---
paths:
  - start9/**
---

# StartOS packaging & deploy

Read this before building or installing the s9pk. Live target is `start9/0.4/`.

## Bump the version FIRST — every build

Start9 0.4.x ignores a same-version rebuild (the install silently does nothing). Before `make`:

1. Edit `PACKAGE_VERSION` in `start9/0.4/startos/utils.ts`.
2. Add `start9/0.4/startos/versions/v0.1.0.NN.ts`.
3. Register it in `start9/0.4/startos/versions/index.ts`: import it, set it as `current`, and move the prior `current` into `other[]`.

## Build (x86_64 only)

```bash
cd start9/0.4 && make        # -> ten-database_x86_64.s9pk
```

- The default `make` goal is `verified-build`: it runs the **frontend render smoke check**
  (`start9/0.4/render-smoke.mjs`, via jsdom) *before* packing, so a build that can't render
  fails fast. Run it standalone with `make render-smoke` (or `node render-smoke.mjs`). It
  (1) transforms the app's inline JSX with the **shipped** Babel and asserts a classic,
  non-module, parseable script — catching the v79 Babel-8 ESM-import regression — and
  (2) mounts the app in jsdom and asserts the login UI renders — catching the v78 blank
  screen. `jsdom` is a build-time devDependency (not shipped in the image); `npm ci` pulls
  it. **Front-end libs are vendored + SRI-pinned** in `frontend/assets/vendor/` (React,
  ReactDOM, Babel) and served same-origin — never re-point them at a CDN. If you re-vendor,
  regenerate each `integrity="sha384-…"` in `frontend/index.html` with
  `openssl dgst -sha384 -binary FILE | openssl base64 -A`.

## Install — PRODUCTION

```bash
start-cli package install -s ten-database_x86_64.s9pk   # target host = $START9_BOX_HOST
```

- `$START9_BOX_HOST` resolves from your local `start-cli` context config — the real hostname is **not** in this repo.
- **`install` prints nothing on success** (an empty log is normal, not a failure — and `${PIPESTATUS}` is a bash-ism, empty under this repo's zsh). Verify the deploy instead with:
  ```bash
  start-cli package installed-version ten-database   # expect the version you just built
  start-cli package logs ten-database --limit 60     # expect server up on :8080 + a clean migration chain
  ```
- **Get explicit user authorization before any production deploy/install.** Verify a new migration against a **copy** of `data/crm.db` first, never the box's DB.