@codemation/cli 0.0.2 → 0.0.3

package/dist/{CliBin-DTTnbKz7.js → CliBin-900C8Din.js}

@@ -120,7 +120,7 @@ var DbMigrateCommand = class {
 //#region src/commands/DevCommand.ts
 var DevCommand = class {
 	require = createRequire(import.meta.url);
-	constructor(pathResolver, pluginDiscovery, tsRuntime, devLockFactory, devSourceWatcherFactory, cliLogger, session, databaseMigrationsApplyService, devBootstrapSummaryFetcher, devCliBannerRenderer, devConsumerPublishBootstrap, consumerEnvDotenvFilePredicate, devTrackedProcessTreeKiller) {
+	constructor(pathResolver, pluginDiscovery, tsRuntime, devLockFactory, devSourceWatcherFactory, cliLogger, session, databaseMigrationsApplyService, devBootstrapSummaryFetcher, devCliBannerRenderer, devConsumerPublishBootstrap, consumerEnvDotenvFilePredicate, devTrackedProcessTreeKiller, nextHostConsumerServerCommandFactory) {
 		this.pathResolver = pathResolver;
 		this.pluginDiscovery = pluginDiscovery;
 		this.tsRuntime = tsRuntime;
@@ -134,6 +134,7 @@ var DevCommand = class {
 		this.devConsumerPublishBootstrap = devConsumerPublishBootstrap;
 		this.consumerEnvDotenvFilePredicate = consumerEnvDotenvFilePredicate;
 		this.devTrackedProcessTreeKiller = devTrackedProcessTreeKiller;
+		this.nextHostConsumerServerCommandFactory = nextHostConsumerServerCommandFactory;
 	}
 	async execute(consumerRoot) {
 		const paths = await this.pathResolver.resolve(consumerRoot);
@@ -235,13 +236,10 @@ var DevCommand = class {
 		const uiProxyBase = `http://127.0.0.1:${uiPort}`;
 		const nextHostPackageJsonPath = this.require.resolve("@codemation/next-host/package.json");
 		const nextHostRoot = path.dirname(nextHostPackageJsonPath);
+		const nextHostCommand = await this.nextHostConsumerServerCommandFactory.create({ nextHostRoot });
 		const consumerOutputManifestPath = path.resolve(prepared.paths.consumerRoot, ".codemation", "output", "current.json");
-		state.currentUiNext = spawn("pnpm", [
-			"exec",
-			"next",
-			"start"
-		], {
-			cwd: nextHostRoot,
+		state.currentUiNext = spawn(nextHostCommand.command, nextHostCommand.args, {
+			cwd: nextHostCommand.cwd,
 			...this.devDetachedChildSpawnOptions(),
 			env: {
 				...process$1.env,
@@ -251,6 +249,8 @@ var DevCommand = class {
 				CODEMATION_CONSUMER_ROOT: prepared.paths.consumerRoot,
 				CODEMATION_CONSUMER_OUTPUT_MANIFEST_PATH: consumerOutputManifestPath,
 				CODEMATION_SKIP_UI_AUTH: prepared.authSettings.skipUiAuth ? "true" : "false",
+				AUTH_SECRET: prepared.authSettings.authSecret,
+				NEXTAUTH_SECRET: prepared.authSettings.authSecret,
 				NEXT_PUBLIC_CODEMATION_SKIP_UI_AUTH: prepared.authSettings.skipUiAuth ? "true" : "false",
 				CODEMATION_WS_PORT: String(websocketPort),
 				NEXT_PUBLIC_CODEMATION_WS_PORT: String(websocketPort),
@@ -416,7 +416,7 @@ var DevCommand = class {
 	}
 	logConsumerDevHintWhenNeeded(devMode, gatewayPort) {
 		if (devMode !== "consumer") return;
-		this.cliLogger.info(`codemation dev (consumer): open http://127.0.0.1:${gatewayPort} — requires a built @codemation/next-host (next build). For Next HMR use CODEMATION_DEV_MODE=framework.`);
+		this.cliLogger.info(`codemation dev (consumer): open http://127.0.0.1:${gatewayPort} — uses the packaged @codemation/next-host UI. For framework UI HMR, set CODEMATION_DEV_MODE=framework.`);
 	}
 };
 
@@ -424,7 +424,7 @@ var DevCommand = class {
 //#region src/commands/ServeWebCommand.ts
 var ServeWebCommand = class {
 	require = createRequire(import.meta.url);
-	constructor(pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, envLoader, listenPortResolver) {
+	constructor(pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, envLoader, listenPortResolver, nextHostConsumerServerCommandFactory) {
 		this.pathResolver = pathResolver;
 		this.pluginDiscovery = pluginDiscovery;
 		this.artifactsPublisher = artifactsPublisher;
@@ -433,6 +433,7 @@ var ServeWebCommand = class {
 		this.outputBuilderLoader = outputBuilderLoader;
 		this.envLoader = envLoader;
 		this.listenPortResolver = listenPortResolver;
+		this.nextHostConsumerServerCommandFactory = nextHostConsumerServerCommandFactory;
 	}
 	async execute(consumerRoot, buildOptions) {
 		const paths = await this.pathResolver.resolve(consumerRoot);
@@ -441,6 +442,7 @@ var ServeWebCommand = class {
 		const discoveredPlugins = await this.pluginDiscovery.discover(paths.consumerRoot);
 		const manifest = await this.artifactsPublisher.publish(snapshot, discoveredPlugins);
 		const nextHostRoot = path.dirname(this.require.resolve("@codemation/next-host/package.json"));
+		const nextHostCommand = await this.nextHostConsumerServerCommandFactory.create({ nextHostRoot });
 		const consumerEnv = this.envLoader.load(paths.consumerRoot);
 		const nextPort = this.listenPortResolver.resolvePrimaryApplicationPort(process$1.env.PORT);
 		const websocketPort = this.listenPortResolver.resolveWebsocketPortRelativeToHttp({
@@ -448,12 +450,8 @@ var ServeWebCommand = class {
 			publicWebsocketPort: process$1.env.NEXT_PUBLIC_CODEMATION_WS_PORT,
 			websocketPort: process$1.env.CODEMATION_WS_PORT
 		});
-		const child = spawn("pnpm", [
-			"exec",
-			"next",
-			"start"
-		], {
-			cwd: nextHostRoot,
+		const child = spawn(nextHostCommand.command, nextHostCommand.args, {
+			cwd: nextHostCommand.cwd,
 			stdio: "inherit",
 			env: {
 				...process$1.env,
@@ -1504,7 +1502,8 @@ var DevelopmentGatewayNotifier = class {
 
 //#endregion
 //#region src/dev/DevAuthSettingsLoader.ts
-var DevAuthSettingsLoader = class {
+var DevAuthSettingsLoader = class DevAuthSettingsLoader {
+	static defaultDevelopmentAuthSecret = "codemation-dev-auth-secret-not-for-production";
 	constructor(configLoader) {
 		this.configLoader = configLoader;
 	}
@@ -1516,9 +1515,15 @@ var DevAuthSettingsLoader = class {
 		const resolution = await this.configLoader.load({ consumerRoot });
 		return {
 			authConfigJson: JSON.stringify(resolution.config.auth ?? null),
+			authSecret: this.resolveDevelopmentAuthSecret(process.env),
 			skipUiAuth: resolution.config.auth?.allowUnauthenticatedInDevelopment === true
 		};
 	}
+	resolveDevelopmentAuthSecret(env) {
+		const configuredSecret = env.AUTH_SECRET ?? env.NEXTAUTH_SECRET;
+		if (configuredSecret && configuredSecret.trim().length > 0) return configuredSecret;
+		return DevAuthSettingsLoader.defaultDevelopmentAuthSecret;
+	}
 };
 
 //#endregion
@@ -2022,11 +2027,11 @@ var CliProgram = class {
 		program.command("build").description("Build consumer workflows/plugins output and write the manifest.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--no-source-maps", "Disable .js.map files for emitted workflow modules (recommended for locked-down production bundles).").option("--target <es2020|es2022>", "ECMAScript language version for emitted workflow JavaScript (default: es2022).", "es2022").action(async (opts) => {
 			await this.buildCommand.execute(resolveConsumerRoot(opts.consumerRoot), this.buildOptionsParser.parse(opts));
 		});
-		program.command("dev", { isDefault: true }).description("Start the dev gateway and runtime child. Use CODEMATION_DEV_MODE=framework with Next dev for framework UI HMR; default consumer mode serves API/WebSocket from the gateway only.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").action(async (opts) => {
+		program.command("dev", { isDefault: true }).description("Start the dev gateway and runtime child. Default consumer mode uses the packaged Codemation UI; use CODEMATION_DEV_MODE=framework for Next dev HMR when working on the host itself.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").action(async (opts) => {
 			await this.devCommand.execute(resolveConsumerRoot(opts.consumerRoot));
 		});
 		const serve = program.command("serve").description("Run production web or worker processes (no dev watchers).");
-		serve.command("web").description("Start the built Next.js Codemation host (next start).").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--no-source-maps", "Disable .js.map files for emitted workflow modules when this command runs the consumer build step.").option("--target <es2020|es2022>", "ECMAScript language version for emitted workflow JavaScript when building consumer output (default: es2022).", "es2022").action(async (opts) => {
+		serve.command("web").description("Start the packaged Codemation web host.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--no-source-maps", "Disable .js.map files for emitted workflow modules when this command runs the consumer build step.").option("--target <es2020|es2022>", "ECMAScript language version for emitted workflow JavaScript when building consumer output (default: es2022).", "es2022").action(async (opts) => {
 			await this.serveWebCommand.execute(resolveConsumerRoot(opts.consumerRoot), this.buildOptionsParser.parse(opts));
 		});
 		serve.command("worker").description("Start the Codemation worker process.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--config <path>", "Override path to codemation.config.ts / .js").action(async (opts) => {
@@ -2087,6 +2092,36 @@ var CliPathResolver = class {
 	}
 };
 
+//#endregion
+//#region src/runtime/NextHostConsumerServerCommandFactory.ts
+var NextHostConsumerServerCommandFactory = class {
+	async create(args) {
+		const standaloneServerPath = path.resolve(args.nextHostRoot, ".next", "standalone", "packages", "next-host", "server.js");
+		if (await this.exists(standaloneServerPath)) return {
+			command: process$1.execPath,
+			args: [standaloneServerPath],
+			cwd: path.dirname(standaloneServerPath)
+		};
+		return {
+			command: "pnpm",
+			args: [
+				"exec",
+				"next",
+				"start"
+			],
+			cwd: args.nextHostRoot
+		};
+	}
+	async exists(filePath) {
+		try {
+			await access(filePath);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+
 //#endregion
 //#region src/runtime/TypeScriptRuntimeConfigurator.ts
 var TypeScriptRuntimeConfigurator = class {
@@ -2276,6 +2311,7 @@ var CliProgramFactory = class {
 		const tsRuntime = new TypeScriptRuntimeConfigurator();
 		const outputBuilderLoader = new ConsumerOutputBuilderLoader();
 		const sourceMapNodeOptions = new SourceMapNodeOptions();
+		const nextHostConsumerServerCommandFactory = new NextHostConsumerServerCommandFactory();
 		const tsconfigPreparation = new ConsumerCliTsconfigPreparation();
 		const databasePersistenceResolver = new DatabasePersistenceResolver();
 		const userAdminBootstrap = new UserAdminCliBootstrap(new CodemationConsumerConfigLoader(), pathResolver, new UserAdminConsumerDotenvLoader(), tsconfigPreparation, databasePersistenceResolver);
@@ -2284,7 +2320,7 @@ var CliProgramFactory = class {
 		const databaseMigrationsApplyService = new DatabaseMigrationsApplyService(cliLogger, new UserAdminConsumerDotenvLoader(), tsconfigPreparation, new CodemationConsumerConfigLoader(), new ConsumerDatabaseConnectionResolver(), new CliDatabaseUrlDescriptor(), hostPackageRoot, new PrismaMigrationDeployer());
 		const buildOptionsParser = new ConsumerBuildOptionsParser();
 		const devConsumerPublishBootstrap = new DevConsumerPublishBootstrap(cliLogger, pluginDiscovery, artifactsPublisher, outputBuilderLoader, buildOptionsParser);
-		return new CliProgram(buildOptionsParser, new BuildCommand(cliLogger, pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, outputBuilderLoader), new DevCommand(pathResolver, pluginDiscovery, tsRuntime, new DevLockFactory(), new DevSourceWatcherFactory(), cliLogger, new DevSessionServicesBuilder(loggerFactory).build(), databaseMigrationsApplyService, new DevBootstrapSummaryFetcher(), new DevCliBannerRenderer(), devConsumerPublishBootstrap, new ConsumerEnvDotenvFilePredicate(), new DevTrackedProcessTreeKiller()), new ServeWebCommand(pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, new ConsumerEnvLoader(), new ListenPortResolver()), new ServeWorkerCommand(sourceMapNodeOptions), new DbMigrateCommand(databaseMigrationsApplyService), new UserCreateCommand(new LocalUserCreator(userAdminBootstrap), userAdminCliOptionsParser), new UserListCommand(cliLogger, userAdminBootstrap, new CliDatabaseUrlDescriptor(), userAdminCliOptionsParser));
+		return new CliProgram(buildOptionsParser, new BuildCommand(cliLogger, pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, outputBuilderLoader), new DevCommand(pathResolver, pluginDiscovery, tsRuntime, new DevLockFactory(), new DevSourceWatcherFactory(), cliLogger, new DevSessionServicesBuilder(loggerFactory).build(), databaseMigrationsApplyService, new DevBootstrapSummaryFetcher(), new DevCliBannerRenderer(), devConsumerPublishBootstrap, new ConsumerEnvDotenvFilePredicate(), new DevTrackedProcessTreeKiller(), nextHostConsumerServerCommandFactory), new ServeWebCommand(pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, new ConsumerEnvLoader(), new ListenPortResolver(), nextHostConsumerServerCommandFactory), new ServeWorkerCommand(sourceMapNodeOptions), new DbMigrateCommand(databaseMigrationsApplyService), new UserCreateCommand(new LocalUserCreator(userAdminBootstrap), userAdminCliOptionsParser), new UserListCommand(cliLogger, userAdminBootstrap, new CliDatabaseUrlDescriptor(), userAdminCliOptionsParser));
 	}
 };
 

package/dist/bin.js

@@ -1,4 +1,4 @@
-import { t as CliBin } from "./CliBin-DTTnbKz7.js";
+import { t as CliBin } from "./CliBin-900C8Din.js";
 import process from "node:process";
 import "reflect-metadata";
 

package/dist/index.d.ts

@@ -23098,13 +23098,16 @@ declare class SourceMapNodeOptions {
 //#region src/dev/DevAuthSettingsLoader.d.ts
 type DevResolvedAuthSettings = Readonly<{
   authConfigJson: string;
+  authSecret: string;
   skipUiAuth: boolean;
 }>;
 declare class DevAuthSettingsLoader {
   private readonly configLoader;
+  static readonly defaultDevelopmentAuthSecret = "codemation-dev-auth-secret-not-for-production";
   constructor(configLoader: CodemationConsumerConfigLoader);
   resolveDevelopmentServerToken(rawToken: string | undefined): string;
   loadForConsumer(consumerRoot: string): Promise<DevResolvedAuthSettings>;
+  resolveDevelopmentAuthSecret(env: NodeJS.ProcessEnv): string;
 }
 //#endregion
 //#region src/dev/DevHttpProbe.d.ts
@@ -23300,6 +23303,19 @@ declare class DevSourceWatcherFactory {
   create(): DevSourceWatcher;
 }
 //#endregion
+//#region src/runtime/NextHostConsumerServerCommandFactory.d.ts
+type NextHostConsumerServerCommand = Readonly<{
+  args: ReadonlyArray<string>;
+  command: string;
+  cwd: string;
+}>;
+declare class NextHostConsumerServerCommandFactory {
+  create(args: Readonly<{
+    nextHostRoot: string;
+  }>): Promise<NextHostConsumerServerCommand>;
+  private exists;
+}
+//#endregion
 //#region src/commands/DevCommand.d.ts
 declare class DevCommand {
   private readonly pathResolver;
@@ -23315,8 +23331,9 @@ declare class DevCommand {
   private readonly devConsumerPublishBootstrap;
   private readonly consumerEnvDotenvFilePredicate;
   private readonly devTrackedProcessTreeKiller;
+  private readonly nextHostConsumerServerCommandFactory;
   private readonly require;
-  constructor(pathResolver: CliPathResolver, pluginDiscovery: CodemationPluginDiscovery, tsRuntime: TypeScriptRuntimeConfigurator, devLockFactory: DevLockFactory, devSourceWatcherFactory: DevSourceWatcherFactory, cliLogger: Logger, session: DevSessionServices, databaseMigrationsApplyService: DatabaseMigrationsApplyService, devBootstrapSummaryFetcher: DevBootstrapSummaryFetcher, devCliBannerRenderer: DevCliBannerRenderer, devConsumerPublishBootstrap: DevConsumerPublishBootstrap, consumerEnvDotenvFilePredicate: ConsumerEnvDotenvFilePredicate, devTrackedProcessTreeKiller: DevTrackedProcessTreeKiller);
+  constructor(pathResolver: CliPathResolver, pluginDiscovery: CodemationPluginDiscovery, tsRuntime: TypeScriptRuntimeConfigurator, devLockFactory: DevLockFactory, devSourceWatcherFactory: DevSourceWatcherFactory, cliLogger: Logger, session: DevSessionServices, databaseMigrationsApplyService: DatabaseMigrationsApplyService, devBootstrapSummaryFetcher: DevBootstrapSummaryFetcher, devCliBannerRenderer: DevCliBannerRenderer, devConsumerPublishBootstrap: DevConsumerPublishBootstrap, consumerEnvDotenvFilePredicate: ConsumerEnvDotenvFilePredicate, devTrackedProcessTreeKiller: DevTrackedProcessTreeKiller, nextHostConsumerServerCommandFactory: NextHostConsumerServerCommandFactory);
   execute(consumerRoot: string): Promise<void>;
   private resolveDevModeFromEnv;
   private prepareDevRuntime;
@@ -23349,8 +23366,9 @@ declare class ServeWebCommand {
   private readonly outputBuilderLoader;
   private readonly envLoader;
   private readonly listenPortResolver;
+  private readonly nextHostConsumerServerCommandFactory;
   private readonly require;
-  constructor(pathResolver: CliPathResolver, pluginDiscovery: CodemationPluginDiscovery, artifactsPublisher: ConsumerBuildArtifactsPublisher, tsRuntime: TypeScriptRuntimeConfigurator, sourceMapNodeOptions: SourceMapNodeOptions, outputBuilderLoader: ConsumerOutputBuilderLoader, envLoader: ConsumerEnvLoader, listenPortResolver: ListenPortResolver);
+  constructor(pathResolver: CliPathResolver, pluginDiscovery: CodemationPluginDiscovery, artifactsPublisher: ConsumerBuildArtifactsPublisher, tsRuntime: TypeScriptRuntimeConfigurator, sourceMapNodeOptions: SourceMapNodeOptions, outputBuilderLoader: ConsumerOutputBuilderLoader, envLoader: ConsumerEnvLoader, listenPortResolver: ListenPortResolver, nextHostConsumerServerCommandFactory: NextHostConsumerServerCommandFactory);
   execute(consumerRoot: string, buildOptions: ConsumerBuildOptions): Promise<void>;
 }
 //#endregion

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as CliProgram, i as CliPathResolver, n as CliProgramFactory, o as ConsumerOutputBuilder, r as CodemationCliApplicationSession, s as ConsumerBuildOptionsParser, t as CliBin } from "./CliBin-DTTnbKz7.js";
+import { a as CliProgram, i as CliPathResolver, n as CliProgramFactory, o as ConsumerOutputBuilder, r as CodemationCliApplicationSession, s as ConsumerBuildOptionsParser, t as CliBin } from "./CliBin-900C8Din.js";
 import { CodemationPluginDiscovery } from "@codemation/host/server";
 
 export { CliBin, CliPathResolver, CliProgram, CliProgramFactory, CodemationCliApplicationSession, CodemationPluginDiscovery, ConsumerBuildOptionsParser, ConsumerOutputBuilder };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codemation/cli",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "publishConfig": {
     "access": "public"
   },
@@ -28,11 +28,11 @@
     "figlet": "^1.11.0",
     "reflect-metadata": "^0.2.2",
     "typescript": "^5.9.3",
-    "@codemation/host": "0.0.2",
-    "@codemation/next-host": "0.0.2",
-    "@codemation/dev-gateway": "0.0.2",
-    "@codemation/runtime-dev": "0.0.2",
-    "@codemation/worker-cli": "0.0.2"
+    "@codemation/dev-gateway": "0.0.3",
+    "@codemation/host": "0.0.3",
+    "@codemation/runtime-dev": "0.0.3",
+    "@codemation/next-host": "0.0.3",
+    "@codemation/worker-cli": "0.0.3"
   },
   "devDependencies": {
     "@types/node": "^25.3.5",

package/src/CliProgramFactory.ts

@@ -28,6 +28,7 @@ import { DevSourceWatcherFactory } from "./dev/Runner";
 import { CliProgram } from "./Program";
 import { CliPathResolver } from "./path/CliPathResolver";
 import { ListenPortResolver } from "./runtime/ListenPortResolver";
+import { NextHostConsumerServerCommandFactory } from "./runtime/NextHostConsumerServerCommandFactory";
 import { SourceMapNodeOptions } from "./runtime/SourceMapNodeOptions";
 import { TypeScriptRuntimeConfigurator } from "./runtime/TypeScriptRuntimeConfigurator";
 import { LocalUserCreator } from "./user/LocalUserCreator";
@@ -51,6 +52,7 @@ export class CliProgramFactory {
     const tsRuntime = new TypeScriptRuntimeConfigurator();
     const outputBuilderLoader = new ConsumerOutputBuilderLoader();
     const sourceMapNodeOptions = new SourceMapNodeOptions();
+    const nextHostConsumerServerCommandFactory = new NextHostConsumerServerCommandFactory();
     const tsconfigPreparation = new ConsumerCliTsconfigPreparation();
     const databasePersistenceResolver = new DatabasePersistenceResolver();
     const userAdminBootstrap = new UserAdminCliBootstrap(
@@ -98,6 +100,7 @@ export class CliProgramFactory {
         devConsumerPublishBootstrap,
         new ConsumerEnvDotenvFilePredicate(),
         new DevTrackedProcessTreeKiller(),
+        nextHostConsumerServerCommandFactory,
       ),
       new ServeWebCommand(
         pathResolver,
@@ -108,6 +111,7 @@ export class CliProgramFactory {
         outputBuilderLoader,
         new ConsumerEnvLoader(),
         new ListenPortResolver(),
+        nextHostConsumerServerCommandFactory,
       ),
       new ServeWorkerCommand(sourceMapNodeOptions),
       new DbMigrateCommand(databaseMigrationsApplyService),

package/src/Program.ts

@@ -57,7 +57,7 @@ export class CliProgram {
     program
       .command("dev", { isDefault: true })
       .description(
-        "Start the dev gateway and runtime child. Use CODEMATION_DEV_MODE=framework with Next dev for framework UI HMR; default consumer mode serves API/WebSocket from the gateway only.",
+        "Start the dev gateway and runtime child. Default consumer mode uses the packaged Codemation UI; use CODEMATION_DEV_MODE=framework for Next dev HMR when working on the host itself.",
       )
       .option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)")
       .action(async (opts: Readonly<{ consumerRoot?: string }>) => {
@@ -68,7 +68,7 @@ export class CliProgram {
 
     serve
       .command("web")
-      .description("Start the built Next.js Codemation host (next start).")
+      .description("Start the packaged Codemation web host.")
       .option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)")
       .option(
         "--no-source-maps",

package/src/commands/DevCommand.ts

@@ -17,6 +17,7 @@ import { DevTrackedProcessTreeKiller } from "../dev/DevTrackedProcessTreeKiller"
 import { DevSourceWatcherFactory } from "../dev/Runner";
 import { CliPathResolver, type CliPaths } from "../path/CliPathResolver";
 import { TypeScriptRuntimeConfigurator } from "../runtime/TypeScriptRuntimeConfigurator";
+import { NextHostConsumerServerCommandFactory } from "../runtime/NextHostConsumerServerCommandFactory";
 
 import type { DevResolvedAuthSettings } from "../dev/DevAuthSettingsLoader";
 
@@ -39,6 +40,7 @@ export class DevCommand {
     private readonly devConsumerPublishBootstrap: DevConsumerPublishBootstrap,
     private readonly consumerEnvDotenvFilePredicate: ConsumerEnvDotenvFilePredicate,
     private readonly devTrackedProcessTreeKiller: DevTrackedProcessTreeKiller,
+    private readonly nextHostConsumerServerCommandFactory: NextHostConsumerServerCommandFactory,
   ) {}
 
   async execute(consumerRoot: string): Promise<void> {
@@ -163,14 +165,15 @@ export class DevCommand {
     const uiProxyBase = `http://127.0.0.1:${uiPort}`;
     const nextHostPackageJsonPath = this.require.resolve("@codemation/next-host/package.json");
     const nextHostRoot = path.dirname(nextHostPackageJsonPath);
+    const nextHostCommand = await this.nextHostConsumerServerCommandFactory.create({ nextHostRoot });
     const consumerOutputManifestPath = path.resolve(
       prepared.paths.consumerRoot,
       ".codemation",
       "output",
       "current.json",
     );
-    state.currentUiNext = spawn("pnpm", ["exec", "next", "start"], {
-      cwd: nextHostRoot,
+    state.currentUiNext = spawn(nextHostCommand.command, nextHostCommand.args, {
+      cwd: nextHostCommand.cwd,
       ...this.devDetachedChildSpawnOptions(),
       env: {
         ...process.env,
@@ -180,6 +183,8 @@ export class DevCommand {
         CODEMATION_CONSUMER_ROOT: prepared.paths.consumerRoot,
         CODEMATION_CONSUMER_OUTPUT_MANIFEST_PATH: consumerOutputManifestPath,
         CODEMATION_SKIP_UI_AUTH: prepared.authSettings.skipUiAuth ? "true" : "false",
+        AUTH_SECRET: prepared.authSettings.authSecret,
+        NEXTAUTH_SECRET: prepared.authSettings.authSecret,
         NEXT_PUBLIC_CODEMATION_SKIP_UI_AUTH: prepared.authSettings.skipUiAuth ? "true" : "false",
         CODEMATION_WS_PORT: String(websocketPort),
         NEXT_PUBLIC_CODEMATION_WS_PORT: String(websocketPort),
@@ -385,7 +390,7 @@ export class DevCommand {
       return;
     }
     this.cliLogger.info(
-      `codemation dev (consumer): open http://127.0.0.1:${gatewayPort} — requires a built @codemation/next-host (next build). For Next HMR use CODEMATION_DEV_MODE=framework.`,
+      `codemation dev (consumer): open http://127.0.0.1:${gatewayPort} — uses the packaged @codemation/next-host UI. For framework UI HMR, set CODEMATION_DEV_MODE=framework.`,
     );
   }
 }

package/src/commands/ServeWebCommand.ts

@@ -10,6 +10,7 @@ import type { ConsumerBuildOptions } from "../consumer/consumerBuildOptions.type
 import { ConsumerOutputBuilderLoader } from "../consumer/Loader";
 import { CliPathResolver } from "../path/CliPathResolver";
 import { ListenPortResolver } from "../runtime/ListenPortResolver";
+import { NextHostConsumerServerCommandFactory } from "../runtime/NextHostConsumerServerCommandFactory";
 import { SourceMapNodeOptions } from "../runtime/SourceMapNodeOptions";
 import { TypeScriptRuntimeConfigurator } from "../runtime/TypeScriptRuntimeConfigurator";
 
@@ -25,6 +26,7 @@ export class ServeWebCommand {
     private readonly outputBuilderLoader: ConsumerOutputBuilderLoader,
     private readonly envLoader: ConsumerEnvLoader,
     private readonly listenPortResolver: ListenPortResolver,
+    private readonly nextHostConsumerServerCommandFactory: NextHostConsumerServerCommandFactory,
   ) {}
 
   async execute(consumerRoot: string, buildOptions: ConsumerBuildOptions): Promise<void> {
@@ -35,6 +37,7 @@ export class ServeWebCommand {
     const discoveredPlugins = await this.pluginDiscovery.discover(paths.consumerRoot);
     const manifest = await this.artifactsPublisher.publish(snapshot, discoveredPlugins);
     const nextHostRoot = path.dirname(this.require.resolve("@codemation/next-host/package.json"));
+    const nextHostCommand = await this.nextHostConsumerServerCommandFactory.create({ nextHostRoot });
     const consumerEnv = this.envLoader.load(paths.consumerRoot);
     const nextPort = this.listenPortResolver.resolvePrimaryApplicationPort(process.env.PORT);
     const websocketPort = this.listenPortResolver.resolveWebsocketPortRelativeToHttp({
@@ -42,8 +45,8 @@ export class ServeWebCommand {
       publicWebsocketPort: process.env.NEXT_PUBLIC_CODEMATION_WS_PORT,
       websocketPort: process.env.CODEMATION_WS_PORT,
     });
-    const child = spawn("pnpm", ["exec", "next", "start"], {
-      cwd: nextHostRoot,
+    const child = spawn(nextHostCommand.command, nextHostCommand.args, {
+      cwd: nextHostCommand.cwd,
       stdio: "inherit",
       env: {
         ...process.env,

package/src/dev/DevAuthSettingsLoader.ts

@@ -4,10 +4,13 @@ import { CodemationConsumerConfigLoader } from "@codemation/host/server";
 
 export type DevResolvedAuthSettings = Readonly<{
   authConfigJson: string;
+  authSecret: string;
   skipUiAuth: boolean;
 }>;
 
 export class DevAuthSettingsLoader {
+  static readonly defaultDevelopmentAuthSecret = "codemation-dev-auth-secret-not-for-production";
+
   constructor(private readonly configLoader: CodemationConsumerConfigLoader) {}
 
   resolveDevelopmentServerToken(rawToken: string | undefined): string {
@@ -21,7 +24,16 @@ export class DevAuthSettingsLoader {
     const resolution = await this.configLoader.load({ consumerRoot });
     return {
       authConfigJson: JSON.stringify(resolution.config.auth ?? null),
+      authSecret: this.resolveDevelopmentAuthSecret(process.env),
       skipUiAuth: resolution.config.auth?.allowUnauthenticatedInDevelopment === true,
     };
   }
+
+  resolveDevelopmentAuthSecret(env: NodeJS.ProcessEnv): string {
+    const configuredSecret = env.AUTH_SECRET ?? env.NEXTAUTH_SECRET;
+    if (configuredSecret && configuredSecret.trim().length > 0) {
+      return configuredSecret;
+    }
+    return DevAuthSettingsLoader.defaultDevelopmentAuthSecret;
+  }
 }

package/src/runtime/NextHostConsumerServerCommandFactory.ts

@@ -0,0 +1,36 @@
+import { access } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+
+export type NextHostConsumerServerCommand = Readonly<{
+  args: ReadonlyArray<string>;
+  command: string;
+  cwd: string;
+}>;
+
+export class NextHostConsumerServerCommandFactory {
+  async create(args: Readonly<{ nextHostRoot: string }>): Promise<NextHostConsumerServerCommand> {
+    const standaloneServerPath = path.resolve(args.nextHostRoot, ".next", "standalone", "packages", "next-host", "server.js");
+    if (await this.exists(standaloneServerPath)) {
+      return {
+        command: process.execPath,
+        args: [standaloneServerPath],
+        cwd: path.dirname(standaloneServerPath),
+      };
+    }
+    return {
+      command: "pnpm",
+      args: ["exec", "next", "start"],
+      cwd: args.nextHostRoot,
+    };
+  }
+
+  private async exists(filePath: string): Promise<boolean> {
+    try {
+      await access(filePath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}