@cosmicdrift/kumiko-dev-server 0.386.0 → 0.388.0

package/dist/scaffold-app.js

@@ -192,12 +192,10 @@ const FOUNDATION_FEATURES = [
         callExpression: "createSessionsFeature()",
     },
 ];
-// composeFeatures({ includeBundled: true }) auto-mountet diese 4 Foundation-
-// Features. Sie hier nochmal in APP_FEATURES zu schreiben löste den dedupe-
-// warn-Spam im scaffolded `bun dev` aus (PR #599 hat den createRegistry-
-// Crash gefangen, der Spam blieb bis hier). Filter wirkt defensiv: auch wenn
-// jemand scaffoldApp() direkt mit allen Bundled-Feature-Entries aufruft
-// rutschen die 4 nicht in run-config.ts.
+// composeFeatures({ includeBundled: true }) auto-mounts these four foundation features.
+// Listing them again in APP_FEATURES caused duplicate-registration warnings in
+// scaffolded `bun dev`; filtering also protects direct scaffoldApp() calls that
+// pass all bundled-feature entries, keeping these four out of run-config.ts.
 const COMPOSE_AUTO_MOUNTED_NAMES = new Set(["config", "user", "tenant", "auth-email-password"]);
 const MAX_LINE_WIDTH = 100;
 // Mirrors Biome's import sort so generated files pass `biome check` untouched:
@@ -367,7 +365,7 @@ function renderMain(appName) {
         'displayName: "Admin",',
     ]);
     // Subject-key KMS is optional locally (plaintext + loud warning) but required
-    // under NODE_ENV=production (fw#2317 / #2339).
+    // under NODE_ENV=production.
     return `// Production-bootstrap. KUMIKO_DRY_RUN_ENV=boot exits after
 // composeFeatures + validateBoot + createRegistry without DB/Redis-connect
 // (see @cosmicdrift/kumiko-server-runtime runProdApp).

package/dist/schema-apply.d.ts

@@ -1,10 +1,10 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { type ComposeFeaturesOptions } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 export type SchemaApplyOptions = ComposeFeaturesOptions & {
-    /** App-Features (z.B. APP_FEATURES aus run-config) — composed mit den
-     *  bundled-Features für den Projection-Rebuild-Registry. */
+    /** App features (e.g. APP_FEATURES from run-config), composed with the
+     * bundled features for the projection rebuild registry. */
     readonly features: readonly FeatureDefinition[];
-    /** Default INIT_CWD ?? process.cwd(); Migrations unter <appCwd>/kumiko/migrations. */
+    /** Default INIT_CWD ?? process.cwd(); migrations live under <appCwd>/kumiko/migrations. */
     readonly appCwd?: string;
 };
 export declare function runSchemaApply(opts: SchemaApplyOptions): Promise<number>;

package/dist/schema-apply.js

@@ -1,10 +1,10 @@
-// Standalone `kumiko schema apply` für Production-Bundles. Apps bündeln ein
-// dünnes bin/kumiko.ts das nur runStandaloneSchemaCli mit den App-Features
-// aufruft — die ganze Orchestrierung (Infra-Bootstrap, Migrations,
-// Projection-Rebuild) lebt hier statt als ~100-Zeilen-Boilerplate pro App.
+// Standalone `kumiko schema apply` for production bundles. Apps bundle a thin
+// bin/kumiko.ts that only calls runStandaloneSchemaCli with the app features;
+// all orchestration (infrastructure bootstrap, migrations, projection rebuild)
+// lives here instead of being repeated as ~100 lines of boilerplate per app.
 //
-// Der Pulumi-migrate-initContainer ruft `bun /app/kumiko.js schema apply`;
-// kumiko-build entdeckt das App-bin via findRepoRoot() und bündelt es.
+// The Pulumi-migrate-initContainer calls `bun /app/kumiko.js schema apply`;
+// kumiko-build discovers the app bin via findRepoRoot() and bundles it.
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { createDbConnection, runMigrationsFromDir } from "@cosmicdrift/kumiko-framework/db";
@@ -22,21 +22,21 @@ export async function runSchemaApply(opts) {
     const appCwd = opts.appCwd ?? process.env["INIT_CWD"] ?? process.cwd();
     const migrationsDir = join(appCwd, "kumiko/migrations");
     if (!existsSync(migrationsDir)) {
-        console.error(`\n  ${migrationsDir} fehlt — kumiko/migrations/ muss im Image liegen.\n`);
+        console.error(`\n  ${migrationsDir} is missing — kumiko/migrations/ must be part of the image.\n`);
         return 1;
     }
     const { db, close } = createDbConnection({ url: dbUrl });
     try {
-        // Infra-Tabellen (event-store + pipeline-state) zuerst, alle
-        // tableExists-gated idempotent: auf einer Bestands-DB no-op, auf einer
-        // leeren Greenfield-DB legen sie kumiko_events/_consumers/_projections an
-        // bevor die App-Migrations dagegen laufen. Ohne das bricht eine leere DB
-        // (z.B. cashcolt auf frischem CNPG) an `relation "kumiko_events" does not exist`.
-        console.log("\n  Lege Framework-Infra-Tabellen an (idempotent)…");
+        // Create infrastructure tables (event store + pipeline state) first; all are
+        // tableExists-gated and idempotent: on an existing DB this is a no-op, while
+        // on an empty Greenfield DB they create kumiko_events/_consumers/_projections
+        // before the app migrations run. Without this, an empty DB (e.g. cashcolt
+        // on a fresh CNPG) fails with `relation "kumiko_events" does not exist`.
+        console.log("\n  Creating framework infrastructure tables (idempotent)…");
         await createEventsTable(db);
         await createEventConsumerStateTable(db);
         await createProjectionStateTable(db);
-        console.log(`  Wende kumiko-Migrations an (${migrationsDir})…`);
+        console.log(`  Applying kumiko migrations (${migrationsDir})…`);
         const result = await runMigrationsFromDir(db, migrationsDir);
         if (result.applied.length === 0) {
             console.log(`\n  ✓ All ${result.skipped.length} migrations already applied.\n`);
@@ -52,7 +52,7 @@ export async function runSchemaApply(opts) {
         // Projection rebuild: persistent queue instead of "only this run's
         // result.applied" — otherwise a failed rebuild stays silently stuck
         // forever, since the migration is already tracked applied and gets
-        // skipped on the next apply (#2464). queueRebuildsFromMarkers persists
+        // skipped on the next apply. queueRebuildsFromMarkers persists
         // the marker tables BEFORE the rebuild; runPendingRebuilds unconditionally
         // also picks up open entries from earlier, failed runs — not just the
         // ones this run freshly applied.
@@ -79,6 +79,6 @@ export async function runStandaloneSchemaCli(opts) {
     if (cmd === "schema" && sub === "apply") {
         process.exit(await runSchemaApply(opts));
     }
-    console.error(`\n  Unbekannt: kumiko ${cmd ?? ""} ${sub ?? ""}\n  Nur 'kumiko schema apply' im Standalone-Bundle.\n`);
+    console.error(`\n  Unknown command: kumiko ${cmd ?? ""} ${sub ?? ""}\n  The standalone bundle only supports 'kumiko schema apply'.\n`);
     process.exit(1);
 }

package/dist/schema-tables-auth-mode.js

@@ -1,24 +1,25 @@
-// Drizzle-Schema-Barrel: Framework-Infrastruktur-Tables.
+// Drizzle schema barrel: framework infrastructure tables.
 //
-// Re-exportiert die Framework-eigenen Tables (Event-Store + Pipeline-State)
-// die jede App in der DB haben muss. App-Author schreibt:
+// Re-exports the framework-owned tables (event store + pipeline state)
+// that every app must have in its database. The app author writes:
 //
 //   // drizzle/schema.ts
 //   export * from "@cosmicdrift/kumiko-dev-server/drizzle-tables-auth-mode";
-//   export * from "./schema.generated";   // App-eigene + Bundle-Entity-Tables
+//   export * from "./schema.generated";   // App-owned + bundle entity tables
 //
-// drizzle-kit sucht im schema-Module nur nach pgTable-Instances und
-// ignoriert alle anderen exports — `export *` ist hier sicher.
+// drizzle-kit only looks for pgTable instances in the schema module and
+// ignores all other exports — `export *` is safe here.
 //
-// Bundle-Entity-Tables (configValuesTable, tenantTable, userTable,
-// userSessionTable, tenantMembershipsTable etc.) sind bewusst NICHT hier:
-// sie kommen über schema.generated.ts via buildEntityTable aus den
-// r.entity()-Definitionen, das ist seit der entity.indexes-API die
-// Single-Source-of-Truth. Doppelte Re-Exports würden zwei pgTable-
-// Instances mit identischem Index-Namen erzeugen — drizzle-kit warnt.
+// Bundle entity tables (configValuesTable, tenantTable, userTable,
+// userSessionTable, tenantMembershipsTable, etc.) are intentionally NOT here:
+// they come through schema.generated.ts via buildEntityTable from the
+// r.entity() definitions, which has been the single source of truth since the
+// entity.indexes API. Duplicate re-exports would create two pgTable instances
+// with identical index names, causing a drizzle-kit warning.
 //
-// (Datei-Name "auth-mode" ist historisch — heute ist der Inhalt reine
-// Framework-Infra. Umbenennen ist breaking change für App-Imports.)
-// Framework-Infra (immer da, unabhängig von Features)
+// The file name "auth-mode" is historical — its contents are now purely
+// framework infrastructure. Renaming it would be a breaking change for app
+// imports.
+// Framework infrastructure (always present, regardless of features)
 export { archivedStreamsTable, eventsTable, snapshotsTable, } from "@cosmicdrift/kumiko-framework/event-store";
 export { eventConsumerStateTable, projectionStateTable, } from "@cosmicdrift/kumiko-framework/pipeline";

package/dist/schema-tables-minimal.js

@@ -1,13 +1,13 @@
-// Drizzle-Schema-Barrel: Minimal (nur Framework-Infra, kein Auth).
+// Minimal Drizzle schema barrel (framework infrastructure only, no auth).
 //
-// Apps OHNE Auth-Stack (anonymous-only, embedded Demos, Headless-APIs)
-// brauchen nur die Framework-Infrastructure-Tables — Event-Store +
-// Pipeline-State. Verwendung in drizzle/schema.ts:
+// Apps WITHOUT an auth stack (anonymous-only, embedded demos, headless APIs)
+// need only the framework infrastructure tables — event store and
+// pipeline state. Use in drizzle/schema.ts:
 //
 //   export * from "@cosmicdrift/kumiko-dev-server/drizzle-tables-minimal";
-//   export * from "./schema.generated";   // App-eigene Entity-Tables
+//   export * from "./schema.generated";   // App-specific entity tables
 //
-// Wer Auth-Tables will, nutzt drizzle-tables-auth-mode (umfasst Minimal
-// plus Bundle-Tables für Config, Tenant, User, Sessions).
+// To include auth tables, use drizzle-tables-auth-mode (includes Minimal
+// plus bundle tables for config, tenant, user, and sessions).
 export { archivedStreamsTable, eventsTable, snapshotsTable, upcasterDeadLetterTable, } from "@cosmicdrift/kumiko-framework/event-store";
 export { eventConsumerStateTable, projectionStateTable, } from "@cosmicdrift/kumiko-framework/pipeline";

package/dist/setup-test-stack-from-features.js

@@ -25,7 +25,7 @@ export function mergeExtraContext(base, presets) {
         const fromBase = typeof base === "function" ? base(deps) : base !== undefined ? { ...base } : {};
         const merged = { ...fromBase };
         if (presets.includes("config")) {
-            // Same precedence as mergeConfigResolverDefault (run-dev-app.ts) — a base-supplied resolver wins, factory always derives from it (fw#3313).
+            // Same precedence as mergeConfigResolverDefault (run-dev-app.ts) — a base-supplied resolver wins, factory always derives from it.
             const configResolver = resolveBaseConfigResolver(fromBase) ?? createConfigResolver();
             Object.assign(merged, addConfigAccessorFactory({ configResolver }, deps.registry));
         }

package/dist/welcome-banner.js

@@ -1,8 +1,8 @@
 // First-run welcome banner for `runDevApp({ welcomeBanner: true })`.
 // Opt-in only — `bun dev` should not normalize this for apps that
 // already log their own startup. Scaffolded apps (create-kumiko-app)
-// flip it on so the first `bun dev` doesn't end on "Server läuft" with
-// the user wondering where to click.
+// flip it on so the first `bun dev` doesn't end on a bare "server running"
+// line with the user wondering where to click.
 export function renderWelcomeBanner(input) {
     const featuresDir = input.featuresDir ?? "src/features/";
     const docsUrl = input.docsUrl ?? "https://docs.kumiko.rocks/quickstart";

package/dist/write-server-lockfile.js

@@ -17,29 +17,36 @@ function findSeedLockfile(startDir) {
         dir = parent;
     }
 }
-export async function writeServerLockfile(options) {
-    const outDir = resolve(options.outDir);
-    const lockfile = join(outDir, "bun.lock");
-    const seedLockfile = findSeedLockfile(options.cwd);
-    if (seedLockfile !== undefined)
-        await copyFile(seedLockfile, lockfile);
+async function runBun(args, cwd) {
     // process.execPath: the lock format has to match the Bun that built the bundle.
-    const install = Bun.spawn({
-        cmd: [process.execPath, "install", "--lockfile-only"],
-        cwd: outDir,
+    const proc = Bun.spawn({
+        cmd: [process.execPath, ...args],
+        cwd,
         stdout: "pipe",
         stderr: "pipe",
     });
     const [exitCode, stdout, stderr] = await Promise.all([
-        install.exited,
-        new Response(install.stdout).text(),
-        new Response(install.stderr).text(),
+        proc.exited,
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
     ]);
-    if (exitCode !== 0) {
-        throw new Error(`bun install --lockfile-only failed in ${outDir} (exit ${exitCode}); shipping dist-server without a lockfile would leave runtime versions unpinned.\n${stderr.trim() || stdout.trim()}`);
+    return { exitCode, output: stderr.trim() || stdout.trim() };
+}
+export async function writeServerLockfile(options) {
+    const outDir = resolve(options.outDir);
+    const lockfile = join(outDir, "bun.lock");
+    const seedLockfile = findSeedLockfile(options.cwd);
+    if (seedLockfile !== undefined)
+        await copyFile(seedLockfile, lockfile);
+    const install = await runBun(["install", "--lockfile-only"], outDir);
+    if (install.exitCode !== 0) {
+        throw new Error(`bun install --lockfile-only failed in ${outDir} (exit ${install.exitCode}); shipping dist-server without a lockfile would leave runtime versions unpinned.\n${install.output}`);
     }
-    if (!existsSync(lockfile)) {
-        throw new Error(`bun install --lockfile-only did not write ${lockfile}`);
+    // A seeded copy exists before the install, so file presence proves nothing: replay the
+    // runtime stage's frozen install to catch a lock that never re-resolved for this package.json.
+    const frozen = await runBun(["install", "--production", "--frozen-lockfile", "--lockfile-only"], outDir);
+    if (frozen.exitCode !== 0) {
+        throw new Error(`${lockfile} does not satisfy ${join(outDir, "package.json")} (frozen install exit ${frozen.exitCode}); the runtime image build would fail.\n${frozen.output}`);
     }
     return seedLockfile === undefined
         ? { mode: "resolved", lockfile }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.386.0",
+  "version": "0.388.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
-  "license": "BUSL-1.1",
+  "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
     "type": "git",
@@ -77,14 +77,14 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.386.0",
-    "@cosmicdrift/kumiko-framework": "0.386.0",
-    "@cosmicdrift/kumiko-renderer": "0.386.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.386.0",
-    "@cosmicdrift/kumiko-guards": "0.386.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.386.0",
-    "@cosmicdrift/kumiko-testing": "0.386.0",
-    "@cosmicdrift/kumiko-types": "0.386.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.388.0",
+    "@cosmicdrift/kumiko-framework": "0.388.0",
+    "@cosmicdrift/kumiko-renderer": "0.388.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
+    "@cosmicdrift/kumiko-guards": "0.388.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.388.0",
+    "@cosmicdrift/kumiko-testing": "0.388.0",
+    "@cosmicdrift/kumiko-types": "0.388.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,34 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "English buildServerBundle errors",
+    "detail": "The errors for a missing bin/main.ts and a missing bin/kumiko.ts in buildServerBundle are now English."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Named boot phases for the dev server",
+    "detail": "createKumikoServer now reads as a list of phases: client bundles, Tailwind stylesheet, HTML templates, stack boot, background runners, fetch handler, HTTP server, shutdown, file watchers and signal handlers. Each phase lives in its own create-kumiko-server-*.ts file. Request routing is a route table instead of one if chain, and the file watcher classifies changes through suffix and directory tables. Responses, headers, cookies, the reload stream, log lines, exit codes and the start and stop order stay the same. PROD_BUNDLES_ENV, STYLESHEET_WATCH_ENV and resolveStylesheet are still exported from the package index."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "runDevApp split into boot phases",
+    "detail": "runDevApp() keeps its signature and behavior. Config resolution and boot validation (run-dev-app-config.ts), late-bound tier, session and token wiring plus the onAfterSetup step (run-dev-app-auth.ts) and the createKumikoServer options (run-dev-app-server-options.ts) are separate phases. Steps shared with prod come from @cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps. A new unit test covers the late-bound tier resolver's boot-order guard and trialGate delegation."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "runDevApp releases the KMS on any boot failure; server lockfile is verified",
+    "detail": "runDevApp closes the KMS wiring when a boot gate throws before the server is created. Stopping one app no longer replaces the session, MFA and PAT revokers a newer app bound on the same feature instances: the bind functions of sessions, auth-mfa and personal-access-tokens return an unbind that only clears its own binding. writeServerLockfile replays the frozen install the runtime image runs, so a lock that did not re-resolve fails in kumiko-build."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Managed CI, app jobs and static config parsing",
+    "detail": "The public ci.yml sets MEILI_URL and MEILI_MASTER_KEY for the Meilisearch service. App-owned workflow jobs with a trailing comment or a quoted name survive a sync. kumiko.config.ts with shorthand or spread siblings next to literal ports is read as defined instead of invalid."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/templates/managed/ci-public.yml.template

@@ -95,6 +95,10 @@ jobs:
           TEST_DATABASE_URL: postgresql://kumiko:kumiko@localhost:15432/kumiko_test
           REDIS_URL: redis://localhost:16379
           JWT_SECRET: testtesttesttesttesttesttesttest
+{{#meilisearch}}
+          MEILI_URL: http://localhost:17700
+          MEILI_MASTER_KEY: kumiko-dev-key
+{{/meilisearch}}
         run: bun run test:integration
 
   # Build on main only; the rollout runs through the manual release workflow.