@cosmicdrift/kumiko-server-runtime 0.371.1 → 0.373.0

package/dist/boot/worker-boot-core.js

@@ -181,7 +181,6 @@ export async function bootWorkerProcess(options, envSource, profile) {
         },
         eventDedup,
         ...(options.observability && { observability: options.observability }),
-        ...(options.observabilityOptions && { observabilityOptions: options.observabilityOptions }),
         redisUrl,
         ...jobLogger,
         ...(options.jobs?.queueNamePrefix !== undefined && {

package/dist/extra-routes-deps.d.ts

@@ -1,3 +1,4 @@
+import type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
@@ -30,4 +31,7 @@ export type SystemWireDeps = {
         readonly payload: unknown;
         readonly tenantId: import("@cosmicdrift/kumiko-framework/engine").TenantId;
     }) => Promise<WriteResult>;
+    /** Read counterpart of dispatchSystemWrite, same SystemAdmin scope. Hand
+     *  anonymous routes only a narrow function built from it, never this. */
+    readonly dispatchSystemQuery: (args: SystemDispatchArgs) => Promise<unknown>;
 };

package/dist/run-prod-app-boot-context.d.ts

@@ -5,7 +5,7 @@ import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type ConfigResolver, type FeatureDefinition, type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
+import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import { type BootCrypto } from "./boot/boot-crypto.ts";
@@ -14,7 +14,7 @@ export declare function addConfigAccessorFactory<T extends {
     readonly configResolver?: ConfigResolver;
 }>(resolved: T, registry: Registry): T;
 export declare function loggerFromExtraContext(extraContext: Record<string, unknown>): Logger | undefined;
-export declare function buildBootExtraContext(opts: {
+type BootExtraContextOptions = {
     readonly db: DbConnection;
     readonly features: readonly FeatureDefinition[];
     readonly envSource: Record<string, string | undefined>;
@@ -33,7 +33,8 @@ export declare function buildBootExtraContext(opts: {
     readonly log?: Logger;
     /** Signs `unsubscribe: true` notifications' mail links; see runProdApp `unsubscribe`. */
     readonly unsubscribeLinks?: UnsubscribeLinkConfig;
-}): Record<string, unknown>;
+};
+export declare function buildBootExtraContext(opts: BootExtraContextOptions): Record<string, unknown>;
 /** Die Auth-Felder die resolveAuthMail liest/normalisiert — beide
  *  App-Auth-Typen (prod + dev) erfüllen das strukturell. */
 type AuthMailNormalizable = {

package/dist/run-prod-app-boot-context.js

@@ -12,6 +12,7 @@ import { createTemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/
 import { TENANT_FEATURE, TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { resolveBootCrypto } from "./boot/boot-crypto.js";
 // Boot-time context helpers for runProdApp: ctx-extra-context wiring
 // (templateResolver/delivery/secrets/config-resolver), auth-mail convenience
@@ -49,6 +50,11 @@ export function addConfigAccessorFactory(resolved, registry) {
 // inline, with `secrets` for chat-channel credentials. `to: { tenant }` resolves
 // through tenantUserIdsQuery, which the caller sets when the tenant feature is mounted.
 function buildDeliveryNotifyFactory(opts) {
+    if (!opts.addressCipher && opts.deliverQueuedInline !== true) {
+        createFallbackLogger("delivery", opts.log).warn("No master key configured: queued delivery jobs carry recipient addresses in plaintext " +
+            "(Redis, job runs). Set KUMIKO_SECRETS_MASTER_KEY_V1 (and KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION) " +
+            "on the web and worker processes to seal them.");
+    }
     const configAccessorFactory = opts.configResolver && createConfigAccessorFactory(opts.registry, opts.configResolver);
     const deliveryService = createDeliveryService({
         db: opts.db,
@@ -56,6 +62,7 @@ function buildDeliveryNotifyFactory(opts) {
         channels: collectChannels(opts.registry),
         ...(opts.redis && { idempotencyRedis: opts.redis }),
         ...(opts.secrets && { secrets: opts.secrets }),
+        ...(opts.addressCipher && { addressCipher: opts.addressCipher }),
         ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
         ...(opts.escapeHatchAuditSink && { escapeHatchAuditSink: opts.escapeHatchAuditSink }),
         ...(opts.log && { log: opts.log }),
@@ -124,10 +131,31 @@ function resolveDeliveryConfigResolver(opts, hasDeliveryFeature, crypto) {
         ? createBootConfigResolver(opts.registry, opts.envSource, crypto)
         : undefined;
 }
+function bootDeliveryContext(opts, parts) {
+    if (!opts.features.some((f) => f.name === DELIVERY_FEATURE))
+        return {};
+    const hasTenantFeature = opts.features.some((f) => f.name === TENANT_FEATURE);
+    const { crypto, secrets, escapeHatchAuditSink } = parts;
+    return {
+        _notifyFactory: buildDeliveryNotifyFactory({
+            db: opts.db,
+            registry: opts.registry,
+            ...(secrets && { secrets }),
+            ...(crypto.configCipher && { addressCipher: crypto.configCipher }),
+            ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+            ...(opts.redis && { redis: opts.redis }),
+            ...(escapeHatchAuditSink && { escapeHatchAuditSink }),
+            ...(opts.log && { log: opts.log }),
+            ...(hasTenantFeature && { tenantUserIdsQuery: TenantQueries.resolveUserIds }),
+            configResolver: parts.configResolver,
+            deliverQueuedInline: opts.deliverQueuedInline,
+            unsubscribeLinks: opts.unsubscribeLinks,
+        }),
+    };
+}
 export function buildBootExtraContext(opts) {
     const crypto = opts.crypto ?? resolveBootCrypto(opts.envSource, opts.masterKey);
     const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
-    const hasTenantFeature = opts.features.some((f) => f.name === TENANT_FEATURE);
     const escapeHatchAuditSink = resolveEscapeHatchAuditSink(opts.features, opts.db);
     const secrets = resolveBootSecrets(opts.db, opts.features, crypto, opts.registry);
     const bootConfigResolver = resolveDeliveryConfigResolver(opts, hasDeliveryFeature, crypto);
@@ -136,20 +164,11 @@ export function buildBootExtraContext(opts) {
         templateResolver: createTemplateResolverApi(opts.db),
         ...(opts.kms && { kms: opts.kms }),
         ...(escapeHatchAuditSink && { _escapeHatchAuditSink: escapeHatchAuditSink }),
-        ...(hasDeliveryFeature && {
-            _notifyFactory: buildDeliveryNotifyFactory({
-                db: opts.db,
-                registry: opts.registry,
-                ...(secrets && { secrets }),
-                ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
-                ...(opts.redis && { redis: opts.redis }),
-                ...(escapeHatchAuditSink && { escapeHatchAuditSink }),
-                ...(opts.log && { log: opts.log }),
-                ...(hasTenantFeature && { tenantUserIdsQuery: TenantQueries.resolveUserIds }),
-                configResolver: bootConfigResolver,
-                deliverQueuedInline: opts.deliverQueuedInline,
-                unsubscribeLinks: opts.unsubscribeLinks,
-            }),
+        ...bootDeliveryContext(opts, {
+            crypto,
+            secrets,
+            escapeHatchAuditSink,
+            configResolver: bootConfigResolver,
         }),
         // Top-level provider so feature jobs (secrets rotate, config reencrypt)
         // reach it via ctx — previously only test-stack wired it.

package/dist/run-prod-app-static-files.js

@@ -1,5 +1,6 @@
 import { join, resolve, sep } from "node:path";
 import { cachedResponse, computeStrongEtag, computeWeakEtag, createClientIpResolver, } from "@cosmicdrift/kumiko-framework/api";
+import { rankPreferredLocales } from "@cosmicdrift/kumiko-framework/i18n";
 import { resolveAndInjectPageHead } from "@cosmicdrift/kumiko-headless/apex";
 import { errorCodeOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { ASSETS_DIR } from "./build-prod-bundle.js";
@@ -194,6 +195,10 @@ trustedProxyHops = 0) {
         const injected = await resolveAndInjectPageHead(text, pageHead.resolvePageHead, {
             path: url.pathname,
             host,
+            preferredLocales: rankPreferredLocales({
+                queryLang: url.searchParams.get("lang"),
+                acceptLanguage: req.headers.get("accept-language"),
+            }),
             systemQuery,
             requestSignal: req.signal,
         });
@@ -249,7 +254,7 @@ trustedProxyHops = 0) {
         }
         // Per-host body (hostDispatch picks the file by host) → Vary: Host,
         // otherwise a shared cache could serve Host A's HTML to Host B.
-        const extraHeaders = { vary: "Host" };
+        const extraHeaders = { vary: pageHead ? PAGE_HEAD_VARY : "Host" };
         if (csp)
             extraHeaders["content-security-policy"] = csp;
         const withHead = await applyPageHead(req, html, socketAddress);
@@ -304,13 +309,16 @@ trustedProxyHops = 0) {
         const index = await readHtmlFile(indexHtml);
         if (index) {
             const withHead = await applyPageHead(req, index, socketAddress);
-            return serveHtmlFile(req, "/index.html", withHead);
+            return serveHtmlFile(req, "/index.html", withHead, pageHead && { vary: PAGE_HEAD_VARY });
         }
         // Kein Hono-Match, keine Disk-Datei, kein index.html → liefer den
         // ursprünglichen 404 von Hono durch (statt einen neuen Roundtrip).
         return honoRes;
     };
 }
+// The resolved page head depends on host and preferred locale; ?lang= is part of the URL and
+// already keys the cache.
+const PAGE_HEAD_VARY = "Host, Accept-Language";
 // Map URL-Pfad → Cache-Policy. Hashed-Asset-Pfade (/assets/*) sind
 // unveränderlich, der Rest bleibt revalidate/no-cache damit Updates ohne
 // Hard-Reload greifen. Exported für Unit-Tests; Konsumenten gehen via

package/dist/run-prod-app.d.ts

@@ -509,8 +509,7 @@ export type RunProdAppOptions = {
      *  kein `/metrics`-Endpoint). Setze `createPrometheusMeter()`-basierten
      *  Provider + `metrics` um `/metrics` real zu exposen (publicstatus#91). */
     readonly observability?: ObservabilityProvider;
-    /** Konfiguriert die Auto-Instrumentation des resolvierten Observability-
-     *  Providers (siehe `BaseEntrypointOptions.observabilityOptions`). */
+    /** @deprecated No effect: the HTTP route label carries no query string anymore. */
     readonly observabilityOptions?: ObservabilityOptions;
     /** Aktiviert den `/metrics`-Endpoint (Open-Metrics-Format). Ohne einen
      *  PrometheusMeter-basierten `observability`-Provider antwortet `/metrics`

package/dist/run-prod-app.js

@@ -60,7 +60,7 @@ import { assertSeedModeNotInProduction } from "@cosmicdrift/kumiko-framework/eve
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { assertKumikoSchemaCurrent, SchemaDriftError, } from "@cosmicdrift/kumiko-framework/migrations";
 import { createMetricsForFactory, } from "@cosmicdrift/kumiko-framework/observability";
-import { createDispatcher, createEntityCache, createEventDedup, createIdempotencyGuard, flushEscapeHatchAudits, } from "@cosmicdrift/kumiko-framework/pipeline";
+import { createDispatcher, createEntityCache, createEventDedup, createIdempotencyGuard, createUnlimitedRateLimitResolver, flushEscapeHatchAudits, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { createRedisCacheSyncBus, redisClientOptionsFromEnv, } from "@cosmicdrift/kumiko-framework/redis";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { Redis } from "ioredis";
@@ -76,7 +76,7 @@ import { resolveBootOptionWiring } from "./boot-options/resolve-boot-options.js"
 import { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.js";
 import { buildBunServeOptions, resolveDerivedMaxRequestBodySize } from "./bun-serve-options.js";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features.js";
-import { makeDispatchSystemWrite } from "./extra-routes-deps.js";
+import { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "./extra-routes-deps.js";
 import { assertPiiBootInvariants } from "./pii-boot-gate.js";
 import { resolveRateLimit } from "./rate-limit-defaults.js";
 import { resolveAuthPublicOrigin } from "./resolve-auth-public-origin.js";
@@ -614,7 +614,6 @@ export async function runProdApp(options) {
         },
         eventDedup,
         ...(options.observability && { observability: options.observability }),
-        ...(options.observabilityOptions && { observabilityOptions: options.observabilityOptions }),
         ...(options.metrics && { metrics: options.metrics }),
         ...(resolvedRateLimit && { rateLimit: resolvedRateLimit }),
         ...(trustedProxyHops !== undefined && { trustedProxyHops }),
@@ -779,6 +778,7 @@ export async function runProdApp(options) {
             registry,
             metricsFor: createMetricsForFactory(entrypoint.observability.meter),
             dispatchSystemWrite: makeDispatchSystemWrite(entrypoint.dispatcher),
+            dispatchSystemQuery: makeDispatchSystemQuery(entrypoint.dispatcher),
         });
     }
     // 9. Seeds: admin first, then config-seeds from r.config({seeds}),
@@ -799,8 +799,17 @@ export async function runProdApp(options) {
     });
     const customSeeds = bootOptionWiring.customSeeds;
     const hasSeeds = customSeeds.length > 0 || options.seedsDir !== undefined;
+    // Seeds are bootstrap writes, not tenant traffic: they always get the unlimited resolver,
+    // even when the app has a real one, so a handler's rateLimit can neither fail nor drain them.
     const seedContext = hasSeeds
-        ? withFileProviderResolver(registry, { db, redis, entityCache, registry, ...extraContext }, cacheSync)
+        ? withFileProviderResolver(registry, {
+            db,
+            redis,
+            entityCache,
+            registry,
+            ...extraContext,
+            rateLimit: createUnlimitedRateLimitResolver(),
+        }, cacheSync)
         : undefined;
     const seedDispatcher = seedContext
         ? withSeedErrorContext(createDispatcher(registry, seedContext, {

package/dist/run-worker-app.d.ts

@@ -89,6 +89,7 @@ export type RunWorkerAppOptions = {
      *  cannot derive them; without this it reads the env as is. */
     readonly kmsSlots?: readonly string[];
     readonly observability?: ObservabilityProvider;
+    /** @deprecated No effect: the HTTP route label carries no query string anymore. */
     readonly observabilityOptions?: ObservabilityOptions;
     /** Serves `/metrics` on its own port (the worker has no HTTP app). Needs a
      *  PrometheusMeter-based `observability`; both are validated at boot,

package/dist/run-worker-app.js

@@ -20,7 +20,7 @@ import { startPiiEventBackfillOnBoot } from "./boot/pii-event-backfill-on-boot.j
 import { recordAppStartedOnBoot } from "./boot/record-app-started-on-boot.js";
 import { bootWorkerProcess, resolveWorkerEnvSource } from "./boot/worker-boot-core.js";
 import { startWorkerMetricsServer, } from "./boot/worker-metrics-server.js";
-import { makeDispatchSystemWrite } from "./extra-routes-deps.js";
+import { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "./extra-routes-deps.js";
 function makeBootModeHandle() {
     return {
         // @cast-boundary boot-mode: no entrypoint exists because no boot ran —
@@ -73,6 +73,7 @@ export async function runWorkerApp(options) {
             registry,
             metricsFor: createMetricsForFactory(entrypoint.observability.meter),
             dispatchSystemWrite: makeDispatchSystemWrite(entrypoint.dispatcher),
+            dispatchSystemQuery: makeDispatchSystemQuery(entrypoint.dispatcher),
             lifecycle: entrypoint.lifecycle,
             ...(boot.secrets && { secrets: boot.secrets }),
         });

package/dist/seed-dispatcher.js

@@ -1,15 +1,13 @@
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { reraiseAsKumikoError } from "@cosmicdrift/kumiko-framework/errors";
-import { createFileContext, createFileRefFromBytes, } from "@cosmicdrift/kumiko-framework/files";
+import { createFileRefFromBytes, createTenantFileContext, } from "@cosmicdrift/kumiko-framework/files";
 export function makeSeedCreateFileRef(deps) {
     const { db, registry, context } = deps;
     const fileResolver = context._fileProviderResolver;
     return (tenantId, input) => createFileRefFromBytes({
         db: createTenantDb({ db, tenantId }),
-        files: fileResolver
-            ? createFileContext(() => fileResolver(tenantId), tenantId)
-            : context.files,
+        files: fileResolver ? createTenantFileContext(fileResolver, tenantId) : context.files,
         registry,
         user: createSystemUser(tenantId),
     }, input);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.371.1",
+  "version": "0.373.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -88,19 +88,19 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.371.1",
-    "@cosmicdrift/kumiko-framework": "0.371.1",
-    "@cosmicdrift/kumiko-headless": "0.371.1",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.371.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.371.1",
-    "@cosmicdrift/kumiko-types": "0.371.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.373.0",
+    "@cosmicdrift/kumiko-framework": "0.373.0",
+    "@cosmicdrift/kumiko-headless": "0.373.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.373.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.373.0",
+    "@cosmicdrift/kumiko-types": "0.373.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.371.1"
+    "@cosmicdrift/kumiko-testing": "0.373.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "fix",
+    "title": "Seeds no longer fail on write handlers that declare a rateLimit",
+    "detail": "The seed dispatcher gets an unlimited RateLimitResolver instead of none; requests keep the app's resolver and limits."
+  },
   {
     "version": "0.371.0",
     "type": "improvement",