@cosmicdrift/kumiko-dev-server 0.415.0 → 0.416.0

package/dist/scaffold-app.js

@@ -343,7 +343,7 @@ function renderMain(appName) {
         { specifier: "@cosmicdrift/kumiko-framework/engine", names: ["TenantId"], typeOnly: true },
         {
             specifier: "@cosmicdrift/kumiko-framework/crypto",
-            names: ["requireKmsWiring", "resolveKmsWiring"],
+            names: ["resolveKmsWiring"],
         },
         { specifier: "../src/run-config", names: ["APP_FEATURES"] },
         { specifier: "../kumiko.config", names: [], defaultName: "appConfig" },
@@ -355,7 +355,7 @@ function renderMain(appName) {
         'displayName: "Admin",',
     ]);
     // Subject-key KMS is optional locally (plaintext + loud warning) but required
-    // under NODE_ENV=production.
+    // under NODE_ENV=production, where kmsMode also resolves the *_CIPHERTEXT form via the Key Manager.
     return `// biome-ignore-all lint/style/noProcessEnv: KMS wiring and the demo admin password are read before runProdApp parses the env contract, and the scaffold has no bin/env.ts
 // Production-bootstrap. KUMIKO_DRY_RUN_ENV=boot exits after
 // composeFeatures + validateBoot + createRegistry without DB/Redis-connect
@@ -373,7 +373,7 @@ const kmsOpts = {
 
 const kmsWiring =
   process.env["NODE_ENV"] === "production"
-    ? requireKmsWiring(process.env, kmsOpts)
+    ? { kmsMode: "required" as const }
     : resolveKmsWiring(process.env, kmsOpts);
 
 await runProdApp({
@@ -498,7 +498,8 @@ KUMIKO_SECRETS_MASTER_KEY_V1=
 ${adminBlock}
 # Subject-keys KMS for PII fields (user, tenant-invitation, fileRef). All-or-none.
 # Unset → local boot with plaintext PII + warning; NODE_ENV=production requires
-# the trio (requireKmsWiring). Generate PLATFORM_KEK / KUMIKO_BLIND_INDEX_KEY
+# the trio (runProdApp kmsMode "required"); prod may supply any key as
+# <NAME>_CIPHERTEXT (Key Manager). Generate PLATFORM_KEK / KUMIKO_BLIND_INDEX_KEY
 # with: openssl rand -base64 32. SUBJECT_KEYS_DATABASE_URL must be a dedicated
 # subject-keys cluster (not the app DB) — see kms-adapter.md.
 PLATFORM_KEK=
@@ -685,6 +686,7 @@ function renderBinKumiko() {
         "// ad-hoc SQL, and `events prune --aggregate-type <type> [--apply]` removes retired",
         "// aggregate types from the event log. kumiko-build bundles this file to dist-server/kumiko.js.",
         "",
+        'import { kmsEnvSchema } from "@cosmicdrift/kumiko-bundled-features/crypto-shredding/env";',
         'import { runConsumerCli } from "@cosmicdrift/kumiko-framework/consumer-cli";',
         'import { kmsSlotsOf } from "@cosmicdrift/kumiko-framework/env";',
         'import { runEventsCli } from "@cosmicdrift/kumiko-framework/events-cli";',
@@ -697,7 +699,8 @@ function renderBinKumiko() {
         "const out = { log: (l: string) => console.log(l), err: (l: string) => console.error(l) };",
         "",
         'if (cmd === "schema") {',
-        "  const kmsSlots = kmsSlotsOf(envSchema.schema);",
+        "  // bin/main.ts boots with kmsMode, which resolves the slots of kmsEnvSchema; the migrate step needs the same keys.",
+        "  const kmsSlots = [...new Set([...kmsSlotsOf(envSchema.schema), ...kmsSlotsOf(kmsEnvSchema)])];",
         "  process.exit(",
         "    await runSchemaCli(rest, process.env.INIT_CWD ?? process.cwd(), out, {",
         "      features: FEATURES,",

package/dist/scaffold-blank-starter.js

@@ -35,7 +35,7 @@ export function renderBlankMain(appName) {
         { specifier: "@cosmicdrift/kumiko-framework/engine", names: ["TenantId"], typeOnly: true },
         {
             specifier: "@cosmicdrift/kumiko-framework/crypto",
-            names: ["requireKmsWiring", "resolveKmsWiring"],
+            names: ["resolveKmsWiring"],
         },
         {
             specifier: "@cosmicdrift/kumiko-bundled-features/auth-email-password",
@@ -62,7 +62,7 @@ const kmsOpts = {
 
 const kmsWiring =
   process.env["NODE_ENV"] === "production"
-    ? requireKmsWiring(process.env, kmsOpts)
+    ? { kmsMode: "required" as const }
     : resolveKmsWiring(process.env, kmsOpts);
 
 // The bootstrap admin has no password; password reset is the only way it gets one. Without SMTP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.415.0",
+  "version": "0.416.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,15 +77,15 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.415.0",
-    "@cosmicdrift/kumiko-feature-ast": "0.415.0",
-    "@cosmicdrift/kumiko-framework": "0.415.0",
-    "@cosmicdrift/kumiko-renderer": "0.415.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.415.0",
-    "@cosmicdrift/kumiko-guards": "0.415.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.415.0",
-    "@cosmicdrift/kumiko-testing": "0.415.0",
-    "@cosmicdrift/kumiko-types": "0.415.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.416.0",
+    "@cosmicdrift/kumiko-feature-ast": "0.416.0",
+    "@cosmicdrift/kumiko-framework": "0.416.0",
+    "@cosmicdrift/kumiko-renderer": "0.416.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.416.0",
+    "@cosmicdrift/kumiko-guards": "0.416.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.416.0",
+    "@cosmicdrift/kumiko-testing": "0.416.0",
+    "@cosmicdrift/kumiko-types": "0.416.0",
     "ts-morph": "^28.0.0",
     "zod": "^4.6.7"
   },

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.416.0",
+    "type": "fix",
+    "title": "Scaffolded apps accept Key Manager ciphertext keys in production",
+    "detail": "The generated `bin/main.ts` (demo and blank starter) boots production with `kmsMode: \"required\"` instead of the sync `requireKmsWiring`, which rejected every `*_CIPHERTEXT` key; local boots keep `resolveKmsWiring`. The generated `bin/kumiko.ts` passes `schema apply` the slots of `kmsEnvSchema` in addition to the app's own, so the migrate step resolves the same keys as the server. Existing apps scaffolded before this release keep their old files; copy both changes by hand if they receive ciphertext keys."
+  },
   {
     "version": "0.414.0",
     "type": "fix",