@cosmicdrift/kumiko-dev-server 0.352.0 → 0.353.0

package/dist/create-kumiko-server.js

@@ -20,8 +20,8 @@ import { readFile, realpath, watch } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
-import { buildRequestContextDataFromRequest, createClientIpResolver, generateToken, requestContext, } from "@cosmicdrift/kumiko-framework/api";
-import { buildAppSchema, createAnonymousUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { createClientIpResolver, generateToken, } from "@cosmicdrift/kumiko-framework/api";
+import { buildAppSchema } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { pushEntityProjectionTables, setupTestStack, TestUsers, } from "@cosmicdrift/kumiko-framework/stack";
 import { resolveAndInjectPageHead, } from "@cosmicdrift/kumiko-headless/apex";
@@ -29,6 +29,7 @@ import { startDevJobRunners } from "@cosmicdrift/kumiko-server-runtime/boot/job-
 import { buildBunServeOptions, resolveDerivedMaxRequestBodySize, } from "@cosmicdrift/kumiko-server-runtime/bun-serve-options";
 import { makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
 import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_URL_PREFIX, resolveRendererWebFontsDir, } from "@cosmicdrift/kumiko-server-runtime/renderer-web-fonts";
+import { buildRequestBoundSystemQuery } from "@cosmicdrift/kumiko-server-runtime/request-bound-system-query";
 import { canResolveTailwindStylesheet, resolveTailwindCli, } from "@cosmicdrift/kumiko-server-runtime/resolve-tailwind-cli";
 import { stripNoRouteMatchHeader, tryHonoFirst, } from "@cosmicdrift/kumiko-server-runtime/try-hono-first";
 // Runtime-detection. The dev-server is meant to run under Bun (Kumiko's
@@ -725,11 +726,12 @@ export async function createKumikoServer(options) {
     // warn-once flags in dev is an accepted, low-risk gap (dev normally
     // runs unproxied — see CreateKumikoServerOptions.trustedProxyHops).
     const pageHeadClientIpResolver = createClientIpResolver(options.trustedProxyHops ?? 0, "createKumikoServer(pageHead)");
-    const buildDevSystemQuery = (req, socketAddress) => (type, payload, tenantId) => requestContext.run(requestContext.get() ??
-        buildRequestContextDataFromRequest(req, {
-            resolver: pageHeadClientIpResolver,
-            socketAddress,
-        }), () => stack.dispatcher.query(type, payload, createAnonymousUser(tenantId)));
+    const buildDevSystemQuery = (req, socketAddress) => buildRequestBoundSystemQuery({
+        req,
+        dispatcher: stack.dispatcher,
+        resolver: pageHeadClientIpResolver,
+        socketAddress,
+    });
     // resolvePageHead goes through the same headless resolveAndInjectPageHead
     // that runProdApp uses, so dev and e2e exercise the one timeout and
     // fallback path instead of a second copy of it (#3026).

package/dist/scaffold-deploy.js

@@ -47,6 +47,12 @@ export function renderDeployFiles(options) {
     // `failed to compute cache key: "/app/seeds": not found`.
     const sourceDir = options.sourceDir ?? destinationRoot;
     const detected = detectOptionalSurfaces(sourceDir, options.appName);
+    if (detected.hasPrivateGhPackages && detected.registryConfigFiles.length === 0) {
+        // The Dockerfile only forwards the auth build-arg; without a registry
+        // config scope entry bun resolves @cosmicdriftgamestudio/* against npmjs
+        // and the image build fails late with a 404.
+        throw new Error(`renderDeployFiles: private @cosmicdriftgamestudio/* deps need a bunfig.toml or .npmrc in ${sourceDir} with a scope entry for the private registry`);
+    }
     const installManifests = ["package.json", "bun.lock", ...detected.registryConfigFiles].join(" ");
     const subs = {
         appName: options.appName,
@@ -198,8 +204,10 @@ function detectOptionalSurfaces(sourceDir, appName) {
     let deployConfigRaw;
     const pkgJsonPath = join(sourceDir, "package.json");
     if (existsSync(pkgJsonPath)) {
+        let jsonParsed = false;
         try {
             const raw = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
+            jsonParsed = true;
             // Read ahead of packageJsonSchema.parse: an unrelated shape problem in
             // `dependencies`/`workspaces` must not silently discard a valid deploy
             // config along with it (that's caught by the outer catch below).
@@ -221,8 +229,12 @@ function detectOptionalSurfaces(sourceDir, appName) {
             // back to defaults (an invalid deploy config must THROW, but
             // unreadable JSON can't distinguish "no deploy config" from "invalid
             // deploy config" — it already surfaces via this warning).
+            const reason = err instanceof Error ? err.message : String(err);
+            const message = jsonParsed
+                ? `scaffoldDeploy: package.json at ${pkgJsonPath} has an unexpected dependencies/workspaces shape — private-GH-packages/install-layout detection skipped (${reason})`
+                : `scaffoldDeploy: package.json at ${pkgJsonPath} is not valid JSON — private-GH-packages/install-layout detection skipped and kumiko.deploy (dbUser/dbName/stackNetwork) falls back to the defaults (${reason})`;
             // biome-ignore lint/suspicious/noConsole: scaffold visibility for skipped private-package detection
-            console.warn(`scaffoldDeploy: package.json at ${pkgJsonPath} is not valid JSON — private-GH-packages/install-layout detection skipped (${err instanceof Error ? err.message : String(err)})`);
+            console.warn(message);
         }
     }
     const registryConfigFiles = REGISTRY_CONFIG_FILES.filter((f) => existsSync(join(sourceDir, f)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.352.0",
+  "version": "0.353.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -64,11 +64,11 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.352.0",
-    "@cosmicdrift/kumiko-framework": "0.352.0",
-    "@cosmicdrift/kumiko-headless": "0.352.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.352.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.352.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.353.0",
+    "@cosmicdrift/kumiko-framework": "0.353.0",
+    "@cosmicdrift/kumiko-headless": "0.353.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.353.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.353.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,15 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "init-deploy fails early when private GitHub packages have no bunfig.toml or .npmrc",
+    "detail": "init-deploy rejects private GitHub packages without a registry config\nAn app with `@cosmicdriftgamestudio/*` dependencies but no `bunfig.toml`/`.npmrc` used to get a Dockerfile whose `bun install` failed with a 404 only inside the image build. `scaffoldDeploy`, `renderDeployFiles` and `checkDeployDrift` now throw with a hint to add the scope entry."
+  },
+  {
+    "version": "0.353.0",
+    "type": "improvement",
+    "title": "Deploy scaffold warnings distinguish broken package.json from unexpected dependency shapes"
+  },
   {
     "version": "0.351.0",
     "type": "fix",