
+    readonly sessionStoreProviderMounted: boolean;
+};

package/dist/run-dev-app-config.js

@@ -0,0 +1,185 @@
+import { EXT_SESSION_STORE } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { configureBlindIndexKey, configurePiiSubjectKms, } from "@cosmicdrift/kumiko-framework/crypto";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { createRegistry, FILE_STORAGE_PROVIDER_BOOT_SENTINEL, FILE_STORAGE_PROVIDER_ENV, } from "@cosmicdrift/kumiko-framework/engine";
+import { parseEnv } from "@cosmicdrift/kumiko-framework/env";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { assertStackBootRequirements, isSeedFnList, rejectRemovedEffectiveFeatures, resolveBootOptionWiring, withBootOptionEnvBlocks, } from "@cosmicdrift/kumiko-server-runtime";
+import { resolveBootCrypto } from "@cosmicdrift/kumiko-server-runtime/boot/boot-crypto";
+import { composeAppFeatures, validateComposedFeatures, withEnvDefaults, } from "@cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps";
+import { assertPiiBootInvariants } from "@cosmicdrift/kumiko-server-runtime/pii-boot-gate";
+import { requireEnv, resolveAuthMail, resolveUnsubscribeWiring, } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
+import { assertSessionBootInvariants } from "@cosmicdrift/kumiko-server-runtime/session-boot-gate";
+import { logInfo } from "./dev-server-runtime.js";
+import { captureEphemeralDevPiiKms, resolveDevPiiKms, } from "./resolve-dev-pii-kms.js";
+function splitDevSeeds(options) {
+    const seedsConfig = options.seeds !== undefined && !isSeedFnList(options.seeds) ? options.seeds : undefined;
+    const stackSeeds = options.seeds === undefined
+        ? []
+        : isSeedFnList(options.seeds)
+            ? options.seeds
+            : (options.seeds.run ?? []);
+    return { seedsConfig, stackSeeds };
+}
+function parseDevEnvSchema(options, seedsConfig, rawEnvSource, envSchema) {
+    // Free dev seeds take the test stack; the env blocks only read the declarative part.
+    const { seeds: _devSeeds, kms: devKms, ...bootFields } = options;
+    const composed = withBootOptionEnvBlocks(envSchema, {
+        ...bootFields,
+        ...(devKms && { kms: devKms }),
+        ...(seedsConfig && { seeds: { ...seedsConfig, run: [] } }),
+        features: options.features,
+    });
+    parseEnv(composed.schema, rawEnvSource, { sources: composed.sources });
+}
+function devBootOptionWiringInput(options, seedsConfig) {
+    return {
+        features: options.features,
+        ...(options.mail && { mail: options.mail }),
+        ...(options.fileStorage && { fileStorage: options.fileStorage }),
+        ...(options.kmsMode !== undefined && { kmsMode: options.kmsMode }),
+        ...(options.billing && { billing: options.billing }),
+        ...(options.featureToggles && { featureToggles: true }),
+        ...(options.demoMode && { demoMode: options.demoMode }),
+        ...(seedsConfig && { seeds: { ...seedsConfig, run: [] } }),
+        ...(options.kms && { kms: options.kms }),
+        ...(options.blindIndexKey !== undefined && { blindIndexKey: options.blindIndexKey }),
+        ...(options.auth && { auth: options.auth }),
+    };
+}
+function collectDevExtraRoutes(options, unsubscribeRoutes, wiring) {
+    return unsubscribeRoutes.length === 0 && wiring.extraRoutes.length === 0
+        ? options.extraRoutes
+        : [...(options.extraRoutes ?? []), ...unsubscribeRoutes, ...wiring.extraRoutes];
+}
+export async function resolveDevBootConfig(options, bootFailure) {
+    // Automatically mixes standard features in auth mode through composeFeatures.
+    // runProdApp and the per-app Drizzle schema generator use the same helper,
+    // keeping migrations and runtime feature composition aligned.
+    const rawEnvSource = options.envSource ?? process.env;
+    const { seedsConfig, stackSeeds } = splitDevSeeds(options);
+    if (options.envSchema) {
+        parseDevEnvSchema(options, seedsConfig, rawEnvSource, options.envSchema);
+    }
+    rejectRemovedEffectiveFeatures(options);
+    const wiring = await resolveBootOptionWiring(devBootOptionWiringInput(options, seedsConfig), rawEnvSource);
+    bootFailure.release = () => wiring.kms.close();
+    const envSource = withEnvDefaults(wiring.envDefaults, rawEnvSource);
+    assertStackBootRequirements({
+        features: options.features,
+        ...(options.featureToggles && { featureToggles: true }),
+    }, ["featureToggles"]);
+    // Normalizes auth.mail into the explicit flow fields, symmetrically with
+    // runProdApp. hmacSecret is read from the JWT_SECRET environment value and
+    // fails fast when unavailable. From this point on, use effectiveAuth rather
+    // than options.auth.
+    const effectiveAuth = options.auth
+        ? resolveAuthMail(options.auth, requireEnv("JWT_SECRET", envSource, "runDevApp"), envSource, {
+            mailConfigured: wiring.mailConfigured,
+        })
+        : undefined;
+    const { unsubscribeLinks, unsubscribeRoutes } = resolveUnsubscribeWiring({
+        unsubscribe: options.unsubscribe,
+        publicOrigin: undefined,
+        mailBaseUrl: effectiveAuth?.mail?.baseUrl,
+        envSource,
+        warn: (message) => createFallbackLogger("runDevApp").warn(message),
+    });
+    const extraRoutes = collectDevExtraRoutes(options, unsubscribeRoutes, wiring);
+    const features = composeAppFeatures(options.features, wiring.features, effectiveAuth);
+    return { stackSeeds, wiring, envSource, effectiveAuth, unsubscribeLinks, extraRoutes, features };
+}
+// An explicitly wired file provider (options.files) satisfies the
+// FILE_STORAGE_PROVIDER boot gate. Passed via the validateBoot env option
+// instead of mutating process.env, so nothing leaks into later runDevApp
+// calls in the same process.
+function resolveDevValidateBootOptions(options, wiring) {
+    const baseBootEnv = {
+        ...wiring.envDefaults,
+        ...(options.validateBootOptions?.env ?? process.env),
+    };
+    const hasBootEnvDefaults = Object.keys(wiring.envDefaults).length > 0;
+    if (options.files !== undefined && baseBootEnv[FILE_STORAGE_PROVIDER_ENV] === undefined) {
+        return {
+            ...options.validateBootOptions,
+            env: { ...baseBootEnv, [FILE_STORAGE_PROVIDER_ENV]: FILE_STORAGE_PROVIDER_BOOT_SENTINEL },
+        };
+    }
+    return hasBootEnvDefaults
+        ? { ...options.validateBootOptions, env: baseBootEnv }
+        : options.validateBootOptions;
+}
+// Run boot validation before creating the server. This catches the same
+// errors runProdApp catches (unqualified navigation or handler QNs,
+// screen-access violations), which would otherwise only show up as a prod pod
+// in CrashLoopBackOff. It throws
+// synchronously before a socket is opened.
+export function validateDevBoot(options, config) {
+    const bootOptions = resolveDevValidateBootOptions(options, config.wiring);
+    // Resolve this before validateBoot: an app-supplied masterKey provider must
+    // satisfy the encrypted-field gate exactly as it does in runProdApp.
+    const bootCrypto = resolveBootCrypto(config.envSource, options.masterKey);
+    validateComposedFeatures(config.features, {
+        ...(bootCrypto.entityFieldCipher && { entityFieldCipher: bootCrypto.entityFieldCipher }),
+        ...bootOptions,
+    });
+    return bootCrypto;
+}
+function resolveDevPiiKmsResolution(options, wiring) {
+    return options.kmsMode !== undefined
+        ? {
+            kms: wiring.kms.kms,
+            blindIndexKey: wiring.kms.blindIndexKey,
+            generatedBlindIndexKey: false,
+            mode: wiring.kms.kms ? "app-kms" : "plaintext",
+        }
+        : resolveDevPiiKms(options);
+}
+export function configureDevBootCrypto(options, config, bootCrypto, resetLateBindings, bootFailure) {
+    const { wiring, features } = config;
+    // The app-wide cipher for `encrypted: true` entity fields is resolved lazily
+    // by executors, symmetrically with runProdApp.
+    configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
+    // Configure Subject-KMS and blind-index handling, symmetrically with
+    // runProdApp. Dev warns instead of failing for plaintext PII, but kms with
+    // lookupable fields still requires blindIndexKey because lookups would fail
+    // in every mode.
+    const piiKms = resolveDevPiiKmsResolution(options, wiring);
+    configurePiiSubjectKms(piiKms.kms);
+    configureBlindIndexKey(piiKms.blindIndexKey);
+    const releaseEphemeralPiiKms = captureEphemeralDevPiiKms(piiKms);
+    // The auth features bind database-backed revokers onto their (possibly shared) instances;
+    // stop() swaps them for inert ones so a later stack in the same process never reaches this
+    // app's closed connection.
+    const releasePiiKms = async () => {
+        for (const reset of resetLateBindings)
+            reset();
+        releaseEphemeralPiiKms();
+        await wiring.kms.close();
+    };
+    bootFailure.release = releasePiiKms;
+    assertPiiBootInvariants(features, {
+        kms: piiKms.kms,
+        blindIndexKey: piiKms.blindIndexKey,
+        mode: "dev",
+    });
+    if (piiKms.mode === "ephemeral-default") {
+        logInfo("[runDevApp] PII encrypted with in-memory KMS (ephemeral DB); pass kms: false to opt out");
+    }
+    return { releasePiiKms };
+}
+// Throwaway registry, built once and reused below — mirrors runProdApp's
+// `createRegistry(features)` right after validateBoot. Symmetric
+// sessionStoreProviderMounted check to runProdApp's (registry.getExtension-
+// Usages, not a raw features.some(...) scan) so dev and prod never ask the
+// same question two different ways again.
+export function resolveDevAuthRegistry(config) {
+    const registry = config.effectiveAuth ? createRegistry(config.features) : undefined;
+    const sessionStoreProviderMounted = registry !== undefined && registry.getExtensionUsages(EXT_SESSION_STORE).length > 0;
+    assertSessionBootInvariants({
+        hasAuth: Boolean(config.effectiveAuth),
+        sessionStoreProviderMounted,
+        mode: "dev",
+    });
+    return { registry, sessionStoreProviderMounted };
+}

package/dist/run-dev-app-server-options.d.ts

@@ -0,0 +1,13 @@
+import type { CreateKumikoServerOptions } from "./create-kumiko-server.ts";
+import type { RunDevAppOptions } from "./run-dev-app.ts";
+import type { DevAuthWiring } from "./run-dev-app-auth.ts";
+import type { DevBootConfig } from "./run-dev-app-config.ts";
+export type DevServerOptions = Omit<CreateKumikoServerOptions, "onAfterSetup">;
+export declare function buildDevServerOptions(deps: {
+    readonly options: RunDevAppOptions;
+    readonly config: DevBootConfig;
+    readonly auth: DevAuthWiring;
+    readonly extraContext: CreateKumikoServerOptions["extraContext"];
+    readonly trustedProxyHops: number | undefined;
+    readonly effectiveFeatures: CreateKumikoServerOptions["effectiveFeatures"];
+}): DevServerOptions;

package/dist/run-dev-app-server-options.js

@@ -0,0 +1,49 @@
+import { buildSharedAuthRoutes } from "@cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps";
+function pickDevClientOptions(options) {
+    return {
+        ...(options.clientEntry !== undefined && { clientEntry: options.clientEntry }),
+        ...(options.errorDocs && { errorDocs: options.errorDocs }),
+        ...(options.clientEntries !== undefined && { clientEntries: options.clientEntries }),
+        ...(options.hostDispatch !== undefined && { hostDispatch: options.hostDispatch }),
+        ...(options.resolvePageHead !== undefined && { resolvePageHead: options.resolvePageHead }),
+        ...(options.stylesheet !== undefined && { stylesheet: options.stylesheet }),
+        ...(options.stylesheetWatch !== undefined && { stylesheetWatch: options.stylesheetWatch }),
+        ...(options.htmlPath !== undefined && { htmlPath: options.htmlPath }),
+        ...(options.port !== undefined && { port: options.port }),
+        ...(options.watchDirs !== undefined && { watchDirs: options.watchDirs }),
+        ...(options.installSignalHandlers !== undefined && {
+            installSignalHandlers: options.installSignalHandlers,
+        }),
+    };
+}
+function pickDevServiceOptions(options) {
+    return {
+        ...(options.anonymousAccess !== undefined && { anonymousAccess: options.anonymousAccess }),
+        ...(options.files !== undefined && { files: options.files }),
+        ...(options.wire !== undefined && { wire: options.wire }),
+    };
+}
+export function buildDevServerOptions(deps) {
+    const { options, config, auth, extraContext, trustedProxyHops, effectiveFeatures } = deps;
+    const { effectiveAuth, extraRoutes, wiring } = config;
+    return {
+        features: config.features,
+        ...pickDevClientOptions(options),
+        ...(extraContext !== undefined && { extraContext }),
+        ...pickDevServiceOptions(options),
+        ...(extraRoutes !== undefined && { extraRoutes }),
+        ...(trustedProxyHops !== undefined && { trustedProxyHops }),
+        ...(options.demoMode && { wrapFetch: wiring.wrapFetch }),
+        ...(effectiveFeatures !== undefined && { effectiveFeatures }),
+        ...(effectiveAuth && {
+            auth: {
+                ...buildSharedAuthRoutes(effectiveAuth, Boolean(auth.mfaFeature)),
+                ...(effectiveAuth.trustedProxyHops !== undefined && {
+                    trustedProxyHops: effectiveAuth.trustedProxyHops,
+                }),
+                ...auth.sessionAuthFragment,
+                ...auth.patAuthFragment,
+            },
+        }),
+    };
+}