@cosmicdrift/kumiko-dev-server 0.122.4 → 0.123.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.122.4",
+  "version": "0.123.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.122.4",
-    "@cosmicdrift/kumiko-framework": "0.122.4",
+    "@cosmicdrift/kumiko-bundled-features": "0.123.0",
+    "@cosmicdrift/kumiko-framework": "0.123.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/build-prod-bundle.ts

@@ -544,7 +544,8 @@ function buildMissingTemplateError(manifest: BuildManifest, entry: ClientEntry):
     ? `    <link rel="stylesheet" href="/styles.css" />\n`
     : "";
   const jsLine = manifest[entry.manifestKey]
-    ? `    <script type="module" src="/${entry.manifestKey}"></script>\n`
+    ? // html-ok: Error-Hilfetext (Tag-Snippet als Text), wird nie gerendert.
+      `    <script type="module" src="/${entry.manifestKey}"></script>\n`
     : "";
   return (
     `[kumiko build] kein ${entry.htmlPath} gefunden, aber es gibt JS/CSS-Output.\n` +
@@ -587,9 +588,9 @@ export function injectAssetTags(
 ): string {
   let result = html;
 
-  // Build-Stand vor </head> backen. id/builtAt sind Hex bzw. ISO → kein
-  // </script>-Escaping nötig. Ohne </head> (z.B. Fragment) still skip.
+  // Build-Stand vor </head> backen. Ohne </head> (z.B. Fragment) still skip.
   if (buildInfo && result.includes("</head>")) {
+    // html-ok: id/builtAt sind Hex bzw. ISO — kein `<` möglich, kein Breakout.
     const tag = `<script>window.__KUMIKO_BUILD__=${JSON.stringify(buildInfo)};</script>`;
     result = result.replace("</head>", `    ${tag}\n  </head>`);
   }
@@ -608,6 +609,7 @@ export function injectAssetTags(
         }),
       );
     }
+    // html-ok: cssUrl ist ein selbst-generierter Manifest-Asset-Pfad (Hash-Name).
     result = result.replace(placeholder[0], `<link rel="stylesheet" href="${cssUrl}" />`);
   }
 
@@ -630,6 +632,7 @@ export function injectAssetTags(
         }),
       );
     }
+    // html-ok: jsUrl ist ein selbst-generierter Manifest-Asset-Pfad (Hash-Name).
     result = result.replace(placeholder[0], `<script type="module" src="${jsUrl}"></script>`);
   }
 

package/src/inject-schema.ts

@@ -14,9 +14,15 @@
 // Reads (prod) oder bereits-vorbereitete templates (custom CI-builds)
 // stacking-Tags produzieren.
 
+// `<` als < serialisieren: verhindert `</script>`-Breakout aus dem
+// RAWTEXT-Block, JSON bleibt valides JS.
+function scriptSafeJsonHtml(json: string): string {
+  return json.replace(/</g, "\\u003c");
+}
+
 export function injectSchema(html: string, schemaJson: string): string {
   if (html.includes("__KUMIKO_SCHEMA__")) return html;
-  const tag = `<script>window.__KUMIKO_SCHEMA__=${schemaJson};</script>`;
+  const tag = `<script>window.__KUMIKO_SCHEMA__=${scriptSafeJsonHtml(schemaJson)};</script>`;
   if (html.includes('<script src="/client.js"')) {
     return html.replace('<script src="/client.js"', `${tag}<script src="/client.js"`);
   }