chore: make the development environment work from a clean checkout

[rmdes]

Setting up to work on Indiekit needed steps that were either undocumented or documented incorrectly, and the test suite depended on ambient state. After this, git clone && npm install && npm test passes with nothing else installed or running.

npm test no longer depends on a MongoDB it didn't start

Most tests already start their own in-memory MongoDB. One did not: packages/util/test/unit/mongodb.js connected to mongodb://foo:bar@localhost — port 27017 — and asserted the error was Authentication failed.. That only holds if something happens to be listening there.

docs/development.md tells contributors to put MongoDB on 27018, so following the documented setup exactly failed this test after a 30-second server-selection timeout. It passes in CI only because the workflow starts MongoDB on 27017.

It now uses an in-memory server with authentication enabled: deterministic, no external service, and 180ms instead of 30s.

Test scripts supply development defaults for SECRET and PASSWORD_SECRET

Without them the suite reports 115 failures that read like broken code rather than a missing environment. ${SECRET:-test} means a real value still wins wherever one is set.

Worth noting: CI supplies both from repository secrets, and pull_request runs from forks don't receive secrets — so an external contributor's first PR currently fails this way.

compose.yaml replaces YAML copied by hand

development.md asked contributors to hand-copy a compose file. That copy pinned mongo:7.0.11 — a release the README explicitly warns against, being affected by CVE-2025-14847 — used the obsolete version: key, and declared its volume external, so it needed docker volume create mongo-data first or it wouldn't start.

The shipped file uses mongo:8, a named volume and a healthcheck, with npm run db:up / db:down / db:reset. The port stays 27018 (override with MONGO_PORT) so it doesn't collide with a MongoDB already on the host.

Also

• Adds .env.example.
• Corrects npm run dev --production → npm run dev -- --production; the original passes the flag to npm, not to the script.

Verified

npm test, clean checkout, no .env, no Docker, nothing on 27017	773 pass, 0 fail
npm run db:up	healthy; connected from the host with the credentials in .env.example
npm run lint	no new errors or warnings

Two lint warnings pre-date this branch and are untouched: packages/endpoint-share/README.md fails prettier --check on main, and wc/no-self-class fires twice in packages/frontend/components.

[paulrobertlloyd]

Corrects npm run dev --production → npm run dev -- --production; the original passes the flag to npm, not to the script.

It was intended that npm receives this flag, and the Indiekit CLI tool doesn’t respect it. Perhaps we should tell users to pass NODE_ENV=production instead?

[rmdes]

Ah — npm sets NODE_ENV=production when it consumes that flag, which is what devMode reads, so the original line worked and my -- is what broke it. Reverted — happy to switch it to NODE_ENV=production if you'd prefer.