@cosmicdrift/kumiko-dev-server 0.13.0 → 0.15.0

package/src/scaffold-app.ts

@@ -6,16 +6,14 @@
 // stub, package.json with @cosmicdrift/* deps, tsconfig, .env.example,
 // README.
 //
-// Intentionally NOT included in DX-1.0:
-// - drizzle/ setup (DX-1.1 — needs FEATURE_IMPORT_REGISTRY decision from DX-4)
-// - deploy/Dockerfile (already covered by scaffoldDeploy — separate cmd)
-// - first feature scaffold (use scaffoldFeature after this)
-//
-// The generated app is born "boots cleanly, mounts nothing fancy". User
-// runs `kumiko add feature` (DX-2) or hand-edits src/run-config.ts to grow.
+// .ts files are built via ts-morph (same tool [[scaffoldAppFeature]] uses
+// to auto-mount features). Means a single AST representation for both
+// generate + later modify — no template-string ↔ ts-morph divergence.
+// Static files (package.json, tsconfig, .env, README) stay text-based.
 
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { IndentationText, Project, VariableDeclarationKind } from "ts-morph";
 
 export type ScaffoldAppOptions = {
   /** kebab-case app name (e.g. "my-shop"). Becomes package-name + folder. */
@@ -122,72 +120,143 @@ function renderTsconfig(): string {
   )}\n`;
 }
 
-function renderRunConfig(): string {
-  return `// Single source of truth für die Feature-Komposition deiner App.
-// Bundled-Foundation: secrets + sessions. config/user/tenant/auth-email-password
-// werden via composeFeatures(includeBundled:true) automatisch ergänzt
-// wenn runProdApp mit \`auth: {…}\` aufgerufen wird (siehe bin/main.ts).
-//
-// Neue features hinzufügen:
-//   - bunx kumiko add feature <name>  (DX-2, automatisch)
-//   - oder: hand-edit + import unten ergänzen
-
-import { createSecretsFeature } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
+function newTsProject(): Project {
+  return new Project({
+    useInMemoryFileSystem: true,
+    compilerOptions: { target: 99, module: 99, strict: true },
+    manipulationSettings: { indentationText: IndentationText.TwoSpaces },
+  });
+}
 
-export const APP_FEATURES = [
-  createSecretsFeature(),
-  createSessionsFeature(),
-] as const;
-`;
+function renderRunConfig(): string {
+  const project = newTsProject();
+  const sf = project.createSourceFile("run-config.ts", "");
+
+  sf.addImportDeclaration({
+    moduleSpecifier: "@cosmicdrift/kumiko-bundled-features/secrets",
+    namedImports: ["createSecretsFeature"],
+  });
+  sf.addImportDeclaration({
+    moduleSpecifier: "@cosmicdrift/kumiko-bundled-features/sessions",
+    namedImports: ["createSessionsFeature"],
+  });
+
+  sf.addVariableStatement({
+    declarationKind: VariableDeclarationKind.Const,
+    isExported: true,
+    declarations: [
+      {
+        name: "APP_FEATURES",
+        initializer: "[createSecretsFeature(), createSessionsFeature()] as const",
+      },
+    ],
+  });
+
+  sf.insertText(
+    0,
+    [
+      "// Single source of truth für die Feature-Komposition deiner App.",
+      "// Bundled-Foundation: secrets + sessions. config/user/tenant/auth-email-password",
+      "// werden via composeFeatures(includeBundled:true) automatisch ergänzt",
+      "// wenn runProdApp mit `auth: {…}` aufgerufen wird (siehe bin/main.ts).",
+      "//",
+      "// Neue features hinzufügen:",
+      "//   - bunx @cosmicdrift/kumiko-cli add feature <name>  (DX-2, automatisch)",
+      "//   - oder: hand-edit + import unten ergänzen",
+      "",
+      "",
+    ].join("\n"),
+  );
+
+  return sf.getFullText();
 }
 
 function renderMain(appName: string): string {
-  // Deterministic tenant-UUID derived from appName for the seed-admin
-  // membership. Reproducible across boots; tenants table sees the same
-  // ID. Format: 8-4-4-4-12 hex chars, version-4 marker at position 14.
-  // We hash the name into the digits using a tiny PRNG so two apps
-  // get different IDs without bun's crypto dependency.
   const tenantId = deriveTenantId(appName);
-  return `// Production-bootstrap. KUMIKO_DRY_RUN_ENV=boot exits after
-// composeFeatures + validateBoot + createRegistry without DB/Redis-connect
-// (siehe @cosmicdrift/kumiko-dev-server runProdApp). Echter Dev-Boot
-// passiert via \`bunx kumiko dev\` mit Docker-stack — DX-1.0 deckt nur
-// den boot-mode-Pfad ab; \`kumiko dev\` kommt in einer späteren DX-Phase.
-
-import { frameworkCoreEnvSchema, runProdApp } from "@cosmicdrift/kumiko-dev-server";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { composeEnvSchema } from "@cosmicdrift/kumiko-framework/env";
-import { APP_FEATURES } from "../src/run-config";
-
-const DEFAULT_TENANT_ID = "${tenantId}" as TenantId;
-
-const envSchema = composeEnvSchema({
-  core: frameworkCoreEnvSchema,
-  features: APP_FEATURES,
-});
-
-await runProdApp({
-  features: APP_FEATURES,
-  envSchema,
-  migrations: false,
-  auth: {
-    admin: {
-      email: "admin@${appName}.local",
-      password: "change-me-on-first-deploy",
-      displayName: "Admin",
-      memberships: [
-        {
-          tenantId: DEFAULT_TENANT_ID,
-          tenantKey: "${appName}",
-          tenantName: "${appName}",
-          roles: ["TenantAdmin"],
-        },
-      ],
-    },
-  },
-});
-`;
+  const project = newTsProject();
+  const sf = project.createSourceFile("main.ts", "");
+
+  sf.addImportDeclaration({
+    moduleSpecifier: "@cosmicdrift/kumiko-dev-server",
+    namedImports: ["frameworkCoreEnvSchema", "runProdApp"],
+  });
+  sf.addImportDeclaration({
+    moduleSpecifier: "@cosmicdrift/kumiko-framework/engine",
+    isTypeOnly: true,
+    namedImports: ["TenantId"],
+  });
+  sf.addImportDeclaration({
+    moduleSpecifier: "@cosmicdrift/kumiko-framework/env",
+    namedImports: ["composeEnvSchema"],
+  });
+  sf.addImportDeclaration({
+    moduleSpecifier: "../src/run-config",
+    namedImports: ["APP_FEATURES"],
+  });
+
+  sf.addVariableStatement({
+    declarationKind: VariableDeclarationKind.Const,
+    declarations: [
+      {
+        name: "DEFAULT_TENANT_ID",
+        initializer: `"${tenantId}" as TenantId`,
+      },
+    ],
+  });
+
+  sf.addVariableStatement({
+    declarationKind: VariableDeclarationKind.Const,
+    declarations: [
+      {
+        name: "envSchema",
+        initializer: "composeEnvSchema({ core: frameworkCoreEnvSchema, features: APP_FEATURES })",
+      },
+    ],
+  });
+
+  sf.addStatements((writer) => {
+    writer
+      .write("await runProdApp(")
+      .inlineBlock(() => {
+        writer.writeLine("features: APP_FEATURES,");
+        writer.writeLine("envSchema,");
+        writer.writeLine("migrations: false,");
+        writer.write("auth: ").inlineBlock(() => {
+          writer.write("admin: ").inlineBlock(() => {
+            writer.writeLine(`email: "admin@${appName}.local",`);
+            writer.writeLine(`password: "change-me-on-first-deploy",`);
+            writer.writeLine(`displayName: "Admin",`);
+            writer.write("memberships: [");
+            writer.indent(() => {
+              writer.inlineBlock(() => {
+                writer.writeLine("tenantId: DEFAULT_TENANT_ID,");
+                writer.writeLine(`tenantKey: "${appName}",`);
+                writer.writeLine(`tenantName: "${appName}",`);
+                writer.writeLine(`roles: ["TenantAdmin"],`);
+              });
+              writer.write(",");
+            });
+            writer.write("],");
+          });
+        });
+      })
+      .write(");");
+  });
+
+  sf.insertText(
+    0,
+    [
+      "// Production-bootstrap. KUMIKO_DRY_RUN_ENV=boot exits after",
+      "// composeFeatures + validateBoot + createRegistry without DB/Redis-connect",
+      "// (siehe @cosmicdrift/kumiko-dev-server runProdApp). Echter Dev-Boot",
+      "// passiert via `yarn kumiko dev` (in-repo dev-tool) mit Docker-stack — DX-1.0 deckt nur",
+      "// den boot-mode-Pfad ab; `kumiko dev` kommt in einer späteren DX-Phase.",
+      "",
+      "",
+    ].join("\n"),
+  );
+
+  return sf.getFullText();
 }
 
 function renderEnvExample(): string {
@@ -208,7 +277,7 @@ function renderReadme(appName: string): string {
   return `# ${appName}
 
 Scaffolded by \`kumiko new app\`. Boots out-of-the-box with secrets + sessions
-mounted (foundation set). Add features with \`bunx kumiko add feature <name>\`.
+mounted (foundation set). Add features with \`bunx @cosmicdrift/kumiko-cli add feature <name>\`.
 
 ## First boot
 
@@ -224,7 +293,7 @@ Expected: \`[runProdApp] boot validation OK (… features, … registry entries)
 ## Adding features
 
 \`\`\`sh
-bunx kumiko add feature my-domain
+bunx @cosmicdrift/kumiko-cli add feature my-domain
 # → editiert src/run-config.ts automatisch + scaffolded src/features/my-domain/
 \`\`\`
 
@@ -241,10 +310,6 @@ For full docs see https://docs.kumiko.so.
 // version-marker at the right spot. NOT cryptographically random —
 // just a stable per-app default the user can change later.
 function deriveTenantId(name: string): string {
-  // Tiny xorshift PRNG seeded from the name's char-codes. Same name →
-  // same ID. Sufficient for "give every scaffolded app a deterministic
-  // default tenant" — production sets its own via the create-tenant
-  // flow anyway.
   let state = 2166136261;
   for (const ch of name) {
     state ^= ch.charCodeAt(0);
@@ -255,11 +320,9 @@ function deriveTenantId(name: string): string {
   state ^= state << 13;
   state >>>= 0;
   const b = hex(state, 4);
-  // version-4 marker at first char of 3rd group:
   state ^= state >>> 17;
   state >>>= 0;
   const c = `4${hex(state, 3)}`;
-  // RFC 4122 variant: 10xx (set top two bits of 4th group to 10):
   state ^= state << 5;
   state >>>= 0;
   const d4 = (0x8 | (state & 0x3)).toString(16);

package/src/{drizzle-tables-auth-mode.ts → schema-tables-auth-mode.ts}

@@ -12,7 +12,7 @@
 //
 // Bundle-Entity-Tables (configValuesTable, tenantTable, userTable,
 // userSessionTable, tenantMembershipsTable etc.) sind bewusst NICHT hier:
-// sie kommen über schema.generated.ts via buildDrizzleTable aus den
+// sie kommen über schema.generated.ts via buildEntityTable aus den
 // r.entity()-Definitionen, das ist seit der entity.indexes-API die
 // Single-Source-of-Truth. Doppelte Re-Exports würden zwei pgTable-
 // Instances mit identischem Index-Namen erzeugen — drizzle-kit warnt.

package/templates/deploy/Dockerfile.template

@@ -13,66 +13,34 @@
 # Size: ~250 MB incl. drizzle-kit for the pre-deploy migrate step.
 # Build context: repository root (monorepo is used in the build stage).
 
-ARG BUN_VERSION=1.2.20
+ARG BUN_VERSION=1.3.14
+{{#hasPrivateGhPackages}}
+# Private GH-Packages: der CI-Workflow injects GITHUB_TOKEN via --build-arg.
+# Docker's multi-stage ARG scoping braucht die Re-declaration in jeder Stage
+# die sie nutzt; das top-level ARG macht sie per `docker build` setzbar.
+ARG GITHUB_TOKEN=
+{{/hasPrivateGhPackages}}
 # Build identity — passed in by the CI workflow via --build-arg. Defaults
 # for local container builds.
 ARG BUILD_VERSION=dev
 ARG BUILD_TIME=unknown
-{{#hasPrivateGhPackages}}
-# Private @cosmicdriftgamestudio/* GH-Packages dep detected — yarn-4
-# reads the token via `npmAuthToken: "${GITHUB_TOKEN:-…}"` in .yarnrc.yml.
-# Without this build-arg, yarn install aborts with YN0041 anonymous-auth.
-ARG GITHUB_TOKEN=
-{{/hasPrivateGhPackages}}
 
 # ----- build: produces dist/ + dist-server/ ---------------------------------
-# Build base is node-alpine (not bun-alpine) because the repo uses yarn 4 as
-# its package manager — `link:./.kumiko` (@app/define codegen output) is
-# yarn-4's symlink protocol, which bun interprets differently. Node ships
-# corepack (yarn 4 via packageManager field); we pull bun via npm for
-# `bun run build`. Runtime stage stays pure bun.
-FROM node:20-alpine AS build
+FROM oven/bun:${BUN_VERSION}-alpine AS build
+WORKDIR /app
 {{#hasPrivateGhPackages}}
-# Multi-stage ARG inheritance: globals declared before FROM need an
-# `ARG <name>` line in every stage that uses them. Without this,
-# ${GITHUB_TOKEN} below resolves to empty and yarn install hits YN0041.
+# GITHUB_TOKEN für @cosmicdriftgamestudio/*-Scope beim bun install.
 ARG GITHUB_TOKEN
+ENV GITHUB_TOKEN=${GITHUB_TOKEN}
+RUN bun config set --scope @cosmicdriftgamestudio token "${GITHUB_TOKEN}"
 {{/hasPrivateGhPackages}}
-WORKDIR /app
-
-RUN corepack enable && npm install -g bun@${BUN_VERSION}
 
 # Standalone-repo layout: @cosmicdrift/* pulled from NPM, no workspace:*
-# refs. Manifests first for Docker layer cache (yarn install only
+# refs. Manifests first for Docker layer cache (bun install only
 # invalidates on dep change).
-COPY package.json yarn.lock .yarnrc.yml ./
+COPY package.json bun.lock ./
 
-# YARN_ENABLE_INLINE_BUILDS=true: postinstall stdout/stderr inline in the
-# install output. Without this, yarn 4 hides logs in /tmp/xfs-*/build.log
-# (invisible in the Docker layer output) and the CI operator guesses why
-# the install failed.
-#
-# `link:./.kumiko` (@app/define in package.json): yarn 4 creates a
-# dangling symlink; install does NOT fail. `bun run build` below calls
-# `runCodegen` from @cosmicdrift/kumiko-dev-server (see
-# bin/kumiko-build.ts), which writes .kumiko/define.ts and turns the
-# symlink real before the bundle is built.
-ENV YARN_ENABLE_INLINE_BUILDS=true
-# Skip postinstall scripts for ALL deps in the build stage. Reason:
-# `bun build` bundles JS source only — no native bindings needed at bundle-
-# time. msgpackr-extract is the most common offender (ARM/CI native-build
-# failures), but the rule applies broadly: any native dep loaded at runtime
-# gets re-installed via `bun install --production` in the runtime stage,
-# which uses bun's own postinstall handling. Apps that needed per-package
-# opt-outs via `dependenciesMeta.<pkg>.built=false` in package.json (e.g.
-# studio, enterprise) can remove those entries after adopting this template.
-ENV YARN_ENABLE_SCRIPTS=false
-{{#hasPrivateGhPackages}}
-# Re-export GITHUB_TOKEN as env so yarn-4's `${GITHUB_TOKEN:-…}` expansion
-# in .yarnrc.yml finds it during the install step.
-ENV GITHUB_TOKEN=${GITHUB_TOKEN}
-{{/hasPrivateGhPackages}}
-RUN yarn install --immutable
+RUN bun install --frozen-lockfile
 
 COPY . .
 RUN bun run build