@cosmicdrift/kumiko-server-runtime 0.329.0 → 0.330.2

package/dist/bun-serve-options.d.ts

@@ -0,0 +1,32 @@
+/// <reference types="bun-types" preserve="true" />
+import { type KumikoServeEnv, type KumikoWebSocketData } from "@cosmicdrift/kumiko-framework/api";
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine/types";
+export declare const DEFAULT_MAX_REQUEST_BODY_SIZE_BYTES: number;
+export declare function resolveDerivedMaxRequestBodySize(registry: Registry): number;
+/**
+ * Bun.serve options for production.
+ *
+ * idleTimeout: 0 (disabled): SSE streams stay alive through their own
+ * heartbeat (SSE_HEARTBEAT_INTERVAL_MS in framework/api/sse-route.ts). With
+ * Bun's 10 s default, every heartbeat gap killed the connection with a half
+ * HTTP/2 RST_STREAM, which browsers report as ERR_HTTP2_PROTOCOL_ERROR.
+ *
+ * __tests__/run-prod-app-spec.test.ts pins the 0 against "looks like a
+ * leak" reverts.
+ *
+ * WebSocket: upgrade requests are branched off here, before `fetchHandler`
+ * (whose static/SPA layers clone the request, which `server.upgrade` can't
+ * use), into `webSocketOptions.upgradeFetch` with the original Request.
+ * `heartbeatIntervalMs` overrides the 25 s ping/revalidation cadence.
+ */
+export type WebSocketServeOptions = {
+    readonly upgradeFetch: (req: Request, env: KumikoServeEnv) => Response | Promise<Response>;
+    readonly heartbeatIntervalMs?: number;
+};
+export declare function buildBunServeOptions(port: number, fetchHandler: (req: Request, socketAddress?: string) => Response | Promise<Response>, maxRequestBodySize?: number, webSocketOptions?: WebSocketServeOptions): {
+    readonly port: number;
+    readonly fetch: (req: Request, server: Bun.Server<KumikoWebSocketData>) => Response | Promise<Response>;
+    readonly idleTimeout: number;
+    readonly maxRequestBodySize: number;
+    readonly websocket: Bun.WebSocketHandler<KumikoWebSocketData>;
+};

package/dist/bun-serve-options.js

@@ -0,0 +1,49 @@
+/// <reference types="bun-types" preserve="true" />
+import { createKumikoWebSocketHandler, DEFAULT_MAX_REQUEST_BYTES, isWebSocketUpgradeRequest, WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, } from "@cosmicdrift/kumiko-framework/api";
+import { readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "@cosmicdrift/kumiko-framework/files";
+// Fallback for callers that skip resolveDerivedMaxRequestBodySize below —
+// Bun's own default is 128 MiB, buffered per request before any app-level
+// body-limit middleware runs.
+export const DEFAULT_MAX_REQUEST_BODY_SIZE_BYTES = 32 * 1024 * 1024;
+// Keeps Bun's cap above the files route's own derived bodyLimit, so that
+// route's JSON 413 fires before Bun's bare rejection would.
+const BUN_BODY_LIMIT_SAFETY_MARGIN_BYTES = 8 * 1024;
+// Derives Bun's request-body ceiling from the same registry-configured
+// maxUploadSize/field maxSize the upload route itself enforces.
+export function resolveDerivedMaxRequestBodySize(registry) {
+    const filesRouteOptions = readFilesRouteOptions(registry);
+    return (Math.max(DEFAULT_MAX_REQUEST_BYTES, resolveMaxUploadBodyBytes({ registry, maxUploadSize: filesRouteOptions.maxUploadSize })) + BUN_BODY_LIMIT_SAFETY_MARGIN_BYTES);
+}
+// Other upgrades (dev HMR, ...) keep going through fetchHandler.
+function isKumikoWebSocketUpgrade(req) {
+    return (isWebSocketUpgradeRequest(req) &&
+        new URL(req.url).pathname.startsWith(WEBSOCKET_ROUTE_PATH_PREFIX));
+}
+export function buildBunServeOptions(port, fetchHandler, maxRequestBodySize = DEFAULT_MAX_REQUEST_BODY_SIZE_BYTES, webSocketOptions) {
+    // `server.requestIP(req)` only resolves for the exact Request instance
+    // Bun created — extracted here, once, before any downstream req.clone()
+    // (tryHonoFirst et al.) can invalidate it.
+    return {
+        port,
+        fetch: (req, server) => {
+            const socketAddress = server.requestIP(req)?.address;
+            if (webSocketOptions && isKumikoWebSocketUpgrade(req)) {
+                return webSocketOptions.upgradeFetch(req, {
+                    ...(socketAddress !== undefined ? { socketAddress } : {}),
+                    server,
+                });
+            }
+            return fetchHandler(req, socketAddress);
+        },
+        idleTimeout: 0,
+        maxRequestBodySize,
+        websocket: {
+            ...createKumikoWebSocketHandler(webSocketOptions?.heartbeatIntervalMs !== undefined
+                ? { heartbeatIntervalMs: webSocketOptions.heartbeatIntervalMs }
+                : {}),
+            maxPayloadLength: WEBSOCKET_MAX_PAYLOAD_BYTES,
+            backpressureLimit: WEBSOCKET_BACKPRESSURE_LIMIT_BYTES,
+            closeOnBackpressureLimit: true,
+        },
+    };
+}

package/dist/compose-features.d.ts

@@ -0,0 +1,31 @@
+import { type AccountLockoutOptions, type AccountUnlockOptions, type AuthEmailPasswordOptions, type EmailVerificationOptions, type InviteOptions, type PasswordResetOptions, type SignupOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export type ComposeFeaturesOptions = {
+    /** When true, prepends config + user + tenant + auth-email-password
+     *  (+ auth-self-registration when authOptions.signup is set) before the
+     *  app features. Mirror of "auth-mode" in run{Dev,Prod}App. */
+    readonly includeBundled: boolean;
+    /** Optional auth-feature options passed through to
+     *  createAuthEmailPasswordFeature. When passwordReset / emailVerification
+     *  are set here, the feature registers the request/confirm handlers —
+     *  otherwise it doesn't (500 if the routes are mounted via
+     *  auth-routes.ts but no handler dispatches). Goes hand-in-hand with the
+     *  passwordReset block in RunProdAppAuthOptions / RunDevAppAuthOptions. */
+    readonly authOptions?: AuthEmailPasswordOptions;
+};
+export declare function composeFeatures(appFeatures: readonly FeatureDefinition[], options: ComposeFeaturesOptions): FeatureDefinition[];
+/** Shape of any run{Prod,Dev}App auth block that can carry a
+ *  passwordReset/emailVerification config, once resolveAuthMail has resolved
+ *  the wrapper's optional hmacSecret into the feature API's required one —
+ *  a structural-typed lookup on the auth-only subset is enough. Lets
+ *  buildComposeAuthOptions be called with both RunProd- and
+ *  RunDev-AuthOptions without building the helper twice. */
+export type AuthOptionsCarrier = {
+    readonly passwordReset?: PasswordResetOptions;
+    readonly emailVerification?: EmailVerificationOptions;
+    readonly signup?: SignupOptions;
+    readonly invite?: InviteOptions;
+    readonly accountUnlock?: AccountUnlockOptions;
+    readonly accountLockout?: AccountLockoutOptions;
+};
+export declare function buildComposeAuthOptions(auth: AuthOptionsCarrier | undefined): AuthEmailPasswordOptions | undefined;

package/dist/compose-features.js

@@ -0,0 +1,124 @@
+// composeFeatures — single source of truth for the feature list that
+// boot AND the schema generator see.
+//
+// Both runDevApp and runProdApp mix in the same bundled features in
+// auth-mode (config + user + tenant + auth-email-password, plus
+// auth-self-registration when authOptions.signup is set). So the
+// drizzle schema generator sees the exact same feature list per app as
+// the runtime, the composition lives here — both bootstrap wrappers AND
+// each app's drizzle/generate.ts call it.
+//
+// Order: infrastructure features (config/user/tenant) first, then
+// auth-email-password (+ auth-self-registration when authOptions.signup
+// is set), then the app features. Later features may reference earlier
+// ones (e.g. authClaims hooks on user/tenant).
+import { createAuthEmailPasswordFeature, createAuthSelfRegistrationToggleFeature, } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { AUTH_MFA_FEATURE, mfaStatusCheckerFromFeature, } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
+import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
+import { createTenantFeature } from "@cosmicdrift/kumiko-bundled-features/tenant";
+import { createUserFeature } from "@cosmicdrift/kumiko-bundled-features/user";
+import { dedupeFeatures } from "@cosmicdrift/kumiko-framework/engine";
+export function composeFeatures(appFeatures, options) {
+    // ponytail: includeBundled:false skips the auth-mfa auto-wiring below —
+    // an app composing its own foundation and mounting auth-mfa itself is
+    // responsible for threading mfaStatusCheckerFromFeature(...) into its
+    // own createAuthEmailPasswordFeature(...) call, or login silently
+    // bypasses MFA. Upgrade if this trips someone: warn here when appFeatures
+    // contains AUTH_MFA_FEATURE but includeBundled is false.
+    if (!options.includeBundled)
+        return dedupeFeatures(appFeatures);
+    // Bundled foundation goes first so its instances carry the runDevApp /
+    // runProdApp `authOptions` (passwordReset wiring etc.). App-features that
+    // ALSO declare one of these names — e.g. the create-kumiko-app picker
+    // hands back `createAuthEmailPasswordFeature()` because the user ticked
+    // it — would otherwise crash createRegistry with "Duplicate feature".
+    // Drop the app-side duplicates and warn so the user can clean run-config.
+    //
+    // auth-mfa is NOT part of the bundled foundation (apps opt in explicitly
+    // via APP_FEATURES) — but if it's there, the login handler needs its
+    // status-checker wired in at construction time, since createAuthEmail-
+    // PasswordFeature is built right here, before the caller ever sees it.
+    const dedupedAppFeatures = dedupeFeatures(appFeatures);
+    const mfaFeature = dedupedAppFeatures.find((f) => f.name === AUTH_MFA_FEATURE);
+    const authOptions = mfaFeature
+        ? { ...options.authOptions, mfaStatusChecker: mfaStatusCheckerFromFeature(mfaFeature) }
+        : options.authOptions;
+    const bundled = [
+        createConfigFeature(),
+        createUserFeature(),
+        // inviteScreen mirrors authOptions.invite: that's the exact option that
+        // makes auth-email-password register the invite-create write-handler
+        // the /members invite drawer is bound to — without this, includeBundled
+        // apps that DO configure invite still get /members with no invite button.
+        createTenantFeature({ inviteScreen: Boolean(authOptions?.invite) }),
+        createAuthEmailPasswordFeature(authOptions ?? {}),
+        // signup-request/signup-confirm are registered whenever authOptions.signup
+        // is set (see above), but the handler itself no-ops unless the companion
+        // toggle feature is mounted (ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE))
+        // — without this, apps using the includeBundled convenience path get
+        // self-signup silently broken (always-200 anti-enumeration contract masks
+        // it as success). Mount it alongside signup, default ON, matching the
+        // "on unless an operator flips it off at runtime" contract.
+        ...(authOptions?.signup !== undefined ? [createAuthSelfRegistrationToggleFeature()] : []),
+    ];
+    const bundledNames = new Set(bundled.map((f) => f.name));
+    const filteredApp = [];
+    for (const f of dedupedAppFeatures) {
+        if (bundledNames.has(f.name)) {
+            // biome-ignore lint/suspicious/noConsole: boot-time UX warning
+            console.warn(`[composeFeatures] "${f.name}" already auto-mounted via includeBundled — dropping the explicit copy from APP_FEATURES. Remove it from run-config.ts to silence this warning.`);
+            continue;
+        }
+        filteredApp.push(f);
+    }
+    return [...bundled, ...filteredApp];
+}
+// The magic-link mail fields shared by all five flows. Conditional spreads omit
+// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
+// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
+// reset/verify layer hmacSecret (+ mode) on top.
+function pickMailFields(src) {
+    return {
+        appUrl: src.appUrl,
+        ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
+        ...(src.appName !== undefined && { appName: src.appName }),
+        ...(src.locale !== undefined && { locale: src.locale }),
+    };
+}
+export function buildComposeAuthOptions(auth) {
+    if (!auth)
+        return undefined;
+    const opts = {};
+    if (auth.passwordReset) {
+        opts.passwordReset = {
+            hmacSecret: auth.passwordReset.hmacSecret,
+            ...pickMailFields(auth.passwordReset),
+        };
+    }
+    if (auth.emailVerification) {
+        opts.emailVerification = {
+            hmacSecret: auth.emailVerification.hmacSecret,
+            ...pickMailFields(auth.emailVerification),
+            ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
+        };
+    }
+    if (auth.signup) {
+        opts.signup = pickMailFields(auth.signup);
+    }
+    if (auth.invite) {
+        opts.invite = pickMailFields(auth.invite);
+    }
+    if (auth.accountUnlock) {
+        opts.accountUnlock = {
+            hmacSecret: auth.accountUnlock.hmacSecret,
+            ...pickMailFields(auth.accountUnlock),
+        };
+    }
+    if (auth.accountLockout) {
+        opts.accountLockout = auth.accountLockout;
+    }
+    return hasAnyAuthFlow(opts) ? opts : undefined;
+}
+function hasAnyAuthFlow(opts) {
+    return Object.values(opts).some(Boolean);
+}

package/dist/extra-routes-deps.d.ts

@@ -0,0 +1,30 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { Registry, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import type { Redis } from "ioredis";
+export type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
+export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+/** Deps for the `wire` hook (runProdApp/createKumikoServer, after
+ *  buildServer has mounted `extraRoutes` — see kumiko-framework#3050) and
+ *  for `runWorkerApp.wireComponents`. Naming: `deps` not `ctx` because
+ *  `ctx` is the framework's HandlerContext (user/tenant/registry) — this
+ *  scope is deliberately smaller and has NO `app` (routes are declared via
+ *  `extraRoutes`, not wired here). */
+export type SystemWireDeps = {
+    readonly db: DbConnection;
+    readonly redis: Redis;
+    /** Feature-registry — e.g. for plugin-lookups via
+     *  `registry.getExtensionUsages("subscriptionProvider")`. */
+    readonly registry: Registry;
+    /** Writes through the /api/*-command-dispatcher (same idempotency/job
+     *  hooks) as an auto-constructed SystemAdmin of the target tenant,
+     *  WITHOUT the route's own access-check. Privilege-scope: SystemAdmin is
+     *  the highest non-tenant-scoped role — reaches ANY SystemAdmin-gated
+     *  handler on ANY tenant; the role-set is not configurable. Only for
+     *  co-running components that already proved their own authenticity
+     *  (e.g. an IMAP supervisor authenticated against its own mailbox). */
+    readonly dispatchSystemWrite: (args: {
+        readonly handlerQn: string;
+        readonly payload: unknown;
+        readonly tenantId: import("@cosmicdrift/kumiko-framework/engine").TenantId;
+    }) => Promise<WriteResult>;
+};

package/dist/extra-routes-deps.js

@@ -0,0 +1,4 @@
+// Re-export the SystemAdmin write/query builders — the single source of
+// truth lives in framework/api next to buildServer's own `extraRoutes`
+// mount so the two never drift on how the SystemAdmin identity is built.
+export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { type ComposeFeaturesOptions, composeFeatures } from "./compose-features.js";
+export type { AccountUnlockSetup, EmailVerificationSetup, InviteSetup, PageHeadMeta, PageHeadResolver, PageHeadSystemQuery, PasswordResetSetup, ProdAppHandle, ProdSeedFn, RunProdAppAuthOptions, RunProdAppOptions, SignupSetup, } from "./run-prod-app.js";
+export { requireEnv, runProdApp } from "./run-prod-app.js";
+export type { RunWorkerAppOptions, WorkerAppHandle, WorkerWireDeps, } from "./run-worker-app.js";
+export { runWorkerApp } from "./run-worker-app.js";
+export type { SecurityHeadersOption } from "./security-headers.js";

package/dist/index.js

@@ -0,0 +1,7 @@
+// Public API für den Kumiko-Production-Server-Boot. Symmetrisch zu
+// runDevApp (kumiko-dev-server), aber ohne Dev-/Scaffold-/Codegen-
+// Tooling (ts-morph) als Dependency — Prod-Apps ziehen so kein
+// Dev-Tooling mehr in ihre node_modules.
+export { composeFeatures } from "./compose-features.js";
+export { requireEnv, runProdApp } from "./run-prod-app.js";
+export { runWorkerApp } from "./run-worker-app.js";

package/dist/pii-boot-gate.d.ts

@@ -0,0 +1,13 @@
+import { type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+type PiiGateOptions = {
+    readonly kms?: KmsAdapter | undefined;
+    readonly blindIndexKey?: string | undefined;
+    readonly allowPlaintextPii?: string | undefined;
+    /** prod fails hard on plaintext PII (opt-out via allowPlaintextPii);
+     *  dev only warns — local data, and an InMemory KMS against a persistent
+     *  dev DB would strand every row after a restart. */
+    readonly mode: "prod" | "dev";
+};
+export declare function assertPiiBootInvariants(features: readonly FeatureDefinition[], opts: PiiGateOptions): void;
+export {};

package/dist/pii-boot-gate.js

@@ -0,0 +1,46 @@
+import { collectLookupableFields, collectPiiSubjectFields, } from "@cosmicdrift/kumiko-framework/crypto";
+export function assertPiiBootInvariants(features, opts) {
+    const tag = opts.mode === "prod" ? "runProdApp" : "runDevApp";
+    const lookupableEntities = features.flatMap((feature) => Object.entries(feature.entities ?? {})
+        .filter(([, entity]) => collectLookupableFields(entity).length > 0)
+        .map(([name]) => name));
+    if (opts.kms && !opts.blindIndexKey && lookupableEntities.length > 0) {
+        throw new Error(`[${tag}] BOOT ABORTED — entities [${lookupableEntities.join(", ")}] declare lookupable fields and a KMS is configured, but no blindIndexKey was passed. Equality lookups on encrypted fields would silently stop matching. Pass { blindIndexKey } (env: KUMIKO_BLIND_INDEX_KEY, generate: openssl rand -base64 32).`);
+    }
+    // skip: KMS configured — PII fields are encrypted, nothing left to gate.
+    if (opts.kms)
+        return;
+    const piiEntities = features.flatMap((feature) => Object.entries(feature.entities ?? {})
+        .filter(([, entity]) => collectPiiSubjectFields(entity).length > 0)
+        .map(([name]) => name));
+    // fw#2776: a declared event stance is worth as much as an entity annotation —
+    // encryptEventPayloadPii no-ops without a KMS, so a catalogued event writes
+    // plaintext PII into kumiko_events with nothing to crypto-shred later.
+    const piiEvents = features.flatMap((feature) => Object.values(feature.events ?? {})
+        .filter((event) => event.piiFields !== undefined && event.piiFields !== "none")
+        .map((event) => event.name));
+    // skip: nothing PII-annotated is mounted — plaintext gate is moot.
+    if (piiEntities.length === 0 && piiEvents.length === 0)
+        return;
+    const carriers = [
+        ...(piiEntities.length > 0 ? [`${piiEntities.length} entities`] : []),
+        ...(piiEvents.length > 0 ? [`${piiEvents.length} events`] : []),
+    ].join(" and ");
+    const named = [
+        ...(piiEntities.length > 0 ? [`entities [${piiEntities.join(", ")}]`] : []),
+        ...(piiEvents.length > 0 ? [`events [${piiEvents.join(", ")}]`] : []),
+    ].join(" and ");
+    if (opts.mode === "dev") {
+        // biome-ignore lint/suspicious/noConsole: boot-time security warning
+        console.warn(`[${tag}] ${carriers} carry pii/userOwned/tenantOwned/recordOwned annotations or a non-"none" defineEvent PII stance but no \`kms\` adapter is configured — fields are stored in PLAINTEXT locally. Pass { kms: new InMemoryKmsAdapter() } (ephemeral DB) or createPgKmsAdapter(...) to exercise crypto-shredding in dev.`);
+        // skip: dev mode, plaintext-PII warning already logged above
+        return;
+    }
+    if (opts.allowPlaintextPii) {
+        // biome-ignore lint/suspicious/noConsole: boot-time security warning
+        console.warn(`[${tag}] ${carriers} carry PII annotations but no \`kms\` adapter is configured — fields are stored in PLAINTEXT (allowPlaintextPii: "${opts.allowPlaintextPii}"). GDPR erasure via crypto-shredding is NOT possible until a KMS is provisioned.`);
+        // skip: operator explicitly acknowledged plaintext PII via allowPlaintextPii, warning already logged above
+        return;
+    }
+    throw new Error(`[${tag}] BOOT ABORTED — ${named} carry pii/userOwned/tenantOwned/recordOwned annotations or a non-"none" defineEvent PII stance but no \`kms\` adapter is configured. The fields would be stored in PLAINTEXT and GDPR erasure (crypto-shredding) could not work. Pass runProdApp({ kms: createPgKmsAdapter({ databaseUrl, platformKek }) }) — or acknowledge explicitly with { allowPlaintextPii: "<reason>" } until your KMS is provisioned.`);
+}

package/dist/renderer-web-fonts.d.ts

@@ -0,0 +1,9 @@
+export declare const RENDERER_WEB_FONTS_URL_PREFIX = "/assets/kumiko/fonts/";
+/** dist-relative folder the prod build copies the fonts into. */
+export declare const RENDERER_WEB_FONTS_DIST_DIR = "assets/kumiko/fonts";
+/** Allowlist for servable font file names; also rules out path segments. */
+export declare const RENDERER_WEB_FONT_FILE_PATTERN: RegExp;
+/** Directory of the woff2 files next to renderer-web's styles.css, or
+ *  undefined when the package can't be resolved from any `searchFrom` dir
+ *  (or outside Bun, which does the package-exports resolution). */
+export declare function resolveRendererWebFontsDir(searchFrom: readonly string[]): string | undefined;

package/{src/renderer-web-fonts.ts → dist/renderer-web-fonts.js}

@@ -2,32 +2,28 @@
 // same-origin URL. Relative url() would 404: the CSS is compiled into a temp
 // dir (dev) or hashed into dist/assets (prod), away from the source fonts.
 // data: URIs are out because apps run with `font-src 'self'`.
-
 import { dirname, join } from "node:path";
-
 export const RENDERER_WEB_FONTS_URL_PREFIX = "/assets/kumiko/fonts/";
-
 /** dist-relative folder the prod build copies the fonts into. */
 export const RENDERER_WEB_FONTS_DIST_DIR = "assets/kumiko/fonts";
-
 /** Allowlist for servable font file names; also rules out path segments. */
 export const RENDERER_WEB_FONT_FILE_PATTERN = /^[a-z0-9-]+\.woff2$/;
-
-const hasBun = typeof (globalThis as { Bun?: unknown }).Bun !== "undefined";
-
+const hasBun = typeof globalThis.Bun !== "undefined";
 /** Directory of the woff2 files next to renderer-web's styles.css, or
  *  undefined when the package can't be resolved from any `searchFrom` dir
  *  (or outside Bun, which does the package-exports resolution). */
-export function resolveRendererWebFontsDir(searchFrom: readonly string[]): string | undefined {
-  if (!hasBun) return undefined;
-  const bun = (globalThis as { Bun: { resolveSync: (id: string, from: string) => string } }).Bun;
-  for (const from of searchFrom) {
-    try {
-      const stylesheet = bun.resolveSync("@cosmicdrift/kumiko-renderer-web/styles.css", from);
-      return join(dirname(stylesheet), "fonts");
-    } catch {
-      // try the next search root
+export function resolveRendererWebFontsDir(searchFrom) {
+    if (!hasBun)
+        return undefined;
+    const bun = globalThis.Bun;
+    for (const from of searchFrom) {
+        try {
+            const stylesheet = bun.resolveSync("@cosmicdrift/kumiko-renderer-web/styles.css", from);
+            return join(dirname(stylesheet), "fonts");
+        }
+        catch {
+            // try the next search root
+        }
     }
-  }
-  return undefined;
+    return undefined;
 }

package/dist/resolve-tailwind-cli.d.ts

@@ -0,0 +1,14 @@
+type BunResolver = {
+    resolveSync: (id: string, from: string) => string;
+};
+export type ResolveTailwindCliDeps = {
+    readonly bun?: BunResolver;
+    readonly cwd: string;
+};
+export declare function resolveTailwindCli(deps: ResolveTailwindCliDeps): string | undefined;
+/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
+ *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
+ *  aren't resolvable from that directory — e.g. Bun cache copies of
+ *  `@cosmicdrift/kumiko-renderer-web` outside a hoisted node_modules tree. */
+export declare function canResolveTailwindStylesheet(entryCss: string, deps: ResolveTailwindCliDeps): boolean;
+export {};

package/dist/resolve-tailwind-cli.js

@@ -0,0 +1,36 @@
+// Resolved den lokal installierten @tailwindcss/cli-Bin auf seinen
+// absoluten Dateipfad. Wir vermeiden `bunx`, weil das auch bei lokal
+// installiertem Package noch das Registry-Manifest fragt und ohne Netz
+// mit `FailedToOpenSocket` stirbt.
+//
+// Ausgelagert aus create-kumiko-server.ts, damit unter vitest/Node
+// testbar (Bun-Branch + Resolve-Fail-Branch) ohne den Server zu
+// booten.
+import { dirname, resolve } from "node:path";
+export function resolveTailwindCli(deps) {
+    if (deps.bun === undefined)
+        return undefined;
+    try {
+        const pkgJsonPath = deps.bun.resolveSync("@tailwindcss/cli/package.json", deps.cwd);
+        // bin: { tailwindcss: "./dist/index.mjs" } → absoluter Pfad
+        return resolve(pkgJsonPath, "..", "dist", "index.mjs");
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
+ *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
+ *  aren't resolvable from that directory — e.g. Bun cache copies of
+ *  `@cosmicdrift/kumiko-renderer-web` outside a hoisted node_modules tree. */
+export function canResolveTailwindStylesheet(entryCss, deps) {
+    if (deps.bun === undefined)
+        return false;
+    try {
+        deps.bun.resolveSync("tailwindcss", dirname(entryCss));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/run-prod-app-boot-context.d.ts

@@ -0,0 +1,43 @@
+import { type EmailVerificationOptions, type PasswordResetOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
+import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { ConfigResolver, FeatureDefinition, Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import { type BootCrypto } from "./boot/boot-crypto.js";
+import type { AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup } from "./run-prod-app.js";
+export declare function addConfigAccessorFactory<T extends {
+    readonly configResolver?: ConfigResolver;
+}>(resolved: T, registry: Registry): T;
+export declare function buildBootExtraContext(opts: {
+    readonly db: DbConnection;
+    readonly features: readonly FeatureDefinition[];
+    readonly envSource: Record<string, string | undefined>;
+    readonly registry: Registry;
+    readonly hasAuth: boolean;
+    readonly crypto?: BootCrypto;
+    readonly masterKey?: MasterKeyProvider;
+    readonly sseBroker?: SseBroker;
+    readonly kms?: KmsAdapter;
+}): Record<string, unknown>;
+/** Die Auth-Felder die resolveAuthMail liest/normalisiert — beide
+ *  App-Auth-Typen (prod + dev) erfüllen das strukturell. */
+type AuthMailNormalizable = {
+    readonly mail?: AuthMailOptions;
+    readonly passwordReset?: PasswordResetSetup;
+    readonly emailVerification?: EmailVerificationSetup;
+    readonly signup?: SignupSetup;
+    readonly invite?: InviteSetup;
+};
+export declare function resolveAuthMail<T extends AuthMailNormalizable>(auth: T, hmacSecret: string, envSource: Record<string, string | undefined>): T & {
+    readonly passwordReset?: PasswordResetOptions;
+    readonly emailVerification?: EmailVerificationOptions;
+};
+export declare function buildProdSessionAuth(db: DbConnection, registry: Registry, sessionsFeature: FeatureDefinition | undefined, mfaFeature: FeatureDefinition | undefined, patFeature: FeatureDefinition | undefined): Promise<{
+    readonly sessionCreator: Awaited<ReturnType<typeof resolveSessionStore>>["creator"];
+    readonly sessionRevoker: Awaited<ReturnType<typeof resolveSessionStore>>["revoker"];
+    readonly sessionChecker: Awaited<ReturnType<typeof resolveSessionStore>>["checker"];
+}>;
+export declare function wireProdPatAutoRevoke(db: DbConnection, patFeature: FeatureDefinition): void;
+export {};