@cosmicdrift/kumiko-server-runtime 0.387.0 → 0.389.0

package/dist/boot-options/resolve-boot-options.js

@@ -1,6 +1,7 @@
 import { BILLING_FOUNDATION_FEATURE } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { DELIVERY_FEATURE } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { FEATURE_TOGGLES_FEATURE } from "@cosmicdrift/kumiko-bundled-features/feature-toggles";
+import { SUBSCRIPTION_DODO_FEATURE } from "@cosmicdrift/kumiko-bundled-features/subscription-dodo";
 import { SUBSCRIPTION_STRIPE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/subscription-stripe";
 import { TIER_ENGINE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
 import { resolveBillingOption } from "./billing-option.js";
@@ -45,9 +46,9 @@ function wireFeatureToggles(options, mounted) {
 function warnAboutBootOptions(options) {
     const bootWarnings = stackBootWarnings(options).map((line) => `stacks in \`features\` expect boot options that are not set:\n${line}`);
     if (options.runSingleInstance === false &&
-        (options.mail || options.fileStorage || options.featureToggles) &&
+        (options.mail || options.fileStorage || options.featureToggles || options.appOverrides) &&
         options.workerMountsFeatures !== true) {
-        bootWarnings.push("runSingleInstance:false — delivery and file jobs run in runWorkerApp. Pass the same mail / fileStorage / featureToggles options there, or set workerMountsFeatures: true if it mounts those features itself.");
+        bootWarnings.push("runSingleInstance:false — delivery and file jobs run in runWorkerApp. Pass the same mail / fileStorage / featureToggles / appOverrides options there, or set workerMountsFeatures: true if it mounts those features itself.");
     }
     if (bootWarnings.length > 0) {
         // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early
@@ -82,10 +83,15 @@ export async function resolveBootOptionWiring(options, envSource) {
         envDefaults = { ...envDefaults, ...fileStorage.envDefaults };
     }
     if (options.billing) {
-        requireFeatures(mounted, "billing.stripe", [BILLING_FOUNDATION_FEATURE, TIER_ENGINE_FEATURE], "Mount createBillingFoundationFeature() and createTierEngineFeature(), or composeSaasStack from @cosmicdrift/kumiko-dev-server/compose-stacks.");
-        rejectDoubleMount(mounted, "billing.stripe", SUBSCRIPTION_STRIPE_FEATURE);
+        requireFeatures(mounted, "billing", [BILLING_FOUNDATION_FEATURE, TIER_ENGINE_FEATURE], "Mount createBillingFoundationFeature() and createTierEngineFeature(), or composeSaasStack from @cosmicdrift/kumiko-dev-server/compose-stacks.");
+        if (options.billing.stripe) {
+            rejectDoubleMount(mounted, "billing.stripe", SUBSCRIPTION_STRIPE_FEATURE);
+        }
+        if (options.billing.dodo) {
+            rejectDoubleMount(mounted, "billing.dodo", SUBSCRIPTION_DODO_FEATURE);
+        }
         const billing = resolveBillingOption(options.billing, envSource);
-        features.push(billing.feature);
+        features.push(...billing.features);
         extraRoutes.push(billing.route);
     }
     const featureToggles = wireFeatureToggles(options, mounted);

package/dist/boot-options/stack-boot-requirements.d.ts

@@ -3,7 +3,7 @@ import type { RunProdAppOptions } from "../run-prod-app.ts";
 export type StackBootOptionFields = Pick<RunProdAppOptions, "features" | "kms" | "allowPlaintextPii" | BootOptionName>;
 /** Reads `bootRequires` from the raw feature list: dedupe may later drop the
  *  tagged copy of a feature two stacks share. `scope` limits the check to the
- *  options the calling boot function can set at all (runDevApp has no `signals`). */
+ *  options the calling boot function can set at all. */
 export declare function assertStackBootRequirements(options: StackBootOptionFields, scope?: readonly BootOptionName[]): void;
 /** Requirements a stack marked `severity: "warn"`: logged at boot, never fatal. */
 export declare function stackBootWarnings(options: StackBootOptionFields): string[];

package/dist/boot-options/stack-boot-requirements.js

@@ -23,24 +23,12 @@ const OPTION_CHECKS = {
     },
     billing: {
         isSatisfied: (options, mounted) => options.billing !== undefined || mountsExtension(mounted, SUBSCRIPTION_PROVIDER_EXTENSION),
-        hint: "set billing: { stripe: { priceToTier }, defaultTier }",
+        hint: "set billing: { stripe: { priceToTier }, defaultTier } (or dodo)",
     },
     featureToggles: {
         isSatisfied: (options) => options.featureToggles === true,
         hint: "set featureToggles: true",
     },
-    demoMode: {
-        isSatisfied: (options) => options.demoMode !== undefined,
-        hint: "set demoMode: { readOnly }",
-    },
-    seeds: {
-        isSatisfied: (options) => options.seeds !== undefined,
-        hint: "set seeds",
-    },
-    signals: {
-        isSatisfied: (options) => options.signals !== false,
-        hint: "drop signals: false",
-    },
     rateLimit: {
         isSatisfied: (options) => options.rateLimit !== false,
         hint: "drop rateLimit: false",
@@ -65,7 +53,7 @@ function unsatisfiedRequirements(options, severity, scope) {
 }
 /** Reads `bootRequires` from the raw feature list: dedupe may later drop the
  *  tagged copy of a feature two stacks share. `scope` limits the check to the
- *  options the calling boot function can set at all (runDevApp has no `signals`). */
+ *  options the calling boot function can set at all. */
 export function assertStackBootRequirements(options, scope) {
     const gaps = unsatisfiedRequirements(options, "error", scope);
     if (gaps.length > 0) {

package/dist/build-prod-bundle.js

@@ -63,6 +63,7 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { BUNDLED_ASSETS_DIST_DIR, readBundledAssetDeclarations, resolveBundledAssetSource, } from "./bundled-assets.js";
 import { CSP_HASHES_FILE, inlineScriptHashes } from "./csp-hashes.js";
 import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_DIST_DIR, resolveRendererWebFontsDir, } from "./renderer-web-fonts.js";
+import { resolveInstalledSync } from "./resolve-installed-package.js";
 import { canResolveTailwindStylesheet, resolveTailwindCli } from "./resolve-tailwind-cli.js";
 // Bun runtime check as a module-level constant: every build step (Tailwind via
 // Bun.spawn, client bundling via Bun.build, and stylesheet resolution via
@@ -454,18 +455,11 @@ function resolveStylesheetEntry(cwd, clientEntry, override) {
     // and production builds behave identically.
     if (!clientEntry)
         return undefined;
-    if (!hasBun)
-        return undefined;
-    try {
-        const resolved = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", cwd);
-        if (!canResolveTailwindStylesheet(resolved, { bun: Bun, cwd })) {
-            return undefined;
-        }
-        return { path: resolved, isRendererWebFallback: true };
-    }
-    catch {
+    const resolved = resolveInstalledSync("@cosmicdrift/kumiko-renderer/web/styles.css", cwd);
+    if (resolved === undefined || !canResolveTailwindStylesheet(resolved, { bun: Bun, cwd })) {
         return undefined;
     }
+    return { path: resolved, isRendererWebFallback: true };
 }
 // Build-time guard against unstyled production output: when the build falls
 // back to renderer-web/styles.css but the compiled CSS lacks the shell sentinel,
@@ -579,9 +573,15 @@ function isTailwindEngine(candidate) {
 // Both packages are the CLI's own dependencies, so they resolve from the CLI package directory
 // (same version the CLI would run), not from the app root.
 async function loadTailwindEngine(cliPath, bun) {
-    const cliDir = dirname(bun.resolveSync("@tailwindcss/cli/package.json", dirname(cliPath)));
-    const node = await import(__rewriteRelativeImportExtension(bun.resolveSync("@tailwindcss/node", cliDir)));
-    const oxide = await import(__rewriteRelativeImportExtension(bun.resolveSync("@tailwindcss/oxide", cliDir)));
+    const cliDir = resolve(cliPath, "..", "..");
+    const importFromCli = (packageName) => {
+        const entry = resolveInstalledSync(packageName, cliDir, bun);
+        if (entry !== undefined)
+            return import(__rewriteRelativeImportExtension(entry));
+        throw new Error(`[kumiko build] ${packageName} is not installed next to @tailwindcss/cli (${cliDir}).`);
+    };
+    const node = await importFromCli("@tailwindcss/node");
+    const oxide = await importFromCli("@tailwindcss/oxide");
     const engine = {
         compile: isRecord(node) ? node["compile"] : undefined,
         optimize: isRecord(node) ? node["optimize"] : undefined,

package/dist/bundled-lists-table.d.ts

@@ -0,0 +1,2 @@
+import { type BundledListsOptions, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export declare function applyBundledListsTable(features: readonly FeatureDefinition[], options: BundledListsOptions | undefined): FeatureDefinition[];

package/dist/bundled-lists-table.js

@@ -0,0 +1,56 @@
+import { normalizeListColumn, validateBundledListsOptions, } from "@cosmicdrift/kumiko-framework/engine";
+export function applyBundledListsTable(features, options) {
+    if (options === undefined)
+        return [...features];
+    validateBundledListsOptions(options);
+    return features.map((feature) => feature.adoptsBundledLists === true ? withListTableDefaults(feature, options) : feature);
+}
+function withListTableDefaults(feature, options) {
+    return {
+        ...feature,
+        screens: Object.fromEntries(Object.entries(feature.screens).map(([id, screen]) => [
+            id,
+            withScreenTableDefaults(screen, options),
+        ])),
+    };
+}
+function withScreenTableDefaults(screen, options) {
+    switch (screen.type) {
+        case "entityList":
+        case "projectionList": {
+            const table = { ...options.table, ...screen.table };
+            return { ...screen, table, columns: pinFirstColumn(screen.columns, table, options) };
+        }
+        case "projectionDetail":
+        case "entityEdit":
+            return {
+                ...screen,
+                layout: {
+                    ...screen.layout,
+                    sections: screen.layout.sections.map((section) => withSectionTableDefaults(section, options)),
+                },
+            };
+        default:
+            return screen;
+    }
+}
+function withSectionTableDefaults(section, options) {
+    if (section.kind !== "relatedList")
+        return section;
+    // export is only valid on entityList and projectionList
+    const { export: _export, ...defaultsWithoutExport } = options.table;
+    const table = { ...defaultsWithoutExport, ...section.table };
+    return { ...section, table, columns: pinFirstColumn(section.columns, table, options) };
+}
+function pinFirstColumn(columns, table, options) {
+    if (options.pinFirstColumn !== true || table.pinning !== true)
+        return columns;
+    const normalized = columns.map(normalizeListColumn);
+    if (normalized.some((column) => column.pinned !== undefined))
+        return columns;
+    // A hidden column only appears via the column picker; pinning it would surprise the user.
+    const firstVisible = normalized.findIndex((column) => column.hidden !== true);
+    if (firstVisible === -1)
+        return columns;
+    return columns.map((column, index) => index === firstVisible ? { ...normalizeListColumn(column), pinned: "left" } : column);
+}

package/dist/compose-auth-options.d.ts

@@ -0,0 +1,16 @@
+import type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOptions, EmailVerificationOptions, InviteOptions, PasswordResetOptions, SignupOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+/** Shape of any run{Prod,Dev}App auth block that can carry a
+ *  passwordReset/emailVerification config, once resolveAuthMail has resolved
+ *  the wrapper's optional hmacSecret into the feature API's required one —
+ *  a structural-typed lookup on the auth-only subset is enough. Lets
+ *  buildComposeAuthOptions be called with both RunProd- and
+ *  RunDev-AuthOptions without building the helper twice. */
+export type AuthOptionsCarrier = {
+    readonly passwordReset?: PasswordResetOptions;
+    readonly emailVerification?: EmailVerificationOptions;
+    readonly signup?: SignupOptions;
+    readonly invite?: InviteOptions;
+    readonly accountUnlock?: AccountUnlockOptions;
+    readonly accountLockout?: AccountLockoutOptions;
+};
+export declare function buildComposeAuthOptions(auth: AuthOptionsCarrier | undefined): AuthEmailPasswordOptions | undefined;

package/dist/compose-auth-options.js

@@ -0,0 +1,49 @@
+// The magic-link mail fields shared by all five flows. Conditional spreads omit
+// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
+// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
+// reset/verify layer hmacSecret (+ mode) on top.
+function pickMailFields(src) {
+    return {
+        appUrl: src.appUrl,
+        ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
+        ...(src.appName !== undefined && { appName: src.appName }),
+        ...(src.locale !== undefined && { locale: src.locale }),
+    };
+}
+export function buildComposeAuthOptions(auth) {
+    if (!auth)
+        return undefined;
+    const opts = {};
+    if (auth.passwordReset) {
+        opts.passwordReset = {
+            hmacSecret: auth.passwordReset.hmacSecret,
+            ...pickMailFields(auth.passwordReset),
+        };
+    }
+    if (auth.emailVerification) {
+        opts.emailVerification = {
+            hmacSecret: auth.emailVerification.hmacSecret,
+            ...pickMailFields(auth.emailVerification),
+            ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
+        };
+    }
+    if (auth.signup) {
+        opts.signup = pickMailFields(auth.signup);
+    }
+    if (auth.invite) {
+        opts.invite = pickMailFields(auth.invite);
+    }
+    if (auth.accountUnlock) {
+        opts.accountUnlock = {
+            hmacSecret: auth.accountUnlock.hmacSecret,
+            ...pickMailFields(auth.accountUnlock),
+        };
+    }
+    if (auth.accountLockout) {
+        opts.accountLockout = auth.accountLockout;
+    }
+    return hasAnyAuthFlow(opts) ? opts : undefined;
+}
+function hasAnyAuthFlow(opts) {
+    return Object.values(opts).some(Boolean);
+}

package/dist/compose-features.d.ts

@@ -1,5 +1,6 @@
-import { type AccountLockoutOptions, type AccountUnlockOptions, type AuthEmailPasswordOptions, type EmailVerificationOptions, type InviteOptions, type PasswordResetOptions, type SignupOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type AuthEmailPasswordOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { type BundledListsOptions, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export { type AuthOptionsCarrier, buildComposeAuthOptions } from "./compose-auth-options.ts";
 export type ComposeFeaturesOptions = {
     /** When true, prepends config + user + tenant + auth-email-password
      *  (+ auth-self-registration when authOptions.signup is set) before the
@@ -12,20 +13,7 @@ export type ComposeFeaturesOptions = {
      *  auth-routes.ts but no handler dispatches). Goes hand-in-hand with the
      *  passwordReset block in RunProdAppAuthOptions / RunDevAppAuthOptions. */
     readonly authOptions?: AuthEmailPasswordOptions;
+    /** One table block for every list screen and relatedList of the bundled features; screen-own keys win. */
+    readonly bundledLists?: BundledListsOptions;
 };
 export declare function composeFeatures(appFeatures: readonly FeatureDefinition[], options: ComposeFeaturesOptions): FeatureDefinition[];
-/** Shape of any run{Prod,Dev}App auth block that can carry a
- *  passwordReset/emailVerification config, once resolveAuthMail has resolved
- *  the wrapper's optional hmacSecret into the feature API's required one —
- *  a structural-typed lookup on the auth-only subset is enough. Lets
- *  buildComposeAuthOptions be called with both RunProd- and
- *  RunDev-AuthOptions without building the helper twice. */
-export type AuthOptionsCarrier = {
-    readonly passwordReset?: PasswordResetOptions;
-    readonly emailVerification?: EmailVerificationOptions;
-    readonly signup?: SignupOptions;
-    readonly invite?: InviteOptions;
-    readonly accountUnlock?: AccountUnlockOptions;
-    readonly accountLockout?: AccountLockoutOptions;
-};
-export declare function buildComposeAuthOptions(auth: AuthOptionsCarrier | undefined): AuthEmailPasswordOptions | undefined;

package/dist/compose-features.js

@@ -21,9 +21,11 @@ import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-featu
 import { collectAssignableAppRoles, createTenantFeature, } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { TENANT_LIFECYCLE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
 import { createUserFeature } from "@cosmicdrift/kumiko-bundled-features/user";
-import { dedupeFeatures } from "@cosmicdrift/kumiko-framework/engine";
+import { dedupeFeatures, } from "@cosmicdrift/kumiko-framework/engine";
 import { FILES_FEATURE } from "@cosmicdrift/kumiko-framework/files";
 import { createRendererMailHtmlFeature } from "@cosmicdrift/kumiko-renderer-mail-html";
+import { applyBundledListsTable } from "./bundled-lists-table.js";
+export { buildComposeAuthOptions } from "./compose-auth-options.js";
 export function composeFeatures(appFeatures, options) {
     // ponytail: includeBundled:false skips the auth-mfa auto-wiring below —
     // an app composing its own foundation and mounting auth-mfa itself is
@@ -32,7 +34,7 @@ export function composeFeatures(appFeatures, options) {
     // bypasses MFA. Upgrade if this trips someone: warn here when appFeatures
     // contains AUTH_MFA_FEATURE but includeBundled is false.
     if (!options.includeBundled)
-        return dedupeFeatures(appFeatures);
+        return applyBundledListsTable(dedupeFeatures(appFeatures), options.bundledLists);
     // Bundled foundation goes first so its instances carry the runDevApp /
     // runProdApp `authOptions` (passwordReset wiring etc.). App-features that
     // ALSO declare one of these names — e.g. the create-kumiko-app picker
@@ -92,12 +94,12 @@ export function composeFeatures(appFeatures, options) {
     const needsFilesTenantData = names.has(FILES_FEATURE) &&
         names.has(TENANT_LIFECYCLE_FEATURE) &&
         !names.has(FILES_TENANT_DATA_FEATURE);
-    return [
+    return applyBundledListsTable([
         ...bundled,
         ...missingAuthMailStack(names),
         ...filteredApp,
         ...(needsFilesTenantData ? [createFilesTenantDataFeature()] : []),
-    ];
+    ], options.bundledLists);
 }
 // auth-email-password declares its mails as stored templates, and the boot seed
 // fails without the template-resolver and a mail renderer. Mounting the missing
@@ -110,52 +112,3 @@ function missingAuthMailStack(mountedNames) {
         createRendererMailHtmlFeature(),
     ].filter((feature) => !mountedNames.has(feature.name));
 }
-// The magic-link mail fields shared by all five flows. Conditional spreads omit
-// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
-// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
-// reset/verify layer hmacSecret (+ mode) on top.
-function pickMailFields(src) {
-    return {
-        appUrl: src.appUrl,
-        ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
-        ...(src.appName !== undefined && { appName: src.appName }),
-        ...(src.locale !== undefined && { locale: src.locale }),
-    };
-}
-export function buildComposeAuthOptions(auth) {
-    if (!auth)
-        return undefined;
-    const opts = {};
-    if (auth.passwordReset) {
-        opts.passwordReset = {
-            hmacSecret: auth.passwordReset.hmacSecret,
-            ...pickMailFields(auth.passwordReset),
-        };
-    }
-    if (auth.emailVerification) {
-        opts.emailVerification = {
-            hmacSecret: auth.emailVerification.hmacSecret,
-            ...pickMailFields(auth.emailVerification),
-            ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
-        };
-    }
-    if (auth.signup) {
-        opts.signup = pickMailFields(auth.signup);
-    }
-    if (auth.invite) {
-        opts.invite = pickMailFields(auth.invite);
-    }
-    if (auth.accountUnlock) {
-        opts.accountUnlock = {
-            hmacSecret: auth.accountUnlock.hmacSecret,
-            ...pickMailFields(auth.accountUnlock),
-        };
-    }
-    if (auth.accountLockout) {
-        opts.accountLockout = auth.accountLockout;
-    }
-    return hasAnyAuthFlow(opts) ? opts : undefined;
-}
-function hasAnyAuthFlow(opts) {
-    return Object.values(opts).some(Boolean);
-}

package/dist/csp-hashes.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { isPlainObject, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
 import { isScriptHash } from "./security-headers.js";
 export const CSP_HASHES_FILE = "csp-hashes.json";
-const INLINE_SCRIPT_PATTERN = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
+const INLINE_SCRIPT_PATTERN = /<script\b((?:"[^"]*"|'[^']*'|[^'">])*)>([\s\S]*?)<\/script\s*>/gi;
 const SRC_ATTRIBUTE_PATTERN = /\ssrc\s*=/i;
 const TYPE_ATTRIBUTE_PATTERN = /\stype\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i;
 // Data blocks (application/json, ld+json, templates) never execute, so

package/dist/extra-routes-deps.d.ts

@@ -1,11 +1,13 @@
 import type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 export type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+export { makeFilesForTenant } from "./files-for-tenant.ts";
 /** Deps for the `wire` hook (runProdApp/createKumikoServer, after
  *  buildServer has mounted `extraRoutes`) and
  *  for `runWorkerApp.wireComponents`. Naming: `deps` not `ctx` because
@@ -18,6 +20,8 @@ export type SystemWireDeps = {
     /** Feature-registry — e.g. for plugin-lookups via
      *  `registry.getExtensionUsages("subscriptionProvider")`. */
     readonly registry: Registry;
+    /** File context of a tenant's storage; undefined when no file storage is mounted. Required so a consumer cannot lose attachment reading by omission. */
+    readonly filesForTenant: (tenantId: string) => FileContext | undefined;
     /** The boot's master key keyring; absent when no `KUMIKO_SECRETS_MASTER_KEY_V<n>` is set. */
     readonly masterKeyProvider?: MasterKeyProvider;
     /** Cipher for `encrypted: true` config keys, same instance and DEK cache as the handlers use. */

package/dist/extra-routes-deps.js

@@ -2,3 +2,4 @@
 // truth lives in framework/api next to buildServer's own `extraRoutes`
 // mount so the two never drift on how the SystemAdmin identity is built.
 export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+export { makeFilesForTenant } from "./files-for-tenant.js";

package/dist/fatal-error-handlers.js

@@ -16,6 +16,7 @@ export function installFatalErrorHandlers(options) {
     const exit = options.exit ?? ((code) => process.exit(code));
     const hardExitMs = options.hardExitMs ?? DEFAULT_HARD_EXIT_MS;
     let handling = false;
+    let stopRunning = false;
     const handle = (source) => (reason) => {
         // skip: a second fault during shutdown is already covered by the running stop and hard-exit timer
         if (handling)
@@ -28,11 +29,13 @@ export function installFatalErrorHandlers(options) {
         });
         const hardExitTimer = setTimeout(() => exit(1), hardExitMs);
         hardExitTimer.unref();
+        stopRunning = true;
         void stop()
             .catch((stopError) => {
             logger.error("shutdown after fatal error failed", describeFatal(stopError));
         })
             .finally(() => {
+            stopRunning = false;
             clearTimeout(hardExitTimer);
             exit(1);
         });
@@ -42,6 +45,10 @@ export function installFatalErrorHandlers(options) {
     process.on("uncaughtException", onUncaughtException);
     process.on("unhandledRejection", onUnhandledRejection);
     return () => {
+        // stop() uninstalls first; during a fatal shutdown the listeners must stay so a second fault cannot hit the default crash path mid-flush
+        // skip: fatal shutdown in progress, see above.
+        if (stopRunning)
+            return;
         process.off("uncaughtException", onUncaughtException);
         process.off("unhandledRejection", onUnhandledRejection);
     };

package/dist/files-for-tenant.d.ts

@@ -0,0 +1,3 @@
+import { type AppContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
+export declare function makeFilesForTenant(context: AppContext): (tenantId: string) => FileContext | undefined;

package/dist/files-for-tenant.js

@@ -0,0 +1,10 @@
+import { fileContextFromResolver } from "@cosmicdrift/kumiko-bundled-features/file-foundation";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+// Takes the AppContext buildServer returned: only that one carries `_fileProviderResolver`.
+// Without a resolver, `context.files` is bound to the system tenant and reaches no other one.
+export function makeFilesForTenant(context) {
+    const resolver = context._fileProviderResolver;
+    if (resolver)
+        return (tenantId) => fileContextFromResolver(resolver, tenantId);
+    return (tenantId) => (tenantId === SYSTEM_TENANT_ID ? context.files : undefined);
+}

package/dist/renderer-web-fonts.js

@@ -3,26 +3,20 @@
 // dir (dev) or hashed into dist/assets (prod), away from the source fonts.
 // data: URIs are out because apps run with `font-src 'self'`.
 import { dirname, join } from "node:path";
+import { resolveInstalledSync } from "./resolve-installed-package.js";
 export const RENDERER_WEB_FONTS_URL_PREFIX = "/assets/kumiko/fonts/";
 /** dist-relative folder the prod build copies the fonts into. */
 export const RENDERER_WEB_FONTS_DIST_DIR = "assets/kumiko/fonts";
 /** Allowlist for servable font file names; also rules out path segments. */
 export const RENDERER_WEB_FONT_FILE_PATTERN = /^[a-z0-9-]+\.woff2$/;
-const hasBun = typeof Bun !== "undefined";
 /** Directory of the woff2 files next to renderer-web's styles.css, or
  *  undefined when the package can't be resolved from any `searchFrom` dir
  *  (or outside Bun, which does the package-exports resolution). */
 export function resolveRendererWebFontsDir(searchFrom) {
-    if (!hasBun)
-        return undefined;
     for (const from of searchFrom) {
-        try {
-            const stylesheet = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", from);
+        const stylesheet = resolveInstalledSync("@cosmicdrift/kumiko-renderer/web/styles.css", from);
+        if (stylesheet !== undefined)
             return join(dirname(stylesheet), "fonts");
-        }
-        catch {
-            // try the next search root
-        }
     }
     return undefined;
 }

package/dist/require-env.d.ts

@@ -0,0 +1,2 @@
+export declare function requireEnv(name: string, src?: Record<string, string | undefined>, context?: string): string;
+export declare function readEnv(name: string, src?: Record<string, string | undefined>): string | undefined;

package/dist/require-env.js

@@ -0,0 +1,21 @@
+// Strict env-var read. Throws with a clear hint when missing — better
+// than discovering a Postgres-connection-refused 30s into the boot.
+// `src` defaults to process.env but is threaded from the caller's envSource
+// so the boot-path reads the SAME env-quelle that was validated above —
+// injected dummies in test-mode must not silently fall back to process.env.
+export function requireEnv(name, src = process.env, context = "runProdApp") {
+    const value = src[name];
+    if (value === undefined || value === "") {
+        const advice = context === "runProdApp"
+            ? "Set it in your container env / .env.production / Coolify secrets."
+            : "Set it in your .env / shell before running the dev server.";
+        throw new Error(`${context}: required env var "${name}" is missing or empty. ${advice}`);
+    }
+    return value;
+}
+// Optional env helper — returns undefined for missing, string for set.
+// Used for KUMIKO_INSTANCE_ID, JWT_ISSUER and other "nice to have" knobs.
+export function readEnv(name, src = process.env) {
+    const value = src[name];
+    return value === undefined || value === "" ? undefined : value;
+}

package/dist/resolve-installed-package.d.ts

@@ -0,0 +1,10 @@
+export type BunResolver = {
+    readonly resolveSync: (id: string, from: string) => string;
+};
+export declare function packageNameOf(specifier: string): string;
+/** Walks node_modules upwards like Node does; returns the real path so transitive deps
+ *  of an isolated-linker install are found as siblings. */
+export declare function findInstalledPackageDir(packageName: string, fromDir: string): string | undefined;
+/** Bun.resolveSync auto-installs from the registry (since 1.4.4) when no node_modules tree
+ *  exists, so only call it for packages that are already installed. */
+export declare function resolveInstalledSync(specifier: string, fromDir: string, bun?: BunResolver | undefined): string | undefined;

package/dist/resolve-installed-package.js

@@ -0,0 +1,32 @@
+import { existsSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+export function packageNameOf(specifier) {
+    const segments = specifier.split("/");
+    return specifier.startsWith("@") ? segments.slice(0, 2).join("/") : (segments[0] ?? specifier);
+}
+/** Walks node_modules upwards like Node does; returns the real path so transitive deps
+ *  of an isolated-linker install are found as siblings. */
+export function findInstalledPackageDir(packageName, fromDir) {
+    for (let dir = resolve(fromDir);; dir = resolve(dir, "..")) {
+        const packageDir = join(dir, "node_modules", packageName);
+        if (existsSync(join(packageDir, "package.json")))
+            return realpathSync(packageDir);
+        if (resolve(dir, "..") === dir)
+            return undefined;
+    }
+}
+const globalBun = typeof Bun !== "undefined" ? Bun : undefined;
+/** Bun.resolveSync auto-installs from the registry (since 1.4.4) when no node_modules tree
+ *  exists, so only call it for packages that are already installed. */
+export function resolveInstalledSync(specifier, fromDir, bun = globalBun) {
+    if (bun === undefined)
+        return undefined;
+    if (findInstalledPackageDir(packageNameOf(specifier), fromDir) === undefined)
+        return undefined;
+    try {
+        return bun.resolveSync(specifier, fromDir);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/resolve-tailwind-cli.d.ts

@@ -1,14 +1,9 @@
-type BunResolver = {
-    resolveSync: (id: string, from: string) => string;
-};
+import { type BunResolver } from "./resolve-installed-package.ts";
 export type ResolveTailwindCliDeps = {
     readonly bun?: BunResolver;
     readonly cwd: string;
 };
 export declare function resolveTailwindCli(deps: ResolveTailwindCliDeps): string | undefined;
-/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
- *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
- *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer/web` outside a hoisted node_modules tree. */
+/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry CSS file, so
+ *  tailwindcss must be installed above it (not just next to a Bun cache copy of renderer-web). */
 export declare function canResolveTailwindStylesheet(entryCss: string, deps: ResolveTailwindCliDeps): boolean;
-export {};