@cosmicdrift/kumiko-dev-server 0.372.0 → 0.374.0

package/bin/kumiko-build.ts

@@ -3,7 +3,8 @@
 //
 //   package.json "kumiko.clientEntries"/"kumiko.clientEntry",
 //     or src/client.tsx | src/styles.css | public/   →  client bundle (dist/)
-//   bin/main.ts                                       →  server bundle (dist-server/)
+//   bin/main.ts                                       →  server bundle (dist-server/,
+//                                                        incl. bun.lock seeded from the app's bun.lock)
 //
 // Both are built when their conventions match, otherwise skipped. A workspace
 // with only bin/main.ts gets just the server bundle, a browser-only sample
@@ -21,7 +22,7 @@
 //   kumiko-build --entry bin/remote-probe.ts
 
 import { existsSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { join, relative, resolve } from "node:path";
 import {
   buildProdBundle,
   buildServerBundle,
@@ -32,6 +33,7 @@ import {
   readClientEntriesConfig,
   readExtraRuntimeExternals,
   resolveClientEntries,
+  writeServerLockfile,
 } from "@cosmicdrift/kumiko-dev-server/cli";
 
 if (process.argv.slice(2).some((arg) => arg === "--help" || arg === "-h")) {
@@ -43,6 +45,7 @@ if (process.argv.slice(2).some((arg) => arg === "--help" || arg === "-h")) {
 
 const red = "\x1b[31m";
 const yellow = "\x1b[33m";
+const dim = "\x1b[2m";
 const reset = "\x1b[0m";
 
 try {
@@ -85,8 +88,13 @@ try {
       ...(buildArgs.extraEntries.length > 0 && { extraEntries: buildArgs.extraEntries }),
     });
     const ms = Math.round(performance.now() - t0);
+    const lock = await writeServerLockfile({ cwd, outDir: result.outDir });
+    const lockLine =
+      lock.mode === "seeded"
+        ? `    ${dim}bun.lock seeded from ${relative(cwd, lock.seedLockfile) || "bun.lock"}${reset}`
+        : `    ${yellow}!${reset} bun.lock resolved fresh – no bun.lock found above ${cwd}`;
     // biome-ignore lint/suspicious/noConsole: CLI-Output, einziger Weg
-    console.log(formatServerBuildResult(result, ms));
+    console.log(`${formatServerBuildResult(result, ms)}\n${lockLine}`);
   }
 } catch (err) {
   // biome-ignore lint/suspicious/noConsole: CLI-Output, einziger Weg

package/dist/build-server-bundle.js

@@ -31,6 +31,7 @@
 //     <basename>.js        ← one per extraEntries path
 //     chunk-*.js           ← geteilte Framework-Chunks
 //     package.json         ← runtime-deps mit gepinnten Versionen
+//     bun.lock             ← written by writeServerLockfile (kumiko-build), not by buildServerBundle
 //
 // Externals — Pakete die NICHT ins Bundle gebakt werden, sondern via
 // `bun install` im Runtime-Container nachgeholt werden:

package/dist/build.d.ts

@@ -1,2 +1,3 @@
 export { ASSETS_DIR, type BuildManifest, type BuildProdBundleOptions, type BuildResult, buildProdBundle, type ClientEntry, type ClientEntryDeclaration, discoverHtmlTemplate, formatBuildResult, injectAssetTags, readClientEntriesConfig, resolveClientEntries, } from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
 export { type BuildServerBundleEntry, type BuildServerBundleOptions, type BuildServerBundleResult, buildServerBundle, discoverServerEntry, formatServerBuildResult, type KumikoBuildArgs, parseKumikoBuildArgs, readExtraRuntimeExternals, } from "./build-server-bundle.ts";
+export { type ServerLockfileResult, type WriteServerLockfileOptions, writeServerLockfile, } from "./write-server-lockfile.ts";

package/dist/build.js

@@ -3,3 +3,4 @@
 // (z.B. wenn drizzle-kit die App-Config unter Node lädt).
 export { ASSETS_DIR, buildProdBundle, discoverHtmlTemplate, formatBuildResult, injectAssetTags, readClientEntriesConfig, resolveClientEntries, } from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
 export { buildServerBundle, discoverServerEntry, formatServerBuildResult, parseKumikoBuildArgs, readExtraRuntimeExternals, } from "./build-server-bundle.js";
+export { writeServerLockfile, } from "./write-server-lockfile.js";

package/dist/cli.d.ts

@@ -1,3 +1,3 @@
-export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildResult, formatServerBuildResult, parseKumikoBuildArgs, readClientEntriesConfig, readExtraRuntimeExternals, resolveClientEntries, } from "./build.ts";
+export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildResult, formatServerBuildResult, parseKumikoBuildArgs, readClientEntriesConfig, readExtraRuntimeExternals, resolveClientEntries, writeServerLockfile, } from "./build.ts";
 export { createCrashTracker } from "./crash-tracker.ts";
 export { runInitDeployCli } from "./init-deploy-cli.ts";

package/dist/cli.js

@@ -2,6 +2,6 @@
 // the package self-reference (`@cosmicdrift/kumiko-dev-server/cli`) so they
 // resolve to src in the workspace and to dist once installed from the
 // tarball, where `src` is not shipped.
-export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildResult, formatServerBuildResult, parseKumikoBuildArgs, readClientEntriesConfig, readExtraRuntimeExternals, resolveClientEntries, } from "./build.js";
+export { buildProdBundle, buildServerBundle, discoverServerEntry, formatBuildResult, formatServerBuildResult, parseKumikoBuildArgs, readClientEntriesConfig, readExtraRuntimeExternals, resolveClientEntries, writeServerLockfile, } from "./build.js";
 export { createCrashTracker } from "./crash-tracker.js";
 export { runInitDeployCli } from "./init-deploy-cli.js";

package/dist/write-server-lockfile.d.ts

@@ -0,0 +1,15 @@
+export type WriteServerLockfileOptions = {
+    /** App directory: the search for a seed bun.lock starts here and walks up. */
+    readonly cwd: string;
+    /** Server bundle directory holding the generated package.json. */
+    readonly outDir: string;
+};
+export type ServerLockfileResult = {
+    readonly lockfile: string;
+} & ({
+    readonly mode: "seeded";
+    readonly seedLockfile: string;
+} | {
+    readonly mode: "resolved";
+});
+export declare function writeServerLockfile(options: WriteServerLockfileOptions): Promise<ServerLockfileResult>;

package/dist/write-server-lockfile.js

@@ -0,0 +1,47 @@
+// Pins dist-server/ to the dependency versions the app was tested with. The runtime image
+// installs from dist-server/package.json, whose ranges alone resolve to whatever is newest
+// on the registry at image-build time. Seeding the app's bun.lock keeps already-locked
+// packages at their locked versions; packages the app lock does not carry resolve fresh.
+import { existsSync } from "node:fs";
+import { copyFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+function findSeedLockfile(startDir) {
+    let dir = resolve(startDir);
+    for (;;) {
+        const candidate = join(dir, "bun.lock");
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+export async function writeServerLockfile(options) {
+    const outDir = resolve(options.outDir);
+    const lockfile = join(outDir, "bun.lock");
+    const seedLockfile = findSeedLockfile(options.cwd);
+    if (seedLockfile !== undefined)
+        await copyFile(seedLockfile, lockfile);
+    // process.execPath: the lock format has to match the Bun that built the bundle.
+    const install = Bun.spawn({
+        cmd: [process.execPath, "install", "--lockfile-only"],
+        cwd: outDir,
+        stdout: "pipe",
+        stderr: "pipe",
+    });
+    const [exitCode, stdout, stderr] = await Promise.all([
+        install.exited,
+        new Response(install.stdout).text(),
+        new Response(install.stderr).text(),
+    ]);
+    if (exitCode !== 0) {
+        throw new Error(`bun install --lockfile-only failed in ${outDir} (exit ${exitCode}); shipping dist-server without a lockfile would leave runtime versions unpinned.\n${stderr.trim() || stdout.trim()}`);
+    }
+    if (!existsSync(lockfile)) {
+        throw new Error(`bun install --lockfile-only did not write ${lockfile}`);
+    }
+    return seedLockfile === undefined
+        ? { mode: "resolved", lockfile }
+        : { mode: "seeded", seedLockfile, lockfile };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.372.0",
+  "version": "0.374.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -72,14 +72,14 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.372.0",
-    "@cosmicdrift/kumiko-framework": "0.372.0",
-    "@cosmicdrift/kumiko-headless": "0.372.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.372.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.372.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.372.0",
-    "@cosmicdrift/kumiko-testing": "0.372.0",
-    "@cosmicdrift/kumiko-types": "0.372.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.374.0",
+    "@cosmicdrift/kumiko-framework": "0.374.0",
+    "@cosmicdrift/kumiko-headless": "0.374.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.374.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.374.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.374.0",
+    "@cosmicdrift/kumiko-testing": "0.374.0",
+    "@cosmicdrift/kumiko-types": "0.374.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.373.0",
+    "type": "improvement",
+    "title": "kumiko-build pins dist-server dependencies with a bun.lock seeded from the app's bun.lock",
+    "detail": "The lock is written by writeServerLockfile after the bundle build and needs network or a warm Bun cache. The scaffolded Dockerfile runs bun install --production --frozen-lockfile in the runtime stage.",
+    "migration": "Apps with their own Dockerfile should run `bun install --production --frozen-lockfile` in dist-server instead of `bun install --production`."
+  },
   {
     "version": "0.372.0",
     "type": "improvement",

package/templates/deploy/Dockerfile.template

@@ -60,10 +60,11 @@ WORKDIR /app
 
 RUN addgroup -S app && adduser -S app -G app
 
-# Server bundle + its minimal package.json. `bun install --production`
-# only pulls the actual externals.
+# Server bundle + its minimal package.json and the bun.lock kumiko-build wrote
+# next to it. `--frozen-lockfile` installs exactly the locked externals and
+# fails on drift instead of resolving newer versions.
 COPY --from=build --chown=app:app /app/dist-server ./
-RUN bun install --production
+RUN bun install --production --frozen-lockfile
 
 # Client build (static assets) — served by runProdApp.staticDir.
 COPY --from=build --chown=app:app /app/dist ./dist