create-kumiko-app 0.4.149 → 0.4.151

package/feature-manifest.json

@@ -1,6 +1,6 @@
 {
-  "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled)",
-  "featureCount": 57,
+  "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled + signup)",
+  "featureCount": 59,
   "features": [
     {
       "name": "admin-shell",
@@ -52,7 +52,8 @@
       "toggleableDefault": null,
       "requires": [
         "user",
-        "tenant"
+        "tenant",
+        "delivery"
       ],
       "optionalRequires": [],
       "configReads": [],
@@ -64,7 +65,9 @@
       "writeHandlers": [
         "auth-email-password:write:change-password",
         "auth-email-password:write:login",
-        "auth-email-password:write:logout"
+        "auth-email-password:write:logout",
+        "auth-email-password:write:signup-confirm",
+        "auth-email-password:write:signup-request"
       ],
       "uiHints": {
         "displayLabel": "Auth · Email + Password",
@@ -202,6 +205,20 @@
       "secrets": [],
       "writeHandlers": []
     },
+    {
+      "name": "auth-self-registration",
+      "description": "Runtime on/off switch for the auth-email-password self-signup flow. Handler-less: composing it registers \"auth-self-registration\" as a toggleable feature (default ON). auth-email-password's signup-request handler and its `signupRegistrationStatus` query both read `ctx.hasFeature(\"auth-self-registration\")` — the query stays reachable when the toggle is off (deliberately not gated itself) so the public signup page can hide its own link/form. Only meaningful when `signup` is configured on `createAuthEmailPasswordFeature` — compose alongside it, then flip via the feature-toggles admin screen.",
+      "toggleableDefault": true,
+      "requires": [],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": []
+    },
     {
       "name": "billing-foundation",
       "description": "Plugin host for subscription billing — manages the `read_subscriptions` projection table and exposes 5 domain events (subscription created/updated/canceled, invoice paid/failed) appended by the foundation's own `billing-foundation:write:process-event` write-handler after provider plugins verify and normalize each webhook. Also ships `billing-foundation:write:create-checkout-session` and `billing-foundation:write:create-portal-session` write-handlers, a `billing-foundation:query:subscription:list` query handler, and a `createSubscriptionWebhookHandler` factory for the `/api/subscription/webhook/:providerName` route. Low-level building block — use `subscription-stripe` or `subscription-mollie` unless you are writing a new payment provider.",
@@ -493,7 +510,10 @@
           "encrypted": false,
           "computed": false,
           "options": null,
-          "bounds": null,
+          "bounds": {
+            "min": 1,
+            "max": 500
+          },
           "pattern": null,
           "writeRoles": [
             "TenantAdmin",
@@ -515,7 +535,9 @@
           "computed": false,
           "options": null,
           "bounds": null,
-          "pattern": null,
+          "pattern": {
+            "regex": "^[a-z]{3}(\\+[a-z]{3})*$"
+          },
           "writeRoles": [
             "TenantAdmin",
             "SystemAdmin"
@@ -1437,7 +1459,7 @@
       "uiHints": {
         "displayLabel": "Personal Access Tokens",
         "category": "identity",
-        "recommended": true
+        "recommended": false
       }
     },
     {
@@ -2136,6 +2158,81 @@
         "recommended": false
       }
     },
+    {
+      "name": "tenant-settings",
+      "description": "Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.",
+      "toggleableDefault": null,
+      "requires": [
+        "config"
+      ],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [],
+      "configKeys": [
+        {
+          "key": "currency",
+          "qualifiedName": "tenant-settings:config:currency",
+          "type": "select",
+          "scope": "tenant",
+          "default": "EUR",
+          "encrypted": false,
+          "computed": false,
+          "options": [
+            "EUR",
+            "USD",
+            "GBP",
+            "CHF",
+            "JPY",
+            "SEK",
+            "NOK",
+            "DKK",
+            "PLN",
+            "CZK",
+            "CAD",
+            "AUD",
+            "NZD",
+            "CNY",
+            "INR"
+          ],
+          "bounds": null,
+          "pattern": null,
+          "writeRoles": [
+            "TenantAdmin",
+            "Admin",
+            "SystemAdmin"
+          ],
+          "readRoles": [
+            "all"
+          ]
+        },
+        {
+          "key": "locale",
+          "qualifiedName": "tenant-settings:config:locale",
+          "type": "text",
+          "scope": "tenant",
+          "default": "en",
+          "encrypted": false,
+          "computed": false,
+          "options": null,
+          "bounds": null,
+          "pattern": {
+            "regex": "^[a-z]{2}(-[A-Z]{2})?$"
+          },
+          "writeRoles": [
+            "TenantAdmin",
+            "Admin",
+            "SystemAdmin"
+          ],
+          "readRoles": [
+            "all"
+          ]
+        }
+      ],
+      "secrets": [],
+      "writeHandlers": []
+    },
     {
       "name": "text-content",
       "description": "Generic Markdown text store keyed by `(tenantId, slug, lang)` — one row per combination in the `read_text_blocks` entity table. Provides `text-content:write:set` (TenantAdmin upsert) and `text-content:query:by-slug` (anonymous-capable read); use `SYSTEM_TENANT_ID` as the tenant for app-wide texts such as imprint, privacy policy, or FAQ. Other features (e.g. `legal-pages`) read blocks without a direct code import via the `createTextContentApi` / `requireTextContent` extraContext pattern.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kumiko-app",
-  "version": "0.4.149",
+  "version": "0.4.151",
   "description": "`bun create kumiko-app <name>` — scaffold a new Kumiko app with an interactive feature picker.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -30,9 +30,9 @@
     "vendor:manifest": "bun run scripts/vendor-manifest.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.165.0",
-    "@cosmicdrift/kumiko-framework": "0.165.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.165.0",
+    "@cosmicdrift/kumiko-dev-server": "2.0.0",
+    "@cosmicdrift/kumiko-framework": "2.0.0",
+    "@cosmicdrift/kumiko-server-runtime": "2.0.0",
     "@inquirer/core": "^10.0.0",
     "@inquirer/prompts": "^7.4.0"
   },

package/src/__tests__/cli.test.ts

@@ -30,7 +30,10 @@ describe("create-kumiko-app CLI", () => {
     expect(code).toBe(0);
     // Onboarding regression gate: the scaffold step is the first thing a new
     // user waits on. Generous ceiling so slow CI runners pass — what we catch
-    // is an order-of-magnitude blowup, not seconds.
+    // is an order-of-magnitude blowup, not seconds. Needs an explicit test
+    // timeout above the 30s ceiling: bun's default (5s) would fail a slow-
+    // but-fine CI run on its own timeout before this assertion ever gets to
+    // fire, making the "ceiling" the opposite of what the comment claims.
     expect(scaffoldMs, `scaffold took ${Math.round(scaffoldMs)}ms (ceiling 30s)`).toBeLessThan(
       30_000,
     );
@@ -67,7 +70,7 @@ describe("create-kumiko-app CLI", () => {
 
     // Setup-impact preview lands before the scaffold actually runs.
     expect(out).toMatch(/→ Scaffolding \d+ features? into \.\/demo-app\//);
-  });
+  }, 35_000);
 
   test("--print-manifest emits JSON, no name needed", async () => {
     const code = await runCreate({

package/src/__tests__/feature-constructors.test.ts

@@ -0,0 +1,54 @@
+// Guards against #1425/1: callExpression (rendered into generated
+// run-config.ts) and callArgs (used at runtime by instantiateScaffoldFeatures)
+// encode the same call twice by hand. If someone edits one without the
+// other, the boot test validates a different feature config than what
+// actually gets scaffolded. This derives the expected callExpression from
+// exportName + callArgs for every entry and diffs it against the literal.
+
+import { describe, expect, test } from "bun:test";
+import { FEATURE_CONSTRUCTORS } from "../feature-constructors";
+
+// Renders a value as hand-written TS source (unquoted object keys, quoted
+// string values) instead of JSON — JSON.stringify(1) and JSON.stringify("1")
+// both survive a whitespace+quote-strip compare as "1", which would hide a
+// string/number divergence between callExpression and callArgs. Rendering
+// like this and normalizing whitespace only keeps that divergence visible.
+function renderTsLiteral(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(renderTsLiteral).join(", ")}]`;
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value as Record<string, unknown>).map(
+      ([key, val]) => `${key}: ${renderTsLiteral(val)}`,
+    );
+    return `{ ${entries.join(", ")} }`;
+  }
+  return JSON.stringify(value);
+}
+
+function expectedCallExpression(exportName: string, callArgs: readonly unknown[]): string {
+  const args = callArgs.map(renderTsLiteral).join(", ");
+  return `${exportName}(${args})`;
+}
+
+describe("FEATURE_CONSTRUCTORS callExpression/callArgs consistency", () => {
+  for (const [name, entry] of Object.entries(FEATURE_CONSTRUCTORS)) {
+    test(`${name}: callExpression matches exportName + callArgs`, () => {
+      if (entry.callArgs !== undefined) {
+        // callExpression is hand-formatted TS source; compare with
+        // whitespace stripped only — NOT quotes, so a string arg ("1") vs.
+        // a number arg (1) still diverges after normalize.
+        const normalize = (s: string) => s.replace(/\s+/g, "");
+        expect(normalize(entry.callExpression)).toBe(
+          normalize(expectedCallExpression(entry.exportName, entry.callArgs)),
+        );
+        return;
+      }
+      // No callArgs: either `exportName()` (zero-arg factory) or bare
+      // `exportName` (object export) — both are legal, but the export name
+      // itself must be the prefix either way.
+      expect(
+        entry.callExpression === entry.exportName ||
+          entry.callExpression === `${entry.exportName}()`,
+      ).toBe(true);
+    });
+  }
+});

package/src/__tests__/yes-scaffold-boot.test.ts

@@ -52,11 +52,9 @@ describe("--yes resolved set boots (issue-1174 regression)", () => {
   });
 
   test("the resolved --yes feature set boots without the GDPR PII-hook-coverage error", async () => {
-    // sessions (auto-included, session-list/detail screens are recommended)
-    // requires auth-foundation, which the dep-resolver already pulls in
-    // transitively — personal-access-tokens (recommended, satisfies the
-    // tokenVerifier boot invariant) is resolved into the set too.
-    expect(resolved.featureNames).toContain("personal-access-tokens");
+    // sessions (auto-included) pulls auth-foundation; #1570 allows zero
+    // tokenVerifier when sessionStore is mounted — PAT stays opt-in (#1514).
+    expect(resolved.featureNames).not.toContain("personal-access-tokens");
     const instances = await instantiateResolved(resolved.featureNames);
     const composed = composeFeatures(instances, { includeBundled: true });
     expect(() => validateBoot(composed)).not.toThrow();

package/src/feature-constructors.ts

@@ -54,6 +54,14 @@ export const FEATURE_CONSTRUCTORS: Readonly<Record<string, ScaffoldFeatureEntry>
     exportName: "createAuthEmailPasswordFeature",
     callExpression: "createAuthEmailPasswordFeature()",
   },
+  // Only meaningful alongside auth.signup — composeFeatures auto-mounts it
+  // when signup is set; listed so scaffolds can pick it explicitly (#1521).
+  "auth-self-registration": {
+    name: "auth-self-registration",
+    importPath: "@cosmicdrift/kumiko-bundled-features/auth-email-password",
+    exportName: "createAuthSelfRegistrationToggleFeature",
+    callExpression: "createAuthSelfRegistrationToggleFeature()",
+  },
   "user-profile": {
     name: "user-profile",
     importPath: "@cosmicdrift/kumiko-bundled-features/user-profile",