fix: install devDependencies on the server so builds work

Default install commands for npm, yarn, and bun dropped the --production
flag — without devDependencies the build step (tsc, vite, tsup) fails.
pnpm was already correct; this completes the same fix for the others.

Adds .installCommand(cmd) and .pkgManager(pm, { installCommand }) for
users who need different flags (e.g. --legacy-peer-deps). The override
applies to both the initial install and the post-symlink relink.

Author: devalade

CHANGELOG.md

@@ -15,6 +15,15 @@ All notable changes to `@devalade/shipnode` will be documented here.
 - **PM2 status check** — after every deploy, `pm2 jlist` is parsed and each declared app must be `online` with `restart_time === 0`. Catches workers that boot and crash before the HTTP health check would notice anything. Runs even on worker-only deployments.
 - **Per-app `env`** — each `pm2.apps` entry can set its own env vars (`{ WORKER_QUEUE: 'emails' }`); PM2 loads the shared `.env` via `env_file` and applies per-app overrides on top.
 
+### Fixed
+- **Builds no longer fail because devDependencies are missing.** The default install commands for `npm`, `yarn`, and `bun` no longer pass `--production` / `--frozen-lockfile --production` — they now install everything so the subsequent build step has access to `tsc`, `vite`, `tsup`, etc. (pnpm was already fixed for this in v2.0.13; this completes the same fix for the other package managers.)
+
+### Added
+- Two ways to override the server-side install command when you need flags the default doesn't carry (e.g. `'npm ci --legacy-peer-deps'`):
+  - `.installCommand(cmd)` — standalone builder method.
+  - `.pkgManager(pm, { installCommand: cmd })` — second-arg form, useful when you're already pinning the package manager.
+  Both write to the same field. Override applies to both the initial install and the post-symlink relink; `--prefer-offline` is not appended to overridden commands.
+
 ### Changed
 - **Ecosystem file is per-release** — `ecosystem.config.cjs` now lives inside each release directory instead of `<remotePath>/shared/`. PM2 references it via `<remotePath>/current/ecosystem.config.cjs` so rollback restores the exact process set that was active for that release (a worker added in v2 won't crash-loop after rolling back to v1). See [ADR-0001](docs/adr/0001-per-release-ecosystem-file.md).
 - **Builder back-compat preserved** — `.pm2(name, opts)` and `.port(n)` still work and now act as sugar on the first app. Existing `shipnode.config.ts` files don't need changes.

README.md

@@ -103,7 +103,8 @@ export default shipnode
 | `.worker({ name, command, ... })` | — | Add a worker process supervised alongside the web app |
 | `.domain(d)` | — | Domain for Caddy config |
 | `.nodeVersion(v)` | `lts` | Node version (via mise) |
-| `.pkgManager(pm)` | auto-detected | `npm` \| `yarn` \| `pnpm` \| `bun` |
+| `.pkgManager(pm, opts?)` | auto-detected | `npm` \| `yarn` \| `pnpm` \| `bun`; `opts.installCommand` overrides the install command |
+| `.installCommand(cmd)` | derived from pkg manager | Override the install command run on the server (e.g. `'npm ci --legacy-peer-deps'`). Equivalent to `pkgManager(pm, { installCommand: cmd })` |
 | `.buildDir(dir)` | auto-detected | Frontend build output dir |
 | `.zeroDowntime({ keepReleases? })` | true, 5 | Zero-downtime releases |
 | `.legacy()` | — | Simple in-place deploy |

src/config/assembly.ts

@@ -80,6 +80,7 @@ export function assembleConfig(partial: AssembleInput): ShipnodeConfig {
     envFile: partial.envFile ?? DEFAULTS.ENV_FILE,
     nodeVersion: partial.nodeVersion ?? DEFAULTS.NODE_VERSION,
     pkgManager: partial.pkgManager,
+    installCommand: partial.installCommand,
     sharedDirs: partial.sharedDirs,
     sharedFiles: partial.sharedFiles,
     buildDir: partial.buildDir,

src/config/builder.ts

@@ -123,8 +123,14 @@ export class ShipnodeBuilder {
     return this;
   }
 
-  pkgManager(pm: PkgManager): this {
+  pkgManager(pm: PkgManager, opts?: { installCommand?: string }): this {
     this.config.pkgManager = pm;
+    if (opts?.installCommand !== undefined) this.config.installCommand = opts.installCommand;
+    return this;
+  }
+
+  installCommand(cmd: string): this {
+    this.config.installCommand = cmd;
     return this;
   }
 

src/config/schema.ts

@@ -92,6 +92,7 @@ export const ShipnodeConfigSchema = z.object({
   envFile: z.string().default('.env'),
   nodeVersion: z.string().default('lts'),
   pkgManager: z.enum(['npm', 'yarn', 'pnpm', 'bun']).optional(),
+  installCommand: z.string().min(1).optional(),
   buildDir: z.string().optional(),
   sharedDirs: z.array(z.string()).optional(),
   sharedFiles: z.array(z.string()).optional(),

src/domain/deploy/backend-strategy.ts

@@ -48,7 +48,7 @@ export class BackendStrategy implements DeploymentStrategy {
 
   async setupEnvironment(ctx: StrategyContext): Promise<void> {
     const pkgManager = await this.resolvePkgManager();
-    const installCmd = getInstallCommand(pkgManager);
+    const installCmd = this.config.installCommand ?? getInstallCommand(pkgManager);
     const runCmd = getRunCommand(pkgManager);
 
     const commands = [
@@ -110,9 +110,12 @@ export class BackendStrategy implements DeploymentStrategy {
     // Re-run install from the final directory so the pkg manager's module
     // resolution state matches the path PM2 will use. Packages are already
     // in the local store so this is a fast offline relink, not a download.
-    const installCmd = getInstallCommand(pkgManager);
+    // If the user supplied a custom installCommand we use it verbatim — they've
+    // chosen their flags and appending --prefer-offline would compose poorly.
+    const baseInstall = this.config.installCommand ?? getInstallCommand(pkgManager);
+    const relinkInstall = this.config.installCommand ? baseInstall : `${baseInstall} --prefer-offline`;
     const installResult = await ctx.executor.exec(
-      `cd "${cdPath}" && ${mise} && ${installCmd} --prefer-offline`,
+      `cd "${cdPath}" && ${mise} && ${relinkInstall}`,
     );
     this.assertNoBuildScriptsIgnored(pkgManager, installResult);
     if (installResult.exitCode !== 0) {

src/domain/framework/detector.ts

@@ -114,7 +114,7 @@ async function detectOrm(cwd: string): Promise<string | undefined> {
 }
 
 export function getInstallCommand(pkgManager: PkgManager): string {
-  return PKG_MANAGER_COMMANDS[pkgManager]?.install ?? 'npm ci --production';
+  return PKG_MANAGER_COMMANDS[pkgManager]?.install ?? 'npm ci';
 }
 
 export function getRunCommand(pkgManager: PkgManager): string {

src/shared/constants.ts

@@ -80,8 +80,11 @@ export const ORM_PATTERNS = {
 } as const;
 
 export const PKG_MANAGER_COMMANDS: Record<string, { install: string; run: string }> = {
-  npm: { install: 'npm ci --production', run: 'npm run' },
-  yarn: { install: 'yarn install --production', run: 'yarn' },
+  // No --production / --omit=dev flags: the install runs on the server and the
+  // build step that follows needs devDependencies (tsc, vite, tsup, …). Users
+  // who want a different install can override via .installCommand(cmd).
+  npm: { install: 'npm ci', run: 'npm run' },
+  yarn: { install: 'yarn install --frozen-lockfile', run: 'yarn' },
   pnpm: { install: 'pnpm install', run: 'pnpm' },
-  bun: { install: 'bun install --production', run: 'bun run' },
+  bun: { install: 'bun install', run: 'bun run' },
 } as const;

src/shared/types.ts

@@ -111,6 +111,8 @@ export interface ShipnodeConfig {
   envFile: string;
   nodeVersion: string;
   pkgManager?: PkgManager;
+  /** Override the install command run on the server. Defaults to the package manager's standard install (e.g. `npm ci`). Use to add flags like `--legacy-peer-deps`, switch to a frozen-lockfile variant, etc. */
+  installCommand?: string;
   buildDir?: string;
   sharedDirs?: string[];
   sharedFiles?: string[];

tests/unit/backend-strategy.test.ts

@@ -115,6 +115,17 @@ describe('BackendStrategy.setupEnvironment', () => {
     expect(cmd).toContain('npm ci');
   });
 
+  it('uses the custom installCommand override when set', async () => {
+    const config = makeConfig({ pkgManager: 'npm', installCommand: 'npm ci --legacy-peer-deps' });
+    const strategy = new BackendStrategy(config, '/local/project');
+    const executor = new FakeRemoteExecutor();
+    await strategy.setupEnvironment!(makeCtx(executor, { config }));
+
+    const cmd = executor.getLastCommand()!.command;
+    expect(cmd).toContain('npm ci --legacy-peer-deps');
+    expect(cmd).not.toContain('npm ci\n'); // not the default
+  });
+
   it('uses pnpm install when pkgManager is pnpm', async () => {
     const strategy = new BackendStrategy(makeConfig({ pkgManager: 'pnpm' }), '/local/project');
     const executor = new FakeRemoteExecutor();
@@ -312,6 +323,17 @@ describe('BackendStrategy.startApp', () => {
     expect(writeCmd).toContain('api-worker');
   });
 
+  it('uses the custom installCommand on the post-symlink relink (no --prefer-offline appended)', async () => {
+    const config = makeConfig({ pkgManager: 'npm', installCommand: 'npm ci --legacy-peer-deps' });
+    const strategy = new BackendStrategy(config, '/local/project');
+    const executor = new FakeRemoteExecutor();
+    await strategy.startApp!(makeCtx(executor, { config }));
+
+    const relinkCmd = executor.getHistory()[1].command;
+    expect(relinkCmd).toContain('npm ci --legacy-peer-deps');
+    expect(relinkCmd).not.toContain('--prefer-offline');
+  });
+
   it('emits the silent legacy-name pm2 delete fallback', async () => {
     const strategy = new BackendStrategy(makeConfig({ pm2: { name: 'myapp' } }), '/local/project');
     const executor = new FakeRemoteExecutor();