@cosmicdrift/kumiko-server-runtime 0.383.1 → 0.384.0

package/dist/index.d.ts

@@ -22,4 +22,5 @@ export { parseRunMode, requireEnv, runProdApp } from "./run-prod-app.ts";
 export type { RunWorkerAppOptions, WorkerAppHandle, WorkerWireDeps, } from "./run-worker-app.ts";
 export { runWorkerApp } from "./run-worker-app.ts";
 export type { CspExtension, CspOption, SecurityHeadersOption } from "./security-headers.ts";
+export { buildDefaultCsp } from "./security-headers.ts";
 export { makeSeedCreateFileRef, type SeedCreateFileRef } from "./seed-dispatcher.ts";

package/dist/index.js

@@ -16,4 +16,5 @@ export { installFatalErrorHandlers, } from "./fatal-error-handlers.js";
 export { runBootstrap } from "./run-bootstrap.js";
 export { parseRunMode, requireEnv, runProdApp } from "./run-prod-app.js";
 export { runWorkerApp } from "./run-worker-app.js";
+export { buildDefaultCsp } from "./security-headers.js";
 export { makeSeedCreateFileRef } from "./seed-dispatcher.js";

package/dist/run-prod-app-boot-context.d.ts

@@ -1,4 +1,4 @@
-import { type EmailVerificationOptions, type PasswordResetOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { type AccountUnlockOptions, type EmailVerificationOptions, type PasswordResetOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
 import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { type UnsubscribeLinkConfig } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
@@ -9,7 +9,7 @@ import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import { type BootCrypto } from "./boot/boot-crypto.ts";
-import type { AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup } from "./run-prod-app.ts";
+import type { AccountUnlockSetup, AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup } from "./run-prod-app.ts";
 export declare function addConfigAccessorFactory<T extends {
     readonly configResolver?: ConfigResolver;
 }>(resolved: T, registry: Registry): T;
@@ -47,12 +47,14 @@ type AuthMailNormalizable = {
     readonly emailVerification?: EmailVerificationSetup;
     readonly signup?: SignupSetup;
     readonly invite?: InviteSetup;
+    readonly accountUnlock?: AccountUnlockSetup;
 };
 export declare function resolveAuthMail<T extends AuthMailNormalizable>(auth: T, hmacSecret: string, envSource: Record<string, string | undefined>, mailWiring?: {
     readonly mailConfigured?: boolean;
 }): T & {
     readonly passwordReset?: PasswordResetOptions;
     readonly emailVerification?: EmailVerificationOptions;
+    readonly accountUnlock?: AccountUnlockOptions;
 };
 export declare function buildProdSessionAuth(db: DbConnection, registry: Registry, sessionsFeature: FeatureDefinition | undefined, mfaFeature: FeatureDefinition | undefined, patFeature: FeatureDefinition | undefined): Promise<{
     readonly sessionCreator: Awaited<ReturnType<typeof resolveSessionStore>>["creator"];

package/dist/run-prod-app-boot-context.js

@@ -189,11 +189,6 @@ function buildAuthPathAppUrl(baseUrl, path) {
         ? (locale) => `${baseUrl}${path(locale)}`
         : `${baseUrl}${path}`;
 }
-// accountUnlock (#1266) deliberately does NOT join this convenience block —
-// unlike reset/verify/signup/invite it's only meaningful paired with
-// `accountLockout` (kumiko-framework#1627), and apps set both explicitly
-// alongside each other (same shape as `passwordReset`), so `mail` alone
-// can't silently expose a new public endpoint an app didn't ask for.
 function backfillTokenSecrets(auth, tokenSecret) {
     return {
         ...auth,
@@ -209,6 +204,12 @@ function backfillTokenSecrets(auth, tokenSecret) {
                 hmacSecret: auth.emailVerification.hmacSecret ?? tokenSecret,
             },
         }),
+        ...(auth.accountUnlock && {
+            accountUnlock: {
+                ...auth.accountUnlock,
+                hmacSecret: auth.accountUnlock.hmacSecret ?? tokenSecret,
+            },
+        }),
     };
 }
 export function resolveAuthMail(auth, hmacSecret, envSource, mailWiring = {}) {
@@ -256,6 +257,12 @@ export function resolveAuthMail(auth, hmacSecret, envSource, mailWiring = {}) {
             appUrl: buildAuthPathAppUrl(auth.mail.baseUrl, paths.inviteAccept),
             ...mailPresentation,
         },
+        // The login lockout is always on, so its escape hatch ships with the mail flows.
+        accountUnlock: withResolvedSecrets.accountUnlock ?? {
+            hmacSecret: tokenSecret,
+            appUrl: buildAuthPathAppUrl(auth.mail.baseUrl, paths.unlockAccount),
+            ...mailPresentation,
+        },
     };
 }
 export async function buildProdSessionAuth(db, registry, sessionsFeature, mfaFeature, patFeature) {

package/dist/run-prod-app-static-files.d.ts

@@ -10,6 +10,10 @@ export declare function readStaticFile(filePath: string): Promise<{
 /** Hashes for the default CSP. Only an app that keeps the default CSP and serves a
  *  staticDir needs them; a missing or broken file leaves inline scripts blocked, so boot says so. */
 export declare function resolveCspScriptHashes(staticDir: string | undefined, securityHeaders: SecurityHeadersOption | undefined): Promise<readonly string[]>;
+/** Hashes handed to hostDispatch: read from disk only when the default-CSP
+ *  path above has not already done so. */
+export declare function resolveHostDispatchScriptHashes(staticDir: string, securityHeaders: SecurityHeadersOption | undefined, defaultCspHashes: readonly string[]): Promise<readonly string[]>;
+export declare function readBuildScriptHashes(staticDir: string): Promise<readonly string[]>;
 export declare function serveDiskFile(req: Request, pathname: string, file: {
     readonly bytes: Uint8Array;
     readonly mime: string;
@@ -28,5 +32,7 @@ export declare function buildStaticFallback(apiHandler: (req: Request, socketAdd
 hostDispatchDispatcher?: QueryDispatcher, 
 /** trustedProxyHops for the systemQuery request-context builds below —
  *  1:1 with runProdApp's effective value. */
-trustedProxyHops?: number): (req: Request, socketAddress?: string) => Promise<Response>;
+trustedProxyHops?: number, 
+/** Build inline-script hashes, passed through to hostDispatch's deps. */
+hostDispatchScriptHashes?: readonly string[]): (req: Request, socketAddress?: string) => Promise<Response>;
 export declare function staticCachePolicy(pathname: string): CachePolicy;

package/dist/run-prod-app-static-files.js

@@ -53,11 +53,22 @@ export async function readStaticFile(filePath) {
 /** Hashes for the default CSP. Only an app that keeps the default CSP and serves a
  *  staticDir needs them; a missing or broken file leaves inline scripts blocked, so boot says so. */
 export async function resolveCspScriptHashes(staticDir, securityHeaders) {
-    if (staticDir === undefined || securityHeaders === false)
+    if (staticDir === undefined || !usesDefaultCsp(securityHeaders))
         return [];
+    return readBuildScriptHashes(staticDir);
+}
+function usesDefaultCsp(securityHeaders) {
+    if (securityHeaders === false)
+        return false;
     const csp = securityHeaders?.csp;
-    if (csp === false || typeof csp === "string")
-        return [];
+    return csp !== false && typeof csp !== "string";
+}
+/** Hashes handed to hostDispatch: read from disk only when the default-CSP
+ *  path above has not already done so. */
+export async function resolveHostDispatchScriptHashes(staticDir, securityHeaders, defaultCspHashes) {
+    return usesDefaultCsp(securityHeaders) ? defaultCspHashes : readBuildScriptHashes(staticDir);
+}
+export async function readBuildScriptHashes(staticDir) {
     const file = await readStaticFile(join(staticDir, CSP_HASHES_FILE));
     const result = file ? parseCspHashes(new TextDecoder().decode(file.bytes)) : undefined;
     if (result?.kind === "found")
@@ -133,7 +144,9 @@ export function buildStaticFallback(apiHandler, staticDir, hostDispatch, pageHea
 hostDispatchDispatcher, 
 /** trustedProxyHops for the systemQuery request-context builds below —
  *  1:1 with runProdApp's effective value. */
-trustedProxyHops = 0) {
+trustedProxyHops = 0, 
+/** Build inline-script hashes, passed through to hostDispatch's deps. */
+hostDispatchScriptHashes = []) {
     const indexHtml = `${staticDir}/index.html`;
     const clientIpResolver = createClientIpResolver(trustedProxyHops, "buildStaticFallback");
     // Reads an HTML file from disk. No schema injection — createKumikoApp
@@ -231,7 +244,7 @@ trustedProxyHops = 0) {
                 socketAddress,
             })(type, payload, tenantId);
         };
-        const result = await hostDispatch({ host, path: url.pathname, search: url.search }, { systemQuery });
+        const result = await hostDispatch({ host, path: url.pathname, search: url.search }, { systemQuery, cspScriptHashes: hostDispatchScriptHashes });
         if (result.kind === "redirect") {
             return new Response(null, {
                 status: result.status ?? 302,

package/dist/run-prod-app.d.ts

@@ -60,10 +60,11 @@ export type SignupSetup = SignupOptions;
 export type InviteSetup = InviteOptions;
 /** Wrapper API for the account-unlock flow (#1266). = AccountUnlockOptions
  *  (appUrl via delivery, symmetric to PasswordResetSetup). Self-service
- *  escape hatch for accountLockout's monotonic failure counter — only
- *  meaningful when `auth.accountLockout` is also set, but wired
- *  independently like the other flows. */
-export type AccountUnlockSetup = AccountUnlockOptions;
+ *  escape hatch for accountLockout's failure counter; the lockout is always
+ *  on, so `auth.mail` mounts this flow by default. */
+export type AccountUnlockSetup = Omit<AccountUnlockOptions, "hmacSecret"> & {
+    readonly hmacSecret?: string;
+};
 /** Wrapper API for the account-lockout brute-force guard on the login
  *  handler. = AccountLockoutOptions (maxFailedAttempts, lockoutDurationMinutes
  *  — no mail/appUrl fields, it doesn't mount any routes). Symmetric to
@@ -72,7 +73,7 @@ export type AccountUnlockSetup = AccountUnlockOptions;
  *  lockout it's meant to escape. */
 export type AccountLockoutSetup = AccountLockoutOptions;
 /** Auth-Mail-Convenience-Optionen — shared zwischen runProdApp + runDevApp.
- *  Verdrahtet alle 4 Mail-Flows aus einem env-SMTP-Transport + Standard-
+ *  Verdrahtet alle 5 Mail-Flows aus einem env-SMTP-Transport + Standard-
  *  Templates (siehe `auth.mail` + resolveAuthMail). */
 export type AuthMailOptions = {
     /** App-Basis-URL inkl. Schema (z.B. "https://app.example.com"). */
@@ -85,7 +86,7 @@ export type AuthMailOptions = {
     readonly emailVerificationMode?: "strict" | "off";
     /** Fallback-From-Adresse wenn `SMTP_FROM`-env fehlt (env gewinnt). */
     readonly from?: string;
-    /** Einzelne Auth-Pfade überschreiben (Default DEFAULT_AUTH_PATHS). */
+    /** Overrides single auth paths (default DEFAULT_AUTH_PATHS). */
     readonly paths?: Partial<AuthPaths>;
     /** Reset/verify token secret, decoupled from JWT_SECRET rotation.
      *  Falls back to resolveAuthMail's call-site secret when unset. */
@@ -99,26 +100,22 @@ export type RunProdAppAuthOptions = {
     readonly admin?: SeedAdminOptions;
     /** Optional override of the login error → HTTP status map. */
     readonly loginErrorStatusMap?: Readonly<Record<string, number>>;
-    /** Auth-Mail-Convenience: verdrahtet alle 4 Mail-Flows (passwordReset,
-     *  emailVerification, signup, invite) aus `auth.mail.baseUrl` + Standard-
-     *  Pfaden. Alle vier mailen via delivery (ctx.notify) — ersetzt das per-App
-     *  hand-gerollte `send*Email`-Callback-Wiring.
+    /** Wires all five mail flows (passwordReset, emailVerification, signup,
+     *  invite, accountUnlock) from `auth.mail.baseUrl` plus the default paths,
+     *  mailing via delivery (ctx.notify).
      *
-     *  Null-Transport-Guard: ohne `SMTP_HOST`-env wird KEIN Mail-Flow
-     *  verdrahtet (Routes blieben sonst 500). Eine App die einen einzelnen
-     *  Flow custom braucht, setzt `passwordReset`/`signup`/… explizit —
-     *  der explizite Block gewinnt über den mail-Default.
+     *  Without `SMTP_HOST` no flow is wired, since the routes would otherwise
+     *  answer 500. An explicit `passwordReset`/`signup`/… block wins over the
+     *  mail default for that flow.
      *
-     *  Bewusste Entscheidung: `mail` mountet ALLE 4 Flows inkl. signup +
-     *  invite (Self-Registration on). Wer nur reset+verify will, lässt `mail`
-     *  weg und setzt die gewünschten Flows explizit — kein impliziter
-     *  Self-Signup. */
+     *  Deliberately mounts signup and invite too (self-registration on); apps
+     *  that want only reset and verify leave `mail` unset and wire those flows
+     *  explicitly, so there is no implicit self-signup. */
     readonly mail?: AuthMailOptions;
     /** Password-reset flow. When set, /api/auth/request-password-reset +
-     *  /api/auth/reset-password are mounted as public routes UND der
-     *  request/confirm-Handler im auth-email-password-Feature wird
-     *  registriert (sonst dispatchen die Routes ins Leere → 500).
-     *  Überschreibt den `mail`-Default für genau diesen Flow. */
+     *  /api/auth/reset-password are mounted as public routes and the
+     *  request/confirm handlers are registered (otherwise the routes answer
+     *  500). Overrides the `mail` default for this flow. */
     readonly passwordReset?: PasswordResetSetup;
     /** Email-verification flow. Symmetric to passwordReset. */
     readonly emailVerification?: EmailVerificationSetup;
@@ -258,6 +255,8 @@ export type HostDispatchFn = (req: {
  *  tenant for a subdomain instead of needing its own db handle. */
 deps: {
     readonly systemQuery: PageHeadSystemQuery;
+    /** Raw `sha256-…` hashes of the build's inline scripts (csp-hashes.json), for a per-host CSP without 'unsafe-inline'. */
+    readonly cspScriptHashes: readonly string[];
 }) => HostDispatchResult | Promise<HostDispatchResult>;
 export type { PageHeadMeta, PageHeadResolver, PageHeadSystemQuery };
 export type RunProdAppOptions = {

package/dist/run-prod-app.js

@@ -81,7 +81,7 @@ import { resolveRateLimit } from "./rate-limit-defaults.js";
 import { resolveAuthPublicOrigin } from "./resolve-auth-public-origin.js";
 import { resolveUnsubscribeWiring } from "./resolve-unsubscribe-wiring.js";
 import { addConfigAccessorFactory, buildBootExtraContext, buildProdSessionAuth, loggerFromExtraContext, resolveAuthMail, wireProdPatAutoRevoke, } from "./run-prod-app-boot-context.js";
-import { buildStaticFallback, resolveCspScriptHashes } from "./run-prod-app-static-files.js";
+import { buildStaticFallback, resolveCspScriptHashes, resolveHostDispatchScriptHashes, } from "./run-prod-app-static-files.js";
 import { withSecurityHeaders } from "./security-headers.js";
 import { makeSeedCreateFileRef, withSeedErrorContext, } from "./seed-dispatcher.js";
 import { assertSessionBootInvariants } from "./session-boot-gate.js";
@@ -775,10 +775,13 @@ export async function runProdApp(options) {
     //     owns the rest. Tests use this directly; listen() wraps it in
     //     Bun.serve.
     const cspScriptHashes = await resolveCspScriptHashes(options.staticDir, options.securityHeaders);
+    const hostDispatchScriptHashes = options.hostDispatch !== undefined && options.staticDir !== undefined
+        ? await resolveHostDispatchScriptHashes(options.staticDir, options.securityHeaders, cspScriptHashes)
+        : [];
     const fetchHandler = withSecurityHeaders(bootOptionWiring.wrapFetch(options.staticDir
         ? buildStaticFallback(entrypoint.app.fetch.bind(entrypoint.app), options.staticDir, options.hostDispatch, options.resolvePageHead
             ? { resolvePageHead: options.resolvePageHead, dispatcher: entrypoint.dispatcher }
-            : undefined, entrypoint.dispatcher, trustedProxyHops ?? 0)
+            : undefined, entrypoint.dispatcher, trustedProxyHops ?? 0, hostDispatchScriptHashes)
         : // No staticDir (split-deploy / API-only container) → app.fetch's
             // response goes straight to the client, bypassing buildStaticFallback
             // (and with it tryHonoFirst) entirely. Must strip the router-miss

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.383.1",
+  "version": "0.384.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -88,18 +88,18 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.383.1",
-    "@cosmicdrift/kumiko-framework": "0.383.1",
-    "@cosmicdrift/kumiko-renderer": "0.383.1",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.383.1",
-    "@cosmicdrift/kumiko-types": "0.383.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.384.0",
+    "@cosmicdrift/kumiko-framework": "0.384.0",
+    "@cosmicdrift/kumiko-renderer": "0.384.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.384.0",
+    "@cosmicdrift/kumiko-types": "0.384.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.383.1"
+    "@cosmicdrift/kumiko-testing": "0.384.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.384.0",
+    "type": "improvement",
+    "title": "hostDispatch pages get the build's CSP script hashes",
+    "detail": "The deps passed to hostDispatch now carry cspScriptHashes (the inline-script hashes from csp-hashes.json). Build the page CSP with buildDefaultCsp(deps.cspScriptHashes), now exported, so per-host pages keep script-src without unsafe-inline. runDevApp passes an empty list because dev serves no per-host CSP."
+  },
   {
     "version": "0.383.0",
     "type": "improvement",