@cosmicdrift/kumiko-server-runtime 0.270.0 → 0.274.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.270.0",
+  "version": "0.274.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,8 +80,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.270.0",
-    "@cosmicdrift/kumiko-framework": "0.270.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.274.0",
+    "@cosmicdrift/kumiko-framework": "0.274.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/boot-extra-context.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { createAuditFeature } from "@cosmicdrift/kumiko-bundled-features/audit";
 import { createDeliveryFeature } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { createSecretsFeature } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
@@ -137,4 +138,26 @@ describe("buildBootExtraContext — framework-default provider autowire", () =>
     });
     expect(ctx["secrets"]).toBeDefined();
   });
+
+  test("audit feature mounted → _escapeHatchAuditSink wired", () => {
+    const ctx = buildBootExtraContext({
+      db: fakeDb,
+      features: [createAuditFeature()],
+      envSource: {},
+      registry,
+      hasAuth: false,
+    });
+    expect(typeof ctx["_escapeHatchAuditSink"]).toBe("function");
+  });
+
+  test("no audit feature → _escapeHatchAuditSink not wired", () => {
+    const ctx = buildBootExtraContext({
+      db: fakeDb,
+      features: [otherFeature],
+      envSource: {},
+      registry,
+      hasAuth: false,
+    });
+    expect(ctx["_escapeHatchAuditSink"]).toBeUndefined();
+  });
 });

package/src/run-prod-app-boot-context.ts

@@ -1,3 +1,7 @@
+import {
+  AUDIT_FEATURE,
+  createEscapeHatchAuditSink,
+} from "@cosmicdrift/kumiko-bundled-features/audit";
 import { makeAuthPaths } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
 import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import {
@@ -30,6 +34,7 @@ import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type {
   ConfigResolver,
+  EscapeHatchAuditSink,
   FeatureDefinition,
   NotifyFactory,
   Registry,
@@ -85,17 +90,27 @@ function buildDeliveryNotifyFactory(opts: {
   readonly db: DbConnection;
   readonly registry: Registry;
   readonly sseBroker?: SseBroker;
+  readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
 }): NotifyFactory {
   const deliveryService = createDeliveryService({
     db: opts.db,
     registry: opts.registry,
     channels: collectChannels(opts.registry),
     ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+    ...(opts.escapeHatchAuditSink && { escapeHatchAuditSink: opts.escapeHatchAuditSink }),
   });
   return (user, tenantId) => (notificationType, options) =>
     deliveryService.notify(notificationType, options, user, tenantId);
 }
 
+function resolveEscapeHatchAuditSink(
+  features: readonly FeatureDefinition[],
+  db: DbConnection,
+): EscapeHatchAuditSink | undefined {
+  const hasAuditFeature = features.some((f) => f.name === AUDIT_FEATURE);
+  return hasAuditFeature ? createEscapeHatchAuditSink({ db }) : undefined;
+}
+
 export function buildBootExtraContext(opts: {
   readonly db: DbConnection;
   readonly features: readonly FeatureDefinition[];
@@ -114,14 +129,17 @@ export function buildBootExtraContext(opts: {
   const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
   const wireSecrets = hasSecretsFeature && crypto.masterKeyProvider !== undefined;
   const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
+  const escapeHatchAuditSink = resolveEscapeHatchAuditSink(opts.features, opts.db);
   return {
     templateResolver: createTemplateResolverApi(opts.db),
     ...(opts.kms && { kms: opts.kms }),
+    ...(escapeHatchAuditSink && { _escapeHatchAuditSink: escapeHatchAuditSink }),
     ...(hasDeliveryFeature && {
       _notifyFactory: buildDeliveryNotifyFactory({
         db: opts.db,
         registry: opts.registry,
         ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+        ...(escapeHatchAuditSink && { escapeHatchAuditSink }),
       }),
     }),
     // Top-level provider so feature jobs (secrets rotate, config reencrypt)