@cosmicdrift/kumiko-dev-server 0.334.0 → 0.336.0

package/dist/codegen/render.js

@@ -71,7 +71,7 @@ export function renderTypesAugmentation(events, outputDirAbs) {
     }
     const importLines = [];
     // `z` from zod is needed for `z.infer<typeof X>`; we import it once.
-    importLines.push(`import type { z } from "zod";`);
+    importLines.push(`import type * as z from "zod";`);
     // Stable order — sort module paths alphabetically; identifiers within
     // a module also alphabetically. Idempotent output.
     for (const [modPath, idents] of [...importsByPath.entries()].sort(([a], [b]) => a.localeCompare(b))) {
@@ -124,7 +124,7 @@ export function renderInlineSchemasFile(events, appRootAbs) {
         "// build`) or let the dev-server regenerate it — otherwise the z.infer",
         "// type drifts from the runtime schema.",
         "",
-        `import { z } from "zod";`,
+        `import * as z from "zod";`,
         "",
     ];
     // Sort by const-name for stable output.

package/dist/codegen/run-codegen.js

@@ -15,6 +15,7 @@
 //      kein leeres Verzeichnis.
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import * as z from "zod";
 import { renderDefineFile, renderInlineSchemasFile, renderTypesAugmentation, renderWriteHandlerTypes, TYPED_DISPATCHER_MARKER, WRITE_HANDLER_QN_MARKER, } from "./render.js";
 import { scanEvents } from "./scan-events.js";
 export function runCodegen(opts) {
@@ -51,9 +52,8 @@ export function runCodegen(opts) {
     // "the manifest doesn't exist" — both come back as an empty array —
     // so an empty result here is a known-lossy read, not authoritative
     // data the way run-dev-app's live registry is.
-    const usingManifestFallback = opts.handlerQns === undefined;
-    const handlerQns = opts.handlerQns ?? readHandlerQnsFromManifest(opts.appRoot);
-    const hasHandlerQns = handlerQns.length > 0;
+    const manifestRead = opts.handlerQns === undefined ? readHandlerQnsFromManifest(opts.appRoot) : undefined;
+    const handlerQns = opts.handlerQns ?? (manifestRead?.kind === "ok" ? manifestRead.qns : []);
     const defineContent = renderDefineFile(handlerQns);
     const schemasContent = renderInlineSchemasFile(scan.events, opts.appRoot);
     // package.json — turns `.kumiko/` into a real installable package
@@ -73,7 +73,9 @@ export function runCodegen(opts) {
     // not a missing-manifest gap, so it clears the block like before.
     // Only the manifest fallback coming back empty is ambiguous enough to
     // warrant carrying the previous block forward instead of dropping it.
-    const shouldPreserveStaleBlock = !hasHandlerQns && usingManifestFallback;
+    // A valid manifest that lists zero handlers is real data and clears the block;
+    // only a missing or unreadable manifest is ambiguous.
+    const shouldPreserveStaleBlock = manifestRead !== undefined && manifestRead.kind !== "ok";
     const finalTypesContent = shouldPreserveStaleBlock
         ? withPreservedBlock(typesContent, typesPath, WRITE_HANDLER_QN_MARKER, LEGACY_WRITE_HANDLER_QN_ANCHOR)
         : `${typesContent}${renderWriteHandlerTypes(handlerQns)}`;
@@ -90,7 +92,9 @@ export function runCodegen(opts) {
         ? [
             ...scan.warnings,
             {
-                message: "No feature-manifest.json found — the WriteHandlerQn/TypedDispatcher block could not be determined from here; run the dev-server to get the exact handler list.",
+                message: manifestRead?.kind === "invalid"
+                    ? `feature-manifest.json invalid: ${manifestRead.reason} — the WriteHandlerQn/TypedDispatcher block could not be determined from here; fix or regenerate the manifest, or run the dev-server.`
+                    : "No feature-manifest.json found — the WriteHandlerQn/TypedDispatcher block could not be determined from here; run the dev-server to get the exact handler list.",
             },
         ]
         : scan.warnings;
@@ -194,26 +198,28 @@ function removeIfExists(path) {
     rmSync(path, { force: true });
     return true;
 }
+const featureManifestSchema = z.object({
+    features: z.array(z.object({ writeHandlers: z.array(z.string()).optional() })),
+});
 /**
- * Fallback: liest `feature-manifest.json` aus dem appRoot und extrahiert
- * alle Write-Handler-QNs. Fehlende/stale Manifeste sind kein Fehler —
- * dann wird schlicht keine `WriteHandlerQn`-Union generiert (CLI ohne
- * Manifest oder CI-Setup ohne Manifest-Generator).
+ * Fallback: reads `feature-manifest.json` from appRoot and extracts all
+ * write-handler QNs. A missing manifest is not an error (CLI without a
+ * manifest generator); a broken one is reported separately. Either way the
+ * existing block is left untouched.
  */
 function readHandlerQnsFromManifest(appRoot) {
+    const manifestPath = join(appRoot, "feature-manifest.json");
+    if (!existsSync(manifestPath))
+        return { kind: "missing" };
     try {
-        const manifestPath = join(appRoot, "feature-manifest.json");
-        const raw = readFileSync(manifestPath, "utf-8");
-        const manifest = JSON.parse(raw);
-        const qns = [];
-        for (const f of manifest.features) {
-            if (f.writeHandlers)
-                qns.push(...f.writeHandlers);
-        }
+        const parsed = featureManifestSchema.safeParse(JSON.parse(readFileSync(manifestPath, "utf-8")));
+        if (!parsed.success)
+            return { kind: "invalid", reason: z.prettifyError(parsed.error) };
+        const qns = parsed.data.features.flatMap((f) => f.writeHandlers ?? []);
         qns.sort();
-        return qns;
+        return { kind: "ok", qns };
     }
-    catch {
-        return [];
+    catch (e) {
+        return { kind: "invalid", reason: e instanceof Error ? e.message : String(e) };
     }
 }

package/dist/codegen/scan-events.d.ts

@@ -35,11 +35,16 @@ export type SchemaSource = {
      *  rename them. */
     readonly generatedConstName: string;
 };
+/** `file` + `line` come as a pair; the location-less variant covers warnings
+ *  that aren't tied to a scanned source line (e.g. a codegen-level warning
+ *  about a missing manifest file). */
 export type ScanWarning = {
-    /** Absent for warnings that aren't tied to a scanned source line
-     *  (e.g. a codegen-level warning about a missing manifest file). */
-    readonly file?: string;
-    readonly line?: number;
+    readonly file: string;
+    readonly line: number;
+    readonly message: string;
+} | {
+    readonly file?: undefined;
+    readonly line?: undefined;
     readonly message: string;
 };
 export type ScanResult = {

package/dist/codegen/scan-events.js

@@ -357,7 +357,7 @@ function looksLikeZodCall(call) {
     // Walk the callee head — `z.something(...)` or `z.something.foo(...)`,
     // anything that traces back to an Identifier `z`. Conservative: we
     // don't try to verify it's the actual zod-import (the runtime check
-    // happens through the schemas-file's `import { z } from "zod"` anyway,
+    // happens through the schemas-file's `import * as z from "zod"` anyway,
     // which fails loudly if the user's `z` is something else).
     let cur = call.getExpression();
     while (cur.asKind(SyntaxKind.PropertyAccessExpression) || cur.asKind(SyntaxKind.CallExpression)) {

package/dist/create-kumiko-server.js

@@ -187,6 +187,10 @@ function resolvePublicFilePath(pathname, publicDir) {
     catch {
         return undefined;
     }
+    // A NUL byte makes readFile throw ERR_INVALID_ARG_VALUE (not ENOENT), which
+    // would surface as a 500 instead of a router miss.
+    if (decoded.includes("\0"))
+        return undefined;
     const resolved = resolve(publicDir, `.${decoded}`);
     return resolved === publicDir || resolved.startsWith(publicDir + sep) ? resolved : undefined;
 }
@@ -235,8 +239,9 @@ async function servePublicFile(pathname, publicDir) {
     }
     catch (err) {
         const code = err.code;
-        if (code === "ENOENT" || code === "EISDIR" || code === "ENOTDIR")
+        if (code === "ENOENT" || code === "EISDIR" || code === "ENOTDIR" || code === "ENAMETOOLONG") {
             return undefined;
+        }
         throw err;
     }
 }

package/dist/run-dev-app.js

@@ -51,26 +51,22 @@ export async function runDevApp(options) {
         ...(composeAuthOptions && { authOptions: composeAuthOptions }),
     });
     // An explicitly wired file provider (options.files) satisfies the
-    // FILE_STORAGE_PROVIDER boot gate — set it before validateBoot runs. Only
-    // if WE set it (532/2): deleting it after use instead of leaving a
-    // permanent process.env mutation, so a second runDevApp call in the same
-    // process (no files this time) doesn't fall through the gate falsely.
-    const setFileStorageProviderEnv = options.files !== undefined && process.env[FILE_STORAGE_PROVIDER_ENV] === undefined;
-    if (setFileStorageProviderEnv) {
-        process.env[FILE_STORAGE_PROVIDER_ENV] = FILE_STORAGE_PROVIDER_BOOT_SENTINEL;
-    }
+    // FILE_STORAGE_PROVIDER boot gate. Passed via the validateBoot env option
+    // instead of mutating process.env, so nothing leaks into later runDevApp
+    // calls in the same process.
+    const baseBootEnv = options.validateBootOptions?.env ?? process.env;
+    const bootOptions = options.files !== undefined && baseBootEnv[FILE_STORAGE_PROVIDER_ENV] === undefined
+        ? {
+            ...options.validateBootOptions,
+            env: { ...baseBootEnv, [FILE_STORAGE_PROVIDER_ENV]: FILE_STORAGE_PROVIDER_BOOT_SENTINEL },
+        }
+        : options.validateBootOptions;
     // Boot-Validation als allererstes — vor fs-Watcher und Server. Dieselbe
     // Fehlerklasse (unqualifizierte nav-/handler-QNs, screen-access etc.),
     // die früher nur runProdApp fing und sonst erst den Prod-Pod im
     // CrashLoopBackOff sterben ließ (#359). Wirft synchron, bevor ein
     // Socket oder Watcher (codegen-Write) aufgeht.
-    try {
-        validateBoot(features, options.validateBootOptions);
-    }
-    finally {
-        if (setFileStorageProviderEnv)
-            delete process.env[FILE_STORAGE_PROVIDER_ENV];
-    }
+    validateBoot(features, bootOptions);
     warnIfNonUtcServerTimeZone();
     validateAppCustomScreenWriteQns(process.cwd(), collectWriteHandlerQns(features));
     // Codegen + File-Watcher — schreibt `<appRoot>/.kumiko/types.generated.d.ts`

package/dist/scaffold-app.js

@@ -563,7 +563,7 @@ function renderClient(appName) {
         "// here — symmetric to APP_FEATURES on the server side.",
         "",
         'import { emailPasswordClient } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";',
-        `import { tasksClient } from "./features/tasks/web";`,
+        'import { tasksClient } from "./features/tasks/web";',
         'import { type AppSchema, createKumikoApp, DefaultAppShell } from "@cosmicdrift/kumiko-renderer-web";',
         'import type { ReactNode } from "react";',
         "",
@@ -742,7 +742,7 @@ function renderKumikoSchema() {
         'import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";',
         'import { collectTableMetas, type EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";',
         'import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";',
-        `import { APP_FEATURES, HAS_AUTH } from "../src/run-config";`,
+        'import { APP_FEATURES, HAS_AUTH } from "../src/run-config";',
         "",
         "export const FEATURES: readonly FeatureDefinition[] = composeFeatures([...APP_FEATURES], {",
         "  includeBundled: HAS_AUTH,",
@@ -764,7 +764,7 @@ function renderBinKumiko() {
         'import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";',
         'import { runConsumerCli } from "@cosmicdrift/kumiko-framework/consumer-cli";',
         'import { runSchemaCli } from "@cosmicdrift/kumiko-framework/schema-cli";',
-        `import { APP_FEATURES, HAS_AUTH } from "../src/run-config";`,
+        'import { APP_FEATURES, HAS_AUTH } from "../src/run-config";',
         "",
         "const [, , cmd, ...rest] = Bun.argv;",
         "// biome-ignore lint/suspicious/noConsole: CLI output is the feature.",

package/dist/scaffold-deploy.js

@@ -170,6 +170,9 @@ function resolveDeployConfig(deployConfigRaw, appName) {
     // over-long appName fails loud here instead of producing a DB user
     // Postgres itself would reject at migrate-time.
     if (!DB_USER_RE.test(dbUser)) {
+        if (config.dbUser === undefined) {
+            throw new Error(`scaffoldDeploy: appName "${appName}" cannot serve as the default DB user (must match ${DB_USER_RE}); set package.json#kumiko.deploy.dbUser`);
+        }
         throw new Error(`scaffoldDeploy: invalid package.json#kumiko.deploy.dbUser — effective value "${dbUser}" (defaulted from appName) does not match ${DB_USER_RE}`);
     }
     return { dbUser, stackNetwork: config.stackNetwork ?? "discover" };

package/dist/schema-apply.js

@@ -10,7 +10,7 @@ import { join } from "node:path";
 import { createDbConnection, runMigrationsFromDir } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import { queueRebuildsFromMarkers, runPendingRebuilds, } from "@cosmicdrift/kumiko-framework/migrations";
+import { queueRebuildsFromMarkers, reportPendingRebuildRun, runPendingRebuilds, } from "@cosmicdrift/kumiko-framework/migrations";
 import { createEventConsumerStateTable, createProjectionStateTable, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { composeFeatures, } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 export async function runSchemaApply(opts) {
@@ -62,18 +62,7 @@ export async function runSchemaApply(opts) {
         });
         const registry = createRegistry(composeFeatures([...opts.features], opts));
         const rebuildRun = await runPendingRebuilds(db, registry, { thisRunTables });
-        if (rebuildRun.rebuilt.length > 0) {
-            console.log(`  Rebuild ${rebuildRun.rebuilt.length} Projection(s)…`);
-            for (const r of rebuildRun.rebuilt) {
-                console.log(`    ↻ ${r.projection} (${r.eventsProcessed} events)`);
-            }
-            console.log("");
-        }
-        if (rebuildRun.failed.length > 0) {
-            throw new Error(`Projection rebuild failed for: ${rebuildRun.failed
-                .map((f) => `${f.projection} (${f.error})`)
-                .join("; ")}. Table(s) stay queued in kumiko_pending_rebuilds — retried on the next apply.`);
-        }
+        reportPendingRebuildRun(rebuildRun, console.log);
         return 0;
     }
     catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.334.0",
+  "version": "0.336.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -64,11 +64,11 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.334.0",
-    "@cosmicdrift/kumiko-framework": "0.334.0",
-    "@cosmicdrift/kumiko-headless": "0.334.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.334.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.334.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.336.0",
+    "@cosmicdrift/kumiko-framework": "0.336.0",
+    "@cosmicdrift/kumiko-headless": "0.336.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.336.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.336.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Codegen validates feature-manifest.json and only keeps the stale handler block when it is missing or invalid",
+    "detail": "`kumiko-build` codegen now validates `feature-manifest.json`. A valid manifest that lists no write handlers removes the generated `WriteHandlerQn` and typed-dispatcher block instead of keeping a stale one. A broken manifest keeps the block and warns with its own \"feature-manifest.json invalid\" message."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Codegen emits namespace zod imports",
+    "detail": "Generated `schemas.generated.ts` and `types.generated.d.ts` now import zod as a namespace (`import * as z from \"zod\"`), matching the framework's own convention. Regenerate with `kumiko build` to pick it up."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Dev public-file fallback returns 404 for NUL or over-long paths, deploy scaffold blames appName for an invalid default DB user",
+    "detail": "The dev-server public-file fallback answers a request path containing an encoded NUL byte (`%00`) or an over-long file name with the normal 404 instead of a 500. The scaffold deploy step now names `appName` as the cause when it is too long to serve as the default DB user."
+  },
   {
     "version": "0.330.0",
     "type": "improvement",