@cosmicdrift/kumiko-dev-server 0.220.1 → 0.221.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.220.1",
+  "version": "0.221.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -59,9 +59,9 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.220.1",
-    "@cosmicdrift/kumiko-framework": "0.220.1",
-    "@cosmicdrift/kumiko-server-runtime": "0.220.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.221.0",
+    "@cosmicdrift/kumiko-framework": "0.221.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.221.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/create-kumiko-server.integration.test.ts

@@ -2,6 +2,7 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { NO_ROUTE_MATCH_HEADER_NAME } from "@cosmicdrift/kumiko-framework/api";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createBooleanField,
@@ -507,3 +508,66 @@ describe("createKumikoServer — hot-reload broadcast", () => {
     }
   });
 });
+
+// kumiko-framework#2435: tryHonoFirst used to decide "no route matched"
+// purely from the status code — a matched httpRoute answering 404 on
+// purpose (e.g. default-deny reads) was indistinguishable from an
+// unregistered path and got silently rewritten to the SPA shell with
+// status 200. Drives the REAL fetch-handler end to end (real Postgres,
+// real Hono app via createKumikoServer) so the fix's actual wiring
+// (buildServer's app.notFound() marker + tryHonoFirst reading it) is
+// under test, not just the pure-function pin in try-hono-first.test.ts.
+const probeHttpRouteFeature = defineFeature("dev-server-probe-http-route", (r) => {
+  r.httpRoute({
+    method: "GET",
+    path: "/probe/:id",
+    anonymous: true,
+    handler: async (c) => {
+      const id = c.req.param("id");
+      if (id === "missing") return c.text("not found", 404);
+      return c.text(`probe:${id}`, 200);
+    },
+  });
+});
+
+describe("createKumikoServer — tryHonoFirst 404-vs-router-miss (#2435)", () => {
+  async function bootWithProbeRoute(): Promise<KumikoServerHandle> {
+    handle = await createKumikoServer({
+      features: [probeHttpRouteFeature],
+      port: 0,
+      installSignalHandlers: false,
+    });
+    return handle;
+  }
+
+  test("gematchte httpRoute mit bewusster 404 bleibt 404 (keine SPA-Maskierung)", async () => {
+    const h = await bootWithProbeRoute();
+    const res = await h.fetch(new Request("http://localhost/probe/missing"));
+    expect(res.status).toBe(404);
+    expect(res.headers.get("content-type") ?? "").not.toMatch(/text\/html/);
+    expect(await res.text()).toBe("not found");
+  });
+
+  test("gematchte httpRoute mit Treffer antwortet normal (200)", async () => {
+    const h = await bootWithProbeRoute();
+    const res = await h.fetch(new Request("http://localhost/probe/exists"));
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe("probe:exists");
+  });
+
+  test("unbekannte SPA-Route liefert weiterhin die SPA-Shell (200 HTML)", async () => {
+    const h = await bootWithProbeRoute();
+    const res = await h.fetch(new Request("http://localhost/some/client-side/route"));
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toMatch(/text\/html/);
+    expect(await res.text()).toMatch(/<div id="root">/);
+  });
+
+  test("kein Router-miss-Marker leakt an den Client", async () => {
+    const h = await bootWithProbeRoute();
+    const missRes = await h.fetch(new Request("http://localhost/some/client-side/route"));
+    const deniedRes = await h.fetch(new Request("http://localhost/probe/missing"));
+    expect(missRes.headers.has(NO_ROUTE_MATCH_HEADER_NAME)).toBe(false);
+    expect(deniedRes.headers.has(NO_ROUTE_MATCH_HEADER_NAME)).toBe(false);
+  });
+});

package/src/__tests__/env-schema.integration.test.ts

@@ -42,6 +42,11 @@ describe("public-export smoke", () => {
   it("re-exports frameworkCoreEnvSchema via dev-server's package entry", () => {
     expect(devServerPublicApi.frameworkCoreEnvSchema).toBe(frameworkCoreEnvSchema);
   });
+
+  it("re-exports frameworkCoreEnvSchema via the env-schema subpath", async () => {
+    const viaSubpath = await import("@cosmicdrift/kumiko-dev-server/env-schema");
+    expect(viaSubpath.frameworkCoreEnvSchema).toBe(frameworkCoreEnvSchema);
+  });
 });
 
 describe("runProdApp envSchema integration", () => {

package/src/__tests__/runtime-classification.test.ts

@@ -1,7 +1,6 @@
 import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { frameworkCoreEnvSchema as envSchemaViaRelative } from "../env-schema";
 
 // Mirrors infra/guards/runtime-isolation-classify.ts `classifyByDirective`
 // as of kumiko-framework#2337 (first 600 bytes, first 8 lines,
@@ -25,17 +24,3 @@ describe("compose-stacks.ts runtime directive", () => {
     expect(classifyByDirective(composeStacksPath)).toBe("runtime");
   });
 });
-
-describe("@cosmicdrift/kumiko-dev-server/env-schema subpath", () => {
-  it("resolves the same schema as the relative import, and it parses", async () => {
-    const { frameworkCoreEnvSchema: envSchemaViaSubpath } = await import(
-      "@cosmicdrift/kumiko-dev-server/env-schema"
-    );
-    expect(envSchemaViaSubpath).toBe(envSchemaViaRelative);
-    const parsed = envSchemaViaSubpath.parse({
-      DATABASE_URL: "postgres://localhost:5432/db",
-      REDIS_URL: "redis://localhost:6379",
-    });
-    expect(parsed.PORT).toBe("3000");
-  });
-});

package/src/__tests__/scaffold-app.test.ts

@@ -276,8 +276,10 @@ describe("scaffoldApp", () => {
 
     const main = readFileSync(join(dest, "bin/main.ts"), "utf-8");
     expect(main).toContain('from "@cosmicdrift/kumiko-framework/crypto"');
+    expect(main).toContain("requireKmsWiring(process.env");
     expect(main).toContain("resolveKmsWiring(process.env");
-    expect(main).toContain('if ("allowPlaintextPii" in kmsWiring)');
+    expect(main).toContain('process.env["NODE_ENV"] === "production"');
+    expect(main).not.toContain('if ("allowPlaintextPii" in kmsWiring)');
     expect(main).toContain("...kmsWiring,");
   });
 

package/src/create-kumiko-server.ts

@@ -41,7 +41,10 @@ import {
   canResolveTailwindStylesheet,
   resolveTailwindCli,
 } from "@cosmicdrift/kumiko-server-runtime/resolve-tailwind-cli";
-import { tryHonoFirst } from "@cosmicdrift/kumiko-server-runtime/try-hono-first";
+import {
+  stripNoRouteMatchHeader,
+  tryHonoFirst,
+} from "@cosmicdrift/kumiko-server-runtime/try-hono-first";
 
 // Runtime-detection. The dev-server is meant to run under Bun (Kumiko's
 // target runtime), but the test-suite runs under vitest on Node — we
@@ -941,7 +944,11 @@ export async function createKumikoServer(
       return htmlResponse("client", true);
     }
 
-    return stack.app.fetch(req);
+    // Bypasses tryHonoFirst entirely (API paths, dotted paths, /sse,
+    // non-GET/HEAD), so the router-miss marker must be stripped here too —
+    // otherwise an unmatched path would leak it straight to the client
+    // (see try-hono-first.ts's header-hygiene note).
+    return stripNoRouteMatchHeader(await stack.app.fetch(req));
   };
 
   // --- HTTP server (Bun only) ---

package/src/env-schema.ts

@@ -1,3 +1,7 @@
+// @runtime runtime
+// Consumed at prod boot via composeEnvSchema (same as compose-stacks),
+// not only by tooling — keep runtime-isolation-safe (kumiko-framework#2340).
+//
 // Framework-core env-schema — the vars that runProdApp + buildServer
 // + the connection-pool read directly from process.env today. Apps merge
 // this into their app-wide schema via `composeEnvSchema({ core, ... })`.

package/src/scaffold-app.ts

@@ -439,7 +439,7 @@ function renderMain(appName: string): string {
   });
   sf.addImportDeclaration({
     moduleSpecifier: "@cosmicdrift/kumiko-framework/crypto",
-    namedImports: ["resolveKmsWiring"],
+    namedImports: ["requireKmsWiring", "resolveKmsWiring"],
   });
   sf.addImportDeclaration({
     moduleSpecifier: "../src/run-config",
@@ -482,34 +482,40 @@ function renderMain(appName: string): string {
   });
 
   // Subject-key KMS for the pii-annotated entities the --yes recommended set
-  // mounts (user, tenant-invitation, fileRef). Without the PLATFORM_KEK /
-  // SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY trio this falls back
-  // to plaintext PII with a loud boot warning — fine to get running locally,
-  // never for a real deploy (kumiko-framework#2330).
+  // mounts (user, tenant-invitation, fileRef). Local/dev may omit the trio
+  // (plaintext + loud warning); NODE_ENV=production uses requireKmsWiring so
+  // a real deploy cannot silently store plaintext PII (fw#2317 / #2339).
+  // assertPiiBootInvariants already warns on the plaintext path — no duplicate console.warn.
   sf.addVariableStatement({
     declarationKind: VariableDeclarationKind.Const,
     declarations: [
       {
-        name: "kmsWiring",
+        name: "kmsOpts",
         initializer: (writer) => {
-          writer.write("resolveKmsWiring(process.env, ").inlineBlock(() => {
-            writer.writeLine(`logPrefix: "[${appName}]",`);
-            writer.writeLine(
-              `plaintextReason: "no PLATFORM_KEK / SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY set — see .env.example",`,
-            );
-          });
-          writer.write(")");
+          writer.write("{").newLine();
+          writer.writeLine(`  logPrefix: "[${appName}]",`);
+          writer.writeLine(
+            `  plaintextReason: "no PLATFORM_KEK / SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY set — see .env.example",`,
+          );
+          writer.write("} as const");
         },
       },
     ],
   });
-
-  sf.addStatements((writer) => {
-    writer.write('if ("allowPlaintextPii" in kmsWiring) ').inlineBlock(() => {
-      writer.writeLine(
-        `console.warn(\`[${appName}] PII IS STORED IN PLAINTEXT — \${kmsWiring.allowPlaintextPii}\`);`,
-      );
-    });
+  sf.addVariableStatement({
+    declarationKind: VariableDeclarationKind.Const,
+    declarations: [
+      {
+        name: "kmsWiring",
+        initializer: (writer) => {
+          writer.write(`process.env["NODE_ENV"] === "production"`);
+          writer.newLine();
+          writer.write("  ? requireKmsWiring(process.env, kmsOpts)");
+          writer.newLine();
+          writer.write("  : resolveKmsWiring(process.env, kmsOpts)");
+        },
+      },
+    ],
   });
 
   sf.addStatements((writer) => {
@@ -697,11 +703,14 @@ JWT_SECRET=change-me-min-32-chars-change-me-min-32
 # Generate with: openssl rand -base64 32
 KUMIKO_SECRETS_MASTER_KEY_V1=
 
-# Subject-keys KMS for PII fields (user, tenant-invitation, fileRef). Unset by
-# default — bin/main.ts then boots with plaintext PII and a loud warning, fine
-# to get running locally. Set all three before a real deploy (crypto-shredding
-# needs it for GDPR erasure): PLATFORM_KEK generate with: openssl rand -base64 32
+# Subject-keys KMS for PII fields (user, tenant-invitation, fileRef). All-or-none.
+# Unset → local boot with plaintext PII + warning; NODE_ENV=production requires
+# the trio (requireKmsWiring). Generate PLATFORM_KEK / KUMIKO_BLIND_INDEX_KEY
+# with: openssl rand -base64 32. SUBJECT_KEYS_DATABASE_URL must be a dedicated
+# subject-keys cluster (not the app DB) — see kms-adapter.md.
 PLATFORM_KEK=
+# Separate Postgres instance for subject keys — never DATABASE_URL (retention
+# must outlive app-DB backups for crypto-shredding).
 SUBJECT_KEYS_DATABASE_URL=
 KUMIKO_BLIND_INDEX_KEY=
 

package/src/scaffold-demo-tasks.ts

@@ -215,7 +215,6 @@ export function renderDemoTasksIndex(): string {
 
 export function renderDemoSeedFile(): string {
   return `// Demo seed — a few tasks so \`bun dev\` shows a non-empty list.
-// Idempotent: skips when the tenant already has tasks (persistent dev DB).
 
 import type { SeedFn } from "@cosmicdrift/kumiko-dev-server";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";