@cosmicdrift/kumiko-server-runtime 0.388.0 → 0.389.0

package/dist/boot/shared-boot-steps.d.ts

@@ -2,16 +2,17 @@ import { type SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth
 import type { AuthRoutesConfig } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type EffectiveFeaturesResolver, type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import { type BundledListsOptions, type EffectiveFeaturesResolver, type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import type { FeatureTogglesWiring } from "../boot-options/feature-toggles-option.ts";
 import type { DbSeedFn } from "../boot-options/seed-shortcuts.ts";
 import { type AuthOptionsCarrier } from "../compose-features.ts";
 import type { RunProdAppAuthOptions } from "../run-prod-app.ts";
+import { type DatabaseWaitClock } from "./wait-for-database.ts";
 /** Returns `envSource` itself (it may be `process.env`) when there is nothing to layer under it. */
 export declare function withEnvDefaults(envDefaults: Readonly<Record<string, string | undefined>>, envSource: Record<string, string | undefined>): Record<string, string | undefined>;
-export declare function composeAppFeatures(appFeatures: readonly FeatureDefinition[], bootFeatures: readonly FeatureDefinition[], effectiveAuth: AuthOptionsCarrier | undefined): readonly FeatureDefinition[];
+export declare function composeAppFeatures(appFeatures: readonly FeatureDefinition[], bootFeatures: readonly FeatureDefinition[], effectiveAuth: AuthOptionsCarrier | undefined, bundledLists?: BundledListsOptions): readonly FeatureDefinition[];
 export declare function validateComposedFeatures(features: readonly FeatureDefinition[], bootOptions: ValidateBootOptions): void;
 export declare function assertMfaSwitchTenantGate(registry: Registry, processName: string): void;
 export declare function buildEffectiveFeaturesResolver(deps: {
@@ -27,13 +28,15 @@ export declare function applyStandardBootSeeds(deps: {
     readonly admin: SeedAdminOptions | undefined;
     readonly shortcutSeeds: readonly DbSeedFn[];
     readonly cipher: EnvelopeCipher | undefined;
+    readonly processName: string;
+    readonly databaseWait?: DatabaseWaitClock;
 }): Promise<void>;
 type SharedAuthFlowFields = Pick<RunProdAppAuthOptions, "passwordReset" | "emailVerification" | "accountUnlock" | "signup" | "invite">;
 type AuthFlowRoutes = Pick<AuthRoutesConfig, "passwordReset" | "emailVerification" | "accountUnlock" | "signup" | "invite">;
 export type SharedAuthRouteSource = SharedAuthFlowFields & Pick<RunProdAppAuthOptions, "loginErrorStatusMap" | "cookieDomain" | "retiredCookieDomains" | "allowedOrigins" | "unsafeSkipOriginCheck" | "postAuthLanding">;
 export type SharedAuthRoutes = AuthFlowRoutes & Pick<AuthRoutesConfig, "membershipQuery" | "loginHandler" | "loginErrorStatusMap" | "cookieDomain" | "retiredCookieDomains" | "allowedOrigins" | "unsafeSkipOriginCheck" | "postAuthLanding" | "mfaVerifyHandler" | "switchTenantMfaGateHandler" | "mfaPreauthEnableStartHandler" | "mfaPreauthConfirmHandler">;
 export declare function buildSharedAuthRoutes(effectiveAuth: SharedAuthRouteSource, hasMfa: boolean): SharedAuthRoutes;
-export declare function waitForKmsHealthy(kms: KmsAdapter, processName: string, deadline: number): Promise<void>;
+export declare function waitForKmsHealthy(kms: KmsAdapter, processName: string, deadline: number, clock?: DatabaseWaitClock): Promise<void>;
 export declare function openDatabasePools(databaseUrl: string, envSource: Record<string, string | undefined>): {
     readonly db: DbConnection;
     readonly closeDb: () => Promise<void>;

package/dist/boot/shared-boot-steps.js

@@ -15,11 +15,12 @@ import { waitUntilDatabaseReachable } from "./wait-for-database.js";
 export function withEnvDefaults(envDefaults, envSource) {
     return Object.keys(envDefaults).length > 0 ? { ...envDefaults, ...envSource } : envSource;
 }
-export function composeAppFeatures(appFeatures, bootFeatures, effectiveAuth) {
+export function composeAppFeatures(appFeatures, bootFeatures, effectiveAuth, bundledLists) {
     const composeAuthOptions = buildComposeAuthOptions(effectiveAuth);
     return composeFeatures([...appFeatures, ...bootFeatures], {
         includeBundled: !!effectiveAuth,
         ...(composeAuthOptions && { authOptions: composeAuthOptions }),
+        ...(bundledLists && { bundledLists }),
     });
 }
 export function validateComposedFeatures(features, bootOptions) {
@@ -46,19 +47,23 @@ export async function buildEffectiveFeaturesResolver(deps) {
     return bound.resolver;
 }
 export async function applyStandardBootSeeds(deps) {
-    const { db, registry, admin, shortcutSeeds, cipher } = deps;
-    if (admin) {
-        await seedAdminGuarded(db, admin);
-    }
-    for (const seed of shortcutSeeds) {
-        await seed(db);
-    }
-    // The helper indirection is what config-seed-boot.integration.ts pins — keep it as a single call.
-    await applyBootSeeds({
-        registry,
-        db,
-        ...(cipher && { cipher }),
-    });
+    const { db, registry, admin, shortcutSeeds, cipher, processName, databaseWait } = deps;
+    // Seeds are idempotent, so a transient connection error re-runs the whole sequence; any other
+    // error stays fatal. Later boot steps build on the seeds, so this cannot continue in the background.
+    await waitUntilDatabaseReachable(async () => {
+        if (admin) {
+            await seedAdminGuarded(db, admin);
+        }
+        for (const seed of shortcutSeeds) {
+            await seed(db);
+        }
+        // The helper indirection is what config-seed-boot.integration.ts pins — keep it as a single call.
+        await applyBootSeeds({
+            registry,
+            db,
+            ...(cipher && { cipher }),
+        });
+    }, { ...databaseWait, processName, target: "database (boot seeds)" });
 }
 const MFA_ROUTE_HANDLERS = {
     mfaVerifyHandler: AuthMfaHandlers.verify,
@@ -129,8 +134,9 @@ export function buildSharedAuthRoutes(effectiveAuth, hasMfa) {
         ...buildAuthFlowRoutes(effectiveAuth),
     };
 }
-export async function waitForKmsHealthy(kms, processName, deadline) {
+export async function waitForKmsHealthy(kms, processName, deadline, clock) {
     const kmsHealth = await waitUntilDatabaseReachable(() => kms.health(), {
+        ...clock,
         processName,
         target: "KMS",
         deadline,

package/dist/boot/wait-for-database.d.ts

@@ -12,5 +12,7 @@ export type WaitForDatabaseOptions = {
     readonly now?: () => number;
     readonly deadline?: number;
 };
+/** Injectable clock and sink; tests drive the backoff without real waiting. */
+export type DatabaseWaitClock = Pick<WaitForDatabaseOptions, "log" | "sleep" | "now">;
 export declare function waitForDatabase(db: DbConnection, options: WaitForDatabaseOptions): Promise<void>;
 export declare function waitUntilDatabaseReachable<T>(ping: () => Promise<T>, options: WaitForDatabaseOptions): Promise<T>;

package/dist/boot/wait-for-database.js

@@ -7,9 +7,10 @@ const TRANSIENT_CODES = new Set([
     "ETIMEDOUT",
     "ENOTFOUND",
     "EAI_AGAIN",
-    "CONNECTION_CLOSED",
-    "CONNECT_TIMEOUT",
-    "CONNECTION_DESTROYED",
+    "ERR_POSTGRES_CONNECTION_CLOSED",
+    "ERR_POSTGRES_CONNECTION_REFUSED",
+    "ERR_POSTGRES_CONNECTION_TIMEOUT",
+    "ERR_POSTGRES_CONNECTION_FAILED",
 ]);
 const CONNECTION_EXCEPTION_CLASS = "08";
 export function isTransientConnectionError(error) {

package/dist/boot/worker-boot-core.js

@@ -67,6 +67,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
     const features = composeFeatures(options.features, {
         includeBundled,
         ...(profile.authOptions && { authOptions: profile.authOptions }),
+        ...(options.bundledLists && { bundledLists: options.bundledLists }),
     });
     const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
     validateBoot(features, {
@@ -92,9 +93,9 @@ export async function bootWorkerProcess(options, envSource, profile) {
         return { kind: "dry-run", envSource };
     }
     // Before the connections, so an abort leaks nothing.
-    const databaseWaitDeadline = Date.now() + WAIT_FOR_DATABASE_DEADLINE_MS;
+    const databaseWaitDeadline = (options.databaseWait?.now ?? Date.now)() + WAIT_FOR_DATABASE_DEADLINE_MS;
     if (options.kms) {
-        await waitForKmsHealthy(options.kms, processName, databaseWaitDeadline);
+        await waitForKmsHealthy(options.kms, processName, databaseWaitDeadline, options.databaseWait);
     }
     const { db, closeDb, outsideTransactionDb, closeOutsideTransactionDb } = openDatabasePools(databaseUrl, envSource);
     const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
@@ -103,7 +104,11 @@ export async function bootWorkerProcess(options, envSource, profile) {
         clientOptions: redisClientOptionsFromEnv(envSource),
     });
     try {
-        await waitForDatabase(db, { processName, deadline: databaseWaitDeadline });
+        await waitForDatabase(db, {
+            ...options.databaseWait,
+            processName,
+            deadline: databaseWaitDeadline,
+        });
     }
     catch (err) {
         await closeDb();
@@ -151,6 +156,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
         registry,
         hasAuth: includeBundled,
         redis,
+        ...(options.appOverrides && { appOverrides: options.appOverrides }),
         crypto: bootCrypto,
         ...(options.kms && { kms: options.kms }),
         ...(profile.deliverQueuedInline === true && { deliverQueuedInline: true }),

package/dist/boot-options/demo-mode.d.ts

@@ -1,4 +1,4 @@
-import type { ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
+import { type ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
 export type DemoAccountRole = "admin" | "sysadmin";
 /** A role alone, or a role with the label the banner shows next to the login. */
 export type DemoAccountEntry = DemoAccountRole | {
@@ -19,7 +19,7 @@ export type DemoModeNotice = {
     readonly accounts?: readonly DemoAccountEntry[];
 };
 /** Live-demo switch. `readOnly: true` answers every mutating request
- *  (POST/PUT/PATCH/DELETE) outside `/api/query` and the login/logout/MFA
+ *  (POST/PUT/PATCH/DELETE) and every WebSocket upgrade outside `/api/query` and the login/logout/MFA
  *  routes with 403 `demo_read_only`. `GET /demo-mode` (anonymous) returns
  *  `{ readOnly, notice }` for the client banner.
  *
@@ -32,7 +32,7 @@ export type DemoModeNotice = {
 export type DemoModeOption = {
     readonly readOnly: boolean;
     readonly notice?: DemoModeNotice;
-    /** Mutating paths that stay open besides the default allowlist. */
+    /** Mutating paths (and WebSocket route paths) that stay open besides the default allowlist. */
     readonly allowedWritePaths?: readonly string[];
 };
 export declare const DEMO_MODE_PATH = "/demo-mode";

package/dist/boot-options/demo-mode.js

@@ -1,3 +1,4 @@
+import { isWebSocketUpgradeRequest, } from "@cosmicdrift/kumiko-framework/api";
 export const DEMO_MODE_PATH = "/demo-mode";
 export const DEMO_READ_ONLY_ERROR_CODE = "demo_read_only";
 const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
@@ -52,7 +53,9 @@ export function withDemoReadOnlyFetch(fetchHandler, demoMode) {
         ...(demoMode.allowedWritePaths ?? []),
     ]);
     return async (req, arg) => {
-        if (MUTATING_METHODS.has(req.method) && !allowed.has(new URL(req.url).pathname)) {
+        // A socket carries writes after the upgrade (route `write` dep), outside this method gate.
+        const mutates = MUTATING_METHODS.has(req.method) || isWebSocketUpgradeRequest(req);
+        if (mutates && !allowed.has(new URL(req.url).pathname)) {
             return Response.json({
                 isSuccess: false,
                 error: {

package/dist/boot-options/resolve-boot-options.d.ts

@@ -24,6 +24,7 @@ export type BootOptionFields = {
     /** With `runSingleInstance: false`: the worker process mounts the same mail / fileStorage
      *  features (its own boot options or by hand), which silences the boot warning. */
     readonly workerMountsFeatures?: boolean;
+    readonly appOverrides?: object;
     readonly auth?: {
         readonly admin?: unknown;
         readonly mail?: {

package/dist/boot-options/resolve-boot-options.js

@@ -46,9 +46,9 @@ function wireFeatureToggles(options, mounted) {
 function warnAboutBootOptions(options) {
     const bootWarnings = stackBootWarnings(options).map((line) => `stacks in \`features\` expect boot options that are not set:\n${line}`);
     if (options.runSingleInstance === false &&
-        (options.mail || options.fileStorage || options.featureToggles) &&
+        (options.mail || options.fileStorage || options.featureToggles || options.appOverrides) &&
         options.workerMountsFeatures !== true) {
-        bootWarnings.push("runSingleInstance:false — delivery and file jobs run in runWorkerApp. Pass the same mail / fileStorage / featureToggles options there, or set workerMountsFeatures: true if it mounts those features itself.");
+        bootWarnings.push("runSingleInstance:false — delivery and file jobs run in runWorkerApp. Pass the same mail / fileStorage / featureToggles / appOverrides options there, or set workerMountsFeatures: true if it mounts those features itself.");
     }
     if (bootWarnings.length > 0) {
         // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early

package/dist/boot-options/stack-boot-requirements.d.ts

@@ -3,7 +3,7 @@ import type { RunProdAppOptions } from "../run-prod-app.ts";
 export type StackBootOptionFields = Pick<RunProdAppOptions, "features" | "kms" | "allowPlaintextPii" | BootOptionName>;
 /** Reads `bootRequires` from the raw feature list: dedupe may later drop the
  *  tagged copy of a feature two stacks share. `scope` limits the check to the
- *  options the calling boot function can set at all (runDevApp has no `signals`). */
+ *  options the calling boot function can set at all. */
 export declare function assertStackBootRequirements(options: StackBootOptionFields, scope?: readonly BootOptionName[]): void;
 /** Requirements a stack marked `severity: "warn"`: logged at boot, never fatal. */
 export declare function stackBootWarnings(options: StackBootOptionFields): string[];

package/dist/boot-options/stack-boot-requirements.js

@@ -29,18 +29,6 @@ const OPTION_CHECKS = {
         isSatisfied: (options) => options.featureToggles === true,
         hint: "set featureToggles: true",
     },
-    demoMode: {
-        isSatisfied: (options) => options.demoMode !== undefined,
-        hint: "set demoMode: { readOnly }",
-    },
-    seeds: {
-        isSatisfied: (options) => options.seeds !== undefined,
-        hint: "set seeds",
-    },
-    signals: {
-        isSatisfied: (options) => options.signals !== false,
-        hint: "drop signals: false",
-    },
     rateLimit: {
         isSatisfied: (options) => options.rateLimit !== false,
         hint: "drop rateLimit: false",
@@ -65,7 +53,7 @@ function unsatisfiedRequirements(options, severity, scope) {
 }
 /** Reads `bootRequires` from the raw feature list: dedupe may later drop the
  *  tagged copy of a feature two stacks share. `scope` limits the check to the
- *  options the calling boot function can set at all (runDevApp has no `signals`). */
+ *  options the calling boot function can set at all. */
 export function assertStackBootRequirements(options, scope) {
     const gaps = unsatisfiedRequirements(options, "error", scope);
     if (gaps.length > 0) {

package/dist/build-prod-bundle.js

@@ -63,6 +63,7 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { BUNDLED_ASSETS_DIST_DIR, readBundledAssetDeclarations, resolveBundledAssetSource, } from "./bundled-assets.js";
 import { CSP_HASHES_FILE, inlineScriptHashes } from "./csp-hashes.js";
 import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_DIST_DIR, resolveRendererWebFontsDir, } from "./renderer-web-fonts.js";
+import { resolveInstalledSync } from "./resolve-installed-package.js";
 import { canResolveTailwindStylesheet, resolveTailwindCli } from "./resolve-tailwind-cli.js";
 // Bun runtime check as a module-level constant: every build step (Tailwind via
 // Bun.spawn, client bundling via Bun.build, and stylesheet resolution via
@@ -454,18 +455,11 @@ function resolveStylesheetEntry(cwd, clientEntry, override) {
     // and production builds behave identically.
     if (!clientEntry)
         return undefined;
-    if (!hasBun)
-        return undefined;
-    try {
-        const resolved = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", cwd);
-        if (!canResolveTailwindStylesheet(resolved, { bun: Bun, cwd })) {
-            return undefined;
-        }
-        return { path: resolved, isRendererWebFallback: true };
-    }
-    catch {
+    const resolved = resolveInstalledSync("@cosmicdrift/kumiko-renderer/web/styles.css", cwd);
+    if (resolved === undefined || !canResolveTailwindStylesheet(resolved, { bun: Bun, cwd })) {
         return undefined;
     }
+    return { path: resolved, isRendererWebFallback: true };
 }
 // Build-time guard against unstyled production output: when the build falls
 // back to renderer-web/styles.css but the compiled CSS lacks the shell sentinel,
@@ -579,9 +573,15 @@ function isTailwindEngine(candidate) {
 // Both packages are the CLI's own dependencies, so they resolve from the CLI package directory
 // (same version the CLI would run), not from the app root.
 async function loadTailwindEngine(cliPath, bun) {
-    const cliDir = dirname(bun.resolveSync("@tailwindcss/cli/package.json", dirname(cliPath)));
-    const node = await import(__rewriteRelativeImportExtension(bun.resolveSync("@tailwindcss/node", cliDir)));
-    const oxide = await import(__rewriteRelativeImportExtension(bun.resolveSync("@tailwindcss/oxide", cliDir)));
+    const cliDir = resolve(cliPath, "..", "..");
+    const importFromCli = (packageName) => {
+        const entry = resolveInstalledSync(packageName, cliDir, bun);
+        if (entry !== undefined)
+            return import(__rewriteRelativeImportExtension(entry));
+        throw new Error(`[kumiko build] ${packageName} is not installed next to @tailwindcss/cli (${cliDir}).`);
+    };
+    const node = await importFromCli("@tailwindcss/node");
+    const oxide = await importFromCli("@tailwindcss/oxide");
     const engine = {
         compile: isRecord(node) ? node["compile"] : undefined,
         optimize: isRecord(node) ? node["optimize"] : undefined,

package/dist/bundled-lists-table.d.ts

@@ -0,0 +1,2 @@
+import { type BundledListsOptions, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export declare function applyBundledListsTable(features: readonly FeatureDefinition[], options: BundledListsOptions | undefined): FeatureDefinition[];

package/dist/bundled-lists-table.js

@@ -0,0 +1,56 @@
+import { normalizeListColumn, validateBundledListsOptions, } from "@cosmicdrift/kumiko-framework/engine";
+export function applyBundledListsTable(features, options) {
+    if (options === undefined)
+        return [...features];
+    validateBundledListsOptions(options);
+    return features.map((feature) => feature.adoptsBundledLists === true ? withListTableDefaults(feature, options) : feature);
+}
+function withListTableDefaults(feature, options) {
+    return {
+        ...feature,
+        screens: Object.fromEntries(Object.entries(feature.screens).map(([id, screen]) => [
+            id,
+            withScreenTableDefaults(screen, options),
+        ])),
+    };
+}
+function withScreenTableDefaults(screen, options) {
+    switch (screen.type) {
+        case "entityList":
+        case "projectionList": {
+            const table = { ...options.table, ...screen.table };
+            return { ...screen, table, columns: pinFirstColumn(screen.columns, table, options) };
+        }
+        case "projectionDetail":
+        case "entityEdit":
+            return {
+                ...screen,
+                layout: {
+                    ...screen.layout,
+                    sections: screen.layout.sections.map((section) => withSectionTableDefaults(section, options)),
+                },
+            };
+        default:
+            return screen;
+    }
+}
+function withSectionTableDefaults(section, options) {
+    if (section.kind !== "relatedList")
+        return section;
+    // export is only valid on entityList and projectionList
+    const { export: _export, ...defaultsWithoutExport } = options.table;
+    const table = { ...defaultsWithoutExport, ...section.table };
+    return { ...section, table, columns: pinFirstColumn(section.columns, table, options) };
+}
+function pinFirstColumn(columns, table, options) {
+    if (options.pinFirstColumn !== true || table.pinning !== true)
+        return columns;
+    const normalized = columns.map(normalizeListColumn);
+    if (normalized.some((column) => column.pinned !== undefined))
+        return columns;
+    // A hidden column only appears via the column picker; pinning it would surprise the user.
+    const firstVisible = normalized.findIndex((column) => column.hidden !== true);
+    if (firstVisible === -1)
+        return columns;
+    return columns.map((column, index) => index === firstVisible ? { ...normalizeListColumn(column), pinned: "left" } : column);
+}

package/dist/compose-auth-options.d.ts

@@ -0,0 +1,16 @@
+import type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOptions, EmailVerificationOptions, InviteOptions, PasswordResetOptions, SignupOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+/** Shape of any run{Prod,Dev}App auth block that can carry a
+ *  passwordReset/emailVerification config, once resolveAuthMail has resolved
+ *  the wrapper's optional hmacSecret into the feature API's required one —
+ *  a structural-typed lookup on the auth-only subset is enough. Lets
+ *  buildComposeAuthOptions be called with both RunProd- and
+ *  RunDev-AuthOptions without building the helper twice. */
+export type AuthOptionsCarrier = {
+    readonly passwordReset?: PasswordResetOptions;
+    readonly emailVerification?: EmailVerificationOptions;
+    readonly signup?: SignupOptions;
+    readonly invite?: InviteOptions;
+    readonly accountUnlock?: AccountUnlockOptions;
+    readonly accountLockout?: AccountLockoutOptions;
+};
+export declare function buildComposeAuthOptions(auth: AuthOptionsCarrier | undefined): AuthEmailPasswordOptions | undefined;

package/dist/compose-auth-options.js

@@ -0,0 +1,49 @@
+// The magic-link mail fields shared by all five flows. Conditional spreads omit
+// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
+// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
+// reset/verify layer hmacSecret (+ mode) on top.
+function pickMailFields(src) {
+    return {
+        appUrl: src.appUrl,
+        ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
+        ...(src.appName !== undefined && { appName: src.appName }),
+        ...(src.locale !== undefined && { locale: src.locale }),
+    };
+}
+export function buildComposeAuthOptions(auth) {
+    if (!auth)
+        return undefined;
+    const opts = {};
+    if (auth.passwordReset) {
+        opts.passwordReset = {
+            hmacSecret: auth.passwordReset.hmacSecret,
+            ...pickMailFields(auth.passwordReset),
+        };
+    }
+    if (auth.emailVerification) {
+        opts.emailVerification = {
+            hmacSecret: auth.emailVerification.hmacSecret,
+            ...pickMailFields(auth.emailVerification),
+            ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
+        };
+    }
+    if (auth.signup) {
+        opts.signup = pickMailFields(auth.signup);
+    }
+    if (auth.invite) {
+        opts.invite = pickMailFields(auth.invite);
+    }
+    if (auth.accountUnlock) {
+        opts.accountUnlock = {
+            hmacSecret: auth.accountUnlock.hmacSecret,
+            ...pickMailFields(auth.accountUnlock),
+        };
+    }
+    if (auth.accountLockout) {
+        opts.accountLockout = auth.accountLockout;
+    }
+    return hasAnyAuthFlow(opts) ? opts : undefined;
+}
+function hasAnyAuthFlow(opts) {
+    return Object.values(opts).some(Boolean);
+}

package/dist/compose-features.d.ts

@@ -1,5 +1,6 @@
-import { type AccountLockoutOptions, type AccountUnlockOptions, type AuthEmailPasswordOptions, type EmailVerificationOptions, type InviteOptions, type PasswordResetOptions, type SignupOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type AuthEmailPasswordOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { type BundledListsOptions, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export { type AuthOptionsCarrier, buildComposeAuthOptions } from "./compose-auth-options.ts";
 export type ComposeFeaturesOptions = {
     /** When true, prepends config + user + tenant + auth-email-password
      *  (+ auth-self-registration when authOptions.signup is set) before the
@@ -12,20 +13,7 @@ export type ComposeFeaturesOptions = {
      *  auth-routes.ts but no handler dispatches). Goes hand-in-hand with the
      *  passwordReset block in RunProdAppAuthOptions / RunDevAppAuthOptions. */
     readonly authOptions?: AuthEmailPasswordOptions;
+    /** One table block for every list screen and relatedList of the bundled features; screen-own keys win. */
+    readonly bundledLists?: BundledListsOptions;
 };
 export declare function composeFeatures(appFeatures: readonly FeatureDefinition[], options: ComposeFeaturesOptions): FeatureDefinition[];
-/** Shape of any run{Prod,Dev}App auth block that can carry a
- *  passwordReset/emailVerification config, once resolveAuthMail has resolved
- *  the wrapper's optional hmacSecret into the feature API's required one —
- *  a structural-typed lookup on the auth-only subset is enough. Lets
- *  buildComposeAuthOptions be called with both RunProd- and
- *  RunDev-AuthOptions without building the helper twice. */
-export type AuthOptionsCarrier = {
-    readonly passwordReset?: PasswordResetOptions;
-    readonly emailVerification?: EmailVerificationOptions;
-    readonly signup?: SignupOptions;
-    readonly invite?: InviteOptions;
-    readonly accountUnlock?: AccountUnlockOptions;
-    readonly accountLockout?: AccountLockoutOptions;
-};
-export declare function buildComposeAuthOptions(auth: AuthOptionsCarrier | undefined): AuthEmailPasswordOptions | undefined;

package/dist/compose-features.js

@@ -21,9 +21,11 @@ import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-featu
 import { collectAssignableAppRoles, createTenantFeature, } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { TENANT_LIFECYCLE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
 import { createUserFeature } from "@cosmicdrift/kumiko-bundled-features/user";
-import { dedupeFeatures } from "@cosmicdrift/kumiko-framework/engine";
+import { dedupeFeatures, } from "@cosmicdrift/kumiko-framework/engine";
 import { FILES_FEATURE } from "@cosmicdrift/kumiko-framework/files";
 import { createRendererMailHtmlFeature } from "@cosmicdrift/kumiko-renderer-mail-html";
+import { applyBundledListsTable } from "./bundled-lists-table.js";
+export { buildComposeAuthOptions } from "./compose-auth-options.js";
 export function composeFeatures(appFeatures, options) {
     // ponytail: includeBundled:false skips the auth-mfa auto-wiring below —
     // an app composing its own foundation and mounting auth-mfa itself is
@@ -32,7 +34,7 @@ export function composeFeatures(appFeatures, options) {
     // bypasses MFA. Upgrade if this trips someone: warn here when appFeatures
     // contains AUTH_MFA_FEATURE but includeBundled is false.
     if (!options.includeBundled)
-        return dedupeFeatures(appFeatures);
+        return applyBundledListsTable(dedupeFeatures(appFeatures), options.bundledLists);
     // Bundled foundation goes first so its instances carry the runDevApp /
     // runProdApp `authOptions` (passwordReset wiring etc.). App-features that
     // ALSO declare one of these names — e.g. the create-kumiko-app picker
@@ -92,12 +94,12 @@ export function composeFeatures(appFeatures, options) {
     const needsFilesTenantData = names.has(FILES_FEATURE) &&
         names.has(TENANT_LIFECYCLE_FEATURE) &&
         !names.has(FILES_TENANT_DATA_FEATURE);
-    return [
+    return applyBundledListsTable([
         ...bundled,
         ...missingAuthMailStack(names),
         ...filteredApp,
         ...(needsFilesTenantData ? [createFilesTenantDataFeature()] : []),
-    ];
+    ], options.bundledLists);
 }
 // auth-email-password declares its mails as stored templates, and the boot seed
 // fails without the template-resolver and a mail renderer. Mounting the missing
@@ -110,52 +112,3 @@ function missingAuthMailStack(mountedNames) {
         createRendererMailHtmlFeature(),
     ].filter((feature) => !mountedNames.has(feature.name));
 }
-// The magic-link mail fields shared by all five flows. Conditional spreads omit
-// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
-// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
-// reset/verify layer hmacSecret (+ mode) on top.
-function pickMailFields(src) {
-    return {
-        appUrl: src.appUrl,
-        ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
-        ...(src.appName !== undefined && { appName: src.appName }),
-        ...(src.locale !== undefined && { locale: src.locale }),
-    };
-}
-export function buildComposeAuthOptions(auth) {
-    if (!auth)
-        return undefined;
-    const opts = {};
-    if (auth.passwordReset) {
-        opts.passwordReset = {
-            hmacSecret: auth.passwordReset.hmacSecret,
-            ...pickMailFields(auth.passwordReset),
-        };
-    }
-    if (auth.emailVerification) {
-        opts.emailVerification = {
-            hmacSecret: auth.emailVerification.hmacSecret,
-            ...pickMailFields(auth.emailVerification),
-            ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
-        };
-    }
-    if (auth.signup) {
-        opts.signup = pickMailFields(auth.signup);
-    }
-    if (auth.invite) {
-        opts.invite = pickMailFields(auth.invite);
-    }
-    if (auth.accountUnlock) {
-        opts.accountUnlock = {
-            hmacSecret: auth.accountUnlock.hmacSecret,
-            ...pickMailFields(auth.accountUnlock),
-        };
-    }
-    if (auth.accountLockout) {
-        opts.accountLockout = auth.accountLockout;
-    }
-    return hasAnyAuthFlow(opts) ? opts : undefined;
-}
-function hasAnyAuthFlow(opts) {
-    return Object.values(opts).some(Boolean);
-}

package/dist/extra-routes-deps.d.ts

@@ -1,11 +1,13 @@
 import type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 export type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+export { makeFilesForTenant } from "./files-for-tenant.ts";
 /** Deps for the `wire` hook (runProdApp/createKumikoServer, after
  *  buildServer has mounted `extraRoutes`) and
  *  for `runWorkerApp.wireComponents`. Naming: `deps` not `ctx` because
@@ -18,6 +20,8 @@ export type SystemWireDeps = {
     /** Feature-registry — e.g. for plugin-lookups via
      *  `registry.getExtensionUsages("subscriptionProvider")`. */
     readonly registry: Registry;
+    /** File context of a tenant's storage; undefined when no file storage is mounted. Required so a consumer cannot lose attachment reading by omission. */
+    readonly filesForTenant: (tenantId: string) => FileContext | undefined;
     /** The boot's master key keyring; absent when no `KUMIKO_SECRETS_MASTER_KEY_V<n>` is set. */
     readonly masterKeyProvider?: MasterKeyProvider;
     /** Cipher for `encrypted: true` config keys, same instance and DEK cache as the handlers use. */

package/dist/extra-routes-deps.js

@@ -2,3 +2,4 @@
 // truth lives in framework/api next to buildServer's own `extraRoutes`
 // mount so the two never drift on how the SystemAdmin identity is built.
 export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+export { makeFilesForTenant } from "./files-for-tenant.js";

package/dist/files-for-tenant.d.ts

@@ -0,0 +1,3 @@
+import { type AppContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
+export declare function makeFilesForTenant(context: AppContext): (tenantId: string) => FileContext | undefined;

package/dist/files-for-tenant.js

@@ -0,0 +1,10 @@
+import { fileContextFromResolver } from "@cosmicdrift/kumiko-bundled-features/file-foundation";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+// Takes the AppContext buildServer returned: only that one carries `_fileProviderResolver`.
+// Without a resolver, `context.files` is bound to the system tenant and reaches no other one.
+export function makeFilesForTenant(context) {
+    const resolver = context._fileProviderResolver;
+    if (resolver)
+        return (tenantId) => fileContextFromResolver(resolver, tenantId);
+    return (tenantId) => (tenantId === SYSTEM_TENANT_ID ? context.files : undefined);
+}

package/dist/renderer-web-fonts.js

@@ -3,26 +3,20 @@
 // dir (dev) or hashed into dist/assets (prod), away from the source fonts.
 // data: URIs are out because apps run with `font-src 'self'`.
 import { dirname, join } from "node:path";
+import { resolveInstalledSync } from "./resolve-installed-package.js";
 export const RENDERER_WEB_FONTS_URL_PREFIX = "/assets/kumiko/fonts/";
 /** dist-relative folder the prod build copies the fonts into. */
 export const RENDERER_WEB_FONTS_DIST_DIR = "assets/kumiko/fonts";
 /** Allowlist for servable font file names; also rules out path segments. */
 export const RENDERER_WEB_FONT_FILE_PATTERN = /^[a-z0-9-]+\.woff2$/;
-const hasBun = typeof Bun !== "undefined";
 /** Directory of the woff2 files next to renderer-web's styles.css, or
  *  undefined when the package can't be resolved from any `searchFrom` dir
  *  (or outside Bun, which does the package-exports resolution). */
 export function resolveRendererWebFontsDir(searchFrom) {
-    if (!hasBun)
-        return undefined;
     for (const from of searchFrom) {
-        try {
-            const stylesheet = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", from);
+        const stylesheet = resolveInstalledSync("@cosmicdrift/kumiko-renderer/web/styles.css", from);
+        if (stylesheet !== undefined)
             return join(dirname(stylesheet), "fonts");
-        }
-        catch {
-            // try the next search root
-        }
     }
     return undefined;
 }

package/dist/resolve-installed-package.d.ts

@@ -0,0 +1,10 @@
+export type BunResolver = {
+    readonly resolveSync: (id: string, from: string) => string;
+};
+export declare function packageNameOf(specifier: string): string;
+/** Walks node_modules upwards like Node does; returns the real path so transitive deps
+ *  of an isolated-linker install are found as siblings. */
+export declare function findInstalledPackageDir(packageName: string, fromDir: string): string | undefined;
+/** Bun.resolveSync auto-installs from the registry (since 1.4.4) when no node_modules tree
+ *  exists, so only call it for packages that are already installed. */
+export declare function resolveInstalledSync(specifier: string, fromDir: string, bun?: BunResolver | undefined): string | undefined;

package/dist/resolve-installed-package.js

@@ -0,0 +1,32 @@
+import { existsSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+export function packageNameOf(specifier) {
+    const segments = specifier.split("/");
+    return specifier.startsWith("@") ? segments.slice(0, 2).join("/") : (segments[0] ?? specifier);
+}
+/** Walks node_modules upwards like Node does; returns the real path so transitive deps
+ *  of an isolated-linker install are found as siblings. */
+export function findInstalledPackageDir(packageName, fromDir) {
+    for (let dir = resolve(fromDir);; dir = resolve(dir, "..")) {
+        const packageDir = join(dir, "node_modules", packageName);
+        if (existsSync(join(packageDir, "package.json")))
+            return realpathSync(packageDir);
+        if (resolve(dir, "..") === dir)
+            return undefined;
+    }
+}
+const globalBun = typeof Bun !== "undefined" ? Bun : undefined;
+/** Bun.resolveSync auto-installs from the registry (since 1.4.4) when no node_modules tree
+ *  exists, so only call it for packages that are already installed. */
+export function resolveInstalledSync(specifier, fromDir, bun = globalBun) {
+    if (bun === undefined)
+        return undefined;
+    if (findInstalledPackageDir(packageNameOf(specifier), fromDir) === undefined)
+        return undefined;
+    try {
+        return bun.resolveSync(specifier, fromDir);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/resolve-tailwind-cli.d.ts

@@ -1,14 +1,9 @@
-type BunResolver = {
-    resolveSync: (id: string, from: string) => string;
-};
+import { type BunResolver } from "./resolve-installed-package.ts";
 export type ResolveTailwindCliDeps = {
     readonly bun?: BunResolver;
     readonly cwd: string;
 };
 export declare function resolveTailwindCli(deps: ResolveTailwindCliDeps): string | undefined;
-/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
- *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
- *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer/web` outside a hoisted node_modules tree. */
+/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry CSS file, so
+ *  tailwindcss must be installed above it (not just next to a Bun cache copy of renderer-web). */
 export declare function canResolveTailwindStylesheet(entryCss: string, deps: ResolveTailwindCliDeps): boolean;
-export {};

package/dist/resolve-tailwind-cli.js

@@ -1,34 +1,17 @@
 // Resolves the locally installed @tailwindcss/cli binary to its absolute path.
 // We avoid `bunx` because it still requests the registry manifest for a locally
 // installed package and fails with `FailedToOpenSocket` when offline.
-//
-// Kept separate from create-kumiko-server.ts so the Bun and resolution-failure
-// branches can be tested under Vitest/Node without booting the server.
-import { dirname, resolve } from "node:path";
+import { dirname, join } from "node:path";
+import { findInstalledPackageDir } from "./resolve-installed-package.js";
 export function resolveTailwindCli(deps) {
     if (deps.bun === undefined)
         return undefined;
-    try {
-        const pkgJsonPath = deps.bun.resolveSync("@tailwindcss/cli/package.json", deps.cwd);
-        // bin: { tailwindcss: "./dist/index.mjs" } → absoluter Pfad
-        return resolve(pkgJsonPath, "..", "dist", "index.mjs");
-    }
-    catch {
-        return undefined;
-    }
+    const cliDir = findInstalledPackageDir("@tailwindcss/cli", deps.cwd);
+    return cliDir === undefined ? undefined : join(cliDir, "dist", "index.mjs");
 }
-/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
- *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
- *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer/web` outside a hoisted node_modules tree. */
+/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry CSS file, so
+ *  tailwindcss must be installed above it (not just next to a Bun cache copy of renderer-web). */
 export function canResolveTailwindStylesheet(entryCss, deps) {
-    if (deps.bun === undefined)
-        return false;
-    try {
-        deps.bun.resolveSync("tailwindcss", dirname(entryCss));
-        return true;
-    }
-    catch {
-        return false;
-    }
+    return (deps.bun !== undefined &&
+        findInstalledPackageDir("tailwindcss", dirname(entryCss)) !== undefined);
 }

package/dist/run-prod-app-boot-context.d.ts

@@ -16,6 +16,8 @@ export declare function addConfigAccessorFactory<T extends {
 export declare function loggerFromExtraContext(extraContext: Record<string, unknown>): Logger | undefined;
 /** Config key (`feature:config:name`) to value; wins over the key's env variable. */
 export type ConfigOverridesInput = Readonly<Record<string, string | number | boolean>>;
+/** Env bridge first, validated app overrides on top: the one merge every boot function shares. */
+export declare function buildConfigOverrides(registry: Registry, envSource: Record<string, string | undefined>, appOverrides: ConfigOverridesInput | undefined): import("@cosmicdrift/kumiko-bundled-features/config").AppConfigOverrides;
 type BootExtraContextOptions = {
     readonly db: DbConnection;
     readonly features: readonly FeatureDefinition[];

package/dist/run-prod-app-boot-context.js

@@ -120,12 +120,16 @@ function bootCryptoContext(crypto) {
         ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
     };
 }
-function createBootConfigResolver(registry, envSource, crypto, appOverrides) {
+/** Env bridge first, validated app overrides on top: the one merge every boot function shares. */
+export function buildConfigOverrides(registry, envSource, appOverrides) {
     const envOverrides = buildEnvConfigOverrides(registry, envSource);
+    return appOverrides
+        ? new Map([...envOverrides, ...validateAppOverrides(registry, appOverrides)])
+        : envOverrides;
+}
+function createBootConfigResolver(registry, envSource, crypto, appOverrides) {
     return createConfigResolver({
-        appOverrides: appOverrides
-            ? new Map([...envOverrides, ...validateAppOverrides(registry, appOverrides)])
-            : envOverrides,
+        appOverrides: buildConfigOverrides(registry, envSource, appOverrides),
         ...(crypto.configCipher && { cipher: crypto.configCipher }),
     });
 }

package/dist/run-prod-app-config.js

@@ -136,7 +136,7 @@ export function composeProdFeatures(options, config, log) {
     // auth-email-password via composeFeatures, using the same feature list as
     // runDevApp and the per-app schema generator. Build it before any connection
     // so boot mode can validate wiring without opening Postgres or Redis sockets.
-    const features = composeAppFeatures(options.features, bootOptionWiring.features, effectiveAuth);
+    const features = composeAppFeatures(options.features, bootOptionWiring.features, effectiveAuth, options.bundledLists);
     const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
     validateComposedFeatures(features, {
         env: envSource,

package/dist/run-prod-app-connections.d.ts

@@ -2,6 +2,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { createRedisCacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
 import { Redis } from "ioredis";
+import { type DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import type { RunProdAppOptions } from "./run-prod-app.ts";
 import type { ProdBootConfig, RegisterBootAbortCleanup } from "./run-prod-app-config.ts";
 export type ProdConnections = {
@@ -12,5 +13,5 @@ export type ProdConnections = {
     readonly redis: Redis;
     readonly cacheSync: ReturnType<typeof createRedisCacheSyncBus>;
 };
-export declare function connectProdDependencies(config: ProdBootConfig, log: Logger, registerAbortCleanup: RegisterBootAbortCleanup): Promise<ProdConnections>;
+export declare function connectProdDependencies(config: ProdBootConfig, log: Logger, registerAbortCleanup: RegisterBootAbortCleanup, databaseWait?: DatabaseWaitClock): Promise<ProdConnections>;
 export declare function assertProdSchemaCurrent(db: DbConnection, migrations: RunProdAppOptions["migrations"], log: Logger): Promise<void>;

package/dist/run-prod-app-connections.js

@@ -2,19 +2,19 @@ import { assertKumikoSchemaCurrent, SchemaDriftError, } from "@cosmicdrift/kumik
 import { createRedisCacheSyncBus, logRedisConnectionState, redisClientOptionsFromEnv, } from "@cosmicdrift/kumiko-framework/redis";
 import { Redis } from "ioredis";
 import { openDatabasePools, waitForKmsHealthy } from "./boot/shared-boot-steps.js";
-import { WAIT_FOR_DATABASE_DEADLINE_MS, waitForDatabase } from "./boot/wait-for-database.js";
+import { WAIT_FOR_DATABASE_DEADLINE_MS, waitForDatabase, } from "./boot/wait-for-database.js";
 // Postgres + Redis. The Redis client is shared by idempotency, event-dedup,
 // entity-cache, rate-limit; failing to construct here surfaces the misconfig
 // immediately. `new Redis(...)` connects eagerly, so this must stay AFTER the
 // boot-mode exit.
-export async function connectProdDependencies(config, log, registerAbortCleanup) {
+export async function connectProdDependencies(config, log, registerAbortCleanup, databaseWait) {
     const { bootKms, databaseUrl, redisUrl, envSource } = config;
     // KMS health gate: an app configured for crypto-shredding must not boot
     // against an unreachable key store — a silent start would answer every
     // PII read with 503. Runs BEFORE connections so an abort leaks nothing.
-    const databaseWaitDeadline = Date.now() + WAIT_FOR_DATABASE_DEADLINE_MS;
+    const databaseWaitDeadline = (databaseWait?.now ?? Date.now)() + WAIT_FOR_DATABASE_DEADLINE_MS;
     if (bootKms.kms) {
-        await waitForKmsHealthy(bootKms.kms, "runProdApp", databaseWaitDeadline);
+        await waitForKmsHealthy(bootKms.kms, "runProdApp", databaseWaitDeadline, databaseWait);
     }
     const pools = openDatabasePools(databaseUrl, envSource);
     const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
@@ -22,7 +22,11 @@ export async function connectProdDependencies(config, log, registerAbortCleanup)
     registerAbortCleanup(pools.closeOutsideTransactionDb);
     registerAbortCleanup(() => redis.disconnect());
     logRedisConnectionState(redis, log);
-    await waitForDatabase(pools.db, { processName: "runProdApp", deadline: databaseWaitDeadline });
+    await waitForDatabase(pools.db, {
+        ...databaseWait,
+        processName: "runProdApp",
+        deadline: databaseWaitDeadline,
+    });
     // One bus per process: the tier resolver, the dispatcher and the file-provider
     // resolver all subscribe to it (invalidation across the API pods).
     const cacheSync = createRedisCacheSyncBus({

package/dist/run-prod-app-entrypoint.js

@@ -4,6 +4,7 @@ import { jobRunLoggerCallbacks } from "./boot/job-run-logger.js";
 import { startPiiEventBackfillOnBoot } from "./boot/pii-event-backfill-on-boot.js";
 import { recordAppStartedOnBoot } from "./boot/record-app-started-on-boot.js";
 import { makeDispatchSystemQuery, makeDispatchSystemWrite } from "./extra-routes-deps.js";
+import { makeFilesForTenant } from "./files-for-tenant.js";
 import { buildProdAuthRoutes } from "./run-prod-app-auth.js";
 function collectProdExtraRoutes(options, config, composed) {
     const bootExtraRoutes = config.bootOptionWiring.extraRoutes;
@@ -126,6 +127,7 @@ export async function runProdWireHook(options, composed, connections, entrypoint
             db: connections.db,
             redis: connections.redis,
             registry: composed.registry,
+            filesForTenant: makeFilesForTenant(entrypoint.context),
             ...(bootCrypto.masterKeyProvider && { masterKeyProvider: bootCrypto.masterKeyProvider }),
             ...(bootCrypto.configCipher && { configEncryption: bootCrypto.configCipher }),
             metricsFor: createMetricsForFactory(entrypoint.observability.meter),

package/dist/run-prod-app-handle.js

@@ -45,7 +45,8 @@ export function createProdAppHandle(input) {
     const { options, config, composed, connections, entrypoint, log } = input;
     const { fetchHandler, cspScriptHashes } = input.fetch;
     // Upgrade rejections (401/403/426...) are ordinary responses and get the same headers as fetchHandler.
-    const securedUpgradeFetch = withSecurityHeaders(async (req, env) => stripNoRouteMatchHeader(await entrypoint.app.fetch(req, env)), options.securityHeaders, cspScriptHashes);
+    // Same read-only demo gate as fetchHandler: upgrade requests are GETs, but the socket then writes.
+    const securedUpgradeFetch = withSecurityHeaders(config.bootOptionWiring.wrapFetch(async (req, env) => stripNoRouteMatchHeader(await entrypoint.app.fetch(req, env))), options.securityHeaders, cspScriptHashes);
     const webSocketUpgradeFetch = async (req, env) => securedUpgradeFetch(req, env);
     let uninstallShutdownSignals;
     let uninstallFatalHandlers;

package/dist/run-prod-app-seeds.js

@@ -65,6 +65,8 @@ export async function runProdBootSeeds(run, entrypoint, dispatcherOptions) {
         admin: composed.effectiveAuth?.admin,
         shortcutSeeds: config.bootOptionWiring.shortcutSeeds,
         cipher: composed.bootCrypto.configCipher,
+        processName: "runProdApp",
+        ...(options.databaseWait && { databaseWait: options.databaseWait }),
     });
     const hasSeeds = config.bootOptionWiring.customSeeds.length > 0 || options.seedsDir !== undefined;
     const seedContext = hasSeeds ? buildSeedContext(run) : undefined;

package/dist/run-prod-app-static-files.js

@@ -1,9 +1,10 @@
+import { existsSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { cachedResponse, computeStrongEtag, computeWeakEtag, createClientIpResolver, } from "@cosmicdrift/kumiko-framework/api";
 import { rankPreferredLocales } from "@cosmicdrift/kumiko-framework/i18n";
 import { resolveAndInjectPageHead } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import { errorCodeOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { ASSETS_DIR } from "./build-prod-bundle.js";
+import { ASSETS_DIR, collectBuildScriptHashes } from "./build-prod-bundle.js";
 import { BUNDLED_ASSETS_DIST_DIR } from "./bundled-assets.js";
 import { CSP_HASHES_FILE, parseCspHashes } from "./csp-hashes.js";
 import { buildRequestBoundSystemQuery, } from "./request-bound-system-query.js";
@@ -67,7 +68,14 @@ function usesDefaultCsp(securityHeaders) {
 export async function resolveHostDispatchScriptHashes(staticDir, securityHeaders, defaultCspHashes) {
     return usesDefaultCsp(securityHeaders) ? defaultCspHashes : readBuildScriptHashes(staticDir);
 }
+// Apps also write HTML into staticDir at boot (rendered landing pages), after kumiko build wrote
+// the file; staticDir is server-owned, so hashing what is on disk never trusts request data.
 export async function readBuildScriptHashes(staticDir) {
+    const fromFile = await readBuildHashesFile(staticDir);
+    const onDisk = existsSync(staticDir) ? collectBuildScriptHashes(staticDir).scriptSrc : [];
+    return [...new Set([...fromFile, ...onDisk])].sort();
+}
+async function readBuildHashesFile(staticDir) {
     const file = await readStaticFile(join(staticDir, CSP_HASHES_FILE));
     const result = file ? parseCspHashes(new TextDecoder().decode(file.bytes)) : undefined;
     if (result?.kind === "found")

package/dist/run-prod-app.d.ts

@@ -3,7 +3,7 @@ import type { AccountLockoutOptions, AccountUnlockOptions, AuthMailLocale, AuthP
 import type { SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import type { ExtraRouteDefinition, KumikoServeEnv, PostAuthLandingResolver, SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import type { FeatureDefinition, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import type { BundledListsOptions, FeatureDefinition, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { AllInOneEntrypoint, ApiEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
@@ -12,6 +12,7 @@ import type { ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observ
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { PageHeadMeta, PageHeadResolver, PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import type { Redis } from "ioredis";
+import type { DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import type { BillingBootOption } from "./boot-options/billing-option.ts";
 import type { DemoModeOption } from "./boot-options/demo-mode.ts";
 import type { FileStorageBootOption } from "./boot-options/file-storage-option.ts";
@@ -29,7 +30,7 @@ export { parseRunMode } from "./boot/env-gate.ts";
 export { buildBunServeOptions } from "./bun-serve-options.ts";
 export { requireEnv } from "./require-env.ts";
 export { resolveUnsubscribeWiring, type UnsubscribeOption, } from "./resolve-unsubscribe-wiring.ts";
-export { addConfigAccessorFactory, buildBootExtraContext, type ConfigOverridesInput, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.ts";
+export { addConfigAccessorFactory, buildBootExtraContext, buildConfigOverrides, type ConfigOverridesInput, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.ts";
 export { staticCachePolicy } from "./run-prod-app-static-files.ts";
 /** Wrapper API for the password-reset flow.
  *
@@ -263,6 +264,8 @@ export type RunProdAppOptions = {
     readonly features: readonly FeatureDefinition[];
     /** Opt-in boot-validator warnings — see ValidateBootOptions. */
     readonly validateBootOptions?: ValidateBootOptions;
+    /** One table block for every list of the bundled features, see ComposeFeaturesOptions.bundledLists. */
+    readonly bundledLists?: BundledListsOptions;
     /** Listen-Port. Default 3000 (or $PORT). */
     readonly port?: number;
     /** Ceiling Bun.serve buffers a request body to before any app-level
@@ -349,6 +352,9 @@ export type RunProdAppOptions = {
      *  cannot start against an unreachable KMS. Without an adapter,
      *  crypto-shredding remains disabled. */
     readonly kms?: KmsAdapter;
+    /** Replaces the real clock, sleep and log sink of the boot backoff for the database, KMS and
+     *  seed waits; tests use it to run the retry path without real waiting. */
+    readonly databaseWait?: DatabaseWaitClock;
     /** 32-byte base64 key for blind-index HMACs on `lookupable` fields
      *  (env: KUMIKO_BLIND_INDEX_KEY, `openssl rand -base64 32`). It is separate
      *  from PLATFORM_KEK and not part of the KmsAdapter contract. It is required

package/dist/run-prod-app.js

@@ -54,7 +54,7 @@ export { parseRunMode } from "./boot/env-gate.js";
 export { buildBunServeOptions } from "./bun-serve-options.js";
 export { requireEnv } from "./require-env.js";
 export { resolveUnsubscribeWiring, } from "./resolve-unsubscribe-wiring.js";
-export { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
+export { addConfigAccessorFactory, buildBootExtraContext, buildConfigOverrides, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
 export { staticCachePolicy } from "./run-prod-app-static-files.js";
 // Returned from runProdApp when KUMIKO_DRY_RUN_ENV is set AND envSource
 // was passed (= test-mode). The handle is intentionally inert — listen()
@@ -119,7 +119,7 @@ async function bootProdApp(options, registerAbortCleanup) {
         }
         return makeDryRunHandle();
     }
-    const connections = await connectProdDependencies(config, log, registerAbortCleanup);
+    const connections = await connectProdDependencies(config, log, registerAbortCleanup, options.databaseWait);
     // Tier-composition auto-wire: if a feature carries a tenantTierResolver extension, the
     // resolver is built here, before the dispatcher exists. The app author only mounts
     // `createTierEngineFeature(opts)`; the framework does the wiring.

package/dist/run-worker-app.d.ts

@@ -1,19 +1,21 @@
 import type { ServerOptions } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { FeatureDefinition, Registry, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import type { BundledListsOptions, FeatureDefinition, Registry, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { WorkerEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
 import type { JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
 import { type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
 import type { MasterKeyProvider, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
+import type { DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import { type WorkerMetricsOptions, type WorkerMetricsServer } from "./boot/worker-metrics-server.ts";
 import type { BillingBootOption } from "./boot-options/billing-option.ts";
 import type { FileStorageBootOption } from "./boot-options/file-storage-option.ts";
 import type { KmsMode } from "./boot-options/kms-mode.ts";
 import type { MailBootOption } from "./boot-options/mail-option.ts";
 import { type SystemWireDeps } from "./extra-routes-deps.ts";
+import type { ConfigOverridesInput } from "./run-prod-app-boot-context.ts";
 export type WorkerContextOption = Record<string, unknown> | ((deps: WorkerDeps) => Record<string, unknown>);
 export type WorkerDeps = {
     readonly db: DbConnection;
@@ -39,6 +41,8 @@ export type RunWorkerAppOptions = {
     readonly features: readonly FeatureDefinition[];
     /** Opt-in boot-validator warnings — see ValidateBootOptions. */
     readonly validateBootOptions?: ValidateBootOptions;
+    /** One table block for every list of the bundled features, see ComposeFeaturesOptions.bundledLists. Must match the API process. */
+    readonly bundledLists?: BundledListsOptions;
     /** Mount the auto-mixed config/user/tenant/auth-email-password features —
      *  MUST match the API process's `includeBundled` value, otherwise API
      *  and worker run with a diverging registry topology. Also controls
@@ -62,6 +66,12 @@ export type RunWorkerAppOptions = {
     /** Subject-key adapter for crypto-shredding — boot checks health()
      *  before any connection (see RunProdAppOptions["kms"]). */
     readonly kms?: KmsAdapter;
+    /** App-level config values, same semantics and merge as RunProdAppOptions["appOverrides"];
+     *  the worker renders the mail layouts and must resolve the same branding as the API. */
+    readonly appOverrides?: ConfigOverridesInput;
+    /** Replaces the real clock, sleep and log sink of the boot backoff for the database and
+     *  KMS waits; tests use it to run the retry path without real waiting. */
+    readonly databaseWait?: DatabaseWaitClock;
     /** Blind-index key for lookupable fields (see
      *  RunProdAppOptions["blindIndexKey"]). */
     readonly blindIndexKey?: string;

package/dist/run-worker-app.js

@@ -27,6 +27,7 @@ import { resolveBootOptionWiring } from "./boot-options/resolve-boot-options.js"
 import { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.js";
 import { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "./extra-routes-deps.js";
 import { installFatalErrorHandlers } from "./fatal-error-handlers.js";
+import { makeFilesForTenant } from "./files-for-tenant.js";
 import { installProcessLogger, uninstallProcessLogger } from "./process-logger.js";
 function makeBootModeHandle() {
     return {
@@ -127,6 +128,7 @@ export async function runWorkerApp(options) {
             db,
             redis,
             registry,
+            filesForTenant: makeFilesForTenant(entrypoint.context),
             metricsFor: createMetricsForFactory(entrypoint.observability.meter),
             dispatchSystemWrite: makeDispatchSystemWrite(entrypoint.dispatcher),
             dispatchSystemQuery: makeDispatchSystemQuery(entrypoint.dispatcher),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.388.0",
+  "version": "0.389.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -70,6 +70,10 @@
       "types": "./dist/renderer-web-fonts.d.ts",
       "default": "./dist/renderer-web-fonts.js"
     },
+    "./resolve-installed-package": {
+      "types": "./dist/resolve-installed-package.d.ts",
+      "default": "./dist/resolve-installed-package.js"
+    },
     "./resolve-tailwind-cli": {
       "types": "./dist/resolve-tailwind-cli.d.ts",
       "default": "./dist/resolve-tailwind-cli.js"
@@ -92,18 +96,21 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.388.0",
-    "@cosmicdrift/kumiko-framework": "0.388.0",
-    "@cosmicdrift/kumiko-renderer": "0.388.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
-    "@cosmicdrift/kumiko-types": "0.388.0",
-    "bun-types": "^1.3.13",
+    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
+    "@cosmicdrift/kumiko-framework": "0.389.0",
+    "@cosmicdrift/kumiko-renderer": "0.389.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.389.0",
+    "@cosmicdrift/kumiko-types": "0.389.0",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
+  "peerDependencies": {
+    "bun-types": "^1.4.4"
+  },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.388.0"
+    "@cosmicdrift/kumiko-testing": "0.389.0",
+    "bun-types": "^1.4.4"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -161,6 +168,10 @@
         "types": "./dist/renderer-web-fonts.d.ts",
         "default": "./dist/renderer-web-fonts.js"
       },
+      "./resolve-installed-package": {
+        "types": "./dist/resolve-installed-package.d.ts",
+        "default": "./dist/resolve-installed-package.js"
+      },
       "./resolve-tailwind-cli": {
         "types": "./dist/resolve-tailwind-cli.d.ts",
         "default": "./dist/resolve-tailwind-cli.js"

package/src/changes.json

@@ -1,4 +1,65 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "The renderer-web stylesheet fallback checks tailwindcss in node_modules",
+    "detail": "canResolveTailwindStylesheet looks for tailwindcss in the node_modules directories above the stylesheet, as Tailwind does, instead of asking Bun.resolveSync. On Bun 1.4.4 the resolver auto-installs tailwindcss next to a renderer copy in Bun's install cache, so a build without a node_modules tree took the fallback and then failed in Tailwind with \"Can't resolve 'tailwindcss'\". Such a build skips the fallback stylesheet again."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Package lookups no longer auto-install from the registry",
+    "detail": "The new @cosmicdrift/kumiko-server-runtime/resolve-installed-package export looks up node_modules before asking Bun.resolveSync, which installs missing packages from the registry since Bun 1.4.4. The prod build, the dev-server stylesheet lookup and the handbuch commands use it."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "bundledLists sets one table block for every bundled list",
+    "detail": "composeFeatures takes bundledLists with a table block and an optional pinFirstColumn flag. The block is mixed into every entityList, projectionList and relatedList section of the bundled features, the foundation features user and tenant as well as the features an app mounts from @cosmicdrift/kumiko-bundled-features, before the boot validator runs. A key the screen sets itself wins, export is left out on relatedList sections, and pinFirstColumn pins the first visible column left where no column is pinned yet. grouping and totals are rejected in the shared block. App screens stay untouched. Features opt in with the new registrar method r.adoptsBundledLists(), which every bundled feature with lists calls and which feature packages such as Enterprise can call for their own lists; app features never do. No migration for apps. The option lives in AppConfig.bundledLists for the managed kumiko/schema.ts and in the run options of runProdApp, runDevApp and runWorkerApp, so kumiko check and the running app see the same screens."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Boot database backoff takes an injectable clock",
+    "detail": "The new databaseWait option on runProdApp and runWorkerApp swaps sleep, now and the log sink of the database, KMS and seed waits. A worker boot against an unreachable database is now tested to retry until the deadline, abort with the connection error and close its Redis clients."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Default CSP covers inline scripts of HTML written after the build",
+    "detail": "At boot the hashes from csp-hashes.json are merged with the inline scripts found in the HTML files under staticDir, for the default CSP and for hostDispatch. Boot-rendered pages keep their inline scripts working without a custom securityHeaders.csp."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Read-only demo mode blocks WebSocket upgrades",
+    "detail": "Upgrade requests count as mutating in the demo read-only gate and get 403 demo_read_only unless the route path is in allowedWritePaths. Socket routes in a read-only demo that need to stay open must be listed there."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "BootOptionName drops demoMode, seeds and signals",
+    "detail": "No stack declared them in bootRequires, so their boot checks never ran. A name returns together with its check and a test once a stack needs it.",
+    "migration": "no known callers; remove \"demoMode\", \"seeds\" and \"signals\" from bootRequires options"
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "appOverrides work in runWorkerApp and runDevApp",
+    "detail": "Both boot functions take the same appOverrides option as runProdApp and share its merge, so worker-rendered mails and the dev server resolve the same tenant model, branding and SEO values as the API. The runSingleInstance:false warning names appOverrides next to mail, fileStorage and featureToggles."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Boot seeds survive a short database outage",
+    "detail": "applyStandardBootSeeds re-runs the idempotent seed sequence with the database backoff on transient connection errors (ECONNREFUSED, connection class 08, too_many_connections) until the 90 second deadline. Non-transient errors still abort the boot at once."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "filesForTenant in SystemWireDeps",
+    "detail": "The wire hook and the worker wireComponents receive filesForTenant, built from the AppContext after buildServer wired it. ApiEntrypoint and WorkerEntrypoint expose that context as entrypoint.context."
+  },
   {
     "version": "0.388.0",
     "type": "improvement",