@cosmicdrift/kumiko-dev-server 0.318.0 → 0.320.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.318.0",
+  "version": "0.320.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -59,10 +59,10 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.318.0",
-    "@cosmicdrift/kumiko-framework": "0.318.0",
-    "@cosmicdrift/kumiko-headless": "0.318.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.318.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.320.0",
+    "@cosmicdrift/kumiko-framework": "0.320.0",
+    "@cosmicdrift/kumiko-headless": "0.320.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.320.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/create-kumiko-server.integration.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import {
   ExtraRouteRejection,
   NO_ROUTE_MATCH_HEADER_NAME,
+  requestContext,
   signatureRoute,
 } from "@cosmicdrift/kumiko-framework/api";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -16,6 +17,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { getSetCookieValue } from "@cosmicdrift/kumiko-framework/testing";
 import * as z from "zod";
 import {
   createKumikoServer,
@@ -50,6 +52,16 @@ const probeFeature = defineFeature("dev-server-probe", (r) => {
     access: { roles: ["anonymous"] },
     handler: async () => ({ pong: true }),
   });
+  // Echoes the resolved client IP — proves a real Bun.serve socket address
+  // reaches requestContext.ip through handleFetch (fw#3260 addendum: every
+  // other test drives h.fetch()/handle.fetch() directly, never Bun.serve's
+  // real socket).
+  r.queryHandler({
+    name: "whoami",
+    schema: z.object({}),
+    access: { roles: ["anonymous"] },
+    handler: async () => ({ ip: requestContext.get()?.ip }),
+  });
   // SystemAdmin-gated write — Ziel der entry:"signature" / `wire`-Tests
   // (252/2): Echo von user.tenantId + roles beweist Dispatch durch
   // den echten Dispatcher (Zod + Access-Check) mit Ziel-Tenant-SystemUser.
@@ -245,9 +257,9 @@ describe("createKumikoServer (Multi-Entry)", () => {
         if (host === "apex.test") return { kind: "not-found" };
         if (host === "old.test") return { kind: "redirect", to: "https://new.test/" };
         if (host.startsWith("admin.")) {
-          return { kind: "html", entryName: "admin", injectSchema: true };
+          return { kind: "html", entryName: "admin" };
         }
-        return { kind: "html", entryName: "public", injectSchema: false };
+        return { kind: "html", entryName: "public" };
       },
     });
   }
@@ -288,35 +300,42 @@ describe("createKumikoServer (Multi-Entry)", () => {
     expect(noFallback.status).toBe(404);
   });
 
-  test("Schema-Inject: admin → injected, public → NICHT injected", async () => {
+  test("HTML never carries the schema; GET /api/schema needs the auto-minted cookie (kumiko-framework#3314)", async () => {
     handle = await bootMultiEntry();
 
-    const publicHtml = await (
-      await handle.fetch(
-        new Request("http://status.localhost/", { headers: { host: "status.localhost" } }),
-      )
-    ).text();
-    expect(publicHtml).not.toMatch(/__KUMIKO_SCHEMA__/);
+    const publicRes = await handle.fetch(
+      new Request("http://status.localhost/", { headers: { host: "status.localhost" } }),
+    );
+    expect(await publicRes.text()).not.toMatch(/__KUMIKO_SCHEMA__/);
+
+    const adminRes = await handle.fetch(
+      new Request("http://admin.localhost/", { headers: { host: "admin.localhost" } }),
+    );
+    expect(await adminRes.text()).not.toMatch(/__KUMIKO_SCHEMA__/);
+
+    const authCookie = getSetCookieValue(adminRes, "kumiko_auth");
+    expect(authCookie).toBeDefined();
+
+    const unauthenticated = await handle.fetch(new Request("http://admin.localhost/api/schema"));
+    expect(unauthenticated.status).toBe(401);
 
-    const adminHtml = await (
-      await handle.fetch(
-        new Request("http://admin.localhost/", { headers: { host: "admin.localhost" } }),
-      )
-    ).text();
-    expect(adminHtml).toMatch(/__KUMIKO_SCHEMA__/);
+    const authenticatedRes = await handle.fetch(
+      new Request("http://admin.localhost/api/schema", {
+        headers: { cookie: `kumiko_auth=${authCookie}` },
+      }),
+    );
+    expect(authenticatedRes.status).toBe(200);
+    const schema = await authenticatedRes.json();
+    // Guards against an empty features array making the #2062 `.some(...)`
+    // assertion below vacuously false.
+    expect(schema.features.length).toBeGreaterThan(0);
 
     // #2062: setupTestStack always wires an in-memory SearchAdapter
     // (test-stack.ts), so the dev-server call site's
     // `searchAdapterMissing: !stack.context.searchAdapter` must read false —
     // proving the flag actually flows from stack.context through to the
-    // injected schema instead of silently staying at its own default.
-    const schemaMatch = adminHtml.match(/window\.__KUMIKO_SCHEMA__=(\{.*?\});<\/script>/s);
-    expect(schemaMatch).not.toBeNull();
-    const injectedSchema = JSON.parse(schemaMatch?.[1] ?? "{}");
-    // Guards against a regex miss silently degrading to `?? "{}"` — an empty
-    // features array would make `.some(...)` below vacuously false too.
-    expect(injectedSchema.features.length).toBeGreaterThan(0);
-    const anyFeatureMissingAdapter = injectedSchema.features.some(
+    // schema served by GET /api/schema.
+    const anyFeatureMissingAdapter = schema.features.some(
       (f: { searchAdapterMissing?: boolean }) => f.searchAdapterMissing === true,
     );
     expect(anyFeatureMissingAdapter).toBe(false);
@@ -907,3 +926,33 @@ describe("createKumikoServer — public/ static files", () => {
     }
   });
 });
+
+describe("createKumikoServer — real Bun.serve socket resolves the client IP (fw#3260 addendum)", () => {
+  // Every other test in this file drives h.fetch()/handle.fetch() directly,
+  // bypassing Bun.serve's real TCP socket entirely — none of them can catch
+  // a regression where handleFetch loses the socket address before it
+  // reaches requestContext.ip (see client-ip.ts: falls back to "unknown"
+  // rather than throwing, so a wiring bug here stays silent otherwise).
+  test("a real loopback connection resolves to the actual socket address, not 'unknown'", async () => {
+    handle = await createKumikoServer({
+      features: [probeFeature],
+      port: 0,
+      installSignalHandlers: false,
+      anonymousAccess: { defaultTenantId: TENANT_ID },
+    });
+    const port = handle.server?.port;
+    if (port === undefined) throw new Error("expected handle.server to be listening");
+
+    const res = await fetch(`http://127.0.0.1:${port}/api/query`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ type: "dev-server-probe:query:whoami", payload: {} }),
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data?: { ip?: string } };
+    // See the matching prod-side test (run-prod-app.integration.test.ts)
+    // for why the assertion matches the loopback family instead of a
+    // fixed literal (IPv4 vs. IPv4-mapped IPv6 is a platform detail).
+    expect(body.data?.ip).toMatch(/^(::ffff:)?127\.0\.0\.1$/);
+  });
+});

package/src/__tests__/merge-extra-context.test.ts

@@ -26,19 +26,30 @@ describe("mergeExtraContext", () => {
     expect(merged).toBe(base);
   });
 
-  test("config preset merges configResolver, keeping base-object fields", () => {
+  test("config preset merges configResolver + _configAccessorFactory, keeping base-object fields", () => {
     const merged = mergeExtraContext({ foo: "bar" }, ["config"]);
     expect(typeof merged).toBe("function");
     const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
     expect(result["foo"]).toBe("bar");
     expect(result["configResolver"]).toBeDefined();
+    // buildHandlerContext derives ctx.config from _configAccessorFactory, not configResolver (fw#3313).
+    expect(result["_configAccessorFactory"]).toBeDefined();
   });
 
-  test("config preset merges configResolver, keeping base-fn fields", () => {
+  test("config preset merges configResolver + _configAccessorFactory, keeping base-fn fields", () => {
     const merged = mergeExtraContext(() => ({ fromFn: 1 }), ["config"]);
     const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
     expect(result["fromFn"]).toBe(1);
     expect(result["configResolver"]).toBeDefined();
+    expect(result["_configAccessorFactory"]).toBeDefined();
+  });
+
+  test("config preset keeps a base-supplied configResolver and derives the factory from it", () => {
+    const ownResolver = { get: async () => undefined } as never;
+    const merged = mergeExtraContext({ configResolver: ownResolver }, ["config"]);
+    const result = (merged as (deps: typeof fakeDeps) => Record<string, unknown>)(fakeDeps);
+    expect(result["configResolver"]).toBe(ownResolver);
+    expect(result["_configAccessorFactory"]).toBeDefined();
   });
 
   test("template-resolver preset merges templateResolver, built from deps.db", () => {

package/src/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.320.0",
+    "type": "breaking",
+    "title": "createKumikoServer/runDevApp gained a trustedProxyHops option",
+    "detail": "`CreateKumikoServerOptions`/`RunDevAppOptions` gained a top-level\n`trustedProxyHops`, forwarded into `setupTestStack`'s `buildServer` call.\nDev normally runs unproxied, so this is usually left unset (default 0).",
+    "migration": "No action needed for the default (unproxied) dev setup. Set\n`trustedProxyHops` only if you run the dev server behind a reverse proxy."
+  },
+  {
+    "version": "0.320.0",
+    "type": "fix",
+    "title": "setupTestStackFromFeatures' config preset now also derives _configAccessorFactory",
+    "detail": "buildHandlerContext derives ctx.config from _configAccessorFactory, not configResolver directly, so a write handler under presets: [\"config\"] saw ctx.config as undefined even with a configResolver present. mergeExtraContext now also runs addConfigAccessorFactory (the same helper runProdApp/runDevApp use), keeping a base-supplied configResolver winning over the preset default. Closes #3313."
+  },
+  {
+    "version": "0.320.0",
+    "type": "breaking",
+    "title": "Dev-server HTML no longer injects __KUMIKO_SCHEMA__ either",
+    "migration": "Same semantics as the prod change: `DevHostDispatchResult.injectSchema`\nis deprecated and ignored. The dev-server's auto-mint mode still sets\nthe `kumiko_auth`/`kumiko_csrf` cookies on the HTML response, so a\nclient-side fetch to `/api/schema` is authenticated immediately without\na real login round-trip."
+  },
   {
     "version": "0.308.0",
     "type": "improvement",

package/src/create-kumiko-server.ts

@@ -23,6 +23,7 @@ import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-
 import {
   type AuthRoutesConfig,
   buildRequestContextDataFromRequest,
+  createClientIpResolver,
   type ExtraRouteDefinition,
   generateToken,
   requestContext,
@@ -46,12 +47,14 @@ import {
   resolveAndInjectPageHead,
 } from "@cosmicdrift/kumiko-headless/apex";
 import { startDevJobRunners } from "@cosmicdrift/kumiko-server-runtime/boot/job-run-logger";
-import { buildBunServeOptions } from "@cosmicdrift/kumiko-server-runtime/bun-serve-options";
+import {
+  buildBunServeOptions,
+  resolveDerivedMaxRequestBodySize,
+} from "@cosmicdrift/kumiko-server-runtime/bun-serve-options";
 import {
   makeDispatchSystemWrite,
   type SystemWireDeps,
 } from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
-import { injectSchema } from "@cosmicdrift/kumiko-server-runtime/inject-schema";
 import {
   canResolveTailwindStylesheet,
   resolveTailwindCli,
@@ -102,24 +105,23 @@ export type DevClientEntry = {
   readonly htmlPath?: string;
 };
 
-/** Discriminated-Union, identisch zur Form von `runProdApp.hostDispatch`.
- *  Damit kann Dev/Prod-Routing 1:1 gespiegelt werden — ein Apex-404 in
- *  Prod ist ein Apex-404 in Dev (mit `/etc/hosts`-Eintrag für die
- *  betroffene Domain). Schema-Inject ist pro Response steuerbar — ein
- *  Public-Bundle leakt das Admin-Schema nicht, auch nicht in Dev. */
+/** Discriminated union, identical in shape to `runProdApp.hostDispatch`, so
+ *  dev/prod routing mirrors 1:1 — an apex 404 in prod is an apex 404 in dev
+ *  (with an `/etc/hosts` entry for the affected domain). HTML never carries
+ *  a schema, in dev or prod — createKumikoApp fetches it itself from the
+ *  authenticated GET /api/schema. */
 export type DevHostDispatchResult =
   | {
       readonly kind: "html";
       readonly entryName: string;
-      /** Default: true. Setze `false` für Public-Routes — analog zu
-       *  prod-`injectSchema:false` für Anonymous-Visitors. */
+      /** @deprecated Ignored — HTML never carries the schema; createKumikoApp
+       *  fetches it from the authenticated GET /api/schema. */
       readonly injectSchema?: boolean;
     }
   | {
-      /** Static-HTML: liefert eine Datei wortwörtlich, kein Bundle-Inject,
-       *  kein Schema-Inject. Pendant zu prod's `{ kind: "html", file: ...,
-       *  injectSchema: false }` für Marketing-/Apex-Pages die kein React
-       *  brauchen. Pfad relativ zum Server-CWD. */
+      /** Static HTML: serves a file verbatim, no bundle injection. Mirrors
+       *  prod's `{ kind: "html", file: ... }` for marketing/apex pages that
+       *  don't need React. Path relative to the server CWD. */
       readonly kind: "static-html";
       readonly file: string;
     }
@@ -232,6 +234,10 @@ export type CreateKumikoServerOptions = {
    *  inside buildServer (setupTestStack), before the Static/HTML-fallback,
    *  so an own GET (/feed.xml, /og-image, …) wins over the dev-asset path. */
   readonly extraRoutes?: readonly ExtraRouteDefinition[];
+  /** Forwarded to setupTestStack → buildServer's top-level
+   *  `ServerOptions.trustedProxyHops`. Dev usually runs unproxied, so this
+   *  is normally left unset (default 0). */
+  readonly trustedProxyHops?: number;
   /** Hook for app-wired co-running components that need the system-write
    *  dispatcher — runs after buildServer, before onAfterSetup (seeds), with
    *  NO `app` (routes are declared via `extraRoutes`, not wired here). */
@@ -495,9 +501,10 @@ async function tryServePublicAsset(
   pathname: string,
   app: HonoLikeApp,
   publicDir: string,
+  socketAddress?: string,
 ): Promise<Response | undefined> {
   if (!isRoutableGetOrHead(req, pathname) || !pathname.includes(".")) return undefined;
-  const honoTry = await tryHonoFirst(app, req);
+  const honoTry = await tryHonoFirst(app, req, socketAddress);
   if (honoTry.matched) {
     return honoTry.response;
   }
@@ -512,9 +519,6 @@ async function tryServePublicAsset(
   return honoTry.response;
 }
 
-// injectSchema lebt in `./inject-schema.ts` damit dev-server + prod-
-// server denselben Inject-Pfad nutzen.
-
 async function watchDir(
   dir: string,
   onChange: (filename: string) => void,
@@ -898,6 +902,7 @@ export async function createKumikoServer(
       effectiveFeatures: options.effectiveFeatures,
     }),
     ...(options.extraRoutes !== undefined && { extraRoutes: options.extraRoutes }),
+    ...(options.trustedProxyHops !== undefined && { trustedProxyHops: options.trustedProxyHops }),
     // jobs.consumerLane unset = enqueuer-only; startDevJobRunners below is
     // the sole consumer/cron-scheduler per lane, so runOnBoot/cron jobs
     // don't double-fire. queueNamePrefix keeps this boot's queues isolated
@@ -968,17 +973,14 @@ export async function createKumikoServer(
   const autoMintJwt = options.auth === undefined;
   const devUser = TestUsers.admin;
 
-  // AppSchema einmal beim Boot bauen. Sample-clients ohne explizites
-  // schema-Argument lesen das via window.__KUMIKO_SCHEMA__ aus — der
-  // dev-server injiziert das in jede HTML-Response. Re-build NICHT
-  // bei Hot-Reload weil sich Feature-Defs nur über einen restart
-  // ändern.
-  const appSchemaJson = JSON.stringify(
-    buildAppSchema(stack.registry, {
-      authoringWarnings: true,
-      searchAdapterMissing: !stack.context.searchAdapter,
-    }),
-  );
+  // Build once at boot purely to surface authoring warnings (settings-hub
+  // placement etc.) at the same point prod would — clients fetch the actual
+  // schema themselves from GET /api/schema, so the result itself is
+  // discarded here.
+  buildAppSchema(stack.registry, {
+    authoringWarnings: true,
+    searchAdapterMissing: !stack.context.searchAdapter,
+  });
 
   // --- SSE reload ---
   // bootId identifiziert diese spezifische Server-Process-Instanz. Wird
@@ -1000,24 +1002,39 @@ export async function createKumikoServer(
     }
   };
 
-  // Build a fresh HTML response. Im Auto-Mint-Modus (keine auth-Config)
-  // packen wir direkt ein gültiges JWT + CSRF-Cookie rein — Deep-Links
-  // funktionieren sofort ohne Login. Im Auth-Modus serven wir nur die
-  // nackte HTML; der Client geht dann durch /auth/login und bekommt die
-  // Cookies von dort.
+  // Build a fresh HTML response. In auto-mint mode (no auth config) we
+  // pack a valid JWT + CSRF cookie right in — deep-links work immediately
+  // without login (and that auth cookie is what a client-side fetch to
+  // GET /api/schema authenticates with). In auth mode we serve the bare
+  // HTML; the client then goes through /auth/login and gets its cookies
+  // from there.
   //
-  // entryName + injectSchemaForEntry werden vom Caller (handleFetch)
-  // bestimmt nachdem er hostDispatch evaluiert hat. Ohne hostDispatch
-  // ist es immer "client" mit Schema-Inject true (Single-Entry-Default
-  // damit der Client TypeScript-Schemas findet).
+  // entryName is decided by the caller (handleFetch) after evaluating
+  // hostDispatch. Without hostDispatch it's always "client" (single-entry
+  // default).
   //
   // Anonymous-role systemQuery, shared by resolvePageHead and hostDispatch —
   // mirrors runProdApp's HostDispatchFn deps so dev/prod stay symmetric.
+  // Own resolver mirroring the same effective hops as setupTestStack's
+  // internal buildServer — this path runs for
+  // page-head/hostDispatch resolution, ahead of requestIdMiddleware's
+  // /api/* mount, so it can't reuse that instance. Two independent
+  // warn-once flags in dev is an accepted, low-risk gap (dev normally
+  // runs unproxied — see CreateKumikoServerOptions.trustedProxyHops).
+  const pageHeadClientIpResolver = createClientIpResolver(
+    options.trustedProxyHops ?? 0,
+    "createKumikoServer(pageHead)",
+  );
   const buildDevSystemQuery =
-    (req: Request): PageHeadSystemQuery =>
+    (req: Request, socketAddress?: string): PageHeadSystemQuery =>
     (type, payload, tenantId) =>
-      requestContext.run(requestContext.get() ?? buildRequestContextDataFromRequest(req), () =>
-        stack.dispatcher.query(type, payload, createAnonymousUser(tenantId)),
+      requestContext.run(
+        requestContext.get() ??
+          buildRequestContextDataFromRequest(req, {
+            resolver: pageHeadClientIpResolver,
+            socketAddress,
+          }),
+        () => stack.dispatcher.query(type, payload, createAnonymousUser(tenantId)),
       );
 
   // resolvePageHead goes through the same headless resolveAndInjectPageHead
@@ -1025,8 +1042,8 @@ export async function createKumikoServer(
   // fallback path instead of a second copy of it (#3026).
   const htmlResponse = async (
     entryName: string,
-    doInjectSchema: boolean,
     req: Request,
+    socketAddress?: string,
   ): Promise<Response> => {
     const template = htmlTemplates.get(entryName) ?? defaultTemplate;
     const headers = new Headers();
@@ -1039,14 +1056,13 @@ export async function createKumikoServer(
     }
     let html = injectReload(template);
     if (stylesheetPath !== undefined) html = injectStylesheet(html);
-    if (doInjectSchema) html = injectSchema(html, appSchemaJson);
     if (options.resolvePageHead !== undefined) {
       const url = new URL(req.url);
       const host = req.headers.get("host") ?? url.host;
       html = await resolveAndInjectPageHead(html, options.resolvePageHead, {
         path: url.pathname,
         host,
-        systemQuery: buildDevSystemQuery(req),
+        systemQuery: buildDevSystemQuery(req, socketAddress),
       });
     }
     return new Response(html, { headers });
@@ -1064,7 +1080,7 @@ export async function createKumikoServer(
   // process.cwd() is the app workspace, so public/ is its static asset dir.
   const publicDir = resolve(process.cwd(), "public");
 
-  const handleFetch = async (req: Request): Promise<Response> => {
+  const handleFetch = async (req: Request, socketAddress?: string): Promise<Response> => {
     const url = new URL(req.url);
 
     // Specific routes first — assets, reload-SSE, API.
@@ -1162,14 +1178,16 @@ export async function createKumikoServer(
       isRoutableGetOrHead(req, url.pathname) &&
       !url.pathname.includes(".")
     ) {
-      const honoTry = await tryHonoFirst(stack.app, req);
+      const honoTry = await tryHonoFirst(stack.app, req, socketAddress);
       if (honoTry.matched) {
         return honoTry.response;
       }
       // Discriminated-Dispatch — symmetric zu prod. Ohne hostDispatch
       // landet das im Single-Entry-Default ("client" + Schema-Inject).
       if (options.hostDispatch !== undefined) {
-        const dispatch = await options.hostDispatch(req, { systemQuery: buildDevSystemQuery(req) });
+        const dispatch = await options.hostDispatch(req, {
+          systemQuery: buildDevSystemQuery(req, socketAddress),
+        });
         if (dispatch.kind === "redirect") {
           return new Response(null, {
             status: dispatch.status ?? 302,
@@ -1180,28 +1198,34 @@ export async function createKumikoServer(
           return new Response("Not Found", { status: 404 });
         }
         if (dispatch.kind === "static-html") {
-          // Raw-File-Serve, kein Bundle-Inject, kein Schema-Inject.
-          // Pendant zu prod's `{ kind: "html", file: ..., injectSchema: false }`.
+          // Raw file serve, no bundle injection — mirrors prod's
+          // `{ kind: "html", file: ... }` static-html branch.
           const file = await readFile(dispatch.file, "utf-8");
           return new Response(file, {
             headers: { "Content-Type": "text/html; charset=utf-8" },
           });
         }
-        return htmlResponse(dispatch.entryName, dispatch.injectSchema ?? true, req);
+        return htmlResponse(dispatch.entryName, req, socketAddress);
       }
-      return htmlResponse("client", true, req);
+      return htmlResponse("client", req, socketAddress);
     }
 
     // Static assets under public/ — see tryServePublicAsset's own comment
     // for the Hono → file → router-miss ordering.
-    const staticAsset = await tryServePublicAsset(req, url.pathname, stack.app, publicDir);
+    const staticAsset = await tryServePublicAsset(
+      req,
+      url.pathname,
+      stack.app,
+      publicDir,
+      socketAddress,
+    );
     if (staticAsset !== undefined) return staticAsset;
 
     // Bypasses tryHonoFirst entirely (API paths, /sse, non-GET/HEAD), so the
     // router-miss marker must be stripped here too — otherwise an unmatched
     // path would leak it straight to the client (see try-hono-first.ts's
     // header-hygiene note).
-    return stripNoRouteMatchHeader(await stack.app.fetch(req));
+    return stripNoRouteMatchHeader(await stack.app.fetch(req, socketAddress));
   };
 
   // --- HTTP server (Bun only) ---
@@ -1213,7 +1237,7 @@ export async function createKumikoServer(
   // (idleTimeout: 0). Spec-Test in run-prod-app-spec.test.ts pinst das.
   const server = hasBun
     ? (globalThis as { Bun: { serve: (opts: unknown) => BunServer } }).Bun.serve(
-        buildBunServeOptions(port, handleFetch),
+        buildBunServeOptions(port, handleFetch, resolveDerivedMaxRequestBodySize(stack.registry)),
       )
     : undefined;
 
@@ -1247,7 +1271,10 @@ export async function createKumikoServer(
           if (action === "ignore") return;
           if (action === "restart") {
             logInfo(
-              `[kumiko-server] schema change in ${filename} — restarting (Bun caches imports, hot-reload reicht hier nicht)`,
+              `[kumiko-server] schema change in ${filename} — restarting (Bun caches imports, hot-reload reicht hier nicht). ` +
+                "The kumiko-dev wrapper (package.json's `dev` script) respawns automatically " +
+                "and re-syncs new r.entity() columns on the new boot; running this entry " +
+                "directly (not via kumiko-dev) exits here without restarting.",
             );
             await stop();
             process.exit(75);

package/src/run-dev-app.ts

@@ -44,7 +44,11 @@ import {
   SESSIONS_FEATURE,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
-import type { SessionMetadata, TokenVerifier } from "@cosmicdrift/kumiko-framework/api";
+import type {
+  PostAuthLandingResolver,
+  SessionMetadata,
+  TokenVerifier,
+} from "@cosmicdrift/kumiko-framework/api";
 import { createInMemoryLoginRateLimiter } from "@cosmicdrift/kumiko-framework/api";
 import {
   configureBlindIndexKey,
@@ -162,6 +166,10 @@ export type RunDevAppAuthOptions = {
    *  RunProdAppAuthOptions — dev usually runs unproxied, so this is normally
    *  left unset (default 0). */
   readonly trustedProxyHops?: number;
+  /** Server-computed post-auth redirect (see AuthRoutesConfig.postAuthLanding).
+   *  Result lands in the login/signup/invite response as `landingPath`; an
+   *  invalid path or a throwing resolver just omits the field. */
+  readonly postAuthLanding?: PostAuthLandingResolver;
 };
 
 /** Hook for app-specific seeding (demo data, fixtures). Runs after the
@@ -268,6 +276,12 @@ export type RunDevAppOptions = {
    *  something the user can click. Pass an object to override the
    *  features-dir hint or the docs URL. */
   readonly welcomeBanner?: boolean | { readonly featuresDir?: string; readonly docsUrl?: string };
+  /** Forwarded to createKumikoServer → setupTestStack's top-level
+   *  `trustedProxyHops` — symmetric to
+   *  RunProdAppOptions.trustedProxyHops. Wins over the deprecated
+   *  `auth.trustedProxyHops`. Dev usually runs unproxied, so this is
+   *  normally left unset (default 0). */
+  readonly trustedProxyHops?: number;
 };
 
 export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServerHandle> {
@@ -491,6 +505,9 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     ...(options.files !== undefined && { files: options.files }),
     ...(options.extraRoutes !== undefined && { extraRoutes: options.extraRoutes }),
     ...(options.wire !== undefined && { wire: options.wire }),
+    ...((options.trustedProxyHops ?? effectiveAuth?.trustedProxyHops) !== undefined && {
+      trustedProxyHops: options.trustedProxyHops ?? effectiveAuth?.trustedProxyHops,
+    }),
     ...(finalEffectiveFeatures !== undefined && {
       effectiveFeatures: finalEffectiveFeatures,
     }),
@@ -514,6 +531,9 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
         ...(effectiveAuth.trustedProxyHops !== undefined && {
           trustedProxyHops: effectiveAuth.trustedProxyHops,
         }),
+        ...(effectiveAuth.postAuthLanding !== undefined && {
+          postAuthLanding: effectiveAuth.postAuthLanding,
+        }),
         ...sessionAuthFragment,
         ...patAuthFragment,
         ...(mfaFeature && {

package/src/scaffold-app.ts

@@ -705,9 +705,9 @@ function renderDev(appName: string): string {
 function renderClient(appName: string): string {
   return [
     "// Browser entry. runDevApp's clientEntry option bundles this file to",
-    "// /client.js and the default HTML loads it. createKumikoApp reads the",
-    "// schema from the window global (injectSchema in the dev-server sets it)",
-    "// and mounts the routes.",
+    "// /client.js and the default HTML loads it. createKumikoApp fetches the",
+    "// AppSchema itself from the authenticated GET /api/schema and mounts",
+    "// the routes.",
     "//",
     "// AppShell wraps DefaultAppShell to supply `brand` — createKumikoApp's",
     "// shell option only injects schema + children. Without `shell` the",

package/src/setup-test-stack-from-features.ts

@@ -1,7 +1,10 @@
 // Test helper: composeFeatures + setupTestStack in one call.
 // Apps pass the same feature list as run-config (APP_FEATURES / buildAppFeatures).
 
-import { createConfigResolver } from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  type ConfigResolver,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
 import { createTemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -13,6 +16,7 @@ import {
   type ComposeFeaturesOptions,
   composeFeatures,
 } from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import { addConfigAccessorFactory } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 
 export type TestStackPreset = "config" | "template-resolver";
 
@@ -34,8 +38,10 @@ export function mergeExtraContext(
     const merged: Record<string, unknown> = { ...fromBase };
 
     if (presets.includes("config")) {
-      const configResolver = createConfigResolver();
-      merged["configResolver"] = configResolver;
+      // Same precedence as mergeConfigResolverDefault (run-dev-app.ts) — a base-supplied resolver wins, factory always derives from it (fw#3313).
+      const configResolver =
+        (fromBase["configResolver"] as ConfigResolver | undefined) ?? createConfigResolver();
+      Object.assign(merged, addConfigAccessorFactory({ configResolver }, deps.registry));
     }
     if (presets.includes("template-resolver")) {
       merged["templateResolver"] = createTemplateResolverApi(deps.db);