@cosmicdrift/kumiko-server-runtime 0.386.0 → 0.388.0

package/dist/run-prod-app.js

@@ -1,119 +1,61 @@
 /// <reference types="bun-types" preserve="true" />
-// runProdApp — production-grade Bootstrap-Wrapper für Kumiko-Apps.
+// runProdApp — production-grade bootstrap wrapper for Kumiko apps.
 //
-// Symmetrisch zu runDevApp, aber:
-//   - DATABASE_URL / REDIS_URL / JWT_SECRET aus env (fail-fast bei Boot,
-//     keine ephemeralen Test-DBs)
-//   - Hard Schema-Drift-Gate: prüft kumiko/migrations vs. _kumiko_migrations
-//     + tableExists für jede erwartete Tabelle. KEIN Auto-CREATE TABLE im
-//     Boot — Migration ist ein CI-Step (`bun kumiko schema apply`), Boot
-//     validiert nur. Verhindert Race-Conditions bei Multi-Replica-Deploys
-//     + macht Schema-Stand reviewbar in der Pull-Request.
-//   - Idempotente Seeds: laufen nur wenn DB leer (über `isDbEmpty`-Probe
-//     pro Seed). Re-Boots nach erstem Seed sind no-op.
-//   - HTTP-Server via Bun.serve mit graceful SIGTERM/SIGINT → drain().
-//   - Auth-Routes + bundled-features auto-mix wenn `auth:` gesetzt
-//     (gleiche Logik wie runDevApp).
+// Symmetric with runDevApp, but:
+//   - DATABASE_URL / REDIS_URL / JWT_SECRET come from env (fail-fast at boot;
+//     no ephemeral test databases)
+//   - Hard schema-drift gate: checks kumiko/migrations against
+//     _kumiko_migrations and verifies every expected table with tableExists.
+//     Boot never runs CREATE TABLE automatically; migrations are applied by
+//     CI (`bun kumiko schema apply`) and boot only validates them. This avoids
+//     races in multi-replica deployments and keeps schema state reviewable.
+//   - Idempotent seeds run only when the database is empty, using an
+//     `isDbEmpty` probe per seed. Reboots after the first seed are no-ops.
+//   - HTTP server via Bun.serve with graceful SIGTERM/SIGINT → drain().
+//   - Auth routes and bundled features are mixed automatically when `auth:` is
+//     set, using the same logic as runDevApp.
 //
-// App-Author schreibt:
+// App authors write:
 //   await runProdApp({ features, envSchema, auth, anonymousAccess, seeds });
 //
-// Container/Coolify setzt:
+// Container/Coolify sets:
 //   DATABASE_URL=postgresql://...
 //   REDIS_URL=redis://...
-//   JWT_SECRET=<random-32+>  (always required — also signs the password-
-//     reset/email-verification HMAC tokens, a separate non-rotating family)
-//     — additionally, for zero-downtime rotation of the session-JWT
-//     signing key specifically:
+//   JWT_SECRET=<random-32+>  (always required — also signs password-reset and
+//     email-verification HMAC tokens, a separate non-rotating token family)
+//     — additionally, for zero-downtime rotation of the session-JWT signing
+//     key specifically:
 //   JWT_SECRET_V1=<random-32+>  (repeat _V2, _V3, ... per rotation)
 //   JWT_SECRET_CURRENT_VERSION=1  (which V<n> signs new tokens; the others
 //     still verify in-flight tokens until they expire)
-//   Adopting rotation for the first time (no JWT_SECRET_V<n> set yet): the
-//   plain JWT_SECRET above stays set and is carried into the keyring as a
-//   verify-only legacy key (loadJwtSecretOrKeyring), so sessions signed
-//   before the cutover keep verifying — no mass-logout at adoption. This
-//   legacy key never expires on its own (boot logs a warning while it's
-//   present) — once max token TTL has elapsed since cutover, unset
-//   JWT_SECRET to retire it. Check first whether an app relies on the
-//   auth.mail convenience default for passwordReset/emailVerification
-//   hmacSecret (falls back to this same JWT_SECRET) before unsetting it.
+//   When adopting rotation for the first time (with no JWT_SECRET_V<n> set),
+//   the plain JWT_SECRET remains set and is carried into the keyring as a
+//   verify-only legacy key (loadJwtSecretOrKeyring), so sessions signed before
+//   cutover continue to verify without a mass logout. This legacy key never
+//   expires automatically; boot logs a warning while it is present. Once the
+//   maximum token TTL has elapsed since cutover, unset JWT_SECRET to retire
+//   it. First check whether the app relies on auth.mail's convenience default
+//   for passwordReset/emailVerification hmacSecret, which falls back to this
+//   same JWT_SECRET.
 //   PORT=3000
 //   KUMIKO_INSTANCE_ID=<stable per replica>
-import { AuthErrors, AuthHandlers, AuthQueries, } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import { seedAdminGuarded, } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
-import { EXT_SESSION_STORE, EXT_TOKEN_VERIFIER, resolveAnonymousAccessFromRegistry, resolveTokenVerifier, } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
-import { AUTH_MFA_FEATURE, AuthMfaHandlers, bindMfaTokenSecretsFromFeature, } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
-import { PAT_FEATURE, patRateLimitFromFeature, } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
-import { SESSIONS_FEATURE } from "@cosmicdrift/kumiko-bundled-features/sessions";
-import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
-import { UserQueries } from "@cosmicdrift/kumiko-bundled-features/user";
-import { createDefaultSseBroker, createRedisLoginRateLimiter, loadJwtSecretOrKeyring, TRUSTED_PROXY_HOPS_ENV, withFileProviderResolver, } from "@cosmicdrift/kumiko-framework/api";
-import { configureBlindIndexKey, configurePiiSubjectKms, } from "@cosmicdrift/kumiko-framework/crypto";
-import { configureEntityFieldEncryption, createDbConnection, dbConnectionOptionsFromEnv, outsideTransactionPoolOptionsFromEnv, serverTimeoutOptionsFromEnv, } from "@cosmicdrift/kumiko-framework/db";
-import { collectWriteHandlerQns, createRegistry, findTierResolverUsage, requireTierResolverPlugin, validateAppCustomScreenWriteQns, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
-import { createAllInOneEntrypoint, createApiEntrypoint, } from "@cosmicdrift/kumiko-framework/entrypoint";
-import { createEsOperationsTable, createSeedMigrationContext, runPendingSeedMigrations, } from "@cosmicdrift/kumiko-framework/es-ops";
 import { assertSeedModeNotInProduction } from "@cosmicdrift/kumiko-framework/event-store";
-import { createFallbackLogger, setProcessLogger } from "@cosmicdrift/kumiko-framework/logging";
-import { assertKumikoSchemaCurrent, SchemaDriftError, } from "@cosmicdrift/kumiko-framework/migrations";
-import { createMetricsForFactory, } from "@cosmicdrift/kumiko-framework/observability";
-import { createDispatcher, createEntityCache, createEventDedup, createIdempotencyGuard, createUnlimitedRateLimitResolver, flushEscapeHatchAudits, } from "@cosmicdrift/kumiko-framework/pipeline";
-import { createRedisCacheSyncBus, logRedisConnectionState, redisClientOptionsFromEnv, } from "@cosmicdrift/kumiko-framework/redis";
-import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
-import { Redis } from "ioredis";
-import { applyBootSeeds } from "./boot/apply-boot-seeds.js";
-import { resolveBootCrypto } from "./boot/boot-crypto.js";
 import { runEnvGate } from "./boot/env-gate.js";
-import { jobRunLoggerCallbacks } from "./boot/job-run-logger.js";
-import { startPiiEventBackfillOnBoot } from "./boot/pii-event-backfill-on-boot.js";
-import { recordAppStartedOnBoot } from "./boot/record-app-started-on-boot.js";
-import { waitForDatabase, waitUntilDatabaseReachable } from "./boot/wait-for-database.js";
-import { installShutdownSignals } from "./boot-options/process-signals.js";
-import { resolveBootOptionWiring } from "./boot-options/resolve-boot-options.js";
-import { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.js";
-import { buildBunServeOptions, resolveDerivedMaxRequestBodySize } from "./bun-serve-options.js";
-import { buildComposeAuthOptions, composeFeatures } from "./compose-features.js";
-import { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "./extra-routes-deps.js";
-import { installFatalErrorHandlers } from "./fatal-error-handlers.js";
-import { assertPiiBootInvariants } from "./pii-boot-gate.js";
+import { buildEffectiveFeaturesResolver } from "./boot/shared-boot-steps.js";
 import { installProcessLogger, uninstallProcessLogger } from "./process-logger.js";
-import { resolveRateLimit } from "./rate-limit-defaults.js";
-import { resolveAuthPublicOrigin } from "./resolve-auth-public-origin.js";
-import { resolveUnsubscribeWiring } from "./resolve-unsubscribe-wiring.js";
-import { addConfigAccessorFactory, buildBootExtraContext, buildProdSessionAuth, loggerFromExtraContext, resolveAuthMail, wireProdPatAutoRevoke, } from "./run-prod-app-boot-context.js";
-import { buildStaticFallback, resolveCspScriptHashes, resolveHostDispatchScriptHashes, } from "./run-prod-app-static-files.js";
-import { withSecurityHeaders } from "./security-headers.js";
-import { makeSeedCreateFileRef, withSeedErrorContext, } from "./seed-dispatcher.js";
-import { assertSessionBootInvariants } from "./session-boot-gate.js";
-import { shouldWireProdSessions } from "./session-wiring.js";
-import { resolveTrustedProxyHops } from "./trusted-proxy-hops.js";
-import { stripNoRouteMatchHeader } from "./try-hono-first.js";
+import { wireProdAuth } from "./run-prod-app-auth.js";
+import { composeProdFeatures, resolveProdBootConfig, runWithBootAbortCleanups, } from "./run-prod-app-config.js";
+import { assertProdSchemaCurrent, connectProdDependencies } from "./run-prod-app-connections.js";
+import { buildProdEntrypointOptions, createProdEntrypoint, registerProdShutdownHooks, runProdWireHook, startProdBackgroundWork, } from "./run-prod-app-entrypoint.js";
+import { buildProdFetchHandler, createProdAppHandle } from "./run-prod-app-handle.js";
+import { buildProdRequestContext } from "./run-prod-app-request-context.js";
+import { runProdBootSeeds } from "./run-prod-app-seeds.js";
 export { parseRunMode } from "./boot/env-gate.js";
 export { buildBunServeOptions } from "./bun-serve-options.js";
+export { requireEnv } from "./require-env.js";
 export { resolveUnsubscribeWiring, } from "./resolve-unsubscribe-wiring.js";
 export { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
 export { staticCachePolicy } from "./run-prod-app-static-files.js";
-// Strict env-var read. Throws with a clear hint when missing — better
-// than discovering a Postgres-connection-refused 30s into the boot.
-// `src` defaults to process.env but is threaded from the caller's envSource
-// so the boot-path reads the SAME env-quelle that was validated above —
-// injected dummies in test-mode must not silently fall back to process.env.
-export function requireEnv(name, src = process.env, context = "runProdApp") {
-    const value = src[name];
-    if (value === undefined || value === "") {
-        const advice = context === "runProdApp"
-            ? "Set it in your container env / .env.production / Coolify secrets."
-            : "Set it in your .env / shell before running the dev server.";
-        throw new Error(`${context}: required env var "${name}" is missing or empty. ${advice}`);
-    }
-    return value;
-}
-// Optional env helper — returns undefined for missing, string for set.
-// Used for KUMIKO_INSTANCE_ID, JWT_ISSUER and other "nice to have" knobs.
-function readEnv(name, src = process.env) {
-    const value = src[name];
-    return value === undefined || value === "" ? undefined : value;
-}
 // Returned from runProdApp when KUMIKO_DRY_RUN_ENV is set AND envSource
 // was passed (= test-mode). The handle is intentionally inert — listen()
 // and stop() are no-ops; tests inspect the dry-run console output and
@@ -133,35 +75,10 @@ function makeDryRunHandle() {
         stop: noop,
     };
 }
-const SERVER_GRACEFUL_STOP_MS = 10_000;
-// stop() without force waits for open connections (SSE never ends on its own); force-close after the grace period.
-async function stopServerGracefully(server) {
-    let graceTimer;
-    const graceElapsed = new Promise((resolve) => {
-        graceTimer = setTimeout(resolve, SERVER_GRACEFUL_STOP_MS);
-    });
-    try {
-        await Promise.race([server.stop(), graceElapsed]);
-    }
-    finally {
-        clearTimeout(graceTimer);
-    }
-    await server.stop(true);
-}
-let warnedLegacyJwtSecret = false;
-function warnLegacyJwtSecretOnce() {
-    // skip: already warned once this process — avoid log spam on every boot path.
-    if (warnedLegacyJwtSecret)
-        return;
-    warnedLegacyJwtSecret = true;
-    createFallbackLogger("runProdApp").warn("JWT keyring carries a legacy (pre-rotation) verify-only key — " +
-        "it never expires on its own. JWT_SECRET remains a required env (hmacSecret " +
-        "fallback + boot requireEnv). To stop verifying with the pre-rotation secret: " +
-        "set auth.mail.hmacSecret explicitly, then rotate JWT_SECRET to a fresh value " +
-        "that is no longer present in any in-flight token (see resolveAuthMail / " +
-        "loadJwtSecretOrKeyring).");
-}
 export async function runProdApp(options) {
+    return runWithBootAbortCleanups((register) => bootProdApp(options, register));
+}
+async function bootProdApp(options, registerAbortCleanup) {
     assertSeedModeNotInProduction();
     // 0. Env-Schema validation + dry-run modes. Runs FIRST so:
     //    - operators can introspect env-requirements without a real boot
@@ -185,109 +102,10 @@ export async function runProdApp(options) {
         return makeDryRunHandle();
     const { runMode, decryptedEnvSource } = envGate;
     const log = installProcessLogger(options.extraContext, "runProdApp");
-    // Stacks whose boot options are missing and the declarative boot options
-    // (mail, kmsMode, fileStorage, billing, demoMode, seed shortcuts) fail here, before any connection. Their defaults sit under
-    // the env so an explicitly set variable wins.
-    assertStackBootRequirements(options);
-    const bootOptionWiring = await resolveBootOptionWiring(options, decryptedEnvSource);
-    const envSource = Object.keys(bootOptionWiring.envDefaults).length > 0
-        ? { ...bootOptionWiring.envDefaults, ...decryptedEnvSource }
-        : decryptedEnvSource;
-    const bootKms = bootOptionWiring.kms;
-    // 1. Polyfill before anything else — feature code references Temporal.
-    const { ensureTemporalPolyfill } = await import("@cosmicdrift/kumiko-framework/time");
-    await ensureTemporalPolyfill();
-    // 2. Env-vars: fail-fast. Better a 0s boot crash with a clear error
-    //    than a 30s timeout chasing a Postgres connection that was never
-    //    configured.
-    const databaseUrl = requireEnv("DATABASE_URL", envSource);
-    const redisUrl = requireEnv("REDIS_URL", envSource);
-    // JWT_SECRET stays mandatory (also the resolveAuthMail hmacSecret
-    // fallback below — a separate, non-rotating HMAC token family, not the
-    // session JWT). jwtSecretOrKeyring is the OPTIONAL upgrade: set
-    // JWT_SECRET_V<n> + JWT_SECRET_CURRENT_VERSION for zero-downtime
-    // rotation of the session-JWT signing key — see loadJwtSecretOrKeyring.
-    const jwtSecret = requireEnv("JWT_SECRET", envSource);
-    const jwtSecretOrKeyring = loadJwtSecretOrKeyring(envSource);
-    if (typeof jwtSecretOrKeyring === "object" && Object.hasOwn(jwtSecretOrKeyring.keys, "legacy")) {
-        // Once per process — JWT_SECRET stays a required env (requireEnv above +
-        // resolveAuthMail hmacSecret fallback). Retiring the *legacy verify key*
-        // means setting auth.mail.hmacSecret explicitly and rotating JWT_SECRET
-        // to a fresh value that is no longer in any in-flight token; unsetting
-        // JWT_SECRET entirely hard-crashes boot.
-        warnLegacyJwtSecretOnce();
-    }
-    const jwtIssuer = readEnv("JWT_ISSUER", envSource);
-    const instanceId = readEnv("KUMIKO_INSTANCE_ID", envSource);
-    // kumiko-framework#1539 — options.auth.trustedProxyHops wins; falls back
-    // to the env var so ops can close the XFF-spoofing hole per-deployment
-    // without a code change (mirrors instanceId's env-first pattern above).
-    const trustedProxyHops = resolveTrustedProxyHops({
-        option: options.trustedProxyHops,
-        authOption: options.auth?.trustedProxyHops,
-        envValue: readEnv(TRUSTED_PROXY_HOPS_ENV, envSource),
-        nodeEnv: process.env["NODE_ENV"],
-    });
-    if (trustedProxyHops === undefined) {
-        // With 0 hops every request appears to come from the proxy pod, so all IP-keyed
-        // rate limiters collapse into one shared bucket behind a reverse proxy.
-        log.warn(`trustedProxyHops / ${TRUSTED_PROXY_HOPS_ENV} is not set; client IP falls back to the socket address. ` +
-            "Behind a reverse proxy all clients share one rate-limit bucket, so the default L1/L2 limits throttle the whole site at once.");
-    }
-    const resolvedRateLimit = resolveRateLimit(options.rateLimit);
-    const port = options.port ?? Number.parseInt(envSource["PORT"] ?? "3000", 10);
-    log.info(`booting Kumiko stack on port ${port}`);
-    // auth.mail → expandiert in die expliziten Flow-Felder, bevor sie sowohl
-    // die Feature-Side (buildComposeAuthOptions) als auch das Routes-Fragment
-    // unten speisen. Ab hier IMMER effectiveAuth statt options.auth lesen.
-    const effectiveAuth = options.auth
-        ? resolveAuthMail(options.auth, jwtSecret, envSource, {
-            mailConfigured: bootOptionWiring.mailConfigured,
-        })
-        : undefined;
-    const authPublicOrigin = effectiveAuth
-        ? resolveAuthPublicOrigin(effectiveAuth, envSource, (message) => {
-            log.warn(message);
-        })
-        : undefined;
-    const { unsubscribeLinks, unsubscribeRoutes } = resolveUnsubscribeWiring({
-        unsubscribe: options.unsubscribe,
-        publicOrigin: effectiveAuth?.publicOrigin,
-        mailBaseUrl: effectiveAuth?.mail?.baseUrl,
-        envSource,
-        warn: (message) => createFallbackLogger("runProdApp").warn(message),
-    });
-    // 3. Feature registry. Auth-mode auto-mixes config/user/tenant/auth-email-
-    //    password via composeFeatures — same source-of-truth as runDevApp
-    //    AND the per-app drizzle-Schema-Generator, so Migration und Runtime
-    //    sehen exakt dieselbe Liste. Built BEFORE any connection so boot-mode
-    //    can validate wiring and exit without opening a Postgres/Redis socket.
-    const composeAuthOptions = buildComposeAuthOptions(effectiveAuth);
-    const features = composeFeatures([...options.features, ...bootOptionWiring.features], {
-        includeBundled: !!effectiveAuth,
-        ...(composeAuthOptions && { authOptions: composeAuthOptions }),
-    });
-    const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
-    validateBoot(features, {
-        env: envSource,
-        ...(bootCrypto.entityFieldCipher && { entityFieldCipher: bootCrypto.entityFieldCipher }),
-        ...options.validateBootOptions,
-    });
-    warnIfNonUtcServerTimeZone();
-    validateAppCustomScreenWriteQns(process.cwd(), collectWriteHandlerQns(features));
-    assertPiiBootInvariants(features, {
-        kms: bootKms.kms,
-        blindIndexKey: bootKms.blindIndexKey,
-        allowPlaintextPii: bootKms.allowPlaintextPii,
-        mode: "prod",
-    });
-    const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
-    const registry = createRegistry(features);
-    assertSessionBootInvariants({
-        hasAuth: Boolean(effectiveAuth),
-        sessionStoreProviderMounted: registry.getExtensionUsages(EXT_SESSION_STORE).length > 0,
-        mode: "prod",
-    });
+    const config = await resolveProdBootConfig(options, decryptedEnvSource, log, registerAbortCleanup);
+    const composed = composeProdFeatures(options, config, log);
+    const { bootKms } = config;
+    const { features, registry } = composed;
     // C1 boot-mode exit: validators ran + registry built; no DB/Redis client
     // is constructed at all in this branch (the eager `new Redis(...)` below
     // would otherwise open a TCP connect just to immediately disconnect it).
@@ -301,556 +119,41 @@ export async function runProdApp(options) {
         }
         return makeDryRunHandle();
     }
-    // 4. Connections — Postgres + Redis. The Redis client is shared by
-    //    idempotency, event-dedup, entity-cache, rate-limit; failing to
-    //    construct here surfaces the misconfig immediately. `new Redis(...)`
-    //    connects eagerly, so it must stay AFTER the boot-mode exit above.
-    // KMS health gate: an app configured for crypto-shredding must not boot
-    // against an unreachable key store — a silent start would answer every
-    // PII read with 503. Runs BEFORE connections so an abort leaks nothing.
-    if (bootKms.kms) {
-        const kms = bootKms.kms;
-        const kmsHealth = await waitUntilDatabaseReachable(() => kms.health(), {
-            processName: "runProdApp",
-        });
-        if (!kmsHealth.ok) {
-            throw new Error(`[runProdApp] BOOT ABORTED — KMS health check failed (latency ${kmsHealth.latencyMs}ms)`);
-        }
-    }
-    const { db, close: closeDb } = createDbConnection({
-        url: databaseUrl,
-        ...dbConnectionOptionsFromEnv(envSource),
-        ...serverTimeoutOptionsFromEnv(envSource),
-    });
-    const { db: outsideTransactionDb, close: closeOutsideTransactionDb } = createDbConnection({
-        url: databaseUrl,
-        ...outsideTransactionPoolOptionsFromEnv(envSource),
-        ...serverTimeoutOptionsFromEnv(envSource),
-    });
-    const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
-    logRedisConnectionState(redis, log);
-    await waitForDatabase(db, { processName: "runProdApp" });
-    // Sprint-8a Tier-Composition auto-wire: scan features for a
-    // tenantTierResolver-extension. If found, build the resolver here (db +
-    // registry are available) before the dispatcher is constructed. App-Author sees
-    // nothing — `createTierEngineFeature(opts)` mounts + framework auto-wires.
-    // One bus per process: the tier resolver, the dispatcher and the file-provider
-    // resolver all subscribe to it (invalidation across the API pods).
-    const cacheSync = createRedisCacheSyncBus({
-        redisUrl,
-        clientOptions: redisClientOptionsFromEnv(envSource),
-    });
-    let resolvedEffectiveFeatures;
-    const tierResolverUsage = findTierResolverUsage(features);
-    if (tierResolverUsage) {
-        resolvedEffectiveFeatures = await requireTierResolverPlugin(tierResolverUsage).build({
-            db,
-            registry,
-            cacheSync,
-        });
-    }
-    if (bootOptionWiring.featureToggles) {
-        const bound = await bootOptionWiring.featureToggles.bind({
-            db,
-            registry,
-            cacheSync,
-            tierResolver: resolvedEffectiveFeatures,
-        });
-        resolvedEffectiveFeatures = bound.resolver;
-    }
-    // 5. Schema-Drift-Gate (drizzle-frei, kumiko/migrations). `kumiko schema
-    //    apply` läuft als Deploy-Step VOR dem Container-Rollout. Boot prüft nur:
-    //      (a) Alle Migrations aus kumiko/migrations/*.sql sind in
-    //          _kumiko_migrations applied (+ checksum unverändert)
-    //      (b) Alle Tabellen aus kumiko/migrations/.snapshot.json existieren
-    //    Drift = Boot-Error mit klarer Meldung (kein Auto-Heal — mehrere
-    //    Container-Replicas würden sonst race-conditionen fahren). Opt-out via
-    //    `migrations: false` für custom Schema-Setups.
-    if (options.migrations !== false) {
-        const migrationsDir = options.migrations?.dir ?? "./kumiko/migrations";
-        log.info(`checking schema drift (${migrationsDir})`);
-        try {
-            await assertKumikoSchemaCurrent(db, migrationsDir);
-        }
-        catch (err) {
-            if (err instanceof SchemaDriftError) {
-                log.error(`BOOT ABORTED — ${err.message}`);
-            }
-            throw err;
-        }
-    }
-    // 6. Pipeline pieces — same default config as runDevApp's setupTestStack.
-    const idempotency = createIdempotencyGuard(redis, { ttlSeconds: 60 });
-    const eventDedup = createEventDedup(redis, { ttlSeconds: 60 });
-    const entityCache = createEntityCache(redis, { ttlSeconds: 60 });
-    // 7. Lifecycle is built by createApiEntrypoint when not supplied —
-    //    we let the entrypoint own it and read it back through the handle
-    //    for SIGTERM.
-    //
-    // extraContext + anonymousAccess sind factory-union: entweder direktes
-    // Object oder Function die {db, redis, registry} bekommt und das Object
-    // returned. Factory-Form gilt als bevorzugt für Cases die zur Boot-Zeit
-    // gegen die DB resolven müssen (z.B. Subdomain-Tenant-Lookup im
-    // tenantResolver) — die Factory closure'd `db` und der Resolver kann
-    // sie zur Request-Zeit aufrufen.
-    // Build the sseBroker here (instead of letting createApiEntrypoint do it
-    // internally) so extraContext factories can close over it at boot time —
-    // e.g. an extraContext provider that publishes SSE events directly. We
-    // pass the same broker into createApiEntrypoint (sseBroker? option) so
-    // the server-internal broadcast and app-specific publishes run over
-    // exactly one broker. createDefaultSseBroker (not createSseBroker
-    // directly) is what makes that broker Redis-backed under REDIS_URL —
-    // an unconditional in-memory broker here would silently win over
-    // buildServer's own REDIS_URL default (ServerOptions.sseBroker always
-    // wins), which is exactly how fw#2630's cross-replica fanout fix shipped
-    // without ever taking effect in production.
-    const { sseBroker, ownedRedisSseBroker } = createDefaultSseBroker(envSource);
-    const deps = {
-        db,
-        redis,
-        registry,
-        sseBroker,
-        env: envSource,
-        ...(bootCrypto.masterKeyProvider && { masterKeyProvider: bootCrypto.masterKeyProvider }),
-        ...(bootCrypto.configCipher && { configEncryption: bootCrypto.configCipher }),
-    };
-    const resolvedExtraContext = typeof options.extraContext === "function"
-        ? options.extraContext(deps)
-        : (options.extraContext ?? {});
-    // Framework-Default-Provider zuerst, App-Werte (resolvedExtraContext)
-    // gewinnen immer (z.B. money-horse's eigener configResolver).
-    // App-wide cipher for `encrypted: true` entity fields — executors resolve
-    // it lazily, entities without encrypted fields never touch it.
-    configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
-    // Subject-key KMS for pii-annotated fields (crypto-shredding, #724).
-    // No adapter only gets this far when assertPiiBootInvariants above let it
-    // through: no PII carriers, or an explicit allowPlaintextPii opt-out. The
-    // engine then stays off and those fields are stored in plaintext.
-    configurePiiSubjectKms(bootKms.kms);
-    // Blind-Index-Key (#818) — Boot-Gate: mit aktivem KMS würden lookupable-
-    // Felder als Ciphertext gespeichert, ohne Key gäbe es keinen bidx-Arm und
-    // jeder Equality-Lookup (Login by email!) liefe ins Leere. Fail-fast statt
-    // silent-broken-auth.
-    configureBlindIndexKey(bootKms.blindIndexKey);
-    const bootLogger = loggerFromExtraContext(resolvedExtraContext);
-    if (bootLogger)
-        setProcessLogger(bootLogger);
-    const autoExtraContext = buildBootExtraContext({
-        db,
+    const connections = await connectProdDependencies(config, log, registerAbortCleanup);
+    // Tier-composition auto-wire: if a feature carries a tenantTierResolver extension, the
+    // resolver is built here, before the dispatcher exists. The app author only mounts
+    // `createTierEngineFeature(opts)`; the framework does the wiring.
+    const effectiveFeatures = await buildEffectiveFeaturesResolver({
         features,
-        envSource,
-        registry,
-        hasAuth: !!effectiveAuth,
-        sseBroker,
-        redis,
-        crypto: bootCrypto,
-        ...(bootKms.kms && { kms: bootKms.kms }),
-        ...(bootLogger && { log: bootLogger }),
-        ...(unsubscribeLinks && { unsubscribeLinks }),
-        ...(options.appOverrides && { appOverrides: options.appOverrides }),
-    });
-    const extraContext = {
-        ...addConfigAccessorFactory({ ...autoExtraContext, ...resolvedExtraContext }, registry),
-        ...(options.defaultLocale !== undefined && { defaultLocale: options.defaultLocale }),
-    };
-    const baseAnonymousAccess = typeof options.anonymousAccess === "function"
-        ? options.anonymousAccess(deps)
-        : options.anonymousAccess;
-    // #1374: tenantResolver / tenantExists come from auth-foundation providers.
-    const resolvedAnonymousAccess = await resolveAnonymousAccessFromRegistry(baseAnonymousAccess, {
-        db,
-        registry,
-        warn: (message) => createFallbackLogger("runProdApp").warn(message),
-    });
-    // Sessions opt-in: db ist hier schon konkret (createDbConnection oben),
-    // also direkt verdrahten — kein late-bound nötig wie bei runDevApp.
-    // Ein JWT ohne sid wird abgelehnt, sobald ein sessionChecker verdrahtet ist —
-    // Prod-Sessions können nicht stillschweigend umgangen werden. sessionMassRevoker
-    // (4. callback aus createSessionCallbacks) ist nicht Teil der
-    // AuthRoutesConfig-Surface — der geht via bindAutoRevokeFromFeature ans
-    // sessions-Feature (Password-Change/-Reset revoked alle Sessions), nicht
-    // über die auth-routes.
-    // Secure-by-default (#1372): sessionStore provider → resolveSessionStore.
-    const mfaFeature = features.find((f) => f.name === AUTH_MFA_FEATURE);
-    if (mfaFeature)
-        bindMfaTokenSecretsFromFeature(mfaFeature)?.(jwtSecret, envSource);
-    if (mfaFeature && registry.getWriteHandler(AuthHandlers.switchTenantMfaGate) === undefined) {
-        throw new Error(`[runProdApp] auth-mfa is mounted but ${AuthHandlers.switchTenantMfaGate} is not registered: ` +
-            "createAuthEmailPasswordFeature registers it only when mfaStatusChecker is set, and without it " +
-            "POST /auth/switch-tenant would mint sessions without the second factor");
-    }
-    // Hoisted above buildProdSessionAuth: that call also wires MFA-enable/
-    // disable → PAT-revoke (bindRevokeAllPatTokensFromFeature), so it needs
-    // patFeature too.
-    const patFeature = features.find((f) => f.name === PAT_FEATURE);
-    const sessionAuthFragment = shouldWireProdSessions(Boolean(effectiveAuth), registry.getExtensionUsages(EXT_SESSION_STORE).length > 0)
-        ? await buildProdSessionAuth(db, registry, sessionsFeature, mfaFeature, patFeature)
-        : undefined;
-    // Password-change → PAT-revoke: independent of sessions/MFA being mounted
-    // (buildProdSessionAuth only runs when a sessionStore provider is
-    // registered), so wired unconditionally here whenever PAT itself is.
-    if (patFeature) {
-        wireProdPatAutoRevoke(db, patFeature);
-    }
-    // Token-verifier opt-in: any provider feature (personal-access-tokens, a
-    // future auth-provider-jwt, ...) self-registers via
-    // r.useExtension(EXT_TOKEN_VERIFIER, ...) — wire one generic resolver
-    // whenever at least one is mounted, resolved by shape at request-time.
-    // PAT keeps its own per-token rate limiter (patRateLimiter), unrelated to
-    // verification.
-    const hasTokenVerifierProviders = registry.getExtensionUsages(EXT_TOKEN_VERIFIER).length > 0;
-    let patAuthFragment;
-    if (effectiveAuth && patFeature && hasTokenVerifierProviders) {
-        const rl = patRateLimitFromFeature(patFeature);
-        patAuthFragment = {
-            tokenVerifier: (rawToken) => resolveTokenVerifier({ db, registry }, rawToken),
-            patRateLimiter: createRedisLoginRateLimiter(redis, rl.maxRequests, rl.windowMs, "pat"),
-        };
-    }
-    const baseEntrypointOptions = {
-        registry,
-        context: {
-            db,
-            redis,
-            entityCache,
-            registry,
-            ...extraContext,
-        },
-        sseBroker,
-        jwtSecret: jwtSecretOrKeyring,
-        ...(jwtIssuer && { jwtIssuer }),
-        ...(instanceId && { instanceId }),
-        dispatcherOptions: {
-            idempotency,
-            cacheSync,
-            outsideTransactionDb,
-            ...(resolvedEffectiveFeatures && { effectiveFeatures: resolvedEffectiveFeatures }),
-        },
-        eventDedup,
-        ...(options.observability && { observability: options.observability }),
-        ...(options.metrics && { metrics: options.metrics }),
-        ...(resolvedRateLimit && { rateLimit: resolvedRateLimit }),
-        ...(trustedProxyHops !== undefined && { trustedProxyHops }),
-        ...(options.errorDocs && { errorDocs: options.errorDocs }),
-        ...((options.extraRoutes || options.unsubscribe || bootOptionWiring.extraRoutes.length > 0) && {
-            extraRoutes: [
-                ...(options.extraRoutes ?? []),
-                ...unsubscribeRoutes,
-                ...bootOptionWiring.extraRoutes,
-            ],
-        }),
-        ...(effectiveAuth && {
-            auth: {
-                membershipQuery: TenantQueries.memberships,
-                userQuery: UserQueries.findForAuth,
-                loginHandler: AuthHandlers.login,
-                loginErrorStatusMap: effectiveAuth.loginErrorStatusMap ?? {
-                    [AuthErrors.invalidCredentials]: 401,
-                    [AuthErrors.noMembership]: 403,
-                },
-                // Redis-backed, not the in-memory default createAuthRoutes falls
-                // back to — an in-process limiter only rate-limits within a single
-                // replica, so a multi-instance prod deployment would silently give
-                // each replica its own bucket (#1262/#1274). Redis is required infra
-                // here already (REDIS_URL), so this is free.
-                loginRateLimit: createRedisLoginRateLimiter(redis),
-                ...(effectiveAuth.cookieDomain !== undefined && {
-                    cookieDomain: effectiveAuth.cookieDomain,
-                }),
-                ...(effectiveAuth.secureCookies !== undefined && {
-                    secureCookies: effectiveAuth.secureCookies,
-                }),
-                ...(effectiveAuth.retiredCookieDomains !== undefined && {
-                    retiredCookieDomains: effectiveAuth.retiredCookieDomains,
-                }),
-                ...(effectiveAuth.allowedOrigins !== undefined && {
-                    allowedOrigins: effectiveAuth.allowedOrigins,
-                }),
-                ...(effectiveAuth.unsafeSkipOriginCheck !== undefined && {
-                    unsafeSkipOriginCheck: effectiveAuth.unsafeSkipOriginCheck,
-                }),
-                ...(authPublicOrigin !== undefined && { publicOrigin: authPublicOrigin }),
-                ...(trustedProxyHops !== undefined && { trustedProxyHops }),
-                ...(effectiveAuth.postAuthLanding !== undefined && {
-                    postAuthLanding: effectiveAuth.postAuthLanding,
-                }),
-                ...sessionAuthFragment,
-                ...patAuthFragment,
-                ...(mfaFeature && {
-                    mfaVerifyHandler: AuthMfaHandlers.verify,
-                    switchTenantMfaGateHandler: AuthHandlers.switchTenantMfaGate,
-                    mfaPreauthEnableStartHandler: AuthMfaHandlers.enableStartPreauth,
-                    mfaPreauthConfirmHandler: AuthMfaHandlers.enableConfirmPreauth,
-                    mfaVerifyRateLimit: createRedisLoginRateLimiter(redis, undefined, undefined, "mfa-verify"),
-                    mfaPreauthEnableStartRateLimit: createRedisLoginRateLimiter(redis, undefined, undefined, "mfa-preauth-start"),
-                    mfaPreauthConfirmRateLimit: createRedisLoginRateLimiter(redis, undefined, undefined, "mfa-preauth-confirm"),
-                }),
-                ...(effectiveAuth.passwordReset && {
-                    passwordReset: {
-                        requestHandler: AuthHandlers.requestPasswordReset,
-                        confirmHandler: AuthHandlers.resetPassword,
-                    },
-                }),
-                ...(effectiveAuth.emailVerification && {
-                    emailVerification: {
-                        requestHandler: AuthHandlers.requestEmailVerification,
-                        confirmHandler: AuthHandlers.verifyEmail,
-                    },
-                }),
-                ...(effectiveAuth.accountUnlock && {
-                    accountUnlock: {
-                        requestHandler: AuthHandlers.requestAccountUnlock,
-                        confirmHandler: AuthHandlers.confirmAccountUnlock,
-                    },
-                }),
-                ...(effectiveAuth.signup && {
-                    signup: {
-                        requestHandler: AuthHandlers.signupRequest,
-                        confirmHandler: AuthHandlers.signupConfirm,
-                    },
-                }),
-                ...(effectiveAuth.invite && {
-                    invite: {
-                        acceptHandler: AuthHandlers.inviteAccept,
-                        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
-                        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
-                        infoHandler: AuthQueries.inviteInfo,
-                    },
-                }),
-            },
-        }),
-        ...(resolvedAnonymousAccess && { anonymousAccess: resolvedAnonymousAccess }),
-    };
-    // Deploy-Topologie. Default (Single-Container): createAllInOneEntrypoint
-    // fährt HTTP + BEIDE Job-Lanes (zwei Runner, jeder schedult seine eigene
-    // Lane-Crons → kein Double-Fire) + Event-Dispatcher inline. So laufen
-    // worker-Lane-Crons (run-export-jobs default runIn:"worker") UND MSPs ohne
-    // separaten Worker-Process — die Asymmetrie, an der der Daten-Export hing.
-    // runSingleInstance:false → API-only; ein dezidierter Worker MUSS dann die
-    // worker-Lane + MSPs übernehmen (api-Lane-Jobs laufen weiter lokal).
-    // Default single-instance. eventDispatcher.disabled ist die Alt-Art, MSPs
-    // diesem Prozess wegzunehmen (dezidierter Worker) — als runSingleInstance:
-    // false honorieren (api-only, kein lokaler Dispatcher), damit der explizite
-    // Flag Vorrang behält aber Bestands-Caller nicht brechen.
-    const runSingleInstance = options.runSingleInstance ?? options.eventDispatcher?.disabled !== true;
-    const hasJobs = registry.getAllJobs().size > 0;
-    const queueNamePrefix = options.jobs?.queueNamePrefix;
-    const jobLogger = jobRunLoggerCallbacks(registry, db);
-    const dispatcherTunables = options.eventDispatcher?.pollIntervalMs !== undefined
-        ? { pollIntervalMs: options.eventDispatcher.pollIntervalMs }
-        : {};
-    const entrypoint = runSingleInstance
-        ? createAllInOneEntrypoint({
-            ...baseEntrypointOptions,
-            redisUrl,
-            ...jobLogger,
-            ...(queueNamePrefix !== undefined && { queueNamePrefix }),
-            ...(options.jobs?.getActiveTenantIds !== undefined && {
-                getActiveTenantIds: options.jobs.getActiveTenantIds,
-            }),
-            ...(!options.eventDispatcher?.disabled && { eventDispatcher: dispatcherTunables }),
-        })
-        : createApiEntrypoint({
-            ...baseEntrypointOptions,
-            ...(hasJobs && {
-                jobs: {
-                    redisUrl,
-                    runLocalJobs: true,
-                    ...jobLogger,
-                    ...(queueNamePrefix !== undefined && { queueNamePrefix }),
-                    ...(options.jobs?.getActiveTenantIds !== undefined && {
-                        getActiveTenantIds: options.jobs.getActiveTenantIds,
-                    }),
-                },
-            }),
-        });
-    // The broker built above is always ours (runProdApp never accepts a
-    // caller-supplied sseBroker), so — same reasoning as buildServer's own
-    // ownedRedisSseBroker hook — closing it on shutdown is our job, not the
-    // entrypoint's. Registered after createApiEntrypoint/createAllInOneEntrypoint
-    // (which already registered the eventDispatcher/jobRunner hooks above),
-    // so it drains LIFO before those, matching the close-before-teardown
-    // order fw#2630 established for buildServer's own hook.
-    entrypoint.lifecycle.registerShutdownHook("prodAppCacheSync", async () => {
-        await cacheSync.close();
-    });
-    if (ownedRedisSseBroker) {
-        const broker = ownedRedisSseBroker;
-        entrypoint.lifecycle.registerShutdownHook("prodAppRedisSseBroker", async () => {
-            await broker.close();
-        });
-    }
-    // `extraRoutes` itself is already mounted — buildServer wires it inside
-    // createApiEntrypoint/createAllInOneEntrypoint, before this function ever
-    // runs. `wire` is the remaining escape-hatch for app-wired co-running
-    // components that need the system-write dispatcher but don't declare a
-    // route (kumiko-framework#3050).
-    if (options.wire) {
-        await options.wire({
-            db,
-            redis,
-            registry,
-            ...(bootCrypto.masterKeyProvider && { masterKeyProvider: bootCrypto.masterKeyProvider }),
-            ...(bootCrypto.configCipher && { configEncryption: bootCrypto.configCipher }),
-            metricsFor: createMetricsForFactory(entrypoint.observability.meter),
-            dispatchSystemWrite: makeDispatchSystemWrite(entrypoint.dispatcher),
-            dispatchSystemQuery: makeDispatchSystemQuery(entrypoint.dispatcher),
-        });
-    }
-    // 9. Seeds: admin first, then config-seeds from r.config({seeds}),
-    //    then app-specific. All idempotent — runProdApp doesn't gate
-    //    "first boot" via flag, every seed-step checks its own
-    //    preconditions. Config-seeds rely on a deterministic
-    //    aggregate-id so re-boot becomes a version_conflict skip.
-    if (effectiveAuth?.admin) {
-        await seedAdminGuarded(db, effectiveAuth.admin);
-    }
-    for (const seed of bootOptionWiring.shortcutSeeds) {
-        await seed(db);
-    }
-    await applyBootSeeds({
+        featureToggles: config.bootOptionWiring.featureToggles,
+        db: connections.db,
         registry,
-        db,
-        ...(bootCrypto.configCipher && { cipher: bootCrypto.configCipher }),
+        cacheSync: connections.cacheSync,
     });
-    const customSeeds = bootOptionWiring.customSeeds;
-    const hasSeeds = customSeeds.length > 0 || options.seedsDir !== undefined;
-    // Seeds are bootstrap writes, not tenant traffic: they always get the unlimited resolver,
-    // even when the app has a real one, so a handler's rateLimit can neither fail nor drain them.
-    const seedContext = hasSeeds
-        ? withFileProviderResolver(registry, {
-            db,
-            redis,
-            entityCache,
-            registry,
-            ...extraContext,
-            rateLimit: createUnlimitedRateLimitResolver(),
-        }, cacheSync)
-        : undefined;
-    const seedDispatcher = seedContext
-        ? withSeedErrorContext(createDispatcher(registry, seedContext, {
-            ...baseEntrypointOptions.dispatcherOptions,
-            ...(entrypoint.mode === "all-in-one" && { jobRunner: entrypoint.jobRunner }),
-        }))
-        : undefined;
-    if (seedDispatcher && seedContext) {
-        const createFileRef = makeSeedCreateFileRef({ db, registry, context: seedContext });
-        for (const seed of customSeeds) {
-            await seed({
-                db,
-                registry,
-                dispatcher: seedDispatcher,
-                createFileRef,
-                ...(bootCrypto.masterKeyProvider && { masterKeyProvider: bootCrypto.masterKeyProvider }),
-                ...(bootCrypto.configCipher && { configEncryption: bootCrypto.configCipher }),
-            });
-        }
-    }
-    // ES-Operations / Seed-Migrations (Phase 1). Läuft NACH applyBootSeeds +
-    // existing seeds-array — die deklarativen Seeds sind die "always-insert-
-    // if-missing"-Schicht; seed-migrations sind die "diff-and-update"-
-    // Schicht für Drift den existing Seeds nicht erfassen können (z.B.
-    // Membership-Roles-Change nach initialer Seed-Erstellung).
-    if (seedDispatcher && options.seedsDir !== undefined && envSource["KUMIKO_SKIP_ES_OPS"] !== "1") {
-        await createEsOperationsTable(db);
-        await runPendingSeedMigrations({
-            db,
-            seedsDir: options.seedsDir,
-            appliedBy: "boot",
-            registry, // → dry-run-validator catched handler-QN-typos vor dem write
-            // @wrapper-known semantic-alias
-            createContext: (dbRunner) => createSeedMigrationContext({ dispatcher: seedDispatcher, dbRunner }),
-        });
-    }
-    await entrypoint.start();
-    await recordAppStartedOnBoot({ db, envSource });
-    startPiiEventBackfillOnBoot({
-        db,
-        registry,
-        lifecycle: entrypoint.lifecycle,
-        envSource,
-    });
-    // 11. Build the fetch-handler. Static-fallback for non-/api/ paths
-    //     wired via a wrapper so Hono owns /api/* + extraRoutes and disk
-    //     owns the rest. Tests use this directly; listen() wraps it in
-    //     Bun.serve.
-    const cspScriptHashes = await resolveCspScriptHashes(options.staticDir, options.securityHeaders);
-    const hostDispatchScriptHashes = options.hostDispatch !== undefined && options.staticDir !== undefined
-        ? await resolveHostDispatchScriptHashes(options.staticDir, options.securityHeaders, cspScriptHashes)
-        : [];
-    const fetchHandler = withSecurityHeaders(bootOptionWiring.wrapFetch(options.staticDir
-        ? buildStaticFallback(entrypoint.app.fetch.bind(entrypoint.app), options.staticDir, options.hostDispatch, options.resolvePageHead
-            ? { resolvePageHead: options.resolvePageHead, dispatcher: entrypoint.dispatcher }
-            : undefined, entrypoint.dispatcher, trustedProxyHops ?? 0, hostDispatchScriptHashes)
-        : // No staticDir (split-deploy / API-only container) → app.fetch's
-            // response goes straight to the client, bypassing buildStaticFallback
-            // (and with it tryHonoFirst) entirely. Must strip the router-miss
-            // marker here too, same reason as the /api/* passthrough in
-            // run-prod-app-static-files.ts (see try-hono-first.ts).
-            async (req, socketAddress) => stripNoRouteMatchHeader(await entrypoint.app.fetch(req, socketAddress))), options.securityHeaders, cspScriptHashes);
-    // 11. Mark lifecycle ready — health/ready flips to 200 after this.
+    await assertProdSchemaCurrent(connections.db, options.migrations, log);
+    const requestContext = await buildProdRequestContext(options, config, composed, connections);
+    const authWiring = await wireProdAuth(config, composed, connections);
+    const entrypointOptions = buildProdEntrypointOptions(options, config, composed, connections, requestContext, authWiring, effectiveFeatures);
+    const entrypoint = createProdEntrypoint(options, config, composed, connections, entrypointOptions);
+    registerProdShutdownHooks(entrypoint, connections.cacheSync, requestContext.ownedRedisSseBroker);
+    await runProdWireHook(options, composed, connections, entrypoint);
+    await runProdBootSeeds({ options, config, composed, connections, requestContext }, entrypoint, entrypointOptions.dispatcherOptions);
+    await startProdBackgroundWork(entrypoint, config, composed, connections);
+    const fetch = await buildProdFetchHandler(options, config, entrypoint);
+    // Mark lifecycle ready — health/ready flips to 200 after this.
     entrypoint.lifecycle.markReady();
-    // Upgrade rejections (401/403/426...) are ordinary responses and get the same headers as fetchHandler.
-    const securedUpgradeFetch = withSecurityHeaders(async (req, env) => stripNoRouteMatchHeader(await entrypoint.app.fetch(req, env)), options.securityHeaders, cspScriptHashes);
-    const webSocketUpgradeFetch = async (req, env) => securedUpgradeFetch(req, env);
-    let uninstallShutdownSignals;
-    let uninstallFatalHandlers;
-    const handle = {
+    const handle = createProdAppHandle({
+        options,
+        config,
+        composed,
+        connections,
         entrypoint,
-        fetch: fetchHandler,
-        webSocketUpgradeFetch,
-        listen: async (listenPort = port) => {
-            // Bun.serve is the production HTTP. Tests don't call listen()
-            // because vitest runs under Node where Bun.serve doesn't exist.
-            // Options-Shape (inkl. idleTimeout: 0 für SSE) liegt in der
-            // exportierten buildBunServeOptions-Funktion — siehe ihren
-            // Header für die Begründung.
-            if (typeof Bun === "undefined") {
-                // Klare Fehlermeldung statt nackter ReferenceError. Trifft wenn
-                // jemand listen() unter Node/vitest aufruft ohne autoListen:false
-                // — hilft beim Debug, statt sich an "Bun is not defined" abzumühen.
-                throw new Error("[runProdApp] listen() requires Bun runtime (Bun.serve). " +
-                    "Under Node/vitest pass `autoListen: false` and call the returned `fetch()` directly.");
-            }
-            handle.server = Bun.serve(buildBunServeOptions(listenPort, fetchHandler, options.maxRequestBodySize ?? resolveDerivedMaxRequestBodySize(registry), { upgradeFetch: webSocketUpgradeFetch }));
-            // SIGTERM/SIGINT — graceful shutdown. Only registered when we
-            // actually own a Bun-server, otherwise the test process picks up
-            // signals it shouldn't respond to.
-            if (options.signals !== false) {
-                uninstallShutdownSignals?.();
-                uninstallShutdownSignals = installShutdownSignals({
-                    stop: () => handle.stop(),
-                    ...(options.signals?.drainTimeoutMs !== undefined && {
-                        drainTimeoutMs: options.signals.drainTimeoutMs,
-                    }),
-                });
-                uninstallFatalHandlers?.();
-                uninstallFatalHandlers = installFatalErrorHandlers({
-                    logger: log,
-                    stop: () => handle.stop(),
-                });
-            }
-            log.info(`ready on http://0.0.0.0:${listenPort}`);
-        },
-        stop: async () => {
-            uninstallFatalHandlers?.();
-            uninstallFatalHandlers = undefined;
-            await entrypoint.stop();
-            if (handle.server)
-                await stopServerGracefully(handle.server);
-            await flushEscapeHatchAudits();
-            await closeDb();
-            await closeOutsideTransactionDb();
-            redis.disconnect();
-            await bootKms.close();
-            uninstallShutdownSignals?.();
-            uninstallShutdownSignals = undefined;
-            uninstallProcessLogger();
-        },
-    };
-    // 12. Auto-listen unless explicitly suppressed (tests pass autoListen:
-    //     false because Bun.serve isn't available under vitest/node).
-    //     Production path: `await runProdApp({...})` and the server is up.
+        fetch,
+        log,
+    });
+    // Auto-listen unless explicitly suppressed (tests pass autoListen:
+    // false because Bun.serve isn't available under vitest/node).
+    // Production path: `await runProdApp({...})` and the server is up.
     if (options.autoListen !== false) {
         await handle.listen();
     }