@cosmicdrift/kumiko-framework 0.326.0 → 0.327.0

package/src/api/jwt.ts

@@ -25,6 +25,8 @@ export type JwtPayload = {
   // Present when the app wires a `sessionCreator` callback (see sessions
   // feature). Absent → stateless-JWT mode, no revocation possible.
   jti?: string;
+  // Expiry as epoch seconds, so long-lived consumers (WebSocket) can enforce it after the upgrade.
+  exp?: number;
 };
 
 export type JwtHelper = {
@@ -184,6 +186,9 @@ export function createJwtHelper(
       if (typeof payload.jti === "string") {
         result.jti = payload.jti;
       }
+      if (typeof payload.exp === "number") {
+        result.exp = payload.exp;
+      }
       return result;
     },
     ttlSeconds,

package/src/api/origin-middleware.ts

@@ -31,7 +31,7 @@ export function isForeignCookieOrigin(c: Context, allowlist: ReadonlySet<string>
   return c.req.header("sec-fetch-site") === "cross-site";
 }
 
-function rejectOrigin(c: Context): Response {
+export function rejectOrigin(c: Context): Response {
   return c.json(
     {
       error: {
@@ -45,6 +45,32 @@ function rejectOrigin(c: Context): Response {
   );
 }
 
+// WebSocket upgrades are GETs, so originMiddleware/csrfMiddleware never see
+// them — yet a cookie-authenticated upgrade from a foreign page is a
+// cross-site WebSocket hijack. Bearer transports can't be set by a browser
+// WebSocket and need no check.
+export function isWebSocketOriginAllowed(
+  c: Context,
+  normalizedAllowlist: ReadonlySet<string> | undefined,
+): boolean {
+  if (getAuthTransport(c) !== "cookie") return true;
+  const origin = c.req.header("origin");
+  if (origin === undefined || origin === "null") return false;
+  let originHost: string;
+  try {
+    originHost = new URL(origin).host.toLowerCase();
+  } catch {
+    return false;
+  }
+  // With an allowlist there is deliberately no same-host fallback: wide
+  // cookieDomain setups are exactly where a sibling subdomain is the attacker.
+  if (normalizedAllowlist !== undefined && normalizedAllowlist.size > 0) {
+    return isOriginAllowed(origin, normalizedAllowlist);
+  }
+  const requestHost = c.req.header("host")?.toLowerCase();
+  return requestHost !== undefined && originHost === requestHost;
+}
+
 // Server-side Origin-allowlist guard — an additional CSRF-hardening layer on
 // top of the double-submit token (csrf-middleware) for deployments that widen
 // the auth cookie across subdomains via AuthRoutesConfig.cookieDomain. A wide

package/src/api/server.ts

@@ -15,6 +15,7 @@ import {
   type RunIn,
   type SessionUser,
   type TenantId,
+  type WebSocketRouteDefinition,
   type WriteResult,
 } from "../engine/types";
 import { createFileContext } from "../files/file-handle";
@@ -22,6 +23,7 @@ import type { FileRoutesOptions } from "../files/file-routes";
 import { createFileRoutes, readFilesRouteOptions } from "../files/file-routes";
 import { makeFileProviderResolver } from "../files/provider-resolver";
 import type { Lifecycle } from "../lifecycle";
+import { createFallbackLogger } from "../logging";
 import {
   createNoopProvider,
   DEFAULT_SENSITIVE_CONFIG,
@@ -60,7 +62,9 @@ import { assertUnreachable, generateId } from "../utils";
 import { NO_ROUTE_MATCH_HEADER_NAME, PUBLIC_API_PATHS, Routes } from "./api-constants";
 import {
   type AnonymousAccessResolved,
+  type AuthSessionChecker,
   authMiddleware,
+  getAuthTokenExpiry,
   getUser,
   type TenantLifecycleStatusResolver,
 } from "./auth-middleware";
@@ -82,11 +86,17 @@ import {
 import { computeStrongEtag, etagMatches } from "./http-cache";
 import { createJwtHelper, type JwtHelper, type JwtKeyring } from "./jwt";
 import { observabilityMiddleware } from "./observability-middleware";
-import { assertOriginGuardConfig, normalizeOrigin, originMiddleware } from "./origin-middleware";
+import {
+  assertOriginGuardConfig,
+  isWebSocketOriginAllowed,
+  normalizeOrigin,
+  originMiddleware,
+  rejectOrigin,
+} from "./origin-middleware";
 import { patRouteGuard } from "./pat-route-guard";
 import { piiCiphertextResponseGuard } from "./pii-leak-guard";
 import { createDefaultSseBroker, type RedisSseBroker } from "./redis-sse-broker";
-import { requestContext } from "./request-context";
+import { type RequestContextData, requestContext } from "./request-context";
 import { buildRequestContextData, requestIdMiddleware } from "./request-id-middleware";
 import {
   DEFAULT_MAX_REQUEST_BYTES,
@@ -98,6 +108,15 @@ import {
 import { createApiRoutes } from "./routes";
 import type { SseBroker } from "./sse-broker";
 import { createSseRoute } from "./sse-route";
+import {
+  buildWebSocketSessionRevalidator,
+  createWebSocketConnectionLimiter,
+  hasWebSocketUpgradeServer,
+  isWebSocketUpgradeRequest,
+  WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER,
+  WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES,
+  type WebSocketConnectionLimiter,
+} from "./websocket-route";
 
 export type ServerOptions = {
   registry: Registry;
@@ -985,6 +1004,39 @@ export function buildServer(options: ServerOptions): KumikoServer {
     }
   }
 
+  // r.webSocketRoute — GET routes under /api/ws/*, so the jwt/pat/rate-limit
+  // chain above already ran. Origin/CSRF guards skip GETs, hence the own check.
+  const webSocketOriginAllowlist = allowedOrigins?.length
+    ? new Set(allowedOrigins.map(normalizeOrigin))
+    : undefined;
+  const webSocketRoutePaths = new Map<string, string>();
+  const webSocketConnectionLimiter = createWebSocketConnectionLimiter();
+  for (const feature of options.registry.features.values()) {
+    for (const route of Object.values(feature.webSocketRoutes)) {
+      const owner = webSocketRoutePaths.get(route.path);
+      if (owner !== undefined) {
+        throw new Error(
+          `[kumiko] WebSocket route "${route.path}" is declared by both feature "${owner}" and ` +
+            `"${feature.name}" — paths must be unique across features.`,
+        );
+      }
+      webSocketRoutePaths.set(route.path, feature.name);
+      app.get(
+        route.path,
+        buildWebSocketRouteHandler(route, {
+          dispatcher,
+          clientIpResolver,
+          originAllowlist: webSocketOriginAllowlist,
+          ...(options.auth?.sessionChecker ? { sessionChecker: options.auth.sessionChecker } : {}),
+          ...(tenantLifecycleResolver
+            ? { resolveTenantLifecycleStatus: tenantLifecycleResolver }
+            : {}),
+          connectionLimiter: webSocketConnectionLimiter,
+        }),
+      );
+    }
+  }
+
   // extraRoutes (kumiko-framework#3050) — declarative HTTP-routes with a
   // Pflicht `entry` tier. Mounted after r.httpRoute for the same reason: an
   // extraRoute dispatching through `dispatcher` builds Hono's matcher, so
@@ -1218,6 +1270,113 @@ function unauthenticatedResponse(c: import("hono").Context): Response {
   );
 }
 
+type WebSocketRouteHandlerDeps = {
+  readonly dispatcher: Dispatcher;
+  readonly clientIpResolver: ClientIpResolver;
+  readonly originAllowlist: ReadonlySet<string> | undefined;
+  readonly sessionChecker?: AuthSessionChecker;
+  readonly resolveTenantLifecycleStatus?: TenantLifecycleStatusResolver;
+  readonly connectionLimiter: WebSocketConnectionLimiter;
+};
+
+const webSocketLog = createFallbackLogger("websocket");
+
+function webSocketErrorResponse(
+  c: import("hono").Context,
+  status: 400 | 426 | 429 | 501,
+  code: string,
+  message: string,
+): Response {
+  return c.json({ error: { code, httpStatus: status, message } }, status);
+}
+
+function buildWebSocketRouteHandler(
+  route: WebSocketRouteDefinition,
+  shared: WebSocketRouteHandlerDeps,
+  // biome-ignore lint/suspicious/noExplicitAny: Hono context generics are invisible at the framework boundary
+): (c: import("hono").Context<any, any>) => Promise<Response> {
+  return async (c) => {
+    if (!isWebSocketOriginAllowed(c, shared.originAllowlist)) return rejectOrigin(c);
+    const user = getUser(c);
+    if (isMissingOrAnonymousUser(user)) return unauthenticatedResponse(c);
+    if (!isWebSocketUpgradeRequest(c.req.raw)) {
+      return webSocketErrorResponse(
+        c,
+        426,
+        "websocket_upgrade_required",
+        "this route only accepts WebSocket upgrade requests",
+      );
+    }
+    const honoEnv: unknown = c.env;
+    if (!hasWebSocketUpgradeServer(honoEnv)) {
+      const message = "webSocketUpgradeFetch not wired: pass it to buildBunServeOptions";
+      webSocketLog.error(message, { path: route.path });
+      return webSocketErrorResponse(c, 501, "websocket_upgrade_not_wired", message);
+    }
+    // The slot is taken before connect (a refused attempt must not run it) and stays synchronous with
+    // the check, so concurrent upgrades can't overshoot the cap. Every path without a live socket frees it.
+    const releaseConnectionSlot = shared.connectionLimiter.tryAcquire(
+      `${route.path}\n${user.tenantId}\n${user.id}`,
+      route.maxConnectionsPerUser ?? WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER,
+    );
+    if (!releaseConnectionSlot) {
+      return webSocketErrorResponse(
+        c,
+        429,
+        "websocket_connection_limit",
+        "too many open WebSocket connections for this user",
+      );
+    }
+    let upgraded = false;
+    try {
+      const handlers = await route.connect(c, {
+        user,
+        query: (type, payload) => shared.dispatcher.query(type, payload, user),
+        write: (type, payload) => shared.dispatcher.write(type, payload, user),
+        clientIp: shared.clientIpResolver.resolve(clientIpSourceFromHonoContext(c)),
+      });
+      if (handlers instanceof Response) return handlers;
+
+      const captured = requestContext.get();
+      const requestContextData = captured ? withoutAbortSignal(captured) : undefined;
+      const revalidateSession = buildWebSocketSessionRevalidator({
+        user,
+        sessionChecker: shared.sessionChecker,
+        resolveTenantLifecycleStatus: shared.resolveTenantLifecycleStatus,
+        tokenExpiresAtSec: getAuthTokenExpiry(c),
+      });
+      upgraded = honoEnv.server.upgrade(c.req.raw, {
+        data: {
+          handlers,
+          maxMessageBytes: route.maxMessageBytes ?? WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES,
+          requestContextData,
+          revalidateSession,
+          releaseConnectionSlot,
+        },
+      });
+      if (!upgraded) {
+        return webSocketErrorResponse(
+          c,
+          400,
+          "websocket_upgrade_failed",
+          "the WebSocket upgrade was rejected",
+        );
+      }
+      // Bun ignores the returned Response after a successful upgrade.
+      return new Response(null);
+    } finally {
+      if (!upgraded) releaseConnectionSlot();
+    }
+  };
+}
+
+// The request's AbortSignal fires when the upgrade request ends, which would
+// abort every later handler running under the captured context.
+function withoutAbortSignal(data: RequestContextData): RequestContextData {
+  const { signal: _signal, ...rest } = data;
+  return rest;
+}
+
 function isKnownExtraRouteEntry(entry: unknown): entry is ExtraRouteEntry {
   return (
     entry === ExtraRouteEntries.anonymous ||

package/src/api/websocket-route.ts

@@ -0,0 +1,327 @@
+import {
+  WEBSOCKET_BACKPRESSURE_LIMIT_BYTES,
+  WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER,
+  WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES,
+  WEBSOCKET_MAX_PAYLOAD_BYTES,
+  WEBSOCKET_ROUTE_PATH_PREFIX,
+  type WebSocketConnection,
+  type WebSocketMessageData,
+  type WebSocketSessionHandlers,
+} from "@cosmicdrift/kumiko-types/websocket-route";
+import type { SessionUser } from "../engine/types";
+import { createFallbackLogger } from "../logging";
+import {
+  type AuthSessionChecker,
+  resolveTenantTeardownStatus,
+  sessionCheckStatus,
+  type TenantLifecycleStatusResolver,
+} from "./auth-middleware";
+import { type RequestContextData, requestContext } from "./request-context";
+
+export {
+  WEBSOCKET_BACKPRESSURE_LIMIT_BYTES,
+  WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER,
+  WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES,
+  WEBSOCKET_MAX_PAYLOAD_BYTES,
+  WEBSOCKET_ROUTE_PATH_PREFIX,
+};
+
+// Must stay below ingress-nginx's default 60 s proxy-read-timeout, or idle sockets get cut.
+export const WEBSOCKET_HEARTBEAT_INTERVAL_MS = 25_000;
+
+const CLOSE_POLICY_VIOLATION = 1008;
+const CLOSE_MESSAGE_TOO_BIG = 1009;
+const CLOSE_INTERNAL_ERROR = 1011;
+const CLOSE_TRY_AGAIN_LATER = 1013;
+
+// Consecutive failed session-store checks before a socket is closed: rides out a
+// short store blip, but a socket must not stay unverified forever.
+export const WEBSOCKET_REVALIDATION_FAILURE_LIMIT = 3;
+
+const log = createFallbackLogger("websocket");
+
+export type KumikoWebSocketData = {
+  readonly handlers: WebSocketSessionHandlers;
+  readonly maxMessageBytes: number;
+  // Socket callbacks run outside the Hono request, so the dispatcher's
+  // AsyncLocalStorage context is captured at upgrade time and re-entered.
+  readonly requestContextData: RequestContextData | undefined;
+  readonly revalidateSession: WebSocketSessionRevalidator | undefined;
+  // Frees this socket's per-user connection slot; called once on close.
+  readonly releaseConnectionSlot?: (() => void) | undefined;
+};
+
+export type WebSocketRevalidation = "live" | "expired" | "invalid";
+export type WebSocketSessionRevalidator = () => Promise<WebSocketRevalidation>;
+
+// Structural so Bun.Server satisfies it without this package depending on bun types.
+export type WebSocketUpgradeServer = {
+  upgrade(req: Request, options: { data: KumikoWebSocketData }): boolean;
+};
+
+// Second argument to `app.fetch(req, env)` on upgrade requests; plain requests
+// keep passing the bare socket-address string.
+export type KumikoServeEnv = {
+  readonly socketAddress?: string;
+  readonly server?: WebSocketUpgradeServer;
+};
+
+export type KumikoServerWebSocket = {
+  readonly data: KumikoWebSocketData;
+  send(data: WebSocketMessageData): unknown;
+  close(code?: number, reason?: string): void;
+  ping(): unknown;
+};
+
+export function isWebSocketUpgradeRequest(req: Request): boolean {
+  return req.headers.get("upgrade")?.toLowerCase() === "websocket";
+}
+
+export function hasWebSocketUpgradeServer(
+  honoEnv: unknown,
+): honoEnv is { readonly server: WebSocketUpgradeServer } {
+  return (
+    typeof honoEnv === "object" &&
+    honoEnv !== null &&
+    "server" in honoEnv &&
+    typeof honoEnv.server === "object" &&
+    honoEnv.server !== null &&
+    "upgrade" in honoEnv.server &&
+    typeof honoEnv.server.upgrade === "function"
+  );
+}
+
+function sameRoles(a: readonly string[], b: readonly string[]): boolean {
+  const left = new Set(a);
+  return left.size === new Set(b).size && b.every((role) => left.has(role));
+}
+
+// Same checks the HTTP guard runs per request, plus the JWT's own expiry (the
+// upgrade request passed the guard once, the socket outlives that). query/write
+// stay bound to the upgrade-time user, so changed roles close the socket
+// instead of silently serving stale permissions.
+export function buildWebSocketSessionRevalidator(deps: {
+  readonly user: SessionUser;
+  readonly sessionChecker?: AuthSessionChecker | undefined;
+  readonly resolveTenantLifecycleStatus?: TenantLifecycleStatusResolver | undefined;
+  /** JWT exp, epoch seconds. */
+  readonly tokenExpiresAtSec?: number | undefined;
+  readonly nowMs?: () => number;
+}): WebSocketSessionRevalidator | undefined {
+  const { user, sessionChecker, resolveTenantLifecycleStatus, tokenExpiresAtSec } = deps;
+  const nowMs = deps.nowMs ?? Date.now;
+  const checkSession = sessionChecker && user.sid ? sessionChecker : undefined;
+  if (!checkSession && !resolveTenantLifecycleStatus && tokenExpiresAtSec === undefined) {
+    return undefined;
+  }
+  return async () => {
+    if (tokenExpiresAtSec !== undefined && nowMs() >= tokenExpiresAtSec * 1000) return "expired";
+    if (checkSession && user.sid) {
+      const result = await checkSession(user.sid, user.id);
+      if (sessionCheckStatus(result) !== "live") return "invalid";
+      if (typeof result === "object" && !sameRoles(result.roles, user.roles)) return "invalid";
+    }
+    const teardown = await resolveTenantTeardownStatus(user.tenantId, resolveTenantLifecycleStatus);
+    return teardown === undefined ? "live" : "invalid";
+  };
+}
+
+// ponytail: per-process counter, so the cap is per pod, not cluster-wide; move to Redis if that matters.
+export type WebSocketConnectionLimiter = {
+  readonly tryAcquire: (key: string, max: number) => (() => void) | undefined;
+};
+
+export function createWebSocketConnectionLimiter(): WebSocketConnectionLimiter {
+  const counts = new Map<string, number>();
+  return {
+    tryAcquire(key, max) {
+      const current = counts.get(key) ?? 0;
+      if (current >= max) return undefined;
+      counts.set(key, current + 1);
+      let released = false;
+      return () => {
+        // skip: slot already released
+        if (released) return;
+        released = true;
+        const remaining = (counts.get(key) ?? 1) - 1;
+        if (remaining <= 0) counts.delete(key);
+        else counts.set(key, remaining);
+      };
+    },
+  };
+}
+
+type ConnectionState = {
+  timer: ReturnType<typeof setInterval> | undefined;
+  revalidationFailures: number;
+  revalidating: boolean;
+  // onOpen/onMessage run one after another in arrival order; steps never reject.
+  chain: Promise<void>;
+  closed: boolean;
+  readonly controller: AbortController;
+};
+
+const connectionStates = new WeakMap<KumikoWebSocketData, ConnectionState>();
+
+function stateOf(ws: KumikoServerWebSocket): ConnectionState {
+  let state = connectionStates.get(ws.data);
+  if (!state) {
+    state = {
+      timer: undefined,
+      revalidationFailures: 0,
+      revalidating: false,
+      chain: Promise.resolve(),
+      closed: false,
+      controller: new AbortController(),
+    };
+    connectionStates.set(ws.data, state);
+  }
+  return state;
+}
+
+function toConnection(ws: KumikoServerWebSocket): WebSocketConnection {
+  return {
+    send: (data) => {
+      ws.send(data);
+    },
+    close: (code, reason) => ws.close(code, reason),
+    signal: stateOf(ws).controller.signal,
+  };
+}
+
+function reportHandlerFailure(error: unknown): void {
+  log.error("websocket handler failed", {
+    error: error instanceof Error ? error.message : String(error),
+  });
+}
+
+// Runs outside the chain: a hung onMessage must not hold back onClose cleanup.
+function runInRequestContext(ws: KumikoServerWebSocket, run: () => Promise<void>): Promise<void> {
+  const { requestContextData } = ws.data;
+  return requestContextData ? requestContext.run(requestContextData, run) : run();
+}
+
+function enqueue(ws: KumikoServerWebSocket, run: () => void | Promise<void>): void {
+  const state = stateOf(ws);
+  // skip: the socket is gone, nothing may start after close
+  if (state.closed) return;
+  const step = async (): Promise<void> => {
+    // skip: queued behind a slower handler and the socket closed meanwhile
+    if (state.closed) return;
+    try {
+      await run();
+    } catch (error) {
+      reportHandlerFailure(error);
+      ws.close(CLOSE_INTERNAL_ERROR, "internal error");
+    }
+  };
+  state.chain = state.chain.then(() => runInRequestContext(ws, step));
+}
+
+function recordRevalidationFailure(
+  ws: KumikoServerWebSocket,
+  state: ConnectionState,
+  reason: string,
+): void {
+  // One failing check must not drop every live socket during a store blip, but persistent failure must.
+  state.revalidationFailures += 1;
+  log.error("websocket heartbeat failed", {
+    error: reason,
+    consecutiveFailures: state.revalidationFailures,
+  });
+  if (state.revalidationFailures >= WEBSOCKET_REVALIDATION_FAILURE_LIMIT) {
+    ws.close(CLOSE_TRY_AGAIN_LATER, "try again later");
+  }
+}
+
+async function heartbeat(ws: KumikoServerWebSocket): Promise<void> {
+  const state = stateOf(ws);
+  try {
+    ws.ping();
+  } catch (error) {
+    log.error("websocket ping failed", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+  const { revalidateSession } = ws.data;
+  // skip: no revalidation wired for this socket
+  if (!revalidateSession) return;
+  // A store that never answers must not pile up checks; an unanswered one counts as a failed check.
+  if (state.revalidating) {
+    recordRevalidationFailure(ws, state, "previous session check still pending");
+    // skip: the pending check owns the verdict; the failure was logged above
+    return;
+  }
+  state.revalidating = true;
+  try {
+    const verdict = await revalidateSession();
+    state.revalidationFailures = 0;
+    if (verdict === "expired") ws.close(CLOSE_POLICY_VIOLATION, "session expired");
+    else if (verdict === "invalid") ws.close(CLOSE_POLICY_VIOLATION, "session changed");
+  } catch (error) {
+    recordRevalidationFailure(ws, state, error instanceof Error ? error.message : String(error));
+  } finally {
+    state.revalidating = false;
+  }
+}
+
+function toMessageData(message: string | Uint8Array): WebSocketMessageData {
+  if (typeof message === "string") return message;
+  // Copy: a Buffer view can sit on a larger pooled ArrayBuffer and be reused after the handler returns.
+  return new Uint8Array(message);
+}
+
+function messageByteLength(message: string | Uint8Array): number {
+  return typeof message === "string" ? Buffer.byteLength(message) : message.byteLength;
+}
+
+export function createKumikoWebSocketHandler(
+  options: { readonly heartbeatIntervalMs?: number } = {},
+) {
+  const heartbeatIntervalMs = options.heartbeatIntervalMs ?? WEBSOCKET_HEARTBEAT_INTERVAL_MS;
+  return {
+    open(ws: KumikoServerWebSocket): void {
+      stateOf(ws).timer = setInterval(() => {
+        void heartbeat(ws);
+      }, heartbeatIntervalMs);
+      const { onOpen } = ws.data.handlers;
+      if (onOpen) enqueue(ws, () => onOpen(toConnection(ws)));
+    },
+    message(ws: KumikoServerWebSocket, message: string | Uint8Array): void {
+      const byteLength = messageByteLength(message);
+      if (byteLength > ws.data.maxMessageBytes) {
+        ws.close(CLOSE_MESSAGE_TOO_BIG, "message too big");
+        log.warn("websocket message over cap", {
+          byteLength,
+          maxMessageBytes: ws.data.maxMessageBytes,
+        });
+        return;
+      }
+      const { onMessage } = ws.data.handlers;
+      if (onMessage) enqueue(ws, () => onMessage(toMessageData(message), toConnection(ws)));
+    },
+    close(ws: KumikoServerWebSocket, code: number, reason: string): void {
+      const state = stateOf(ws);
+      if (state.timer !== undefined) {
+        clearInterval(state.timer);
+        state.timer = undefined;
+      }
+      ws.data.releaseConnectionSlot?.();
+      state.closed = true;
+      state.controller.abort();
+      const { onClose } = ws.data.handlers;
+      if (onClose) {
+        const cleanup = async (): Promise<void> => {
+          try {
+            await onClose(code, reason, toConnection(ws));
+          } catch (error) {
+            reportHandlerFailure(error);
+          }
+        };
+        void runInRequestContext(ws, cleanup);
+      }
+    },
+  };
+}
+
+export const kumikoWebSocketHandler = createKumikoWebSocketHandler();

package/src/bun-db/query.ts

@@ -930,11 +930,13 @@ export async function updateMany<TRow = any>(
     return scoped.updateMany<TRow>(table, set, where);
   }
   const info = extractTableInfo(table);
-  const setEntries = Object.entries(set).map(([k, v]) => {
-    const col = info.columnOf(k);
-    const pgType = info.pgTypeOf(col);
-    return { col, prepared: prepareValue(v, pgType) };
-  });
+  const setEntries = Object.entries(set)
+    .filter(([k]) => info.hasColumn(k))
+    .map(([k, v]) => {
+      const col = info.columnOf(k);
+      const pgType = info.pgTypeOf(col);
+      return { col, prepared: prepareValue(v, pgType) };
+    });
   if (setEntries.length === 0) throw new Error("updateMany: empty set object");
   const values: unknown[] = [];
   let idx = 1;

package/src/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.327.0",
+    "type": "improvement",
+    "title": "r.webSocketRoute for authenticated WebSocket routes under /api/ws/",
+    "detail": "renderer-web gains `FloatingPanel` (movable, resizable, non-modal panel with persisted geometry and a full-screen sheet on narrow viewports) and exports `useIsNarrowViewport`. Features can declare `r.webSocketRoute` under `/api/ws/` with session auth, an Origin check (allowlist, or same host without one), a per-route message cap, backpressure protection (4 MiB, the socket is closed beyond it) and a per-user connection cap (`maxConnectionsPerUser`, default 5, per server process; over it the upgrade gets 429). Handlers run one after another in arrival order per socket; on close `onClose` runs immediately (not queued behind a hung handler), queued messages never start, and `connection.signal` aborts. A 25 s heartbeat revalidates session, roles, tenant lifecycle and the token's own expiry (close 1008); a session store that keeps failing closes the socket with 1013 after three failed checks in a row. A server without upgrade wiring answers 501 `websocket_upgrade_not_wired` and logs the fix. `buildBunServeOptions` takes an optional `{ upgradeFetch, heartbeatIntervalMs? }` object as 4th argument and `runProdApp` handles expose `webSocketUpgradeFetch`; the dev server wires it. Upgrade rejections carry the same security headers as other responses. Additive, no migration."
+  },
+  {
+    "version": "0.327.0",
+    "type": "fix",
+    "title": "JobRunner.stop() waits for queue readiness before closing",
+    "detail": "JobRunner.stop() waits (bounded by the boot Redis timeout) for its queues to be ready before closing them. Stopping a runner right after construction no longer leaves an unhandled \"Connection is closed.\" rejection behind."
+  },
+  {
+    "version": "0.327.0",
+    "type": "fix",
+    "title": "updateMany drops unknown columns, so replaying an update event for a removed field no longer fails the rebuild",
+    "detail": "`updateMany` now ignores keys that have no column on the target table, matching `insertOne`/`insertMany`. A historical `<entity>.updated` event that still carries a field removed from the entity no longer aborts a projection rebuild with \"column ... does not exist\"."
+  },
   {
     "version": "0.325.0",
     "type": "improvement",