@cosmicdrift/kumiko-dev-server 1.0.0 → 2.0.0

package/src/__tests__/scaffold-app.test.ts

@@ -13,6 +13,9 @@ const SCAFFOLD_FILES = [
   "bunfig.toml",
   "bunfig.ci.toml",
   "src/run-config.ts",
+  "src/features/tasks/feature.ts",
+  "src/features/tasks/index.ts",
+  "src/seed.ts",
   "kumiko/schema.ts",
   "bin/main.ts",
   "bin/dev.ts",
@@ -89,6 +92,7 @@ describe("scaffoldApp", () => {
 
     const kumikoBin = readFileSync(join(dest, "bin/kumiko.ts"), "utf-8");
     expect(kumikoBin).toContain("runSchemaCli");
+    expect(kumikoBin).toContain("runConsumerCli");
     expect(kumikoBin).toContain("includeBundled: HAS_AUTH");
   });
 
@@ -112,9 +116,13 @@ describe("scaffoldApp", () => {
     expect(client).toContain("createKumikoApp");
     expect(client).toContain("emailPasswordClient");
     expect(client).toContain("DefaultAppShell");
-    expect(client).toContain("shell: DefaultAppShell");
+    expect(client).toContain("shell: AppShell");
+    expect(client).toContain("function AppShell(");
+    expect(client).toContain("brand={<span");
+    expect(client).toContain(">my-shop</span>");
     expect(client).toContain('from "@cosmicdrift/kumiko-renderer-web"');
     expect(client).toContain('from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web"');
+    expect(client).toContain("tasksClient");
   });
 
   test(".env.example carries KUMIKO_DEV_DB_NAME default so reboots are persistent", async () => {
@@ -178,6 +186,27 @@ describe("scaffoldApp", () => {
     expect(readme).toContain("- `delivery`");
   });
 
+  test("callExpression/export-callability mismatch throws instead of silently mis-instantiating", async () => {
+    const dest = join(tmp, "my-shop");
+    await expect(
+      scaffoldApp({
+        name: "my-shop",
+        destination: dest,
+        features: [
+          {
+            name: "delivery",
+            importPath: "@cosmicdrift/kumiko-bundled-features/delivery",
+            exportName: "createDeliveryFeature",
+            // createDeliveryFeature is a factory function, but this claims it's
+            // a plain object export (no trailing "()") — must not silently push
+            // the function itself as a FeatureDefinition.
+            callExpression: "createDeliveryFeature",
+          },
+        ],
+      }),
+    ).rejects.toThrow(/is.*callable but callExpression/);
+  });
+
   test("bin/main.ts contains runProdApp + auth.admin stub + staticDir", async () => {
     const dest = join(tmp, "my-shop");
     await scaffoldApp({ name: "my-shop", destination: dest });
@@ -202,13 +231,15 @@ describe("scaffoldApp", () => {
     );
   });
 
-  test("src/run-config.ts mounts secrets + sessions + HAS_AUTH", async () => {
+  test("src/run-config.ts mounts secrets + sessions + tasks + HAS_AUTH", async () => {
     const dest = join(tmp, "my-shop");
     await scaffoldApp({ name: "my-shop", destination: dest });
 
     const runConfig = readFileSync(join(dest, "src/run-config.ts"), "utf-8");
     expect(runConfig).toContain("createSecretsFeature()");
     expect(runConfig).toContain("createSessionsFeature()");
+    expect(runConfig).toContain("tasksFeature");
+    expect(runConfig).toContain('from "./features/tasks"');
     expect(runConfig).toContain("export const APP_FEATURES");
     expect(runConfig).toContain("export const HAS_AUTH");
   });
@@ -362,6 +393,7 @@ describe("scaffoldApp", () => {
     const cfg = readFileSync(join(dest, "src/run-config.ts"), "utf-8");
     expect(cfg).not.toContain("createSecretsFeature");
     expect(cfg).not.toContain("createSessionsFeature");
+    expect(cfg).toContain("tasksFeature");
   });
 
   test("deterministic tenantId for same name (reproducible boots)", async () => {

package/src/__tests__/schema-apply.integration.test.ts

@@ -6,7 +6,7 @@
 // `relation "kumiko_events" does not exist`. Dieser Test fährt den echten
 // Pfad gegen eine leere DB + den idempotenten Re-Run.
 
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, spyOn, test } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -76,7 +76,7 @@ describe("runSchemaApply", () => {
     expect(await tableExists(conn.db, "public.read_thing")).toBe(true);
   });
 
-  test("rebuild-Marker für nicht-registrierte Tabelle → kein Crash, 0", async () => {
+  test("rebuild-Marker für nicht-registrierte Tabelle → kein Crash, 0, aber laut warnen (522/3)", async () => {
     writeFileSync(
       join(migDir, "0002_more.sql"),
       `CREATE TABLE "read_more" ("id" text PRIMARY KEY);`,
@@ -86,7 +86,10 @@ describe("runSchemaApply", () => {
       JSON.stringify({ version: 1, tables: ["read_more"] }),
     );
 
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
     expect(await runSchemaApply({ ...APPLY, appCwd })).toBe(0);
     expect(await tableExists(conn.db, "public.read_more")).toBe(true);
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('Table "read_more"'));
+    warn.mockRestore();
   });
 });

package/src/__tests__/setup-test-stack-from-features.integration.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { setupTestStackFromFeatures } from "../setup-test-stack-from-features";
+
+const noopFeature = defineFeature("noop-app", () => {});
+
+describe("setupTestStackFromFeatures", () => {
+  test("includeBundled prepends config/user/tenant/auth", async () => {
+    const stack = await setupTestStackFromFeatures([noopFeature], { includeBundled: true });
+    try {
+      for (const name of ["config", "user", "tenant", "auth-email-password", "noop-app"]) {
+        expect(stack.registry.getFeature(name)).toBeDefined();
+      }
+    } finally {
+      await stack.cleanup();
+    }
+  });
+
+  test("config preset wires configResolver in extraContext", async () => {
+    const stack = await setupTestStackFromFeatures([noopFeature], {
+      includeBundled: true,
+      presets: ["config"],
+    });
+    try {
+      expect(stack.registry.getFeature("config")).toBeDefined();
+    } finally {
+      await stack.cleanup();
+    }
+  });
+});

package/src/__tests__/walkthrough.integration.test.ts

@@ -13,10 +13,12 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createPersonalAccessTokensFeature } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import { createSecretsFeature } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { createRegistry, defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
-import { composeFeatures } from "../compose-features";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { scaffoldApp } from "../scaffold-app";
 import { scaffoldAppFeature } from "../scaffold-app-feature";
 
@@ -77,18 +79,32 @@ describe("walkthrough — DX-3.1 snapshot", () => {
     // a dummy defineFeature here — the scaffold-side of "notesFeature"
     // (file-content) is pinned in test 2; this test pins the runtime-side
     // (composeFeatures auto-prepend behaviour the walkthrough claims).
+    //
+    // sessions now requires auth-foundation (#1370/#1371), which itself
+    // needs a tokenVerifier provider mounted (#1368) — PAT here, mirroring
+    // the scaffold picker's real-world default. Not part of the walkthrough's
+    // advertised 7-feature count (that count is about includeBundled's
+    // auto-mount, unrelated to this coupling), so both are added on top.
     const notesFeature = defineFeature("notes", () => {});
-    const APP_FEATURES = [createSecretsFeature(), createSessionsFeature(), notesFeature];
+    const APP_FEATURES = [
+      createSecretsFeature(),
+      authFoundationFeature,
+      createPersonalAccessTokensFeature({ scopes: {} }),
+      createSessionsFeature(),
+      notesFeature,
+    ];
 
     const composed = composeFeatures(APP_FEATURES, { includeBundled: true });
-    // 3 explicit + 4 auto-mounted bundled = 7 total features.
-    expect(composed.length).toBe(7);
+    // 5 explicit + 4 auto-mounted bundled = 9 total features.
+    expect(composed.length).toBe(9);
 
     const composedNames = composed.map((f) => f.name).sort();
     expect(composedNames).toEqual([
       "auth-email-password",
+      "auth-foundation",
       "config",
       "notes",
+      "personal-access-tokens",
       "secrets",
       "sessions",
       "tenant",
@@ -97,9 +113,9 @@ describe("walkthrough — DX-3.1 snapshot", () => {
 
     // validateBoot must pass (no missing-requires, no schema-errors).
     expect(() => validateBoot(composed)).not.toThrow();
-    // Registry must contain all 7 features.
+    // Registry must contain all 9 features.
     const registry = createRegistry(composed);
-    expect(registry.features.size).toBe(7);
+    expect(registry.features.size).toBe(9);
   });
 
   test("bin/main.ts contains the auth.admin stub the walkthrough relies on", async () => {

package/src/build-server-bundle.ts

@@ -38,6 +38,7 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
+import { parseJsonOrThrow, parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 
 const hasBun = typeof (globalThis as { Bun?: unknown }).Bun !== "undefined";
 
@@ -46,6 +47,12 @@ const hasBun = typeof (globalThis as { Bun?: unknown }).Bun !== "undefined";
 // ioredis), dynamic-require (postgres, temporal-polyfill) — alles was unter
 // Bun-bundling bricht. (drizzle-kit/drizzle-orm sind raus: der Migrate-Pfad
 // nutzt jetzt den framework-eigenen runMigrationsFromDir, kein drizzle-kit.)
+// meilisearch: deliberately here, not in BUILD_ONLY_EXTERNALS below — apps
+// that import createMeilisearchAdapter (kumiko-framework/search/meilisearch)
+// reference the package at runtime (no native binding, plain HTTP client,
+// but a real runtime import). Found 2026-07-19: money-horse prod crash
+// "Cannot find package 'meilisearch'" because it used to sit in
+// BUILD_ONLY_EXTERNALS instead.
 const RUNTIME_EXTERNALS = [
   "@node-rs/argon2",
   "bullmq",
@@ -54,6 +61,7 @@ const RUNTIME_EXTERNALS = [
   "temporal-polyfill",
   "pino",
   "pino-pretty",
+  "meilisearch",
 ] as const;
 
 // Pakete die nur im Build-Stack erscheinen (transitive Imports im Framework),
@@ -62,7 +70,6 @@ const RUNTIME_EXTERNALS = [
 // Bundle — der Marker schaltet nur das resolution-during-build ab. NICHT in
 // runtime-deps.
 const BUILD_ONLY_EXTERNALS = [
-  "meilisearch",
   "@planetscale/database",
   "@libsql/client",
   "better-sqlite3",
@@ -178,7 +185,7 @@ export async function buildServerBundle(
   entries.sort((a, b) => a.file.localeCompare(b.file));
   const totalBytes = [...entries, ...chunks].reduce((sum, e) => sum + e.sizeBytes, 0);
 
-  const runtimeDeps = await resolveRuntimeDepsVersions(repoRoot, [
+  const runtimeDeps = await resolveRuntimeDepsVersions(cwd, repoRoot, [
     ...RUNTIME_EXTERNALS,
     ...(options.extraRuntimeExternals ?? []),
   ]);
@@ -217,29 +224,35 @@ function findRepoRoot(start: string): string | undefined {
   return undefined;
 }
 
-// Versionen für RUNTIME_EXTERNALS auflösen: erst aus framework + bundled-
-// features package.json (Workspace-pinning), Fallback auf "*" wenn nichts
-// gefunden. Ein Repo-Root muss existieren — sonst kann eh kein CLI-Bundle
-// gemacht werden, also wird die Funktion gar nicht erst gerufen.
+// Versionen für RUNTIME_EXTERNALS auflösen: erst aus den installierten
+// node_modules/@cosmicdrift/*-Packages (relativ zu cwd — funktioniert für
+// jede Consumer-App), dann als Zusatz aus packages/framework + bundled-
+// features (Workspace-Checkout des Frameworks selbst). Fallback auf "*"
+// wenn keine Quelle den Namen kennt.
 async function resolveRuntimeDepsVersions(
+  cwd: string,
   repoRoot: string | undefined,
   packages: readonly string[],
 ): Promise<Record<string, string>> {
   const out: Record<string, string> = {};
-  if (!repoRoot) {
-    for (const pkg of packages) out[pkg] = "*";
-    return out;
-  }
 
   const pinSources = [
-    join(repoRoot, "packages/framework/package.json"),
-    join(repoRoot, "packages/bundled-features/package.json"),
+    ...(repoRoot
+      ? [
+          join(repoRoot, "packages/framework/package.json"),
+          join(repoRoot, "packages/bundled-features/package.json"),
+        ]
+      : []),
+    // node_modules applied last so its versions win over the repo-root
+    // fallback — see the function comment above (#1217 bug class).
+    join(cwd, "node_modules/@cosmicdrift/kumiko-framework/package.json"),
+    join(cwd, "node_modules/@cosmicdrift/kumiko-bundled-features/package.json"),
   ];
   const allDeps: Record<string, string> = {};
   for (const path of pinSources) {
     if (!existsSync(path)) continue;
     const raw = await readFile(path, "utf-8");
-    const parsed = JSON.parse(raw) as { dependencies?: Record<string, string> };
+    const parsed = parseJsonOrThrow<{ dependencies?: Record<string, string> }>(raw, path);
     Object.assign(allDeps, parsed.dependencies ?? {});
   }
   for (const pkg of packages) {
@@ -251,12 +264,17 @@ async function resolveRuntimeDepsVersions(
 function derivePkgName(cwd: string): string {
   const pkgJson = join(cwd, "package.json");
   if (!existsSync(pkgJson)) return "kumiko-app-runtime";
+  // existsSync/readFileSync race (deleted between the two calls) or a
+  // permission error must fall back like a missing file, not crash the
+  // build — read here too, not just the JSON.parse below.
+  let raw: string;
   try {
-    const parsed = JSON.parse(readFileSync(pkgJson, "utf-8")) as { name?: string };
-    return parsed.name ? `${parsed.name}-runtime` : "kumiko-app-runtime";
+    raw = readFileSync(pkgJson, "utf-8");
   } catch {
     return "kumiko-app-runtime";
   }
+  const parsed = parseJsonSafe<{ name?: string }>(raw, {});
+  return parsed.name ? `${parsed.name}-runtime` : "kumiko-app-runtime";
 }
 
 export function formatServerBuildResult(

package/src/build.ts

@@ -10,11 +10,10 @@ export {
   buildProdBundle,
   type ClientEntry,
   discoverClientEntries,
-  discoverClientEntry,
   discoverHtmlTemplate,
   formatBuildResult,
   injectAssetTags,
-} from "./build-prod-bundle";
+} from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
 
 export {
   type BuildServerBundleEntry,

package/src/codegen/__tests__/render-codegen.test.ts

@@ -79,7 +79,8 @@ describe("renderDefineFile", () => {
     const out = renderDefineFile(["tenant:write:create", "tenant:write:update"]);
     expect(out).toContain("export type TypedDispatcher");
     expect(out).toContain("export function createTypedDispatcher");
-    expect(out).toContain('export type { WriteHandlerQn } from "./types.generated"');
+    expect(out).toContain('import type { WriteHandlerQn } from "./types.generated"');
+    expect(out).toContain("export type { WriteHandlerQn };");
   });
 });
 

package/src/codegen/__tests__/run-codegen.test.ts

@@ -283,7 +283,7 @@ export default defineFeature("dup", (r) => {
     const result = runCodegen({ appRoot });
     expect(result.eventCount).toBe(1);
     expect(result.warnings.length).toBeGreaterThanOrEqual(1);
-    const w = result.warnings.find((w) => w.reason.includes("duplicate"));
+    const w = result.warnings.find((w) => w.message.includes("duplicate"));
     expect(w).toBeDefined();
   });
 
@@ -368,7 +368,7 @@ export default defineFeature("inline", (r) => {
     const result = runCodegen({ appRoot });
     expect(result.eventCount).toBe(0);
     expect(result.warnings.length).toBe(1);
-    expect(result.warnings[0]?.reason).toMatch(/not a named import nor an inline z\.\* call/);
+    expect(result.warnings[0]?.message).toMatch(/not a named import nor an inline z\.\* call/);
   });
 
   test("skips test files, node_modules, .kumiko, dist", () => {

package/src/codegen/__tests__/strict-mode-diagnostics.test.ts

@@ -1,7 +1,12 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import * as ts from "typescript";
+// TS7's package.json exports only version.cjs at ".", so the classic
+// createProgram/ScriptTarget Compiler API is unreachable via `import *
+// as ts from "typescript"` anymore; ts-morph's vendored (older) compiler
+// build is the only way to get that surface, so diagnostics here run
+// against a different compiler than the repo's own tsc.
+import { ts } from "ts-morph";
 import { runCodegen } from "../run-codegen";
 
 const REPO_ROOT = join(__dirname, "../../../../..");

package/src/codegen/__tests__/watch.test.ts

@@ -138,8 +138,7 @@ export default defineFeature("orders", (r) => {
     writeFile(appRoot, "src/feature.ts", FEATURE_TEMPLATE("nope", "evt"));
     const handle = watchAndRegenerate({ appRoot, onResult: () => {} });
     handle.close();
-    handle.close(); // must not throw
-    expect(true).toBe(true);
+    expect(() => handle.close()).not.toThrow();
   });
 
   test("non-ts file changes do not trigger codegen", async () => {

package/src/codegen/render.ts

@@ -175,8 +175,13 @@ export function renderDefineFile(handlerQns: readonly string[] = []): string {
       ? [
           "",
           `import type { Dispatcher, WriteOpts, WriteResult } from "@cosmicdrift/kumiko-headless";`,
+          `import type { WriteHandlerQn } from "./types.generated";`,
           "",
-          `export type { WriteHandlerQn } from "./types.generated";`,
+          // Plain `export type { WriteHandlerQn } from "./types.generated"`
+          // only re-exports — with verbatimModuleSyntax it does NOT bind the
+          // name locally, so the `TypedDispatcher` reference below would fail
+          // to resolve. Import above + bare re-export here does both.
+          `export type { WriteHandlerQn };`,
           "",
           `/** Dispatcher with write() narrowed to registered handler QNs. */`,
           `export type TypedDispatcher = Omit<Dispatcher, "write"> & {`,

package/src/codegen/scan-events.ts

@@ -93,7 +93,7 @@ export type SchemaSource =
 export type ScanWarning = {
   readonly file: string;
   readonly line: number;
-  readonly reason: string;
+  readonly message: string;
 };
 
 export type ScanResult = {
@@ -152,7 +152,7 @@ function collectTsFiles(dir: string, out: string[]): void {
   try {
     entries = readdirSync(dir);
   } catch {
-    // Directory missing — fine, just no files to scan there.
+    // skip: directory unreadable, nothing to scan there
     return;
   }
   for (const entry of entries) {
@@ -224,8 +224,9 @@ function collectFromDefineEvent(
     warnings.push({
       file: filePath,
       line: call.getStartLineNumber(),
-      reason: "r.defineEvent: cannot read event-name + schema statically",
+      message: "r.defineEvent: cannot read event-name + schema statically",
     });
+    // skip: defineEvent call shape not statically parseable, already recorded as warning
     return;
   }
 
@@ -241,8 +242,9 @@ function collectFromDefineEvent(
     warnings.push({
       file: filePath,
       line: call.getStartLineNumber(),
-      reason: `r.defineEvent("${parsed.eventName}"): schema "${parsed.schemaNode.getText()}" — not a named import nor an inline z.* call, skipped`,
+      message: `r.defineEvent("${parsed.eventName}"): schema "${parsed.schemaNode.getText()}" — not a named import nor an inline z.* call, skipped`,
     });
+    // skip: schema source not resolvable, already recorded as warning
     return;
   }
 
@@ -544,7 +546,7 @@ function dedupe(events: ScannedEvent[], warnings: ScanWarning[]): ScannedEvent[]
       warnings.push({
         file: ev.source.file,
         line: ev.source.line,
-        reason: `duplicate r.defineEvent("${ev.qualifiedName}") — first declared at ${existing.source.file}:${existing.source.line}, ignored here`,
+        message: `duplicate r.defineEvent("${ev.qualifiedName}") — first declared at ${existing.source.file}:${existing.source.line}, ignored here`,
       });
       continue;
     }

package/src/codegen/watch.ts

@@ -74,7 +74,7 @@ export function watchAndRegenerate(opts: WatchOptions): WatchHandle {
         if (result.warnings.length > 0) {
           for (const w of result.warnings) {
             // biome-ignore lint/suspicious/noConsole: codegen-watcher logs to terminal
-            console.warn(`[codegen] ${w.file}:${w.line} — ${w.reason}`);
+            console.warn(`[codegen] ${w.file}:${w.line} — ${w.message}`);
           }
         }
       }
@@ -95,17 +95,19 @@ export function watchAndRegenerate(opts: WatchOptions): WatchHandle {
 
   try {
     watcher = watch(srcDir, { recursive: true }, (_eventType, filename) => {
+      // skip: watcher closed or no filename reported, nothing to act on
       if (closed || !filename) return;
       // node liefert filename relativ zu srcDir, kann aber posix oder
       // windows-style separators haben. Wir prüfen substring-tolerant.
       const normalised = `/${filename.toString().replace(/\\/g, "/")}`;
+      // skip: path matches an excluded segment (node_modules/dist/etc.)
       if (SKIP_SUBSTRINGS.some((seg) => normalised.includes(seg))) return;
-      // Nur .ts/.tsx interessieren — alles andere (CSS, MD, JSON) hat
+      // skip: Nur .ts/.tsx interessieren — alles andere (CSS, MD, JSON) hat
       // keinen Einfluss auf r.defineEvent-Calls.
       if (!normalised.endsWith(".ts") && !normalised.endsWith(".tsx")) return;
-      // .d.ts ausgenommen — die kommen meistens vom codegen selbst.
+      // skip: .d.ts ausgenommen — die kommen meistens vom codegen selbst.
       if (normalised.endsWith(".d.ts")) return;
-      // .test.ts/.test.tsx ausgenommen — Tests definieren keine
+      // skip: .test.ts/.test.tsx ausgenommen — Tests definieren keine
       // Production-Features.
       if (normalised.endsWith(".test.ts") || normalised.endsWith(".test.tsx")) return;
 
@@ -127,6 +129,7 @@ export function watchAndRegenerate(opts: WatchOptions): WatchHandle {
 
   return {
     close: () => {
+      // skip: already closed, avoid double-close
       if (closed) return;
       closed = true;
       if (timer) clearTimeout(timer);