@cosmicdrift/kumiko-server-runtime 0.163.0 → 0.163.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.163.0",
+  "version": "0.163.2",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -72,8 +72,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.163.0",
-    "@cosmicdrift/kumiko-framework": "0.163.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.163.2",
+    "@cosmicdrift/kumiko-framework": "0.163.2",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/compose-features.test.ts

@@ -76,6 +76,24 @@ describe("composeFeatures", () => {
     expect(handlerNames).toContain("signup-confirm");
   });
 
+  // Regression: signup-request no-ops silently (always-200 anti-enumeration
+  // contract) unless "auth-self-registration" is mounted. composeFeatures
+  // must bundle it alongside authOptions.signup, not leave apps using the
+  // includeBundled convenience path to mount it by hand.
+  test("authOptions.signup → auth-self-registration mounted, default ON", () => {
+    const features = composeFeatures([noopFeature], {
+      includeBundled: true,
+      authOptions: { signup: { appUrl: "https://app/signup/complete" } },
+    });
+    const toggle = features.find((f) => f.name === "auth-self-registration");
+    expect(toggle).toBeDefined();
+  });
+
+  test("no authOptions.signup → auth-self-registration NOT mounted", () => {
+    const features = composeFeatures([noopFeature], { includeBundled: true });
+    expect(features.map((f) => f.name)).not.toContain("auth-self-registration");
+  });
+
   test("OHNE authOptions → KEINE reset/verify-handlers (anti-default-deploy-bug)", () => {
     // Genau der Bug der vom Review-Agent gefangen wurde: composeFeatures
     // ohne authOptions registriert die handler nicht. Wenn jemand das

package/src/compose-features.ts

@@ -16,6 +16,7 @@ import {
   type AuthEmailPasswordOptions,
   type AuthMailLocale,
   createAuthEmailPasswordFeature,
+  createAuthSelfRegistrationToggleFeature,
   type EmailVerificationOptions,
   type InviteOptions,
   type PasswordResetOptions,
@@ -75,6 +76,14 @@ export function composeFeatures(
     createUserFeature(),
     createTenantFeature(),
     createAuthEmailPasswordFeature(authOptions ?? {}),
+    // signup-request/signup-confirm are registered whenever authOptions.signup
+    // is set (see above), but the handler itself no-ops unless the companion
+    // toggle feature is mounted (ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE))
+    // — without this, apps using the includeBundled convenience path get
+    // self-signup silently broken (always-200 anti-enumeration contract masks
+    // it as success). Mount it alongside signup, default ON, matching the
+    // "on unless an operator flips it off at runtime" contract.
+    ...(authOptions?.signup !== undefined ? [createAuthSelfRegistrationToggleFeature()] : []),
   ];
   const bundledNames = new Set(bundled.map((f) => f.name));
   const filteredApp: FeatureDefinition[] = [];