@cosmicdrift/kumiko-server-runtime 0.377.0 → 0.378.0

package/dist/disk-file-route.d.ts

@@ -0,0 +1,10 @@
+import type { AnonymousExtraRoute } from "@cosmicdrift/kumiko-framework/api";
+export type DiskFileRouteOptions = {
+    /** Route path containing the `:file` parameter, e.g. `/fonts/:file`. */
+    readonly path: string;
+    /** Maps a plain file name to an absolute disk path, or null to answer 404. Only one
+     *  segment without a leading dot or separator gets here; anything else is 404 already.
+     *  Must return fixed, allowlisted paths, never `join(dir, name)`: symlinks are not checked. */
+    readonly resolveFile: (requestedFile: string) => string | null;
+};
+export declare function diskFileRoute(options: DiskFileRouteOptions): AnonymousExtraRoute;

package/dist/disk-file-route.js

@@ -0,0 +1,28 @@
+import { readStaticFile, serveDiskFile } from "./run-prod-app-static-files.js";
+// Hono percent-decodes the param, so `..%2F` arrives as `../`; a leading dot also
+// covers `.`, `..` and dotfiles such as `.env` next to the served files.
+function isPlainFileName(name) {
+    return name.length > 0 && !name.startsWith(".") && !/[/\\\0]/.test(name);
+}
+export function diskFileRoute(options) {
+    if (!options.path.includes(":file")) {
+        throw new Error(`diskFileRoute: path "${options.path}" must contain the ":file" parameter`);
+    }
+    return {
+        method: "GET",
+        path: options.path,
+        entry: "anonymous",
+        handler: async (c) => {
+            const requestedFile = c.req.param("file") ?? "";
+            if (!isPlainFileName(requestedFile))
+                return c.notFound();
+            const filePath = options.resolveFile(requestedFile);
+            if (filePath === null)
+                return c.notFound();
+            const file = await readStaticFile(filePath);
+            if (!file)
+                return c.notFound();
+            return serveDiskFile(c.req.raw, c.req.path, file);
+        },
+    };
+}

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export type { ProdSeedsConfig, ProdSeedTenant } from "./boot-options/seed-shortc
 export { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.ts";
 export { type BundledAssetDeclaration, type BundledAssetOptions, readBundledAsset, resolveBundledAsset, } from "./bundled-assets.ts";
 export { type ComposeFeaturesOptions, composeFeatures } from "./compose-features.ts";
+export { type DiskFileRouteOptions, diskFileRoute } from "./disk-file-route.ts";
 export type { RateLimitOption } from "./rate-limit-defaults.ts";
 export type { RunBootstrapOptions } from "./run-bootstrap.ts";
 export { runBootstrap } from "./run-bootstrap.ts";

package/dist/index.js

@@ -9,6 +9,7 @@ export { isSeedFnList, rejectRemovedEffectiveFeatures, resolveBootOptionWiring,
 export { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.js";
 export { readBundledAsset, resolveBundledAsset, } from "./bundled-assets.js";
 export { composeFeatures } from "./compose-features.js";
+export { diskFileRoute } from "./disk-file-route.js";
 export { runBootstrap } from "./run-bootstrap.js";
 export { parseRunMode, requireEnv, runProdApp } from "./run-prod-app.js";
 export { runWorkerApp } from "./run-worker-app.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.377.0",
+  "version": "0.378.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -88,18 +88,18 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.377.0",
-    "@cosmicdrift/kumiko-framework": "0.377.0",
-    "@cosmicdrift/kumiko-renderer": "0.377.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.377.0",
-    "@cosmicdrift/kumiko-types": "0.377.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.378.0",
+    "@cosmicdrift/kumiko-framework": "0.378.0",
+    "@cosmicdrift/kumiko-renderer": "0.378.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.378.0",
+    "@cosmicdrift/kumiko-types": "0.378.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.377.0"
+    "@cosmicdrift/kumiko-testing": "0.378.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "diskFileRoute for allowlisted disk files",
+    "detail": "diskFileRoute({ path, resolveFile }) returns an anonymous GET extra route with a :file parameter. resolveFile maps the raw name to a disk path or null for 404; the file is served with mime type, ETag and 304 handling."
+  },
   {
     "version": "0.376.0",
     "type": "breaking",