@cosmicdrift/kumiko-dev-server 0.388.0 → 0.389.0

package/dist/create-kumiko-server-stack.js

@@ -2,7 +2,7 @@ import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createMetricsForFactory } from "@cosmicdrift/kumiko-framework/observability";
 import { startDevJobRunners } from "@cosmicdrift/kumiko-server-runtime/boot/job-run-logger";
-import { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
+import { makeDispatchSystemQuery, makeDispatchSystemWrite, makeFilesForTenant, } from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
 import { pushEntityProjectionTables, setupTestStack, } from "@cosmicdrift/kumiko-testing/stack";
 import { logInfo } from "./dev-server-runtime.js";
 import { isPersistentDevDb } from "./is-persistent-dev-db.js";
@@ -60,6 +60,7 @@ export async function bootDevStack(options, dbMode) {
             // so application code sees the same interface in development and production.
             redis: stack.redis.redis,
             registry: stack.registry,
+            filesForTenant: makeFilesForTenant(stack.context),
             metricsFor: createMetricsForFactory(stack.observability.meter),
             dispatchSystemWrite: makeDispatchSystemWrite(stack.dispatcher),
             dispatchSystemQuery: makeDispatchSystemQuery(stack.dispatcher),

package/dist/create-kumiko-server-stylesheet.js

@@ -3,6 +3,7 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { resolveInstalledSync } from "@cosmicdrift/kumiko-server-runtime/resolve-installed-package";
 import { canResolveTailwindStylesheet, resolveTailwindCli, } from "@cosmicdrift/kumiko-server-runtime/resolve-tailwind-cli";
 import { hasBun, logError, logInfo } from "./dev-server-runtime.js";
 // Duplicated in packages/testing/src/e2e/constants.ts: the Playwright config
@@ -44,18 +45,15 @@ export function resolveStylesheet(options) {
         // silently rather than reporting an error.
         return undefined;
     }
-    try {
-        const resolved = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", process.cwd());
-        if (!canResolveTailwindStylesheet(resolved, { bun: Bun, cwd: process.cwd() })) {
-            return undefined;
-        }
-        return resolved;
-    }
-    catch (err) {
+    const resolved = resolveInstalledSync("@cosmicdrift/kumiko-renderer/web/styles.css", process.cwd());
+    if (resolved === undefined) {
         logError("[kumiko-server] couldn't auto-resolve @cosmicdrift/kumiko-renderer/web/styles.css — " +
-            "pass `stylesheet: <path>` or `stylesheet: false` explicitly.", err);
+            "pass `stylesheet: <path>` or `stylesheet: false` explicitly.");
         return undefined;
     }
+    return canResolveTailwindStylesheet(resolved, { bun: Bun, cwd: process.cwd() })
+        ? resolved
+        : undefined;
 }
 // The E2E template can only reach an app's own server entry through its env,
 // so the env has to count whenever the option is left undefined.

package/dist/framework-version.js

@@ -13,6 +13,7 @@ function isDevServerManifest(value) {
 }
 // All @cosmicdrift packages release in lockstep (changesets fixed-group), so
 // the dev-server's own version is the framework version.
+// Exact (no caret): `kumiko check managed` rejects ranges on @cosmicdrift pins.
 export function resolveFrameworkVersion(startDir = import.meta.dir) {
     let dir = startDir;
     while (true) {
@@ -21,7 +22,7 @@ export function resolveFrameworkVersion(startDir = import.meta.dir) {
             // A corrupt or foreign package.json on the way up must not abort the search.
             const manifest = parseJsonSafe(readFileSync(candidate, "utf-8"), undefined);
             if (isDevServerManifest(manifest))
-                return `^${manifest.version}`;
+                return manifest.version;
         }
         const parent = dirname(dir);
         if (parent === dir)

package/dist/managed-files/registry.js

@@ -92,6 +92,7 @@ function renderReleaseWorkflow(facts) {
         infraRef: infraRef ?? DEFAULT_INFRA_REF,
     }, { privateDeploy: visibility === "private", publicRollout: visibility === "public" });
 }
+const COMPOSE_ONLY_DEPLOY_FILE = "migrate-step.sh";
 export function renderManagedTemplates(facts) {
     const deploy = renderDeployFiles({
         appName: facts.appName,
@@ -99,7 +100,10 @@ export function renderManagedTemplates(facts) {
         ensuredRegistryConfigFiles: [BUNFIG_FILES.unit],
     });
     return [
-        ...deploy.files.map((file) => marked(`deploy/${file.output}`, file.content, "#", file.output.endsWith(".sh"))),
+        ...deploy.files
+            // Managed apps migrate through the k3s release.yml InitContainer; migrate-step.sh is compose-only.
+            .filter((file) => file.output !== COMPOSE_ONLY_DEPLOY_FILE)
+            .map((file) => marked(`deploy/${file.output}`, file.content, "#", file.output.endsWith(".sh"))),
         marked(".husky/pre-push", readTemplate("husky-pre-push.template"), "#", true),
         marked(".github/workflows/cache-cleanup.yml", readTemplate("cache-cleanup.yml.template"), "#"),
         marked(".github/workflows/release.yml", renderReleaseWorkflow(facts), "#"),

package/dist/run-dev-app-auth.js

@@ -148,6 +148,7 @@ export async function runDevAfterSetup(stack, ctx) {
         admin: effectiveAuth?.admin,
         shortcutSeeds: wiring.shortcutSeeds,
         cipher: bootCrypto.configCipher,
+        processName: "runDevApp",
     });
     for (const seed of config.stackSeeds) {
         await seed(stack);

package/dist/run-dev-app-config.js

@@ -86,7 +86,7 @@ export async function resolveDevBootConfig(options, bootFailure) {
         warn: (message) => createFallbackLogger("runDevApp").warn(message),
     });
     const extraRoutes = collectDevExtraRoutes(options, unsubscribeRoutes, wiring);
-    const features = composeAppFeatures(options.features, wiring.features, effectiveAuth);
+    const features = composeAppFeatures(options.features, wiring.features, effectiveAuth, options.bundledLists);
     return { stackSeeds, wiring, envSource, effectiveAuth, unsubscribeLinks, extraRoutes, features };
 }
 // An explicitly wired file provider (options.files) satisfies the

package/dist/run-dev-app.d.ts

@@ -1,7 +1,7 @@
 import type { SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import type { PostAuthLandingResolver } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import { type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import { type BundledListsOptions, type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { ComposedEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
 import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -11,7 +11,7 @@ import type { TestStack } from "@cosmicdrift/kumiko-testing/stack";
 import { type CreateKumikoServerOptions, type KumikoServerHandle } from "./create-kumiko-server.ts";
 export type { AccountLockoutSetup, AccountUnlockSetup, AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup, } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 import type { AccountLockoutSetup, AccountUnlockSetup, AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
-import { type UnsubscribeOption } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
+import { type ConfigOverridesInput, type UnsubscribeOption } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 export type RunDevAppAuthOptions = {
     /** Admin user to seed at boot. Idempotent — re-runs in persistent-DB
      *  mode reuse the existing user. */
@@ -78,6 +78,8 @@ export type RunDevAppOptions = {
     readonly features: readonly FeatureDefinition[];
     /** Opt-in boot-validator warnings — see ValidateBootOptions. */
     readonly validateBootOptions?: ValidateBootOptions;
+    /** One table block for every list of the bundled features, see ComposeFeaturesOptions.bundledLists. */
+    readonly bundledLists?: BundledListsOptions;
     /** Browser entry module, bundled to /client.js. Mutually exclusive with
      *  `clientEntries`. */
     readonly clientEntry?: string;
@@ -124,6 +126,8 @@ export type RunDevAppOptions = {
      *  no locale signal. Merged into AppContext before extraContext (app wins). */
     readonly defaultLocale?: string;
     readonly extraContext?: CreateKumikoServerOptions["extraContext"];
+    /** App-level config values, same semantics and merge as RunProdAppOptions["appOverrides"]. */
+    readonly appOverrides?: ConfigOverridesInput;
     /** MasterKeyProvider for the automatically wired `ctx.secrets`. Defaults to
      *  `createEnvMasterKeyProvider`; override it for KMS backends. Only relevant
      *  when the secrets feature is mounted. Symmetric with runProdApp. */
@@ -200,4 +204,4 @@ export type RunDevAppOptions = {
     readonly errorDocs?: ErrorDocsConfig;
 };
 export declare function runDevApp(options: RunDevAppOptions): Promise<KumikoServerHandle>;
-export declare function mergeConfigResolverDefault(ctx: CreateKumikoServerOptions["extraContext"], registry: Registry, envSource: Record<string, string | undefined>, cipher?: EnvelopeCipher): CreateKumikoServerOptions["extraContext"];
+export declare function mergeConfigResolverDefault(ctx: CreateKumikoServerOptions["extraContext"], registry: Registry, envSource: Record<string, string | undefined>, cipher?: EnvelopeCipher, appOverrides?: ConfigOverridesInput): CreateKumikoServerOptions["extraContext"];

package/dist/run-dev-app.js

@@ -11,7 +11,7 @@
 // For maximum control, such as custom auth wiring, a different membership
 // query, or a custom LoginRateLimiter, use `createKumikoServer` directly from
 // @cosmicdrift/kumiko-dev-server.
-import { buildEnvConfigOverrides, createConfigResolver, } from "@cosmicdrift/kumiko-bundled-features/config";
+import { createConfigResolver } from "@cosmicdrift/kumiko-bundled-features/config";
 import { parseTrustedProxyHopsEnv, TRUSTED_PROXY_HOPS_ENV, } from "@cosmicdrift/kumiko-framework/api";
 import { findTierResolverUsage, } from "@cosmicdrift/kumiko-framework/engine";
 import { createKumikoServer, } from "./create-kumiko-server.js";
@@ -19,7 +19,7 @@ import { createDevLateBindings, createLateBoundEffectiveFeatures, runDevAfterSet
 import { configureDevBootCrypto, resolveDevAuthRegistry, resolveDevBootConfig, validateDevBoot, } from "./run-dev-app-config.js";
 import { buildDevServerOptions } from "./run-dev-app-server-options.js";
 import { renderWelcomeBanner } from "./welcome-banner.js";
-import { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
+import { addConfigAccessorFactory, buildBootExtraContext, buildConfigOverrides, loggerFromExtraContext, } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 export async function runDevApp(options) {
     const bootFailure = { release: undefined };
     try {
@@ -105,7 +105,7 @@ function renderDevWelcomeBanner(options, config, handle) {
 function buildDevExtraContext(options, config, registry, bootCrypto) {
     const { features, envSource, unsubscribeLinks } = config;
     const cfgExtra = registry
-        ? mergeConfigResolverDefault(options.extraContext, registry, envSource, bootCrypto.configCipher)
+        ? mergeConfigResolverDefault(options.extraContext, registry, envSource, bootCrypto.configCipher, options.appOverrides)
         : options.extraContext;
     return (deps) => {
         const base = typeof cfgExtra === "function" ? cfgExtra(deps) : (cfgExtra ?? {});
@@ -133,10 +133,10 @@ function buildDevExtraContext(options, config, registry, bootCrypto) {
 // pins that the dev configResolver-default carries the ENV→app-override bridge
 // and that a caller-supplied configResolver still overrides it. Not re-exported
 // from the package barrel (index.ts lists only runDevApp).
-export function mergeConfigResolverDefault(ctx, registry, envSource, cipher) {
+export function mergeConfigResolverDefault(ctx, registry, envSource, cipher, appOverrides) {
     const defaults = {
         configResolver: createConfigResolver({
-            appOverrides: buildEnvConfigOverrides(registry, envSource),
+            appOverrides: buildConfigOverrides(registry, envSource, appOverrides),
             ...(cipher && { cipher }),
         }),
     };

package/dist/scaffold-app.d.ts

@@ -27,7 +27,8 @@ export type ScaffoldAppOptions = {
      *  (the CLI's ctx.cwd) MUST pass it so the scaffold lands where the
      *  command's output claims it does. */
     readonly cwd?: string;
-    /** npm-version-pin for @cosmicdrift/* deps. Default "*" for latest. */
+    /** Exact version pin for @cosmicdrift/* deps. Default: the running framework version
+     *  (resolveFrameworkVersion); scaffoldApp throws when that cannot be resolved. */
     readonly frameworkVersion?: string;
     /** Bundled-features to mount in run-config.ts. Default: secrets + auth-foundation + sessions
      *  (the historical foundation). create-kumiko-app passes the picker output

package/dist/scaffold-app.js

@@ -21,7 +21,9 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { APP_CONFIG_FILE } from "@cosmicdrift/kumiko-framework/config";
 import { collectTableMetas, generateMigration, writeSnapshotJson, } from "@cosmicdrift/kumiko-framework/db";
+import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import { resolveFrameworkVersion } from "./framework-version.js";
 import { isKebabSegment } from "./kebab.js";
 import { CURRENT_INFRA_REF, PREPARE_SCRIPT, resolveManagedAppFacts, syncManagedFiles, } from "./managed-files/index.js";
 import { renderAgentsMd, renderClaudeMd, renderMountedFeatureList } from "./scaffold-agent-docs.js";
@@ -45,7 +47,10 @@ export async function scaffoldApp(options) {
     if (existsSync(destination)) {
         throw new Error(`scaffoldApp: ${destination} already exists — refusing to overwrite`);
     }
-    const version = options.frameworkVersion ?? "*";
+    const version = options.frameworkVersion ?? resolveFrameworkVersion();
+    if (version === undefined) {
+        throw new Error("scaffoldApp: cannot resolve the framework version; pass frameworkVersion explicitly");
+    }
     const testSetup = options.testSetup?.({ appName: options.name, frameworkVersion: version });
     mkdirSync(join(destination, "bin"), { recursive: true });
     mkdirSync(join(destination, "src"), { recursive: true });
@@ -84,6 +89,9 @@ export async function scaffoldApp(options) {
     files.push("src/client.tsx");
     write(join(destination, "src", "styles.css"), renderStylesCss());
     files.push("src/styles.css");
+    mkdirSync(join(destination, "public"), { recursive: true });
+    write(join(destination, "public", "index.html"), renderIndexHtml(options.name));
+    files.push("public/index.html");
     write(join(destination, ".env.example"), renderEnvExample(options.name));
     files.push(".env.example");
     write(join(destination, "docker-compose.yml"), renderDockerCompose());
@@ -161,7 +169,7 @@ function renderPackageJson(name, version, testSetup, infraRef) {
             "@tailwindcss/cli": "^4.3.0",
             "@types/react": "^19.2.0",
             "@types/react-dom": "^19.2.0",
-            "bun-types": "^1.4.0",
+            "bun-types": "^1.4.4",
             tailwindcss: "^4.3.0",
             typescript: "^6.0.3",
             ...testSetup?.devDependencies,
@@ -552,6 +560,8 @@ services:
     # Pinned to the project's own compose-file tag (663/1) — Alpine variant
     # (~90MB vs ~400MB) and a reproducible patch version, bump on PG18 minors.
     image: postgres:18.3-alpine
+    # Bun.SQL dials its whole pool eagerly; the default of 100 is too tight for app + tests.
+    command: postgres -c max_connections=300
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
@@ -660,6 +670,23 @@ Files whose first line reads \`kumiko-managed\` (deploy/, .github/workflows/,
 For full docs see https://docs.kumiko.rocks.
 `;
 }
+// No inline script: CSP is script-src 'self'.
+function renderIndexHtml(appName) {
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width,initial-scale=1,interactive-widget=resizes-content" />
+    <title>${escapeHtml(appName)}</title>
+    <link rel="stylesheet" href="/styles.css" />
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/client.js"></script>
+  </body>
+</html>
+`;
+}
 function renderStylesCss() {
     return [
         '@import "@cosmicdrift/kumiko-renderer/web/styles.css";',

package/dist/setup-test-stack-from-features.d.ts

@@ -5,6 +5,7 @@ export type TestStackPreset = "config" | "template-resolver";
 export type SetupTestStackFromFeaturesOptions = Omit<TestStackOptions, "features"> & {
     readonly includeBundled?: boolean;
     readonly authOptions?: ComposeFeaturesOptions["authOptions"];
+    readonly bundledLists?: ComposeFeaturesOptions["bundledLists"];
     readonly presets?: readonly TestStackPreset[];
 };
 export declare function mergeExtraContext(base: TestStackOptions["extraContext"], presets: readonly TestStackPreset[]): TestStackOptions["extraContext"];

package/dist/setup-test-stack-from-features.js

@@ -36,8 +36,12 @@ export function mergeExtraContext(base, presets) {
     };
 }
 export async function setupTestStackFromFeatures(appFeatures, options = {}) {
-    const { includeBundled = false, authOptions, presets = [], ...stackOptions } = options;
-    const features = composeFeatures(appFeatures, { includeBundled, authOptions });
+    const { includeBundled = false, authOptions, bundledLists, presets = [], ...stackOptions } = options;
+    const features = composeFeatures(appFeatures, {
+        includeBundled,
+        authOptions,
+        ...(bundledLists && { bundledLists }),
+    });
     const extraContext = mergeExtraContext(stackOptions.extraContext, presets);
     // Same run-logger wiring as prod, so jobs that declare tenantVisibleFailure
     // write their failure rows in tests too.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.388.0",
+  "version": "0.389.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,18 +77,23 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.388.0",
-    "@cosmicdrift/kumiko-framework": "0.388.0",
-    "@cosmicdrift/kumiko-renderer": "0.388.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
-    "@cosmicdrift/kumiko-guards": "0.388.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.388.0",
-    "@cosmicdrift/kumiko-testing": "0.388.0",
-    "@cosmicdrift/kumiko-types": "0.388.0",
-    "bun-types": "^1.3.13",
+    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
+    "@cosmicdrift/kumiko-framework": "0.389.0",
+    "@cosmicdrift/kumiko-renderer": "0.389.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.389.0",
+    "@cosmicdrift/kumiko-guards": "0.389.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.389.0",
+    "@cosmicdrift/kumiko-testing": "0.389.0",
+    "@cosmicdrift/kumiko-types": "0.389.0",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"
   },
+  "peerDependencies": {
+    "bun-types": "^1.4.4"
+  },
+  "devDependencies": {
+    "bun-types": "^1.4.4"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public",

package/src/changes.json

@@ -1,4 +1,35 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Scaffolded apps pin Bun 1.4.4",
+    "detail": "The deploy Dockerfile template, the managed public CI workflow and the scaffolded bun-types range move from Bun 1.4.0 to 1.4.4, the minimum the Bun.SQL driver needs. The managed CI workflow updates on the next sync; the deploy Dockerfile is only written at scaffold time.",
+    "migration": "Raise BUN_VERSION in an existing deploy Dockerfile to 1.4.4 and bun-types to ^1.4.4 by hand."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Scaffolded docker-compose raises Postgres max_connections to 300",
+    "detail": "Bun.SQL dials its whole pool eagerly, so the default limit of 100 is too tight for an app plus its tests. Existing apps can add command postgres -c max_connections=300 to the postgres service."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Fresh scaffolds build with bun run build",
+    "detail": "create-kumiko-app now writes public/index.html with the /styles.css and /client.js placeholders. Without it kumiko-build stopped with a missing-template error, so the scaffolded Dockerfile could not build either."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Scaffolded apps get exact framework pins",
+    "detail": "resolveFrameworkVersion no longer prefixes ^ and scaffoldApp no longer falls back to \"*\", so a new app is green in kumiko check managed. Without a resolvable version and without an explicit frameworkVersion, scaffoldApp throws."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "migrate-step.sh leaves the managed file set",
+    "detail": "Managed apps run migrations as the k3s InitContainer from release.yml, so deploy/migrate-step.sh is neither scaffolded nor synced for them. Delete it if present. kumiko-init-deploy keeps generating it for compose self-hosting."
+  },
   {
     "version": "0.388.0",
     "type": "improvement",

package/templates/deploy/Dockerfile.template

@@ -11,7 +11,7 @@
 #
 # Build context: repository root (the full source tree is only used in the build stage).
 
-ARG BUN_VERSION=1.4.0
+ARG BUN_VERSION=1.4.4
 {{#hasPrivateGhPackages}}
 # Registry auth for @cosmicdriftgamestudio: CI passes the token as
 # NPM_AUTH_TOKEN via --build-arg. Multi-stage ARG scoping needs the
@@ -69,7 +69,8 @@ RUN bun install --production --frozen-lockfile
 # Client build (static assets) — served by runProdApp.staticDir.
 COPY --from=build --chown=app:app /app/dist ./dist
 
-# Checked-in SQL migrations for the pre-deploy `kumiko schema apply` step.
+# Checked-in SQL migrations for the pre-deploy `kumiko schema apply` step
+# (k3s InitContainer from release.yml, or migrate-step.sh on compose hosts).
 # The shipped `kumiko-schema` bin reads `${INIT_CWD}/kumiko/migrations/*.sql`
 # (see ENV INIT_CWD=/app below). kumiko/schema.ts is NOT needed at runtime
 # (only generate reads it; apply is checksum-tracked SQL only).

package/templates/managed/ci-public.yml.template

@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.4.0"
+          bun-version: "1.4.4"
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun run lint
@@ -81,7 +81,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.4.0"
+          bun-version: "1.4.4"
       - run: bun install --frozen-lockfile
       - name: Create test database
         env:

package/templates/managed/kumiko-schema.ts.template

@@ -22,6 +22,7 @@ const HAS_AUTH =
 
 export const FEATURES: readonly FeatureDefinition[] = composeFeatures([...CONFIGURED_FEATURES], {
   includeBundled: HAS_AUTH,
+  ...(appConfig.bundledLists && { bundledLists: appConfig.bundledLists }),
 });
 
 // `kumiko check` validates the boot with the options kumiko.config.ts declares.