@cosmicdrift/kumiko-dev-server 0.78.0 → 0.79.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.78.0",
+  "version": "0.79.2",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.78.0",
-    "@cosmicdrift/kumiko-framework": "0.78.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.79.2",
+    "@cosmicdrift/kumiko-framework": "0.79.2",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/compose-features.test.ts

@@ -13,6 +13,11 @@ import { composeFeatures } from "../compose-features";
 
 const noopFeature = defineFeature("noop-app", () => {});
 
+// Mirrors what the create-kumiko-app picker hands back when the user
+// ticks an auto-mounted feature: a stub with the same name as a bundled
+// one. The dedupe path drops it and warns.
+const pickerAuthDupe = defineFeature("auth-email-password", () => {});
+
 const HMAC_SECRET = "test-secret-with-at-least-32-bytes-aaa";
 
 describe("composeFeatures", () => {
@@ -78,4 +83,29 @@ describe("composeFeatures", () => {
     expect(handlerNames).toContain("login");
     expect(handlerNames).toContain("logout");
   });
+
+  test("app feature duplicating a bundled name is dropped (no createRegistry crash)", () => {
+    // Bug discovered during Phase 3 recording: create-kumiko-app's picker
+    // hands back createAuthEmailPasswordFeature() because the user ticked
+    // it in the recommended set; runDevApp then adds its OWN bundled
+    // copy via includeBundled:true, and createRegistry throws "Duplicate
+    // feature: auth-email-password". The dedupe path keeps the bundled
+    // instance (it carries authOptions wiring) and drops the app stub.
+    const features = composeFeatures([pickerAuthDupe, noopFeature], {
+      includeBundled: true,
+    });
+    expect(features.map((f) => f.name)).toEqual([
+      "config",
+      "user",
+      "tenant",
+      "auth-email-password",
+      "noop-app",
+    ]);
+    // The kept instance is the bundled one — confirmed by the presence of
+    // login/logout handlers (the picker stub has none).
+    const auth = features.find((f) => f.name === "auth-email-password");
+    expect(auth).toBeDefined();
+    if (!auth) return;
+    expect(Object.keys(auth.writeHandlers)).toContain("login");
+  });
 });

package/src/compose-features.ts

@@ -41,15 +41,33 @@ export function composeFeatures(
   appFeatures: readonly FeatureDefinition[],
   options: ComposeFeaturesOptions,
 ): FeatureDefinition[] {
-  return options.includeBundled
-    ? [
-        createConfigFeature(),
-        createUserFeature(),
-        createTenantFeature(),
-        createAuthEmailPasswordFeature(options.authOptions ?? {}),
-        ...appFeatures,
-      ]
-    : [...appFeatures];
+  if (!options.includeBundled) return [...appFeatures];
+
+  // Bundled foundation goes first so its instances carry the runDevApp /
+  // runProdApp `authOptions` (passwordReset wiring etc.). App-features that
+  // ALSO declare one of these names — e.g. the create-kumiko-app picker
+  // hands back `createAuthEmailPasswordFeature()` because the user ticked
+  // it — would otherwise crash createRegistry with "Duplicate feature".
+  // Drop the app-side duplicates and warn so the user can clean run-config.
+  const bundled = [
+    createConfigFeature(),
+    createUserFeature(),
+    createTenantFeature(),
+    createAuthEmailPasswordFeature(options.authOptions ?? {}),
+  ];
+  const bundledNames = new Set(bundled.map((f) => f.name));
+  const filteredApp: FeatureDefinition[] = [];
+  for (const f of appFeatures) {
+    if (bundledNames.has(f.name)) {
+      // biome-ignore lint/suspicious/noConsole: boot-time UX warning
+      console.warn(
+        `[composeFeatures] "${f.name}" already auto-mounted via includeBundled — dropping the explicit copy from APP_FEATURES. Remove it from run-config.ts to silence this warning.`,
+      );
+      continue;
+    }
+    filteredApp.push(f);
+  }
+  return [...bundled, ...filteredApp];
 }
 
 /** Shape eines beliebigen run{Prod,Dev}App-Auth-Blocks der eine