@cosmicdrift/kumiko-dev-server 0.377.0 → 0.378.0

package/dist/compose-stacks.d.ts

@@ -4,6 +4,7 @@ import { type BillingFoundationOptions } from "@cosmicdrift/kumiko-bundled-featu
 import { type CreateCapOverviewOptions } from "@cosmicdrift/kumiko-bundled-features/cap-overview";
 import { type LegalPagesOptions } from "@cosmicdrift/kumiko-bundled-features/legal-pages";
 import { type SubscriptionMollieOptions } from "@cosmicdrift/kumiko-bundled-features/subscription-mollie";
+import { type TemplateResolverOptions } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { type CreateTierEngineOptions } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
 import { type UserDataRightsOptions } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
 import { type WaitlistOptions } from "@cosmicdrift/kumiko-bundled-features/waitlist";
@@ -72,6 +73,8 @@ export type RendererStackOptions = {
     readonly mailFooter?: MailFooterResolver;
     /** Word after the tenant name in the mail's brand row, e.g. "Status". */
     readonly mailBrandSuffix?: MailBrandSuffixResolver;
+    /** Passed to createTemplateResolverFeature, e.g. `tenantEditable` to let a TenantAdmin edit chosen templates. */
+    readonly templateResolver?: TemplateResolverOptions;
 };
 export declare function composeRendererStack(options?: RendererStackOptions): FeatureDefinition[];
 /** Tenant mail transports reach users through channel-email, so the stack needs `mail`. */

package/dist/compose-stacks.js

@@ -32,7 +32,7 @@ import { createRateLimitingFeature } from "@cosmicdrift/kumiko-bundled-features/
 import { createRendererFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/renderer-foundation";
 import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { createSubscriptionMollieFeature, } from "@cosmicdrift/kumiko-bundled-features/subscription-mollie";
-import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import { createTemplateResolverFeature, } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { createTenantLifecycleFeature } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
 import { createTierEngineFeature, } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
 import { createUserDataRightsFeature, } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
@@ -64,7 +64,7 @@ export function composePagesStack(options = {}) {
 }
 export function composeRendererStack(options = {}) {
     return [
-        createTemplateResolverFeature(),
+        createTemplateResolverFeature(options.templateResolver),
         createRendererFoundationFeature(),
         createRendererMailHtmlFeature({
             ...(options.mailFooter !== undefined && { footer: options.mailFooter }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.377.0",
+  "version": "0.378.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,14 +77,14 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.377.0",
-    "@cosmicdrift/kumiko-framework": "0.377.0",
-    "@cosmicdrift/kumiko-renderer": "0.377.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.377.0",
-    "@cosmicdrift/kumiko-guards": "0.377.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.377.0",
-    "@cosmicdrift/kumiko-testing": "0.377.0",
-    "@cosmicdrift/kumiko-types": "0.377.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.378.0",
+    "@cosmicdrift/kumiko-framework": "0.378.0",
+    "@cosmicdrift/kumiko-renderer": "0.378.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.378.0",
+    "@cosmicdrift/kumiko-guards": "0.378.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.378.0",
+    "@cosmicdrift/kumiko-testing": "0.378.0",
+    "@cosmicdrift/kumiko-types": "0.378.0",
     "bun-types": "^1.3.13",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "composeRendererStack forwards templateResolver options",
+    "detail": "RendererStackOptions.templateResolver is passed to createTemplateResolverFeature, so an app can set tenantEditable."
+  },
   {
     "version": "0.376.0",
     "type": "improvement",

package/templates/managed/husky-pre-push.template

@@ -8,15 +8,35 @@ fi
 # Walk up so a worktree without its own node_modules resolves via the parent
 # install, but not past an enclosing repository: a bin above that boundary
 # belongs to another project. `[ -x ]` also skips a broken (uninstalled) symlink.
+# A bin in an ancestor that is owned by someone else or group/world-writable
+# (/tmp, /Users/Shared) is attacker-plantable and must never be exec'd, and
+# $HOME is the upper trust boundary (inclusive), compared by physical path
+# because git prints REPO_ROOT resolved: a trailing slash or a symlinked home
+# would otherwise never match and the walk would continue to /.
+HOME_BOUND=""
+if [ -n "$HOME" ] && [ -d "$HOME" ]; then
+  HOME_BOUND="$(cd "$HOME" 2>/dev/null && pwd -P)"
+fi
 BIN=""
 DIR="$REPO_ROOT"
 while true; do
-  CANDIDATE="$DIR/node_modules/.bin/kumiko-pre-push"
-  if [ -x "$CANDIDATE" ]; then
-    BIN="$CANDIDATE"
-    break
+  TRUSTED=1
+  if [ "$DIR" != "$REPO_ROOT" ]; then
+    if [ ! -O "$DIR" ] || [ -n "$(find "$DIR" -maxdepth 0 \( -perm -0020 -o -perm -0002 \) -print 2>/dev/null)" ]; then
+      TRUSTED=0
+    fi
+  fi
+  if [ "$TRUSTED" = 1 ]; then
+    BIN_DIR="$DIR/node_modules/.bin"
+    CANDIDATE="$BIN_DIR/kumiko-pre-push"
+    # The bin dir itself must be user-owned and not group/world-writable, or a
+    # planted entry could replace the real bin.
+    if [ -x "$CANDIDATE" ] && [ -O "$BIN_DIR" ] && [ -z "$(find "$BIN_DIR" -maxdepth 0 \( -perm -0020 -o -perm -0002 \) -print 2>/dev/null)" ]; then
+      BIN="$CANDIDATE"
+      break
+    fi
   fi
-  if [ "$DIR" = "/" ]; then
+  if [ "$DIR" = "/" ] || { [ -n "$HOME_BOUND" ] && [ "$DIR" = "$HOME_BOUND" ]; }; then
     break
   fi
   if [ "$DIR" != "$REPO_ROOT" ] && [ -e "$DIR/.git" ]; then