@cosmicdrift/kumiko-server-runtime 0.387.0 → 0.388.0

package/dist/run-worker-app.d.ts

@@ -90,7 +90,7 @@ export type RunWorkerAppOptions = {
     readonly fileStorage?: FileStorageBootOption;
     /** Same as RunProdAppOptions["kmsMode"]; cannot be combined with `kms` / `blindIndexKey` / `allowPlaintextPii`. */
     readonly kmsMode?: KmsMode;
-    /** Same as RunProdAppOptions["billing"]: mounts subscription-stripe so the registry matches the API. The webhook route belongs to the API process. */
+    /** Same as RunProdAppOptions["billing"]: mounts the configured subscription providers so the registry matches the API. The webhook route belongs to the API process. */
     readonly billing?: BillingBootOption;
     /** Same as RunProdAppOptions["featureToggles"]: mounts feature-toggles and layers the operator switches over the tier resolver. */
     readonly featureToggles?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.387.0",
+  "version": "0.388.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,6 +50,10 @@
       "types": "./dist/boot/apply-boot-seeds.d.ts",
       "default": "./dist/boot/apply-boot-seeds.js"
     },
+    "./boot/shared-boot-steps": {
+      "types": "./dist/boot/shared-boot-steps.d.ts",
+      "default": "./dist/boot/shared-boot-steps.js"
+    },
     "./boot/boot-crypto": {
       "types": "./dist/boot/boot-crypto.d.ts",
       "default": "./dist/boot/boot-crypto.js"
@@ -88,18 +92,18 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.387.0",
-    "@cosmicdrift/kumiko-framework": "0.387.0",
-    "@cosmicdrift/kumiko-renderer": "0.387.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.387.0",
-    "@cosmicdrift/kumiko-types": "0.387.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.388.0",
+    "@cosmicdrift/kumiko-framework": "0.388.0",
+    "@cosmicdrift/kumiko-renderer": "0.388.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
+    "@cosmicdrift/kumiko-types": "0.388.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.387.0"
+    "@cosmicdrift/kumiko-testing": "0.388.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -137,6 +141,10 @@
         "types": "./dist/boot/apply-boot-seeds.d.ts",
         "default": "./dist/boot/apply-boot-seeds.js"
       },
+      "./boot/shared-boot-steps": {
+        "types": "./dist/boot/shared-boot-steps.d.ts",
+        "default": "./dist/boot/shared-boot-steps.js"
+      },
       "./boot/boot-crypto": {
         "types": "./dist/boot/boot-crypto.d.ts",
         "default": "./dist/boot/boot-crypto.js"

package/src/changes.json

@@ -1,4 +1,29 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "runProdApp split into boot phases, boot steps shared with dev and worker",
+    "detail": "runProdApp() keeps its signature and behavior. Config resolution, feature composition, dependency connection, request context, auth wiring, entrypoint, seeds and the returned handle now live in run-prod-app-*.ts files next to run-prod-app.ts. Steps that prod, dev and the worker ran as copies (env defaults, feature composition, boot validation, the auth-mfa switch-tenant gate, the tier and feature-toggle resolver, standard boot seeds, shared auth routes, the KMS health gate and the database pools) live once in the new subpath @cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps. requireEnv is still exported from run-prod-app under the same name."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "runProdApp releases connections when the boot fails",
+    "detail": "A failing boot closes the database pools, the Redis client and the KMS adapter it already opened. The KMS health wait logs \"KMS not reachable\" instead of \"database not reachable\"."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Boot validation and shutdown hardening",
+    "detail": "The KMS and app database waits share one deadline so a boot never outlasts the liveness window. An app-supplied master key provider is checked at boot, also in a dry run. Additional fileStorage providers get the same production and S3 checks as the default one, and their env keys are validated. appOverrides without auth or delivery feature abort instead of being dropped. A fatal shutdown keeps its listeners installed, and inline script hashing handles a \">\" inside quoted attributes."
+  },
+  {
+    "version": "0.388.0",
+    "type": "breaking",
+    "title": "billing boot option takes stripe and/or dodo",
+    "detail": "billing.stripe is now optional and billing.dodo is new (priceToTier, oneOffPriceIds). At least one is required. resolveBillingOption returns features (an array) instead of feature, and one webhook route serves every provider on stripe.webhookPath or SUBSCRIPTION_WEBHOOK_PATH. DODO_PAYMENTS_API_KEY and DODO_PAYMENTS_WEBHOOK_KEY are the env bridge.",
+    "migration": "Callers of resolveBillingOption use billing.features instead of billing.feature."
+  },
   {
     "version": "0.385.0",
     "type": "improvement",