@cosmicdrift/kumiko-server-runtime 0.337.1 → 0.339.0

package/dist/build-prod-bundle.d.ts

@@ -33,9 +33,9 @@ export type BuildResult = {
      *  undefined bei vanilla public-only-Builds (kein Bundle). */
     readonly buildInfo?: BuildInfo;
 };
-/** In index.html gebacken (`window.__KUMIKO_BUILD__`) UND als
- *  dist/build-info.json geschrieben. Der UpdateChecker pollt build-info.json
- *  und vergleicht `id` gegen den geladenen Stand → Reload-Banner bei Drift. */
+/** Baked into index.html (`<meta name="kumiko-build">`) AND written as
+ *  dist/build-info.json. The UpdateChecker polls build-info.json and compares
+ *  `id` with the loaded build, showing a reload banner on drift. */
 export type BuildInfo = {
     /** Hash über die sortierten (content-gehashten) Asset-URLs. Ändert sich
      *  gdw. sich ein Asset ändert — selbsttragend, kein Env-Var/Dockerfile. */

package/dist/build-prod-bundle.js

@@ -51,6 +51,7 @@ import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { isPlainObject, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { Temporal } from "temporal-polyfill";
 import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_DIST_DIR, resolveRendererWebFontsDir, } from "./renderer-web-fonts.js";
 import { canResolveTailwindStylesheet, resolveTailwindCli } from "./resolve-tailwind-cli.js";
@@ -654,6 +655,7 @@ export function buildMissingTemplateError(manifest, entry) {
         `\n` +
         `Der Build ersetzt /styles.css und /${entry.manifestKey} durch die gehashten URLs.`);
 }
+const BUILD_META_NAME = "kumiko-build";
 // @internal — exported nur für Unit-Tests.
 //
 // Convention: das HTML-Template MUSS Placeholder-Tags für jedes Asset
@@ -668,10 +670,10 @@ export function buildMissingTemplateError(manifest, entry) {
 // Diff zwischen Dev- und Prod-HTML unsichtbar macht.
 export function injectAssetTags(html, manifest, entry, buildInfo) {
     let result = html;
-    // Build-Stand vor </head> backen. Ohne </head> (z.B. Fragment) still skip.
+    // Meta tag instead of an inline script: strict CSPs (script-src 'self') block inline scripts.
+    // Without </head> (e.g. a fragment) skip silently.
     if (buildInfo && result.includes("</head>")) {
-        // html-ok: id/builtAt sind Hex bzw. ISO — kein `<` möglich, kein Breakout.
-        const tag = `<script>window.__KUMIKO_BUILD__=${JSON.stringify(buildInfo)};</script>`;
+        const tag = `<meta name="${BUILD_META_NAME}" content="${escapeHtmlAttr(buildInfo.id)}" data-built-at="${escapeHtmlAttr(buildInfo.builtAt)}" />`;
         result = result.replace("</head>", `    ${tag}\n  </head>`);
     }
     const cssUrl = manifest["styles.css"];

package/dist/run-prod-app-static-files.js

@@ -117,8 +117,17 @@ trustedProxyHops = 0) {
             mtimeMs: file.mtimeMs,
         };
     }
-    function serveHtmlFile(req, pathname, html, extraHeaders) {
+    function serveHtmlFile(req, pathname, html, extraHeaders, status) {
+        // A not-found page carries no validator: a matching If-None-Match must
+        // never turn a 404 into a bodyless 304.
+        if (status === 404) {
+            return new Response(req.method === "HEAD" ? null : html.bytes, {
+                status,
+                headers: { "content-type": html.mime, "cache-control": "no-store", ...extraHeaders },
+            });
+        }
         return cachedResponse(req, {
+            status,
             body: html.bytes,
             etag: html.etag,
             cache: staticCachePolicy(pathname),
@@ -177,30 +186,33 @@ trustedProxyHops = 0) {
                 buildRequestContextDataFromRequest(req, { resolver: clientIpResolver, socketAddress }), () => hostDispatchDispatcher.query(type, payload, createAnonymousUser(tenantId)));
         };
         const result = await hostDispatch({ host, path: url.pathname, search: url.search }, { systemQuery });
-        if (result.kind === "not-found") {
-            return new Response("Not Found", { status: 404 });
-        }
         if (result.kind === "redirect") {
             return new Response(null, {
                 status: result.status ?? 302,
                 headers: { Location: result.to },
             });
         }
-        // result.kind === "html"
-        const filePath = `${staticDir}/${result.file}`;
-        const html = await readHtmlFile(filePath);
+        if (result.kind === "not-found") {
+            if (result.file === undefined)
+                return new Response("Not Found", { status: 404 });
+            return serveHostDispatchFile(req, result.file, result.csp, socketAddress, 404);
+        }
+        return serveHostDispatchFile(req, result.file, result.csp, socketAddress, 200);
+    }
+    async function serveHostDispatchFile(req, file, csp, socketAddress, status) {
+        const html = await readHtmlFile(`${staticDir}/${file}`);
         if (!html) {
             // Author-Fehler: hostDispatch verweist auf nicht-existente Datei.
             // Liefer 500 statt silent-404 damit der Bug schnell auffällt.
-            return new Response(`hostDispatch: file not found: ${result.file}`, { status: 500 });
+            return new Response(`hostDispatch: file not found: ${file}`, { status: 500 });
         }
         // Per-host body (hostDispatch picks the file by host) → Vary: Host,
         // otherwise a shared cache could serve Host A's HTML to Host B.
         const extraHeaders = { vary: "Host" };
-        if (result.csp)
-            extraHeaders["content-security-policy"] = result.csp;
+        if (csp)
+            extraHeaders["content-security-policy"] = csp;
         const withHead = await applyPageHead(req, html, socketAddress);
-        return serveHtmlFile(req, "/index.html", withHead, extraHeaders);
+        return serveHtmlFile(req, "/index.html", withHead, extraHeaders, status);
     }
     return async (req, socketAddress) => {
         const url = new URL(req.url);

package/dist/run-prod-app.d.ts

@@ -179,7 +179,8 @@ export type ExtraContextOption = Record<string, unknown> | ((deps: RunProdAppDep
  *      itself from the authenticated GET /api/schema, after the
  *      clientFeature gates (auth) let it through.
  *    - "redirect": 301/302 to the given location.
- *    - "not-found": reject outright (e.g. unknown subdomain).
+ *    - "not-found": reject (e.g. unknown subdomain) with a plain 404, or —
+ *      with `file` (+ optional `csp`) — serve that page with status 404.
  *
  *  Only consulted when the path would otherwise fall through to the HTML
  *  fallback — i.e. for "/", "/index.html", or SPA routes that neither Hono
@@ -198,6 +199,8 @@ export type HostDispatchResult = {
     readonly status?: 301 | 302;
 } | {
     readonly kind: "not-found";
+    readonly file?: string;
+    readonly csp?: string;
 };
 export type HostDispatchFn = (req: {
     readonly host: string;

package/dist/run-prod-app.js

@@ -242,6 +242,13 @@ export async function runProdApp(options) {
     const trustedProxyHops = options.trustedProxyHops ??
         options.auth?.trustedProxyHops ??
         parseTrustedProxyHopsEnv(readEnv(TRUSTED_PROXY_HOPS_ENV, envSource), "runProdApp");
+    if (trustedProxyHops === undefined) {
+        // With 0 hops every request appears to come from the proxy pod, so all IP-keyed
+        // rate limiters collapse into one shared bucket behind a reverse proxy.
+        // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early
+        console.warn(`[runProdApp] trustedProxyHops / ${TRUSTED_PROXY_HOPS_ENV} is not set; client IP falls back to the socket address. ` +
+            "Behind a reverse proxy all clients share one rate-limit bucket.");
+    }
     const port = options.port ?? Number.parseInt(envSource["PORT"] ?? "3000", 10);
     // biome-ignore lint/suspicious/noConsole: boot-time progress hint, no logger configured this early
     console.log(`[runProdApp] booting Kumiko stack on port ${port}…`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.337.1",
+  "version": "0.339.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,10 +80,10 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.337.1",
-    "@cosmicdrift/kumiko-framework": "0.337.1",
-    "@cosmicdrift/kumiko-headless": "0.337.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.337.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.339.0",
+    "@cosmicdrift/kumiko-framework": "0.339.0",
+    "@cosmicdrift/kumiko-headless": "0.339.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.339.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2"

package/src/changes.json

@@ -1,4 +1,25 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "fix",
+    "title": "Prod builds no longer inject an inline script for the build info, so strict CSPs without unsafe-inline work without hashes or nonces",
+    "detail": "Build info is baked into index.html as a meta tag instead of an inline script",
+    "migration": "window.__KUMIKO_BUILD__ no longer exists. Code that read it (for example a version footer) now gets undefined and silently renders nothing. Replace the global with readLoadedBuild() from @cosmicdrift/kumiko-renderer-web, which returns { id, builtAt } from the new <meta name=\"kumiko-build\"> tag, and drop the Window augmentation for __KUMIKO_BUILD__. The UpdateChecker needs no change."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "hostDispatch not-found can serve a custom 404 page",
+    "detail": "`HostDispatchResult` `{ kind: \"not-found\" }` accepts `file` (relative to `staticDir`) and `csp`. The page goes through the same delivery as `kind: \"html\"` (page head, `Vary: Host`, CSP) with status 404. A missing file answers 500 with the same message as `html`.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "boot warning when trustedProxyHops is unset",
+    "detail": "runProdApp warns at boot when neither `trustedProxyHops` nor `KUMIKO_TRUSTED_PROXY_HOPS` is set. Behind a reverse proxy all clients then share one IP-keyed rate-limit bucket.",
+    "migration": "Set `KUMIKO_TRUSTED_PROXY_HOPS` (for example 1 behind one ingress) or pass `trustedProxyHops` to runProdApp."
+  },
   {
     "version": "0.335.0",
     "type": "fix",