@cosmicdrift/kumiko-server-runtime 0.319.0 → 0.320.0

package/src/run-prod-app.ts

@@ -75,6 +75,7 @@ import {
   type ExtraRouteDefinition,
   type LoginRateLimiter,
   loadJwtSecretOrKeyring,
+  type PostAuthLandingResolver,
   type SseBroker,
   type TokenVerifier,
 } from "@cosmicdrift/kumiko-framework/api";
@@ -90,7 +91,6 @@ import {
   type DbRunner,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
-  buildAppSchema,
   collectWriteHandlerQns,
   createRegistry,
   type EffectiveFeaturesResolver,
@@ -145,7 +145,7 @@ import Redis from "ioredis";
 import { applyBootSeeds } from "./boot/apply-boot-seeds";
 import { resolveBootCrypto } from "./boot/boot-crypto";
 import { jobRunLoggerCallbacks } from "./boot/job-run-logger";
-import { buildBunServeOptions } from "./bun-serve-options";
+import { buildBunServeOptions, resolveDerivedMaxRequestBodySize } from "./bun-serve-options";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
 import { makeDispatchSystemWrite, type SystemWireDeps } from "./extra-routes-deps";
 import { assertPiiBootInvariants } from "./pii-boot-gate";
@@ -248,17 +248,24 @@ function makeDryRunHandle(): ProdAppHandle {
   };
 }
 
-/** Wrapper-API für den Password-Reset-Flow.
+/** Wrapper API for the password-reset flow.
  *
- *  Seit der delivery-Migration trägt PasswordResetOptions selbst `appUrl`
- *  (+ appName/locale) und der Handler mailt via ctx.notify — kein
- *  sendResetEmail-Callback mehr. Apps geben `auth.mail` (Convenience,
- *  resolveAuthMail baut die appUrl) ODER einen expliziten Block. */
-export type PasswordResetSetup = PasswordResetOptions;
+ *  Since the delivery migration PasswordResetOptions carries `appUrl`
+ *  (+ appName/locale) itself and the handler mails via ctx.notify — no
+ *  sendResetEmail callback anymore. Apps pass `auth.mail` (convenience,
+ *  resolveAuthMail builds the appUrl) OR an explicit block.
+ *
+ *  hmacSecret is optional here (unlike PasswordResetOptions): resolveAuthMail
+ *  backfills it, so overriding just appUrl needs no secret of its own. */
+export type PasswordResetSetup = Omit<PasswordResetOptions, "hmacSecret"> & {
+  readonly hmacSecret?: string;
+};
 
-/** Wrapper-API für den Email-Verification-Flow. Symmetrisch zu
- *  PasswordResetSetup — = EmailVerificationOptions (appUrl via delivery). */
-export type EmailVerificationSetup = EmailVerificationOptions;
+/** Wrapper API for the email-verification flow, symmetric to
+ *  PasswordResetSetup (appUrl via delivery, optional hmacSecret). */
+export type EmailVerificationSetup = Omit<EmailVerificationOptions, "hmacSecret"> & {
+  readonly hmacSecret?: string;
+};
 
 /** Wrapper-API für Magic-Link Self-Signup. = SignupOptions (appUrl, die
  *  Mail geht via delivery/ctx.notify wie reset/verify). Anders als reset/
@@ -303,6 +310,9 @@ export type AuthMailOptions = {
   readonly from?: string;
   /** Einzelne Auth-Pfade überschreiben (Default DEFAULT_AUTH_PATHS). */
   readonly paths?: Partial<AuthPaths>;
+  /** Reset/verify token secret, decoupled from JWT_SECRET rotation.
+   *  Falls back to resolveAuthMail's call-site secret when unset. */
+  readonly hmacSecret?: string;
 };
 
 export type RunProdAppAuthOptions = {
@@ -373,6 +383,10 @@ export type RunProdAppAuthOptions = {
    *  env var when unset; both unset means the pre-#1539 spoofable default
    *  (0 hops). Set this to your real ingress hop count (typically 1). */
   readonly trustedProxyHops?: number;
+  /** Server-computed post-auth redirect (see AuthRoutesConfig.postAuthLanding).
+   *  Result lands in the login/signup/invite response as `landingPath`; an
+   *  invalid path or a throwing resolver just omits the field. */
+  readonly postAuthLanding?: PostAuthLandingResolver;
 };
 
 /** Hook for app-specific seeding — runs after the admin (when auth is
@@ -403,23 +417,25 @@ export type ExtraContextOption =
   | Record<string, unknown>
   | ((deps: RunProdAppDeps) => Record<string, unknown>);
 
-/** Per-Host Routing-Entscheidung für den staticDir-Fallback. Wird aus
- *  hostDispatch returned. Drei Modi:
- *    - "html": eine bestimmte HTML-Datei (relativ zu staticDir) servieren,
- *      mit optionaler Schema-Injection und CSP. Schema-Injection MUSS
- *      explizit eingeschaltet werden (default false) — Public-Domain-
- *      Antworten leaken sonst die volle Admin-UI-Schema-Topologie.
- *    - "redirect": 301/302 an die angegebene Location.
- *    - "not-found": klar abweisen (z.B. unbekannte Subdomain).
+/** Per-host routing decision for the staticDir fallback, returned from
+ *  hostDispatch. Three modes:
+ *    - "html": serve a specific HTML file (relative to staticDir), optionally
+ *      with CSP. HTML never carries a schema — createKumikoApp fetches it
+ *      itself from the authenticated GET /api/schema, after the
+ *      clientFeature gates (auth) let it through.
+ *    - "redirect": 301/302 to the given location.
+ *    - "not-found": reject outright (e.g. unknown subdomain).
  *
- *  Wird NUR konsultiert wenn der Pfad sonst auf den HTML-Fallback gehen
- *  würde — also für "/", "/index.html", oder SPA-Routen die weder Hono
- *  matched noch eine konkrete Disk-Datei treffen. Asset-Pfade (/assets/*)
- *  und API-Pfade laufen unabhängig vom Host. */
+ *  Only consulted when the path would otherwise fall through to the HTML
+ *  fallback — i.e. for "/", "/index.html", or SPA routes that neither Hono
+ *  matches nor a concrete disk file. Asset paths (/assets/*) and API paths
+ *  run independent of the host. */
 export type HostDispatchResult =
   | {
       readonly kind: "html";
       readonly file: string;
+      /** @deprecated Ignored — HTML never carries the schema; createKumikoApp
+       *  fetches it from the authenticated GET /api/schema. */
       readonly injectSchema?: boolean;
       readonly csp?: string;
     }
@@ -458,6 +474,12 @@ export type RunProdAppOptions = {
   readonly validateBootOptions?: ValidateBootOptions;
   /** Listen-Port. Default 3000 (or $PORT). */
   readonly port?: number;
+  /** Ceiling Bun.serve buffers a request body to before any app-level
+   *  body-limit middleware runs. Default is derived from `createFilesFeature`'s
+   *  configured `maxUploadSize`/field `maxSize` (see
+   *  resolveDerivedMaxRequestBodySize in bun-serve-options.ts) — override
+   *  only for a custom ceiling unrelated to that config. */
+  readonly maxRequestBodySize?: number;
   /** Auth-mode: standard features + routes wired, admin seeded. */
   readonly auth?: RunProdAppAuthOptions;
   /** Custom seed functions, run after the admin seed (when auth-mode). */
@@ -481,21 +503,19 @@ export type RunProdAppOptions = {
    *  for any path that doesn't match an /api/ handler. Use this for the
    *  public status page HTML, embed widget JS, etc. */
   readonly staticDir?: string;
-  /** Host-aware Routing-Hook für Multi-Tenant + Multi-App-Deployments
-   *  (z.B. publicstatus's `<sub>.publicstatus.eu` (Public-Page) +
-   *  `admin.publicstatus.eu` (Admin-UI) + `publicstatus.eu` (Apex/
-   *  Marketing) im SELBEN Container).
+  /** Host-aware routing hook for multi-tenant + multi-app deployments
+   *  (e.g. publicstatus's `<sub>.publicstatus.eu` (public page) +
+   *  `admin.publicstatus.eu` (admin UI) + `publicstatus.eu` (apex/
+   *  marketing) in the SAME container).
    *
-   *  Wird aufgerufen wenn der staticDir-Fallback einen HTML-Response
-   *  generieren würde (Root oder SPA-Route). Default-Verhalten ohne
-   *  hostDispatch: index.html mit Schema-Injection (Single-App).
+   *  Called when the staticDir fallback would generate an HTML response
+   *  (root or SPA route). Default behavior without hostDispatch: index.html
+   *  (single-app), no schema.
    *
-   *  Sicherheitshinweis: Schema-Injection (`__KUMIKO_SCHEMA__`) leakt
-   *  die Admin-UI-Topologie (alle Screens, Felder, Layouts) ans HTML.
-   *  Public-Domain-Antworten sollen das NIEMALS — `injectSchema` ist
-   *  daher default false und MUSS pro Host explizit eingeschaltet
-   *  werden. CSP-Header pro Host können zusätzlich Asset-Pfade
-   *  einschränken. */
+   *  Schema safety: HTML (per-host as well as single-app) never carries an
+   *  AppSchema — createKumikoApp fetches it via GET /api/schema, which sits
+   *  behind the auth middleware and only serves non-anonymous, signed-in
+   *  users. Per-host CSP headers can additionally restrict asset paths. */
   readonly hostDispatch?: HostDispatchFn;
   /** Per-request head-metadata resolver (Open-Graph/title/description) for
    *  the static-fallback HTML shell — see `PageHeadResolver`. Consulted on
@@ -664,6 +684,12 @@ export type RunProdAppOptions = {
    *  overridden. `false` disables the whole block; per-header overrides
    *  via the object form — see SecurityHeadersOption. */
   readonly securityHeaders?: SecurityHeadersOption;
+  /** Number of trusted reverse-proxy hops for client-IP resolution — 1:1
+   *  durchgereicht an `buildServer`s
+   *  top-level `ServerOptions.trustedProxyHops`. Wins over the deprecated
+   *  `auth.trustedProxyHops` and `KUMIKO_TRUSTED_PROXY_HOPS`. Default 0 =
+   *  trust no proxy header, only the socket address (or "unknown") counts. */
+  readonly trustedProxyHops?: number;
 };
 
 export type ProdAppHandle = {
@@ -799,6 +825,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // deployment — a self-inflicted DoS, worse than staying on the default.
   const trustedProxyHopsFromEnv = readEnv("KUMIKO_TRUSTED_PROXY_HOPS", envSource);
   const trustedProxyHops = ((): number | undefined => {
+    if (options.trustedProxyHops !== undefined) return options.trustedProxyHops;
     if (options.auth?.trustedProxyHops !== undefined) return options.auth.trustedProxyHops;
     if (trustedProxyHopsFromEnv === undefined) return undefined;
     // Digits-only — parseInt("0x10")/("1e3")/("2x") would silently coerce
@@ -989,11 +1016,6 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     ...addConfigAccessorFactory({ ...autoExtraContext, ...resolvedExtraContext }, registry),
     ...(options.defaultLocale !== undefined && { defaultLocale: options.defaultLocale }),
   };
-  // @cast-boundary engine-bridge — searchAdapter is an optional context-extension
-  // (SharedContextFields.searchAdapter), invisible to extraContext's loose
-  // Record<string, unknown>-based typing. Presence check only, no need to
-  // pull in the SearchAdapter type here.
-  const searchAdapterMissing = !(extraContext as { searchAdapter?: unknown }).searchAdapter;
   const baseAnonymousAccess =
     typeof options.anonymousAccess === "function"
       ? options.anonymousAccess(deps)
@@ -1075,6 +1097,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     ...(options.observabilityOptions && { observabilityOptions: options.observabilityOptions }),
     ...(options.metrics && { metrics: options.metrics }),
     ...(options.rateLimit && { rateLimit: options.rateLimit }),
+    ...(trustedProxyHops !== undefined && { trustedProxyHops }),
     ...(options.extraRoutes && { extraRoutes: options.extraRoutes }),
     ...(effectiveAuth && {
       auth: {
@@ -1101,6 +1124,9 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
           unsafeSkipOriginCheck: effectiveAuth.unsafeSkipOriginCheck,
         }),
         ...(trustedProxyHops !== undefined && { trustedProxyHops }),
+        ...(effectiveAuth.postAuthLanding !== undefined && {
+          postAuthLanding: effectiveAuth.postAuthLanding,
+        }),
         ...sessionAuthFragment,
         ...patAuthFragment,
         ...(mfaFeature && {
@@ -1222,18 +1248,6 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     });
   }
 
-  // 8. Build the AppSchema once + serialize. Wird beim Static-Fallback
-  //    in die index.html injiziert damit createKumikoApp() im Browser
-  //    `window.__KUMIKO_SCHEMA__` synchron lesen kann — gleicher Pfad
-  //    wie im dev-server, damit der Client-Code keine Sonderfall-
-  //    Branch zwischen dev/prod braucht. Boot-once weil Features
-  //    nach dem Start nicht mehr ändern.
-  // TODO: Sobald per-Tenant- oder per-User-Schema kommt (Feature-Toggles
-  // pro Tenant, Auth-Rolle gated Screens), muss die Injection pro
-  // Request rendern — staticDir-Fallback einen render(req)-Hook bekommen
-  // statt eines fixed JSON-Strings. Heute: registry-static, also OK.
-  const appSchemaJson = JSON.stringify(buildAppSchema(registry, { searchAdapterMissing }));
-
   // `extraRoutes` itself is already mounted — buildServer wires it inside
   // createApiEntrypoint/createAllInOneEntrypoint, before this function ever
   // runs. `wire` is the remaining escape-hatch for app-wired co-running
@@ -1301,19 +1315,20 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
       ? buildStaticFallback(
           entrypoint.app.fetch.bind(entrypoint.app),
           options.staticDir,
-          appSchemaJson,
           options.hostDispatch,
           options.resolvePageHead
             ? { resolvePageHead: options.resolvePageHead, dispatcher: entrypoint.dispatcher }
             : undefined,
           entrypoint.dispatcher,
+          trustedProxyHops ?? 0,
         )
       : // No staticDir (split-deploy / API-only container) → app.fetch's
         // response goes straight to the client, bypassing buildStaticFallback
         // (and with it tryHonoFirst) entirely. Must strip the router-miss
         // marker here too, same reason as the /api/* passthrough in
         // run-prod-app-static-files.ts (see try-hono-first.ts).
-        async (req: Request) => stripNoRouteMatchHeader(await entrypoint.app.fetch(req)),
+        async (req: Request, socketAddress?: string) =>
+          stripNoRouteMatchHeader(await entrypoint.app.fetch(req, socketAddress)),
     options.securityHeaders,
   );
 
@@ -1338,7 +1353,13 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
             "Under Node/vitest pass `autoListen: false` and call the returned `fetch()` directly.",
         );
       }
-      handle.server = Bun.serve(buildBunServeOptions(listenPort, fetchHandler));
+      handle.server = Bun.serve(
+        buildBunServeOptions(
+          listenPort,
+          fetchHandler,
+          options.maxRequestBodySize ?? resolveDerivedMaxRequestBodySize(registry),
+        ),
+      );
 
       // SIGTERM/SIGINT — graceful shutdown. Only registered when we
       // actually own a Bun-server, otherwise the test process picks up

package/src/security-headers.ts

@@ -43,13 +43,13 @@ export function resolveSecurityHeaders(
 // Sets each header only when absent so per-response values (e.g. the
 // per-host CSP from hostDispatch) always win over the runtime default.
 export function withSecurityHeaders(
-  handler: (req: Request) => Response | Promise<Response>,
+  handler: (req: Request, socketAddress?: string) => Response | Promise<Response>,
   option: SecurityHeadersOption | undefined,
-): (req: Request) => Response | Promise<Response> {
+): (req: Request, socketAddress?: string) => Response | Promise<Response> {
   const defaults = resolveSecurityHeaders(option);
   if (defaults.length === 0) return handler;
-  return async (req: Request): Promise<Response> => {
-    const res = await handler(req);
+  return async (req: Request, socketAddress?: string): Promise<Response> => {
+    const res = await handler(req, socketAddress);
     try {
       for (const [name, value] of defaults) {
         if (!res.headers.has(name)) res.headers.set(name, value);

package/src/try-hono-first.ts

@@ -31,11 +31,13 @@
 import { NO_ROUTE_MATCH_HEADER_NAME } from "@cosmicdrift/kumiko-framework/api";
 
 export type HonoLikeApp = {
-  // Hono.app.fetch is `(req) => Response | Promise<Response>` (sync if all
-  // handlers are sync, otherwise a Promise). createApiEntrypoint's
+  // Hono.app.fetch is `(req, env?) => Response | Promise<Response>` (sync if
+  // all handlers are sync, otherwise a Promise). createApiEntrypoint's
   // apiHandler matches the same shape. The union accepts both — we await
-  // below, which works for either case.
-  readonly fetch: (req: Request) => Response | Promise<Response>;
+  // below, which works for either case. `socketAddress` rides in as `env`
+  // so requestIdMiddleware/rate-limit can read it via `c.env` without Hono
+  // ever seeing a raw Bun `Server`.
+  readonly fetch: (req: Request, socketAddress?: string) => Response | Promise<Response>;
 };
 
 export type HonoFirstResult = {
@@ -69,8 +71,12 @@ export function stripNoRouteMatchHeader(response: Response): Response {
  * req.clone() because downstream needs to read the request body again
  * (future-proofing for POST/PUT/PATCH — only GET routes today).
  */
-export async function tryHonoFirst(app: HonoLikeApp, req: Request): Promise<HonoFirstResult> {
-  const response = await app.fetch(req.clone());
+export async function tryHonoFirst(
+  app: HonoLikeApp,
+  req: Request,
+  socketAddress?: string,
+): Promise<HonoFirstResult> {
+  const response = await app.fetch(req.clone(), socketAddress);
   const isRouterMiss = response.status === 404 && response.headers.has(NO_ROUTE_MATCH_HEADER_NAME);
   stripNoRouteMatchHeader(response);
   return { matched: !isRouterMiss, response };

package/src/__tests__/inject-schema.test.ts

@@ -1,100 +0,0 @@
-// injectSchema is shared by the dev-server (every HTML response) and
-// prod-server (static-fallback index.html) paths. A bug here would be a
-// silent production failure: createKumikoApp wouldn't find
-// `window.__KUMIKO_SCHEMA__` and would mount empty. Tests pin idempotency
-// plus the two insertion points (before the /client.js tag or before </body>).
-
-import { describe, expect, test } from "bun:test";
-import { injectSchema } from "../inject-schema";
-
-const SCHEMA = '{"features":[]}';
-const TAG = `<script>window.__KUMIKO_SCHEMA__=${SCHEMA};</script>`;
-
-describe("injectSchema", () => {
-  test("HTML mit /client.js-Tag: Schema-Tag wird DAVOR eingefügt", () => {
-    const html = '<html><body><script src="/client.js" defer></script></body></html>';
-    const out = injectSchema(html, SCHEMA);
-    expect(out).toContain(TAG);
-    // Schema MUST come before the client bundle — otherwise createKumikoApp()
-    // runs before window.__KUMIKO_SCHEMA__ is set.
-    expect(out.indexOf(TAG)).toBeLessThan(out.indexOf('<script src="/client.js"'));
-  });
-
-  test("HTML mit module-form /client.js-Tag: Schema-Tag wird DAVOR eingefügt", () => {
-    const html = '<html><body><script type="module" src="/client.js"></script></body></html>';
-    const out = injectSchema(html, SCHEMA);
-    expect(out).toContain(TAG);
-    // Dev templates use `type="module"`, not the classic form — insertion
-    // must match this tag pattern too.
-    expect(out.indexOf(TAG)).toBeLessThan(out.indexOf('<script type="module" src="/client.js"'));
-  });
-
-  test("HTML ohne /client.js-Tag: Schema-Tag wird vor </body> eingefügt", () => {
-    const html = "<html><body><div id=root></div></body></html>";
-    const out = injectSchema(html, SCHEMA);
-    expect(out).toContain(TAG);
-    expect(out.indexOf(TAG)).toBeLessThan(out.indexOf("</body>"));
-  });
-
-  test("HTML ohne </body>: Schema-Tag wird angehängt (defensiver Fallback)", () => {
-    const html = "<div>fragment</div>";
-    const out = injectSchema(html, SCHEMA);
-    expect(out.endsWith(TAG)).toBe(true);
-  });
-
-  test("Idempotent: bei bereits injectem Schema kein zweiter Tag", () => {
-    const html = `<html><body>${TAG}</body></html>`;
-    const out = injectSchema(html, '{"features":[{"differentSchema":true}]}');
-    // Original tag stays, no second tag added — the marker check otherwise
-    // prevents stacking tags on repeated reads.
-    expect(out).toBe(html);
-  });
-
-  test("Schema mit Komplex-Daten (entities + screens) bleibt valides JS", () => {
-    const complex = JSON.stringify({
-      features: [
-        {
-          featureName: "items",
-          entities: { item: { fields: { title: { type: "text" } } } },
-          screens: [{ id: "list", type: "entityList", entity: "item", columns: ["title"] }],
-        },
-      ],
-    });
-    const html = '<html><body><script src="/client.js"></script></body></html>';
-    const out = injectSchema(html, complex);
-    // Sanity: the injected script must be valid JS (object-literal syntax,
-    // no HTML-reserved chars in the JSON that would break the <script>
-    // block — JSON.stringify doesn't escape /, < etc., but the standard
-    // chars used here are harmless).
-    expect(out).toContain(`window.__KUMIKO_SCHEMA__=${complex}`);
-  });
-
-  test("Schema mit $-Replacement-Patterns bleibt byte-identisch (kein HTML-Splicing)", () => {
-    // String.prototype.replace() interprets $$, $&, $`, $' specially in the
-    // REPLACEMENT argument. The injected schema JSON string lands there — an
-    // i18n label containing "$'" or similar would otherwise splice parts of
-    // `html` into the script tag. A replacer-function argument sidesteps that.
-    const dollarSchema = '{"label":"$\' tail $$ amp $& end"}';
-    const dollarTag = `<script>window.__KUMIKO_SCHEMA__=${dollarSchema};</script>`;
-    const html = '<html><body><script src="/client.js"></script></body></html>';
-    const out = injectSchema(html, dollarSchema);
-    // Insertion point is right before the /client.js tag, not the start of
-    // the document — built via indexOf/slice, not .replace(), so the
-    // expected value doesn't itself run through the same $-pattern footgun.
-    const clientScriptIdx = html.indexOf('<script src="/client.js"');
-    const expected = html.slice(0, clientScriptIdx) + dollarTag + html.slice(clientScriptIdx);
-    expect(out).toBe(expected);
-  });
-
-  test("Schema mit $-Replacement-Patterns, Insertion vor </body>", () => {
-    const dollarSchema = '{"label":"$\' tail $$ amp $& end"}';
-    const dollarTag = `<script>window.__KUMIKO_SCHEMA__=${dollarSchema};</script>`;
-    const html = "<html><body><div id=root></div></body></html>";
-    const out = injectSchema(html, dollarSchema);
-    // Built via slice/concat, not .replace() — the expected value must not
-    // itself run through the same $-pattern footgun the fix removes.
-    const bodyIdx = html.indexOf("</body>");
-    const expected = html.slice(0, bodyIdx) + dollarTag + html.slice(bodyIdx);
-    expect(out).toBe(expected);
-  });
-});

package/src/inject-schema.ts

@@ -1,33 +0,0 @@
-// Injiziert das Server-aufgelöste AppSchema in das HTML-Template damit
-// createKumikoApp() es synchron unter `window.__KUMIKO_SCHEMA__` vorfindet.
-// JSON ist valides JS — direkt eingebettet, der Browser parsed das
-// Object-Literal nativ.
-//
-// Geteilt zwischen dev-server (Schema kommt frisch aus dem laufenden
-// Prozess) und prod-server (Schema wird beim Boot einmal berechnet und
-// in die statisch ausgelieferte index.html injiziert). Beide Pfade
-// nutzen dieselbe Tag-Form damit `createKumikoApp` den Lookup nicht je
-// nach Kontext anders machen muss.
-//
-// Idempotenz: wenn das HTML schon einen __KUMIKO_SCHEMA__-Marker hat,
-// wird nicht doppelt injected — verhindert dass repeated index.html-
-// Reads (prod) oder bereits-vorbereitete templates (custom CI-builds)
-// stacking-Tags produzieren.
-
-// `<` als < serialisieren: verhindert `</script>`-Breakout aus dem
-// RAWTEXT-Block, JSON bleibt valides JS.
-function scriptSafeJsonHtml(json: string): string {
-  return json.replace(/</g, "\\u003c");
-}
-
-const CLIENT_SCRIPT_TAG_RE = /<script\b[^>]*\ssrc="\/client\.js"/;
-
-export function injectSchema(html: string, schemaJson: string): string {
-  if (html.includes("__KUMIKO_SCHEMA__")) return html;
-  const tag = `<script>window.__KUMIKO_SCHEMA__=${scriptSafeJsonHtml(schemaJson)};</script>`;
-  const clientScriptMatch = html.match(CLIENT_SCRIPT_TAG_RE);
-  if (clientScriptMatch) {
-    return html.replace(CLIENT_SCRIPT_TAG_RE, (m) => `${tag}${m}`);
-  }
-  return html.includes("</body>") ? html.replace("</body>", () => `${tag}</body>`) : html + tag;
-}