create-kumiko-app 0.4.150 → 0.4.151

package/feature-manifest.json

@@ -1,6 +1,6 @@
 {
-  "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled)",
-  "featureCount": 57,
+  "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled + signup)",
+  "featureCount": 59,
   "features": [
     {
       "name": "admin-shell",
@@ -52,7 +52,8 @@
       "toggleableDefault": null,
       "requires": [
         "user",
-        "tenant"
+        "tenant",
+        "delivery"
       ],
       "optionalRequires": [],
       "configReads": [],
@@ -64,7 +65,9 @@
       "writeHandlers": [
         "auth-email-password:write:change-password",
         "auth-email-password:write:login",
-        "auth-email-password:write:logout"
+        "auth-email-password:write:logout",
+        "auth-email-password:write:signup-confirm",
+        "auth-email-password:write:signup-request"
       ],
       "uiHints": {
         "displayLabel": "Auth · Email + Password",
@@ -202,6 +205,20 @@
       "secrets": [],
       "writeHandlers": []
     },
+    {
+      "name": "auth-self-registration",
+      "description": "Runtime on/off switch for the auth-email-password self-signup flow. Handler-less: composing it registers \"auth-self-registration\" as a toggleable feature (default ON). auth-email-password's signup-request handler and its `signupRegistrationStatus` query both read `ctx.hasFeature(\"auth-self-registration\")` — the query stays reachable when the toggle is off (deliberately not gated itself) so the public signup page can hide its own link/form. Only meaningful when `signup` is configured on `createAuthEmailPasswordFeature` — compose alongside it, then flip via the feature-toggles admin screen.",
+      "toggleableDefault": true,
+      "requires": [],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": []
+    },
     {
       "name": "billing-foundation",
       "description": "Plugin host for subscription billing — manages the `read_subscriptions` projection table and exposes 5 domain events (subscription created/updated/canceled, invoice paid/failed) appended by the foundation's own `billing-foundation:write:process-event` write-handler after provider plugins verify and normalize each webhook. Also ships `billing-foundation:write:create-checkout-session` and `billing-foundation:write:create-portal-session` write-handlers, a `billing-foundation:query:subscription:list` query handler, and a `createSubscriptionWebhookHandler` factory for the `/api/subscription/webhook/:providerName` route. Low-level building block — use `subscription-stripe` or `subscription-mollie` unless you are writing a new payment provider.",
@@ -1442,7 +1459,7 @@
       "uiHints": {
         "displayLabel": "Personal Access Tokens",
         "category": "identity",
-        "recommended": true
+        "recommended": false
       }
     },
     {
@@ -2141,6 +2158,81 @@
         "recommended": false
       }
     },
+    {
+      "name": "tenant-settings",
+      "description": "Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.",
+      "toggleableDefault": null,
+      "requires": [
+        "config"
+      ],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [],
+      "configKeys": [
+        {
+          "key": "currency",
+          "qualifiedName": "tenant-settings:config:currency",
+          "type": "select",
+          "scope": "tenant",
+          "default": "EUR",
+          "encrypted": false,
+          "computed": false,
+          "options": [
+            "EUR",
+            "USD",
+            "GBP",
+            "CHF",
+            "JPY",
+            "SEK",
+            "NOK",
+            "DKK",
+            "PLN",
+            "CZK",
+            "CAD",
+            "AUD",
+            "NZD",
+            "CNY",
+            "INR"
+          ],
+          "bounds": null,
+          "pattern": null,
+          "writeRoles": [
+            "TenantAdmin",
+            "Admin",
+            "SystemAdmin"
+          ],
+          "readRoles": [
+            "all"
+          ]
+        },
+        {
+          "key": "locale",
+          "qualifiedName": "tenant-settings:config:locale",
+          "type": "text",
+          "scope": "tenant",
+          "default": "en",
+          "encrypted": false,
+          "computed": false,
+          "options": null,
+          "bounds": null,
+          "pattern": {
+            "regex": "^[a-z]{2}(-[A-Z]{2})?$"
+          },
+          "writeRoles": [
+            "TenantAdmin",
+            "Admin",
+            "SystemAdmin"
+          ],
+          "readRoles": [
+            "all"
+          ]
+        }
+      ],
+      "secrets": [],
+      "writeHandlers": []
+    },
     {
       "name": "text-content",
       "description": "Generic Markdown text store keyed by `(tenantId, slug, lang)` — one row per combination in the `read_text_blocks` entity table. Provides `text-content:write:set` (TenantAdmin upsert) and `text-content:query:by-slug` (anonymous-capable read); use `SYSTEM_TENANT_ID` as the tenant for app-wide texts such as imprint, privacy policy, or FAQ. Other features (e.g. `legal-pages`) read blocks without a direct code import via the `createTextContentApi` / `requireTextContent` extraContext pattern.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kumiko-app",
-  "version": "0.4.150",
+  "version": "0.4.151",
   "description": "`bun create kumiko-app <name>` — scaffold a new Kumiko app with an interactive feature picker.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -30,9 +30,9 @@
     "vendor:manifest": "bun run scripts/vendor-manifest.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "1.0.0",
-    "@cosmicdrift/kumiko-framework": "1.0.0",
-    "@cosmicdrift/kumiko-server-runtime": "1.0.0",
+    "@cosmicdrift/kumiko-dev-server": "2.0.0",
+    "@cosmicdrift/kumiko-framework": "2.0.0",
+    "@cosmicdrift/kumiko-server-runtime": "2.0.0",
     "@inquirer/core": "^10.0.0",
     "@inquirer/prompts": "^7.4.0"
   },

package/src/__tests__/feature-constructors.test.ts

@@ -8,18 +8,24 @@
 import { describe, expect, test } from "bun:test";
 import { FEATURE_CONSTRUCTORS } from "../feature-constructors";
 
-function expectedCallExpression(
-  exportName: string,
-  callArgs: readonly unknown[] | undefined,
-): string {
-  if (callArgs === undefined) {
-    // Ambiguous by callArgs alone: could be a zero-arg factory (`fn()`) or a
-    // bare object export (`fn`). Disambiguate the same way the runtime does
-    // (scaffold-app.ts's instantiateScaffoldFeatures): trust the "()" the
-    // literal itself carries, then only check the exportName prefix matches.
-    return exportName;
+// Renders a value as hand-written TS source (unquoted object keys, quoted
+// string values) instead of JSON — JSON.stringify(1) and JSON.stringify("1")
+// both survive a whitespace+quote-strip compare as "1", which would hide a
+// string/number divergence between callExpression and callArgs. Rendering
+// like this and normalizing whitespace only keeps that divergence visible.
+function renderTsLiteral(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(renderTsLiteral).join(", ")}]`;
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value as Record<string, unknown>).map(
+      ([key, val]) => `${key}: ${renderTsLiteral(val)}`,
+    );
+    return `{ ${entries.join(", ")} }`;
   }
-  const args = callArgs.map((a) => JSON.stringify(a)).join(", ");
+  return JSON.stringify(value);
+}
+
+function expectedCallExpression(exportName: string, callArgs: readonly unknown[]): string {
+  const args = callArgs.map(renderTsLiteral).join(", ");
   return `${exportName}(${args})`;
 }
 
@@ -27,10 +33,10 @@ describe("FEATURE_CONSTRUCTORS callExpression/callArgs consistency", () => {
   for (const [name, entry] of Object.entries(FEATURE_CONSTRUCTORS)) {
     test(`${name}: callExpression matches exportName + callArgs`, () => {
       if (entry.callArgs !== undefined) {
-        // callExpression is hand-formatted TS source (`{ scopes: {} }`), not
-        // JSON (`{"scopes":{}}`) — compare with whitespace stripped so both
-        // are checked against the same underlying arg values.
-        const normalize = (s: string) => s.replace(/[\s"]+/g, "");
+        // callExpression is hand-formatted TS source; compare with
+        // whitespace stripped only — NOT quotes, so a string arg ("1") vs.
+        // a number arg (1) still diverges after normalize.
+        const normalize = (s: string) => s.replace(/\s+/g, "");
         expect(normalize(entry.callExpression)).toBe(
           normalize(expectedCallExpression(entry.exportName, entry.callArgs)),
         );

package/src/__tests__/yes-scaffold-boot.test.ts

@@ -52,11 +52,9 @@ describe("--yes resolved set boots (issue-1174 regression)", () => {
   });
 
   test("the resolved --yes feature set boots without the GDPR PII-hook-coverage error", async () => {
-    // sessions (auto-included, session-list/detail screens are recommended)
-    // requires auth-foundation, which the dep-resolver already pulls in
-    // transitively — personal-access-tokens (recommended, satisfies the
-    // tokenVerifier boot invariant) is resolved into the set too.
-    expect(resolved.featureNames).toContain("personal-access-tokens");
+    // sessions (auto-included) pulls auth-foundation; #1570 allows zero
+    // tokenVerifier when sessionStore is mounted — PAT stays opt-in (#1514).
+    expect(resolved.featureNames).not.toContain("personal-access-tokens");
     const instances = await instantiateResolved(resolved.featureNames);
     const composed = composeFeatures(instances, { includeBundled: true });
     expect(() => validateBoot(composed)).not.toThrow();

package/src/feature-constructors.ts

@@ -54,6 +54,14 @@ export const FEATURE_CONSTRUCTORS: Readonly<Record<string, ScaffoldFeatureEntry>
     exportName: "createAuthEmailPasswordFeature",
     callExpression: "createAuthEmailPasswordFeature()",
   },
+  // Only meaningful alongside auth.signup — composeFeatures auto-mounts it
+  // when signup is set; listed so scaffolds can pick it explicitly (#1521).
+  "auth-self-registration": {
+    name: "auth-self-registration",
+    importPath: "@cosmicdrift/kumiko-bundled-features/auth-email-password",
+    exportName: "createAuthSelfRegistrationToggleFeature",
+    callExpression: "createAuthSelfRegistrationToggleFeature()",
+  },
   "user-profile": {
     name: "user-profile",
     importPath: "@cosmicdrift/kumiko-bundled-features/user-profile",