@cosmicdrift/kumiko-dev-server 0.352.0 → 0.354.0

package/bin/kumiko-build.ts

@@ -33,18 +33,34 @@ import {
 
 if (process.argv.slice(2).some((arg) => arg === "--help" || arg === "-h")) {
   process.stdout.write(
-    "Usage: kumiko-build [app-dir]   build client (dist/) and server (dist-server/) bundles\n",
+    "Usage: kumiko-build [--check] [app-dir]   build client (dist/) and server (dist-server/) bundles;\n" +
+      "       --check only verifies .kumiko/ is up to date (exit 1 on drift, writes nothing)\n",
   );
   process.exit(0);
 }
 
-const explicit = process.argv[2];
+const checkCodegenOnly = process.argv.includes("--check");
+const explicit = process.argv.slice(2).find((arg) => !arg.startsWith("-"));
 const cwd = explicit ? resolve(process.cwd(), explicit) : process.cwd();
 
 const red = "\x1b[31m";
 const yellow = "\x1b[33m";
 const reset = "\x1b[0m";
 
+if (checkCodegenOnly) {
+  const drift = runCodegen({ appRoot: cwd, checkOnly: true });
+  for (const w of drift.warnings) {
+    process.stderr.write(`${yellow}!${reset} [codegen] ${formatScanWarning(w)}\n`);
+  }
+  if (drift.didWriteTypes || drift.didWriteDefine || drift.didWriteSchemas) {
+    process.stderr.write(
+      `\n  ${red}✗${reset} .kumiko/ is stale; run kumiko-build or the dev-server and commit.\n\n`,
+    );
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
 try {
   // Read once up front — resolveClientEntries can throw (mutual exclusion,
   // malformed declaration, unmigrated legacy client-*.tsx files) and that

package/dist/codegen/run-codegen.d.ts

@@ -7,6 +7,9 @@ export type CodegenOptions = {
      *  Die Dev-Server-Integration übergibt die QNs direkt aus der gebooteten
      *  Registry — CLI ruft sie aus dem Manifest. */
     readonly handlerQns?: readonly string[];
+    /** Drift check for CI: nothing is written or removed; the `didWrite*` flags
+     *  report which files would have changed. */
+    readonly checkOnly?: boolean;
 };
 export type CodegenResult = {
     readonly outputDir: string;

package/dist/codegen/run-codegen.js

@@ -44,7 +44,9 @@ export function runCodegen(opts) {
             skipped: true,
         };
     }
-    mkdirSync(outputDir, { recursive: true });
+    const checkOnly = opts.checkOnly === true;
+    if (!checkOnly)
+        mkdirSync(outputDir, { recursive: true });
     const typesContent = renderTypesAugmentation(scan.events, outputDir);
     // `opts.handlerQns` undefined means the caller (kumiko-build) has no
     // live feature registry to draw from and relies on the manifest
@@ -82,12 +84,12 @@ export function runCodegen(opts) {
     const finalDefineContent = shouldPreserveStaleBlock
         ? withPreservedBlock(defineContent, definePath, TYPED_DISPATCHER_MARKER, LEGACY_TYPED_DISPATCHER_ANCHOR)
         : defineContent;
-    const didWriteTypes = writeIfChanged(typesPath, finalTypesContent);
-    const didWriteDefine = writeIfChanged(definePath, finalDefineContent);
-    writeIfChanged(packageJsonPath, packageJsonContent);
+    const didWriteTypes = writeIfChanged(typesPath, finalTypesContent, checkOnly);
+    const didWriteDefine = writeIfChanged(definePath, finalDefineContent, checkOnly);
+    writeIfChanged(packageJsonPath, packageJsonContent, checkOnly);
     const didWriteSchemas = schemasContent !== undefined
-        ? writeIfChanged(schemasPath, schemasContent)
-        : removeIfExists(schemasPath);
+        ? writeIfChanged(schemasPath, schemasContent, checkOnly)
+        : removeIfExists(schemasPath, checkOnly);
     const warnings = shouldPreserveStaleBlock
         ? [
             ...scan.warnings,
@@ -144,11 +146,12 @@ function renderKumikoPackageJson() {
  * must NOT trigger a full TS-language-server rebuild (which would
  * happen on every mtime change).
  */
-function writeIfChanged(path, content) {
+function writeIfChanged(path, content, checkOnly) {
     const existing = readExistingOrUndefined(path);
     if (existing === content)
         return false;
-    writeFileSync(path, content, "utf-8");
+    if (!checkOnly)
+        writeFileSync(path, content, "utf-8");
     return true;
 }
 function readExistingOrUndefined(path) {
@@ -192,10 +195,11 @@ function extractBlock(content, anchor) {
  * produces it (e.g. the last inline-schema was refactored to a named
  * export). Returns true when an actual unlink happened.
  */
-function removeIfExists(path) {
+function removeIfExists(path, checkOnly) {
     if (!existsSync(path))
         return false;
-    rmSync(path, { force: true });
+    if (!checkOnly)
+        rmSync(path, { force: true });
     return true;
 }
 const featureManifestSchema = z.object({

package/dist/create-kumiko-server.d.ts

@@ -201,6 +201,7 @@ export type KumikoServerHandle = {
 };
 export declare const STYLESHEET_WATCH_ENV = "KUMIKO_DEV_STYLESHEET_WATCH";
 export declare const PROD_BUNDLES_ENV = "KUMIKO_DEV_PROD_BUNDLES";
+export declare const DEFAULT_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width,initial-scale=1,interactive-widget=resizes-content\" />\n    <title>Kumiko</title>\n  </head>\n  <body>\n    <div id=\"root\"></div>\n    <script type=\"module\" src=\"/client.js\"></script>\n  </body>\n</html>\n";
 type DirectoryWatchEvents = (dir: string, options: {
     readonly recursive: true;
     readonly signal: AbortSignal;

package/dist/create-kumiko-server.js

@@ -20,8 +20,8 @@ import { readFile, realpath, watch } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
-import { buildRequestContextDataFromRequest, createClientIpResolver, generateToken, requestContext, } from "@cosmicdrift/kumiko-framework/api";
-import { buildAppSchema, createAnonymousUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { createClientIpResolver, generateToken, } from "@cosmicdrift/kumiko-framework/api";
+import { buildAppSchema } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { pushEntityProjectionTables, setupTestStack, TestUsers, } from "@cosmicdrift/kumiko-framework/stack";
 import { resolveAndInjectPageHead, } from "@cosmicdrift/kumiko-headless/apex";
@@ -29,6 +29,7 @@ import { startDevJobRunners } from "@cosmicdrift/kumiko-server-runtime/boot/job-
 import { buildBunServeOptions, resolveDerivedMaxRequestBodySize, } from "@cosmicdrift/kumiko-server-runtime/bun-serve-options";
 import { makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
 import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_URL_PREFIX, resolveRendererWebFontsDir, } from "@cosmicdrift/kumiko-server-runtime/renderer-web-fonts";
+import { buildRequestBoundSystemQuery } from "@cosmicdrift/kumiko-server-runtime/request-bound-system-query";
 import { canResolveTailwindStylesheet, resolveTailwindCli, } from "@cosmicdrift/kumiko-server-runtime/resolve-tailwind-cli";
 import { stripNoRouteMatchHeader, tryHonoFirst, } from "@cosmicdrift/kumiko-server-runtime/try-hono-first";
 // Runtime-detection. The dev-server is meant to run under Bun (Kumiko's
@@ -92,7 +93,7 @@ const RELOAD_SNIPPET = `
 // keyboard shrinks only the visual viewport, not the layout viewport that
 // `position: fixed` anchors to — a fixed bottom action bar would stay
 // pinned behind the keyboard instead of above it.
-const DEFAULT_HTML = `<!doctype html>
+export const DEFAULT_HTML = `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
@@ -725,11 +726,12 @@ export async function createKumikoServer(options) {
     // warn-once flags in dev is an accepted, low-risk gap (dev normally
     // runs unproxied — see CreateKumikoServerOptions.trustedProxyHops).
     const pageHeadClientIpResolver = createClientIpResolver(options.trustedProxyHops ?? 0, "createKumikoServer(pageHead)");
-    const buildDevSystemQuery = (req, socketAddress) => (type, payload, tenantId) => requestContext.run(requestContext.get() ??
-        buildRequestContextDataFromRequest(req, {
-            resolver: pageHeadClientIpResolver,
-            socketAddress,
-        }), () => stack.dispatcher.query(type, payload, createAnonymousUser(tenantId)));
+    const buildDevSystemQuery = (req, socketAddress) => buildRequestBoundSystemQuery({
+        req,
+        dispatcher: stack.dispatcher,
+        resolver: pageHeadClientIpResolver,
+        socketAddress,
+    });
     // resolvePageHead goes through the same headless resolveAndInjectPageHead
     // that runProdApp uses, so dev and e2e exercise the one timeout and
     // fallback path instead of a second copy of it (#3026).
@@ -753,6 +755,7 @@ export async function createKumikoServer(options) {
                 path: url.pathname,
                 host,
                 systemQuery: buildDevSystemQuery(req, socketAddress),
+                requestSignal: req.signal,
             });
         }
         return new Response(html, { status, headers });

package/dist/run-dev-app.js

@@ -165,6 +165,7 @@ export async function runDevApp(options) {
             registry: deps.registry,
             hasAuth: false,
             sseBroker: deps.sseBroker,
+            redis: deps.redis,
             crypto: bootCrypto,
             ...(bootLogger && { log: bootLogger }),
         });

package/dist/scaffold-deploy.js

@@ -47,6 +47,12 @@ export function renderDeployFiles(options) {
     // `failed to compute cache key: "/app/seeds": not found`.
     const sourceDir = options.sourceDir ?? destinationRoot;
     const detected = detectOptionalSurfaces(sourceDir, options.appName);
+    if (detected.hasPrivateGhPackages && detected.registryConfigFiles.length === 0) {
+        // The Dockerfile only forwards the auth build-arg; without a registry
+        // config scope entry bun resolves @cosmicdriftgamestudio/* against npmjs
+        // and the image build fails late with a 404.
+        throw new Error(`renderDeployFiles: private @cosmicdriftgamestudio/* deps need a bunfig.toml or .npmrc in ${sourceDir} with a scope entry for the private registry`);
+    }
     const installManifests = ["package.json", "bun.lock", ...detected.registryConfigFiles].join(" ");
     const subs = {
         appName: options.appName,
@@ -198,8 +204,10 @@ function detectOptionalSurfaces(sourceDir, appName) {
     let deployConfigRaw;
     const pkgJsonPath = join(sourceDir, "package.json");
     if (existsSync(pkgJsonPath)) {
+        let jsonParsed = false;
         try {
             const raw = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
+            jsonParsed = true;
             // Read ahead of packageJsonSchema.parse: an unrelated shape problem in
             // `dependencies`/`workspaces` must not silently discard a valid deploy
             // config along with it (that's caught by the outer catch below).
@@ -221,8 +229,12 @@ function detectOptionalSurfaces(sourceDir, appName) {
             // back to defaults (an invalid deploy config must THROW, but
             // unreadable JSON can't distinguish "no deploy config" from "invalid
             // deploy config" — it already surfaces via this warning).
+            const reason = err instanceof Error ? err.message : String(err);
+            const message = jsonParsed
+                ? `scaffoldDeploy: package.json at ${pkgJsonPath} has an unexpected dependencies/workspaces shape — private-GH-packages/install-layout detection skipped (${reason})`
+                : `scaffoldDeploy: package.json at ${pkgJsonPath} is not valid JSON — private-GH-packages/install-layout detection skipped and kumiko.deploy (dbUser/dbName/stackNetwork) falls back to the defaults (${reason})`;
             // biome-ignore lint/suspicious/noConsole: scaffold visibility for skipped private-package detection
-            console.warn(`scaffoldDeploy: package.json at ${pkgJsonPath} is not valid JSON — private-GH-packages/install-layout detection skipped (${err instanceof Error ? err.message : String(err)})`);
+            console.warn(message);
         }
     }
     const registryConfigFiles = REGISTRY_CONFIG_FILES.filter((f) => existsSync(join(sourceDir, f)));

package/dist/scaffold-feature.js

@@ -155,7 +155,7 @@ function starterPatterns() {
             entityName: "item",
             definition: {
                 fields: {
-                    title: { type: "text", required: true },
+                    title: { type: "text", required: true, allowPlaintext: "is_business_data" },
                 },
             },
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.352.0",
+  "version": "0.354.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -64,11 +64,11 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.352.0",
-    "@cosmicdrift/kumiko-framework": "0.352.0",
-    "@cosmicdrift/kumiko-headless": "0.352.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.352.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.352.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.354.0",
+    "@cosmicdrift/kumiko-framework": "0.354.0",
+    "@cosmicdrift/kumiko-headless": "0.354.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.354.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.354.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,21 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "Dev boot passes Redis to the delivery service so notify idempotencyKey dedupes",
+    "migration": "No action needed."
+  },
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "init-deploy fails early when private GitHub packages have no bunfig.toml or .npmrc",
+    "detail": "init-deploy rejects private GitHub packages without a registry config\nAn app with `@cosmicdriftgamestudio/*` dependencies but no `bunfig.toml`/`.npmrc` used to get a Dockerfile whose `bun install` failed with a 404 only inside the image build. `scaffoldDeploy`, `renderDeployFiles` and `checkDeployDrift` now throw with a hint to add the scope entry."
+  },
+  {
+    "version": "0.353.0",
+    "type": "improvement",
+    "title": "Deploy scaffold warnings distinguish broken package.json from unexpected dependency shapes"
+  },
   {
     "version": "0.351.0",
     "type": "fix",