create-kumiko-app 0.4.243 → 0.4.245

package/feature-manifest.json

@@ -1,6 +1,6 @@
 {
   "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled + signup)",
-  "featureCount": 68,
+  "featureCount": 69,
   "features": [
     {
       "name": "admin-shell",
@@ -31,7 +31,9 @@
       "name": "audit",
       "description": "Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection — the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range.",
       "toggleableDefault": null,
-      "requires": [],
+      "requires": [
+        "tenant"
+      ],
       "optionalRequires": [],
       "configReads": [],
       "exposesApis": [],
@@ -921,6 +923,38 @@
         "recommended": false
       }
     },
+    {
+      "name": "files-tenant-data",
+      "description": "GDPR coverage for the `files` feature's `fileRef` entity: tenant-destroy row purge (EXT_TENANT_DATA) and full storage-prefix binary wipe (EXT_STORAGE_PROVIDER), plus a manual backfill/GC job that sweeps derivatives orphaned by a forget/tenant-destroy that ran before #2461 wired binary cleanup into those flows. Requires `tenant-lifecycle`, optionalRequires `files`.",
+      "toggleableDefault": null,
+      "requires": [
+        "tenant-lifecycle"
+      ],
+      "optionalRequires": [
+        "files"
+      ],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [
+        {
+          "extensionName": "tenantData",
+          "entityName": "fileRef"
+        },
+        {
+          "extensionName": "storageProvider",
+          "entityName": "fileRef"
+        }
+      ],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": [],
+      "uiHints": {
+        "displayLabel": "Files · Tenant-Destroy & Derivative GC",
+        "category": "compliance",
+        "recommended": false
+      }
+    },
     {
       "name": "folders",
       "description": "Generic, host-agnostic hierarchical folders for any entity. Owns two event-sourced entities — the per-tenant `folder` tree (`read_folders`, self-referential via parentId) and SINGLE-membership `folder-assignment` rows keyed by (entityType, entityId) (`read_folder_assignments`) — so filing an entity adds NO column to the host and needs no relational pivot or JOIN. The folder catalog uses the generic entity handlers (create, update [= rename, optimistic-locked], delete, list, detail); set-folder puts/moves an entity into a folder (one folder per entity) and clear-folder unfiles it (both idempotent). Read which folder an entity is in, or which entities a folder holds, by listing `folder-assignment` filtered on `entityId` or `folderId`. Every path uses one access rule — adopt the host's model with createFoldersFeature({ access: { openToAll: true } }) or pin roles. Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
@@ -2110,7 +2144,7 @@
     },
     {
       "name": "tags",
-      "description": "Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Provides write-handlers `create-tag`, `update-tag` (optimistic-locked rename/recolor/re-scope), `delete-tag` (cascades over assignments), `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: true } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
+      "description": "Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Catalog screens are declarative (`entityList` + `entityEdit`) and use convention QNs `tag:{create,update,delete}`; TagManager/TagPicker keep `create-tag`/`update-tag`/`delete-tag`. Also: `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: true } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
       "toggleableDefault": null,
       "requires": [],
       "optionalRequires": [],
@@ -2468,7 +2502,8 @@
           "computed": false,
           "options": [
             "de",
-            "en"
+            "en",
+            "es"
           ],
           "bounds": null,
           "pattern": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kumiko-app",
-  "version": "0.4.243",
+  "version": "0.4.245",
   "description": "`bun create kumiko-app <name>` — scaffold a new Kumiko app with an interactive feature picker.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -27,9 +27,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.220.1",
-    "@cosmicdrift/kumiko-framework": "0.220.1",
-    "@cosmicdrift/kumiko-server-runtime": "0.220.1",
+    "@cosmicdrift/kumiko-dev-server": "0.222.0",
+    "@cosmicdrift/kumiko-framework": "0.222.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.222.0",
     "@inquirer/core": "^10.0.0",
     "@inquirer/prompts": "^7.4.0"
   },

package/src/__tests__/manifest-drift.test.ts

@@ -0,0 +1,32 @@
+// Vendored manifest.json must match the source-of-truth in
+// samples/apps/use-all-bundled/feature-manifest.json. The picker reads
+// the vendored copy at runtime; a stale copy lets the picker show old
+// features or miss new ones. Refresh by running `bun run gen:manifest`
+// inside samples/apps/use-all-bundled (writes both copies at once).
+
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const VENDOR = resolve(HERE, "..", "..", "feature-manifest.json");
+const SOURCE = resolve(
+  HERE,
+  "..",
+  "..",
+  "..",
+  "..",
+  "samples",
+  "apps",
+  "use-all-bundled",
+  "feature-manifest.json",
+);
+
+describe("vendored manifest", () => {
+  test("byte-identical to samples/apps/use-all-bundled/feature-manifest.json", () => {
+    const vendor = readFileSync(VENDOR, "utf-8");
+    const source = readFileSync(SOURCE, "utf-8");
+    expect(vendor).toBe(source);
+  });
+});

package/src/__tests__/yes-scaffold-boot.test.ts

@@ -6,9 +6,11 @@
 // feature satisfies — cli.test.ts's file-existence checks can't catch that,
 // only actually booting the resolved set through validateBoot can.
 
-import { describe, expect, test } from "bun:test";
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
 import { frameworkCoreEnvSchema } from "@cosmicdrift/kumiko-dev-server";
-import { resolveKmsWiring } from "@cosmicdrift/kumiko-framework/crypto";
+import { requireKmsWiring, resolveKmsWiring } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createRegistry,
   type FeatureDefinition,
@@ -21,6 +23,7 @@ import { runProdApp } from "@cosmicdrift/kumiko-server-runtime";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { resolveDeps } from "../dep-resolver";
 import { FEATURE_CONSTRUCTORS } from "../feature-constructors";
+import { runCreate } from "../index";
 import { loadManifest } from "../manifest";
 import { buildChoices } from "../picker";
 
@@ -125,7 +128,19 @@ describe("--yes resolved set through runProdApp's PII boot gate (issue-2330 regr
     );
   });
 
-  test("with resolveKmsWiring's fallback (what the generated bin/main.ts now does), boot succeeds", async () => {
+  test("requireKmsWiring aborts when NODE_ENV=production and the trio is empty", () => {
+    expect(() =>
+      requireKmsWiring(
+        {},
+        {
+          logPrefix: "[test]",
+          plaintextReason: "should-not-fallback",
+        },
+      ),
+    ).toThrow(/PLATFORM_KEK|SUBJECT_KEYS|BLIND_INDEX|trio|required/i);
+  });
+
+  test("with resolveKmsWiring's fallback (generated bin/main.ts non-prod path), boot succeeds", async () => {
     // Empty object, not process.env: a dev machine with the real trio set
     // would otherwise flip this into the ActiveKmsWiring branch and the test
     // would stop exercising the plaintext fallback it's meant to pin.
@@ -157,3 +172,69 @@ describe("--yes resolved set through runProdApp's PII boot gate (issue-2330 regr
     expect(handle).toBeDefined();
   });
 });
+
+// The suite above rebuilds the wiring in-process and pins that the pieces
+// are individually correct — it never imports the file scaffoldApp actually
+// writes, so a typo in bin/main.ts's import specifier or a `...kmsWiring`
+// spread landing in the wrong object literal would stay green. This drives
+// the real generated bin/main.ts as a subprocess instead. Fixtures live
+// under __tests__/.tmp-fixtures/ (gitignored, same trick as
+// dev-server/src/codegen/__tests__/watch.test.ts) so Bun's node_modules
+// walk-up from bin/main.ts still finds the repo's hoisted @cosmicdrift/*
+// symlinks — a system tmpdir sits outside the workspace and can't resolve
+// them (see walkthrough.integration.test.ts's comment on the same issue).
+describe("generated bin/main.ts actually boots (issue-2330 regression, real subprocess)", () => {
+  const FIXTURE_ROOT = join(import.meta.dir, ".tmp-fixtures");
+  const createdDirs: string[] = [];
+
+  afterAll(() => {
+    for (const d of createdDirs) {
+      try {
+        rmSync(d, { recursive: true, force: true });
+      } catch {
+        // ignore — best-effort
+      }
+    }
+  });
+
+  test("KUMIKO_DRY_RUN_ENV=boot bun bin/main.ts exits 0 against the file scaffoldApp wrote", async () => {
+    mkdirSync(FIXTURE_ROOT, { recursive: true });
+    const cwd = mkdtempSync(join(FIXTURE_ROOT, "boot-"));
+    createdDirs.push(cwd);
+
+    const exitCode = await runCreate({ name: "boot-fixture", yes: true, cwd, log: () => {} });
+    expect(exitCode).toBe(0);
+
+    const appDir = join(cwd, "boot-fixture");
+    const proc = Bun.spawn({
+      cmd: ["bun", "bin/main.ts"],
+      cwd: appDir,
+      env: {
+        ...process.env,
+        KUMIKO_DRY_RUN_ENV: "boot",
+        JWT_SECRET: "a".repeat(32),
+        KUMIKO_SECRETS_MASTER_KEY_V1: Buffer.alloc(32, 7).toString("base64"),
+        DATABASE_URL: "postgres://dummy:dummy@127.0.0.1:1/dummy",
+        REDIS_URL: "redis://127.0.0.1:1",
+        // Pinned empty, not inherited from process.env: a dev machine with
+        // the real trio set would otherwise flip resolveKmsWiring into the
+        // ActiveKmsWiring branch (and its KMS health check) instead of the
+        // plaintext fallback this test exercises.
+        PLATFORM_KEK: "",
+        SUBJECT_KEYS_DATABASE_URL: "",
+        KUMIKO_BLIND_INDEX_KEY: "",
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, code] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ]);
+
+    expect(code, `stdout:\n${stdout}\nstderr:\n${stderr}`).toBe(0);
+    expect(`${stdout}${stderr}`).not.toContain("BOOT ABORTED");
+    expect(stdout).toContain("boot validation OK");
+  }, 30_000);
+});