@cosmicdrift/kumiko-dev-server 0.387.0 → 0.389.0

package/dist/scaffold-app.js

@@ -21,7 +21,9 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { APP_CONFIG_FILE } from "@cosmicdrift/kumiko-framework/config";
 import { collectTableMetas, generateMigration, writeSnapshotJson, } from "@cosmicdrift/kumiko-framework/db";
+import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import { resolveFrameworkVersion } from "./framework-version.js";
 import { isKebabSegment } from "./kebab.js";
 import { CURRENT_INFRA_REF, PREPARE_SCRIPT, resolveManagedAppFacts, syncManagedFiles, } from "./managed-files/index.js";
 import { renderAgentsMd, renderClaudeMd, renderMountedFeatureList } from "./scaffold-agent-docs.js";
@@ -45,7 +47,10 @@ export async function scaffoldApp(options) {
     if (existsSync(destination)) {
         throw new Error(`scaffoldApp: ${destination} already exists — refusing to overwrite`);
     }
-    const version = options.frameworkVersion ?? "*";
+    const version = options.frameworkVersion ?? resolveFrameworkVersion();
+    if (version === undefined) {
+        throw new Error("scaffoldApp: cannot resolve the framework version; pass frameworkVersion explicitly");
+    }
     const testSetup = options.testSetup?.({ appName: options.name, frameworkVersion: version });
     mkdirSync(join(destination, "bin"), { recursive: true });
     mkdirSync(join(destination, "src"), { recursive: true });
@@ -84,6 +89,9 @@ export async function scaffoldApp(options) {
     files.push("src/client.tsx");
     write(join(destination, "src", "styles.css"), renderStylesCss());
     files.push("src/styles.css");
+    mkdirSync(join(destination, "public"), { recursive: true });
+    write(join(destination, "public", "index.html"), renderIndexHtml(options.name));
+    files.push("public/index.html");
     write(join(destination, ".env.example"), renderEnvExample(options.name));
     files.push(".env.example");
     write(join(destination, "docker-compose.yml"), renderDockerCompose());
@@ -161,7 +169,7 @@ function renderPackageJson(name, version, testSetup, infraRef) {
             "@tailwindcss/cli": "^4.3.0",
             "@types/react": "^19.2.0",
             "@types/react-dom": "^19.2.0",
-            "bun-types": "^1.4.0",
+            "bun-types": "^1.4.4",
             tailwindcss: "^4.3.0",
             typescript: "^6.0.3",
             ...testSetup?.devDependencies,
@@ -552,6 +560,8 @@ services:
     # Pinned to the project's own compose-file tag (663/1) — Alpine variant
     # (~90MB vs ~400MB) and a reproducible patch version, bump on PG18 minors.
     image: postgres:18.3-alpine
+    # Bun.SQL dials its whole pool eagerly; the default of 100 is too tight for app + tests.
+    command: postgres -c max_connections=300
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
@@ -660,6 +670,23 @@ Files whose first line reads \`kumiko-managed\` (deploy/, .github/workflows/,
 For full docs see https://docs.kumiko.rocks.
 `;
 }
+// No inline script: CSP is script-src 'self'.
+function renderIndexHtml(appName) {
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width,initial-scale=1,interactive-widget=resizes-content" />
+    <title>${escapeHtml(appName)}</title>
+    <link rel="stylesheet" href="/styles.css" />
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/client.js"></script>
+  </body>
+</html>
+`;
+}
 function renderStylesCss() {
     return [
         '@import "@cosmicdrift/kumiko-renderer/web/styles.css";',

package/dist/schema-apply.d.ts

@@ -4,7 +4,7 @@ export type SchemaApplyOptions = ComposeFeaturesOptions & {
     /** App features (e.g. APP_FEATURES from run-config), composed with the
      * bundled features for the projection rebuild registry. */
     readonly features: readonly FeatureDefinition[];
-    /** Default INIT_CWD ?? process.cwd(); Migrations unter <appCwd>/kumiko/migrations. */
+    /** Default INIT_CWD ?? process.cwd(); migrations live under <appCwd>/kumiko/migrations. */
     readonly appCwd?: string;
 };
 export declare function runSchemaApply(opts: SchemaApplyOptions): Promise<number>;

package/dist/schema-apply.js

@@ -22,7 +22,7 @@ export async function runSchemaApply(opts) {
     const appCwd = opts.appCwd ?? process.env["INIT_CWD"] ?? process.cwd();
     const migrationsDir = join(appCwd, "kumiko/migrations");
     if (!existsSync(migrationsDir)) {
-        console.error(`\n  ${migrationsDir} fehlt — kumiko/migrations/ muss im Image liegen.\n`);
+        console.error(`\n  ${migrationsDir} is missing — kumiko/migrations/ must be part of the image.\n`);
         return 1;
     }
     const { db, close } = createDbConnection({ url: dbUrl });
@@ -32,11 +32,11 @@ export async function runSchemaApply(opts) {
         // on an empty Greenfield DB they create kumiko_events/_consumers/_projections
         // before the app migrations run. Without this, an empty DB (e.g. cashcolt
         // on a fresh CNPG) fails with `relation "kumiko_events" does not exist`.
-        console.log("\n  Lege Framework-Infra-Tabellen an (idempotent)…");
+        console.log("\n  Creating framework infrastructure tables (idempotent)…");
         await createEventsTable(db);
         await createEventConsumerStateTable(db);
         await createProjectionStateTable(db);
-        console.log(`  Wende kumiko-Migrations an (${migrationsDir})…`);
+        console.log(`  Applying kumiko migrations (${migrationsDir})…`);
         const result = await runMigrationsFromDir(db, migrationsDir);
         if (result.applied.length === 0) {
             console.log(`\n  ✓ All ${result.skipped.length} migrations already applied.\n`);
@@ -79,6 +79,6 @@ export async function runStandaloneSchemaCli(opts) {
     if (cmd === "schema" && sub === "apply") {
         process.exit(await runSchemaApply(opts));
     }
-    console.error(`\n  Unbekannt: kumiko ${cmd ?? ""} ${sub ?? ""}\n  Nur 'kumiko schema apply' im Standalone-Bundle.\n`);
+    console.error(`\n  Unknown command: kumiko ${cmd ?? ""} ${sub ?? ""}\n  The standalone bundle only supports 'kumiko schema apply'.\n`);
     process.exit(1);
 }

package/dist/setup-test-stack-from-features.d.ts

@@ -5,6 +5,7 @@ export type TestStackPreset = "config" | "template-resolver";
 export type SetupTestStackFromFeaturesOptions = Omit<TestStackOptions, "features"> & {
     readonly includeBundled?: boolean;
     readonly authOptions?: ComposeFeaturesOptions["authOptions"];
+    readonly bundledLists?: ComposeFeaturesOptions["bundledLists"];
     readonly presets?: readonly TestStackPreset[];
 };
 export declare function mergeExtraContext(base: TestStackOptions["extraContext"], presets: readonly TestStackPreset[]): TestStackOptions["extraContext"];

package/dist/setup-test-stack-from-features.js

@@ -36,8 +36,12 @@ export function mergeExtraContext(base, presets) {
     };
 }
 export async function setupTestStackFromFeatures(appFeatures, options = {}) {
-    const { includeBundled = false, authOptions, presets = [], ...stackOptions } = options;
-    const features = composeFeatures(appFeatures, { includeBundled, authOptions });
+    const { includeBundled = false, authOptions, bundledLists, presets = [], ...stackOptions } = options;
+    const features = composeFeatures(appFeatures, {
+        includeBundled,
+        authOptions,
+        ...(bundledLists && { bundledLists }),
+    });
     const extraContext = mergeExtraContext(stackOptions.extraContext, presets);
     // Same run-logger wiring as prod, so jobs that declare tenantVisibleFailure
     // write their failure rows in tests too.

package/dist/write-server-lockfile.js

@@ -17,29 +17,36 @@ function findSeedLockfile(startDir) {
         dir = parent;
     }
 }
-export async function writeServerLockfile(options) {
-    const outDir = resolve(options.outDir);
-    const lockfile = join(outDir, "bun.lock");
-    const seedLockfile = findSeedLockfile(options.cwd);
-    if (seedLockfile !== undefined)
-        await copyFile(seedLockfile, lockfile);
+async function runBun(args, cwd) {
     // process.execPath: the lock format has to match the Bun that built the bundle.
-    const install = Bun.spawn({
-        cmd: [process.execPath, "install", "--lockfile-only"],
-        cwd: outDir,
+    const proc = Bun.spawn({
+        cmd: [process.execPath, ...args],
+        cwd,
         stdout: "pipe",
         stderr: "pipe",
     });
     const [exitCode, stdout, stderr] = await Promise.all([
-        install.exited,
-        new Response(install.stdout).text(),
-        new Response(install.stderr).text(),
+        proc.exited,
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
     ]);
-    if (exitCode !== 0) {
-        throw new Error(`bun install --lockfile-only failed in ${outDir} (exit ${exitCode}); shipping dist-server without a lockfile would leave runtime versions unpinned.\n${stderr.trim() || stdout.trim()}`);
+    return { exitCode, output: stderr.trim() || stdout.trim() };
+}
+export async function writeServerLockfile(options) {
+    const outDir = resolve(options.outDir);
+    const lockfile = join(outDir, "bun.lock");
+    const seedLockfile = findSeedLockfile(options.cwd);
+    if (seedLockfile !== undefined)
+        await copyFile(seedLockfile, lockfile);
+    const install = await runBun(["install", "--lockfile-only"], outDir);
+    if (install.exitCode !== 0) {
+        throw new Error(`bun install --lockfile-only failed in ${outDir} (exit ${install.exitCode}); shipping dist-server without a lockfile would leave runtime versions unpinned.\n${install.output}`);
     }
-    if (!existsSync(lockfile)) {
-        throw new Error(`bun install --lockfile-only did not write ${lockfile}`);
+    // A seeded copy exists before the install, so file presence proves nothing: replay the
+    // runtime stage's frozen install to catch a lock that never re-resolved for this package.json.
+    const frozen = await runBun(["install", "--production", "--frozen-lockfile", "--lockfile-only"], outDir);
+    if (frozen.exitCode !== 0) {
+        throw new Error(`${lockfile} does not satisfy ${join(outDir, "package.json")} (frozen install exit ${frozen.exitCode}); the runtime image build would fail.\n${frozen.output}`);
     }
     return seedLockfile === undefined
         ? { mode: "resolved", lockfile }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.387.0",
+  "version": "0.389.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,18 +77,23 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.387.0",
-    "@cosmicdrift/kumiko-framework": "0.387.0",
-    "@cosmicdrift/kumiko-renderer": "0.387.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.387.0",
-    "@cosmicdrift/kumiko-guards": "0.387.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.387.0",
-    "@cosmicdrift/kumiko-testing": "0.387.0",
-    "@cosmicdrift/kumiko-types": "0.387.0",
-    "bun-types": "^1.3.13",
+    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
+    "@cosmicdrift/kumiko-framework": "0.389.0",
+    "@cosmicdrift/kumiko-renderer": "0.389.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.389.0",
+    "@cosmicdrift/kumiko-guards": "0.389.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.389.0",
+    "@cosmicdrift/kumiko-testing": "0.389.0",
+    "@cosmicdrift/kumiko-types": "0.389.0",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"
   },
+  "peerDependencies": {
+    "bun-types": "^1.4.4"
+  },
+  "devDependencies": {
+    "bun-types": "^1.4.4"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public",

package/src/changes.json

@@ -1,4 +1,65 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Scaffolded apps pin Bun 1.4.4",
+    "detail": "The deploy Dockerfile template, the managed public CI workflow and the scaffolded bun-types range move from Bun 1.4.0 to 1.4.4, the minimum the Bun.SQL driver needs. The managed CI workflow updates on the next sync; the deploy Dockerfile is only written at scaffold time.",
+    "migration": "Raise BUN_VERSION in an existing deploy Dockerfile to 1.4.4 and bun-types to ^1.4.4 by hand."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Scaffolded docker-compose raises Postgres max_connections to 300",
+    "detail": "Bun.SQL dials its whole pool eagerly, so the default limit of 100 is too tight for an app plus its tests. Existing apps can add command postgres -c max_connections=300 to the postgres service."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Fresh scaffolds build with bun run build",
+    "detail": "create-kumiko-app now writes public/index.html with the /styles.css and /client.js placeholders. Without it kumiko-build stopped with a missing-template error, so the scaffolded Dockerfile could not build either."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Scaffolded apps get exact framework pins",
+    "detail": "resolveFrameworkVersion no longer prefixes ^ and scaffoldApp no longer falls back to \"*\", so a new app is green in kumiko check managed. Without a resolvable version and without an explicit frameworkVersion, scaffoldApp throws."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "migrate-step.sh leaves the managed file set",
+    "detail": "Managed apps run migrations as the k3s InitContainer from release.yml, so deploy/migrate-step.sh is neither scaffolded nor synced for them. Delete it if present. kumiko-init-deploy keeps generating it for compose self-hosting."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "English buildServerBundle errors",
+    "detail": "The errors for a missing bin/main.ts and a missing bin/kumiko.ts in buildServerBundle are now English."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Named boot phases for the dev server",
+    "detail": "createKumikoServer now reads as a list of phases: client bundles, Tailwind stylesheet, HTML templates, stack boot, background runners, fetch handler, HTTP server, shutdown, file watchers and signal handlers. Each phase lives in its own create-kumiko-server-*.ts file. Request routing is a route table instead of one if chain, and the file watcher classifies changes through suffix and directory tables. Responses, headers, cookies, the reload stream, log lines, exit codes and the start and stop order stay the same. PROD_BUNDLES_ENV, STYLESHEET_WATCH_ENV and resolveStylesheet are still exported from the package index."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "runDevApp split into boot phases",
+    "detail": "runDevApp() keeps its signature and behavior. Config resolution and boot validation (run-dev-app-config.ts), late-bound tier, session and token wiring plus the onAfterSetup step (run-dev-app-auth.ts) and the createKumikoServer options (run-dev-app-server-options.ts) are separate phases. Steps shared with prod come from @cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps. A new unit test covers the late-bound tier resolver's boot-order guard and trialGate delegation."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "runDevApp releases the KMS on any boot failure; server lockfile is verified",
+    "detail": "runDevApp closes the KMS wiring when a boot gate throws before the server is created. Stopping one app no longer replaces the session, MFA and PAT revokers a newer app bound on the same feature instances: the bind functions of sessions, auth-mfa and personal-access-tokens return an unbind that only clears its own binding. writeServerLockfile replays the frozen install the runtime image runs, so a lock that did not re-resolve fails in kumiko-build."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Managed CI, app jobs and static config parsing",
+    "detail": "The public ci.yml sets MEILI_URL and MEILI_MASTER_KEY for the Meilisearch service. App-owned workflow jobs with a trailing comment or a quoted name survive a sync. kumiko.config.ts with shorthand or spread siblings next to literal ports is read as defined instead of invalid."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/templates/deploy/Dockerfile.template

@@ -11,7 +11,7 @@
 #
 # Build context: repository root (the full source tree is only used in the build stage).
 
-ARG BUN_VERSION=1.4.0
+ARG BUN_VERSION=1.4.4
 {{#hasPrivateGhPackages}}
 # Registry auth for @cosmicdriftgamestudio: CI passes the token as
 # NPM_AUTH_TOKEN via --build-arg. Multi-stage ARG scoping needs the
@@ -69,7 +69,8 @@ RUN bun install --production --frozen-lockfile
 # Client build (static assets) — served by runProdApp.staticDir.
 COPY --from=build --chown=app:app /app/dist ./dist
 
-# Checked-in SQL migrations for the pre-deploy `kumiko schema apply` step.
+# Checked-in SQL migrations for the pre-deploy `kumiko schema apply` step
+# (k3s InitContainer from release.yml, or migrate-step.sh on compose hosts).
 # The shipped `kumiko-schema` bin reads `${INIT_CWD}/kumiko/migrations/*.sql`
 # (see ENV INIT_CWD=/app below). kumiko/schema.ts is NOT needed at runtime
 # (only generate reads it; apply is checksum-tracked SQL only).

package/templates/managed/ci-public.yml.template

@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.4.0"
+          bun-version: "1.4.4"
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun run lint
@@ -81,7 +81,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.4.0"
+          bun-version: "1.4.4"
       - run: bun install --frozen-lockfile
       - name: Create test database
         env:
@@ -95,6 +95,10 @@ jobs:
           TEST_DATABASE_URL: postgresql://kumiko:kumiko@localhost:15432/kumiko_test
           REDIS_URL: redis://localhost:16379
           JWT_SECRET: testtesttesttesttesttesttesttest
+{{#meilisearch}}
+          MEILI_URL: http://localhost:17700
+          MEILI_MASTER_KEY: kumiko-dev-key
+{{/meilisearch}}
         run: bun run test:integration
 
   # Build on main only; the rollout runs through the manual release workflow.

package/templates/managed/kumiko-schema.ts.template

@@ -22,6 +22,7 @@ const HAS_AUTH =
 
 export const FEATURES: readonly FeatureDefinition[] = composeFeatures([...CONFIGURED_FEATURES], {
   includeBundled: HAS_AUTH,
+  ...(appConfig.bundledLists && { bundledLists: appConfig.bundledLists }),
 });
 
 // `kumiko check` validates the boot with the options kumiko.config.ts declares.