@cosmicdrift/kumiko-server-runtime 0.352.0 → 0.354.0

package/dist/boot/worker-boot-core.js

@@ -139,6 +139,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
         envSource,
         registry,
         hasAuth: includeBundled,
+        redis,
         crypto: bootCrypto,
         ...(options.kms && { kms: options.kms }),
         ...(profile.deliverQueuedInline === true && { deliverQueuedInline: true }),

package/dist/build-prod-bundle.d.ts

@@ -43,6 +43,7 @@ export type BuildInfo = {
     /** ISO-Zeitstempel des Builds, lesbare Anzeige-Version (ersetzt den rohen sha). */
     readonly builtAt: string;
 };
+export declare const DEFAULT_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width,initial-scale=1,interactive-widget=resizes-content\" />\n    <title>Kumiko</title>\n  </head>\n  <body>\n    <div id=\"root\"></div>\n  </body>\n</html>\n";
 /** Folder name relative to dist/ for hashed assets (JS, CSS, file-loader
  *  outputs). Exported damit runProdApp dieselbe Konvention für Cache-
  *  Header nutzt — Drift verhindern. */
@@ -94,7 +95,6 @@ export declare function assertRendererWebShellPresent(css: string, stylesheet: R
 export declare function discoverHtmlTemplate(cwd: string): string | undefined;
 export declare function runTailwindOnce(entry: string, cwd: string): Promise<string>;
 export declare function isEntryOutputFor(outName: string, baseName: string): boolean;
-export declare function buildMissingTemplateError(manifest: BuildManifest, entry: ClientEntry): string;
 export declare function injectAssetTags(html: string, manifest: BuildManifest, entry: ClientEntry, buildInfo?: BuildInfo): string;
 export declare function computeBuildId(manifest: BuildManifest): string;
 /** Formatiert ein BuildResult als CLI-freundliche Mehrzeilen-Zusammenfassung

package/dist/build-prod-bundle.js

@@ -67,7 +67,7 @@ const hasBun = typeof globalThis.Bun !== "undefined";
 // index.html mit den richtigen Placeholder-Tags.
 // interactive-widget=resizes-content (fw#1918): keeps `position: fixed`
 // bottom bars anchored above a mobile keyboard instead of behind it.
-const DEFAULT_HTML = `<!doctype html>
+export const DEFAULT_HTML = `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
@@ -672,10 +672,9 @@ async function renderHtml(templatePath, manifest, entry, buildInfo) {
     const template = templatePath ? await readFile(templatePath, "utf8") : DEFAULT_HTML;
     return injectAssetTags(template, manifest, entry, buildInfo);
 }
-// @internal — exported for unit tests only. See #2305: the message must
-// name the source file and, for a declared multi-entry, which package.json
-// "kumiko.clientEntries" entry it came from.
-export function buildMissingTemplateError(manifest, entry) {
+// The message must name the source file and, for a declared multi-entry,
+// which package.json "kumiko.clientEntries" entry it came from.
+function buildMissingTemplateError(manifest, entry) {
     const cssLine = manifest["styles.css"]
         ? `    <link rel="stylesheet" href="/styles.css" />\n`
         : "";

package/dist/pii-boot-gate.js

@@ -17,7 +17,7 @@ export function assertPiiBootInvariants(features, opts) {
     // encryptEventPayloadPii no-ops without a KMS, so a catalogued event writes
     // plaintext PII into kumiko_events with nothing to crypto-shred later.
     const piiEvents = features.flatMap((feature) => Object.values(feature.events ?? {})
-        .filter((event) => event.piiFields !== undefined && event.piiFields !== "none")
+        .filter((event) => event.piiFields !== "none")
         .map((event) => event.name));
     // skip: nothing PII-annotated is mounted — plaintext gate is moot.
     if (piiEntities.length === 0 && piiEvents.length === 0)

package/dist/request-bound-system-query.d.ts

@@ -0,0 +1,12 @@
+import { type ClientIpResolver } from "@cosmicdrift/kumiko-framework/api";
+import { type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
+export type QueryDispatcher = {
+    readonly query: (type: string, payload: unknown, user: SessionUser) => Promise<unknown>;
+};
+export declare function buildRequestBoundSystemQuery(params: {
+    readonly req: Request;
+    readonly dispatcher: QueryDispatcher;
+    readonly resolver: ClientIpResolver;
+    readonly socketAddress?: string;
+}): PageHeadSystemQuery;

package/dist/request-bound-system-query.js

@@ -0,0 +1,15 @@
+import { buildRequestContextDataFromRequest, } from "@cosmicdrift/kumiko-framework/api";
+import { createAnonymousUser } from "@cosmicdrift/kumiko-framework/engine";
+import { requestContext } from "@cosmicdrift/kumiko-framework/internal/request-context";
+// Single wiring for the anonymous-role systemQuery that page-head and
+// hostDispatch resolvers receive, shared by runProdApp and the dev server so
+// the anonymous role / request-context / client-IP resolution can't drift.
+export function buildRequestBoundSystemQuery(params) {
+    const { req, dispatcher, resolver, socketAddress } = params;
+    return (type, payload, tenantId, options) => {
+        const base = requestContext.get() ?? buildRequestContextDataFromRequest(req, { resolver, socketAddress });
+        // The caller's signal replaces the request's: it already folds the request signal in.
+        const data = options?.signal ? { ...base, signal: options.signal } : base;
+        return requestContext.run(data, () => dispatcher.query(type, payload, createAnonymousUser(tenantId)));
+    };
+}

package/dist/run-prod-app-boot-context.d.ts

@@ -6,6 +6,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigResolver, FeatureDefinition, Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import type { Redis } from "ioredis";
 import { type BootCrypto } from "./boot/boot-crypto.js";
 import type { AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup } from "./run-prod-app.js";
 export declare function addConfigAccessorFactory<T extends {
@@ -21,6 +22,8 @@ export declare function buildBootExtraContext(opts: {
     readonly crypto?: BootCrypto;
     readonly masterKey?: MasterKeyProvider;
     readonly sseBroker?: SseBroker;
+    /** Backs notify's idempotencyKey dedup; without it such a notify throws. */
+    readonly redis?: Redis;
     readonly kms?: KmsAdapter;
     /** One-shot process (runBootstrap): nothing drains its job queue once it
      *  exits, so queued channels must send inline instead of enqueueing. */

package/dist/run-prod-app-boot-context.js

@@ -49,6 +49,7 @@ function buildDeliveryNotifyFactory(opts) {
         db: opts.db,
         registry: opts.registry,
         channels: collectChannels(opts.registry),
+        ...(opts.redis && { idempotencyRedis: opts.redis }),
         ...(opts.secrets && { secrets: opts.secrets }),
         ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
         ...(opts.escapeHatchAuditSink && { escapeHatchAuditSink: opts.escapeHatchAuditSink }),
@@ -83,6 +84,15 @@ function resolveBootSecrets(db, features, crypto, registry) {
         dekCache: crypto.dekCache,
     });
 }
+function bootCryptoContext(crypto) {
+    return {
+        ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
+        // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
+        // whenever a master key exists — NOT gated on the secrets feature,
+        // config encryption must work without mounting ctx.secrets.
+        ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
+    };
+}
 export function buildBootExtraContext(opts) {
     const crypto = opts.crypto ?? resolveBootCrypto(opts.envSource, opts.masterKey);
     const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
@@ -98,6 +108,7 @@ export function buildBootExtraContext(opts) {
                 registry: opts.registry,
                 ...(secrets && { secrets }),
                 ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+                ...(opts.redis && { redis: opts.redis }),
                 ...(escapeHatchAuditSink && { escapeHatchAuditSink }),
                 ...(opts.log && { log: opts.log }),
                 deliverQueuedInline: opts.deliverQueuedInline,
@@ -105,11 +116,7 @@ export function buildBootExtraContext(opts) {
         }),
         // Top-level provider so feature jobs (secrets rotate, config reencrypt)
         // reach it via ctx — previously only test-stack wired it.
-        ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
-        // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
-        // whenever a master key exists — NOT gated on the secrets feature,
-        // config encryption must work without mounting ctx.secrets.
-        ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
+        ...bootCryptoContext(crypto),
         ...(secrets && { secrets }),
         ...(opts.hasAuth && {
             configResolver: createConfigResolver({

package/dist/run-prod-app-static-files.d.ts

@@ -1,5 +1,5 @@
 import { type CachePolicy } from "@cosmicdrift/kumiko-framework/api";
-import { type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type QueryDispatcher } from "./request-bound-system-query.js";
 import type { HostDispatchFn, PageHeadResolver } from "./run-prod-app.js";
 export declare function readStaticFile(filePath: string): Promise<{
     readonly bytes: Uint8Array;
@@ -12,9 +12,6 @@ export declare function serveDiskFile(req: Request, pathname: string, file: {
     readonly mtimeMs: number;
 }): Response;
 export declare function mimeTypeFor(filePath: string): string;
-type QueryDispatcher = {
-    readonly query: (type: string, payload: unknown, user: SessionUser) => Promise<unknown>;
-};
 export type PageHeadOptions = {
     readonly resolvePageHead: PageHeadResolver;
     readonly dispatcher: QueryDispatcher;
@@ -29,4 +26,3 @@ hostDispatchDispatcher?: QueryDispatcher,
  *  1:1 with runProdApp's effective value. */
 trustedProxyHops?: number): (req: Request, socketAddress?: string) => Promise<Response>;
 export declare function staticCachePolicy(pathname: string): CachePolicy;
-export {};

package/dist/run-prod-app-static-files.js

@@ -1,9 +1,9 @@
 import { resolve, sep } from "node:path";
-import { buildRequestContextDataFromRequest, cachedResponse, computeStrongEtag, computeWeakEtag, createClientIpResolver, requestContext, } from "@cosmicdrift/kumiko-framework/api";
-import { createAnonymousUser } from "@cosmicdrift/kumiko-framework/engine";
+import { cachedResponse, computeStrongEtag, computeWeakEtag, createClientIpResolver, } from "@cosmicdrift/kumiko-framework/api";
 import { resolveAndInjectPageHead } from "@cosmicdrift/kumiko-headless/apex";
 import { ASSETS_DIR } from "./build-prod-bundle.js";
 import { BUNDLED_ASSETS_DIST_DIR } from "./bundled-assets.js";
+import { buildRequestBoundSystemQuery, } from "./request-bound-system-query.js";
 import { stripNoRouteMatchHeader, tryHonoFirst } from "./try-hono-first.js";
 // Static-asset + SPA-fallback serving for runProdApp's HTTP handler. Split
 // out of run-prod-app.ts (#1005, Welle 2) — mechanical relocation, these
@@ -162,13 +162,18 @@ trustedProxyHops = 0) {
             return html;
         const url = new URL(req.url);
         const host = req.headers.get("host") ?? url.host;
-        const systemQuery = (type, payload, tenantId) => requestContext.run(requestContext.get() ??
-            buildRequestContextDataFromRequest(req, { resolver: clientIpResolver, socketAddress }), () => pageHead.dispatcher.query(type, payload, createAnonymousUser(tenantId)));
+        const systemQuery = buildRequestBoundSystemQuery({
+            req,
+            dispatcher: pageHead.dispatcher,
+            resolver: clientIpResolver,
+            socketAddress,
+        });
         const text = new TextDecoder().decode(html.bytes);
         const injected = await resolveAndInjectPageHead(text, pageHead.resolvePageHead, {
             path: url.pathname,
             host,
             systemQuery,
+            requestSignal: req.signal,
         });
         if (injected === text)
             return html;
@@ -192,8 +197,12 @@ trustedProxyHops = 0) {
             if (!hostDispatchDispatcher) {
                 throw new Error("hostDispatch called deps.systemQuery but buildStaticFallback got no hostDispatchDispatcher");
             }
-            return requestContext.run(requestContext.get() ??
-                buildRequestContextDataFromRequest(req, { resolver: clientIpResolver, socketAddress }), () => hostDispatchDispatcher.query(type, payload, createAnonymousUser(tenantId)));
+            return buildRequestBoundSystemQuery({
+                req,
+                dispatcher: hostDispatchDispatcher,
+                resolver: clientIpResolver,
+                socketAddress,
+            })(type, payload, tenantId);
         };
         const result = await hostDispatch({ host, path: url.pathname, search: url.search }, { systemQuery });
         if (result.kind === "redirect") {

package/dist/run-prod-app.js

@@ -176,6 +176,28 @@ export async function runProdApp(options) {
     //    needed in 9.1's audit (37 references, 25 distinct vars).
     const rawEnvSource = options.envSource ?? process.env;
     const runMode = parseRunMode(rawEnvSource["KUMIKO_DRY_RUN_ENV"]);
+    const composedEnvSchema = options.envSchema;
+    const validateEnv = (source) => {
+        // skip: app declares no env schema, nothing to validate
+        if (!composedEnvSchema)
+            return;
+        try {
+            const schema = options.masterKey
+                ? withOptionalEnvKeys(composedEnvSchema.schema, SECRETS_MASTER_KEK_ENV_KEYS)
+                : composedEnvSchema.schema;
+            parseEnv(schema, source, {
+                sources: composedEnvSchema.sources,
+                ...(options.pulumiPrefix ? { pulumiPrefix: options.pulumiPrefix } : {}),
+            });
+        }
+        catch (err) {
+            if (err instanceof KumikoBootError) {
+                const reporter = options.bootErrorReporter ?? defaultBootErrorReporter;
+                reporter(err);
+            }
+            throw err;
+        }
+    };
     if (options.envSchema) {
         if (isRenderMode(runMode)) {
             // biome-ignore lint/suspicious/noConsole: dry-run output IS the deliverable
@@ -194,22 +216,7 @@ export async function runProdApp(options) {
         // boot-mode AND normal-boot both run env-validation. boot-mode wants
         // a real env-check (all required vars present + schema-valid) before
         // it asserts feature-wiring works.
-        try {
-            const envSchema = options.masterKey
-                ? withOptionalEnvKeys(options.envSchema.schema, SECRETS_MASTER_KEK_ENV_KEYS)
-                : options.envSchema.schema;
-            parseEnv(envSchema, rawEnvSource, {
-                sources: options.envSchema.sources,
-                ...(options.pulumiPrefix ? { pulumiPrefix: options.pulumiPrefix } : {}),
-            });
-        }
-        catch (err) {
-            if (err instanceof KumikoBootError) {
-                const reporter = options.bootErrorReporter ?? defaultBootErrorReporter;
-                reporter(err);
-            }
-            throw err;
-        }
+        validateEnv(rawEnvSource);
     }
     // Slots the schema marks `kms` are decrypted once here so every consumer
     // below (boot probe, master-key keyring, config) sees the same resolved env.
@@ -219,6 +226,12 @@ export async function runProdApp(options) {
             logPrefix: "[runProdApp]",
         })
         : rawEnvSource;
+    // The first parse relaxes ciphertext-only slots, so their decrypted
+    // plaintext never met the slot's own validators (.regex/.min/.refine).
+    if (options.envSchema &&
+        kmsSlotsOf(options.envSchema.schema).some((slot) => rawEnvSource[slot] === undefined && envSource[slot] !== undefined)) {
+        validateEnv(envSource);
+    }
     // 1. Polyfill before anything else — feature code references Temporal.
     const { ensureTemporalPolyfill } = await import("@cosmicdrift/kumiko-framework/time");
     await ensureTemporalPolyfill();
@@ -418,6 +431,7 @@ export async function runProdApp(options) {
         registry,
         hasAuth: !!effectiveAuth,
         sseBroker,
+        redis,
         crypto: bootCrypto,
         ...(options.kms && { kms: options.kms }),
         ...(bootLogger && { log: bootLogger }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.352.0",
+  "version": "0.354.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -74,17 +74,21 @@
       "types": "./dist/try-hono-first.d.ts",
       "default": "./dist/try-hono-first.js"
     },
+    "./request-bound-system-query": {
+      "types": "./dist/request-bound-system-query.d.ts",
+      "default": "./dist/request-bound-system-query.js"
+    },
     "./build-prod-bundle": {
       "types": "./dist/build-prod-bundle.d.ts",
       "default": "./dist/build-prod-bundle.js"
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.352.0",
-    "@cosmicdrift/kumiko-framework": "0.352.0",
-    "@cosmicdrift/kumiko-headless": "0.352.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.352.0",
-    "@cosmicdrift/kumiko-types": "0.352.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.354.0",
+    "@cosmicdrift/kumiko-framework": "0.354.0",
+    "@cosmicdrift/kumiko-headless": "0.354.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.354.0",
+    "@cosmicdrift/kumiko-types": "0.354.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2"
@@ -149,6 +153,10 @@
         "types": "./dist/try-hono-first.d.ts",
         "default": "./dist/try-hono-first.js"
       },
+      "./request-bound-system-query": {
+        "types": "./dist/request-bound-system-query.d.ts",
+        "default": "./dist/request-bound-system-query.js"
+      },
       "./build-prod-bundle": {
         "types": "./dist/build-prod-bundle.d.ts",
         "default": "./dist/build-prod-bundle.js"

package/src/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "Boot context passes Redis to the delivery service",
+    "detail": "notify with an idempotencyKey used to throw because the delivery service had no idempotencyRedis. Production boot, dev boot and the worker boot now hand over the existing Redis.",
+    "migration": "No action needed."
+  },
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Boot rejects decrypted kms env slots that violate their schema validators",
+    "detail": "runProdApp validates Key-Manager-decrypted env slots against their schema\nA `kms` slot delivered only as `_CIPHERTEXT` skipped its own `.regex`/`.min`/`.refine` because the first parse relaxes it. After decryption the env is now parsed again, so a malformed plaintext aborts the boot with a `KumikoBootError` naming the slot."
+  },
+  {
+    "version": "0.353.0",
+    "type": "improvement",
+    "title": "Prod static files and the dev server share one request-bound systemQuery wiring",
+    "detail": "Shared request-bound systemQuery wiring and clearer deploy scaffold warnings\n`@cosmicdrift/kumiko-server-runtime/request-bound-system-query` exports the systemQuery wiring that the prod static-file path and the dev server previously each copied. `scaffoldDeploy` now tells a broken `package.json` (deploy settings fall back to defaults) apart from an unexpected `dependencies`/`workspaces` shape in its warning."
+  },
   {
     "version": "0.347.0",
     "type": "fix",