@cosmicdrift/kumiko-dev-server 0.387.0 → 0.388.0

package/dist/write-server-lockfile.js

@@ -17,29 +17,36 @@ function findSeedLockfile(startDir) {
         dir = parent;
     }
 }
-export async function writeServerLockfile(options) {
-    const outDir = resolve(options.outDir);
-    const lockfile = join(outDir, "bun.lock");
-    const seedLockfile = findSeedLockfile(options.cwd);
-    if (seedLockfile !== undefined)
-        await copyFile(seedLockfile, lockfile);
+async function runBun(args, cwd) {
     // process.execPath: the lock format has to match the Bun that built the bundle.
-    const install = Bun.spawn({
-        cmd: [process.execPath, "install", "--lockfile-only"],
-        cwd: outDir,
+    const proc = Bun.spawn({
+        cmd: [process.execPath, ...args],
+        cwd,
         stdout: "pipe",
         stderr: "pipe",
     });
     const [exitCode, stdout, stderr] = await Promise.all([
-        install.exited,
-        new Response(install.stdout).text(),
-        new Response(install.stderr).text(),
+        proc.exited,
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
     ]);
-    if (exitCode !== 0) {
-        throw new Error(`bun install --lockfile-only failed in ${outDir} (exit ${exitCode}); shipping dist-server without a lockfile would leave runtime versions unpinned.\n${stderr.trim() || stdout.trim()}`);
+    return { exitCode, output: stderr.trim() || stdout.trim() };
+}
+export async function writeServerLockfile(options) {
+    const outDir = resolve(options.outDir);
+    const lockfile = join(outDir, "bun.lock");
+    const seedLockfile = findSeedLockfile(options.cwd);
+    if (seedLockfile !== undefined)
+        await copyFile(seedLockfile, lockfile);
+    const install = await runBun(["install", "--lockfile-only"], outDir);
+    if (install.exitCode !== 0) {
+        throw new Error(`bun install --lockfile-only failed in ${outDir} (exit ${install.exitCode}); shipping dist-server without a lockfile would leave runtime versions unpinned.\n${install.output}`);
     }
-    if (!existsSync(lockfile)) {
-        throw new Error(`bun install --lockfile-only did not write ${lockfile}`);
+    // A seeded copy exists before the install, so file presence proves nothing: replay the
+    // runtime stage's frozen install to catch a lock that never re-resolved for this package.json.
+    const frozen = await runBun(["install", "--production", "--frozen-lockfile", "--lockfile-only"], outDir);
+    if (frozen.exitCode !== 0) {
+        throw new Error(`${lockfile} does not satisfy ${join(outDir, "package.json")} (frozen install exit ${frozen.exitCode}); the runtime image build would fail.\n${frozen.output}`);
     }
     return seedLockfile === undefined
         ? { mode: "resolved", lockfile }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.387.0",
+  "version": "0.388.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,14 +77,14 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.387.0",
-    "@cosmicdrift/kumiko-framework": "0.387.0",
-    "@cosmicdrift/kumiko-renderer": "0.387.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.387.0",
-    "@cosmicdrift/kumiko-guards": "0.387.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.387.0",
-    "@cosmicdrift/kumiko-testing": "0.387.0",
-    "@cosmicdrift/kumiko-types": "0.387.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.388.0",
+    "@cosmicdrift/kumiko-framework": "0.388.0",
+    "@cosmicdrift/kumiko-renderer": "0.388.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
+    "@cosmicdrift/kumiko-guards": "0.388.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.388.0",
+    "@cosmicdrift/kumiko-testing": "0.388.0",
+    "@cosmicdrift/kumiko-types": "0.388.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,34 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "English buildServerBundle errors",
+    "detail": "The errors for a missing bin/main.ts and a missing bin/kumiko.ts in buildServerBundle are now English."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Named boot phases for the dev server",
+    "detail": "createKumikoServer now reads as a list of phases: client bundles, Tailwind stylesheet, HTML templates, stack boot, background runners, fetch handler, HTTP server, shutdown, file watchers and signal handlers. Each phase lives in its own create-kumiko-server-*.ts file. Request routing is a route table instead of one if chain, and the file watcher classifies changes through suffix and directory tables. Responses, headers, cookies, the reload stream, log lines, exit codes and the start and stop order stay the same. PROD_BUNDLES_ENV, STYLESHEET_WATCH_ENV and resolveStylesheet are still exported from the package index."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "runDevApp split into boot phases",
+    "detail": "runDevApp() keeps its signature and behavior. Config resolution and boot validation (run-dev-app-config.ts), late-bound tier, session and token wiring plus the onAfterSetup step (run-dev-app-auth.ts) and the createKumikoServer options (run-dev-app-server-options.ts) are separate phases. Steps shared with prod come from @cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps. A new unit test covers the late-bound tier resolver's boot-order guard and trialGate delegation."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "runDevApp releases the KMS on any boot failure; server lockfile is verified",
+    "detail": "runDevApp closes the KMS wiring when a boot gate throws before the server is created. Stopping one app no longer replaces the session, MFA and PAT revokers a newer app bound on the same feature instances: the bind functions of sessions, auth-mfa and personal-access-tokens return an unbind that only clears its own binding. writeServerLockfile replays the frozen install the runtime image runs, so a lock that did not re-resolve fails in kumiko-build."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Managed CI, app jobs and static config parsing",
+    "detail": "The public ci.yml sets MEILI_URL and MEILI_MASTER_KEY for the Meilisearch service. App-owned workflow jobs with a trailing comment or a quoted name survive a sync. kumiko.config.ts with shorthand or spread siblings next to literal ports is read as defined instead of invalid."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/templates/managed/ci-public.yml.template

@@ -95,6 +95,10 @@ jobs:
           TEST_DATABASE_URL: postgresql://kumiko:kumiko@localhost:15432/kumiko_test
           REDIS_URL: redis://localhost:16379
           JWT_SECRET: testtesttesttesttesttesttesttest
+{{#meilisearch}}
+          MEILI_URL: http://localhost:17700
+          MEILI_MASTER_KEY: kumiko-dev-key
+{{/meilisearch}}
         run: bun run test:integration
 
   # Build on main only; the rollout runs through the manual release workflow.