@cosmicdrift/kumiko-server-runtime 0.377.0 → 0.379.0

package/dist/disk-file-route.d.ts

@@ -0,0 +1,10 @@
+import type { AnonymousExtraRoute } from "@cosmicdrift/kumiko-framework/api";
+export type DiskFileRouteOptions = {
+    /** Route path containing the `:file` parameter, e.g. `/fonts/:file`. */
+    readonly path: string;
+    /** Maps a plain file name to an absolute disk path, or null to answer 404. Only one
+     *  segment without a leading dot or separator gets here; anything else is 404 already.
+     *  Must return fixed, allowlisted paths, never `join(dir, name)`: symlinks are not checked. */
+    readonly resolveFile: (requestedFile: string) => string | null;
+};
+export declare function diskFileRoute(options: DiskFileRouteOptions): AnonymousExtraRoute;

package/dist/disk-file-route.js

@@ -0,0 +1,28 @@
+import { readStaticFile, serveDiskFile } from "./run-prod-app-static-files.js";
+// Hono percent-decodes the param, so `..%2F` arrives as `../`; a leading dot also
+// covers `.`, `..` and dotfiles such as `.env` next to the served files.
+function isPlainFileName(name) {
+    return name.length > 0 && !name.startsWith(".") && !/[/\\\0]/.test(name);
+}
+export function diskFileRoute(options) {
+    if (!options.path.includes(":file")) {
+        throw new Error(`diskFileRoute: path "${options.path}" must contain the ":file" parameter`);
+    }
+    return {
+        method: "GET",
+        path: options.path,
+        entry: "anonymous",
+        handler: async (c) => {
+            const requestedFile = c.req.param("file") ?? "";
+            if (!isPlainFileName(requestedFile))
+                return c.notFound();
+            const filePath = options.resolveFile(requestedFile);
+            if (filePath === null)
+                return c.notFound();
+            const file = await readStaticFile(filePath);
+            if (!file)
+                return c.notFound();
+            return serveDiskFile(c.req.raw, c.req.path, file);
+        },
+    };
+}

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 export { type BillingBootOption, resolveBillingOption } from "./boot-options/billing-option.ts";
 export type { DemoAccountEntry, DemoAccountRole, DemoModeNotice, DemoModeOption, } from "./boot-options/demo-mode.ts";
 export { buildDemoModeRoute, withDemoReadOnlyFetch, } from "./boot-options/demo-mode.ts";
+export { type FeatureTogglesBinding, type FeatureTogglesWiring, resolveFeatureTogglesOption, } from "./boot-options/feature-toggles-option.ts";
 export type { FileStorageBootOption, FileStorageProviderName, } from "./boot-options/file-storage-option.ts";
 export type { KmsMode } from "./boot-options/kms-mode.ts";
-export type { MailBootOption, MailRecipientScope } from "./boot-options/mail-option.ts";
+export { type MailBootOption, type MailRecipientScope, resolveStoredUserEmail, } from "./boot-options/mail-option.ts";
 export { withBootOptionEnvBlocks } from "./boot-options/option-env-schema.ts";
 export type { SignalsOption } from "./boot-options/process-signals.ts";
 export { type BootOptionFields, type BootOptionWiring, isSeedFnList, rejectRemovedEffectiveFeatures, resolveBootOptionWiring, } from "./boot-options/resolve-boot-options.ts";
@@ -11,6 +12,7 @@ export type { ProdSeedsConfig, ProdSeedTenant } from "./boot-options/seed-shortc
 export { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.ts";
 export { type BundledAssetDeclaration, type BundledAssetOptions, readBundledAsset, resolveBundledAsset, } from "./bundled-assets.ts";
 export { type ComposeFeaturesOptions, composeFeatures } from "./compose-features.ts";
+export { type DiskFileRouteOptions, diskFileRoute } from "./disk-file-route.ts";
 export type { RateLimitOption } from "./rate-limit-defaults.ts";
 export type { RunBootstrapOptions } from "./run-bootstrap.ts";
 export { runBootstrap } from "./run-bootstrap.ts";

package/dist/index.js

@@ -4,11 +4,14 @@
 // Dev-Tooling mehr in ihre node_modules.
 export { resolveBillingOption } from "./boot-options/billing-option.js";
 export { buildDemoModeRoute, withDemoReadOnlyFetch, } from "./boot-options/demo-mode.js";
+export { resolveFeatureTogglesOption, } from "./boot-options/feature-toggles-option.js";
+export { resolveStoredUserEmail, } from "./boot-options/mail-option.js";
 export { withBootOptionEnvBlocks } from "./boot-options/option-env-schema.js";
 export { isSeedFnList, rejectRemovedEffectiveFeatures, resolveBootOptionWiring, } from "./boot-options/resolve-boot-options.js";
 export { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.js";
 export { readBundledAsset, resolveBundledAsset, } from "./bundled-assets.js";
 export { composeFeatures } from "./compose-features.js";
+export { diskFileRoute } from "./disk-file-route.js";
 export { runBootstrap } from "./run-bootstrap.js";
 export { parseRunMode, requireEnv, runProdApp } from "./run-prod-app.js";
 export { runWorkerApp } from "./run-worker-app.js";

package/dist/rate-limit-defaults.d.ts

@@ -1,14 +1,11 @@
-import type { ServerOptions } from "@cosmicdrift/kumiko-framework/api";
+import { DEFAULT_GLOBAL_RATE_LIMIT, type ServerOptions } from "@cosmicdrift/kumiko-framework/api";
 type ServerRateLimit = NonNullable<ServerOptions["rateLimit"]>;
 /** `false` per layer or for the whole option switches it off. */
 export type RateLimitOption = false | {
     readonly global?: false | ServerRateLimit["global"];
     readonly auth?: false | ServerRateLimit["auth"];
 };
-export declare const DEFAULT_GLOBAL_RATE_LIMIT: {
-    readonly limit: 600;
-    readonly windowSeconds: 60;
-};
+export { DEFAULT_GLOBAL_RATE_LIMIT };
 export declare const DEFAULT_AUTH_RATE_LIMIT: {
     readonly limit: 30;
     readonly windowSeconds: 60;
@@ -16,4 +13,3 @@ export declare const DEFAULT_AUTH_RATE_LIMIT: {
 /** Layers the app did not mention keep their default; a layer it did mention
  *  overrides only the fields it names. */
 export declare function resolveRateLimit(option: RateLimitOption | undefined): ServerRateLimit | undefined;
-export {};

package/dist/rate-limit-defaults.js

@@ -1,4 +1,5 @@
-export const DEFAULT_GLOBAL_RATE_LIMIT = { limit: 600, windowSeconds: 60 };
+import { DEFAULT_GLOBAL_RATE_LIMIT } from "@cosmicdrift/kumiko-framework/api";
+export { DEFAULT_GLOBAL_RATE_LIMIT };
 export const DEFAULT_AUTH_RATE_LIMIT = { limit: 30, windowSeconds: 60 };
 /** Layers the app did not mention keep their default; a layer it did mention
  *  overrides only the fields it names. */

package/dist/run-prod-app-boot-context.js

@@ -168,7 +168,7 @@ export function buildBootExtraContext(opts) {
     const bootConfigResolver = resolveDeliveryConfigResolver(opts, hasDeliveryFeature, crypto);
     const configResolver = opts.hasAuth ? bootConfigResolver : undefined;
     return {
-        templateResolver: createTemplateResolverApi(opts.db),
+        templateResolver: createTemplateResolverApi(opts.db, opts.registry),
         ...(opts.kms && { kms: opts.kms }),
         ...(escapeHatchAuditSink && { _escapeHatchAuditSink: escapeHatchAuditSink }),
         ...bootDeliveryContext(opts, {

package/dist/run-prod-app.d.ts

@@ -8,7 +8,7 @@ import { type AllInOneEntrypoint, type ApiEntrypoint } from "@cosmicdrift/kumiko
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
-import { type ObservabilityOptions, type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
+import { type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { PageHeadMeta, PageHeadResolver, PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import { Redis } from "ioredis";
@@ -232,7 +232,7 @@ export type HostDispatchResult = {
     readonly kind: "html";
     readonly file: string;
     /** @deprecated Ignored — HTML never carries the schema; createKumikoApp
-     *  fetches it from the authenticated GET /api/schema. */
+     *  fetches it from the authenticated GET /api/schema. Removed in 0.390.0. */
     readonly injectSchema?: boolean;
     readonly csp?: string;
 } | {
@@ -326,27 +326,21 @@ export type RunProdAppOptions = {
      *  anonymous role (not system) — the resolver is reachable by any
      *  public visitor, same access gate as a real anonymous request. */
     readonly resolvePageHead?: PageHeadResolver;
-    /** Pfad zu kumiko/migrations für den Boot-Gate. Default "./kumiko/
-     *  migrations" relativ zum process-cwd (wo die App gestartet wird —
-     *  bei Container-Deploys typischerweise der App-Workspace-Root, weil
-     *  WORKDIR im Dockerfile dorthin zeigt). Boot wirft SchemaDriftError
-     *  wenn Migrations pending sind oder erwartete Tabellen fehlen.
-     *  Setze auf `false` um den Gate komplett zu deaktivieren — nur für
-     *  Setups die ihren eigenen Schema-Check fahren (z.B. bring-your-own-
-     *  ORM). Standard-Apps lassen das default. */
+    /** Path to kumiko/migrations for the boot gate. Default "./kumiko/migrations"
+     *  relative to the process cwd. Boot throws SchemaDriftError on pending
+     *  migrations or missing tables. `false` disables the gate for setups that
+     *  run their own schema check. */
     readonly migrations?: {
         readonly dir: string;
     } | false;
-    /** Extra AppContext keys. Framework-Defaults werden zur Boot-Zeit
-     *  unter den Factory-Werten ergänzt, App-Werte gewinnen immer:
-     *    - `templateResolver` (createTemplateResolverApi(db)) — immer
-     *    - `secrets` (createSecretsContext) — nur wenn das `secrets`-Feature
-     *      gemountet ist (sonst kein KEK-env-Zwang für Apps ohne secrets)
-     *    - `configResolver` — im Auth-Mode (env-config-overrides)
-     *  Akzeptiert einen statischen Object ODER eine Factory
-     *  `({db, redis, registry}) => Record<string, unknown>` — gleiches
-     *  Pattern wie `anonymousAccess`. Eine App die einen dieser Keys selbst
-     *  setzt (z.B. eigener configResolver) überschreibt den Default. */
+    /** Extra AppContext keys. Framework defaults are added at boot beneath the
+     *  factory values; app values always win:
+     *    - `templateResolver` (createTemplateResolverApi(db, registry)), always
+     *    - `secrets` (createSecretsContext), only when the `secrets` feature is
+     *      mounted (no KEK env requirement otherwise)
+     *    - `configResolver`, in auth mode (env-config-overrides)
+     *  Accepts a static object or a factory
+     *  `({db, redis, registry}) => Record<string, unknown>`, like `anonymousAccess`. */
     /** Boot default locale (BCP-47) for ctx.locale when the request carries
      *  no locale signal. Merged into AppContext before extraContext (app wins). */
     readonly defaultLocale?: string;
@@ -519,8 +513,6 @@ export type RunProdAppOptions = {
      *  kein `/metrics`-Endpoint). Setze `createPrometheusMeter()`-basierten
      *  Provider + `metrics` um `/metrics` real zu exposen (publicstatus#91). */
     readonly observability?: ObservabilityProvider;
-    /** @deprecated No effect: the HTTP route label carries no query string anymore. */
-    readonly observabilityOptions?: ObservabilityOptions;
     /** Aktiviert den `/metrics`-Endpoint (Open-Metrics-Format). Ohne einen
      *  PrometheusMeter-basierten `observability`-Provider antwortet `/metrics`
      *  mit 503 + Misconfiguration-Hinweis statt echter Metriken. */

package/dist/run-worker-app.d.ts

@@ -5,7 +5,7 @@ import type { FeatureDefinition, Registry, ValidateBootOptions } from "@cosmicdr
 import type { WorkerEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
 import type { JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
-import { type ObservabilityOptions, type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
+import { type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
 import type { MasterKeyProvider, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import { type WorkerMetricsOptions, type WorkerMetricsServer } from "./boot/worker-metrics-server.ts";
@@ -108,8 +108,6 @@ export type RunWorkerAppOptions = {
      *  cannot derive them; without this it reads the env as is. */
     readonly kmsSlots?: readonly string[];
     readonly observability?: ObservabilityProvider;
-    /** @deprecated No effect: the HTTP route label carries no query string anymore. */
-    readonly observabilityOptions?: ObservabilityOptions;
     /** Serves `/metrics` on its own port (the worker has no HTTP app). Needs a
      *  PrometheusMeter-based `observability`; both are validated at boot,
      *  including KUMIKO_DRY_RUN_ENV=boot. Same `token`/`path` as runProdApp. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.377.0",
+  "version": "0.379.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -88,18 +88,18 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.377.0",
-    "@cosmicdrift/kumiko-framework": "0.377.0",
-    "@cosmicdrift/kumiko-renderer": "0.377.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.377.0",
-    "@cosmicdrift/kumiko-types": "0.377.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.379.0",
+    "@cosmicdrift/kumiko-framework": "0.379.0",
+    "@cosmicdrift/kumiko-renderer": "0.379.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.379.0",
+    "@cosmicdrift/kumiko-types": "0.379.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.377.0"
+    "@cosmicdrift/kumiko-testing": "0.379.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "resolveStoredUserEmail and resolveFeatureTogglesOption exported",
+    "detail": "resolveStoredUserEmail (with MailRecipientScope) and resolveFeatureTogglesOption with its binding types are available from the package entry. The production boot builds the template resolver API with the registry."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "diskFileRoute for allowlisted disk files",
+    "detail": "diskFileRoute({ path, resolveFile }) returns an anonymous GET extra route with a :file parameter. resolveFile maps the raw name to a disk path or null for 404; the file is served with mime type, ETag and 304 handling."
+  },
   {
     "version": "0.376.0",
     "type": "breaking",