@cosmicdrift/kumiko-server-runtime 0.342.0 → 0.344.0

package/dist/boot/worker-boot-core.js

@@ -16,7 +16,7 @@ import { Redis } from "ioredis";
 import { composeFeatures } from "../compose-features.js";
 import { assertPiiBootInvariants } from "../pii-boot-gate.js";
 import { requireEnv } from "../run-prod-app.js";
-import { addConfigAccessorFactory, buildBootExtraContext } from "../run-prod-app-boot-context.js";
+import { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, } from "../run-prod-app-boot-context.js";
 import { resolveBootCrypto } from "./boot-crypto.js";
 import { jobRunLoggerCallbacks } from "./job-run-logger.js";
 import { assertWorkerMetricsOptions } from "./worker-metrics-server.js";
@@ -71,7 +71,12 @@ export async function bootWorkerProcess(options, envSource, profile) {
         includeBundled,
         ...(profile.authOptions && { authOptions: profile.authOptions }),
     });
-    validateBoot(features, { env: envSource, ...options.validateBootOptions });
+    const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
+    validateBoot(features, {
+        env: envSource,
+        ...(bootCrypto.entityFieldCipher && { entityFieldCipher: bootCrypto.entityFieldCipher }),
+        ...options.validateBootOptions,
+    });
     warnIfNonUtcServerTimeZone();
     assertWorkerMetricsOptions(options.metrics, options.observability, processName);
     assertPiiBootInvariants(features, {
@@ -124,10 +129,10 @@ export async function bootWorkerProcess(options, envSource, profile) {
     const resolvedExtraContext = typeof options.extraContext === "function"
         ? options.extraContext(deps)
         : (options.extraContext ?? {});
-    const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
     configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
     configurePiiSubjectKms(options.kms);
     configureBlindIndexKey(options.blindIndexKey);
+    const bootLogger = loggerFromExtraContext(resolvedExtraContext);
     const autoExtraContext = buildBootExtraContext({
         db,
         features,
@@ -137,6 +142,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
         crypto: bootCrypto,
         ...(options.kms && { kms: options.kms }),
         ...(profile.deliverQueuedInline === true && { deliverQueuedInline: true }),
+        ...(bootLogger && { log: bootLogger }),
     });
     const extraContext = addConfigAccessorFactory({ ...autoExtraContext, ...resolvedExtraContext }, registry);
     const jobLogger = jobRunLoggerCallbacks(registry, db);

package/dist/build-prod-bundle.js

@@ -48,9 +48,8 @@
 //   alles andere (public/)  →  default (auto-cache)
 import { createHash } from "node:crypto";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { isPlainObject, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
 import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { Temporal } from "temporal-polyfill";
@@ -530,21 +529,57 @@ export async function runTailwindOnce(entry, cwd) {
     if (!canResolveTailwindStylesheet(entry, { bun: bunResolver, cwd })) {
         throw new Error(`[kumiko build] tailwindcss nicht auflösbar für ${entry} — peer dependency fehlt am Stylesheet-Ort.`);
     }
-    const tmpDir = await mkdtemp(join(tmpdir(), "kumiko-build-tw-"));
-    const outPath = join(tmpDir, "styles.css");
-    const bunPath = process.argv[0] ?? "bun";
-    const proc = Bun.spawn([bunPath, "run", cliPath, "-i", entry, "-o", outPath, "--minify"], {
-        cwd,
-        stdout: "inherit",
-        stderr: "inherit",
+    const { compile, optimize, Scanner } = await loadTailwindEngine(cliPath, bunResolver);
+    const input = resolve(cwd, entry);
+    if (!existsSync(input)) {
+        throw new Error(`[kumiko build] tailwind: stylesheet not found: ${input}`);
+    }
+    const css = await readFile(input, "utf8");
+    // Mirrors `@tailwindcss/cli -i <entry> -o <file> --minify` option for option, so the output
+    // stays byte-identical to the CLI without spawning a child process.
+    const compiler = await compile(css, {
+        from: input,
+        base: dirname(input),
+        onDependency: () => { },
     });
-    const code = await proc.exited;
-    if (code !== 0) {
-        throw new Error(`[kumiko build] tailwind exit ${code}`);
+    const rootSources = compiler.root === "none"
+        ? []
+        : compiler.root === null
+            ? [{ base: resolve(cwd), pattern: "**/*", negated: false }]
+            : [{ ...compiler.root, negated: false }];
+    const scanner = new Scanner({
+        sources: [
+            ...rootSources,
+            ...compiler.sources,
+            { base: dirname(process.execPath), pattern: basename(process.execPath), negated: true },
+        ],
+    });
+    return optimize(compiler.build(scanner.scan()), { file: input, minify: true }).code;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+// Dynamic import of an external package: only the shape is checkable, the signatures are the documented Tailwind v4 API.
+function isTailwindEngine(candidate) {
+    return (typeof candidate.compile === "function" &&
+        typeof candidate.optimize === "function" &&
+        typeof candidate.Scanner === "function");
+}
+// Both packages are the CLI's own dependencies, so they resolve from the CLI package directory
+// (same version the CLI would run), not from the app root.
+async function loadTailwindEngine(cliPath, bun) {
+    const cliDir = dirname(bun.resolveSync("@tailwindcss/cli/package.json", dirname(cliPath)));
+    const node = await import(bun.resolveSync("@tailwindcss/node", cliDir));
+    const oxide = await import(bun.resolveSync("@tailwindcss/oxide", cliDir));
+    const engine = {
+        compile: isRecord(node) ? node["compile"] : undefined,
+        optimize: isRecord(node) ? node["optimize"] : undefined,
+        Scanner: isRecord(oxide) ? oxide["Scanner"] : undefined,
+    };
+    if (!isTailwindEngine(engine)) {
+        throw new Error("[kumiko build] @tailwindcss/node or @tailwindcss/oxide has an unexpected API.");
     }
-    const css = await readFile(outPath, "utf8");
-    await rm(tmpDir, { recursive: true, force: true });
-    return css;
+    return engine;
 }
 // Exact `<base>-<hash>.js` match: a plain prefix check would let
 // `client-admin-legacy-<hash>.js` satisfy the `client-admin` entry. The hash is

package/dist/run-prod-app-boot-context.d.ts

@@ -4,12 +4,14 @@ import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigResolver, FeatureDefinition, Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import { type BootCrypto } from "./boot/boot-crypto.js";
 import type { AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup } from "./run-prod-app.js";
 export declare function addConfigAccessorFactory<T extends {
     readonly configResolver?: ConfigResolver;
 }>(resolved: T, registry: Registry): T;
+export declare function loggerFromExtraContext(extraContext: Record<string, unknown>): Logger | undefined;
 export declare function buildBootExtraContext(opts: {
     readonly db: DbConnection;
     readonly features: readonly FeatureDefinition[];
@@ -23,6 +25,8 @@ export declare function buildBootExtraContext(opts: {
     /** One-shot process (runBootstrap): nothing drains its job queue once it
      *  exits, so queued channels must send inline instead of enqueueing. */
     readonly deliverQueuedInline?: boolean;
+    /** Receives redacted delivery failures; without it they go to the console. */
+    readonly log?: Logger;
 }): Record<string, unknown>;
 /** Die Auth-Felder die resolveAuthMail liest/normalisiert — beide
  *  App-Auth-Typen (prod + dev) erfüllen das strukturell. */

package/dist/run-prod-app-boot-context.js

@@ -4,7 +4,7 @@ import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-f
 import { bindMfaRevokeAllOtherSessionsFromFeature, bindRevokeAllPatTokensFromFeature, } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
 import { createSmtpTransportFromEnv } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { buildEnvConfigOverrides, createConfigAccessorFactory, createConfigResolver, } from "@cosmicdrift/kumiko-bundled-features/config";
-import { collectChannels, createDeliveryService, DELIVERY_FEATURE, } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { collectChannels, createDeliveryNotifyFactory, createDeliveryService, DELIVERY_FEATURE, } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { bindPatAutoRevokeOnPasswordChangeFromFeature, revokeAllPatTokensForUser, } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import { createSecretsContext, SECRETS_FEATURE_NAME, } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { bindAutoRevokeFromFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
@@ -52,8 +52,21 @@ function buildDeliveryNotifyFactory(opts) {
         ...(opts.secrets && { secrets: opts.secrets }),
         ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
         ...(opts.escapeHatchAuditSink && { escapeHatchAuditSink: opts.escapeHatchAuditSink }),
+        ...(opts.log && { log: opts.log }),
     });
-    return (user, tenantId, jobDispatcher) => (notificationType, options) => deliveryService.notify(notificationType, options, user, tenantId, opts.deliverQueuedInline === true ? undefined : jobDispatcher);
+    return createDeliveryNotifyFactory(deliveryService, {
+        deliverQueuedInline: opts.deliverQueuedInline === true,
+    });
+}
+function isLogger(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    return ["info", "warn", "error", "debug", "child"].every((method) => method in value && typeof Reflect.get(value, method) === "function");
+}
+// Prod context.log only comes from the app's extraContext.
+export function loggerFromExtraContext(extraContext) {
+    const candidate = extraContext["log"];
+    return isLogger(candidate) ? candidate : undefined;
 }
 function resolveEscapeHatchAuditSink(features, db) {
     const hasAuditFeature = features.some((f) => f.name === AUDIT_FEATURE);
@@ -86,6 +99,7 @@ export function buildBootExtraContext(opts) {
                 ...(secrets && { secrets }),
                 ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
                 ...(escapeHatchAuditSink && { escapeHatchAuditSink }),
+                ...(opts.log && { log: opts.log }),
                 deliverQueuedInline: opts.deliverQueuedInline,
             }),
         }),

package/dist/run-prod-app.d.ts

@@ -6,6 +6,7 @@ import { type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { type EffectiveFeaturesResolver, type FeatureDefinition, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import { type AllInOneEntrypoint, type ApiEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import { type ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
+import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
 import type { ObservabilityOptions, ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -14,7 +15,7 @@ import { Redis } from "ioredis";
 import { type SystemWireDeps } from "./extra-routes-deps.js";
 import { type SecurityHeadersOption } from "./security-headers.js";
 export { buildBunServeOptions } from "./bun-serve-options.js";
-export { addConfigAccessorFactory, buildBootExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
+export { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
 export { staticCachePolicy } from "./run-prod-app-static-files.js";
 export declare function requireEnv(name: string, src?: Record<string, string | undefined>, context?: string): string;
 /** Wrapper API for the password-reset flow.
@@ -156,9 +157,13 @@ export type RunProdAppAuthOptions = {
 };
 /** Hook for app-specific seeding — runs after the admin (when auth is
  *  active). Each seed is responsible for its own idempotence (seeds are
- *  expected to check "is my row already there?" before inserting). */
+ *  expected to check "is my row already there?" before inserting). Write
+ *  through `dispatcher.write(...)` rather than `db` so projections and
+ *  hooks run; `registry` is the boot registry. */
 export type ProdSeedFn = (deps: {
     db: import("@cosmicdrift/kumiko-framework/db").DbConnection;
+    registry: import("@cosmicdrift/kumiko-framework/engine").Registry;
+    dispatcher: import("@cosmicdrift/kumiko-framework/pipeline").Dispatcher;
 }) => Promise<void>;
 /** Boot-Time-Deps die `extraContext` + `anonymousAccess` Factories als
  *  Argument bekommen. Closure dann in der returned Config (z.B. ein
@@ -306,10 +311,11 @@ export type RunProdAppOptions = {
      *  no locale signal. Merged into AppContext before extraContext (app wins). */
     readonly defaultLocale?: string;
     readonly extraContext?: ExtraContextOption;
-    /** MasterKeyProvider für die auto-verdrahtete `ctx.secrets`. Default:
-     *  `createEnvMasterKeyProvider` (KEK aus `KUMIKO_SECRETS_MASTER_KEY_V<n>`).
-     *  Override für KMS-Backends (AWS/GCP/Azure) statt env-KEK. Nur relevant
-     *  wenn das `secrets`-Feature gemountet ist. */
+    /** MasterKeyProvider replacing the env KEK (`KUMIKO_SECRETS_MASTER_KEY_V<n>`)
+     *  for `ctx.secrets`, encrypted config keys and `encrypted: true` entity
+     *  fields. Default: `createEnvMasterKeyProvider`. Use it for KMS backends
+     *  (AWS/GCP/Azure); with it set, `KUMIKO_SECRETS_MASTER_KEY_V1` is not
+     *  required in the env. */
     readonly masterKey?: MasterKeyProvider;
     /** Subject-Key-Adapter für Crypto-Shredding (DSGVO Art. 17). Wenn gesetzt,
      *  steht er Feature-Code als `ctx.kms` zur Verfügung und der Boot prüft
@@ -447,6 +453,8 @@ export type RunProdAppOptions = {
      *  `auth.trustedProxyHops` and `KUMIKO_TRUSTED_PROXY_HOPS`. Default 0 =
      *  trust no proxy header, only the socket address (or "unknown") counts. */
     readonly trustedProxyHops?: number;
+    /** Links the app's own error reasons to its own docs (`docsUrl` in error responses); framework reasons keep the framework docs link. */
+    readonly errorDocs?: ErrorDocsConfig;
 };
 export type ProdAppHandle = {
     /** The composed entrypoint — AllInOne (runSingleInstance, default) or

package/dist/run-prod-app.js

@@ -44,6 +44,7 @@ import { seedAdminGuarded, } from "@cosmicdrift/kumiko-bundled-features/auth-ema
 import { EXT_SESSION_STORE, EXT_TOKEN_VERIFIER, resolveAnonymousAccessFromRegistry, resolveTokenVerifier, } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { AUTH_MFA_FEATURE, AuthMfaHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
 import { PAT_FEATURE, patRateLimitFromFeature, } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
+import { SECRETS_MASTER_KEK_ENV_KEYS } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { SESSIONS_FEATURE } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { UserQueries } from "@cosmicdrift/kumiko-bundled-features/user";
@@ -52,7 +53,7 @@ import { configureBlindIndexKey, configurePiiSubjectKms, resolvePlatformKeks, }
 import { configureEntityFieldEncryption, createDbConnection, } from "@cosmicdrift/kumiko-framework/db";
 import { collectWriteHandlerQns, createRegistry, findTierResolverUsage, validateAppCustomScreenWriteQns, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
 import { createAllInOneEntrypoint, createApiEntrypoint, } from "@cosmicdrift/kumiko-framework/entrypoint";
-import { KumikoBootError, kmsSlotsOf, parseEnv, } from "@cosmicdrift/kumiko-framework/env";
+import { KumikoBootError, kmsSlotsOf, parseEnv, withOptionalEnvKeys, } from "@cosmicdrift/kumiko-framework/env";
 import { renderDryRun } from "@cosmicdrift/kumiko-framework/env/dry-run";
 import { createEsOperationsTable, createSeedMigrationContext, runPendingSeedMigrations, } from "@cosmicdrift/kumiko-framework/es-ops";
 import { assertKumikoSchemaCurrent, SchemaDriftError, } from "@cosmicdrift/kumiko-framework/migrations";
@@ -68,14 +69,14 @@ import { buildBunServeOptions, resolveDerivedMaxRequestBodySize } from "./bun-se
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features.js";
 import { makeDispatchSystemWrite } from "./extra-routes-deps.js";
 import { assertPiiBootInvariants } from "./pii-boot-gate.js";
-import { addConfigAccessorFactory, buildBootExtraContext, buildProdSessionAuth, resolveAuthMail, wireProdPatAutoRevoke, } from "./run-prod-app-boot-context.js";
+import { addConfigAccessorFactory, buildBootExtraContext, buildProdSessionAuth, loggerFromExtraContext, resolveAuthMail, wireProdPatAutoRevoke, } from "./run-prod-app-boot-context.js";
 import { buildStaticFallback } from "./run-prod-app-static-files.js";
 import { withSecurityHeaders } from "./security-headers.js";
 import { assertSessionBootInvariants } from "./session-boot-gate.js";
 import { shouldWireProdSessions } from "./session-wiring.js";
 import { stripNoRouteMatchHeader } from "./try-hono-first.js";
 export { buildBunServeOptions } from "./bun-serve-options.js";
-export { addConfigAccessorFactory, buildBootExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
+export { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
 export { staticCachePolicy } from "./run-prod-app-static-files.js";
 // Strict env-var read. Throws with a clear hint when missing — better
 // than discovering a Postgres-connection-refused 30s into the boot.
@@ -191,7 +192,10 @@ export async function runProdApp(options) {
         // a real env-check (all required vars present + schema-valid) before
         // it asserts feature-wiring works.
         try {
-            parseEnv(options.envSchema.schema, rawEnvSource, {
+            const envSchema = options.masterKey
+                ? withOptionalEnvKeys(options.envSchema.schema, SECRETS_MASTER_KEK_ENV_KEYS)
+                : options.envSchema.schema;
+            parseEnv(envSchema, rawEnvSource, {
                 sources: options.envSchema.sources,
                 ...(options.pulumiPrefix ? { pulumiPrefix: options.pulumiPrefix } : {}),
             });
@@ -269,7 +273,12 @@ export async function runProdApp(options) {
         includeBundled: !!effectiveAuth,
         ...(composeAuthOptions && { authOptions: composeAuthOptions }),
     });
-    validateBoot(features, { env: envSource, ...options.validateBootOptions });
+    const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
+    validateBoot(features, {
+        env: envSource,
+        ...(bootCrypto.entityFieldCipher && { entityFieldCipher: bootCrypto.entityFieldCipher }),
+        ...options.validateBootOptions,
+    });
     warnIfNonUtcServerTimeZone();
     validateAppCustomScreenWriteQns(process.cwd(), collectWriteHandlerQns(features));
     assertPiiBootInvariants(features, {
@@ -385,7 +394,6 @@ export async function runProdApp(options) {
         : (options.extraContext ?? {});
     // Framework-Default-Provider zuerst, App-Werte (resolvedExtraContext)
     // gewinnen immer (z.B. money-horse's eigener configResolver).
-    const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
     // App-wide cipher for `encrypted: true` entity fields — executors resolve
     // it lazily, entities without encrypted fields never touch it.
     configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
@@ -399,6 +407,7 @@ export async function runProdApp(options) {
     // jeder Equality-Lookup (Login by email!) liefe ins Leere. Fail-fast statt
     // silent-broken-auth.
     configureBlindIndexKey(options.blindIndexKey);
+    const bootLogger = loggerFromExtraContext(resolvedExtraContext);
     const autoExtraContext = buildBootExtraContext({
         db,
         features,
@@ -408,6 +417,7 @@ export async function runProdApp(options) {
         sseBroker,
         crypto: bootCrypto,
         ...(options.kms && { kms: options.kms }),
+        ...(bootLogger && { log: bootLogger }),
     });
     const extraContext = {
         ...addConfigAccessorFactory({ ...autoExtraContext, ...resolvedExtraContext }, registry),
@@ -483,6 +493,7 @@ export async function runProdApp(options) {
         ...(options.metrics && { metrics: options.metrics }),
         ...(options.rateLimit && { rateLimit: options.rateLimit }),
         ...(trustedProxyHops !== undefined && { trustedProxyHops }),
+        ...(options.errorDocs && { errorDocs: options.errorDocs }),
         ...(options.extraRoutes && { extraRoutes: options.extraRoutes }),
         ...(effectiveAuth && {
             auth: {
@@ -643,23 +654,21 @@ export async function runProdApp(options) {
         db,
         ...(bootCrypto.configCipher && { cipher: bootCrypto.configCipher }),
     });
-    for (const seed of options.seeds ?? []) {
-        await seed({ db });
+    const seedDispatcher = (options.seeds?.length ?? 0) > 0 || options.seedsDir !== undefined
+        ? createDispatcher(registry, { db, redis, entityCache, registry, ...extraContext })
+        : undefined;
+    if (seedDispatcher) {
+        for (const seed of options.seeds ?? []) {
+            await seed({ db, registry, dispatcher: seedDispatcher });
+        }
     }
     // ES-Operations / Seed-Migrations (Phase 1). Läuft NACH applyBootSeeds +
     // existing seeds-array — die deklarativen Seeds sind die "always-insert-
     // if-missing"-Schicht; seed-migrations sind die "diff-and-update"-
     // Schicht für Drift den existing Seeds nicht erfassen können (z.B.
     // Membership-Roles-Change nach initialer Seed-Erstellung).
-    if (options.seedsDir !== undefined && envSource["KUMIKO_SKIP_ES_OPS"] !== "1") {
+    if (seedDispatcher && options.seedsDir !== undefined && envSource["KUMIKO_SKIP_ES_OPS"] !== "1") {
         await createEsOperationsTable(db);
-        const seedDispatcher = createDispatcher(registry, {
-            db,
-            redis,
-            entityCache,
-            registry,
-            ...extraContext,
-        });
         await runPendingSeedMigrations({
             db,
             seedsDir: options.seedsDir,

package/dist/run-worker-app.d.ts

@@ -49,7 +49,9 @@ export type RunWorkerAppOptions = {
      *  RunProdAppOptions["extraContext"], without sseBroker (the worker
      *  has none — see entrypoint/index.ts's documented SSE limitation). */
     readonly extraContext?: WorkerContextOption;
-    /** MasterKeyProvider for ctx.secrets. Default: env-KEK (see
+    /** MasterKeyProvider replacing the env KEK for ctx.secrets, encrypted
+     *  config keys and `encrypted: true` entity fields; with it set,
+     *  `KUMIKO_SECRETS_MASTER_KEY_V1` is not required (see
      *  RunProdAppOptions["masterKey"]). */
     readonly masterKey?: MasterKeyProvider;
     /** Subject-key adapter for crypto-shredding — boot checks health()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.342.0",
+  "version": "0.344.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,10 +80,10 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.342.0",
-    "@cosmicdrift/kumiko-framework": "0.342.0",
-    "@cosmicdrift/kumiko-headless": "0.342.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.342.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.344.0",
+    "@cosmicdrift/kumiko-framework": "0.344.0",
+    "@cosmicdrift/kumiko-headless": "0.344.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.344.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2"

package/src/changes.json

@@ -1,4 +1,29 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "fix",
+    "title": "Delivery failures are logged to the app logger in prod",
+    "detail": "The prod and worker boot pass the app logger (`extraContext.log`) to the delivery service, so redacted delivery failures reach that logger instead of the console. `ctx.notify` is built with `createDeliveryNotifyFactory`. `buildBootExtraContext` accepts an optional `log`."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "masterKey on runProdApp and runWorkerApp replaces the env KEK for the boot checks",
+    "detail": "A `masterKey` provider on runProdApp and runWorkerApp is enough for the boot checks\nThe boot probe for `encrypted: true` entity fields now accepts the cipher the runner builds from `masterKey` (new `ValidateBootOptions.entityFieldCipher`), and the env-schema parse no longer requires `KUMIKO_SECRETS_MASTER_KEY_V1` when `masterKey` is set. The framework exports `withOptionalEnvKeys` for that, and the secrets feature exports `SECRETS_MASTER_KEK_ENV_KEYS`. Without `masterKey`, a missing env KEK still stops the boot; the message now names both ways to provide a key. A malformed env KEK now fails during boot validation, so `KUMIKO_DRY_RUN_ENV=boot` reports it too.",
+    "migration": "Apps that pass `masterKey` can drop `KUMIKO_SECRETS_MASTER_KEY_V1` from their env and deployment config. Apps without `masterKey` change nothing."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Prod seeds get registry and dispatcher",
+    "detail": "Prod seeds receive the boot registry and a system dispatcher\n`ProdSeedFn` deps grow from `{ db }` to `{ db, registry, dispatcher }`. Seeds should write through `dispatcher.write(...)` so projections and hooks run. The dispatcher is built once when `seeds` or `seedsDir` is set and is shared with the seed migrations."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Prod build runs Tailwind in-process instead of spawning the CLI",
+    "detail": "The prod build runs Tailwind in-process (`@tailwindcss/node` and `@tailwindcss/oxide`, resolved from the `@tailwindcss/cli` package) instead of spawning the CLI. Options mirror the CLI, and a parity test pins byte-identical output."
+  },
   {
     "version": "0.341.0",
     "type": "improvement",