@cosmicdrift/kumiko-server-runtime 0.338.0 → 0.339.0

package/dist/build-prod-bundle.d.ts

@@ -33,9 +33,9 @@ export type BuildResult = {
      *  undefined bei vanilla public-only-Builds (kein Bundle). */
     readonly buildInfo?: BuildInfo;
 };
-/** In index.html gebacken (`window.__KUMIKO_BUILD__`) UND als
- *  dist/build-info.json geschrieben. Der UpdateChecker pollt build-info.json
- *  und vergleicht `id` gegen den geladenen Stand → Reload-Banner bei Drift. */
+/** Baked into index.html (`<meta name="kumiko-build">`) AND written as
+ *  dist/build-info.json. The UpdateChecker polls build-info.json and compares
+ *  `id` with the loaded build, showing a reload banner on drift. */
 export type BuildInfo = {
     /** Hash über die sortierten (content-gehashten) Asset-URLs. Ändert sich
      *  gdw. sich ein Asset ändert — selbsttragend, kein Env-Var/Dockerfile. */

package/dist/build-prod-bundle.js

@@ -51,6 +51,7 @@ import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { isPlainObject, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { Temporal } from "temporal-polyfill";
 import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_DIST_DIR, resolveRendererWebFontsDir, } from "./renderer-web-fonts.js";
 import { canResolveTailwindStylesheet, resolveTailwindCli } from "./resolve-tailwind-cli.js";
@@ -654,6 +655,7 @@ export function buildMissingTemplateError(manifest, entry) {
         `\n` +
         `Der Build ersetzt /styles.css und /${entry.manifestKey} durch die gehashten URLs.`);
 }
+const BUILD_META_NAME = "kumiko-build";
 // @internal — exported nur für Unit-Tests.
 //
 // Convention: das HTML-Template MUSS Placeholder-Tags für jedes Asset
@@ -668,10 +670,10 @@ export function buildMissingTemplateError(manifest, entry) {
 // Diff zwischen Dev- und Prod-HTML unsichtbar macht.
 export function injectAssetTags(html, manifest, entry, buildInfo) {
     let result = html;
-    // Build-Stand vor </head> backen. Ohne </head> (z.B. Fragment) still skip.
+    // Meta tag instead of an inline script: strict CSPs (script-src 'self') block inline scripts.
+    // Without </head> (e.g. a fragment) skip silently.
     if (buildInfo && result.includes("</head>")) {
-        // html-ok: id/builtAt sind Hex bzw. ISO — kein `<` möglich, kein Breakout.
-        const tag = `<script>window.__KUMIKO_BUILD__=${JSON.stringify(buildInfo)};</script>`;
+        const tag = `<meta name="${BUILD_META_NAME}" content="${escapeHtmlAttr(buildInfo.id)}" data-built-at="${escapeHtmlAttr(buildInfo.builtAt)}" />`;
         result = result.replace("</head>", `    ${tag}\n  </head>`);
     }
     const cssUrl = manifest["styles.css"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.338.0",
+  "version": "0.339.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,10 +80,10 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.338.0",
-    "@cosmicdrift/kumiko-framework": "0.338.0",
-    "@cosmicdrift/kumiko-headless": "0.338.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.338.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.339.0",
+    "@cosmicdrift/kumiko-framework": "0.339.0",
+    "@cosmicdrift/kumiko-headless": "0.339.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.339.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2"

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "fix",
+    "title": "Prod builds no longer inject an inline script for the build info, so strict CSPs without unsafe-inline work without hashes or nonces",
+    "detail": "Build info is baked into index.html as a meta tag instead of an inline script",
+    "migration": "window.__KUMIKO_BUILD__ no longer exists. Code that read it (for example a version footer) now gets undefined and silently renders nothing. Replace the global with readLoadedBuild() from @cosmicdrift/kumiko-renderer-web, which returns { id, builtAt } from the new <meta name=\"kumiko-build\"> tag, and drop the Window augmentation for __KUMIKO_BUILD__. The UpdateChecker needs no change."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",