npm - @cosmicdrift/kumiko-server-runtime - Versions diffs - 0.159.1 → 0.161.0 - Mend

@cosmicdrift/kumiko-server-runtime 0.159.1 → 0.161.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/package.json +3 -3
package/src/__tests__/build-prod-bundle.inprocess.test.ts +166 -0
package/src/__tests__/run-prod-app-dry-run.test.ts +158 -0
package/src/__tests__/run-prod-app-static-files.test.ts +148 -0
package/src/__tests__/run-prod-app.integration.test.ts +13 -4
package/src/__tests__/session-boot-gate.test.ts +8 -40
package/src/__tests__/session-wiring.test.ts +8 -43
package/src/run-prod-app-boot-context.ts +16 -25
package/src/run-prod-app.ts +16 -33
package/src/session-boot-gate.ts +9 -18
package/src/session-wiring.ts +7 -19

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.159.1",
+  "version": "0.161.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -72,8 +72,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.159.1",
-    "@cosmicdrift/kumiko-framework": "0.159.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.161.0",
+    "@cosmicdrift/kumiko-framework": "0.161.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/build-prod-bundle.inprocess.test.ts ADDED Viewed

@@ -0,0 +1,166 @@
+// In-process buildProdBundle — covers Bun.build + HTML render + build-info
+// in the same process (CLI subprocess tests do not contribute to lcov).
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildProdBundle } from "../build-prod-bundle";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, "../../../..");
+describe("buildProdBundle in-process (Bun.build)", () => {
+  let tmp = "";
+  beforeEach(async () => {
+    tmp = await mkdtemp(join(tmpdir(), "kumiko-build-inproc-"));
+  });
+  afterEach(async () => {
+    await rm(tmp, { recursive: true, force: true });
+  });
+  async function writeMinimalClientApp(opts?: { html?: string; client?: string }) {
+    await mkdir(join(tmp, "src"), { recursive: true });
+    await writeFile(
+      join(tmp, "src/client.ts"),
+      opts?.client ??
+        `const root = document.getElementById("root"); if (root) root.textContent = "hi";`,
+    );
+    await mkdir(join(tmp, "public"), { recursive: true });
+    await writeFile(
+      join(tmp, "public/index.html"),
+      opts?.html ??
+        `<!doctype html><html><head></head><body><div id="root"></div><script type="module" src="/client.js"></script></body></html>`,
+    );
+    await writeFile(join(tmp, "package.json"), `{"name":"inproc-fixture","private":true}`);
+  }
+  test("client.ts → hashed bundle, manifest, build-info, injected script", async () => {
+    await writeMinimalClientApp();
+    const result = await buildProdBundle({ cwd: tmp, stylesheet: false });
+    expect(result.manifest["client.js"]).toMatch(/^\/assets\/client-[a-z0-9]+\.js$/);
+    expect(result.buildInfo?.id).toMatch(/^[0-9a-f]{12}$/);
+    expect(existsSync(join(tmp, "dist/build-info.json"))).toBe(true);
+    const html = await readFile(join(tmp, "dist/index.html"), "utf8");
+    expect(html).toContain(`src="${result.manifest["client.js"]}"`);
+    expect(html).toContain("__KUMIKO_BUILD__");
+    const assetPath = join(tmp, "dist", result.manifest["client.js"] ?? "");
+    expect(existsSync(assetPath)).toBe(true);
+    expect(await readFile(assetPath, "utf8")).toContain('"hi"');
+  });
+  test("missing index.html → error with template snippet", async () => {
+    await mkdir(join(tmp, "src"), { recursive: true });
+    await writeFile(join(tmp, "src/client.ts"), `console.log("hi");`);
+    await writeFile(join(tmp, "package.json"), `{"name":"no-html","private":true}`);
+    await expect(buildProdBundle({ cwd: tmp, stylesheet: false })).rejects.toThrow(
+      /kein index\.html gefunden/,
+    );
+  });
+  test("index.html without /client.js placeholder → error with snippet", async () => {
+    await writeMinimalClientApp({
+      html: `<!doctype html><html><body>no script</body></html>`,
+    });
+    await expect(buildProdBundle({ cwd: tmp, stylesheet: false })).rejects.toThrow(
+      /keinen Entry-Tag für \/client\.js/,
+    );
+  });
+  test("syntax-broken client → Bun.build rejects", async () => {
+    await writeMinimalClientApp({ client: `const x = {{{` });
+    // Bun may throw "Bundle failed" before returning `{ success: false }`.
+    await expect(buildProdBundle({ cwd: tmp, stylesheet: false })).rejects.toThrow(
+      /Bundle failed|Bun\.build failed/,
+    );
+  });
+  test("stylesheet override src/styles.css → hashed styles.css in manifest", async () => {
+    // Temp under REPO_ROOT so @tailwindcss/cli + tailwindcss peer resolve
+    // (same constraint as renderer-web-css-relocation.integration.test.ts).
+    const dir = await mkdtemp(join(REPO_ROOT, ".inproc-styles-"));
+    const cwd = join(dir, "app");
+    try {
+      await mkdir(join(cwd, "src"), { recursive: true });
+      await writeFile(
+        join(cwd, "src/client.ts"),
+        `const root = document.getElementById("root"); if (root) root.textContent = "hi";`,
+      );
+      await writeFile(join(cwd, "src/styles.css"), "body { margin: 0; }\n");
+      await mkdir(join(cwd, "public"), { recursive: true });
+      await writeFile(
+        join(cwd, "public/index.html"),
+        `<!doctype html><html><head><link rel="stylesheet" href="/styles.css" /></head><body><div id="root"></div><script type="module" src="/client.js"></script></body></html>`,
+      );
+      await writeFile(join(cwd, "package.json"), `{"name":"inproc-styles","private":true}`);
+      const result = await buildProdBundle({ cwd, stylesheet: "src/styles.css" });
+      expect(result.manifest["styles.css"]).toMatch(/^\/assets\/styles-[a-z0-9]+\.css$/);
+      const cssPath = join(cwd, "dist", result.manifest["styles.css"] ?? "");
+      expect(existsSync(cssPath)).toBe(true);
+      expect(await readFile(cssPath, "utf8")).toMatch(/margin:\s*0/);
+      const html = await readFile(join(cwd, "dist/index.html"), "utf8");
+      expect(html).toContain(`href="${result.manifest["styles.css"]}"`);
+      expect(html).not.toContain('href="/styles.css"');
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+  test("missing stylesheet override → tailwind rejects", async () => {
+    const dir = await mkdtemp(join(REPO_ROOT, ".inproc-styles-miss-"));
+    const cwd = join(dir, "app");
+    try {
+      await mkdir(join(cwd, "src"), { recursive: true });
+      await writeFile(join(cwd, "src/client.ts"), `console.log("hi");`);
+      await mkdir(join(cwd, "public"), { recursive: true });
+      await writeFile(
+        join(cwd, "public/index.html"),
+        `<!doctype html><html><body><div id="root"></div><script type="module" src="/client.js"></script></body></html>`,
+      );
+      await writeFile(join(cwd, "package.json"), `{"name":"inproc-styles-miss","private":true}`);
+      await expect(buildProdBundle({ cwd, stylesheet: "src/missing-theme.css" })).rejects.toThrow(
+        /tailwind|Bundle failed|tailwindcss/i,
+      );
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+  test("multi-entry client-admin + client-public → two hashed bundles", async () => {
+    await mkdir(join(tmp, "src"), { recursive: true });
+    await writeFile(join(tmp, "src/client-admin.ts"), `console.log("admin");`);
+    await writeFile(join(tmp, "src/client-public.ts"), `console.log("public");`);
+    await mkdir(join(tmp, "public"), { recursive: true });
+    await writeFile(
+      join(tmp, "public/index.html"),
+      `<!doctype html><html><body><script type="module" src="/client-public.js"></script></body></html>`,
+    );
+    await writeFile(
+      join(tmp, "admin.html"),
+      `<!doctype html><html><body><script type="module" src="/client-admin.js"></script></body></html>`,
+    );
+    await writeFile(join(tmp, "package.json"), `{"name":"multi-inproc","private":true}`);
+    const result = await buildProdBundle({ cwd: tmp, stylesheet: false });
+    expect(result.manifest["client-admin.js"]).toMatch(/^\/assets\/client-admin-/);
+    expect(result.manifest["client-public.js"]).toMatch(/^\/assets\/client-public-/);
+    expect(existsSync(join(tmp, "dist/admin.html"))).toBe(true);
+    expect(existsSync(join(tmp, "dist/index.html"))).toBe(true);
+  });
+});

package/src/__tests__/run-prod-app-dry-run.test.ts ADDED Viewed

@@ -0,0 +1,158 @@
+// Dry-run + bootErrorReporter paths — no DB/Redis. envSource avoids process.exit(0).
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import {
+  createBooleanField,
+  createEntity,
+  createTextField,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { composeEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
+import { z } from "zod";
+import { runProdApp } from "../run-prod-app";
+const probeEntity = createEntity({
+  fields: {
+    name: createTextField({ required: true }),
+    active: createBooleanField({ default: true }),
+  },
+  table: "dry_run_probe",
+});
+const probeFeature = defineFeature("dry-run-probe", (r) => {
+  r.entity("widget", probeEntity);
+  r.envSchema(z.object({ DRY_RUN_PROBE: z.string().optional().describe("probe var") }));
+  r.queryHandler({
+    name: "ping",
+    schema: z.object({}),
+    access: { roles: ["anonymous"] },
+    handler: async () => ({ pong: true }),
+  });
+});
+const CLEARED = ["DATABASE_URL", "REDIS_URL", "JWT_SECRET", "PORT"] as const;
+describe("runProdApp dry-run / bootErrorReporter", () => {
+  const saved: Record<string, string | undefined> = {};
+  beforeEach(() => {
+    for (const k of CLEARED) {
+      saved[k] = process.env[k];
+      delete process.env[k];
+    }
+  });
+  afterEach(() => {
+    for (const k of CLEARED) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+  });
+  test("KUMIKO_DRY_RUN_ENV=human + envSource → render + dry-run handle (no exit)", async () => {
+    const logs: string[] = [];
+    const originalLog = console.log;
+    console.log = (...args: unknown[]) => {
+      logs.push(args.map(String).join(" "));
+    };
+    const envSchema = composeEnvSchema({ features: [probeFeature] });
+    let handle: Awaited<ReturnType<typeof runProdApp>>;
+    try {
+      handle = await runProdApp({
+        features: [probeFeature],
+        envSchema,
+        autoListen: false,
+        migrations: false,
+        envSource: { KUMIKO_DRY_RUN_ENV: "human" },
+      });
+    } finally {
+      console.log = originalLog;
+    }
+    expect(logs.some((l) => l.includes("DRY_RUN_PROBE") || l.includes("Optional"))).toBe(true);
+    const res = await handle!.fetch(new Request("http://test/"));
+    expect(res.status).toBe(503);
+    expect(await res.text()).toBe("dry-run");
+    await handle!.stop();
+  });
+  test("KUMIKO_DRY_RUN_ENV=json → structured dry-run output", async () => {
+    const logs: string[] = [];
+    const originalLog = console.log;
+    console.log = (...args: unknown[]) => {
+      logs.push(args.map(String).join(" "));
+    };
+    const envSchema = composeEnvSchema({ features: [probeFeature] });
+    try {
+      const handle = await runProdApp({
+        features: [probeFeature],
+        envSchema,
+        autoListen: false,
+        migrations: false,
+        envSource: { KUMIKO_DRY_RUN_ENV: "json" },
+      });
+      await handle.stop();
+    } finally {
+      console.log = originalLog;
+    }
+    const joined = logs.join("\n");
+    expect(joined).toContain("required");
+    expect(joined).toContain("optional");
+  });
+  test("unrecognized KUMIKO_DRY_RUN_ENV warns then hits envSchema parse", async () => {
+    const warnings: string[] = [];
+    const originalWarn = console.warn;
+    console.warn = (...args: unknown[]) => {
+      warnings.push(args.map(String).join(" "));
+    };
+    const envSchema = composeEnvSchema({
+      features: [],
+      extend: z.object({ MUST_HAVE: z.string().describe("required for test") }),
+    });
+    try {
+      await expect(
+        runProdApp({
+          features: [probeFeature],
+          envSchema,
+          autoListen: false,
+          migrations: false,
+          envSource: { KUMIKO_DRY_RUN_ENV: "not-a-real-mode" },
+          bootErrorReporter: (err) => {
+            throw err;
+          },
+        }),
+      ).rejects.toBeInstanceOf(KumikoBootError);
+    } finally {
+      console.warn = originalWarn;
+    }
+    expect(warnings.some((w) => w.includes("unrecognized"))).toBe(true);
+  });
+  test("bootErrorReporter receives KumikoBootError instead of process.exit", async () => {
+    const envSchema = composeEnvSchema({
+      features: [],
+      extend: z.object({ MUST_HAVE: z.string().describe("required for test") }),
+    });
+    let reported: KumikoBootError | undefined;
+    await expect(
+      runProdApp({
+        features: [probeFeature],
+        envSchema,
+        autoListen: false,
+        migrations: false,
+        envSource: {
+          // no MUST_HAVE → parseEnv throws KumikoBootError
+          DATABASE_URL: "postgres://x",
+          REDIS_URL: "redis://x",
+        },
+        bootErrorReporter: (err) => {
+          reported = err;
+          throw err;
+        },
+      }),
+    ).rejects.toBeInstanceOf(KumikoBootError);
+    expect(reported).toBeInstanceOf(KumikoBootError);
+    expect(reported!.errors.some((e) => e.name === "MUST_HAVE")).toBe(true);
+  });
+});

package/src/__tests__/run-prod-app-static-files.test.ts ADDED Viewed

@@ -0,0 +1,148 @@
+// Unit coverage for mimeTypeFor + hostDispatch edge in buildStaticFallback.
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  buildStaticFallback,
+  mimeTypeFor,
+  readStaticFile,
+  serveDiskFile,
+} from "../run-prod-app-static-files";
+describe("mimeTypeFor", () => {
+  const cases: ReadonlyArray<readonly [string, string]> = [
+    ["x.html", "text/html; charset=utf-8"],
+    ["x.js", "text/javascript; charset=utf-8"],
+    ["x.mjs", "text/javascript; charset=utf-8"],
+    ["x.css", "text/css; charset=utf-8"],
+    ["x.json", "application/json; charset=utf-8"],
+    ["x.svg", "image/svg+xml"],
+    ["x.png", "image/png"],
+    ["x.jpg", "image/jpeg"],
+    ["x.jpeg", "image/jpeg"],
+    ["x.ico", "image/x-icon"],
+    ["x.txt", "text/plain; charset=utf-8"],
+    ["x.xml", "application/xml; charset=utf-8"],
+    ["x.webmanifest", "application/manifest+json"],
+    ["x.bin", "application/octet-stream"],
+    ["noext", "application/octet-stream"],
+  ];
+  for (const [path, mime] of cases) {
+    test(`${path} → ${mime}`, () => {
+      expect(mimeTypeFor(path)).toBe(mime);
+    });
+  }
+});
+describe("readStaticFile / serveDiskFile", () => {
+  let tmp = "";
+  beforeEach(async () => {
+    tmp = await mkdtemp(join(tmpdir(), "kumiko-static-"));
+  });
+  afterEach(async () => {
+    await rm(tmp, { recursive: true, force: true });
+  });
+  test("readStaticFile returns bytes+mime; ENOENT → undefined", async () => {
+    const path = join(tmp, "a.css");
+    await writeFile(path, "body{}");
+    const file = await readStaticFile(path);
+    expect(file?.mime).toBe("text/css; charset=utf-8");
+    expect(new TextDecoder().decode(file!.bytes)).toBe("body{}");
+    expect(await readStaticFile(join(tmp, "missing.css"))).toBeUndefined();
+  });
+  test("serveDiskFile sets content-type from mime", async () => {
+    const path = join(tmp, "a.svg");
+    await writeFile(path, "<svg/>");
+    const file = await readStaticFile(path);
+    const res = serveDiskFile(new Request("http://t/a.svg"), "/a.svg", file!);
+    expect(res.headers.get("content-type")).toBe("image/svg+xml");
+    expect(await res.text()).toBe("<svg/>");
+  });
+});
+describe("buildStaticFallback hostDispatch", () => {
+  let tmp = "";
+  beforeEach(async () => {
+    tmp = await mkdtemp(join(tmpdir(), "kumiko-fallback-"));
+  });
+  afterEach(async () => {
+    await rm(tmp, { recursive: true, force: true });
+  });
+  test("hostDispatch html pointing at missing file → 500", async () => {
+    const handler = buildStaticFallback(
+      () => new Response("api-404", { status: 404 }),
+      tmp,
+      "{}",
+      () => ({ kind: "html", file: "gone.html" }),
+    );
+    const res = await handler(new Request("http://t/"));
+    expect(res.status).toBe(500);
+    expect(await res.text()).toContain("hostDispatch: file not found: gone.html");
+  });
+  test("hostDispatch not-found → 404; redirect → 302", async () => {
+    const notFound = buildStaticFallback(
+      () => new Response("x", { status: 404 }),
+      tmp,
+      "{}",
+      () => ({ kind: "not-found" }),
+    );
+    expect((await notFound(new Request("http://t/"))).status).toBe(404);
+    const redirect = buildStaticFallback(
+      () => new Response("x", { status: 404 }),
+      tmp,
+      "{}",
+      () => ({ kind: "redirect", to: "https://example.com/", status: 301 }),
+    );
+    const res = await redirect(new Request("http://t/"));
+    expect(res.status).toBe(301);
+    expect(res.headers.get("location")).toBe("https://example.com/");
+  });
+  test("/api/* always hits apiHandler", async () => {
+    const handler = buildStaticFallback(() => new Response("from-api", { status: 200 }), tmp, "{}");
+    const res = await handler(new Request("http://t/api/query", { method: "POST" }));
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe("from-api");
+  });
+  test("serves disk asset under staticDir", async () => {
+    await writeFile(join(tmp, "logo.png"), "PNGDATA");
+    const handler = buildStaticFallback(() => new Response("404", { status: 404 }), tmp, "{}");
+    const res = await handler(new Request("http://t/logo.png"));
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toBe("image/png");
+    expect(await res.text()).toBe("PNGDATA");
+  });
+  test("hostDispatch html with CSP + Vary: Host", async () => {
+    await writeFile(join(tmp, "tenant.html"), "<!doctype html><html><body>ok</body></html>");
+    const handler = buildStaticFallback(
+      () => new Response("404", { status: 404 }),
+      tmp,
+      '{"screens":[]}',
+      () => ({
+        kind: "html",
+        file: "tenant.html",
+        injectSchema: false,
+        csp: "default-src 'self'",
+      }),
+    );
+    const res = await handler(new Request("http://t/", { headers: { host: "a.example" } }));
+    expect(res.status).toBe(200);
+    expect(res.headers.get("vary")).toBe("Host");
+    expect(res.headers.get("content-security-policy")).toBe("default-src 'self'");
+    expect(await res.text()).toContain("ok");
+  });
+});

package/src/__tests__/run-prod-app.integration.test.ts CHANGED Viewed

@@ -823,7 +823,12 @@ describe("runProdApp — auth allowedOrigins forwarding", () => {
   test("cookieDomain without allowedOrigins fails closed — guard is wired through runProdApp", async () => {
     await expect(
       boot(undefined, {
-        auth: { admin: ADMIN, cookieDomain: "example.eu", sessions: false },
+        features: [
+          authFoundationFeature,
+          createPersonalAccessTokensFeature({ scopes: {} }),
+          createSessionsFeature(),
+        ],
+        auth: { admin: ADMIN, cookieDomain: "example.eu" },
         allowPlaintextPii: "test: origin-guard focus, not crypto",
       }),
     ).rejects.toThrow(/allowedOrigins is empty/);
@@ -836,11 +841,15 @@ describe("runProdApp — auth allowedOrigins forwarding", () => {
     let bootError: unknown;
     try {
       const handle = await boot(undefined, {
+        features: [
+          authFoundationFeature,
+          createPersonalAccessTokensFeature({ scopes: {} }),
+          createSessionsFeature(),
+        ],
         auth: {
           admin: ADMIN,
           cookieDomain: "example.eu",
           allowedOrigins: ["https://app.example.eu"],
-          sessions: false,
         },
       });
       expect(handle).toBeDefined();
@@ -861,7 +870,7 @@ describe("runProdApp — session boot gate (#1262/#1275)", () => {
     memberships: [],
   };
-  test("auth mounted, sessions feature missing, no opt-out → aborts boot", async () => {
+  test("auth mounted, sessions feature missing → aborts boot", async () => {
     await expect(
       boot(undefined, {
         auth: {
@@ -871,7 +880,7 @@ describe("runProdApp — session boot gate (#1262/#1275)", () => {
         },
         allowPlaintextPii: "test: session-gate focus, not crypto",
       }),
-    ).rejects.toThrow(/BOOT ABORTED.*sessions.*stateless/s);
+    ).rejects.toThrow(/BOOT ABORTED.*sessionStore/);
   });
   test("auth mounted, sessions feature mounted → boots cleanly (the happy path the gate guards)", async () => {

package/src/__tests__/session-boot-gate.test.ts CHANGED Viewed

@@ -1,54 +1,22 @@
 import { describe, expect, test } from "bun:test";
 import { assertSessionBootInvariants } from "../session-boot-gate";
-describe("assertSessionBootInvariants", () => {
-  test("no auth mounted → nothing to gate", () => {
+describe("assertSessionBootInvariants (#1372)", () => {
+  test("no auth → no throw", () => {
     expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: false,
-        sessionsFeatureMounted: false,
-        sessionsOption: undefined,
-      }),
+      assertSessionBootInvariants({ hasAuth: false, sessionStoreProviderMounted: false }),
     ).not.toThrow();
   });
-  test("auth mounted, sessions feature missing, no opt-out → aborts boot", () => {
+  test("auth + sessionStore → no throw", () => {
     expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: true,
-        sessionsFeatureMounted: false,
-        sessionsOption: undefined,
-      }),
-    ).toThrow(/BOOT ABORTED.*sessions.*stateless/s);
-  });
-  test("auth mounted, sessions feature missing, explicit sessions:false → boots", () => {
-    expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: true,
-        sessionsFeatureMounted: false,
-        sessionsOption: false,
-      }),
-    ).not.toThrow();
-  });
-  test("auth mounted, sessions feature wired → boots", () => {
-    expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: true,
-        sessionsFeatureMounted: true,
-        sessionsOption: undefined,
-      }),
+      assertSessionBootInvariants({ hasAuth: true, sessionStoreProviderMounted: true }),
     ).not.toThrow();
   });
-  test("auth mounted, sessions feature wired AND an expiresInMs override → boots", () => {
+  test("auth without sessionStore → throws", () => {
     expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: true,
-        sessionsFeatureMounted: true,
-        sessionsOption: { expiresInMs: 60_000 },
-      }),
-    ).not.toThrow();
+      assertSessionBootInvariants({ hasAuth: true, sessionStoreProviderMounted: false }),
+    ).toThrow(/BOOT ABORTED/);
   });
 });

package/src/__tests__/session-wiring.test.ts CHANGED Viewed

@@ -1,51 +1,16 @@
 import { describe, expect, it } from "bun:test";
-import {
-  createSessionsFeature,
-  SESSIONS_FEATURE,
-} from "@cosmicdrift/kumiko-bundled-features/sessions";
-import { resolveProdSessionsConfig, shouldWireProdSessions } from "../session-wiring";
+import { shouldWireProdSessions } from "../session-wiring";
-describe("shouldWireProdSessions — secure-by-default with opt-out (KF-1)", () => {
-  it("wires sessions when the feature is mounted, even without an explicit config", () => {
-    // The publicstatus bug: sessions feature mounted + auth set, but no auth.sessions —
-    // previously left stateless (no revocation). Now it wires automatically.
-    expect(shouldWireProdSessions(true, true, undefined)).toBe(true);
+describe("shouldWireProdSessions — secure-by-default (#1372)", () => {
+  it("wires when auth + sessionStore provider mounted", () => {
+    expect(shouldWireProdSessions(true, true)).toBe(true);
   });
-  it("wires sessions when a config object is given", () => {
-    expect(shouldWireProdSessions(true, true, { expiresInMs: 1000 })).toBe(true);
+  it("does not wire without auth", () => {
+    expect(shouldWireProdSessions(false, true)).toBe(false);
   });
-  it("does not wire when sessions: false (explicit opt-out)", () => {
-    expect(shouldWireProdSessions(true, true, false)).toBe(false);
-  });
-  it("does not wire when the sessions feature is not mounted", () => {
-    expect(shouldWireProdSessions(true, false, undefined)).toBe(false);
-  });
-  it("does not wire when the app has no auth at all", () => {
-    expect(shouldWireProdSessions(false, true, undefined)).toBe(false);
-  });
-});
-describe("SESSIONS_FEATURE constant matches the real feature name", () => {
-  it("createSessionsFeature()'s name equals SESSIONS_FEATURE", () => {
-    // shouldWireProdSessions's own arm only tests the pure boolean helper —
-    // the actual run-prod-app.ts integration seam
-    // (`features.some((f) => f.name === SESSIONS_FEATURE)`) drifts silently
-    // if the feature is ever renamed without updating this constant.
-    expect(createSessionsFeature().name).toBe(SESSIONS_FEATURE);
-  });
-});
-describe("resolveProdSessionsConfig", () => {
-  it("passes a config object through", () => {
-    expect(resolveProdSessionsConfig({ expiresInMs: 5000 })).toEqual({ expiresInMs: 5000 });
-  });
-  it("collapses false / undefined to defaults", () => {
-    expect(resolveProdSessionsConfig(undefined)).toEqual({});
-    expect(resolveProdSessionsConfig(false)).toEqual({});
+  it("does not wire without sessionStore provider", () => {
+    expect(shouldWireProdSessions(true, false)).toBe(false);
   });
 });

package/src/run-prod-app-boot-context.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 import { makeAuthPaths } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { bindMfaRevokeAllOtherSessionsFromFeature } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
 import { createSmtpTransportFromEnv } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import {
@@ -15,10 +16,7 @@ import {
   createSecretsContext,
   SECRETS_FEATURE_NAME,
 } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import {
-  bindAutoRevokeFromFeature,
-  createSessionCallbacks,
-} from "@cosmicdrift/kumiko-bundled-features/sessions";
+import { bindAutoRevokeFromFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { createTextContentApi } from "@cosmicdrift/kumiko-bundled-features/text-content";
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
@@ -38,7 +36,6 @@ import type {
   PasswordResetSetup,
   SignupSetup,
 } from "./run-prod-app";
-import type { ProdSessionsConfig } from "./session-wiring";
 // Boot-time context helpers for runProdApp: ctx-extra-context wiring
 // (textContent/delivery/secrets/config-resolver), auth-mail convenience
@@ -214,33 +211,27 @@ export function resolveAuthMail<T extends AuthMailNormalizable>(
   };
 }
-export function buildProdSessionAuth(
+export async function buildProdSessionAuth(
   db: DbConnection,
-  opts: ProdSessionsConfig,
+  registry: Registry,
   sessionsFeature: FeatureDefinition | undefined,
   mfaFeature: FeatureDefinition | undefined,
-): {
-  readonly sessionCreator: ReturnType<typeof createSessionCallbacks>["sessionCreator"];
-  readonly sessionRevoker: ReturnType<typeof createSessionCallbacks>["sessionRevoker"];
-  readonly sessionChecker: ReturnType<typeof createSessionCallbacks>["sessionChecker"];
-} {
-  const cbs = createSessionCallbacks({
-    db,
-    ...(opts.expiresInMs !== undefined && { expiresInMs: opts.expiresInMs }),
-  });
-  // Secure-by-default: password-change/-reset mass-revokes the user's live
-  // sessions without the app opting in via autoRevokeOnPasswordChange.
+): Promise<{
+  readonly sessionCreator: Awaited<ReturnType<typeof resolveSessionStore>>["creator"];
+  readonly sessionRevoker: Awaited<ReturnType<typeof resolveSessionStore>>["revoker"];
+  readonly sessionChecker: Awaited<ReturnType<typeof resolveSessionStore>>["checker"];
+}> {
+  // Resolve the sessions feature sessionStore provider (#1372).
+  const store = await resolveSessionStore({ db, registry });
   if (sessionsFeature) {
-    bindAutoRevokeFromFeature(sessionsFeature)?.(cbs.sessionMassRevoker);
+    bindAutoRevokeFromFeature(sessionsFeature)?.(store.massRevoker);
   }
-  // MFA enable/disable/regenerate mass-revokes every OTHER live session
-  // (stolen-session defense) — only wired when auth-mfa is mounted.
   if (mfaFeature) {
-    bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(cbs.sessionRevokeAllOthers);
+    bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(store.revokeAllOthers);
   }
   return {
-    sessionCreator: cbs.sessionCreator,
-    sessionRevoker: cbs.sessionRevoker,
-    sessionChecker: cbs.sessionChecker,
+    sessionCreator: store.creator,
+    sessionRevoker: store.revoker,
+    sessionChecker: store.checker,
   };
 }

package/src/run-prod-app.ts CHANGED Viewed

@@ -46,7 +46,9 @@ import {
   seedAdmin,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import {
+  EXT_SESSION_STORE,
   EXT_TOKEN_VERIFIER,
+  resolveAnonymousAccessFromRegistry,
   resolveTokenVerifier,
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { AUTH_MFA_FEATURE, AuthMfaHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
@@ -140,11 +142,7 @@ import {
 import { buildStaticFallback } from "./run-prod-app-static-files";
 import { type SecurityHeadersOption, withSecurityHeaders } from "./security-headers";
 import { assertSessionBootInvariants } from "./session-boot-gate";
-import {
-  type ProdSessionsOption,
-  resolveProdSessionsConfig,
-  shouldWireProdSessions,
-} from "./session-wiring";
+import { shouldWireProdSessions } from "./session-wiring";
 export { buildBunServeOptions } from "./bun-serve-options";
 export {
@@ -287,14 +285,6 @@ export type RunProdAppAuthOptions = {
   readonly admin: SeedAdminOptions;
   /** Optional override of the login error → HTTP status map. */
   readonly loginErrorStatusMap?: Readonly<Record<string, number>>;
-  /** Opt-in: revocable server-side sessions. Caller MUSS
-   *  `createSessionsFeature()` zu `features` adden — runProdApp wired
-   *  hier nur die Auth-Callbacks (creator/revoker/checker) gegen die
-   *  echte db-connection (sidless JWTs werden dann abgelehnt).
-   *
-   *  Standardverhalten ohne diese Option: stateless JWTs ohne sid
-   *  (legacy-Verhalten, Kartenhaus existing-Apps unangefasst). */
-  readonly sessions?: ProdSessionsOption;
   /** Auth-Mail-Convenience: verdrahtet alle 4 Mail-Flows (passwordReset,
    *  emailVerification, signup, invite) aus `auth.mail.baseUrl` + Standard-
    *  Pfaden. Alle vier mailen via delivery (ctx.notify) — ersetzt das per-App
@@ -368,10 +358,8 @@ export type RunProdAppDeps = {
 };
 export type AnonymousAccessOption =
-  | import("@cosmicdrift/kumiko-framework/api").ServerOptions["anonymousAccess"]
-  | ((
-      deps: RunProdAppDeps,
-    ) => import("@cosmicdrift/kumiko-framework/api").ServerOptions["anonymousAccess"]);
+  | import("@cosmicdrift/kumiko-framework/api").AnonymousAccessConfig
+  | ((deps: RunProdAppDeps) => import("@cosmicdrift/kumiko-framework/api").AnonymousAccessConfig);
 export type ExtraContextOption =
   | Record<string, unknown>
@@ -726,12 +714,11 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     mode: "prod",
   });
   const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
+  const registry = createRegistry(features);
   assertSessionBootInvariants({
     hasAuth: Boolean(effectiveAuth),
-    sessionsFeatureMounted: sessionsFeature !== undefined,
-    sessionsOption: effectiveAuth?.sessions,
+    sessionStoreProviderMounted: registry.getExtensionUsages(EXT_SESSION_STORE).length > 0,
   });
-  const registry = createRegistry(features);
   // C1 boot-mode exit: validators ran + registry built; no DB/Redis client
   // is constructed at all in this branch (the eager `new Redis(...)` below
@@ -861,10 +848,15 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     { ...autoExtraContext, ...resolvedExtraContext },
     registry,
   );
-  const resolvedAnonymousAccess =
+  const baseAnonymousAccess =
     typeof options.anonymousAccess === "function"
       ? options.anonymousAccess(deps)
       : options.anonymousAccess;
+  // #1374: tenantResolver / tenantExists come from auth-foundation providers.
+  const resolvedAnonymousAccess = await resolveAnonymousAccessFromRegistry(baseAnonymousAccess, {
+    db,
+    registry,
+  });
   // Sessions opt-in: db ist hier schon konkret (createDbConnection oben),
   // also direkt verdrahten — kein late-bound nötig wie bei runDevApp.
@@ -874,22 +866,13 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // AuthRoutesConfig-Surface — der geht via bindAutoRevokeFromFeature ans
   // sessions-Feature (Password-Change/-Reset revoked alle Sessions), nicht
   // über die auth-routes.
-  // Secure-by-default: if the sessions feature is mounted, server-side revocation +
-  // auto-revoke-on-password-change are wired automatically;
-  // `auth.sessions` only overrides the config, and `auth.sessions: false` is the
-  // explicit opt-out (back to stateless JWTs).
+  // Secure-by-default (#1372): sessionStore provider → resolveSessionStore.
   const mfaFeature = features.find((f) => f.name === AUTH_MFA_FEATURE);
   const sessionAuthFragment = shouldWireProdSessions(
     Boolean(effectiveAuth),
-    sessionsFeature !== undefined,
-    effectiveAuth?.sessions,
+    registry.getExtensionUsages(EXT_SESSION_STORE).length > 0,
   )
-    ? buildProdSessionAuth(
-        db,
-        resolveProdSessionsConfig(effectiveAuth?.sessions),
-        sessionsFeature,
-        mfaFeature,
-      )
+    ? await buildProdSessionAuth(db, registry, sessionsFeature, mfaFeature)
     : undefined;
   // Token-verifier opt-in: any provider feature (personal-access-tokens, a

package/src/session-boot-gate.ts CHANGED Viewed

@@ -1,29 +1,20 @@
-import type { ProdSessionsOption } from "./session-wiring";
 export type SessionBootGateOptions = {
   readonly hasAuth: boolean;
-  readonly sessionsFeatureMounted: boolean;
-  readonly sessionsOption: ProdSessionsOption | undefined;
+  readonly sessionStoreProviderMounted: boolean;
 };
-// Mirrors pii-boot-gate.ts: catch a forgotten wiring at boot instead of
-// letting it degrade silently into stateless JWTs (no server-side
-// revocation, valid for the full 24h token TTL). `auth.sessions: false` is
-// already the sanctioned opt-out (see session-wiring.ts) — reusing it here
-// instead of inventing a second acknowledgment param.
+// Catch a forgotten sessions mount at boot instead of silently degrading
+// into stateless JWTs (#1372). Mount createSessionsFeature() for revocable
+// sessions; there is no auth.sessions opt-out anymore.
 export function assertSessionBootInvariants(opts: SessionBootGateOptions): void {
   // skip: no auth mounted — nothing to gate.
   if (!opts.hasAuth) return;
-  // skip: explicit opt-out, operator acknowledged stateless JWTs.
-  if (opts.sessionsOption === false) return;
-  // skip: sessions feature is wired.
-  if (opts.sessionsFeatureMounted) return;
+  // skip: sessionStore provider is wired (sessions feature).
+  if (opts.sessionStoreProviderMounted) return;
   throw new Error(
-    "[runProdApp] BOOT ABORTED — auth is mounted but the `sessions` feature is not. " +
-      "JWTs would be stateless (no server-side revocation, valid until the 24h expiry) " +
-      "with no warning. Mount createSessionsFeature() " +
-      "(@cosmicdrift/kumiko-bundled-features/sessions) for revocable sessions, or pass " +
-      "{ auth: { sessions: false } } to acknowledge stateless JWTs are intentional.",
+    "[runProdApp] BOOT ABORTED — auth is mounted but no sessionStore provider is registered. " +
+      "JWTs would be stateless (no server-side revocation). Mount createSessionsFeature() " +
+      "(@cosmicdrift/kumiko-bundled-features/sessions) alongside auth-foundation.",
   );
 }

package/src/session-wiring.ts CHANGED Viewed

@@ -2,28 +2,16 @@
  * runProdApp session-wiring decision (extracted pure so it is testable without a
  * full prod boot).
  *
- * Secure-by-default: mounting the `sessions` feature turns server-side session
- * revocation ON automatically — there is no separate opt-in. The
- * `auth.sessions` option only overrides the config, and `auth.sessions: false` is the
- * explicit opt-out (back to stateless JWTs).
+ * Secure-by-default (#1372): mounting a sessionStore provider (sessions feature)
+ * turns server-side session revocation ON automatically. There is no
+ * `auth.sessions` opt-in/opt-out — mount sessions for revocable JWTs, omit it
+ * for intentional stateless JWTs (boot-gate warns / aborts unless acknowledged
+ * via a future flag if needed; today auth without sessions fails the gate).
  */
-export type ProdSessionsConfig = { readonly expiresInMs?: number };
-/** Config object to override defaults, or `false` to disable session wiring entirely. */
-export type ProdSessionsOption = ProdSessionsConfig | false;
 export function shouldWireProdSessions(
   hasAuth: boolean,
-  sessionsFeatureMounted: boolean,
-  sessionsOption: ProdSessionsOption | undefined,
+  sessionStoreProviderMounted: boolean,
 ): boolean {
-  return hasAuth && sessionsFeatureMounted && sessionsOption !== false;
-}
-/** The config passed to buildProdSessionAuth — `false`/absent collapse to defaults. */
-export function resolveProdSessionsConfig(
-  sessionsOption: ProdSessionsOption | undefined,
-): ProdSessionsConfig {
-  return sessionsOption || {};
+  return hasAuth && sessionStoreProviderMounted;
 }