@cosmicdrift/kumiko-server-runtime 0.319.0 → 0.321.0

package/src/run-prod-app-static-files.ts

@@ -1,15 +1,16 @@
 import {
   buildRequestContextDataFromRequest,
   type CachePolicy,
+  type ClientIpResolver,
   cachedResponse,
   computeStrongEtag,
   computeWeakEtag,
+  createClientIpResolver,
   requestContext,
 } from "@cosmicdrift/kumiko-framework/api";
 import { createAnonymousUser, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { resolveAndInjectPageHead } from "@cosmicdrift/kumiko-headless/apex";
 import { ASSETS_DIR } from "./build-prod-bundle";
-import { injectSchema } from "./inject-schema";
 import type { HostDispatchFn, PageHeadResolver, PageHeadSystemQuery } from "./run-prod-app";
 import { stripNoRouteMatchHeader, tryHonoFirst } from "./try-hono-first";
 
@@ -127,9 +128,8 @@ export type PageHeadOptions = {
 };
 
 export function buildStaticFallback(
-  apiHandler: (req: Request) => Response | Promise<Response>,
+  apiHandler: (req: Request, socketAddress?: string) => Response | Promise<Response>,
   staticDir: string,
-  appSchemaJson: string,
   hostDispatch?: HostDispatchFn,
   pageHead?: PageHeadOptions,
   /** Backs hostDispatch's `systemQuery` — required whenever `hostDispatch`
@@ -137,38 +137,31 @@ export function buildStaticFallback(
    *  throw). Separate from `pageHead.dispatcher` since resolvePageHead is
    *  optional independently of hostDispatch. */
   hostDispatchDispatcher?: QueryDispatcher,
-): (req: Request) => Promise<Response> {
+  /** trustedProxyHops for the systemQuery request-context builds below —
+   *  1:1 with runProdApp's effective value. */
+  trustedProxyHops = 0,
+): (req: Request, socketAddress?: string) => Promise<Response> {
   const indexHtml = `${staticDir}/index.html`;
+  const clientIpResolver: ClientIpResolver = createClientIpResolver(
+    trustedProxyHops,
+    "buildStaticFallback",
+  );
 
-  // Helper: liest eine HTML-Datei von der Disk + (optional) injiziert
-  // das pre-serialized AppSchema vor dem client.js-Tag. Schema-Injection
-  // ist explicit-opt-in damit Public-Domain-Antworten die Admin-UI-
-  // Topologie nicht leaken. injectSchema ist idempotent, doppelte Calls
-  // produzieren keinen doppelten Tag.
+  // Reads an HTML file from disk. No schema injection — createKumikoApp
+  // fetches it itself from the authenticated GET /api/schema, so the HTML
+  // is identical for every host.
   async function readHtmlFile(
     path: string,
-    injectSchemaInto: boolean,
   ): Promise<{ bytes: ArrayBuffer; mime: string; etag: string; mtimeMs: number } | null> {
     const file = await readStaticFile(path);
     if (!file) return null;
-    if (!injectSchemaInto) {
-      return {
-        bytes: file.bytes.buffer.slice(
-          file.bytes.byteOffset,
-          file.bytes.byteOffset + file.bytes.byteLength,
-        ) as ArrayBuffer,
-        mime: file.mime,
-        etag: computeWeakEtag(file.mtimeMs, file.bytes.byteLength),
-        mtimeMs: file.mtimeMs,
-      };
-    }
-    const text = new TextDecoder().decode(file.bytes);
-    const injected = injectSchema(text, appSchemaJson);
-    const bytes = new TextEncoder().encode(injected).buffer as ArrayBuffer;
     return {
-      bytes,
+      bytes: file.bytes.buffer.slice(
+        file.bytes.byteOffset,
+        file.bytes.byteOffset + file.bytes.byteLength,
+      ) as ArrayBuffer,
       mime: file.mime,
-      etag: computeStrongEtag(new Uint8Array(bytes)),
+      etag: computeWeakEtag(file.mtimeMs, file.bytes.byteLength),
       mtimeMs: file.mtimeMs,
     };
   }
@@ -203,13 +196,16 @@ export function buildStaticFallback(
   async function applyPageHead(
     req: Request,
     html: { bytes: ArrayBuffer; mime: string; etag: string; mtimeMs: number },
+    socketAddress?: string,
   ): Promise<{ bytes: ArrayBuffer; mime: string; etag: string; mtimeMs: number }> {
     if (!pageHead) return html;
     const url = new URL(req.url);
     const host = req.headers.get("host") ?? url.host;
     const systemQuery: PageHeadSystemQuery = (type, payload, tenantId) =>
-      requestContext.run(requestContext.get() ?? buildRequestContextDataFromRequest(req), () =>
-        pageHead.dispatcher.query(type, payload, createAnonymousUser(tenantId)),
+      requestContext.run(
+        requestContext.get() ??
+          buildRequestContextDataFromRequest(req, { resolver: clientIpResolver, socketAddress }),
+        () => pageHead.dispatcher.query(type, payload, createAnonymousUser(tenantId)),
       );
     const text = new TextDecoder().decode(html.bytes);
     const injected = await resolveAndInjectPageHead(text, pageHead.resolvePageHead, {
@@ -231,7 +227,7 @@ export function buildStaticFallback(
   // HTML-Fallback fällt (Root oder SPA-Route). Returnt entweder die
   // resolved Response (redirect/404/html) oder null wenn der Default-
   // Pfad weiterlaufen soll.
-  async function tryHostDispatch(req: Request): Promise<Response | null> {
+  async function tryHostDispatch(req: Request, socketAddress?: string): Promise<Response | null> {
     if (!hostDispatch) return null;
     const url = new URL(req.url);
     const host = req.headers.get("host") ?? url.host;
@@ -242,7 +238,8 @@ export function buildStaticFallback(
         );
       }
       return requestContext.run(
-        requestContext.get() ?? buildRequestContextDataFromRequest(req),
+        requestContext.get() ??
+          buildRequestContextDataFromRequest(req, { resolver: clientIpResolver, socketAddress }),
         () => hostDispatchDispatcher.query(type, payload, createAnonymousUser(tenantId)),
       );
     };
@@ -261,28 +258,28 @@ export function buildStaticFallback(
     }
     // result.kind === "html"
     const filePath = `${staticDir}/${result.file}`;
-    const html = await readHtmlFile(filePath, result.injectSchema === true);
+    const html = await readHtmlFile(filePath);
     if (!html) {
       // Author-Fehler: hostDispatch verweist auf nicht-existente Datei.
       // Liefer 500 statt silent-404 damit der Bug schnell auffällt.
       return new Response(`hostDispatch: file not found: ${result.file}`, { status: 500 });
     }
-    // Per-Host-Body (hostDispatch wählt die Datei nach Host) → Vary: Host,
-    // sonst darf ein Shared-Cache Tenant-As Schema an Tenant B liefern.
+    // Per-host body (hostDispatch picks the file by host) → Vary: Host,
+    // otherwise a shared cache could serve Host A's HTML to Host B.
     const extraHeaders: Record<string, string> = { vary: "Host" };
     if (result.csp) extraHeaders["content-security-policy"] = result.csp;
-    const withHead = await applyPageHead(req, html);
+    const withHead = await applyPageHead(req, html, socketAddress);
     return serveHtmlFile(req, "/index.html", withHead, extraHeaders);
   }
 
-  return async (req: Request): Promise<Response> => {
+  return async (req: Request, socketAddress?: string): Promise<Response> => {
     const url = new URL(req.url);
     // /api/* and /health → always Hono (Dispatcher + Health-Probe). Bypasses
     // tryHonoFirst entirely, so the router-miss marker must be stripped
     // here too — otherwise an unmatched /api/* path would leak it straight
     // to the client (see try-hono-first.ts's header-hygiene note).
     if (url.pathname.startsWith("/api/") || url.pathname === "/health") {
-      return stripNoRouteMatchHeader(await apiHandler(req));
+      return stripNoRouteMatchHeader(await apiHandler(req, socketAddress));
     }
 
     // Hono-First für andere Pfade: extraRoutes (z.B. /feed.xml,
@@ -290,7 +287,7 @@ export function buildStaticFallback(
     // dem Disk-Lookup greifen, sonst schluckt der SPA-Fallback unten
     // unbekannte Pfade als index.html. Shared mit dev-server's
     // createKumikoServer.handleFetch damit beide IDENTISCHE Semantik haben.
-    const honoTry = await tryHonoFirst({ fetch: apiHandler }, req);
+    const honoTry = await tryHonoFirst({ fetch: apiHandler }, req, socketAddress);
     if (honoTry.matched) {
       return honoTry.response;
     }
@@ -317,15 +314,15 @@ export function buildStaticFallback(
       }
     }
 
-    // Root oder SPA-Route — hier greift hostDispatch wenn gesetzt.
-    // Ohne hostDispatch: alter Single-App-Pfad (index.html mit Schema).
-    const dispatched = await tryHostDispatch(req);
+    // Root or SPA route — hostDispatch applies here when set.
+    // Without hostDispatch: the old single-app path (index.html).
+    const dispatched = await tryHostDispatch(req, socketAddress);
     if (dispatched) return dispatched;
 
-    // Default Single-App-Pfad: index.html, schema injected.
-    const index = await readHtmlFile(indexHtml, true);
+    // Default single-app path: index.html, no schema injection.
+    const index = await readHtmlFile(indexHtml);
     if (index) {
-      const withHead = await applyPageHead(req, index);
+      const withHead = await applyPageHead(req, index, socketAddress);
       return serveHtmlFile(req, "/index.html", withHead);
     }
 

package/src/run-prod-app.ts

@@ -75,8 +75,11 @@ import {
   type ExtraRouteDefinition,
   type LoginRateLimiter,
   loadJwtSecretOrKeyring,
+  type PostAuthLandingResolver,
+  parseTrustedProxyHopsEnv,
   type SseBroker,
   type TokenVerifier,
+  TRUSTED_PROXY_HOPS_ENV,
 } from "@cosmicdrift/kumiko-framework/api";
 import {
   configureBlindIndexKey,
@@ -90,7 +93,6 @@ import {
   type DbRunner,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
-  buildAppSchema,
   collectWriteHandlerQns,
   createRegistry,
   type EffectiveFeaturesResolver,
@@ -145,7 +147,7 @@ import Redis from "ioredis";
 import { applyBootSeeds } from "./boot/apply-boot-seeds";
 import { resolveBootCrypto } from "./boot/boot-crypto";
 import { jobRunLoggerCallbacks } from "./boot/job-run-logger";
-import { buildBunServeOptions } from "./bun-serve-options";
+import { buildBunServeOptions, resolveDerivedMaxRequestBodySize } from "./bun-serve-options";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
 import { makeDispatchSystemWrite, type SystemWireDeps } from "./extra-routes-deps";
 import { assertPiiBootInvariants } from "./pii-boot-gate";
@@ -248,17 +250,24 @@ function makeDryRunHandle(): ProdAppHandle {
   };
 }
 
-/** Wrapper-API für den Password-Reset-Flow.
+/** Wrapper API for the password-reset flow.
  *
- *  Seit der delivery-Migration trägt PasswordResetOptions selbst `appUrl`
- *  (+ appName/locale) und der Handler mailt via ctx.notify — kein
- *  sendResetEmail-Callback mehr. Apps geben `auth.mail` (Convenience,
- *  resolveAuthMail baut die appUrl) ODER einen expliziten Block. */
-export type PasswordResetSetup = PasswordResetOptions;
+ *  Since the delivery migration PasswordResetOptions carries `appUrl`
+ *  (+ appName/locale) itself and the handler mails via ctx.notify — no
+ *  sendResetEmail callback anymore. Apps pass `auth.mail` (convenience,
+ *  resolveAuthMail builds the appUrl) OR an explicit block.
+ *
+ *  hmacSecret is optional here (unlike PasswordResetOptions): resolveAuthMail
+ *  backfills it, so overriding just appUrl needs no secret of its own. */
+export type PasswordResetSetup = Omit<PasswordResetOptions, "hmacSecret"> & {
+  readonly hmacSecret?: string;
+};
 
-/** Wrapper-API für den Email-Verification-Flow. Symmetrisch zu
- *  PasswordResetSetup — = EmailVerificationOptions (appUrl via delivery). */
-export type EmailVerificationSetup = EmailVerificationOptions;
+/** Wrapper API for the email-verification flow, symmetric to
+ *  PasswordResetSetup (appUrl via delivery, optional hmacSecret). */
+export type EmailVerificationSetup = Omit<EmailVerificationOptions, "hmacSecret"> & {
+  readonly hmacSecret?: string;
+};
 
 /** Wrapper-API für Magic-Link Self-Signup. = SignupOptions (appUrl, die
  *  Mail geht via delivery/ctx.notify wie reset/verify). Anders als reset/
@@ -303,6 +312,9 @@ export type AuthMailOptions = {
   readonly from?: string;
   /** Einzelne Auth-Pfade überschreiben (Default DEFAULT_AUTH_PATHS). */
   readonly paths?: Partial<AuthPaths>;
+  /** Reset/verify token secret, decoupled from JWT_SECRET rotation.
+   *  Falls back to resolveAuthMail's call-site secret when unset. */
+  readonly hmacSecret?: string;
 };
 
 export type RunProdAppAuthOptions = {
@@ -370,9 +382,15 @@ export type RunProdAppAuthOptions = {
    *  process for client-IP derivation (see AuthRoutesConfig.trustedProxyHops,
    *  kumiko-framework#1539) — closes the X-Forwarded-For spoofing hole on
    *  the auth rate-limiters. Falls back to the `KUMIKO_TRUSTED_PROXY_HOPS`
-   *  env var when unset; both unset means the pre-#1539 spoofable default
-   *  (0 hops). Set this to your real ingress hop count (typically 1). */
+   *  env var when unset; both unset means 0 hops, the safe socket-only
+   *  default (only the socket address counts, XFF ignored). Deprecated in
+   *  favor of the top-level `trustedProxyHops` option, which wins over
+   *  this and the env var. */
   readonly trustedProxyHops?: number;
+  /** Server-computed post-auth redirect (see AuthRoutesConfig.postAuthLanding).
+   *  Result lands in the login/signup/invite response as `landingPath`; an
+   *  invalid path or a throwing resolver just omits the field. */
+  readonly postAuthLanding?: PostAuthLandingResolver;
 };
 
 /** Hook for app-specific seeding — runs after the admin (when auth is
@@ -403,23 +421,25 @@ export type ExtraContextOption =
   | Record<string, unknown>
   | ((deps: RunProdAppDeps) => Record<string, unknown>);
 
-/** Per-Host Routing-Entscheidung für den staticDir-Fallback. Wird aus
- *  hostDispatch returned. Drei Modi:
- *    - "html": eine bestimmte HTML-Datei (relativ zu staticDir) servieren,
- *      mit optionaler Schema-Injection und CSP. Schema-Injection MUSS
- *      explizit eingeschaltet werden (default false) — Public-Domain-
- *      Antworten leaken sonst die volle Admin-UI-Schema-Topologie.
- *    - "redirect": 301/302 an die angegebene Location.
- *    - "not-found": klar abweisen (z.B. unbekannte Subdomain).
+/** Per-host routing decision for the staticDir fallback, returned from
+ *  hostDispatch. Three modes:
+ *    - "html": serve a specific HTML file (relative to staticDir), optionally
+ *      with CSP. HTML never carries a schema — createKumikoApp fetches it
+ *      itself from the authenticated GET /api/schema, after the
+ *      clientFeature gates (auth) let it through.
+ *    - "redirect": 301/302 to the given location.
+ *    - "not-found": reject outright (e.g. unknown subdomain).
  *
- *  Wird NUR konsultiert wenn der Pfad sonst auf den HTML-Fallback gehen
- *  würde — also für "/", "/index.html", oder SPA-Routen die weder Hono
- *  matched noch eine konkrete Disk-Datei treffen. Asset-Pfade (/assets/*)
- *  und API-Pfade laufen unabhängig vom Host. */
+ *  Only consulted when the path would otherwise fall through to the HTML
+ *  fallback — i.e. for "/", "/index.html", or SPA routes that neither Hono
+ *  matches nor a concrete disk file. Asset paths (/assets/*) and API paths
+ *  run independent of the host. */
 export type HostDispatchResult =
   | {
       readonly kind: "html";
       readonly file: string;
+      /** @deprecated Ignored — HTML never carries the schema; createKumikoApp
+       *  fetches it from the authenticated GET /api/schema. */
       readonly injectSchema?: boolean;
       readonly csp?: string;
     }
@@ -458,6 +478,12 @@ export type RunProdAppOptions = {
   readonly validateBootOptions?: ValidateBootOptions;
   /** Listen-Port. Default 3000 (or $PORT). */
   readonly port?: number;
+  /** Ceiling Bun.serve buffers a request body to before any app-level
+   *  body-limit middleware runs. Default is derived from `createFilesFeature`'s
+   *  configured `maxUploadSize`/field `maxSize` (see
+   *  resolveDerivedMaxRequestBodySize in bun-serve-options.ts) — override
+   *  only for a custom ceiling unrelated to that config. */
+  readonly maxRequestBodySize?: number;
   /** Auth-mode: standard features + routes wired, admin seeded. */
   readonly auth?: RunProdAppAuthOptions;
   /** Custom seed functions, run after the admin seed (when auth-mode). */
@@ -481,21 +507,19 @@ export type RunProdAppOptions = {
    *  for any path that doesn't match an /api/ handler. Use this for the
    *  public status page HTML, embed widget JS, etc. */
   readonly staticDir?: string;
-  /** Host-aware Routing-Hook für Multi-Tenant + Multi-App-Deployments
-   *  (z.B. publicstatus's `<sub>.publicstatus.eu` (Public-Page) +
-   *  `admin.publicstatus.eu` (Admin-UI) + `publicstatus.eu` (Apex/
-   *  Marketing) im SELBEN Container).
+  /** Host-aware routing hook for multi-tenant + multi-app deployments
+   *  (e.g. publicstatus's `<sub>.publicstatus.eu` (public page) +
+   *  `admin.publicstatus.eu` (admin UI) + `publicstatus.eu` (apex/
+   *  marketing) in the SAME container).
    *
-   *  Wird aufgerufen wenn der staticDir-Fallback einen HTML-Response
-   *  generieren würde (Root oder SPA-Route). Default-Verhalten ohne
-   *  hostDispatch: index.html mit Schema-Injection (Single-App).
+   *  Called when the staticDir fallback would generate an HTML response
+   *  (root or SPA route). Default behavior without hostDispatch: index.html
+   *  (single-app), no schema.
    *
-   *  Sicherheitshinweis: Schema-Injection (`__KUMIKO_SCHEMA__`) leakt
-   *  die Admin-UI-Topologie (alle Screens, Felder, Layouts) ans HTML.
-   *  Public-Domain-Antworten sollen das NIEMALS — `injectSchema` ist
-   *  daher default false und MUSS pro Host explizit eingeschaltet
-   *  werden. CSP-Header pro Host können zusätzlich Asset-Pfade
-   *  einschränken. */
+   *  Schema safety: HTML (per-host as well as single-app) never carries an
+   *  AppSchema — createKumikoApp fetches it via GET /api/schema, which sits
+   *  behind the auth middleware and only serves non-anonymous, signed-in
+   *  users. Per-host CSP headers can additionally restrict asset paths. */
   readonly hostDispatch?: HostDispatchFn;
   /** Per-request head-metadata resolver (Open-Graph/title/description) for
    *  the static-fallback HTML shell — see `PageHeadResolver`. Consulted on
@@ -664,6 +688,12 @@ export type RunProdAppOptions = {
    *  overridden. `false` disables the whole block; per-header overrides
    *  via the object form — see SecurityHeadersOption. */
   readonly securityHeaders?: SecurityHeadersOption;
+  /** Number of trusted reverse-proxy hops for client-IP resolution — 1:1
+   *  durchgereicht an `buildServer`s
+   *  top-level `ServerOptions.trustedProxyHops`. Wins over the deprecated
+   *  `auth.trustedProxyHops` and `KUMIKO_TRUSTED_PROXY_HOPS`. Default 0 =
+   *  trust no proxy header, only the socket address (or "unknown") counts. */
+  readonly trustedProxyHops?: number;
 };
 
 export type ProdAppHandle = {
@@ -674,8 +704,12 @@ export type ProdAppHandle = {
    *  `process.exit(0)` before returning a handle. */
   readonly entrypoint: ApiEntrypoint | AllInOneEntrypoint;
   /** The fetch-handler — wired into Bun.serve in production, called
-   *  directly in tests. Composes Hono + static-fallback. */
-  readonly fetch: (req: Request) => Promise<Response> | Response;
+   *  directly in tests. Composes Hono + static-fallback. Apps with
+   *  `autoListen: false` that call `Bun.serve` themselves must pass the
+   *  2nd arg from `server.requestIP(req)?.address`, extracted in their
+   *  outermost Bun fetch callback — `requestIP` only resolves for Bun's
+   *  original Request instance, never a cloned/rebuilt one. */
+  readonly fetch: (req: Request, socketAddress?: string) => Promise<Response> | Response;
   /** Active Bun-server (only set when listen() was called — tests skip
    *  listen() because Bun.serve isn't available under vitest/node). */
   server?: ReturnType<typeof Bun.serve>;
@@ -792,30 +826,10 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // kumiko-framework#1539 — options.auth.trustedProxyHops wins; falls back
   // to the env var so ops can close the XFF-spoofing hole per-deployment
   // without a code change (mirrors instanceId's env-first pattern above).
-  // Fail loud on a garbage env value rather than silently coercing to NaN:
-  // clientIpOf treats NaN like "always short chain" and returns "unknown"
-  // for every request, which collapses mfa-verify/preauth-confirm's
-  // pure-IP-keyed rate limiter into one shared bucket for the whole
-  // deployment — a self-inflicted DoS, worse than staying on the default.
-  const trustedProxyHopsFromEnv = readEnv("KUMIKO_TRUSTED_PROXY_HOPS", envSource);
-  const trustedProxyHops = ((): number | undefined => {
-    if (options.auth?.trustedProxyHops !== undefined) return options.auth.trustedProxyHops;
-    if (trustedProxyHopsFromEnv === undefined) return undefined;
-    // Digits-only — parseInt("0x10")/("1e3")/("2x") would silently coerce
-    // and land on the spoofable hops=0 path for values like "0x10".
-    if (!/^\d+$/.test(trustedProxyHopsFromEnv)) {
-      throw new Error(
-        `runProdApp: KUMIKO_TRUSTED_PROXY_HOPS must be a non-negative integer, got "${trustedProxyHopsFromEnv}".`,
-      );
-    }
-    const parsed = Number.parseInt(trustedProxyHopsFromEnv, 10);
-    if (!Number.isInteger(parsed) || parsed < 0) {
-      throw new Error(
-        `runProdApp: KUMIKO_TRUSTED_PROXY_HOPS must be a non-negative integer, got "${trustedProxyHopsFromEnv}".`,
-      );
-    }
-    return parsed;
-  })();
+  const trustedProxyHops =
+    options.trustedProxyHops ??
+    options.auth?.trustedProxyHops ??
+    parseTrustedProxyHopsEnv(readEnv(TRUSTED_PROXY_HOPS_ENV, envSource), "runProdApp");
   const port = options.port ?? Number.parseInt(envSource["PORT"] ?? "3000", 10);
 
   // biome-ignore lint/suspicious/noConsole: boot-time progress hint, no logger configured this early
@@ -989,11 +1003,6 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     ...addConfigAccessorFactory({ ...autoExtraContext, ...resolvedExtraContext }, registry),
     ...(options.defaultLocale !== undefined && { defaultLocale: options.defaultLocale }),
   };
-  // @cast-boundary engine-bridge — searchAdapter is an optional context-extension
-  // (SharedContextFields.searchAdapter), invisible to extraContext's loose
-  // Record<string, unknown>-based typing. Presence check only, no need to
-  // pull in the SearchAdapter type here.
-  const searchAdapterMissing = !(extraContext as { searchAdapter?: unknown }).searchAdapter;
   const baseAnonymousAccess =
     typeof options.anonymousAccess === "function"
       ? options.anonymousAccess(deps)
@@ -1075,6 +1084,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     ...(options.observabilityOptions && { observabilityOptions: options.observabilityOptions }),
     ...(options.metrics && { metrics: options.metrics }),
     ...(options.rateLimit && { rateLimit: options.rateLimit }),
+    ...(trustedProxyHops !== undefined && { trustedProxyHops }),
     ...(options.extraRoutes && { extraRoutes: options.extraRoutes }),
     ...(effectiveAuth && {
       auth: {
@@ -1101,6 +1111,9 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
           unsafeSkipOriginCheck: effectiveAuth.unsafeSkipOriginCheck,
         }),
         ...(trustedProxyHops !== undefined && { trustedProxyHops }),
+        ...(effectiveAuth.postAuthLanding !== undefined && {
+          postAuthLanding: effectiveAuth.postAuthLanding,
+        }),
         ...sessionAuthFragment,
         ...patAuthFragment,
         ...(mfaFeature && {
@@ -1222,18 +1235,6 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     });
   }
 
-  // 8. Build the AppSchema once + serialize. Wird beim Static-Fallback
-  //    in die index.html injiziert damit createKumikoApp() im Browser
-  //    `window.__KUMIKO_SCHEMA__` synchron lesen kann — gleicher Pfad
-  //    wie im dev-server, damit der Client-Code keine Sonderfall-
-  //    Branch zwischen dev/prod braucht. Boot-once weil Features
-  //    nach dem Start nicht mehr ändern.
-  // TODO: Sobald per-Tenant- oder per-User-Schema kommt (Feature-Toggles
-  // pro Tenant, Auth-Rolle gated Screens), muss die Injection pro
-  // Request rendern — staticDir-Fallback einen render(req)-Hook bekommen
-  // statt eines fixed JSON-Strings. Heute: registry-static, also OK.
-  const appSchemaJson = JSON.stringify(buildAppSchema(registry, { searchAdapterMissing }));
-
   // `extraRoutes` itself is already mounted — buildServer wires it inside
   // createApiEntrypoint/createAllInOneEntrypoint, before this function ever
   // runs. `wire` is the remaining escape-hatch for app-wired co-running
@@ -1301,19 +1302,20 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
       ? buildStaticFallback(
           entrypoint.app.fetch.bind(entrypoint.app),
           options.staticDir,
-          appSchemaJson,
           options.hostDispatch,
           options.resolvePageHead
             ? { resolvePageHead: options.resolvePageHead, dispatcher: entrypoint.dispatcher }
             : undefined,
           entrypoint.dispatcher,
+          trustedProxyHops ?? 0,
         )
       : // No staticDir (split-deploy / API-only container) → app.fetch's
         // response goes straight to the client, bypassing buildStaticFallback
         // (and with it tryHonoFirst) entirely. Must strip the router-miss
         // marker here too, same reason as the /api/* passthrough in
         // run-prod-app-static-files.ts (see try-hono-first.ts).
-        async (req: Request) => stripNoRouteMatchHeader(await entrypoint.app.fetch(req)),
+        async (req: Request, socketAddress?: string) =>
+          stripNoRouteMatchHeader(await entrypoint.app.fetch(req, socketAddress)),
     options.securityHeaders,
   );
 
@@ -1338,7 +1340,13 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
             "Under Node/vitest pass `autoListen: false` and call the returned `fetch()` directly.",
         );
       }
-      handle.server = Bun.serve(buildBunServeOptions(listenPort, fetchHandler));
+      handle.server = Bun.serve(
+        buildBunServeOptions(
+          listenPort,
+          fetchHandler,
+          options.maxRequestBodySize ?? resolveDerivedMaxRequestBodySize(registry),
+        ),
+      );
 
       // SIGTERM/SIGINT — graceful shutdown. Only registered when we
       // actually own a Bun-server, otherwise the test process picks up

package/src/security-headers.ts

@@ -43,13 +43,13 @@ export function resolveSecurityHeaders(
 // Sets each header only when absent so per-response values (e.g. the
 // per-host CSP from hostDispatch) always win over the runtime default.
 export function withSecurityHeaders(
-  handler: (req: Request) => Response | Promise<Response>,
+  handler: (req: Request, socketAddress?: string) => Response | Promise<Response>,
   option: SecurityHeadersOption | undefined,
-): (req: Request) => Response | Promise<Response> {
+): (req: Request, socketAddress?: string) => Response | Promise<Response> {
   const defaults = resolveSecurityHeaders(option);
   if (defaults.length === 0) return handler;
-  return async (req: Request): Promise<Response> => {
-    const res = await handler(req);
+  return async (req: Request, socketAddress?: string): Promise<Response> => {
+    const res = await handler(req, socketAddress);
     try {
       for (const [name, value] of defaults) {
         if (!res.headers.has(name)) res.headers.set(name, value);

package/src/try-hono-first.ts

@@ -31,11 +31,13 @@
 import { NO_ROUTE_MATCH_HEADER_NAME } from "@cosmicdrift/kumiko-framework/api";
 
 export type HonoLikeApp = {
-  // Hono.app.fetch is `(req) => Response | Promise<Response>` (sync if all
-  // handlers are sync, otherwise a Promise). createApiEntrypoint's
+  // Hono.app.fetch is `(req, env?) => Response | Promise<Response>` (sync if
+  // all handlers are sync, otherwise a Promise). createApiEntrypoint's
   // apiHandler matches the same shape. The union accepts both — we await
-  // below, which works for either case.
-  readonly fetch: (req: Request) => Response | Promise<Response>;
+  // below, which works for either case. `socketAddress` rides in as `env`
+  // so requestIdMiddleware/rate-limit can read it via `c.env` without Hono
+  // ever seeing a raw Bun `Server`.
+  readonly fetch: (req: Request, socketAddress?: string) => Response | Promise<Response>;
 };
 
 export type HonoFirstResult = {
@@ -69,8 +71,12 @@ export function stripNoRouteMatchHeader(response: Response): Response {
  * req.clone() because downstream needs to read the request body again
  * (future-proofing for POST/PUT/PATCH — only GET routes today).
  */
-export async function tryHonoFirst(app: HonoLikeApp, req: Request): Promise<HonoFirstResult> {
-  const response = await app.fetch(req.clone());
+export async function tryHonoFirst(
+  app: HonoLikeApp,
+  req: Request,
+  socketAddress?: string,
+): Promise<HonoFirstResult> {
+  const response = await app.fetch(req.clone(), socketAddress);
   const isRouterMiss = response.status === 404 && response.headers.has(NO_ROUTE_MATCH_HEADER_NAME);
   stripNoRouteMatchHeader(response);
   return { matched: !isRouterMiss, response };