@cosmicdrift/kumiko-server-runtime 0.197.0 → 0.198.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.197.0",
+  "version": "0.198.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -42,6 +42,10 @@
       "types": "./src/pii-boot-gate.ts",
       "default": "./src/pii-boot-gate.ts"
     },
+    "./session-boot-gate": {
+      "types": "./src/session-boot-gate.ts",
+      "default": "./src/session-boot-gate.ts"
+    },
     "./boot/apply-boot-seeds": {
       "types": "./src/boot/apply-boot-seeds.ts",
       "default": "./src/boot/apply-boot-seeds.ts"
@@ -76,8 +80,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.197.0",
-    "@cosmicdrift/kumiko-framework": "0.197.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.198.0",
+    "@cosmicdrift/kumiko-framework": "0.198.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/session-boot-gate.test.ts

@@ -1,22 +1,70 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
 import { assertSessionBootInvariants } from "../session-boot-gate";
 
 describe("assertSessionBootInvariants (#1372)", () => {
   test("no auth → no throw", () => {
     expect(() =>
-      assertSessionBootInvariants({ hasAuth: false, sessionStoreProviderMounted: false }),
+      assertSessionBootInvariants({
+        hasAuth: false,
+        sessionStoreProviderMounted: false,
+        mode: "prod",
+      }),
     ).not.toThrow();
   });
 
   test("auth + sessionStore → no throw", () => {
     expect(() =>
-      assertSessionBootInvariants({ hasAuth: true, sessionStoreProviderMounted: true }),
+      assertSessionBootInvariants({
+        hasAuth: true,
+        sessionStoreProviderMounted: true,
+        mode: "prod",
+      }),
     ).not.toThrow();
   });
 
-  test("auth without sessionStore → throws", () => {
+  test("prod: auth without sessionStore → BOOT ABORTED throw", () => {
     expect(() =>
-      assertSessionBootInvariants({ hasAuth: true, sessionStoreProviderMounted: false }),
+      assertSessionBootInvariants({
+        hasAuth: true,
+        sessionStoreProviderMounted: false,
+        mode: "prod",
+      }),
     ).toThrow(/BOOT ABORTED/);
   });
 });
+
+// dev/prod split (#2027) — dev-server had no equivalent gate at all before
+// this: a forgotten sessions mount silently left session-list empty with no
+// signal. Mirrors assertPiiBootInvariants' dev/prod split (warn vs abort).
+describe("assertSessionBootInvariants — dev mode (#2027)", () => {
+  test("dev: auth without sessionStore → warns, does NOT throw", () => {
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      expect(() =>
+        assertSessionBootInvariants({
+          hasAuth: true,
+          sessionStoreProviderMounted: false,
+          mode: "dev",
+        }),
+      ).not.toThrow();
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("sessionStore"));
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("[runDevApp]"));
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+
+  test("dev: auth + sessionStore → no throw, no warn", () => {
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      assertSessionBootInvariants({
+        hasAuth: true,
+        sessionStoreProviderMounted: true,
+        mode: "dev",
+      });
+      expect(warnSpy).not.toHaveBeenCalled();
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+});

package/src/run-prod-app.ts

@@ -799,6 +799,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   assertSessionBootInvariants({
     hasAuth: Boolean(effectiveAuth),
     sessionStoreProviderMounted: registry.getExtensionUsages(EXT_SESSION_STORE).length > 0,
+    mode: "prod",
   });
 
   // C1 boot-mode exit: validators ran + registry built; no DB/Redis client

package/src/session-boot-gate.ts

@@ -1,6 +1,12 @@
 export type SessionBootGateOptions = {
   readonly hasAuth: boolean;
   readonly sessionStoreProviderMounted: boolean;
+  /** prod fails hard on a missing sessionStore provider (stateless JWTs would
+   *  silently skip server-side revocation and any session-list UI stays
+   *  empty); dev only warns — a forgotten sessions mount in a local sample
+   *  app shouldn't crash the dev-server boot, but it must not stay silent
+   *  either (#2027 — dev previously had no gate here at all). */
+  readonly mode: "prod" | "dev";
 };
 
 // Catch a forgotten sessions mount at boot instead of silently degrading
@@ -12,9 +18,17 @@ export function assertSessionBootInvariants(opts: SessionBootGateOptions): void
   // skip: sessionStore provider is wired (sessions feature).
   if (opts.sessionStoreProviderMounted) return;
 
-  throw new Error(
-    "[runProdApp] BOOT ABORTED — auth is mounted but no sessionStore provider is registered. " +
-      "JWTs would be stateless (no server-side revocation). Mount createSessionsFeature() " +
-      "(@cosmicdrift/kumiko-bundled-features/sessions) alongside auth-foundation.",
-  );
+  const tag = opts.mode === "prod" ? "runProdApp" : "runDevApp";
+  const message =
+    "auth is mounted but no sessionStore provider is registered. JWTs would be stateless " +
+    "(no server-side revocation) and any session-list screen stays empty. Mount " +
+    "createSessionsFeature() (@cosmicdrift/kumiko-bundled-features/sessions) alongside auth-foundation.";
+
+  if (opts.mode === "dev") {
+    // biome-ignore lint/suspicious/noConsole: boot-time ops warning, no logger configured this early
+    console.warn(`[${tag}] ${message}`);
+    // skip: dev mode, warning already logged above — never abort dev boot.
+    return;
+  }
+  throw new Error(`[${tag}] BOOT ABORTED — ${message}`);
 }