@cosmicdrift/kumiko-cli 0.363.0 → 0.365.0

package/LICENSE

@@ -0,0 +1,57 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             Marc Frost
+
+Licensed Work:        @cosmicdrift/kumiko-framework
+                      The Licensed Work is © 2026 Marc Frost.
+
+Additional Use Grant: 
+You may use the Licensed Work in production for any purpose, including 
+commercially, EXCEPT for the Restricted Use. 
+
+"Restricted Use" is defined as using the Licensed Work to provide a platform 
+or service to third parties that allows them to host, deploy, or run their 
+own applications built with the Licensed Work. This includes, but is not 
+limited to: managed hosting services, software-as-a-service (SaaS) platforms, 
+platform-as-a-service (PaaS), developer platforms, or any multi-tenant 
+managed offering of the Licensed Work.
+
+This restriction does not apply to the Licensor, any entity controlled by, 
+controlling, or under common control with the Licensor ("Affiliates"), or 
+contractors acting on their behalf. The Licensor remains free to use the 
+Licensed Work for any purpose, including for the operation of kumiko.rocks.
+
+Change Date:          2030-05-05
+Change License:       Apache License, Version 2.0
+
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative works, 
+redistribute, and make non-production use of the Licensed Work. The Licensor may 
+make an Additional Use Grant, above, permitting limited production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly 
+available distribution of the Licensed Work under this License, whichever comes 
+first, this License will convert to the Change License.
+
+This Business Source License governs use of the Licensed Work in all cases, except 
+as to any use that is explicitly granted in the Additional Use Grant above or 
+under the Change License after the Change Date.
+
+If your use of the Licensed Work does not comply with the requirements of this 
+License, you must cease use of the Licensed Work immediately.
+
+All copies of the Licensed Work, and all derivative works thereof, must include 
+this License.
+
+This License does not grant you any right, title, or interest in any trademark, 
+logo, or branding of the Licensor, except as required to comply with this License.
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN 
+“AS IS” BASIS. LICENSOR DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 
+WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, 
+TITLE, AND NON-INFRINGEMENT. IN NO EVENT WILL LICENSOR BE LIABLE FOR ANY DAMAGES 
+ARISING OUT OF OR RELATED TO THIS LICENSE OR THE USE OF THE LICENSED WORK.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-cli",
-  "version": "0.363.0",
+  "version": "0.365.0",
   "description": "CLI for Kumiko apps. `bunx @cosmicdrift/kumiko-cli new app <name>` scaffolds a runnable workspace; `add feature <name>` mounts a feature; `check` runs boot validation plus the guard suites with the step list derived from kumiko.json; `agent lint`, `project` and `consumer` operate on an existing app; `handbuch build` renders the HTML handbuch.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -36,10 +36,10 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.363.0",
-    "@cosmicdrift/kumiko-guards": "0.363.0",
-    "@cosmicdrift/kumiko-repo-manifest": "0.363.0",
-    "@cosmicdrift/kumiko-testing": "0.363.0",
+    "@cosmicdrift/kumiko-dev-server": "0.365.0",
+    "@cosmicdrift/kumiko-guards": "0.365.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.365.0",
+    "@cosmicdrift/kumiko-testing": "0.365.0",
     "marked": "^18.0.3",
     "zod": "^4.4.3"
   },
@@ -64,9 +64,9 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.363.0",
-    "@cosmicdrift/kumiko-framework": "0.363.0",
-    "@cosmicdrift/kumiko-headless": "0.363.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.365.0",
+    "@cosmicdrift/kumiko-framework": "0.365.0",
+    "@cosmicdrift/kumiko-headless": "0.365.0",
     "sharp": "^0.35.5"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "kumiko handbuch build refuses a dangerous --out; missing-peer message tells an outdated install from a missing one",
+    "detail": "handbuch build deletes the output directory before building, so `--out .` or `--out <root>` removed the checkout. The command now exits 2 when --out is, or contains, the working directory, --root or a configured source repo. When an installed @cosmicdrift package lacks a requested subpath, the error asks for an upgrade instead of recommending bun add."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",

package/src/commands/handbuch.ts

@@ -1,4 +1,4 @@
-import { basename, join, resolve } from "node:path";
+import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { ZodError } from "zod";
 import type { HandbuchConfig } from "../handbuch/config";
@@ -41,6 +41,11 @@ function appSlug(configPath: string): string {
   return basename(configPath).replace(/\.json$/, "") || "handbuch";
 }
 
+function containsPath(parentDir: string, candidate: string): boolean {
+  const rel = relative(parentDir, candidate);
+  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
 async function runBuild(ctx: CliCommandContext, args: ReadonlyArray<string>): Promise<number> {
   let parsed: ReturnType<
     typeof parseArgs<{ options: typeof BUILD_OPTIONS; allowPositionals: true }>
@@ -82,11 +87,27 @@ async function runBuild(ctx: CliCommandContext, args: ReadonlyArray<string>): Pr
     return 2;
   }
 
+  // buildHandbuch wipes outDir recursively, so a mistyped --out must never be
+  // (or contain) a directory the build reads from or the user works in.
+  const outDir = resolve(ctx.cwd, values.out ?? join(rootDir, ".handbuch", appSlug(configPath)));
+  const protectedDirs = [
+    ctx.cwd,
+    rootDir,
+    resolve(rootDir, config.repo),
+    ...(config.flowSources ?? []).map((source) => resolve(rootDir, source.repo)),
+  ];
+  if (protectedDirs.some((dir) => containsPath(outDir, dir))) {
+    return usageError(
+      ctx,
+      `Refusing to build into ${outDir}: it is or contains the working directory, --root or a source repo, and is deleted before the build.`,
+    );
+  }
+
   const optionalDir = (value: string | undefined) => (value ? resolve(ctx.cwd, value) : undefined);
   try {
     const result = await buildHandbuch(config, {
       rootDir,
-      outDir: resolve(ctx.cwd, values.out ?? join(rootDir, ".handbuch", appSlug(configPath))),
+      outDir,
       shotsDir: optionalDir(values.shots),
       textsDir: optionalDir(values.texts),
       flowShotsDir: optionalDir(values["web-shots"]),

package/src/missing-peer.ts

@@ -6,12 +6,18 @@ const APP_PEER_PACKAGES = [
 
 // The runtime packages are optional peers (so `new app` runs without them); a
 // command that needs one must report the missing install, not a resolver stacktrace.
+// A subpath miss means the package is installed but too old for the requested export.
 export function missingPeerMessage(error: unknown): string | undefined {
   if (!(error instanceof Error)) return undefined;
+  if (!/cannot find (package|module)/i.test(error.message)) return undefined;
   for (const peer of APP_PEER_PACKAGES) {
-    if (error.message.includes(`'${peer}`) && /cannot find (package|module)/i.test(error.message)) {
+    if (error.message.includes(`'${peer}'`)) {
       return `${peer} is not installed. Install ${peer} in your app (bun add ${peer}).`;
     }
+    const subpath = error.message.match(new RegExp(`'${peer}(/[^']*)'`))?.[1];
+    if (subpath !== undefined) {
+      return `Installed ${peer} lacks ${subpath.slice(1)}. Upgrade ${peer} in your app.`;
+    }
   }
   return undefined;
 }