@cosmicdrift/kumiko-server-runtime 0.386.0 → 0.387.0

package/dist/run-prod-app.js

@@ -1,42 +1,42 @@
 /// <reference types="bun-types" preserve="true" />
-// runProdApp — production-grade Bootstrap-Wrapper für Kumiko-Apps.
+// runProdApp — production-grade bootstrap wrapper for Kumiko apps.
 //
-// Symmetrisch zu runDevApp, aber:
-//   - DATABASE_URL / REDIS_URL / JWT_SECRET aus env (fail-fast bei Boot,
-//     keine ephemeralen Test-DBs)
-//   - Hard Schema-Drift-Gate: prüft kumiko/migrations vs. _kumiko_migrations
-//     + tableExists für jede erwartete Tabelle. KEIN Auto-CREATE TABLE im
-//     Boot — Migration ist ein CI-Step (`bun kumiko schema apply`), Boot
-//     validiert nur. Verhindert Race-Conditions bei Multi-Replica-Deploys
-//     + macht Schema-Stand reviewbar in der Pull-Request.
-//   - Idempotente Seeds: laufen nur wenn DB leer (über `isDbEmpty`-Probe
-//     pro Seed). Re-Boots nach erstem Seed sind no-op.
-//   - HTTP-Server via Bun.serve mit graceful SIGTERM/SIGINT → drain().
-//   - Auth-Routes + bundled-features auto-mix wenn `auth:` gesetzt
-//     (gleiche Logik wie runDevApp).
+// Symmetric with runDevApp, but:
+//   - DATABASE_URL / REDIS_URL / JWT_SECRET come from env (fail-fast at boot;
+//     no ephemeral test databases)
+//   - Hard schema-drift gate: checks kumiko/migrations against
+//     _kumiko_migrations and verifies every expected table with tableExists.
+//     Boot never runs CREATE TABLE automatically; migrations are applied by
+//     CI (`bun kumiko schema apply`) and boot only validates them. This avoids
+//     races in multi-replica deployments and keeps schema state reviewable.
+//   - Idempotent seeds run only when the database is empty, using an
+//     `isDbEmpty` probe per seed. Reboots after the first seed are no-ops.
+//   - HTTP server via Bun.serve with graceful SIGTERM/SIGINT → drain().
+//   - Auth routes and bundled features are mixed automatically when `auth:` is
+//     set, using the same logic as runDevApp.
 //
-// App-Author schreibt:
+// App authors write:
 //   await runProdApp({ features, envSchema, auth, anonymousAccess, seeds });
 //
-// Container/Coolify setzt:
+// Container/Coolify sets:
 //   DATABASE_URL=postgresql://...
 //   REDIS_URL=redis://...
-//   JWT_SECRET=<random-32+>  (always required — also signs the password-
-//     reset/email-verification HMAC tokens, a separate non-rotating family)
-//     — additionally, for zero-downtime rotation of the session-JWT
-//     signing key specifically:
+//   JWT_SECRET=<random-32+>  (always required — also signs password-reset and
+//     email-verification HMAC tokens, a separate non-rotating token family)
+//     — additionally, for zero-downtime rotation of the session-JWT signing
+//     key specifically:
 //   JWT_SECRET_V1=<random-32+>  (repeat _V2, _V3, ... per rotation)
 //   JWT_SECRET_CURRENT_VERSION=1  (which V<n> signs new tokens; the others
 //     still verify in-flight tokens until they expire)
-//   Adopting rotation for the first time (no JWT_SECRET_V<n> set yet): the
-//   plain JWT_SECRET above stays set and is carried into the keyring as a
-//   verify-only legacy key (loadJwtSecretOrKeyring), so sessions signed
-//   before the cutover keep verifying — no mass-logout at adoption. This
-//   legacy key never expires on its own (boot logs a warning while it's
-//   present) — once max token TTL has elapsed since cutover, unset
-//   JWT_SECRET to retire it. Check first whether an app relies on the
-//   auth.mail convenience default for passwordReset/emailVerification
-//   hmacSecret (falls back to this same JWT_SECRET) before unsetting it.
+//   When adopting rotation for the first time (with no JWT_SECRET_V<n> set),
+//   the plain JWT_SECRET remains set and is carried into the keyring as a
+//   verify-only legacy key (loadJwtSecretOrKeyring), so sessions signed before
+//   cutover continue to verify without a mass logout. This legacy key never
+//   expires automatically; boot logs a warning while it is present. Once the
+//   maximum token TTL has elapsed since cutover, unset JWT_SECRET to retire
+//   it. First check whether the app relies on auth.mail's convenience default
+//   for passwordReset/emailVerification hmacSecret, which falls back to this
+//   same JWT_SECRET.
 //   PORT=3000
 //   KUMIKO_INSTANCE_ID=<stable per replica>
 import { AuthErrors, AuthHandlers, AuthQueries, } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
@@ -219,7 +219,7 @@ export async function runProdApp(options) {
     }
     const jwtIssuer = readEnv("JWT_ISSUER", envSource);
     const instanceId = readEnv("KUMIKO_INSTANCE_ID", envSource);
-    // kumiko-framework#1539 — options.auth.trustedProxyHops wins; falls back
+    // options.auth.trustedProxyHops wins; falls back
     // to the env var so ops can close the XFF-spoofing hole per-deployment
     // without a code change (mirrors instanceId's env-first pattern above).
     const trustedProxyHops = resolveTrustedProxyHops({
@@ -237,9 +237,9 @@ export async function runProdApp(options) {
     const resolvedRateLimit = resolveRateLimit(options.rateLimit);
     const port = options.port ?? Number.parseInt(envSource["PORT"] ?? "3000", 10);
     log.info(`booting Kumiko stack on port ${port}`);
-    // auth.mail → expandiert in die expliziten Flow-Felder, bevor sie sowohl
-    // die Feature-Side (buildComposeAuthOptions) als auch das Routes-Fragment
-    // unten speisen. Ab hier IMMER effectiveAuth statt options.auth lesen.
+    // auth.mail is expanded into the explicit flow fields before feeding both
+    // the feature side (buildComposeAuthOptions) and the routes fragment below.
+    // From here on, always read effectiveAuth instead of options.auth.
     const effectiveAuth = options.auth
         ? resolveAuthMail(options.auth, jwtSecret, envSource, {
             mailConfigured: bootOptionWiring.mailConfigured,
@@ -257,11 +257,10 @@ export async function runProdApp(options) {
         envSource,
         warn: (message) => createFallbackLogger("runProdApp").warn(message),
     });
-    // 3. Feature registry. Auth-mode auto-mixes config/user/tenant/auth-email-
-    //    password via composeFeatures — same source-of-truth as runDevApp
-    //    AND the per-app drizzle-Schema-Generator, so Migration und Runtime
-    //    sehen exakt dieselbe Liste. Built BEFORE any connection so boot-mode
-    //    can validate wiring and exit without opening a Postgres/Redis socket.
+    // 3. Feature registry. Auth mode automatically mixes config/user/tenant/
+    // auth-email-password via composeFeatures, using the same feature list as
+    // runDevApp and the per-app schema generator. Build it before any connection
+    // so boot mode can validate wiring without opening Postgres or Redis sockets.
     const composeAuthOptions = buildComposeAuthOptions(effectiveAuth);
     const features = composeFeatures([...options.features, ...bootOptionWiring.features], {
         includeBundled: !!effectiveAuth,
@@ -330,7 +329,7 @@ export async function runProdApp(options) {
     const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
     logRedisConnectionState(redis, log);
     await waitForDatabase(db, { processName: "runProdApp" });
-    // Sprint-8a Tier-Composition auto-wire: scan features for a
+    // Tier-Composition auto-wire: scan features for a
     // tenantTierResolver-extension. If found, build the resolver here (db +
     // registry are available) before the dispatcher is constructed. App-Author sees
     // nothing — `createTierEngineFeature(opts)` mounts + framework auto-wires.
@@ -358,14 +357,13 @@ export async function runProdApp(options) {
         });
         resolvedEffectiveFeatures = bound.resolver;
     }
-    // 5. Schema-Drift-Gate (drizzle-frei, kumiko/migrations). `kumiko schema
-    //    apply` läuft als Deploy-Step VOR dem Container-Rollout. Boot prüft nur:
-    //      (a) Alle Migrations aus kumiko/migrations/*.sql sind in
-    //          _kumiko_migrations applied (+ checksum unverändert)
-    //      (b) Alle Tabellen aus kumiko/migrations/.snapshot.json existieren
-    //    Drift = Boot-Error mit klarer Meldung (kein Auto-Heal — mehrere
-    //    Container-Replicas würden sonst race-conditionen fahren). Opt-out via
-    //    `migrations: false` für custom Schema-Setups.
+    // 5. Schema-drift gate (without drizzle, using kumiko/migrations). `kumiko
+    // schema apply` runs as a deploy step before container rollout. Boot only
+    // verifies that every kumiko/migrations/*.sql file is applied in
+    // _kumiko_migrations with an unchanged checksum and that every table in
+    // kumiko/migrations/.snapshot.json exists. Drift aborts boot rather than being auto-healed, avoiding
+    // races between container replicas. `migrations: false` opts out for custom
+    // schema setups.
     if (options.migrations !== false) {
         const migrationsDir = options.migrations?.dir ?? "./kumiko/migrations";
         log.info(`checking schema drift (${migrationsDir})`);
@@ -383,27 +381,20 @@ export async function runProdApp(options) {
     const idempotency = createIdempotencyGuard(redis, { ttlSeconds: 60 });
     const eventDedup = createEventDedup(redis, { ttlSeconds: 60 });
     const entityCache = createEntityCache(redis, { ttlSeconds: 60 });
-    // 7. Lifecycle is built by createApiEntrypoint when not supplied —
-    //    we let the entrypoint own it and read it back through the handle
-    //    for SIGTERM.
+    // 7. When no lifecycle is supplied, createApiEntrypoint builds and owns it;
+    // the handle exposes it for SIGTERM.
     //
-    // extraContext + anonymousAccess sind factory-union: entweder direktes
-    // Object oder Function die {db, redis, registry} bekommt und das Object
-    // returned. Factory-Form gilt als bevorzugt für Cases die zur Boot-Zeit
-    // gegen die DB resolven müssen (z.B. Subdomain-Tenant-Lookup im
-    // tenantResolver) — die Factory closure'd `db` und der Resolver kann
-    // sie zur Request-Zeit aufrufen.
-    // Build the sseBroker here (instead of letting createApiEntrypoint do it
-    // internally) so extraContext factories can close over it at boot time —
-    // e.g. an extraContext provider that publishes SSE events directly. We
-    // pass the same broker into createApiEntrypoint (sseBroker? option) so
-    // the server-internal broadcast and app-specific publishes run over
-    // exactly one broker. createDefaultSseBroker (not createSseBroker
-    // directly) is what makes that broker Redis-backed under REDIS_URL —
-    // an unconditional in-memory broker here would silently win over
-    // buildServer's own REDIS_URL default (ServerOptions.sseBroker always
-    // wins), which is exactly how fw#2630's cross-replica fanout fix shipped
-    // without ever taking effect in production.
+    // extraContext and anonymousAccess accept either an object or a factory that
+    // receives {db, redis, registry}; factories are useful when boot-time database
+    // access is needed, such as a subdomain-to-tenant resolver.
+    //
+    // Build the SSE broker here so extraContext factories can close over it, and
+    // pass the same broker into createApiEntrypoint (sseBroker option) so
+    // server-internal broadcasts and app-specific publishes share one broker. Use
+    // createDefaultSseBroker so REDIS_URL selects a Redis-backed broker; an
+    // unconditional in-memory broker would silently override buildServer's
+    // Redis-backed default (ServerOptions.sseBroker always wins) and prevent
+    // cross-replica fanout.
     const { sseBroker, ownedRedisSseBroker } = createDefaultSseBroker(envSource);
     const deps = {
         db,
@@ -417,20 +408,19 @@ export async function runProdApp(options) {
     const resolvedExtraContext = typeof options.extraContext === "function"
         ? options.extraContext(deps)
         : (options.extraContext ?? {});
-    // Framework-Default-Provider zuerst, App-Werte (resolvedExtraContext)
-    // gewinnen immer (z.B. money-horse's eigener configResolver).
-    // App-wide cipher for `encrypted: true` entity fields — executors resolve
-    // it lazily, entities without encrypted fields never touch it.
+    // Install framework defaults first; app values in resolvedExtraContext always
+    // win (for example, an app-specific configResolver).
+    // The app-wide cipher is resolved lazily, so entities without encrypted
+    // fields never access it.
     configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
-    // Subject-key KMS for pii-annotated fields (crypto-shredding, #724).
+    // Subject-key KMS for pii-annotated fields (crypto-shredding).
     // No adapter only gets this far when assertPiiBootInvariants above let it
     // through: no PII carriers, or an explicit allowPlaintextPii opt-out. The
     // engine then stays off and those fields are stored in plaintext.
     configurePiiSubjectKms(bootKms.kms);
-    // Blind-Index-Key (#818) — Boot-Gate: mit aktivem KMS würden lookupable-
-    // Felder als Ciphertext gespeichert, ohne Key gäbe es keinen bidx-Arm und
-    // jeder Equality-Lookup (Login by email!) liefe ins Leere. Fail-fast statt
-    // silent-broken-auth.
+    // Blind-index key boot gate: with KMS enabled, lookupable fields are stored as
+    // ciphertext. Without the key, equality lookups such as login by email cannot
+    // work, so fail fast rather than allowing silently broken authentication.
     configureBlindIndexKey(bootKms.blindIndexKey);
     const bootLogger = loggerFromExtraContext(resolvedExtraContext);
     if (bootLogger)
@@ -456,21 +446,19 @@ export async function runProdApp(options) {
     const baseAnonymousAccess = typeof options.anonymousAccess === "function"
         ? options.anonymousAccess(deps)
         : options.anonymousAccess;
-    // #1374: tenantResolver / tenantExists come from auth-foundation providers.
+    // tenantResolver / tenantExists come from auth-foundation providers.
     const resolvedAnonymousAccess = await resolveAnonymousAccessFromRegistry(baseAnonymousAccess, {
         db,
         registry,
         warn: (message) => createFallbackLogger("runProdApp").warn(message),
     });
-    // Sessions opt-in: db ist hier schon konkret (createDbConnection oben),
-    // also direkt verdrahten — kein late-bound nötig wie bei runDevApp.
-    // Ein JWT ohne sid wird abgelehnt, sobald ein sessionChecker verdrahtet ist —
-    // Prod-Sessions können nicht stillschweigend umgangen werden. sessionMassRevoker
-    // (4. callback aus createSessionCallbacks) ist nicht Teil der
-    // AuthRoutesConfig-Surface — der geht via bindAutoRevokeFromFeature ans
-    // sessions-Feature (Password-Change/-Reset revoked alle Sessions), nicht
-    // über die auth-routes.
-    // Secure-by-default (#1372): sessionStore provider → resolveSessionStore.
+    // Sessions are wired directly because db has already been created; unlike
+    // runDevApp, no late binding is needed. Once a sessionChecker is wired, JWTs
+    // without sid are rejected, so production sessions cannot be bypassed.
+    // sessionMassRevoker (the fourth callback from createSessionCallbacks) is not
+    // part of AuthRoutesConfig; bindAutoRevokeFromFeature hands it to the sessions
+    // feature so password change and reset revoke all sessions. Secure by default: the sessionStore provider
+    // goes through resolveSessionStore.
     const mfaFeature = features.find((f) => f.name === AUTH_MFA_FEATURE);
     if (mfaFeature)
         bindMfaTokenSecretsFromFeature(mfaFeature)?.(jwtSecret, envSource);
@@ -551,7 +539,7 @@ export async function runProdApp(options) {
                 // Redis-backed, not the in-memory default createAuthRoutes falls
                 // back to — an in-process limiter only rate-limits within a single
                 // replica, so a multi-instance prod deployment would silently give
-                // each replica its own bucket (#1262/#1274). Redis is required infra
+                // each replica its own bucket. Redis is required infra
                 // here already (REDIS_URL), so this is free.
                 loginRateLimit: createRedisLoginRateLimiter(redis),
                 ...(effectiveAuth.cookieDomain !== undefined && {
@@ -621,17 +609,15 @@ export async function runProdApp(options) {
         }),
         ...(resolvedAnonymousAccess && { anonymousAccess: resolvedAnonymousAccess }),
     };
-    // Deploy-Topologie. Default (Single-Container): createAllInOneEntrypoint
-    // fährt HTTP + BEIDE Job-Lanes (zwei Runner, jeder schedult seine eigene
-    // Lane-Crons → kein Double-Fire) + Event-Dispatcher inline. So laufen
-    // worker-Lane-Crons (run-export-jobs default runIn:"worker") UND MSPs ohne
-    // separaten Worker-Process — die Asymmetrie, an der der Daten-Export hing.
-    // runSingleInstance:false → API-only; ein dezidierter Worker MUSS dann die
-    // worker-Lane + MSPs übernehmen (api-Lane-Jobs laufen weiter lokal).
-    // Default single-instance. eventDispatcher.disabled ist die Alt-Art, MSPs
-    // diesem Prozess wegzunehmen (dezidierter Worker) — als runSingleInstance:
-    // false honorieren (api-only, kein lokaler Dispatcher), damit der explizite
-    // Flag Vorrang behält aber Bestands-Caller nicht brechen.
+    // Deployment topology. By default, createAllInOneEntrypoint runs HTTP, both
+    // job lanes (two runners, each scheduling only its own lane's crons, so
+    // nothing fires twice) and the event dispatcher inline. That way worker-lane
+    // crons (run-export-jobs defaults to runIn:"worker") and MSPs run without a
+    // separate worker process, the gap the data export used to stall on.
+    // runSingleInstance:false means API-only: a dedicated worker must then take
+    // over the worker lane and MSPs, while API-lane jobs keep running locally.
+    // The legacy eventDispatcher.disabled maps to runSingleInstance:false so
+    // existing callers keep working; the explicit flag takes precedence.
     const runSingleInstance = options.runSingleInstance ?? options.eventDispatcher?.disabled !== true;
     const hasJobs = registry.getAllJobs().size > 0;
     const queueNamePrefix = options.jobs?.queueNamePrefix;
@@ -670,7 +656,7 @@ export async function runProdApp(options) {
     // entrypoint's. Registered after createApiEntrypoint/createAllInOneEntrypoint
     // (which already registered the eventDispatcher/jobRunner hooks above),
     // so it drains LIFO before those, matching the close-before-teardown
-    // order fw#2630 established for buildServer's own hook.
+    // order established for buildServer's own hook.
     entrypoint.lifecycle.registerShutdownHook("prodAppCacheSync", async () => {
         await cacheSync.close();
     });
@@ -684,7 +670,7 @@ export async function runProdApp(options) {
     // createApiEntrypoint/createAllInOneEntrypoint, before this function ever
     // runs. `wire` is the remaining escape-hatch for app-wired co-running
     // components that need the system-write dispatcher but don't declare a
-    // route (kumiko-framework#3050).
+    // route.
     if (options.wire) {
         await options.wire({
             db,
@@ -746,18 +732,17 @@ export async function runProdApp(options) {
             });
         }
     }
-    // ES-Operations / Seed-Migrations (Phase 1). Läuft NACH applyBootSeeds +
-    // existing seeds-array — die deklarativen Seeds sind die "always-insert-
-    // if-missing"-Schicht; seed-migrations sind die "diff-and-update"-
-    // Schicht für Drift den existing Seeds nicht erfassen können (z.B.
-    // Membership-Roles-Change nach initialer Seed-Erstellung).
+    // ES operations and seed migrations run after applyBootSeeds and the existing
+    // seeds array. Declarative seeds insert missing records; seed migrations
+    // diff and update state that existing seeds cannot revise, such as membership
+    // roles changed after initial seed creation.
     if (seedDispatcher && options.seedsDir !== undefined && envSource["KUMIKO_SKIP_ES_OPS"] !== "1") {
         await createEsOperationsTable(db);
         await runPendingSeedMigrations({
             db,
             seedsDir: options.seedsDir,
             appliedBy: "boot",
-            registry, // → dry-run-validator catched handler-QN-typos vor dem write
+            registry, // The dry-run validator catches handler QN typos before writing.
             // @wrapper-known semantic-alias
             createContext: (dbRunner) => createSeedMigrationContext({ dispatcher: seedDispatcher, dbRunner }),
         });
@@ -800,15 +785,13 @@ export async function runProdApp(options) {
         fetch: fetchHandler,
         webSocketUpgradeFetch,
         listen: async (listenPort = port) => {
-            // Bun.serve is the production HTTP. Tests don't call listen()
-            // because vitest runs under Node where Bun.serve doesn't exist.
-            // Options-Shape (inkl. idleTimeout: 0 für SSE) liegt in der
-            // exportierten buildBunServeOptions-Funktion — siehe ihren
-            // Header für die Begründung.
+            // Bun.serve provides production HTTP. Tests run under Node, so they call the
+            // fetch handler directly instead. buildBunServeOptions centralizes the
+            // options shape, including `idleTimeout: 0` for SSE.
             if (typeof Bun === "undefined") {
-                // Klare Fehlermeldung statt nackter ReferenceError. Trifft wenn
-                // jemand listen() unter Node/vitest aufruft ohne autoListen:false
-                // — hilft beim Debug, statt sich an "Bun is not defined" abzumühen.
+                // Throw a clear error instead of a raw ReferenceError when listen() is called
+                // under Node/vitest without autoListen:false, making the runtime
+                // requirement explicit.
                 throw new Error("[runProdApp] listen() requires Bun runtime (Bun.serve). " +
                     "Under Node/vitest pass `autoListen: false` and call the returned `fetch()` directly.");
             }

package/dist/run-worker-app.js

@@ -3,11 +3,11 @@
 // Hono app, no auth routes, no SSE broker, no seeds. Shares the boot core
 // with runProdApp (env fail-fast, Temporal polyfill, composeFeatures/
 // registry, PII invariants, KMS health gate, connections, schema-drift
-// gate, boot-crypto, extraContext) — see fw#1725: before this function,
-// every app deploying a worker rebuilt this boot by hand (solon#42), and
-// every deviation was silent: without `ensureTemporalPolyfill`, every job
-// in the worker fails with "Temporal is not defined" in a retry loop,
-// with no boot-time signal that anything is wrong.
+// gate, boot-crypto, extraContext). Before this function, every app
+// deploying a worker rebuilt this boot by hand, and every deviation was
+// silent: without `ensureTemporalPolyfill`, every job in the worker fails
+// with "Temporal is not defined" in a retry loop, with no boot-time signal
+// that anything is wrong.
 //
 // App-author writes:
 //   await runWorkerApp({ features, wireComponents: async (deps) => {...} });

package/dist/session-boot-gate.d.ts

@@ -5,7 +5,7 @@ export type SessionBootGateOptions = {
      *  silently skip server-side revocation and any session-list UI stays
      *  empty); dev only warns — a forgotten sessions mount in a local sample
      *  app shouldn't crash the dev-server boot, but it must not stay silent
-     *  either (#2027 — dev previously had no gate here at all). */
+     *  either. */
     readonly mode: "prod" | "dev";
 };
 export declare function assertSessionBootInvariants(opts: SessionBootGateOptions): void;

package/dist/session-boot-gate.js

@@ -1,5 +1,5 @@
 // Catch a forgotten sessions mount at boot instead of silently degrading
-// into stateless JWTs (#1372). Mount createSessionsFeature() for revocable
+// into stateless JWTs. Mount createSessionsFeature() for revocable
 // sessions; there is no auth.sessions opt-out anymore.
 export function assertSessionBootInvariants(opts) {
     // skip: no auth mounted — nothing to gate.

package/dist/session-wiring.d.ts

@@ -2,7 +2,7 @@
  * runProdApp session-wiring decision (extracted pure so it is testable without a
  * full prod boot).
  *
- * Secure-by-default (#1372): mounting a sessionStore provider (sessions feature)
+ * Secure-by-default: mounting a sessionStore provider (sessions feature)
  * turns server-side session revocation ON automatically. There is no
  * `auth.sessions` opt-in/opt-out — mount sessions for revocable JWTs, omit it
  * for intentional stateless JWTs (boot-gate warns / aborts unless acknowledged

package/dist/session-wiring.js

@@ -2,7 +2,7 @@
  * runProdApp session-wiring decision (extracted pure so it is testable without a
  * full prod boot).
  *
- * Secure-by-default (#1372): mounting a sessionStore provider (sessions feature)
+ * Secure-by-default: mounting a sessionStore provider (sessions feature)
  * turns server-side session revocation ON automatically. There is no
  * `auth.sessions` opt-in/opt-out — mount sessions for revocable JWTs, omit it
  * for intentional stateless JWTs (boot-gate warns / aborts unless acknowledged

package/dist/try-hono-first.js

@@ -14,7 +14,7 @@
 //
 // The status code alone used to be the only signal ("404 = no match") —
 // that masked any matched route's deliberate 404 (e.g. default-deny reads)
-// as the SPA shell with status 200 (kumiko-framework#2435). buildServer
+// as the SPA shell with status 200. buildServer
 // (framework/api/server.ts) registers app.notFound() LAST on the app object
 // and marks exactly the "no handler found" case with
 // NO_ROUTE_MATCH_HEADER_NAME — a handler that builds its own

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.386.0",
+  "version": "0.387.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
-  "license": "BUSL-1.1",
+  "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
     "type": "git",
@@ -88,18 +88,18 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.386.0",
-    "@cosmicdrift/kumiko-framework": "0.386.0",
-    "@cosmicdrift/kumiko-renderer": "0.386.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.386.0",
-    "@cosmicdrift/kumiko-types": "0.386.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.387.0",
+    "@cosmicdrift/kumiko-framework": "0.387.0",
+    "@cosmicdrift/kumiko-renderer": "0.387.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.387.0",
+    "@cosmicdrift/kumiko-types": "0.387.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.386.0"
+    "@cosmicdrift/kumiko-testing": "0.387.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",