@cosmicdrift/kumiko-server-runtime 0.386.0 → 0.388.0

package/dist/run-worker-app.d.ts

@@ -90,7 +90,7 @@ export type RunWorkerAppOptions = {
     readonly fileStorage?: FileStorageBootOption;
     /** Same as RunProdAppOptions["kmsMode"]; cannot be combined with `kms` / `blindIndexKey` / `allowPlaintextPii`. */
     readonly kmsMode?: KmsMode;
-    /** Same as RunProdAppOptions["billing"]: mounts subscription-stripe so the registry matches the API. The webhook route belongs to the API process. */
+    /** Same as RunProdAppOptions["billing"]: mounts the configured subscription providers so the registry matches the API. The webhook route belongs to the API process. */
     readonly billing?: BillingBootOption;
     /** Same as RunProdAppOptions["featureToggles"]: mounts feature-toggles and layers the operator switches over the tier resolver. */
     readonly featureToggles?: boolean;

package/dist/run-worker-app.js

@@ -3,11 +3,11 @@
 // Hono app, no auth routes, no SSE broker, no seeds. Shares the boot core
 // with runProdApp (env fail-fast, Temporal polyfill, composeFeatures/
 // registry, PII invariants, KMS health gate, connections, schema-drift
-// gate, boot-crypto, extraContext) — see fw#1725: before this function,
-// every app deploying a worker rebuilt this boot by hand (solon#42), and
-// every deviation was silent: without `ensureTemporalPolyfill`, every job
-// in the worker fails with "Temporal is not defined" in a retry loop,
-// with no boot-time signal that anything is wrong.
+// gate, boot-crypto, extraContext). Before this function, every app
+// deploying a worker rebuilt this boot by hand, and every deviation was
+// silent: without `ensureTemporalPolyfill`, every job in the worker fails
+// with "Temporal is not defined" in a retry loop, with no boot-time signal
+// that anything is wrong.
 //
 // App-author writes:
 //   await runWorkerApp({ features, wireComponents: async (deps) => {...} });

package/dist/session-boot-gate.d.ts

@@ -5,7 +5,7 @@ export type SessionBootGateOptions = {
      *  silently skip server-side revocation and any session-list UI stays
      *  empty); dev only warns — a forgotten sessions mount in a local sample
      *  app shouldn't crash the dev-server boot, but it must not stay silent
-     *  either (#2027 — dev previously had no gate here at all). */
+     *  either. */
     readonly mode: "prod" | "dev";
 };
 export declare function assertSessionBootInvariants(opts: SessionBootGateOptions): void;

package/dist/session-boot-gate.js

@@ -1,5 +1,5 @@
 // Catch a forgotten sessions mount at boot instead of silently degrading
-// into stateless JWTs (#1372). Mount createSessionsFeature() for revocable
+// into stateless JWTs. Mount createSessionsFeature() for revocable
 // sessions; there is no auth.sessions opt-out anymore.
 export function assertSessionBootInvariants(opts) {
     // skip: no auth mounted — nothing to gate.

package/dist/session-wiring.d.ts

@@ -2,7 +2,7 @@
  * runProdApp session-wiring decision (extracted pure so it is testable without a
  * full prod boot).
  *
- * Secure-by-default (#1372): mounting a sessionStore provider (sessions feature)
+ * Secure-by-default: mounting a sessionStore provider (sessions feature)
  * turns server-side session revocation ON automatically. There is no
  * `auth.sessions` opt-in/opt-out — mount sessions for revocable JWTs, omit it
  * for intentional stateless JWTs (boot-gate warns / aborts unless acknowledged

package/dist/session-wiring.js

@@ -2,7 +2,7 @@
  * runProdApp session-wiring decision (extracted pure so it is testable without a
  * full prod boot).
  *
- * Secure-by-default (#1372): mounting a sessionStore provider (sessions feature)
+ * Secure-by-default: mounting a sessionStore provider (sessions feature)
  * turns server-side session revocation ON automatically. There is no
  * `auth.sessions` opt-in/opt-out — mount sessions for revocable JWTs, omit it
  * for intentional stateless JWTs (boot-gate warns / aborts unless acknowledged

package/dist/try-hono-first.js

@@ -14,7 +14,7 @@
 //
 // The status code alone used to be the only signal ("404 = no match") —
 // that masked any matched route's deliberate 404 (e.g. default-deny reads)
-// as the SPA shell with status 200 (kumiko-framework#2435). buildServer
+// as the SPA shell with status 200. buildServer
 // (framework/api/server.ts) registers app.notFound() LAST on the app object
 // and marks exactly the "no handler found" case with
 // NO_ROUTE_MATCH_HEADER_NAME — a handler that builds its own

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.386.0",
+  "version": "0.388.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
-  "license": "BUSL-1.1",
+  "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
     "type": "git",
@@ -50,6 +50,10 @@
       "types": "./dist/boot/apply-boot-seeds.d.ts",
       "default": "./dist/boot/apply-boot-seeds.js"
     },
+    "./boot/shared-boot-steps": {
+      "types": "./dist/boot/shared-boot-steps.d.ts",
+      "default": "./dist/boot/shared-boot-steps.js"
+    },
     "./boot/boot-crypto": {
       "types": "./dist/boot/boot-crypto.d.ts",
       "default": "./dist/boot/boot-crypto.js"
@@ -88,18 +92,18 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.386.0",
-    "@cosmicdrift/kumiko-framework": "0.386.0",
-    "@cosmicdrift/kumiko-renderer": "0.386.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.386.0",
-    "@cosmicdrift/kumiko-types": "0.386.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.388.0",
+    "@cosmicdrift/kumiko-framework": "0.388.0",
+    "@cosmicdrift/kumiko-renderer": "0.388.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
+    "@cosmicdrift/kumiko-types": "0.388.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.386.0"
+    "@cosmicdrift/kumiko-testing": "0.388.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -137,6 +141,10 @@
         "types": "./dist/boot/apply-boot-seeds.d.ts",
         "default": "./dist/boot/apply-boot-seeds.js"
       },
+      "./boot/shared-boot-steps": {
+        "types": "./dist/boot/shared-boot-steps.d.ts",
+        "default": "./dist/boot/shared-boot-steps.js"
+      },
       "./boot/boot-crypto": {
         "types": "./dist/boot/boot-crypto.d.ts",
         "default": "./dist/boot/boot-crypto.js"

package/src/changes.json

@@ -1,4 +1,29 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "runProdApp split into boot phases, boot steps shared with dev and worker",
+    "detail": "runProdApp() keeps its signature and behavior. Config resolution, feature composition, dependency connection, request context, auth wiring, entrypoint, seeds and the returned handle now live in run-prod-app-*.ts files next to run-prod-app.ts. Steps that prod, dev and the worker ran as copies (env defaults, feature composition, boot validation, the auth-mfa switch-tenant gate, the tier and feature-toggle resolver, standard boot seeds, shared auth routes, the KMS health gate and the database pools) live once in the new subpath @cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps. requireEnv is still exported from run-prod-app under the same name."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "runProdApp releases connections when the boot fails",
+    "detail": "A failing boot closes the database pools, the Redis client and the KMS adapter it already opened. The KMS health wait logs \"KMS not reachable\" instead of \"database not reachable\"."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Boot validation and shutdown hardening",
+    "detail": "The KMS and app database waits share one deadline so a boot never outlasts the liveness window. An app-supplied master key provider is checked at boot, also in a dry run. Additional fileStorage providers get the same production and S3 checks as the default one, and their env keys are validated. appOverrides without auth or delivery feature abort instead of being dropped. A fatal shutdown keeps its listeners installed, and inline script hashing handles a \">\" inside quoted attributes."
+  },
+  {
+    "version": "0.388.0",
+    "type": "breaking",
+    "title": "billing boot option takes stripe and/or dodo",
+    "detail": "billing.stripe is now optional and billing.dodo is new (priceToTier, oneOffPriceIds). At least one is required. resolveBillingOption returns features (an array) instead of feature, and one webhook route serves every provider on stripe.webhookPath or SUBSCRIPTION_WEBHOOK_PATH. DODO_PAYMENTS_API_KEY and DODO_PAYMENTS_WEBHOOK_KEY are the env bridge.",
+    "migration": "Callers of resolveBillingOption use billing.features instead of billing.feature."
+  },
   {
     "version": "0.385.0",
     "type": "improvement",