@cosmicdrift/kumiko-server-runtime 0.273.0 → 0.275.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.273.0",
+  "version": "0.275.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,8 +80,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.273.0",
-    "@cosmicdrift/kumiko-framework": "0.273.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.275.0",
+    "@cosmicdrift/kumiko-framework": "0.275.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/compose-features.test.ts

@@ -8,6 +8,8 @@
 // dispatched ins Leere → 500.
 
 import { describe, expect, spyOn, test } from "bun:test";
+import { securityBaselineFeatures } from "@cosmicdrift/kumiko-bundled-features/presets";
+import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { composeFeatures } from "../compose-features";
 
@@ -190,4 +192,15 @@ describe("composeFeatures", () => {
     if (!auth) return;
     expect(Object.keys(auth.writeHandlers)).toContain("login");
   });
+
+  test("includeBundled=false → sessions mounted via preset + standalone collapses to one entry", () => {
+    const sessionsInstances = securityBaselineFeatures();
+    const standaloneSessions = createSessionsFeature();
+    const features = composeFeatures([...sessionsInstances, standaloneSessions], {
+      includeBundled: false,
+    });
+    const sessionsEntries = features.filter((f) => f.name === "sessions");
+    expect(sessionsEntries).toHaveLength(1);
+    expect(sessionsEntries[0]).toBe(sessionsInstances[0]);
+  });
 });

package/src/compose-features.ts

@@ -32,7 +32,7 @@ import {
 import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
 import { createTenantFeature } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { createUserFeature } from "@cosmicdrift/kumiko-bundled-features/user";
-import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { dedupeFeatures, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 
 export type ComposeFeaturesOptions = {
   /** When true, prepends config + user + tenant + auth-email-password
@@ -58,7 +58,7 @@ export function composeFeatures(
   // own createAuthEmailPasswordFeature(...) call, or login silently
   // bypasses MFA. Upgrade if this trips someone: warn here when appFeatures
   // contains AUTH_MFA_FEATURE but includeBundled is false.
-  if (!options.includeBundled) return [...appFeatures];
+  if (!options.includeBundled) return dedupeFeatures(appFeatures);
 
   // Bundled foundation goes first so its instances carry the runDevApp /
   // runProdApp `authOptions` (passwordReset wiring etc.). App-features that
@@ -71,7 +71,8 @@ export function composeFeatures(
   // via APP_FEATURES) — but if it's there, the login handler needs its
   // status-checker wired in at construction time, since createAuthEmail-
   // PasswordFeature is built right here, before the caller ever sees it.
-  const mfaFeature = appFeatures.find((f) => f.name === AUTH_MFA_FEATURE);
+  const dedupedAppFeatures = dedupeFeatures(appFeatures);
+  const mfaFeature = dedupedAppFeatures.find((f) => f.name === AUTH_MFA_FEATURE);
   const authOptions = mfaFeature
     ? { ...options.authOptions, mfaStatusChecker: mfaStatusCheckerFromFeature(mfaFeature) }
     : options.authOptions;
@@ -95,7 +96,7 @@ export function composeFeatures(
   ];
   const bundledNames = new Set(bundled.map((f) => f.name));
   const filteredApp: FeatureDefinition[] = [];
-  for (const f of appFeatures) {
+  for (const f of dedupedAppFeatures) {
     if (bundledNames.has(f.name)) {
       // biome-ignore lint/suspicious/noConsole: boot-time UX warning
       console.warn(