create-kumiko-app 0.4.138 → 0.4.140

package/feature-manifest.json

@@ -1,6 +1,6 @@
 {
   "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled)",
-  "featureCount": 55,
+  "featureCount": 56,
   "features": [
     {
       "name": "admin-shell",
@@ -48,7 +48,7 @@
     },
     {
       "name": "auth-email-password",
-      "description": "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, and tenant invite — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`) to `createAuthEmailPasswordFeature(opts)`. All four magic-link flows (reset, verification, signup activation, tenant invite) dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify) or opaque-random in Redis (signup/invite). Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
+      "description": "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, tenant invite, and account-unlock — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`, `accountUnlock`) to `createAuthEmailPasswordFeature(opts)`. All five magic-link flows dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify/unlock) or opaque-random in Redis (signup/invite). `accountUnlock` is the self-service escape hatch for `accountLockout`'s monotonic failure-counter (#1266): confirming the mailed token clears the Redis lockout state without touching the user entity. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
       "toggleableDefault": null,
       "requires": [
         "user",
@@ -94,10 +94,35 @@
             "label": "Tenant-Invite-Flow",
             "type": "boolean",
             "default": false
+          },
+          {
+            "key": "accountUnlock",
+            "label": "Account-Unlock-Flow",
+            "type": "boolean",
+            "default": false
           }
         ]
       }
     },
+    {
+      "name": "auth-foundation",
+      "description": "Declares the `tokenVerifier` (Bearer-token auth) and `sessionStore` extension points. Provider-features register a static `shape` plus a `build()` for tokenVerifier — mount together with at least one auth-provider-* feature (e.g. personal-access-tokens) and call `resolveTokenVerifier(deps, rawToken)` to find the matching one; sessions self-registers as the single sessionStore provider.",
+      "toggleableDefault": null,
+      "requires": [],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": [],
+      "uiHints": {
+        "displayLabel": "Auth Provider Foundation",
+        "category": "identity",
+        "recommended": false
+      }
+    },
     {
       "name": "auth-mfa",
       "description": "TOTP-based two-factor authentication: enable/disable flow with QR-code setup, 8 single-use recovery codes, and (once wired into a login flow) a second login step after password verification. Secrets are envelope-encrypted at rest via the same MasterKeyProvider as `secrets`/`config`.",
@@ -1320,17 +1345,23 @@
     },
     {
       "name": "personal-access-tokens",
-      "description": "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — the resolver is wired via run-prod-app, not the dispatcher. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
+      "description": "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — registered as an auth-foundation tokenVerifier provider, resolved generically by the middleware. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
       "toggleableDefault": null,
       "requires": [
         "user",
-        "tenant"
+        "tenant",
+        "auth-foundation"
       ],
       "optionalRequires": [],
       "configReads": [],
       "exposesApis": [],
       "usesApis": [],
-      "extensionsUsed": [],
+      "extensionsUsed": [
+        {
+          "extensionName": "tokenVerifier",
+          "entityName": "pat"
+        }
+      ],
       "configKeys": [],
       "secrets": [],
       "writeHandlers": [
@@ -1597,10 +1628,11 @@
     },
     {
       "name": "sessions",
-      "description": "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
+      "description": "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
       "toggleableDefault": null,
       "requires": [
-        "user"
+        "user",
+        "auth-foundation"
       ],
       "optionalRequires": [],
       "configReads": [],
@@ -1608,7 +1640,12 @@
         "sessions.revokeAllForUser"
       ],
       "usesApis": [],
-      "extensionsUsed": [],
+      "extensionsUsed": [
+        {
+          "extensionName": "sessionStore",
+          "entityName": "default"
+        }
+      ],
       "configKeys": [],
       "secrets": [],
       "writeHandlers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kumiko-app",
-  "version": "0.4.138",
+  "version": "0.4.140",
   "description": "`bun create kumiko-app <name>` — scaffold a new Kumiko app with an interactive feature picker.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -30,9 +30,9 @@
     "vendor:manifest": "bun run scripts/vendor-manifest.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.158.2",
-    "@cosmicdrift/kumiko-framework": "0.158.2",
-    "@cosmicdrift/kumiko-server-runtime": "0.158.2",
+    "@cosmicdrift/kumiko-dev-server": "0.159.1",
+    "@cosmicdrift/kumiko-framework": "0.159.1",
+    "@cosmicdrift/kumiko-server-runtime": "0.159.1",
     "@inquirer/core": "^10.0.0",
     "@inquirer/prompts": "^7.4.0"
   },

package/src/__tests__/cli.test.ts

@@ -19,13 +19,21 @@ describe("create-kumiko-app CLI", () => {
   afterEach(() => rmSync(tmp, { recursive: true, force: true }));
 
   test("--yes scaffolds the recommended stack", async () => {
+    const startedAt = performance.now();
     const code = await runCreate({
       name: "demo-app",
       yes: true,
       cwd: tmp,
       log: (line) => logs.push(line),
     });
+    const scaffoldMs = performance.now() - startedAt;
     expect(code).toBe(0);
+    // Onboarding regression gate: the scaffold step is the first thing a new
+    // user waits on. Generous ceiling so slow CI runners pass — what we catch
+    // is an order-of-magnitude blowup, not seconds.
+    expect(scaffoldMs, `scaffold took ${Math.round(scaffoldMs)}ms (ceiling 30s)`).toBeLessThan(
+      30_000,
+    );
 
     const dest = join(tmp, "demo-app");
     expect(existsSync(dest)).toBe(true);

package/src/__tests__/yes-scaffold-boot.test.ts

@@ -7,6 +7,7 @@
 // only actually booting the resolved set through validateBoot can.
 
 import { describe, expect, test } from "bun:test";
+import { createPersonalAccessTokensFeature } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import {
   createRegistry,
   type FeatureDefinition,
@@ -53,6 +54,11 @@ describe("--yes resolved set boots (issue-1174 regression)", () => {
 
   test("the resolved --yes feature set boots without the GDPR PII-hook-coverage error", async () => {
     const instances = await instantiateResolved(resolved.featureNames);
+    // sessions (auto-included, session-list/detail screens are recommended)
+    // requires auth-foundation, which the dep-resolver already pulls in
+    // transitively — it just needs a tokenVerifier provider mounted too.
+    // PAT is what publicstatus/money-horse mount for this today.
+    instances.push(createPersonalAccessTokensFeature({ scopes: {} }));
     const composed = composeFeatures(instances, { includeBundled: true });
     expect(() => validateBoot(composed)).not.toThrow();
     expect(() => createRegistry(composed)).not.toThrow();

package/src/feature-constructors.ts

@@ -29,6 +29,12 @@ export const FEATURE_CONSTRUCTORS: Readonly<Record<string, ScaffoldFeatureEntry>
     exportName: "createUserFeature",
     callExpression: "createUserFeature()",
   },
+  "auth-foundation": {
+    name: "auth-foundation",
+    importPath: "@cosmicdrift/kumiko-bundled-features/auth-foundation",
+    exportName: "authFoundationFeature",
+    callExpression: "authFoundationFeature",
+  },
   sessions: {
     name: "sessions",
     importPath: "@cosmicdrift/kumiko-bundled-features/sessions",