@cosmicdrift/kumiko-server-runtime 0.329.0 → 0.330.2

package/src/bun-serve-options.ts

@@ -1,110 +0,0 @@
-import {
-  createKumikoWebSocketHandler,
-  DEFAULT_MAX_REQUEST_BYTES,
-  isWebSocketUpgradeRequest,
-  type KumikoServeEnv,
-  type KumikoWebSocketData,
-  WEBSOCKET_BACKPRESSURE_LIMIT_BYTES,
-  WEBSOCKET_MAX_PAYLOAD_BYTES,
-  WEBSOCKET_ROUTE_PATH_PREFIX,
-} from "@cosmicdrift/kumiko-framework/api";
-import type { Registry } from "@cosmicdrift/kumiko-framework/engine/types";
-import {
-  readFilesRouteOptions,
-  resolveMaxUploadBodyBytes,
-} from "@cosmicdrift/kumiko-framework/files";
-
-// Fallback for callers that skip resolveDerivedMaxRequestBodySize below —
-// Bun's own default is 128 MiB, buffered per request before any app-level
-// body-limit middleware runs.
-export const DEFAULT_MAX_REQUEST_BODY_SIZE_BYTES = 32 * 1024 * 1024;
-
-// Keeps Bun's cap above the files route's own derived bodyLimit, so that
-// route's JSON 413 fires before Bun's bare rejection would.
-const BUN_BODY_LIMIT_SAFETY_MARGIN_BYTES = 8 * 1024;
-
-// Derives Bun's request-body ceiling from the same registry-configured
-// maxUploadSize/field maxSize the upload route itself enforces.
-export function resolveDerivedMaxRequestBodySize(registry: Registry): number {
-  const filesRouteOptions = readFilesRouteOptions(registry);
-  return (
-    Math.max(
-      DEFAULT_MAX_REQUEST_BYTES,
-      resolveMaxUploadBodyBytes({ registry, maxUploadSize: filesRouteOptions.maxUploadSize }),
-    ) + BUN_BODY_LIMIT_SAFETY_MARGIN_BYTES
-  );
-}
-
-// Other upgrades (dev HMR, ...) keep going through fetchHandler.
-function isKumikoWebSocketUpgrade(req: Request): boolean {
-  return (
-    isWebSocketUpgradeRequest(req) &&
-    new URL(req.url).pathname.startsWith(WEBSOCKET_ROUTE_PATH_PREFIX)
-  );
-}
-
-/**
- * Bun.serve options for production.
- *
- * idleTimeout: 0 (disabled): SSE streams stay alive through their own
- * heartbeat (SSE_HEARTBEAT_INTERVAL_MS in framework/api/sse-route.ts). With
- * Bun's 10 s default, every heartbeat gap killed the connection with a half
- * HTTP/2 RST_STREAM, which browsers report as ERR_HTTP2_PROTOCOL_ERROR.
- *
- * __tests__/run-prod-app-spec.test.ts pins the 0 against "looks like a
- * leak" reverts.
- *
- * WebSocket: upgrade requests are branched off here, before `fetchHandler`
- * (whose static/SPA layers clone the request, which `server.upgrade` can't
- * use), into `webSocketOptions.upgradeFetch` with the original Request.
- * `heartbeatIntervalMs` overrides the 25 s ping/revalidation cadence.
- */
-export type WebSocketServeOptions = {
-  readonly upgradeFetch: (req: Request, env: KumikoServeEnv) => Response | Promise<Response>;
-  readonly heartbeatIntervalMs?: number;
-};
-
-export function buildBunServeOptions(
-  port: number,
-  fetchHandler: (req: Request, socketAddress?: string) => Response | Promise<Response>,
-  maxRequestBodySize: number = DEFAULT_MAX_REQUEST_BODY_SIZE_BYTES,
-  webSocketOptions?: WebSocketServeOptions,
-): {
-  readonly port: number;
-  readonly fetch: (
-    req: Request,
-    server: Bun.Server<KumikoWebSocketData>,
-  ) => Response | Promise<Response>;
-  readonly idleTimeout: number;
-  readonly maxRequestBodySize: number;
-  readonly websocket: Bun.WebSocketHandler<KumikoWebSocketData>;
-} {
-  // `server.requestIP(req)` only resolves for the exact Request instance
-  // Bun created — extracted here, once, before any downstream req.clone()
-  // (tryHonoFirst et al.) can invalidate it.
-  return {
-    port,
-    fetch: (req, server) => {
-      const socketAddress = server.requestIP(req)?.address;
-      if (webSocketOptions && isKumikoWebSocketUpgrade(req)) {
-        return webSocketOptions.upgradeFetch(req, {
-          ...(socketAddress !== undefined ? { socketAddress } : {}),
-          server,
-        });
-      }
-      return fetchHandler(req, socketAddress);
-    },
-    idleTimeout: 0,
-    maxRequestBodySize,
-    websocket: {
-      ...createKumikoWebSocketHandler(
-        webSocketOptions?.heartbeatIntervalMs !== undefined
-          ? { heartbeatIntervalMs: webSocketOptions.heartbeatIntervalMs }
-          : {},
-      ),
-      maxPayloadLength: WEBSOCKET_MAX_PAYLOAD_BYTES,
-      backpressureLimit: WEBSOCKET_BACKPRESSURE_LIMIT_BYTES,
-      closeOnBackpressureLimit: true,
-    },
-  };
-}

package/src/compose-features.ts

@@ -1,197 +0,0 @@
-// composeFeatures — single source of truth for the feature list that
-// boot AND the schema generator see.
-//
-// Both runDevApp and runProdApp mix in the same bundled features in
-// auth-mode (config + user + tenant + auth-email-password, plus
-// auth-self-registration when authOptions.signup is set). So the
-// drizzle schema generator sees the exact same feature list per app as
-// the runtime, the composition lives here — both bootstrap wrappers AND
-// each app's drizzle/generate.ts call it.
-//
-// Order: infrastructure features (config/user/tenant) first, then
-// auth-email-password (+ auth-self-registration when authOptions.signup
-// is set), then the app features. Later features may reference earlier
-// ones (e.g. authClaims hooks on user/tenant).
-
-import {
-  type AccountLockoutOptions,
-  type AccountUnlockOptions,
-  type AuthEmailPasswordOptions,
-  type AuthMailLocale,
-  createAuthEmailPasswordFeature,
-  createAuthSelfRegistrationToggleFeature,
-  type EmailVerificationOptions,
-  type InviteOptions,
-  type PasswordResetOptions,
-  type SignupOptions,
-} from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import {
-  AUTH_MFA_FEATURE,
-  mfaStatusCheckerFromFeature,
-} from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
-import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
-import { createTenantFeature } from "@cosmicdrift/kumiko-bundled-features/tenant";
-import { createUserFeature } from "@cosmicdrift/kumiko-bundled-features/user";
-import { dedupeFeatures, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-
-export type ComposeFeaturesOptions = {
-  /** When true, prepends config + user + tenant + auth-email-password
-   *  (+ auth-self-registration when authOptions.signup is set) before the
-   *  app features. Mirror of "auth-mode" in run{Dev,Prod}App. */
-  readonly includeBundled: boolean;
-  /** Optional auth-feature options passed through to
-   *  createAuthEmailPasswordFeature. When passwordReset / emailVerification
-   *  are set here, the feature registers the request/confirm handlers —
-   *  otherwise it doesn't (500 if the routes are mounted via
-   *  auth-routes.ts but no handler dispatches). Goes hand-in-hand with the
-   *  passwordReset block in RunProdAppAuthOptions / RunDevAppAuthOptions. */
-  readonly authOptions?: AuthEmailPasswordOptions;
-};
-
-export function composeFeatures(
-  appFeatures: readonly FeatureDefinition[],
-  options: ComposeFeaturesOptions,
-): FeatureDefinition[] {
-  // ponytail: includeBundled:false skips the auth-mfa auto-wiring below —
-  // an app composing its own foundation and mounting auth-mfa itself is
-  // responsible for threading mfaStatusCheckerFromFeature(...) into its
-  // own createAuthEmailPasswordFeature(...) call, or login silently
-  // bypasses MFA. Upgrade if this trips someone: warn here when appFeatures
-  // contains AUTH_MFA_FEATURE but includeBundled is false.
-  if (!options.includeBundled) return dedupeFeatures(appFeatures);
-
-  // Bundled foundation goes first so its instances carry the runDevApp /
-  // runProdApp `authOptions` (passwordReset wiring etc.). App-features that
-  // ALSO declare one of these names — e.g. the create-kumiko-app picker
-  // hands back `createAuthEmailPasswordFeature()` because the user ticked
-  // it — would otherwise crash createRegistry with "Duplicate feature".
-  // Drop the app-side duplicates and warn so the user can clean run-config.
-  //
-  // auth-mfa is NOT part of the bundled foundation (apps opt in explicitly
-  // via APP_FEATURES) — but if it's there, the login handler needs its
-  // status-checker wired in at construction time, since createAuthEmail-
-  // PasswordFeature is built right here, before the caller ever sees it.
-  const dedupedAppFeatures = dedupeFeatures(appFeatures);
-  const mfaFeature = dedupedAppFeatures.find((f) => f.name === AUTH_MFA_FEATURE);
-  const authOptions = mfaFeature
-    ? { ...options.authOptions, mfaStatusChecker: mfaStatusCheckerFromFeature(mfaFeature) }
-    : options.authOptions;
-  const bundled = [
-    createConfigFeature(),
-    createUserFeature(),
-    // inviteScreen mirrors authOptions.invite: that's the exact option that
-    // makes auth-email-password register the invite-create write-handler
-    // the /members invite drawer is bound to — without this, includeBundled
-    // apps that DO configure invite still get /members with no invite button.
-    createTenantFeature({ inviteScreen: Boolean(authOptions?.invite) }),
-    createAuthEmailPasswordFeature(authOptions ?? {}),
-    // signup-request/signup-confirm are registered whenever authOptions.signup
-    // is set (see above), but the handler itself no-ops unless the companion
-    // toggle feature is mounted (ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE))
-    // — without this, apps using the includeBundled convenience path get
-    // self-signup silently broken (always-200 anti-enumeration contract masks
-    // it as success). Mount it alongside signup, default ON, matching the
-    // "on unless an operator flips it off at runtime" contract.
-    ...(authOptions?.signup !== undefined ? [createAuthSelfRegistrationToggleFeature()] : []),
-  ];
-  const bundledNames = new Set(bundled.map((f) => f.name));
-  const filteredApp: FeatureDefinition[] = [];
-  for (const f of dedupedAppFeatures) {
-    if (bundledNames.has(f.name)) {
-      // biome-ignore lint/suspicious/noConsole: boot-time UX warning
-      console.warn(
-        `[composeFeatures] "${f.name}" already auto-mounted via includeBundled — dropping the explicit copy from APP_FEATURES. Remove it from run-config.ts to silence this warning.`,
-      );
-      continue;
-    }
-    filteredApp.push(f);
-  }
-  return [...bundled, ...filteredApp];
-}
-
-/** Shape of any run{Prod,Dev}App auth block that can carry a
- *  passwordReset/emailVerification config, once resolveAuthMail has resolved
- *  the wrapper's optional hmacSecret into the feature API's required one —
- *  a structural-typed lookup on the auth-only subset is enough. Lets
- *  buildComposeAuthOptions be called with both RunProd- and
- *  RunDev-AuthOptions without building the helper twice. */
-export type AuthOptionsCarrier = {
-  readonly passwordReset?: PasswordResetOptions;
-  readonly emailVerification?: EmailVerificationOptions;
-  readonly signup?: SignupOptions;
-  readonly invite?: InviteOptions;
-  readonly accountUnlock?: AccountUnlockOptions;
-  readonly accountLockout?: AccountLockoutOptions;
-};
-
-/** Builds the authOptions block for composeFeatures from a wrapper auth
- *  block. Passes through ONLY the feature-side fields (hmacSecret,
- *  tokenTtlMinutes, mode) — the mail side (sendResetEmail/appResetUrl)
- *  belongs in the auth-routes config and is wired separately by the
- *  wrapper.
- *
- *  Returns undefined when neither passwordReset nor emailVerification is
- *  set (composeFeatures default-deny: NO handler registered in the
- *  registry, /api/auth/request-password-reset etc. stay 401/404). */
-// All five magic-link flows (reset/verify/signup/invite/unlock) accept the
-// same appUrl shape — a plain string, or a `(locale) => string` function for
-// apps with language-in-path routing (see SignupRequestOptions.appUrl).
-type MailFlowFields = {
-  readonly appUrl: string | ((locale: string) => string);
-  readonly tokenTtlMinutes?: number;
-  readonly appName?: string;
-  readonly locale?: AuthMailLocale;
-};
-
-// The magic-link mail fields shared by all five flows. Conditional spreads omit
-// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
-// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
-// reset/verify layer hmacSecret (+ mode) on top.
-function pickMailFields(src: MailFlowFields): MailFlowFields {
-  return {
-    appUrl: src.appUrl,
-    ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
-    ...(src.appName !== undefined && { appName: src.appName }),
-    ...(src.locale !== undefined && { locale: src.locale }),
-  };
-}
-
-export function buildComposeAuthOptions(
-  auth: AuthOptionsCarrier | undefined,
-): AuthEmailPasswordOptions | undefined {
-  if (!auth) return undefined;
-  const opts: { -readonly [K in keyof AuthEmailPasswordOptions]: AuthEmailPasswordOptions[K] } = {};
-  if (auth.passwordReset) {
-    opts.passwordReset = {
-      hmacSecret: auth.passwordReset.hmacSecret,
-      ...pickMailFields(auth.passwordReset),
-    };
-  }
-  if (auth.emailVerification) {
-    opts.emailVerification = {
-      hmacSecret: auth.emailVerification.hmacSecret,
-      ...pickMailFields(auth.emailVerification),
-      ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
-    };
-  }
-  if (auth.signup) {
-    opts.signup = pickMailFields(auth.signup);
-  }
-  if (auth.invite) {
-    opts.invite = pickMailFields(auth.invite);
-  }
-  if (auth.accountUnlock) {
-    opts.accountUnlock = {
-      hmacSecret: auth.accountUnlock.hmacSecret,
-      ...pickMailFields(auth.accountUnlock),
-    };
-  }
-  if (auth.accountLockout) {
-    opts.accountLockout = auth.accountLockout;
-  }
-  return hasAnyAuthFlow(opts) ? opts : undefined;
-}
-
-function hasAnyAuthFlow(opts: AuthEmailPasswordOptions): boolean {
-  return Object.values(opts).some(Boolean);
-}

package/src/extra-routes-deps.ts

@@ -1,38 +0,0 @@
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { Registry, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
-import type Redis from "ioredis";
-
-export type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
-// Re-export the SystemAdmin write/query builders — the single source of
-// truth lives in framework/api next to buildServer's own `extraRoutes`
-// mount so the two never drift on how the SystemAdmin identity is built.
-export {
-  makeDispatchSystemQuery,
-  makeDispatchSystemWrite,
-} from "@cosmicdrift/kumiko-framework/api";
-
-/** Deps for the `wire` hook (runProdApp/createKumikoServer, after
- *  buildServer has mounted `extraRoutes` — see kumiko-framework#3050) and
- *  for `runWorkerApp.wireComponents`. Naming: `deps` not `ctx` because
- *  `ctx` is the framework's HandlerContext (user/tenant/registry) — this
- *  scope is deliberately smaller and has NO `app` (routes are declared via
- *  `extraRoutes`, not wired here). */
-export type SystemWireDeps = {
-  readonly db: DbConnection;
-  readonly redis: Redis;
-  /** Feature-registry — e.g. for plugin-lookups via
-   *  `registry.getExtensionUsages("subscriptionProvider")`. */
-  readonly registry: Registry;
-  /** Writes through the /api/*-command-dispatcher (same idempotency/job
-   *  hooks) as an auto-constructed SystemAdmin of the target tenant,
-   *  WITHOUT the route's own access-check. Privilege-scope: SystemAdmin is
-   *  the highest non-tenant-scoped role — reaches ANY SystemAdmin-gated
-   *  handler on ANY tenant; the role-set is not configurable. Only for
-   *  co-running components that already proved their own authenticity
-   *  (e.g. an IMAP supervisor authenticated against its own mailbox). */
-  readonly dispatchSystemWrite: (args: {
-    readonly handlerQn: string;
-    readonly payload: unknown;
-    readonly tenantId: import("@cosmicdrift/kumiko-framework/engine").TenantId;
-  }) => Promise<WriteResult>;
-};

package/src/index.ts

@@ -1,27 +0,0 @@
-// Public API für den Kumiko-Production-Server-Boot. Symmetrisch zu
-// runDevApp (kumiko-dev-server), aber ohne Dev-/Scaffold-/Codegen-
-// Tooling (ts-morph) als Dependency — Prod-Apps ziehen so kein
-// Dev-Tooling mehr in ihre node_modules.
-export { type ComposeFeaturesOptions, composeFeatures } from "./compose-features";
-export type {
-  AccountUnlockSetup,
-  EmailVerificationSetup,
-  InviteSetup,
-  PageHeadMeta,
-  PageHeadResolver,
-  PageHeadSystemQuery,
-  PasswordResetSetup,
-  ProdAppHandle,
-  ProdSeedFn,
-  RunProdAppAuthOptions,
-  RunProdAppOptions,
-  SignupSetup,
-} from "./run-prod-app";
-export { requireEnv, runProdApp } from "./run-prod-app";
-export type {
-  RunWorkerAppOptions,
-  WorkerAppHandle,
-  WorkerWireDeps,
-} from "./run-worker-app";
-export { runWorkerApp } from "./run-worker-app";
-export type { SecurityHeadersOption } from "./security-headers";

package/src/pii-boot-gate.ts

@@ -1,80 +0,0 @@
-import {
-  collectLookupableFields,
-  collectPiiSubjectFields,
-  type KmsAdapter,
-} from "@cosmicdrift/kumiko-framework/crypto";
-import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-
-type PiiGateOptions = {
-  readonly kms?: KmsAdapter | undefined;
-  readonly blindIndexKey?: string | undefined;
-  readonly allowPlaintextPii?: string | undefined;
-  /** prod fails hard on plaintext PII (opt-out via allowPlaintextPii);
-   *  dev only warns — local data, and an InMemory KMS against a persistent
-   *  dev DB would strand every row after a restart. */
-  readonly mode: "prod" | "dev";
-};
-
-export function assertPiiBootInvariants(
-  features: readonly FeatureDefinition[],
-  opts: PiiGateOptions,
-): void {
-  const tag = opts.mode === "prod" ? "runProdApp" : "runDevApp";
-
-  const lookupableEntities = features.flatMap((feature) =>
-    Object.entries(feature.entities ?? {})
-      .filter(([, entity]) => collectLookupableFields(entity).length > 0)
-      .map(([name]) => name),
-  );
-  if (opts.kms && !opts.blindIndexKey && lookupableEntities.length > 0) {
-    throw new Error(
-      `[${tag}] BOOT ABORTED — entities [${lookupableEntities.join(", ")}] declare lookupable fields and a KMS is configured, but no blindIndexKey was passed. Equality lookups on encrypted fields would silently stop matching. Pass { blindIndexKey } (env: KUMIKO_BLIND_INDEX_KEY, generate: openssl rand -base64 32).`,
-    );
-  }
-
-  // skip: KMS configured — PII fields are encrypted, nothing left to gate.
-  if (opts.kms) return;
-  const piiEntities = features.flatMap((feature) =>
-    Object.entries(feature.entities ?? {})
-      .filter(([, entity]) => collectPiiSubjectFields(entity).length > 0)
-      .map(([name]) => name),
-  );
-  // fw#2776: a declared event stance is worth as much as an entity annotation —
-  // encryptEventPayloadPii no-ops without a KMS, so a catalogued event writes
-  // plaintext PII into kumiko_events with nothing to crypto-shred later.
-  const piiEvents = features.flatMap((feature) =>
-    Object.values(feature.events ?? {})
-      .filter((event) => event.piiFields !== undefined && event.piiFields !== "none")
-      .map((event) => event.name),
-  );
-  // skip: nothing PII-annotated is mounted — plaintext gate is moot.
-  if (piiEntities.length === 0 && piiEvents.length === 0) return;
-  const carriers = [
-    ...(piiEntities.length > 0 ? [`${piiEntities.length} entities`] : []),
-    ...(piiEvents.length > 0 ? [`${piiEvents.length} events`] : []),
-  ].join(" and ");
-  const named = [
-    ...(piiEntities.length > 0 ? [`entities [${piiEntities.join(", ")}]`] : []),
-    ...(piiEvents.length > 0 ? [`events [${piiEvents.join(", ")}]`] : []),
-  ].join(" and ");
-
-  if (opts.mode === "dev") {
-    // biome-ignore lint/suspicious/noConsole: boot-time security warning
-    console.warn(
-      `[${tag}] ${carriers} carry pii/userOwned/tenantOwned/recordOwned annotations or a non-"none" defineEvent PII stance but no \`kms\` adapter is configured — fields are stored in PLAINTEXT locally. Pass { kms: new InMemoryKmsAdapter() } (ephemeral DB) or createPgKmsAdapter(...) to exercise crypto-shredding in dev.`,
-    );
-    // skip: dev mode, plaintext-PII warning already logged above
-    return;
-  }
-  if (opts.allowPlaintextPii) {
-    // biome-ignore lint/suspicious/noConsole: boot-time security warning
-    console.warn(
-      `[${tag}] ${carriers} carry PII annotations but no \`kms\` adapter is configured — fields are stored in PLAINTEXT (allowPlaintextPii: "${opts.allowPlaintextPii}"). GDPR erasure via crypto-shredding is NOT possible until a KMS is provisioned.`,
-    );
-    // skip: operator explicitly acknowledged plaintext PII via allowPlaintextPii, warning already logged above
-    return;
-  }
-  throw new Error(
-    `[${tag}] BOOT ABORTED — ${named} carry pii/userOwned/tenantOwned/recordOwned annotations or a non-"none" defineEvent PII stance but no \`kms\` adapter is configured. The fields would be stored in PLAINTEXT and GDPR erasure (crypto-shredding) could not work. Pass runProdApp({ kms: createPgKmsAdapter({ databaseUrl, platformKek }) }) — or acknowledge explicitly with { allowPlaintextPii: "<reason>" } until your KMS is provisioned.`,
-  );
-}

package/src/resolve-tailwind-cli.ts

@@ -1,45 +0,0 @@
-// Resolved den lokal installierten @tailwindcss/cli-Bin auf seinen
-// absoluten Dateipfad. Wir vermeiden `bunx`, weil das auch bei lokal
-// installiertem Package noch das Registry-Manifest fragt und ohne Netz
-// mit `FailedToOpenSocket` stirbt.
-//
-// Ausgelagert aus create-kumiko-server.ts, damit unter vitest/Node
-// testbar (Bun-Branch + Resolve-Fail-Branch) ohne den Server zu
-// booten.
-
-import { dirname, resolve } from "node:path";
-
-type BunResolver = { resolveSync: (id: string, from: string) => string };
-
-export type ResolveTailwindCliDeps = {
-  readonly bun?: BunResolver;
-  readonly cwd: string;
-};
-
-export function resolveTailwindCli(deps: ResolveTailwindCliDeps): string | undefined {
-  if (deps.bun === undefined) return undefined;
-  try {
-    const pkgJsonPath = deps.bun.resolveSync("@tailwindcss/cli/package.json", deps.cwd);
-    // bin: { tailwindcss: "./dist/index.mjs" } → absoluter Pfad
-    return resolve(pkgJsonPath, "..", "dist", "index.mjs");
-  } catch {
-    return undefined;
-  }
-}
-
-/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
- *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
- *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer-web` outside a hoisted node_modules tree. */
-export function canResolveTailwindStylesheet(
-  entryCss: string,
-  deps: ResolveTailwindCliDeps,
-): boolean {
-  if (deps.bun === undefined) return false;
-  try {
-    deps.bun.resolveSync("tailwindcss", dirname(entryCss));
-    return true;
-  } catch {
-    return false;
-  }
-}