@cosmicdrift/kumiko-server-runtime 0.387.0 → 0.389.0

package/dist/run-worker-app.d.ts

@@ -1,19 +1,21 @@
 import type { ServerOptions } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { FeatureDefinition, Registry, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import type { BundledListsOptions, FeatureDefinition, Registry, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { WorkerEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
 import type { JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
 import { type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
 import type { MasterKeyProvider, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
+import type { DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import { type WorkerMetricsOptions, type WorkerMetricsServer } from "./boot/worker-metrics-server.ts";
 import type { BillingBootOption } from "./boot-options/billing-option.ts";
 import type { FileStorageBootOption } from "./boot-options/file-storage-option.ts";
 import type { KmsMode } from "./boot-options/kms-mode.ts";
 import type { MailBootOption } from "./boot-options/mail-option.ts";
 import { type SystemWireDeps } from "./extra-routes-deps.ts";
+import type { ConfigOverridesInput } from "./run-prod-app-boot-context.ts";
 export type WorkerContextOption = Record<string, unknown> | ((deps: WorkerDeps) => Record<string, unknown>);
 export type WorkerDeps = {
     readonly db: DbConnection;
@@ -39,6 +41,8 @@ export type RunWorkerAppOptions = {
     readonly features: readonly FeatureDefinition[];
     /** Opt-in boot-validator warnings — see ValidateBootOptions. */
     readonly validateBootOptions?: ValidateBootOptions;
+    /** One table block for every list of the bundled features, see ComposeFeaturesOptions.bundledLists. Must match the API process. */
+    readonly bundledLists?: BundledListsOptions;
     /** Mount the auto-mixed config/user/tenant/auth-email-password features —
      *  MUST match the API process's `includeBundled` value, otherwise API
      *  and worker run with a diverging registry topology. Also controls
@@ -62,6 +66,12 @@ export type RunWorkerAppOptions = {
     /** Subject-key adapter for crypto-shredding — boot checks health()
      *  before any connection (see RunProdAppOptions["kms"]). */
     readonly kms?: KmsAdapter;
+    /** App-level config values, same semantics and merge as RunProdAppOptions["appOverrides"];
+     *  the worker renders the mail layouts and must resolve the same branding as the API. */
+    readonly appOverrides?: ConfigOverridesInput;
+    /** Replaces the real clock, sleep and log sink of the boot backoff for the database and
+     *  KMS waits; tests use it to run the retry path without real waiting. */
+    readonly databaseWait?: DatabaseWaitClock;
     /** Blind-index key for lookupable fields (see
      *  RunProdAppOptions["blindIndexKey"]). */
     readonly blindIndexKey?: string;
@@ -90,7 +100,7 @@ export type RunWorkerAppOptions = {
     readonly fileStorage?: FileStorageBootOption;
     /** Same as RunProdAppOptions["kmsMode"]; cannot be combined with `kms` / `blindIndexKey` / `allowPlaintextPii`. */
     readonly kmsMode?: KmsMode;
-    /** Same as RunProdAppOptions["billing"]: mounts subscription-stripe so the registry matches the API. The webhook route belongs to the API process. */
+    /** Same as RunProdAppOptions["billing"]: mounts the configured subscription providers so the registry matches the API. The webhook route belongs to the API process. */
     readonly billing?: BillingBootOption;
     /** Same as RunProdAppOptions["featureToggles"]: mounts feature-toggles and layers the operator switches over the tier resolver. */
     readonly featureToggles?: boolean;

package/dist/run-worker-app.js

@@ -27,6 +27,7 @@ import { resolveBootOptionWiring } from "./boot-options/resolve-boot-options.js"
 import { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.js";
 import { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "./extra-routes-deps.js";
 import { installFatalErrorHandlers } from "./fatal-error-handlers.js";
+import { makeFilesForTenant } from "./files-for-tenant.js";
 import { installProcessLogger, uninstallProcessLogger } from "./process-logger.js";
 function makeBootModeHandle() {
     return {
@@ -127,6 +128,7 @@ export async function runWorkerApp(options) {
             db,
             redis,
             registry,
+            filesForTenant: makeFilesForTenant(entrypoint.context),
             metricsFor: createMetricsForFactory(entrypoint.observability.meter),
             dispatchSystemWrite: makeDispatchSystemWrite(entrypoint.dispatcher),
             dispatchSystemQuery: makeDispatchSystemQuery(entrypoint.dispatcher),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.387.0",
+  "version": "0.389.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,6 +50,10 @@
       "types": "./dist/boot/apply-boot-seeds.d.ts",
       "default": "./dist/boot/apply-boot-seeds.js"
     },
+    "./boot/shared-boot-steps": {
+      "types": "./dist/boot/shared-boot-steps.d.ts",
+      "default": "./dist/boot/shared-boot-steps.js"
+    },
     "./boot/boot-crypto": {
       "types": "./dist/boot/boot-crypto.d.ts",
       "default": "./dist/boot/boot-crypto.js"
@@ -66,6 +70,10 @@
       "types": "./dist/renderer-web-fonts.d.ts",
       "default": "./dist/renderer-web-fonts.js"
     },
+    "./resolve-installed-package": {
+      "types": "./dist/resolve-installed-package.d.ts",
+      "default": "./dist/resolve-installed-package.js"
+    },
     "./resolve-tailwind-cli": {
       "types": "./dist/resolve-tailwind-cli.d.ts",
       "default": "./dist/resolve-tailwind-cli.js"
@@ -88,18 +96,21 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.387.0",
-    "@cosmicdrift/kumiko-framework": "0.387.0",
-    "@cosmicdrift/kumiko-renderer": "0.387.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.387.0",
-    "@cosmicdrift/kumiko-types": "0.387.0",
-    "bun-types": "^1.3.13",
+    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
+    "@cosmicdrift/kumiko-framework": "0.389.0",
+    "@cosmicdrift/kumiko-renderer": "0.389.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.389.0",
+    "@cosmicdrift/kumiko-types": "0.389.0",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
+  "peerDependencies": {
+    "bun-types": "^1.4.4"
+  },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.387.0"
+    "@cosmicdrift/kumiko-testing": "0.389.0",
+    "bun-types": "^1.4.4"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -137,6 +148,10 @@
         "types": "./dist/boot/apply-boot-seeds.d.ts",
         "default": "./dist/boot/apply-boot-seeds.js"
       },
+      "./boot/shared-boot-steps": {
+        "types": "./dist/boot/shared-boot-steps.d.ts",
+        "default": "./dist/boot/shared-boot-steps.js"
+      },
       "./boot/boot-crypto": {
         "types": "./dist/boot/boot-crypto.d.ts",
         "default": "./dist/boot/boot-crypto.js"
@@ -153,6 +168,10 @@
         "types": "./dist/renderer-web-fonts.d.ts",
         "default": "./dist/renderer-web-fonts.js"
       },
+      "./resolve-installed-package": {
+        "types": "./dist/resolve-installed-package.d.ts",
+        "default": "./dist/resolve-installed-package.js"
+      },
       "./resolve-tailwind-cli": {
         "types": "./dist/resolve-tailwind-cli.d.ts",
         "default": "./dist/resolve-tailwind-cli.js"

package/src/changes.json

@@ -1,4 +1,90 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "The renderer-web stylesheet fallback checks tailwindcss in node_modules",
+    "detail": "canResolveTailwindStylesheet looks for tailwindcss in the node_modules directories above the stylesheet, as Tailwind does, instead of asking Bun.resolveSync. On Bun 1.4.4 the resolver auto-installs tailwindcss next to a renderer copy in Bun's install cache, so a build without a node_modules tree took the fallback and then failed in Tailwind with \"Can't resolve 'tailwindcss'\". Such a build skips the fallback stylesheet again."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Package lookups no longer auto-install from the registry",
+    "detail": "The new @cosmicdrift/kumiko-server-runtime/resolve-installed-package export looks up node_modules before asking Bun.resolveSync, which installs missing packages from the registry since Bun 1.4.4. The prod build, the dev-server stylesheet lookup and the handbuch commands use it."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "bundledLists sets one table block for every bundled list",
+    "detail": "composeFeatures takes bundledLists with a table block and an optional pinFirstColumn flag. The block is mixed into every entityList, projectionList and relatedList section of the bundled features, the foundation features user and tenant as well as the features an app mounts from @cosmicdrift/kumiko-bundled-features, before the boot validator runs. A key the screen sets itself wins, export is left out on relatedList sections, and pinFirstColumn pins the first visible column left where no column is pinned yet. grouping and totals are rejected in the shared block. App screens stay untouched. Features opt in with the new registrar method r.adoptsBundledLists(), which every bundled feature with lists calls and which feature packages such as Enterprise can call for their own lists; app features never do. No migration for apps. The option lives in AppConfig.bundledLists for the managed kumiko/schema.ts and in the run options of runProdApp, runDevApp and runWorkerApp, so kumiko check and the running app see the same screens."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Boot database backoff takes an injectable clock",
+    "detail": "The new databaseWait option on runProdApp and runWorkerApp swaps sleep, now and the log sink of the database, KMS and seed waits. A worker boot against an unreachable database is now tested to retry until the deadline, abort with the connection error and close its Redis clients."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Default CSP covers inline scripts of HTML written after the build",
+    "detail": "At boot the hashes from csp-hashes.json are merged with the inline scripts found in the HTML files under staticDir, for the default CSP and for hostDispatch. Boot-rendered pages keep their inline scripts working without a custom securityHeaders.csp."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Read-only demo mode blocks WebSocket upgrades",
+    "detail": "Upgrade requests count as mutating in the demo read-only gate and get 403 demo_read_only unless the route path is in allowedWritePaths. Socket routes in a read-only demo that need to stay open must be listed there."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "BootOptionName drops demoMode, seeds and signals",
+    "detail": "No stack declared them in bootRequires, so their boot checks never ran. A name returns together with its check and a test once a stack needs it.",
+    "migration": "no known callers; remove \"demoMode\", \"seeds\" and \"signals\" from bootRequires options"
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "appOverrides work in runWorkerApp and runDevApp",
+    "detail": "Both boot functions take the same appOverrides option as runProdApp and share its merge, so worker-rendered mails and the dev server resolve the same tenant model, branding and SEO values as the API. The runSingleInstance:false warning names appOverrides next to mail, fileStorage and featureToggles."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Boot seeds survive a short database outage",
+    "detail": "applyStandardBootSeeds re-runs the idempotent seed sequence with the database backoff on transient connection errors (ECONNREFUSED, connection class 08, too_many_connections) until the 90 second deadline. Non-transient errors still abort the boot at once."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "filesForTenant in SystemWireDeps",
+    "detail": "The wire hook and the worker wireComponents receive filesForTenant, built from the AppContext after buildServer wired it. ApiEntrypoint and WorkerEntrypoint expose that context as entrypoint.context."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "runProdApp split into boot phases, boot steps shared with dev and worker",
+    "detail": "runProdApp() keeps its signature and behavior. Config resolution, feature composition, dependency connection, request context, auth wiring, entrypoint, seeds and the returned handle now live in run-prod-app-*.ts files next to run-prod-app.ts. Steps that prod, dev and the worker ran as copies (env defaults, feature composition, boot validation, the auth-mfa switch-tenant gate, the tier and feature-toggle resolver, standard boot seeds, shared auth routes, the KMS health gate and the database pools) live once in the new subpath @cosmicdrift/kumiko-server-runtime/boot/shared-boot-steps. requireEnv is still exported from run-prod-app under the same name."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "runProdApp releases connections when the boot fails",
+    "detail": "A failing boot closes the database pools, the Redis client and the KMS adapter it already opened. The KMS health wait logs \"KMS not reachable\" instead of \"database not reachable\"."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Boot validation and shutdown hardening",
+    "detail": "The KMS and app database waits share one deadline so a boot never outlasts the liveness window. An app-supplied master key provider is checked at boot, also in a dry run. Additional fileStorage providers get the same production and S3 checks as the default one, and their env keys are validated. appOverrides without auth or delivery feature abort instead of being dropped. A fatal shutdown keeps its listeners installed, and inline script hashing handles a \">\" inside quoted attributes."
+  },
+  {
+    "version": "0.388.0",
+    "type": "breaking",
+    "title": "billing boot option takes stripe and/or dodo",
+    "detail": "billing.stripe is now optional and billing.dodo is new (priceToTier, oneOffPriceIds). At least one is required. resolveBillingOption returns features (an array) instead of feature, and one webhook route serves every provider on stripe.webhookPath or SUBSCRIPTION_WEBHOOK_PATH. DODO_PAYMENTS_API_KEY and DODO_PAYMENTS_WEBHOOK_KEY are the env bridge.",
+    "migration": "Callers of resolveBillingOption use billing.features instead of billing.feature."
+  },
   {
     "version": "0.385.0",
     "type": "improvement",