@cosmicdrift/kumiko-server-runtime 0.374.0 → 0.377.0

package/dist/boot-options/resolve-boot-options.js

@@ -1,13 +1,16 @@
 import { BILLING_FOUNDATION_FEATURE } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { DELIVERY_FEATURE } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { FEATURE_TOGGLES_FEATURE } from "@cosmicdrift/kumiko-bundled-features/feature-toggles";
 import { SUBSCRIPTION_STRIPE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/subscription-stripe";
 import { TIER_ENGINE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
 import { resolveBillingOption } from "./billing-option.js";
 import { buildDemoModeRoute, withDemoReadOnlyFetch } from "./demo-mode.js";
+import { resolveFeatureTogglesOption, } from "./feature-toggles-option.js";
 import { FILE_FOUNDATION_FEATURE, resolveFileStorageOption, } from "./file-storage-option.js";
 import { resolveKmsMode } from "./kms-mode.js";
 import { CHANNEL_EMAIL_FEATURE, resolveMailOption } from "./mail-option.js";
 import { resolveSeedShortcuts } from "./seed-shortcuts.js";
+import { stackBootWarnings } from "./stack-boot-requirements.js";
 export function isSeedFnList(seeds) {
     return Array.isArray(seeds);
 }
@@ -22,6 +25,35 @@ function rejectDoubleMount(mounted, option, feature) {
         throw new Error(`[runProdApp] ${option} mounts ${feature} itself — remove it from \`features\` or drop the option.`);
     }
 }
+// The old option was a function the app computed; ignoring it silently would drop an operator kill-switch.
+export function rejectRemovedEffectiveFeatures(options) {
+    if ("effectiveFeatures" in options) {
+        throw new Error("[runProdApp] The `effectiveFeatures` option was removed — operator switches no longer take effect through it. Set `featureToggles: true` (it mounts feature-toggles and layers the switches over the tier resolver) and drop the `feature-toggles` feature from `features`.");
+    }
+}
+function wireFeatureToggles(options, mounted) {
+    rejectRemovedEffectiveFeatures(options);
+    if (options.featureToggles) {
+        rejectDoubleMount(mounted, "featureToggles", FEATURE_TOGGLES_FEATURE);
+        return resolveFeatureTogglesOption();
+    }
+    if (mounted.has(FEATURE_TOGGLES_FEATURE)) {
+        throw new Error(`[runProdApp] ${FEATURE_TOGGLES_FEATURE} is in \`features\` but \`featureToggles\` is not set — its switches would not reach the dispatcher. Set \`featureToggles: true\` and remove the feature from \`features\`.`);
+    }
+    return undefined;
+}
+function warnAboutBootOptions(options) {
+    const bootWarnings = stackBootWarnings(options).map((line) => `stacks in \`features\` expect boot options that are not set:\n${line}`);
+    if (options.runSingleInstance === false &&
+        (options.mail || options.fileStorage || options.featureToggles) &&
+        options.workerMountsFeatures !== true) {
+        bootWarnings.push("runSingleInstance:false — delivery and file jobs run in runWorkerApp. Pass the same mail / fileStorage / featureToggles options there, or set workerMountsFeatures: true if it mounts those features itself.");
+    }
+    if (bootWarnings.length > 0) {
+        // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early
+        console.warn(`[runProdApp] ${bootWarnings.join("\n[runProdApp] ")}`);
+    }
+}
 /** Runs after the env is validated and KEK slots are decrypted, before any
  *  connection: every misconfiguration of the new options fails here. */
 export async function resolveBootOptionWiring(options, envSource) {
@@ -56,14 +88,14 @@ export async function resolveBootOptionWiring(options, envSource) {
         features.push(billing.feature);
         extraRoutes.push(billing.route);
     }
+    const featureToggles = wireFeatureToggles(options, mounted);
+    if (featureToggles)
+        features.push(featureToggles.feature);
     const { demoMode } = options;
     if (demoMode) {
         extraRoutes.push(buildDemoModeRoute(demoMode, envSource));
     }
-    if (options.runSingleInstance === false && (options.mail || options.fileStorage)) {
-        // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early
-        console.warn("[runProdApp] runSingleInstance:false — delivery and file jobs run in runWorkerApp, which does not read mail / fileStorage. Mount the same channel-email and file provider features there.");
-    }
+    warnAboutBootOptions(options);
     const seeds = options.seeds ?? [];
     const shortcutSeeds = isSeedFnList(seeds)
         ? []
@@ -80,6 +112,7 @@ export async function resolveBootOptionWiring(options, envSource) {
         extraRoutes,
         envDefaults,
         kms,
+        ...(featureToggles && { featureToggles }),
         shortcutSeeds,
         customSeeds,
         mailConfigured: options.mail !== undefined,

package/dist/boot-options/stack-boot-requirements.d.ts

@@ -2,5 +2,8 @@ import { type BootOptionName } from "@cosmicdrift/kumiko-framework/engine";
 import type { RunProdAppOptions } from "../run-prod-app.ts";
 export type StackBootOptionFields = Pick<RunProdAppOptions, "features" | "kms" | "allowPlaintextPii" | BootOptionName>;
 /** Reads `bootRequires` from the raw feature list: dedupe may later drop the
- *  tagged copy of a feature two stacks share. */
-export declare function assertStackBootRequirements(options: StackBootOptionFields): void;
+ *  tagged copy of a feature two stacks share. `scope` limits the check to the
+ *  options the calling boot function can set at all (runDevApp has no `signals`). */
+export declare function assertStackBootRequirements(options: StackBootOptionFields, scope?: readonly BootOptionName[]): void;
+/** Requirements a stack marked `severity: "warn"`: logged at boot, never fatal. */
+export declare function stackBootWarnings(options: StackBootOptionFields): string[];

package/dist/boot-options/stack-boot-requirements.js

@@ -25,6 +25,10 @@ const OPTION_CHECKS = {
         isSatisfied: (options, mounted) => options.billing !== undefined || mountsExtension(mounted, SUBSCRIPTION_PROVIDER_EXTENSION),
         hint: "set billing: { stripe: { priceToTier }, defaultTier }",
     },
+    featureToggles: {
+        isSatisfied: (options) => options.featureToggles === true,
+        hint: "set featureToggles: true",
+    },
     demoMode: {
         isSatisfied: (options) => options.demoMode !== undefined,
         hint: "set demoMode: { readOnly }",
@@ -42,22 +46,33 @@ const OPTION_CHECKS = {
         hint: "drop rateLimit: false",
     },
 };
-/** Reads `bootRequires` from the raw feature list: dedupe may later drop the
- *  tagged copy of a feature two stacks share. */
-export function assertStackBootRequirements(options) {
-    const gaps = new Set();
+function unsatisfiedRequirements(options, severity, scope) {
+    const lines = new Set();
     for (const feature of options.features) {
         const requirement = feature.bootRequires;
-        if (requirement === undefined)
+        if (requirement === undefined || (requirement.severity ?? "error") !== severity)
             continue;
         for (const option of requirement.options) {
+            if (scope !== undefined && !scope.includes(option))
+                continue;
             const check = OPTION_CHECKS[option];
             if (!check.isSatisfied(options, options.features)) {
-                gaps.add(`  - ${requirement.stack} needs the boot option \`${option}\`: ${check.hint}`);
+                lines.add(`  - ${requirement.stack} needs the boot option \`${option}\`: ${check.hint}`);
             }
         }
     }
-    if (gaps.size > 0) {
-        throw new Error(`[runProdApp] stacks in \`features\` need boot options that are not set:\n${[...gaps].join("\n")}`);
+    return [...lines];
+}
+/** Reads `bootRequires` from the raw feature list: dedupe may later drop the
+ *  tagged copy of a feature two stacks share. `scope` limits the check to the
+ *  options the calling boot function can set at all (runDevApp has no `signals`). */
+export function assertStackBootRequirements(options, scope) {
+    const gaps = unsatisfiedRequirements(options, "error", scope);
+    if (gaps.length > 0) {
+        throw new Error(`[runProdApp] stacks in \`features\` need boot options that are not set:\n${gaps.join("\n")}`);
     }
 }
+/** Requirements a stack marked `severity: "warn"`: logged at boot, never fatal. */
+export function stackBootWarnings(options) {
+    return unsatisfiedRequirements(options, "warn");
+}

package/dist/build-prod-bundle.d.ts

@@ -4,9 +4,9 @@ export type BuildProdBundleOptions = {
     readonly cwd?: string;
     /** Output-Folder relativ zu cwd. Default: "dist". */
     readonly outDir?: string;
-    /** Stylesheet-Override. Default: erst src/styles.css, dann
-     *  @cosmicdrift/kumiko-renderer-web/styles.css wenn clientEntry da ist.
-     *  `false` deaktiviert die CSS-Pipeline explizit. */
+    /** Stylesheet override. Default: src/styles.css first, then
+     *  @cosmicdrift/kumiko-renderer/web/styles.css when a clientEntry exists.
+     *  `false` disables the CSS pipeline explicitly. */
     readonly stylesheet?: string | false;
 } & ClientEntriesConfig;
 /** One declared client entry, read from package.json `kumiko.clientEntries`.

package/dist/build-prod-bundle.js

@@ -14,7 +14,7 @@
 // Convention for everything else (all optional, missing → skipped):
 //
 //   src/styles.css                   →  Tailwind one-shot
-//                                       (oder fallback auf @cosmicdrift/kumiko-renderer-web/styles.css
+//                                       (oder fallback auf @cosmicdrift/kumiko-renderer/web/styles.css
 //                                        wenn nur clientEntry da ist und kein eigenes CSS)
 //   public/                          →  rsync 1:1 (kein Hash — User-bewusste URLs)
 //   public/index.html | index.html   →  Template, Placeholder-Tags ersetzt:
@@ -60,7 +60,7 @@ import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { isPlainObject, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
-import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { BUNDLED_ASSETS_DIST_DIR, readBundledAssetDeclarations, resolveBundledAssetSource, } from "./bundled-assets.js";
 import { CSP_HASHES_FILE, inlineScriptHashes } from "./csp-hashes.js";
@@ -458,7 +458,7 @@ function resolveStylesheetEntry(cwd, clientEntry, override) {
     if (!hasBun)
         return undefined;
     try {
-        const resolved = Bun.resolveSync("@cosmicdrift/kumiko-renderer-web/styles.css", cwd);
+        const resolved = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", cwd);
         if (!canResolveTailwindStylesheet(resolved, { bun: Bun, cwd })) {
             return undefined;
         }
@@ -483,8 +483,8 @@ export function assertRendererWebShellPresent(css, stylesheet) {
         return;
     throw new Error(`[kumiko build] renderer-web-Fallback-CSS ohne Shell-Klasse "${RENDERER_WEB_SHELL_SENTINEL}" — ` +
         "die DefaultAppShell/WorkspaceShell-Styles fehlen, prod würde unstyled rendern. Meist ist " +
-        "@cosmicdrift/kumiko-renderer-web nicht dort installiert wo Tailwind seine Source scannt. " +
-        'Fix: src/styles.css anlegen mit `@import "@cosmicdrift/kumiko-renderer-web/styles.css";` ' +
+        "@cosmicdrift/kumiko-renderer/web nicht dort installiert wo Tailwind seine Source scannt. " +
+        'Fix: src/styles.css anlegen mit `@import "@cosmicdrift/kumiko-renderer/web/styles.css";` ' +
         '(+ `@source "./**/*.{ts,tsx}";` um auch eigene Komponenten zu scannen).');
 }
 // The compiled CSS points at absolute /assets/kumiko/fonts/<file>.woff2 URLs

package/dist/extra-routes-deps.d.ts

@@ -2,6 +2,7 @@ import type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
+import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 export type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
@@ -17,6 +18,10 @@ export type SystemWireDeps = {
     /** Feature-registry — e.g. for plugin-lookups via
      *  `registry.getExtensionUsages("subscriptionProvider")`. */
     readonly registry: Registry;
+    /** The boot's master key keyring; absent when no `KUMIKO_SECRETS_MASTER_KEY_V<n>` is set. */
+    readonly masterKeyProvider?: MasterKeyProvider;
+    /** Cipher for `encrypted: true` config keys, same instance and DEK cache as the handlers use. */
+    readonly configEncryption?: EnvelopeCipher;
     /** Same contract as `ctx.metricsFor`: unregistered metric names no-op. */
     readonly metricsFor: (featureName: string) => MetricsHandle;
     /** Writes through the /api/*-command-dispatcher (same idempotency/job

package/dist/index.d.ts

@@ -1,11 +1,14 @@
 export { type BillingBootOption, resolveBillingOption } from "./boot-options/billing-option.ts";
-export type { DemoAccountRole, DemoModeNotice, DemoModeOption, } from "./boot-options/demo-mode.ts";
+export type { DemoAccountEntry, DemoAccountRole, DemoModeNotice, DemoModeOption, } from "./boot-options/demo-mode.ts";
 export { buildDemoModeRoute, withDemoReadOnlyFetch, } from "./boot-options/demo-mode.ts";
 export type { FileStorageBootOption, FileStorageProviderName, } from "./boot-options/file-storage-option.ts";
 export type { KmsMode } from "./boot-options/kms-mode.ts";
-export type { MailBootOption } from "./boot-options/mail-option.ts";
+export type { MailBootOption, MailRecipientScope } from "./boot-options/mail-option.ts";
+export { withBootOptionEnvBlocks } from "./boot-options/option-env-schema.ts";
 export type { SignalsOption } from "./boot-options/process-signals.ts";
+export { type BootOptionFields, type BootOptionWiring, isSeedFnList, rejectRemovedEffectiveFeatures, resolveBootOptionWiring, } from "./boot-options/resolve-boot-options.ts";
 export type { ProdSeedsConfig, ProdSeedTenant } from "./boot-options/seed-shortcuts.ts";
+export { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.ts";
 export { type BundledAssetDeclaration, type BundledAssetOptions, readBundledAsset, resolveBundledAsset, } from "./bundled-assets.ts";
 export { type ComposeFeaturesOptions, composeFeatures } from "./compose-features.ts";
 export type { RateLimitOption } from "./rate-limit-defaults.ts";

package/dist/index.js

@@ -4,6 +4,9 @@
 // Dev-Tooling mehr in ihre node_modules.
 export { resolveBillingOption } from "./boot-options/billing-option.js";
 export { buildDemoModeRoute, withDemoReadOnlyFetch, } from "./boot-options/demo-mode.js";
+export { withBootOptionEnvBlocks } from "./boot-options/option-env-schema.js";
+export { isSeedFnList, rejectRemovedEffectiveFeatures, resolveBootOptionWiring, } from "./boot-options/resolve-boot-options.js";
+export { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.js";
 export { readBundledAsset, resolveBundledAsset, } from "./bundled-assets.js";
 export { composeFeatures } from "./compose-features.js";
 export { runBootstrap } from "./run-bootstrap.js";

package/dist/renderer-web-fonts.js

@@ -17,7 +17,7 @@ export function resolveRendererWebFontsDir(searchFrom) {
         return undefined;
     for (const from of searchFrom) {
         try {
-            const stylesheet = Bun.resolveSync("@cosmicdrift/kumiko-renderer-web/styles.css", from);
+            const stylesheet = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", from);
             return join(dirname(stylesheet), "fonts");
         }
         catch {

package/dist/request-bound-system-query.d.ts

@@ -1,6 +1,6 @@
 import { type ClientIpResolver } from "@cosmicdrift/kumiko-framework/api";
 import { type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
+import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 export type QueryDispatcher = {
     readonly query: (type: string, payload: unknown, user: SessionUser) => Promise<unknown>;
 };

package/dist/resolve-tailwind-cli.d.ts

@@ -9,6 +9,6 @@ export declare function resolveTailwindCli(deps: ResolveTailwindCliDeps): string
 /** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
  *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
  *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer-web` outside a hoisted node_modules tree. */
+ *  `@cosmicdrift/kumiko-renderer/web` outside a hoisted node_modules tree. */
 export declare function canResolveTailwindStylesheet(entryCss: string, deps: ResolveTailwindCliDeps): boolean;
 export {};

package/dist/resolve-tailwind-cli.js

@@ -22,7 +22,7 @@ export function resolveTailwindCli(deps) {
 /** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
  *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
  *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer-web` outside a hoisted node_modules tree. */
+ *  `@cosmicdrift/kumiko-renderer/web` outside a hoisted node_modules tree. */
 export function canResolveTailwindStylesheet(entryCss, deps) {
     if (deps.bun === undefined)
         return false;

package/dist/run-prod-app-boot-context.d.ts

@@ -14,6 +14,8 @@ export declare function addConfigAccessorFactory<T extends {
     readonly configResolver?: ConfigResolver;
 }>(resolved: T, registry: Registry): T;
 export declare function loggerFromExtraContext(extraContext: Record<string, unknown>): Logger | undefined;
+/** Config key (`feature:config:name`) to value; wins over the key's env variable. */
+export type ConfigOverridesInput = Readonly<Record<string, string | number | boolean>>;
 type BootExtraContextOptions = {
     readonly db: DbConnection;
     readonly features: readonly FeatureDefinition[];
@@ -33,6 +35,8 @@ type BootExtraContextOptions = {
     readonly log?: Logger;
     /** Signs `unsubscribe: true` notifications' mail links; see runProdApp `unsubscribe`. */
     readonly unsubscribeLinks?: UnsubscribeLinkConfig;
+    /** App-level config values (tenant model, branding, seo ...) above the env bridge. */
+    readonly appOverrides?: ConfigOverridesInput;
 };
 export declare function buildBootExtraContext(opts: BootExtraContextOptions): Record<string, unknown>;
 /** Die Auth-Felder die resolveAuthMail liest/normalisiert — beide

package/dist/run-prod-app-boot-context.js

@@ -3,7 +3,7 @@ import { makeAuthPaths, } from "@cosmicdrift/kumiko-bundled-features/auth-email-
 import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { bindMfaRevokeAllOtherSessionsFromFeature, bindRevokeAllPatTokensFromFeature, } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
 import { createSmtpTransportFromEnv } from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import { buildEnvConfigOverrides, createConfigAccessorFactory, createConfigResolver, } from "@cosmicdrift/kumiko-bundled-features/config";
+import { buildEnvConfigOverrides, createConfigAccessorFactory, createConfigResolver, validateAppOverrides, } from "@cosmicdrift/kumiko-bundled-features/config";
 import { collectChannels, createDeliveryNotifyFactory, createDeliveryService, DELIVERY_FEATURE, } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { bindPatAutoRevokeOnPasswordChangeFromFeature, revokeAllPatTokensForUser, } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import { createSecretsContext, SECRETS_FEATURE_NAME, } from "@cosmicdrift/kumiko-bundled-features/secrets";
@@ -23,9 +23,13 @@ import { resolveBootCrypto } from "./boot/boot-crypto.js";
 export function addConfigAccessorFactory(resolved, registry) {
     if (!resolved.configResolver)
         return resolved;
+    // Both keys, always overriding an app-supplied value: the factory must derive from the
+    // effective resolver (fw#3313); the underscore alias stays until the next major.
+    const configAccessorFactory = createConfigAccessorFactory(registry, resolved.configResolver);
     return {
         ...resolved,
-        _configAccessorFactory: createConfigAccessorFactory(registry, resolved.configResolver),
+        configAccessorFactory,
+        _configAccessorFactory: configAccessorFactory,
     };
 }
 // Framework-Default-Provider für den AppContext — gleicher Mechanismus wie
@@ -117,9 +121,12 @@ function bootCryptoContext(crypto) {
         ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
     };
 }
-function createBootConfigResolver(registry, envSource, crypto) {
+function createBootConfigResolver(registry, envSource, crypto, appOverrides) {
+    const envOverrides = buildEnvConfigOverrides(registry, envSource);
     return createConfigResolver({
-        appOverrides: buildEnvConfigOverrides(registry, envSource),
+        appOverrides: appOverrides
+            ? new Map([...envOverrides, ...validateAppOverrides(registry, appOverrides)])
+            : envOverrides,
         ...(crypto.configCipher && { cipher: crypto.configCipher }),
     });
 }
@@ -128,7 +135,7 @@ function createBootConfigResolver(registry, envSource, crypto) {
 // stays auth-only.
 function resolveDeliveryConfigResolver(opts, hasDeliveryFeature, crypto) {
     return opts.hasAuth || hasDeliveryFeature
-        ? createBootConfigResolver(opts.registry, opts.envSource, crypto)
+        ? createBootConfigResolver(opts.registry, opts.envSource, crypto, opts.appOverrides)
         : undefined;
 }
 function bootDeliveryContext(opts, parts) {

package/dist/run-prod-app-static-files.js

@@ -1,7 +1,7 @@
 import { join, resolve, sep } from "node:path";
 import { cachedResponse, computeStrongEtag, computeWeakEtag, createClientIpResolver, } from "@cosmicdrift/kumiko-framework/api";
 import { rankPreferredLocales } from "@cosmicdrift/kumiko-framework/i18n";
-import { resolveAndInjectPageHead } from "@cosmicdrift/kumiko-headless/apex";
+import { resolveAndInjectPageHead } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import { errorCodeOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { ASSETS_DIR } from "./build-prod-bundle.js";
 import { BUNDLED_ASSETS_DIST_DIR } from "./bundled-assets.js";

package/dist/run-prod-app.d.ts

@@ -3,15 +3,14 @@ import { type AccountLockoutOptions, type AccountUnlockOptions, type AuthMailLoc
 import { type SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import { type ExtraRouteDefinition, type KumikoServeEnv, type PostAuthLandingResolver, type SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import { type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import { type EffectiveFeaturesResolver, type FeatureDefinition, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureDefinition, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import { type AllInOneEntrypoint, type ApiEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
-import { type ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
-import { type DryRunEnvMode } from "@cosmicdrift/kumiko-framework/env/dry-run";
+import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
 import { type ObservabilityOptions, type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
-import type { PageHeadMeta, PageHeadResolver, PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
+import type { PageHeadMeta, PageHeadResolver, PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import { Redis } from "ioredis";
 import type { BillingBootOption } from "./boot-options/billing-option.ts";
 import type { DemoModeOption } from "./boot-options/demo-mode.ts";
@@ -23,15 +22,15 @@ import type { ProdSeedsConfig } from "./boot-options/seed-shortcuts.ts";
 import { type SystemWireDeps } from "./extra-routes-deps.ts";
 import { type RateLimitOption } from "./rate-limit-defaults.ts";
 import { type UnsubscribeOption } from "./resolve-unsubscribe-wiring.ts";
+import { type ConfigOverridesInput } from "./run-prod-app-boot-context.ts";
 import { type SecurityHeadersOption } from "./security-headers.ts";
 import { type SeedCreateFileRef } from "./seed-dispatcher.ts";
+export { parseRunMode } from "./boot/env-gate.ts";
 export { buildBunServeOptions } from "./bun-serve-options.ts";
 export { resolveUnsubscribeWiring, type UnsubscribeOption, } from "./resolve-unsubscribe-wiring.ts";
-export { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.ts";
+export { addConfigAccessorFactory, buildBootExtraContext, type ConfigOverridesInput, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.ts";
 export { staticCachePolicy } from "./run-prod-app-static-files.ts";
 export declare function requireEnv(name: string, src?: Record<string, string | undefined>, context?: string): string;
-type RunMode = DryRunEnvMode;
-export declare function parseRunMode(raw: string | undefined): RunMode | null;
 /** Wrapper API for the password-reset flow.
  *
  *  Since the delivery migration PasswordResetOptions carries `appUrl`
@@ -192,6 +191,9 @@ export type ProdSeedFn = (deps: {
     /** Stores bytes as a fileRef of `tenantId` (same validation and storage
      *  layout as POST /files) without a helper write handler. */
     createFileRef: SeedCreateFileRef;
+    /** Present when a master key is configured: decrypts the same keys the handlers do, so a seed need not resolve the KEK itself. */
+    masterKeyProvider?: import("@cosmicdrift/kumiko-framework/secrets").MasterKeyProvider;
+    configEncryption?: import("@cosmicdrift/kumiko-framework/secrets").EnvelopeCipher;
 }) => Promise<void>;
 /** Boot-Time-Deps die `extraContext` + `anonymousAccess` Factories als
  *  Argument bekommen. Closure dann in der returned Config (z.B. ein
@@ -206,6 +208,9 @@ export type RunProdAppDeps = {
     readonly sseBroker: SseBroker;
     /** The env the boot runs on: process env or `envSource`, with the boot-option defaults (e.g. `fileStorage`) underneath. */
     readonly env: Readonly<Record<string, string | undefined>>;
+    /** Present when a master key is configured; the same keyring the handlers use. */
+    readonly masterKeyProvider?: import("@cosmicdrift/kumiko-framework/secrets").MasterKeyProvider;
+    readonly configEncryption?: import("@cosmicdrift/kumiko-framework/secrets").EnvelopeCipher;
 };
 export type AnonymousAccessOption = import("@cosmicdrift/kumiko-framework/api").AnonymousAccessConfig | ((deps: RunProdAppDeps) => import("@cosmicdrift/kumiko-framework/api").AnonymousAccessConfig);
 export type ExtraContextOption = Record<string, unknown> | ((deps: RunProdAppDeps) => Record<string, unknown>);
@@ -394,6 +399,9 @@ export type RunProdAppOptions = {
      *  @example
      *  billing: { stripe: { priceToTier: { [env.STRIPE_PRICE_PRO]: "pro" } }, defaultTier: "free" } */
     readonly billing?: BillingBootOption;
+    /** Global operator switches: mounts `feature-toggles` and layers them over the tier resolver, so
+     *  an operator can switch a feature off for every tenant. */
+    readonly featureToggles?: boolean;
     /** Live-demo mode: read-only gate in the fetch chain plus the anonymous
      *  `GET /demo-mode` route. See `DemoModeOption`.
      *  @example
@@ -418,6 +426,9 @@ export type RunProdAppOptions = {
      *  jobs and queued delivery attempts (email/push/chat) stay pending and the
      *  read side stays empty (2026-06-11 incident class). */
     readonly runSingleInstance?: boolean;
+    /** With `runSingleInstance: false`: the worker mounts the same mail / fileStorage features
+     *  (its own boot options or by hand), so the boot warning about them stays silent. */
+    readonly workerMountsFeatures?: boolean;
     /** Job-Block. Wenn das Feature `r.job(...)` registriert, wird er
      *  automatisch verdrahtet (siehe runSingleInstance). */
     readonly jobs?: {
@@ -474,11 +485,10 @@ export type RunProdAppOptions = {
      *  the fetch-handler directly (Bun.serve isn't available under vitest +
      *  node), then call handle.listen() manually if needed. */
     readonly autoListen?: boolean;
-    /** Per-tenant feature resolver, passed to the dispatcher.
-     *  @deprecated Removed in the next release. `createTierEngineFeature({ tierMap })`
-     *  (or `composeSaasStack`) builds the resolver at boot, and prod-only features
-     *  come from the `mail`, `fileStorage` and `billing` options. */
-    readonly effectiveFeatures?: EffectiveFeaturesResolver;
+    /** App-level config values (tenant model, branding, seo ...) keyed by the qualified config
+     *  key. Validated against the registered keys at boot; they win over the key's env variable
+     *  and sit below tenant and user values. */
+    readonly appOverrides?: ConfigOverridesInput;
     /** Composed Zod-schema for env-validation (from `composeEnvSchema({
      *  core, features, extend })` in @cosmicdrift/kumiko-framework/env):
      *  - `process.env` is parsed against it BEFORE any boot work; missing