[pyramation]

Summary

graphql/server/src/server.ts does import cookieParser from 'cookie-parser' at runtime, but cookie-parser was listed under devDependencies. The published @constructive-io/graphql-server@5.32.7 therefore doesn't install it, so npx @constructive-io/cli@8.22.7 server crashes on start with Cannot find module 'cookie-parser' outside this monorepo.

You can see it in the registry today: npm view @constructive-io/graphql-server@5.32.7 dependencies has no cookie-parser.

The fix moves cookie-parser from devDependencies to dependencies, and moves the same entry in the lockfile importer. The resolved version stays 1.4.7, so no package resolution changes.

Link to Devin session: https://app.devin.ai/sessions/606ffc9866e54e4aa7140e33324662df
Open in Devin Desktop: https://app.devin.ai/desktop/session/606ffc9866e54e4aa7140e33324662df?variant=devin
Requested by: @pyramation

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

This PR makes a single dependency-manifest change in graphql/server/package.json: the cookie-parser package is promoted from devDependencies to dependencies, reflecting that the server uses it at runtime (cookie-based auth/session handling) rather than only in tests. No code, configuration, or lockfile semantics change beyond the section move; the pinned range ^1.4.7 is unchanged.

_{Reviewed commit: 4d195f0}