@cosmicdrift/kumiko-dev-server 0.373.0 → 0.377.0

package/templates/managed/ci-public.yml.template

@@ -0,0 +1,134 @@
+# CI for {{appName}}: a public repo cannot call the private reusable workflows in
+# cosmicdriftgamestudio/infra, so every job here is self-contained on GitHub-hosted
+# runners. The rollout is manual: see release.yml. Jobs only this app needs: name
+# them `app-<name>` in this file (they survive `kumiko sync-managed`).
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  HUSKY: "0"
+
+jobs:
+  test:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.4.0"
+      - run: bun install --frozen-lockfile
+      - run: bun run typecheck
+      - run: bun run lint
+      - run: bun kumiko check
+      - name: Schema + boot validate
+        env:
+          FILE_STORAGE_PROVIDER: "inmemory"
+        run: bun kumiko-schema validate
+{{#uiGuards}}
+      - name: UI guards
+        run: bun kumiko-guards ui
+{{/uiGuards}}
+      - run: bun run test
+
+  integration:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    services:
+      postgres:
+        image: postgres:18.4-alpine
+        env:
+          POSTGRES_USER: kumiko
+          POSTGRES_PASSWORD: kumiko
+          POSTGRES_DB: kumiko_dev
+        ports:
+          - 15432:5432
+        options: >-
+          --health-cmd "pg_isready -U kumiko -d kumiko_dev"
+          --health-interval 2s --health-timeout 3s --health-retries 30
+      redis:
+        image: redis:8-alpine
+        ports:
+          - 16379:6379
+{{#meilisearch}}
+      meilisearch:
+        image: getmeili/meilisearch:v1.12
+        env:
+          MEILI_MASTER_KEY: kumiko-dev-key
+          MEILI_ENV: development
+        ports:
+          - 17700:7700
+{{/meilisearch}}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.4.0"
+      - run: bun install --frozen-lockfile
+      - name: Create test database
+        env:
+          PGPASSWORD: kumiko
+        run: psql -h localhost -p 15432 -U kumiko -d kumiko_dev -c "CREATE DATABASE kumiko_test;"
+      - name: Run integration tests
+        env:
+          NODE_ENV: test
+          KUMIKO_INSTANCE_ID: test-instance
+          DATABASE_URL: postgresql://kumiko:kumiko@localhost:15432/kumiko_dev
+          TEST_DATABASE_URL: postgresql://kumiko:kumiko@localhost:15432/kumiko_test
+          REDIS_URL: redis://localhost:16379
+          JWT_SECRET: testtesttesttesttesttesttesttest
+        run: bun run test:integration
+
+  # Build on main only; the rollout runs through the manual release workflow.
+  build:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-26.04-arm
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/cosmicdriftgamestudio/{{appName}}
+          tags: |
+            type=raw,value=latest
+            type=sha,prefix=sha-,format=short
+      - uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: deploy/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/arm64
+          build-args: |
+            BUILD_VERSION=${{ github.sha }}

package/templates/managed/ci.yml.template

@@ -1,6 +1,6 @@
 # CI for {{appName}}: a thin orchestrator over the reusable workflows in
-# cosmicdriftgamestudio/infra. Jobs only this app needs go into an unmanaged
-# workflow next to this one (e.g. ci-extra.yml).
+# cosmicdriftgamestudio/infra. Jobs only this app needs: name them `app-<name>`
+# in this file (they survive `kumiko sync-managed`) or use an unmanaged workflow.
 
 name: CI
 
@@ -19,16 +19,19 @@ env:
 
 jobs:
   test:
-    uses: cosmicdriftgamestudio/infra/.github/workflows/_app-test.yml@main
+    uses: cosmicdriftgamestudio/infra/.github/workflows/_app-test.yml@{{infraRef}}
     with:
       ui-guards: {{uiGuards}}
       # The boot gate in kumiko-schema validate demands a provider for file
       # fields; CI only checks that one is configured.
       file-storage-provider: "inmemory"
+{{#docStatusGuardOff}}
+      doc-status-guard: false
+{{/docStatusGuardOff}}
     secrets: inherit
 
   integration:
-    uses: cosmicdriftgamestudio/infra/.github/workflows/_app-integration.yml@main
+    uses: cosmicdriftgamestudio/infra/.github/workflows/_app-integration.yml@{{infraRef}}
 {{#minio}}
     with:
       minio: true
@@ -39,7 +42,7 @@ jobs:
   # otherwise never report and block the merge.
   e2e:
     if: contains(fromJSON('["pull_request","merge_group"]'), github.event_name)
-    uses: cosmicdriftgamestudio/infra/.github/workflows/_app-e2e.yml@main
+    uses: cosmicdriftgamestudio/infra/.github/workflows/_app-e2e.yml@{{infraRef}}
 {{#e2eInputs}}
     with:
 {{/e2eInputs}}
@@ -58,7 +61,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: cosmicdriftgamestudio/infra/.github/workflows/_docker-build-push.yml@main
+    uses: cosmicdriftgamestudio/infra/.github/workflows/_docker-build-push.yml@{{infraRef}}
     with:
       image-name: {{appName}}
       dockerfile: deploy/Dockerfile

package/templates/managed/husky-pre-push.template

@@ -1,10 +1,4 @@
 #!/usr/bin/env sh
-# PRE_PUSH_SKIP is checked here too so the bypass works even without node_modules.
-if [ "${PRE_PUSH_SKIP:-0}" = "1" ]; then
-  echo "[pre-push] PRE_PUSH_SKIP=1 — hook skipped"
-  exit 0
-fi
-
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 if [ -z "$REPO_ROOT" ]; then
   echo "[pre-push] FATAL: git rev-parse --show-toplevel failed — refusing push" >&2
@@ -33,7 +27,7 @@ done
 
 if [ -z "$BIN" ]; then
   echo "[pre-push] kumiko-pre-push not found in any node_modules/.bin above $REPO_ROOT." >&2
-  echo "Run \`bun install\`, or set PRE_PUSH_SKIP=1 to bypass this hook." >&2
+  echo "Run \`bun install\`." >&2
   exit 1
 fi
 

package/templates/managed/kumiko-schema.ts.template

@@ -5,9 +5,24 @@
 import { allAppFeatures } from "@cosmicdrift/kumiko-framework/config";
 import { collectTableMetas, type EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import appConfig from "../kumiko.config";
 
-export const FEATURES: readonly FeatureDefinition[] = allAppFeatures(appConfig);
+const CONFIGURED_FEATURES = allAppFeatures(appConfig);
+
+// Auth apps mount config/user/tenant/auth-email-password through composeFeatures at boot;
+// without them here the generated schema would miss their tables. Composing an already
+// composed list is a no-op (app-side duplicates of bundled names are dropped).
+// kumiko.config.ts `includeBundled` wins; otherwise an auth-foundation or sessions feature marks an auth app.
+const HAS_AUTH =
+  appConfig.includeBundled ??
+  CONFIGURED_FEATURES.some(
+    (feature) => feature.name === "auth-foundation" || feature.name === "sessions",
+  );
+
+export const FEATURES: readonly FeatureDefinition[] = composeFeatures([...CONFIGURED_FEATURES], {
+  includeBundled: HAS_AUTH,
+});
 
 // `kumiko check` validates the boot with the options kumiko.config.ts declares.
 export const VALIDATE_BOOT_OPTIONS = appConfig.validateBootOptions;

package/templates/managed/release.yml.template

@@ -44,12 +44,28 @@ jobs:
             exit 1
           fi
 
+{{#privateDeploy}}
   deploy:
     needs: verify
-    uses: cosmicdriftgamestudio/infra/.github/workflows/_app-deploy.yml@main
+    uses: cosmicdriftgamestudio/infra/.github/workflows/_app-deploy.yml@{{infraRef}}
     with:
       namespace: {{namespace}}
       deployment: {{deployment}}
       image-name: {{appName}}
       git_sha: ${{ inputs.sha }}
     secrets: inherit
+{{/privateDeploy}}
+{{#publicRollout}}
+  # A public repo cannot call the private infra workflows; the rollout runs from infra.
+  rollout-hint:
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Print rollout command
+        env:
+          SHA: ${{ inputs.sha }}
+        run: |
+          echo "SHA verified. Roll out from a machine with access to the infra repo:"
+          echo "gh workflow run public-app-rollout.yml --repo cosmicdriftgamestudio/infra -f app={{appName}} -f git_sha=$SHA"
+{{/publicRollout}}

package/dist/managed-files/port-registry.d.ts

@@ -1,17 +0,0 @@
-import { type AppPortRole } from "@cosmicdrift/kumiko-framework/config";
-import { type StaticAppConfig } from "./static-app-config.ts";
-export type ScannedApp = {
-    readonly app: string;
-    readonly config: StaticAppConfig;
-};
-export type PortClaim = {
-    readonly app: string;
-    readonly role: AppPortRole;
-};
-export type PortCollision = {
-    readonly port: number;
-    readonly claims: readonly PortClaim[];
-};
-/** Direct children of `root` with a kumiko.config.ts; worktrees and dot-dirs are skipped. */
-export declare function scanWorkspaceApps(root: string): readonly ScannedApp[];
-export declare function findPortCollisions(apps: readonly ScannedApp[]): readonly PortCollision[];

package/dist/managed-files/port-registry.js

@@ -1,31 +0,0 @@
-// Port registry across the apps of a workspace: every app declares its ports
-// in kumiko.config.ts, and two apps (or two roles of one app) must never claim
-// the same port, otherwise their local dev and E2E runs block each other.
-import { existsSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { APP_CONFIG_FILE, listAppPorts, } from "@cosmicdrift/kumiko-framework/config";
-import { readStaticAppConfig } from "./static-app-config.js";
-/** Direct children of `root` with a kumiko.config.ts; worktrees and dot-dirs are skipped. */
-export function scanWorkspaceApps(root) {
-    return readdirSync(root, { withFileTypes: true })
-        .filter((entry) => entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules")
-        .filter((entry) => existsSync(join(root, entry.name, APP_CONFIG_FILE)))
-        .map((entry) => ({ app: entry.name, config: readStaticAppConfig(join(root, entry.name)) }))
-        .sort((a, b) => a.app.localeCompare(b.app));
-}
-export function findPortCollisions(apps) {
-    const claimsByPort = new Map();
-    for (const { app, config } of apps) {
-        if (config.kind !== "defined")
-            continue;
-        for (const { role, port } of listAppPorts(config.ports)) {
-            const claims = claimsByPort.get(port) ?? [];
-            claims.push({ app, role });
-            claimsByPort.set(port, claims);
-        }
-    }
-    return [...claimsByPort.entries()]
-        .filter(([, claims]) => claims.length > 1)
-        .map(([port, claims]) => ({ port, claims }))
-        .sort((a, b) => a.port - b.port);
-}

package/dist/managed-files/static-app-config.d.ts

@@ -1,16 +0,0 @@
-import { type AppPorts } from "@cosmicdrift/kumiko-framework/config";
-export type StaticAppConfig = {
-    readonly kind: "missing";
-}
-/** A config without defineAppConfig: the app has not adopted the standard yet. */
- | {
-    readonly kind: "legacy";
-} | {
-    readonly kind: "invalid";
-    readonly message: string;
-} | {
-    readonly kind: "defined";
-    readonly ports: AppPorts;
-};
-export declare function parseStaticAppConfig(source: string): StaticAppConfig;
-export declare function readStaticAppConfig(appRoot: string): StaticAppConfig;

package/dist/managed-files/static-app-config.js

@@ -1,99 +0,0 @@
-// Reads the ports out of kumiko.config.ts without importing it: importing
-// would execute every feature module of the app, and the port registry scans
-// sibling apps whose dependencies may not even be installed.
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { APP_CONFIG_FILE, findAppPortProblems, } from "@cosmicdrift/kumiko-framework/config";
-import { Project, SyntaxKind } from "ts-morph";
-const INFRA_KEYS = [
-    "postgres",
-    "redis",
-    "meilisearch",
-    "s3",
-];
-function isInfraKey(name) {
-    return INFRA_KEYS.some((key) => key === name);
-}
-class StaticConfigError extends Error {
-}
-function propertyName(node) {
-    if (node.isKind(SyntaxKind.PropertyAssignment))
-        return node.getName().replace(/^["']|["']$/g, "");
-    return undefined;
-}
-function objectProperty(object, name) {
-    for (const property of object.getProperties()) {
-        if (property.isKind(SyntaxKind.SpreadAssignment) ||
-            property.isKind(SyntaxKind.ShorthandPropertyAssignment)) {
-            throw new StaticConfigError(`${name}: spread and shorthand properties cannot be read statically`);
-        }
-        if (propertyName(property) === name && property.isKind(SyntaxKind.PropertyAssignment)) {
-            return property.getInitializerOrThrow();
-        }
-    }
-    return undefined;
-}
-function numericLiteral(node, path) {
-    if (node === undefined)
-        throw new StaticConfigError(`${path} is missing`);
-    if (!node.isKind(SyntaxKind.NumericLiteral)) {
-        throw new StaticConfigError(`${path} must be a number literal so tooling can read it, got "${node.getText()}"`);
-    }
-    return node.getLiteralValue();
-}
-function objectLiteral(node, path) {
-    if (node === undefined)
-        throw new StaticConfigError(`${path} is missing`);
-    if (!node.isKind(SyntaxKind.ObjectLiteralExpression)) {
-        throw new StaticConfigError(`${path} must be an object literal, got "${node.getText()}"`);
-    }
-    return node;
-}
-function readInfraPorts(node) {
-    if (node === undefined)
-        return undefined;
-    const object = objectLiteral(node, "ports.infra");
-    const infra = {};
-    for (const property of object.getProperties()) {
-        const name = propertyName(property);
-        if (name === undefined || !isInfraKey(name)) {
-            throw new StaticConfigError(`ports.infra: unknown entry "${property.getText()}", expected ${INFRA_KEYS.join(", ")}`);
-        }
-        infra[name] = numericLiteral(objectProperty(object, name), `ports.infra.${name}`);
-    }
-    return infra;
-}
-export function parseStaticAppConfig(source) {
-    const project = new Project({ useInMemoryFileSystem: true, skipFileDependencyResolution: true });
-    const file = project.createSourceFile(APP_CONFIG_FILE, source);
-    const call = file
-        .getDescendantsOfKind(SyntaxKind.CallExpression)
-        .find((candidate) => candidate.getExpression().getText() === "defineAppConfig");
-    if (call === undefined)
-        return { kind: "legacy" };
-    try {
-        const config = objectLiteral(call.getArguments()[0], "defineAppConfig argument");
-        const ports = objectLiteral(objectProperty(config, "ports"), "ports");
-        const infra = readInfraPorts(objectProperty(ports, "infra"));
-        const parsed = {
-            dev: numericLiteral(objectProperty(ports, "dev"), "ports.dev"),
-            e2e: numericLiteral(objectProperty(ports, "e2e"), "ports.e2e"),
-            ...(infra === undefined ? {} : { infra }),
-        };
-        const problems = findAppPortProblems(parsed);
-        if (problems.length > 0)
-            return { kind: "invalid", message: problems.join("; ") };
-        return { kind: "defined", ports: parsed };
-    }
-    catch (error) {
-        if (error instanceof StaticConfigError)
-            return { kind: "invalid", message: error.message };
-        throw error;
-    }
-}
-export function readStaticAppConfig(appRoot) {
-    const path = join(appRoot, APP_CONFIG_FILE);
-    if (!existsSync(path))
-        return { kind: "missing" };
-    return parseStaticAppConfig(readFileSync(path, "utf-8"));
-}