@cosmicdrift/kumiko-server-runtime 0.351.0 → 0.353.0

package/dist/build-prod-bundle.d.ts

@@ -94,7 +94,6 @@ export declare function assertRendererWebShellPresent(css: string, stylesheet: R
 export declare function discoverHtmlTemplate(cwd: string): string | undefined;
 export declare function runTailwindOnce(entry: string, cwd: string): Promise<string>;
 export declare function isEntryOutputFor(outName: string, baseName: string): boolean;
-export declare function buildMissingTemplateError(manifest: BuildManifest, entry: ClientEntry): string;
 export declare function injectAssetTags(html: string, manifest: BuildManifest, entry: ClientEntry, buildInfo?: BuildInfo): string;
 export declare function computeBuildId(manifest: BuildManifest): string;
 /** Formatiert ein BuildResult als CLI-freundliche Mehrzeilen-Zusammenfassung

package/dist/build-prod-bundle.js

@@ -672,10 +672,9 @@ async function renderHtml(templatePath, manifest, entry, buildInfo) {
     const template = templatePath ? await readFile(templatePath, "utf8") : DEFAULT_HTML;
     return injectAssetTags(template, manifest, entry, buildInfo);
 }
-// @internal — exported for unit tests only. See #2305: the message must
-// name the source file and, for a declared multi-entry, which package.json
-// "kumiko.clientEntries" entry it came from.
-export function buildMissingTemplateError(manifest, entry) {
+// The message must name the source file and, for a declared multi-entry,
+// which package.json "kumiko.clientEntries" entry it came from.
+function buildMissingTemplateError(manifest, entry) {
     const cssLine = manifest["styles.css"]
         ? `    <link rel="stylesheet" href="/styles.css" />\n`
         : "";

package/dist/pii-boot-gate.js

@@ -17,7 +17,7 @@ export function assertPiiBootInvariants(features, opts) {
     // encryptEventPayloadPii no-ops without a KMS, so a catalogued event writes
     // plaintext PII into kumiko_events with nothing to crypto-shred later.
     const piiEvents = features.flatMap((feature) => Object.values(feature.events ?? {})
-        .filter((event) => event.piiFields !== undefined && event.piiFields !== "none")
+        .filter((event) => event.piiFields !== "none")
         .map((event) => event.name));
     // skip: nothing PII-annotated is mounted — plaintext gate is moot.
     if (piiEntities.length === 0 && piiEvents.length === 0)

package/dist/request-bound-system-query.d.ts

@@ -0,0 +1,12 @@
+import { type ClientIpResolver } from "@cosmicdrift/kumiko-framework/api";
+import { type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
+export type QueryDispatcher = {
+    readonly query: (type: string, payload: unknown, user: SessionUser) => Promise<unknown>;
+};
+export declare function buildRequestBoundSystemQuery(params: {
+    readonly req: Request;
+    readonly dispatcher: QueryDispatcher;
+    readonly resolver: ClientIpResolver;
+    readonly socketAddress?: string;
+}): PageHeadSystemQuery;

package/dist/request-bound-system-query.js

@@ -0,0 +1,9 @@
+import { buildRequestContextDataFromRequest, requestContext, } from "@cosmicdrift/kumiko-framework/api";
+import { createAnonymousUser } from "@cosmicdrift/kumiko-framework/engine";
+// Single wiring for the anonymous-role systemQuery that page-head and
+// hostDispatch resolvers receive, shared by runProdApp and the dev server so
+// the anonymous role / request-context / client-IP resolution can't drift.
+export function buildRequestBoundSystemQuery(params) {
+    const { req, dispatcher, resolver, socketAddress } = params;
+    return (type, payload, tenantId) => requestContext.run(requestContext.get() ?? buildRequestContextDataFromRequest(req, { resolver, socketAddress }), () => dispatcher.query(type, payload, createAnonymousUser(tenantId)));
+}

package/dist/run-prod-app-static-files.d.ts

@@ -1,5 +1,5 @@
 import { type CachePolicy } from "@cosmicdrift/kumiko-framework/api";
-import { type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type QueryDispatcher } from "./request-bound-system-query.js";
 import type { HostDispatchFn, PageHeadResolver } from "./run-prod-app.js";
 export declare function readStaticFile(filePath: string): Promise<{
     readonly bytes: Uint8Array;
@@ -12,9 +12,6 @@ export declare function serveDiskFile(req: Request, pathname: string, file: {
     readonly mtimeMs: number;
 }): Response;
 export declare function mimeTypeFor(filePath: string): string;
-type QueryDispatcher = {
-    readonly query: (type: string, payload: unknown, user: SessionUser) => Promise<unknown>;
-};
 export type PageHeadOptions = {
     readonly resolvePageHead: PageHeadResolver;
     readonly dispatcher: QueryDispatcher;
@@ -29,4 +26,3 @@ hostDispatchDispatcher?: QueryDispatcher,
  *  1:1 with runProdApp's effective value. */
 trustedProxyHops?: number): (req: Request, socketAddress?: string) => Promise<Response>;
 export declare function staticCachePolicy(pathname: string): CachePolicy;
-export {};

package/dist/run-prod-app-static-files.js

@@ -1,9 +1,9 @@
 import { resolve, sep } from "node:path";
-import { buildRequestContextDataFromRequest, cachedResponse, computeStrongEtag, computeWeakEtag, createClientIpResolver, requestContext, } from "@cosmicdrift/kumiko-framework/api";
-import { createAnonymousUser } from "@cosmicdrift/kumiko-framework/engine";
+import { cachedResponse, computeStrongEtag, computeWeakEtag, createClientIpResolver, } from "@cosmicdrift/kumiko-framework/api";
 import { resolveAndInjectPageHead } from "@cosmicdrift/kumiko-headless/apex";
 import { ASSETS_DIR } from "./build-prod-bundle.js";
 import { BUNDLED_ASSETS_DIST_DIR } from "./bundled-assets.js";
+import { buildRequestBoundSystemQuery, } from "./request-bound-system-query.js";
 import { stripNoRouteMatchHeader, tryHonoFirst } from "./try-hono-first.js";
 // Static-asset + SPA-fallback serving for runProdApp's HTTP handler. Split
 // out of run-prod-app.ts (#1005, Welle 2) — mechanical relocation, these
@@ -162,8 +162,12 @@ trustedProxyHops = 0) {
             return html;
         const url = new URL(req.url);
         const host = req.headers.get("host") ?? url.host;
-        const systemQuery = (type, payload, tenantId) => requestContext.run(requestContext.get() ??
-            buildRequestContextDataFromRequest(req, { resolver: clientIpResolver, socketAddress }), () => pageHead.dispatcher.query(type, payload, createAnonymousUser(tenantId)));
+        const systemQuery = buildRequestBoundSystemQuery({
+            req,
+            dispatcher: pageHead.dispatcher,
+            resolver: clientIpResolver,
+            socketAddress,
+        });
         const text = new TextDecoder().decode(html.bytes);
         const injected = await resolveAndInjectPageHead(text, pageHead.resolvePageHead, {
             path: url.pathname,
@@ -192,8 +196,12 @@ trustedProxyHops = 0) {
             if (!hostDispatchDispatcher) {
                 throw new Error("hostDispatch called deps.systemQuery but buildStaticFallback got no hostDispatchDispatcher");
             }
-            return requestContext.run(requestContext.get() ??
-                buildRequestContextDataFromRequest(req, { resolver: clientIpResolver, socketAddress }), () => hostDispatchDispatcher.query(type, payload, createAnonymousUser(tenantId)));
+            return buildRequestBoundSystemQuery({
+                req,
+                dispatcher: hostDispatchDispatcher,
+                resolver: clientIpResolver,
+                socketAddress,
+            })(type, payload, tenantId);
         };
         const result = await hostDispatch({ host, path: url.pathname, search: url.search }, { systemQuery });
         if (result.kind === "redirect") {

package/dist/run-prod-app.js

@@ -176,6 +176,28 @@ export async function runProdApp(options) {
     //    needed in 9.1's audit (37 references, 25 distinct vars).
     const rawEnvSource = options.envSource ?? process.env;
     const runMode = parseRunMode(rawEnvSource["KUMIKO_DRY_RUN_ENV"]);
+    const composedEnvSchema = options.envSchema;
+    const validateEnv = (source) => {
+        // skip: app declares no env schema, nothing to validate
+        if (!composedEnvSchema)
+            return;
+        try {
+            const schema = options.masterKey
+                ? withOptionalEnvKeys(composedEnvSchema.schema, SECRETS_MASTER_KEK_ENV_KEYS)
+                : composedEnvSchema.schema;
+            parseEnv(schema, source, {
+                sources: composedEnvSchema.sources,
+                ...(options.pulumiPrefix ? { pulumiPrefix: options.pulumiPrefix } : {}),
+            });
+        }
+        catch (err) {
+            if (err instanceof KumikoBootError) {
+                const reporter = options.bootErrorReporter ?? defaultBootErrorReporter;
+                reporter(err);
+            }
+            throw err;
+        }
+    };
     if (options.envSchema) {
         if (isRenderMode(runMode)) {
             // biome-ignore lint/suspicious/noConsole: dry-run output IS the deliverable
@@ -194,22 +216,7 @@ export async function runProdApp(options) {
         // boot-mode AND normal-boot both run env-validation. boot-mode wants
         // a real env-check (all required vars present + schema-valid) before
         // it asserts feature-wiring works.
-        try {
-            const envSchema = options.masterKey
-                ? withOptionalEnvKeys(options.envSchema.schema, SECRETS_MASTER_KEK_ENV_KEYS)
-                : options.envSchema.schema;
-            parseEnv(envSchema, rawEnvSource, {
-                sources: options.envSchema.sources,
-                ...(options.pulumiPrefix ? { pulumiPrefix: options.pulumiPrefix } : {}),
-            });
-        }
-        catch (err) {
-            if (err instanceof KumikoBootError) {
-                const reporter = options.bootErrorReporter ?? defaultBootErrorReporter;
-                reporter(err);
-            }
-            throw err;
-        }
+        validateEnv(rawEnvSource);
     }
     // Slots the schema marks `kms` are decrypted once here so every consumer
     // below (boot probe, master-key keyring, config) sees the same resolved env.
@@ -219,6 +226,12 @@ export async function runProdApp(options) {
             logPrefix: "[runProdApp]",
         })
         : rawEnvSource;
+    // The first parse relaxes ciphertext-only slots, so their decrypted
+    // plaintext never met the slot's own validators (.regex/.min/.refine).
+    if (options.envSchema &&
+        kmsSlotsOf(options.envSchema.schema).some((slot) => rawEnvSource[slot] === undefined && envSource[slot] !== undefined)) {
+        validateEnv(envSource);
+    }
     // 1. Polyfill before anything else — feature code references Temporal.
     const { ensureTemporalPolyfill } = await import("@cosmicdrift/kumiko-framework/time");
     await ensureTemporalPolyfill();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.351.0",
+  "version": "0.353.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -74,17 +74,21 @@
       "types": "./dist/try-hono-first.d.ts",
       "default": "./dist/try-hono-first.js"
     },
+    "./request-bound-system-query": {
+      "types": "./dist/request-bound-system-query.d.ts",
+      "default": "./dist/request-bound-system-query.js"
+    },
     "./build-prod-bundle": {
       "types": "./dist/build-prod-bundle.d.ts",
       "default": "./dist/build-prod-bundle.js"
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.351.0",
-    "@cosmicdrift/kumiko-framework": "0.351.0",
-    "@cosmicdrift/kumiko-headless": "0.351.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.351.0",
-    "@cosmicdrift/kumiko-types": "0.351.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.353.0",
+    "@cosmicdrift/kumiko-framework": "0.353.0",
+    "@cosmicdrift/kumiko-headless": "0.353.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.353.0",
+    "@cosmicdrift/kumiko-types": "0.353.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2"
@@ -149,6 +153,10 @@
         "types": "./dist/try-hono-first.d.ts",
         "default": "./dist/try-hono-first.js"
       },
+      "./request-bound-system-query": {
+        "types": "./dist/request-bound-system-query.d.ts",
+        "default": "./dist/request-bound-system-query.js"
+      },
       "./build-prod-bundle": {
         "types": "./dist/build-prod-bundle.d.ts",
         "default": "./dist/build-prod-bundle.js"

package/src/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Boot rejects decrypted kms env slots that violate their schema validators",
+    "detail": "runProdApp validates Key-Manager-decrypted env slots against their schema\nA `kms` slot delivered only as `_CIPHERTEXT` skipped its own `.regex`/`.min`/`.refine` because the first parse relaxes it. After decryption the env is now parsed again, so a malformed plaintext aborts the boot with a `KumikoBootError` naming the slot."
+  },
+  {
+    "version": "0.353.0",
+    "type": "improvement",
+    "title": "Prod static files and the dev server share one request-bound systemQuery wiring",
+    "detail": "Shared request-bound systemQuery wiring and clearer deploy scaffold warnings\n`@cosmicdrift/kumiko-server-runtime/request-bound-system-query` exports the systemQuery wiring that the prod static-file path and the dev server previously each copied. `scaffoldDeploy` now tells a broken `package.json` (deploy settings fall back to defaults) apart from an unexpected `dependencies`/`workspaces` shape in its warning."
+  },
   {
     "version": "0.347.0",
     "type": "fix",