@cosmicdrift/kumiko-dev-server 0.337.1 → 0.338.0

package/dist/create-kumiko-server.d.ts

@@ -48,7 +48,12 @@ export type DevHostDispatchResult = {
     readonly to: string;
     readonly status?: 301 | 302;
 } | {
+    /** Plain 404 by default. `file` serves a static page with status 404
+     *  (like `static-html`), `entryName` serves that bundle's shell with 404;
+     *  `file` wins when both are set. */
     readonly kind: "not-found";
+    readonly entryName?: string;
+    readonly file?: string;
 };
 /** Picks an entry by inspecting the incoming request. Wird von
  *  Multi-Entry-Apps gesetzt; im Single-Entry-Mode irrelevant. */

package/dist/create-kumiko-server.js

@@ -723,7 +723,7 @@ export async function createKumikoServer(options) {
     // resolvePageHead goes through the same headless resolveAndInjectPageHead
     // that runProdApp uses, so dev and e2e exercise the one timeout and
     // fallback path instead of a second copy of it (#3026).
-    const htmlResponse = async (entryName, req, socketAddress) => {
+    const htmlResponse = async (entryName, req, socketAddress, status = 200) => {
         const template = htmlTemplates.get(entryName) ?? defaultTemplate;
         const headers = new Headers();
         headers.set("Content-Type", "text/html; charset=utf-8");
@@ -745,7 +745,23 @@ export async function createKumikoServer(options) {
                 systemQuery: buildDevSystemQuery(req, socketAddress),
             });
         }
-        return new Response(html, { headers });
+        return new Response(html, { status, headers });
+    };
+    // Raw file serve, no bundle injection — mirrors prod's `{ kind: "html", file }`.
+    const staticHtmlResponse = async (file, status) => {
+        let content;
+        try {
+            content = await readFile(file, "utf-8");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            return new Response(`hostDispatch: file not found: ${file}`, { status: 500 });
+        }
+        return new Response(content, {
+            status,
+            headers: { "Content-Type": "text/html; charset=utf-8" },
+        });
     };
     // --- Fetch handler (runtime-neutral) ---
     // Bundle-Pfad-Lookup: für jede Entry serven wir
@@ -898,15 +914,15 @@ export async function createKumikoServer(options) {
                     });
                 }
                 if (dispatch.kind === "not-found") {
+                    if (dispatch.file !== undefined)
+                        return staticHtmlResponse(dispatch.file, 404);
+                    if (dispatch.entryName !== undefined) {
+                        return htmlResponse(dispatch.entryName, req, socketAddress, 404);
+                    }
                     return new Response("Not Found", { status: 404 });
                 }
                 if (dispatch.kind === "static-html") {
-                    // Raw file serve, no bundle injection — mirrors prod's
-                    // `{ kind: "html", file: ... }` static-html branch.
-                    const file = await readFile(dispatch.file, "utf-8");
-                    return new Response(file, {
-                        headers: { "Content-Type": "text/html; charset=utf-8" },
-                    });
+                    return staticHtmlResponse(dispatch.file, 200);
                 }
                 return htmlResponse(dispatch.entryName, req, socketAddress);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.337.1",
+  "version": "0.338.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -64,11 +64,11 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.337.1",
-    "@cosmicdrift/kumiko-framework": "0.337.1",
-    "@cosmicdrift/kumiko-headless": "0.337.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.337.1",
-    "@cosmicdrift/kumiko-server-runtime": "0.337.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.338.0",
+    "@cosmicdrift/kumiko-framework": "0.338.0",
+    "@cosmicdrift/kumiko-headless": "0.338.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.338.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.338.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "Scaffolded migrate step percent-encodes DB_PASSWORD",
+    "detail": "dev-server: the scaffolded `deploy/migrate-step.sh` percent-encodes `DB_PASSWORD` in `DATABASE_URL`, so passwords with `@`, `:`, `/`, `#`, `%` or non-ASCII characters no longer break the URL. Re-run `kumiko init-deploy` to pick it up; apps with a hand-written `urlencode` should take the new version, which also encodes bytes >= 0x80 correctly."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "dev hostDispatch not-found can serve a custom 404 page",
+    "detail": "`DevHostDispatchResult` `{ kind: \"not-found\" }` accepts `file` (served like `static-html`) or `entryName` (that entry's shell), both with status 404. A missing file answers 500 with `hostDispatch: file not found`. Without fields the plain \"Not Found\" 404 stays.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "New package @cosmicdrift/kumiko-samples with the corpus sources",
+    "detail": "New package with the sample recipes, sample apps and bundled-features sources\n`@cosmicdrift/kumiko-samples` ships the sample recipes, sample apps and bundled-features sources in the repository layout. Tools such as the few-shot corpus build can run against a pinned version of it and get the same entry ids and source paths as in the monorepo."
+  },
   {
     "version": "0.337.1",
     "type": "improvement",

package/templates/deploy/Dockerfile.template

@@ -2,14 +2,14 @@
 #
 # Production-Image for {{appName}}.
 #
-# Server-Bundle variant — the runtime image doesn't know about the
-# monorepo any more, only:
+# Server-Bundle variant — the runtime image doesn't carry the source tree
+# or its node_modules any more, only:
 #
 #   dist/                  ← Client build (kumiko-build)
 #   dist-server/           ← Server bundle (bun build) + minimal package.json
 #   kumiko/migrations/     ← Checked-in SQL migrations applied by `kumiko schema apply`
 #
-# Build context: repository root (monorepo is used in the build stage).
+# Build context: repository root (the full source tree is only used in the build stage).
 
 ARG BUN_VERSION=1.4.0
 {{#hasPrivateGhPackages}}

package/templates/deploy/migrate-step.sh.template

@@ -49,6 +49,21 @@ set -a
 . ./.env
 set +a
 
+# Percent-encode so '@', ':', '/', '#', '%' in the password cannot change how
+# the URL is parsed. LC_ALL=C makes the loop walk bytes, not characters;
+# bash sign-extends bytes >= 0x80 in "'$c", hence the & 255.
+urlencode() {
+  local LC_ALL=C s="$1" out="" c i byte
+  for ((i = 0; i < ${#s}; i++)); do
+    c="${s:i:1}"
+    case "$c" in
+      [A-Za-z0-9._~-]) out+="$c" ;;
+      *) printf -v byte '%d' "'$c"; printf -v c '%%%02X' $((byte & 255)); out+="$c" ;;
+    esac
+  done
+  printf '%s' "$out"
+}
+
 # DATABASE_URL assumes: db user = appName, db name = appName, host "db"
 # (compose-service-name), port 5432. Adjust to your stack if different.
 {{#customDbUser}}
@@ -60,7 +75,7 @@ set +a
 # NAME (`-e DATABASE_URL`, no value) so the expanded password never appears
 # in `docker run`'s argv — otherwise it would be visible in `ps auxe` for
 # the duration of the migrate run.
-export DATABASE_URL="postgresql://{{dbUser}}:${DB_PASSWORD}@db:5432/{{appName}}"
+export DATABASE_URL="postgresql://{{dbUser}}:$(urlencode "$DB_PASSWORD")@db:5432/{{appName}}"
 docker run --rm \
   --network "$STACK_NETWORK" \
   -e DATABASE_URL \