@cosmicdrift/kumiko-server-runtime 0.269.2 → 0.273.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.269.2",
+  "version": "0.273.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,8 +80,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.269.2",
-    "@cosmicdrift/kumiko-framework": "0.269.2",
+    "@cosmicdrift/kumiko-bundled-features": "0.273.0",
+    "@cosmicdrift/kumiko-framework": "0.273.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/boot-extra-context.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { createAuditFeature } from "@cosmicdrift/kumiko-bundled-features/audit";
 import { createDeliveryFeature } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { createSecretsFeature } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
@@ -137,4 +138,26 @@ describe("buildBootExtraContext — framework-default provider autowire", () =>
     });
     expect(ctx["secrets"]).toBeDefined();
   });
+
+  test("audit feature mounted → _escapeHatchAuditSink wired", () => {
+    const ctx = buildBootExtraContext({
+      db: fakeDb,
+      features: [createAuditFeature()],
+      envSource: {},
+      registry,
+      hasAuth: false,
+    });
+    expect(typeof ctx["_escapeHatchAuditSink"]).toBe("function");
+  });
+
+  test("no audit feature → _escapeHatchAuditSink not wired", () => {
+    const ctx = buildBootExtraContext({
+      db: fakeDb,
+      features: [otherFeature],
+      envSource: {},
+      registry,
+      hasAuth: false,
+    });
+    expect(ctx["_escapeHatchAuditSink"]).toBeUndefined();
+  });
 });

package/src/boot/__tests__/job-run-logger.integration.test.ts

@@ -124,11 +124,11 @@ const attachDispatcherFeature = defineFeature("jobattach", (r) => {
       });
       return crud.create(event.payload, event.user, ctx.db);
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.queryHandler("list", z.object({}), async (_query, ctx) => selectMany(ctx.db, attachNoteTable), {
-    access: { openToAll: true },
+    access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
   });
 
   r.job("record", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {

package/src/run-prod-app-boot-context.ts

@@ -1,3 +1,7 @@
+import {
+  AUDIT_FEATURE,
+  createEscapeHatchAuditSink,
+} from "@cosmicdrift/kumiko-bundled-features/audit";
 import { makeAuthPaths } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
 import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import {
@@ -30,6 +34,7 @@ import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type {
   ConfigResolver,
+  EscapeHatchAuditSink,
   FeatureDefinition,
   NotifyFactory,
   Registry,
@@ -85,17 +90,27 @@ function buildDeliveryNotifyFactory(opts: {
   readonly db: DbConnection;
   readonly registry: Registry;
   readonly sseBroker?: SseBroker;
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
 }): NotifyFactory {
   const deliveryService = createDeliveryService({
     db: opts.db,
     registry: opts.registry,
     channels: collectChannels(opts.registry),
     ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+    ...(opts.escapeHatchAuditSink && { escapeHatchAuditSink: opts.escapeHatchAuditSink }),
   });
   return (user, tenantId) => (notificationType, options) =>
     deliveryService.notify(notificationType, options, user, tenantId);
 }
 
+function resolveEscapeHatchAuditSink(
+  features: readonly FeatureDefinition[],
+  db: DbConnection,
+): EscapeHatchAuditSink | undefined {
+  const hasAuditFeature = features.some((f) => f.name === AUDIT_FEATURE);
+  return hasAuditFeature ? createEscapeHatchAuditSink({ db }) : undefined;
+}
+
 export function buildBootExtraContext(opts: {
   readonly db: DbConnection;
   readonly features: readonly FeatureDefinition[];
@@ -114,14 +129,17 @@ export function buildBootExtraContext(opts: {
   const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
   const wireSecrets = hasSecretsFeature && crypto.masterKeyProvider !== undefined;
   const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
+  const escapeHatchAuditSink = resolveEscapeHatchAuditSink(opts.features, opts.db);
   return {
     templateResolver: createTemplateResolverApi(opts.db),
     ...(opts.kms && { kms: opts.kms }),
+    ...(escapeHatchAuditSink && { _escapeHatchAuditSink: escapeHatchAuditSink }),
     ...(hasDeliveryFeature && {
       _notifyFactory: buildDeliveryNotifyFactory({
         db: opts.db,
         registry: opts.registry,
         ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+        ...(escapeHatchAuditSink && { escapeHatchAuditSink }),
       }),
     }),
     // Top-level provider so feature jobs (secrets rotate, config reencrypt)