@cosmicdrift/kumiko-server-runtime 0.369.0 → 0.370.0

package/dist/boot-options/process-signals.js

@@ -0,0 +1,58 @@
+// Kubernetes sends SIGKILL after terminationGracePeriodSeconds (default 30 s).
+// Draining 25 s leaves room for the exit and the final log line before that.
+export const DEFAULT_DRAIN_TIMEOUT_MS = 25_000;
+/** Registers SIGTERM/SIGINT: the first signal drains via `stop()` and exits
+ *  0, a drain that fails or outlives the timeout exits 1. Returns the
+ *  uninstall function so `stop()` can drop the listeners again. */
+export function installShutdownSignals(deps) {
+    const signalProcess = deps.signalProcess ?? process;
+    const exit = deps.exit ?? ((code) => process.exit(code));
+    // biome-ignore lint/suspicious/noConsole: shutdown progress, no logger at this level
+    const log = deps.log ?? ((message) => console.log(message));
+    const logError = deps.logError ??
+        // biome-ignore lint/suspicious/noConsole: shutdown-time error, only path is stderr
+        ((message, error) => console.error(message, error));
+    const drainTimeoutMs = deps.drainTimeoutMs ?? DEFAULT_DRAIN_TIMEOUT_MS;
+    let shuttingDown = false;
+    const shutdown = async (signal) => {
+        // skip: shutdown already in progress, a second signal must not double-drain
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        log(`[runProdApp] ${signal} received — draining (timeout ${drainTimeoutMs}ms)…`);
+        let timer;
+        const timeout = new Promise((resolve) => {
+            timer = setTimeout(() => resolve({ kind: "timeout" }), drainTimeoutMs);
+        });
+        let exitCode = 0;
+        try {
+            const outcome = await Promise.race([
+                deps.stop().then(() => ({ kind: "drained" })),
+                timeout,
+            ]);
+            if (outcome.kind === "timeout") {
+                exitCode = 1;
+                logError(`[runProdApp] drain exceeded ${drainTimeoutMs}ms, exiting anyway`, undefined);
+            }
+            else {
+                log("[runProdApp] graceful shutdown complete.");
+            }
+        }
+        catch (error) {
+            exitCode = 1;
+            logError("[runProdApp] error during shutdown:", error);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        exit(exitCode);
+    };
+    const onSigterm = () => void shutdown("SIGTERM");
+    const onSigint = () => void shutdown("SIGINT");
+    signalProcess.on("SIGTERM", onSigterm);
+    signalProcess.on("SIGINT", onSigint);
+    return () => {
+        signalProcess.off("SIGTERM", onSigterm);
+        signalProcess.off("SIGINT", onSigint);
+    };
+}

package/dist/boot-options/resolve-boot-options.d.ts

@@ -0,0 +1,44 @@
+import type { ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { ProdSeedFn } from "../run-prod-app.ts";
+import { type BillingBootOption } from "./billing-option.ts";
+import { type DemoModeOption } from "./demo-mode.ts";
+import { type FileStorageBootOption } from "./file-storage-option.ts";
+import { type KmsMode, type ResolvedKmsMode } from "./kms-mode.ts";
+import { type MailBootOption } from "./mail-option.ts";
+import { type DbSeedFn, type ProdSeedsConfig } from "./seed-shortcuts.ts";
+export type BootOptionFields = {
+    readonly features: readonly FeatureDefinition[];
+    readonly mail?: MailBootOption;
+    readonly kmsMode?: KmsMode;
+    readonly fileStorage?: FileStorageBootOption;
+    readonly billing?: BillingBootOption;
+    readonly demoMode?: DemoModeOption;
+    readonly seeds?: readonly ProdSeedFn[] | ProdSeedsConfig;
+    readonly kms?: ResolvedKmsMode["kms"];
+    readonly blindIndexKey?: string;
+    readonly allowPlaintextPii?: string;
+    readonly runSingleInstance?: boolean;
+    readonly auth?: {
+        readonly admin?: unknown;
+        readonly mail?: {
+            readonly from?: string;
+        };
+    };
+};
+export type BootOptionWiring = {
+    readonly features: readonly FeatureDefinition[];
+    readonly extraRoutes: readonly ExtraRouteDefinition[];
+    /** Applied under the env: an explicitly set variable always wins. */
+    readonly envDefaults: Readonly<Record<string, string>>;
+    readonly kms: ResolvedKmsMode;
+    readonly shortcutSeeds: readonly DbSeedFn[];
+    readonly customSeeds: readonly ProdSeedFn[];
+    /** True when `mail` mounted a transport; the auth mail flows then wire without `SMTP_HOST`. */
+    readonly mailConfigured: boolean;
+    readonly wrapFetch: <TArg>(handler: (req: Request, arg?: TArg) => Promise<Response>) => (req: Request, arg?: TArg) => Promise<Response>;
+};
+export declare function isSeedFnList(seeds: readonly ProdSeedFn[] | ProdSeedsConfig): seeds is readonly ProdSeedFn[];
+/** Runs after the env is validated and KEK slots are decrypted, before any
+ *  connection: every misconfiguration of the new options fails here. */
+export declare function resolveBootOptionWiring(options: BootOptionFields, envSource: Record<string, string | undefined>): Promise<BootOptionWiring>;

package/dist/boot-options/resolve-boot-options.js

@@ -0,0 +1,88 @@
+import { BILLING_FOUNDATION_FEATURE } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { DELIVERY_FEATURE } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { SUBSCRIPTION_STRIPE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/subscription-stripe";
+import { TIER_ENGINE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
+import { resolveBillingOption } from "./billing-option.js";
+import { buildDemoModeRoute, withDemoReadOnlyFetch } from "./demo-mode.js";
+import { FILE_FOUNDATION_FEATURE, resolveFileStorageOption, } from "./file-storage-option.js";
+import { resolveKmsMode } from "./kms-mode.js";
+import { CHANNEL_EMAIL_FEATURE, resolveMailOption } from "./mail-option.js";
+import { resolveSeedShortcuts } from "./seed-shortcuts.js";
+export function isSeedFnList(seeds) {
+    return Array.isArray(seeds);
+}
+function requireFeatures(mounted, option, required, hint) {
+    const missing = required.filter((name) => !mounted.has(name));
+    if (missing.length > 0) {
+        throw new Error(`[runProdApp] ${option} needs the feature(s) ${missing.join(", ")} in \`features\`. ${hint}`);
+    }
+}
+function rejectDoubleMount(mounted, option, feature) {
+    if (mounted.has(feature)) {
+        throw new Error(`[runProdApp] ${option} mounts ${feature} itself — remove it from \`features\` or drop the option.`);
+    }
+}
+/** Runs after the env is validated and KEK slots are decrypted, before any
+ *  connection: every misconfiguration of the new options fails here. */
+export async function resolveBootOptionWiring(options, envSource) {
+    const isProduction = envSource["NODE_ENV"] === "production";
+    const mounted = new Set(options.features.map((feature) => feature.name));
+    const features = [];
+    const extraRoutes = [];
+    let envDefaults = {};
+    if (options.mail) {
+        requireFeatures(mounted, "mail", [DELIVERY_FEATURE], "channel-email sends through delivery.");
+        rejectDoubleMount(mounted, "mail", CHANNEL_EMAIL_FEATURE);
+        features.push(resolveMailOption(options.mail, {
+            envSource,
+            isProduction,
+            authMailFrom: options.auth?.mail?.from,
+        }).feature);
+    }
+    if (options.fileStorage) {
+        requireFeatures(mounted, "fileStorage", [FILE_FOUNDATION_FEATURE], "Mount it via composeFileStack.");
+        const fileStorage = resolveFileStorageOption(options.fileStorage, {
+            envSource,
+            isProduction,
+            mountedFeatureNames: mounted,
+        });
+        features.push(...fileStorage.features);
+        envDefaults = { ...envDefaults, ...fileStorage.envDefaults };
+    }
+    if (options.billing) {
+        requireFeatures(mounted, "billing.stripe", [BILLING_FOUNDATION_FEATURE, TIER_ENGINE_FEATURE], "Mount createBillingFoundationFeature() and createTierEngineFeature(), or composeSaasStack from @cosmicdrift/kumiko-dev-server/compose-stacks.");
+        rejectDoubleMount(mounted, "billing.stripe", SUBSCRIPTION_STRIPE_FEATURE);
+        const billing = resolveBillingOption(options.billing, envSource);
+        features.push(billing.feature);
+        extraRoutes.push(billing.route);
+    }
+    const { demoMode } = options;
+    if (demoMode) {
+        extraRoutes.push(buildDemoModeRoute(demoMode, envSource));
+    }
+    if (options.runSingleInstance === false && (options.mail || options.fileStorage)) {
+        // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early
+        console.warn("[runProdApp] runSingleInstance:false — delivery and file jobs run in runWorkerApp, which does not read mail / fileStorage. Mount the same channel-email and file provider features there.");
+    }
+    const seeds = options.seeds ?? [];
+    const shortcutSeeds = isSeedFnList(seeds)
+        ? []
+        : resolveSeedShortcuts(seeds, {
+            envSource,
+            hasAuth: options.auth !== undefined,
+            hasAuthAdmin: options.auth?.admin !== undefined,
+        });
+    const customSeeds = isSeedFnList(seeds) ? seeds : (seeds.run ?? []);
+    // Last: it may open a KMS pool, which nothing above should leak on a throw.
+    const kms = await resolveKmsMode(options.kmsMode, options, envSource);
+    return {
+        features,
+        extraRoutes,
+        envDefaults,
+        kms,
+        shortcutSeeds,
+        customSeeds,
+        mailConfigured: options.mail !== undefined,
+        wrapFetch: (handler) => (demoMode ? withDemoReadOnlyFetch(handler, demoMode) : handler),
+    };
+}

package/dist/boot-options/seed-shortcuts.d.ts

@@ -0,0 +1,49 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { ProdSeedFn } from "../run-prod-app.ts";
+export type ProdSeedTenant = {
+    /** Default: `DEMO_TENANT_ID` from the env. */
+    readonly id?: string;
+    readonly key: string;
+    readonly name: string;
+};
+type SeededAccountOptions = {
+    readonly displayName?: string;
+    /** Membership roles in the tenant. */
+    readonly roles?: readonly string[];
+    readonly emailVerified?: boolean;
+};
+/** Declarative boot seeds, all idempotent (existing users keep their roles).
+ *  Need `auth`; run right after `auth.admin`, before `run`.
+ *  - `demoTenant`: the tenant the demo accounts belong to.
+ *  - `demoAdminFromEnv`: `DEMO_ADMIN_EMAIL` / `DEMO_ADMIN_PASSWORD`, member of
+ *    `demoTenant` with `Admin` + `TenantAdmin` (default). Replaces `auth.admin`.
+ *  - `sysadminFromEnv`: `DEMO_SYSADMIN_EMAIL` / `DEMO_SYSADMIN_PASSWORD`, global
+ *    role `SystemAdmin`, email verified, member of `tenant` (default
+ *    `demoTenant`) with role `User` (default).
+ *  - `run`: free seed functions, same contract as the array form.
+ *
+ *  @example
+ *  seeds: {
+ *    demoTenant: { key: "demo", name: "Demo" },
+ *    demoAdminFromEnv: true,
+ *    sysadminFromEnv: true,
+ *    run: [seedDemoData],
+ *  }
+ */
+export type ProdSeedsConfig = {
+    readonly demoTenant?: ProdSeedTenant;
+    readonly demoAdminFromEnv?: boolean | SeededAccountOptions;
+    readonly sysadminFromEnv?: boolean | (SeededAccountOptions & {
+        readonly tenant?: ProdSeedTenant;
+    });
+    readonly run?: readonly ProdSeedFn[];
+};
+export type DbSeedFn = (db: DbConnection) => Promise<void>;
+/** Validates env and options at boot (before any connection) and returns the
+ *  seeds to run once the database is up. */
+export declare function resolveSeedShortcuts(seeds: ProdSeedsConfig, deps: {
+    readonly envSource: Record<string, string | undefined>;
+    readonly hasAuth: boolean;
+    readonly hasAuthAdmin: boolean;
+}): readonly DbSeedFn[];
+export {};

package/dist/boot-options/seed-shortcuts.js

@@ -0,0 +1,92 @@
+import { seedAdminGuarded, seedTenant, } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import { parseTenantId } from "@cosmicdrift/kumiko-types/identifiers";
+const DEFAULT_DEMO_ADMIN_ROLES = ["Admin", ROLES.TenantAdmin];
+const DEFAULT_SYSADMIN_TENANT_ROLES = ["User"];
+function resolveTenant(tenant, envSource, label) {
+    const rawId = tenant.id ?? envSource["DEMO_TENANT_ID"];
+    const id = parseTenantId(rawId);
+    if (id === null) {
+        throw new Error(`[runProdApp] seeds.${label} needs a UUID id (option or DEMO_TENANT_ID), got ${rawId === undefined ? "nothing" : "an invalid value"}.`);
+    }
+    return { id, key: tenant.key, name: tenant.name };
+}
+function requireAccountEnv(envSource, emailKey, passwordKey, label) {
+    const email = envSource[emailKey];
+    const password = envSource[passwordKey];
+    if (!email || !password) {
+        const missing = [emailKey, passwordKey].filter((key) => !envSource[key]);
+        throw new Error(`[runProdApp] seeds.${label} is missing ${missing.join(", ")}.`);
+    }
+    return { email, password };
+}
+function accountOptions(value) {
+    return typeof value === "object" ? value : {};
+}
+function membershipOf(tenant, roles) {
+    return { tenantId: tenant.id, tenantKey: tenant.key, tenantName: tenant.name, roles };
+}
+function seedAccount(admin) {
+    return async (db) => {
+        await seedAdminGuarded(db, admin);
+    };
+}
+function buildDemoAdminSeed(value, demoTenant, envSource) {
+    if (!demoTenant) {
+        throw new Error("[runProdApp] seeds.demoAdminFromEnv needs seeds.demoTenant.");
+    }
+    const options = accountOptions(value);
+    const account = requireAccountEnv(envSource, "DEMO_ADMIN_EMAIL", "DEMO_ADMIN_PASSWORD", "demoAdminFromEnv");
+    return seedAccount({
+        ...account,
+        displayName: options.displayName ?? "Admin",
+        memberships: [membershipOf(demoTenant, options.roles ?? DEFAULT_DEMO_ADMIN_ROLES)],
+        ...(options.emailVerified !== undefined && { emailVerified: options.emailVerified }),
+    });
+}
+function buildSysadminSeed(value, demoTenant, envSource) {
+    const options = typeof value === "object" ? value : {};
+    const tenant = options.tenant
+        ? resolveTenant(options.tenant, envSource, "sysadminFromEnv.tenant")
+        : demoTenant;
+    if (!tenant) {
+        throw new Error("[runProdApp] seeds.sysadminFromEnv needs seeds.demoTenant or sysadminFromEnv.tenant for its login membership.");
+    }
+    const account = requireAccountEnv(envSource, "DEMO_SYSADMIN_EMAIL", "DEMO_SYSADMIN_PASSWORD", "sysadminFromEnv");
+    // Verified by default: with strict verification an undelivered mail would
+    // otherwise lock out the only SystemAdmin.
+    return seedAccount({
+        ...account,
+        displayName: options.displayName ?? "Sysadmin",
+        globalRoles: [ROLES.SystemAdmin],
+        emailVerified: options.emailVerified ?? true,
+        memberships: [membershipOf(tenant, options.roles ?? DEFAULT_SYSADMIN_TENANT_ROLES)],
+    });
+}
+/** Validates env and options at boot (before any connection) and returns the
+ *  seeds to run once the database is up. */
+export function resolveSeedShortcuts(seeds, deps) {
+    const wantsAccounts = Boolean(seeds.demoAdminFromEnv) || Boolean(seeds.sysadminFromEnv);
+    if ((wantsAccounts || seeds.demoTenant) && !deps.hasAuth) {
+        throw new Error("[runProdApp] seeds.demoTenant / demoAdminFromEnv / sysadminFromEnv need `auth` (user, tenant and auth-email-password features).");
+    }
+    if (seeds.demoAdminFromEnv && deps.hasAuthAdmin) {
+        throw new Error("[runProdApp] seeds.demoAdminFromEnv and auth.admin both seed the admin — keep one.");
+    }
+    const demoTenant = seeds.demoTenant
+        ? resolveTenant(seeds.demoTenant, deps.envSource, "demoTenant")
+        : undefined;
+    const result = [];
+    if (demoTenant) {
+        result.push(async (db) => {
+            await seedTenant(db, demoTenant);
+        });
+    }
+    if (seeds.demoAdminFromEnv) {
+        result.push(buildDemoAdminSeed(seeds.demoAdminFromEnv, demoTenant, deps.envSource));
+    }
+    if (seeds.sysadminFromEnv) {
+        result.push(buildSysadminSeed(seeds.sysadminFromEnv, demoTenant, deps.envSource));
+    }
+    return result;
+}

package/dist/boot-options/stack-boot-requirements.d.ts

@@ -0,0 +1,6 @@
+import { type BootOptionName } from "@cosmicdrift/kumiko-framework/engine";
+import type { RunProdAppOptions } from "../run-prod-app.ts";
+export type StackBootOptionFields = Pick<RunProdAppOptions, "features" | "kms" | "allowPlaintextPii" | BootOptionName>;
+/** Reads `bootRequires` from the raw feature list: dedupe may later drop the
+ *  tagged copy of a feature two stacks share. */
+export declare function assertStackBootRequirements(options: StackBootOptionFields): void;

package/dist/boot-options/stack-boot-requirements.js

@@ -0,0 +1,63 @@
+import { SUBSCRIPTION_PROVIDER_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { EXT_FILE_PROVIDER, } from "@cosmicdrift/kumiko-framework/engine";
+import { CHANNEL_EMAIL_FEATURE } from "./mail-option.js";
+function mountsExtension(features, extensionName) {
+    return features.some((feature) => feature.extensionUsages.some((usage) => usage.extensionName === extensionName));
+}
+// The low-level paths still count until the deprecated wiring is gone: an app
+// that mounts channel-email or a provider by hand has what the option builds.
+const OPTION_CHECKS = {
+    mail: {
+        isSatisfied: (options, mounted) => options.mail !== undefined || mounted.some((f) => f.name === CHANNEL_EMAIL_FEATURE),
+        hint: 'set mail: { transport: "smtp-env" }',
+    },
+    kmsMode: {
+        isSatisfied: (options) => options.kmsMode !== undefined ||
+            options.kms !== undefined ||
+            options.allowPlaintextPii !== undefined,
+        hint: 'set kmsMode: "required" (or { plaintextReason } for a demo)',
+    },
+    fileStorage: {
+        isSatisfied: (options, mounted) => options.fileStorage !== undefined || mountsExtension(mounted, EXT_FILE_PROVIDER),
+        hint: 'set fileStorage: { provider: "auto" }',
+    },
+    billing: {
+        isSatisfied: (options, mounted) => options.billing !== undefined || mountsExtension(mounted, SUBSCRIPTION_PROVIDER_EXTENSION),
+        hint: "set billing: { stripe: { priceToTier }, defaultTier }",
+    },
+    demoMode: {
+        isSatisfied: (options) => options.demoMode !== undefined,
+        hint: "set demoMode: { readOnly }",
+    },
+    seeds: {
+        isSatisfied: (options) => options.seeds !== undefined,
+        hint: "set seeds",
+    },
+    signals: {
+        isSatisfied: (options) => options.signals !== false,
+        hint: "drop signals: false",
+    },
+    rateLimit: {
+        isSatisfied: (options) => options.rateLimit !== false,
+        hint: "drop rateLimit: false",
+    },
+};
+/** Reads `bootRequires` from the raw feature list: dedupe may later drop the
+ *  tagged copy of a feature two stacks share. */
+export function assertStackBootRequirements(options) {
+    const gaps = new Set();
+    for (const feature of options.features) {
+        const requirement = feature.bootRequires;
+        if (requirement === undefined)
+            continue;
+        for (const option of requirement.options) {
+            const check = OPTION_CHECKS[option];
+            if (!check.isSatisfied(options, options.features)) {
+                gaps.add(`  - ${requirement.stack} needs the boot option \`${option}\`: ${check.hint}`);
+            }
+        }
+    }
+    if (gaps.size > 0) {
+        throw new Error(`[runProdApp] stacks in \`features\` need boot options that are not set:\n${[...gaps].join("\n")}`);
+    }
+}

package/dist/build-prod-bundle.d.ts

@@ -1,3 +1,4 @@
+import { type CspHashesFile } from "./csp-hashes.ts";
 export type BuildProdBundleOptions = {
     /** App-Root. Default: process.cwd(). */
     readonly cwd?: string;
@@ -101,4 +102,7 @@ export declare function computeBuildId(manifest: BuildManifest): string;
  *  mit ANSI-Farben. Wird sowohl von `kumiko build` als auch von dem
  *  hoisted `kumiko-build`-Bin verwendet, damit das Output konsistent ist. */
 export declare function formatBuildResult(result: BuildResult, durationMs: number): string;
+/** Hashes every inline script in the HTML files of a finished build output, so the
+ *  CSP only ever allows code that shipped in the artefact. */
+export declare function collectBuildScriptHashes(distDir: string): CspHashesFile;
 export {};

package/dist/build-prod-bundle.js

@@ -38,6 +38,7 @@
 //       <asset>-<hash>.<ext>  ← imported file-loader assets
 //     kumiko-bundled-assets/  ← package.json "kumiko.assets", never served over HTTP
 //     manifest.json           ← logical → hashed-URL mapping
+//     csp-hashes.json         ← sha256 of every inline <script> in the HTML above
 //     <public/* 1:1>          ← favicon.ico, robots.txt, og-image.png, …
 //
 // Cache-Header (von runProdApp gesetzt, nicht hier):
@@ -46,6 +47,14 @@
 //   /index.html, /sw.js     →  no-cache, must-revalidate
 //   /manifest.json          →  no-cache
 //   alles andere (public/)  →  default (auto-cache)
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
 import { createHash } from "node:crypto";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
@@ -54,6 +63,7 @@ import { isPlainObject, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/u
 import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { BUNDLED_ASSETS_DIST_DIR, readBundledAssetDeclarations, resolveBundledAssetSource, } from "./bundled-assets.js";
+import { CSP_HASHES_FILE, inlineScriptHashes } from "./csp-hashes.js";
 import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_DIST_DIR, resolveRendererWebFontsDir, } from "./renderer-web-fonts.js";
 import { canResolveTailwindStylesheet, resolveTailwindCli } from "./resolve-tailwind-cli.js";
 // Bun-Runtime-Check als module-level Konstante: alle Build-Schritte
@@ -180,6 +190,10 @@ export async function buildProdBundle(options = {}) {
     if (buildInfo) {
         await writeFile(join(outDir, "build-info.json"), `${JSON.stringify(buildInfo)}\n`);
     }
+    // 8. CSP script hashes over the finished output (templates and copied
+    //    public/*.html alike), so the runtime default CSP allows exactly the
+    //    inline scripts that shipped.
+    await writeFile(join(outDir, CSP_HASHES_FILE), `${JSON.stringify(collectBuildScriptHashes(outDir), null, 2)}\n`);
     return { outDir, manifest, ...(buildInfo && { buildInfo }) };
 }
 const ENTRY_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
@@ -567,8 +581,8 @@ function isTailwindEngine(candidate) {
 // (same version the CLI would run), not from the app root.
 async function loadTailwindEngine(cliPath, bun) {
     const cliDir = dirname(bun.resolveSync("@tailwindcss/cli/package.json", dirname(cliPath)));
-    const node = await import(bun.resolveSync("@tailwindcss/node", cliDir));
-    const oxide = await import(bun.resolveSync("@tailwindcss/oxide", cliDir));
+    const node = await import(__rewriteRelativeImportExtension(bun.resolveSync("@tailwindcss/node", cliDir)));
+    const oxide = await import(__rewriteRelativeImportExtension(bun.resolveSync("@tailwindcss/oxide", cliDir)));
     const engine = {
         compile: isRecord(node) ? node["compile"] : undefined,
         optimize: isRecord(node) ? node["optimize"] : undefined,
@@ -810,3 +824,28 @@ export function formatBuildResult(result, durationMs) {
     lines.push("");
     return lines.join("\n");
 }
+function htmlFilesUnder(dir) {
+    const files = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isDirectory()) {
+            // Bundled assets are never served over HTTP.
+            if (entry.name === BUNDLED_ASSETS_DIST_DIR)
+                continue;
+            files.push(...htmlFilesUnder(join(dir, entry.name)));
+        }
+        else if (entry.name.endsWith(".html")) {
+            files.push(join(dir, entry.name));
+        }
+    }
+    return files;
+}
+/** Hashes every inline script in the HTML files of a finished build output, so the
+ *  CSP only ever allows code that shipped in the artefact. */
+export function collectBuildScriptHashes(distDir) {
+    const hashes = new Set();
+    for (const file of htmlFilesUnder(distDir)) {
+        for (const hash of inlineScriptHashes(readFileSync(file, "utf8")))
+            hashes.add(hash);
+    }
+    return { scriptSrc: [...hashes].sort() };
+}

package/dist/csp-hashes.d.ts

@@ -0,0 +1,15 @@
+export declare const CSP_HASHES_FILE = "csp-hashes.json";
+export type CspHashesFile = {
+    readonly scriptSrc: readonly string[];
+};
+export declare function inlineScriptHashes(html: string): string[];
+export type CspHashesReadResult = {
+    readonly kind: "found";
+    readonly scriptSrc: readonly string[];
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "invalid";
+    readonly problem: string;
+};
+export declare function parseCspHashes(text: string): CspHashesReadResult;

package/dist/csp-hashes.js

@@ -0,0 +1,46 @@
+import { createHash } from "node:crypto";
+import { isPlainObject, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import { isScriptHash } from "./security-headers.js";
+export const CSP_HASHES_FILE = "csp-hashes.json";
+const INLINE_SCRIPT_PATTERN = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
+const SRC_ATTRIBUTE_PATTERN = /\ssrc\s*=/i;
+const TYPE_ATTRIBUTE_PATTERN = /\stype\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i;
+// Data blocks (application/json, ld+json, templates) never execute, so
+// script-src does not apply to them. Importmaps do, and are governed by it.
+const EXECUTABLE_SCRIPT_TYPES = new Set([
+    "",
+    "module",
+    "importmap",
+    "text/javascript",
+    "application/javascript",
+]);
+function scriptTypeOf(attributes) {
+    const match = TYPE_ATTRIBUTE_PATTERN.exec(attributes);
+    return (match?.[1] ?? match?.[2] ?? match?.[3] ?? "").trim().toLowerCase();
+}
+export function inlineScriptHashes(html) {
+    const hashes = [];
+    for (const match of html.matchAll(INLINE_SCRIPT_PATTERN)) {
+        const attributes = ` ${match[1] ?? ""}`;
+        const content = match[2] ?? "";
+        if (content.length === 0 || SRC_ATTRIBUTE_PATTERN.test(attributes))
+            continue;
+        if (!EXECUTABLE_SCRIPT_TYPES.has(scriptTypeOf(attributes)))
+            continue;
+        hashes.push(`sha256-${createHash("sha256").update(content, "utf8").digest("base64")}`);
+    }
+    return hashes;
+}
+export function parseCspHashes(text) {
+    try {
+        const parsed = parseJsonOrThrow(text, CSP_HASHES_FILE);
+        const scriptSrc = isPlainObject(parsed) ? parsed["scriptSrc"] : undefined;
+        if (!Array.isArray(scriptSrc) || !scriptSrc.every(isScriptHash)) {
+            return { kind: "invalid", problem: '"scriptSrc" must be an array of sha256 hashes' };
+        }
+        return { kind: "found", scriptSrc };
+    }
+    catch (error) {
+        return { kind: "invalid", problem: error instanceof Error ? error.message : String(error) };
+    }
+}

package/dist/index.d.ts

@@ -1,9 +1,18 @@
-export { type BundledAssetDeclaration, type BundledAssetOptions, readBundledAsset, resolveBundledAsset, } from "./bundled-assets.js";
-export { type ComposeFeaturesOptions, composeFeatures } from "./compose-features.js";
-export type { RunBootstrapOptions } from "./run-bootstrap.js";
-export { runBootstrap } from "./run-bootstrap.js";
-export type { AccountUnlockSetup, EmailVerificationSetup, InviteSetup, PageHeadMeta, PageHeadResolver, PageHeadSystemQuery, PasswordResetSetup, ProdAppHandle, ProdSeedFn, RunProdAppAuthOptions, RunProdAppOptions, SignupSetup, } from "./run-prod-app.js";
-export { requireEnv, runProdApp } from "./run-prod-app.js";
-export type { RunWorkerAppOptions, WorkerAppHandle, WorkerWireDeps, } from "./run-worker-app.js";
-export { runWorkerApp } from "./run-worker-app.js";
-export type { SecurityHeadersOption } from "./security-headers.js";
+export type { BillingBootOption } from "./boot-options/billing-option.ts";
+export type { DemoAccountRole, DemoModeNotice, DemoModeOption, } from "./boot-options/demo-mode.ts";
+export type { FileStorageBootOption, FileStorageProviderName, } from "./boot-options/file-storage-option.ts";
+export type { KmsMode } from "./boot-options/kms-mode.ts";
+export type { MailBootOption } from "./boot-options/mail-option.ts";
+export type { SignalsOption } from "./boot-options/process-signals.ts";
+export type { ProdSeedsConfig, ProdSeedTenant } from "./boot-options/seed-shortcuts.ts";
+export { type BundledAssetDeclaration, type BundledAssetOptions, readBundledAsset, resolveBundledAsset, } from "./bundled-assets.ts";
+export { type ComposeFeaturesOptions, composeFeatures } from "./compose-features.ts";
+export type { RateLimitOption } from "./rate-limit-defaults.ts";
+export type { RunBootstrapOptions } from "./run-bootstrap.ts";
+export { runBootstrap } from "./run-bootstrap.ts";
+export type { AccountUnlockSetup, EmailVerificationSetup, InviteSetup, PageHeadMeta, PageHeadResolver, PageHeadSystemQuery, PasswordResetSetup, ProdAppHandle, ProdSeedFn, RunProdAppAuthOptions, RunProdAppOptions, SignupSetup, } from "./run-prod-app.ts";
+export { requireEnv, runProdApp } from "./run-prod-app.ts";
+export type { RunWorkerAppOptions, WorkerAppHandle, WorkerWireDeps, } from "./run-worker-app.ts";
+export { runWorkerApp } from "./run-worker-app.ts";
+export type { CspExtension, CspOption, SecurityHeadersOption } from "./security-headers.ts";
+export { makeSeedCreateFileRef, type SeedCreateFileRef } from "./seed-dispatcher.ts";

package/dist/index.js

@@ -7,3 +7,4 @@ export { composeFeatures } from "./compose-features.js";
 export { runBootstrap } from "./run-bootstrap.js";
 export { requireEnv, runProdApp } from "./run-prod-app.js";
 export { runWorkerApp } from "./run-worker-app.js";
+export { makeSeedCreateFileRef } from "./seed-dispatcher.js";

package/dist/rate-limit-defaults.d.ts

@@ -0,0 +1,19 @@
+import type { ServerOptions } from "@cosmicdrift/kumiko-framework/api";
+type ServerRateLimit = NonNullable<ServerOptions["rateLimit"]>;
+/** `false` per layer or for the whole option switches it off. */
+export type RateLimitOption = false | {
+    readonly global?: false | ServerRateLimit["global"];
+    readonly auth?: false | ServerRateLimit["auth"];
+};
+export declare const DEFAULT_GLOBAL_RATE_LIMIT: {
+    readonly limit: 600;
+    readonly windowSeconds: 60;
+};
+export declare const DEFAULT_AUTH_RATE_LIMIT: {
+    readonly limit: 30;
+    readonly windowSeconds: 60;
+};
+/** Layers the app did not mention keep their default; a layer it did mention
+ *  overrides only the fields it names. */
+export declare function resolveRateLimit(option: RateLimitOption | undefined): ServerRateLimit | undefined;
+export {};

package/dist/rate-limit-defaults.js

@@ -0,0 +1,13 @@
+export const DEFAULT_GLOBAL_RATE_LIMIT = { limit: 600, windowSeconds: 60 };
+export const DEFAULT_AUTH_RATE_LIMIT = { limit: 30, windowSeconds: 60 };
+/** Layers the app did not mention keep their default; a layer it did mention
+ *  overrides only the fields it names. */
+export function resolveRateLimit(option) {
+    if (option === false)
+        return undefined;
+    const { global, auth } = option ?? {};
+    return {
+        ...(global !== false && { global: { ...DEFAULT_GLOBAL_RATE_LIMIT, ...global } }),
+        ...(auth !== false && { auth: { ...DEFAULT_AUTH_RATE_LIMIT, ...auth } }),
+    };
+}

package/dist/run-bootstrap.d.ts

@@ -1,6 +1,6 @@
 import { type BootstrapPlan, type BootstrapReport } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import { type RunProdAppAuthOptions } from "./run-prod-app.js";
-import type { RunWorkerAppOptions } from "./run-worker-app.js";
+import { type RunProdAppAuthOptions } from "./run-prod-app.ts";
+import type { RunWorkerAppOptions } from "./run-worker-app.ts";
 export type RunBootstrapOptions = Omit<RunWorkerAppOptions, "wireComponents" | "includeBundled" | "jobs" | "eventDispatcher" | "metrics"> & BootstrapPlan & {
     /** The same auth block the app passes to runProdApp (`admin` is ignored).
      *  Needs a mounted invite flow: `auth.invite`, or `auth.mail` with