@cosmicdrift/kumiko-server-runtime 0.337.1 → 0.338.0

package/dist/run-prod-app-static-files.js

@@ -117,8 +117,17 @@ trustedProxyHops = 0) {
             mtimeMs: file.mtimeMs,
         };
     }
-    function serveHtmlFile(req, pathname, html, extraHeaders) {
+    function serveHtmlFile(req, pathname, html, extraHeaders, status) {
+        // A not-found page carries no validator: a matching If-None-Match must
+        // never turn a 404 into a bodyless 304.
+        if (status === 404) {
+            return new Response(req.method === "HEAD" ? null : html.bytes, {
+                status,
+                headers: { "content-type": html.mime, "cache-control": "no-store", ...extraHeaders },
+            });
+        }
         return cachedResponse(req, {
+            status,
             body: html.bytes,
             etag: html.etag,
             cache: staticCachePolicy(pathname),
@@ -177,30 +186,33 @@ trustedProxyHops = 0) {
                 buildRequestContextDataFromRequest(req, { resolver: clientIpResolver, socketAddress }), () => hostDispatchDispatcher.query(type, payload, createAnonymousUser(tenantId)));
         };
         const result = await hostDispatch({ host, path: url.pathname, search: url.search }, { systemQuery });
-        if (result.kind === "not-found") {
-            return new Response("Not Found", { status: 404 });
-        }
         if (result.kind === "redirect") {
             return new Response(null, {
                 status: result.status ?? 302,
                 headers: { Location: result.to },
             });
         }
-        // result.kind === "html"
-        const filePath = `${staticDir}/${result.file}`;
-        const html = await readHtmlFile(filePath);
+        if (result.kind === "not-found") {
+            if (result.file === undefined)
+                return new Response("Not Found", { status: 404 });
+            return serveHostDispatchFile(req, result.file, result.csp, socketAddress, 404);
+        }
+        return serveHostDispatchFile(req, result.file, result.csp, socketAddress, 200);
+    }
+    async function serveHostDispatchFile(req, file, csp, socketAddress, status) {
+        const html = await readHtmlFile(`${staticDir}/${file}`);
         if (!html) {
             // Author-Fehler: hostDispatch verweist auf nicht-existente Datei.
             // Liefer 500 statt silent-404 damit der Bug schnell auffällt.
-            return new Response(`hostDispatch: file not found: ${result.file}`, { status: 500 });
+            return new Response(`hostDispatch: file not found: ${file}`, { status: 500 });
         }
         // Per-host body (hostDispatch picks the file by host) → Vary: Host,
         // otherwise a shared cache could serve Host A's HTML to Host B.
         const extraHeaders = { vary: "Host" };
-        if (result.csp)
-            extraHeaders["content-security-policy"] = result.csp;
+        if (csp)
+            extraHeaders["content-security-policy"] = csp;
         const withHead = await applyPageHead(req, html, socketAddress);
-        return serveHtmlFile(req, "/index.html", withHead, extraHeaders);
+        return serveHtmlFile(req, "/index.html", withHead, extraHeaders, status);
     }
     return async (req, socketAddress) => {
         const url = new URL(req.url);

package/dist/run-prod-app.d.ts

@@ -179,7 +179,8 @@ export type ExtraContextOption = Record<string, unknown> | ((deps: RunProdAppDep
  *      itself from the authenticated GET /api/schema, after the
  *      clientFeature gates (auth) let it through.
  *    - "redirect": 301/302 to the given location.
- *    - "not-found": reject outright (e.g. unknown subdomain).
+ *    - "not-found": reject (e.g. unknown subdomain) with a plain 404, or —
+ *      with `file` (+ optional `csp`) — serve that page with status 404.
  *
  *  Only consulted when the path would otherwise fall through to the HTML
  *  fallback — i.e. for "/", "/index.html", or SPA routes that neither Hono
@@ -198,6 +199,8 @@ export type HostDispatchResult = {
     readonly status?: 301 | 302;
 } | {
     readonly kind: "not-found";
+    readonly file?: string;
+    readonly csp?: string;
 };
 export type HostDispatchFn = (req: {
     readonly host: string;

package/dist/run-prod-app.js

@@ -242,6 +242,13 @@ export async function runProdApp(options) {
     const trustedProxyHops = options.trustedProxyHops ??
         options.auth?.trustedProxyHops ??
         parseTrustedProxyHopsEnv(readEnv(TRUSTED_PROXY_HOPS_ENV, envSource), "runProdApp");
+    if (trustedProxyHops === undefined) {
+        // With 0 hops every request appears to come from the proxy pod, so all IP-keyed
+        // rate limiters collapse into one shared bucket behind a reverse proxy.
+        // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early
+        console.warn(`[runProdApp] trustedProxyHops / ${TRUSTED_PROXY_HOPS_ENV} is not set; client IP falls back to the socket address. ` +
+            "Behind a reverse proxy all clients share one rate-limit bucket.");
+    }
     const port = options.port ?? Number.parseInt(envSource["PORT"] ?? "3000", 10);
     // biome-ignore lint/suspicious/noConsole: boot-time progress hint, no logger configured this early
     console.log(`[runProdApp] booting Kumiko stack on port ${port}…`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.337.1",
+  "version": "0.338.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,10 +80,10 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.337.1",
-    "@cosmicdrift/kumiko-framework": "0.337.1",
-    "@cosmicdrift/kumiko-headless": "0.337.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.337.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.338.0",
+    "@cosmicdrift/kumiko-framework": "0.338.0",
+    "@cosmicdrift/kumiko-headless": "0.338.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.338.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2"

package/src/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "hostDispatch not-found can serve a custom 404 page",
+    "detail": "`HostDispatchResult` `{ kind: \"not-found\" }` accepts `file` (relative to `staticDir`) and `csp`. The page goes through the same delivery as `kind: \"html\"` (page head, `Vary: Host`, CSP) with status 404. A missing file answers 500 with the same message as `html`.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "boot warning when trustedProxyHops is unset",
+    "detail": "runProdApp warns at boot when neither `trustedProxyHops` nor `KUMIKO_TRUSTED_PROXY_HOPS` is set. Behind a reverse proxy all clients then share one IP-keyed rate-limit bucket.",
+    "migration": "Set `KUMIKO_TRUSTED_PROXY_HOPS` (for example 1 behind one ingress) or pass `trustedProxyHops` to runProdApp."
+  },
   {
     "version": "0.335.0",
     "type": "fix",