@cosmicdrift/kumiko-server-runtime 0.388.0 → 0.390.0

package/dist/boot/apply-boot-seeds.js

@@ -1,4 +1,5 @@
 import { seedAllConfigValues } from "@cosmicdrift/kumiko-bundled-features/config";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 // Single boot-seed entry-point. runDevApp + runProdApp both call this
 // from their post-stack hook, so the wiring lives in exactly one place
 // — config-seed-boot.integration.ts pins this helper, which means a
@@ -7,12 +8,14 @@ import { seedAllConfigValues } from "@cosmicdrift/kumiko-bundled-features/config
 // shipping a server that never seeds.
 // @wrapper-known semantic-alias
 export async function applyBootSeeds(deps) {
-    await seedAllConfigValues(deps.registry, deps.db, deps.cipher);
-    // Loaded lazily: the seeding module pulls the document sanitizer (happy-dom),
-    // which apps without notification templates must not pay for at boot.
-    const hasNotificationTemplates = Array.from(deps.registry.getAllNotifications().values()).some((notification) => notification.template !== undefined);
-    if (hasNotificationTemplates) {
-        const { seedNotificationTemplates } = await import("@cosmicdrift/kumiko-bundled-features/template-resolver/seeding");
-        await seedNotificationTemplates(deps.db, deps.registry);
-    }
+    return runInSystemRowLevelSecurityScope("boot seeds write rows for arbitrary tenants", async () => {
+        await seedAllConfigValues(deps.registry, deps.db, deps.cipher);
+        // Loaded lazily: the seeding module pulls the document sanitizer (happy-dom),
+        // which apps without notification templates must not pay for at boot.
+        const hasNotificationTemplates = Array.from(deps.registry.getAllNotifications().values()).some((notification) => notification.template !== undefined);
+        if (hasNotificationTemplates) {
+            const { seedNotificationTemplates } = await import("@cosmicdrift/kumiko-bundled-features/template-resolver/seeding");
+            await seedNotificationTemplates(deps.db, deps.registry);
+        }
+    });
 }

package/dist/boot/job-run-logger.js

@@ -27,7 +27,7 @@ export async function startDevJobRunners(opts) {
             consumerLane: lane,
             ...logger,
         });
-        // Without this, ctx.write/ctx.queryAs inside a dev-run job throw
+        // Without this, ctx.dispatch.write/ctx.dispatch.queryAs inside a dev-run job throw
         // "dispatcher attached — call attachDispatcher() first" on their first
         // call — the prod entrypoints attach automatically, dev boot must too.
         jr.attachDispatcher(dispatcherToWriteRef(opts.dispatcher));

package/dist/boot/shared-boot-steps.d.ts

@@ -1,17 +1,18 @@
 import { type SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import type { AuthRoutesConfig } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type EffectiveFeaturesResolver, type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import { type DbConnection, type RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
+import { type BundledListsOptions, type EffectiveFeaturesResolver, type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import type { FeatureTogglesWiring } from "../boot-options/feature-toggles-option.ts";
 import type { DbSeedFn } from "../boot-options/seed-shortcuts.ts";
 import { type AuthOptionsCarrier } from "../compose-features.ts";
 import type { RunProdAppAuthOptions } from "../run-prod-app.ts";
+import { type DatabaseWaitClock } from "./wait-for-database.ts";
 /** Returns `envSource` itself (it may be `process.env`) when there is nothing to layer under it. */
 export declare function withEnvDefaults(envDefaults: Readonly<Record<string, string | undefined>>, envSource: Record<string, string | undefined>): Record<string, string | undefined>;
-export declare function composeAppFeatures(appFeatures: readonly FeatureDefinition[], bootFeatures: readonly FeatureDefinition[], effectiveAuth: AuthOptionsCarrier | undefined): readonly FeatureDefinition[];
+export declare function composeAppFeatures(appFeatures: readonly FeatureDefinition[], bootFeatures: readonly FeatureDefinition[], effectiveAuth: AuthOptionsCarrier | undefined, bundledLists?: BundledListsOptions): readonly FeatureDefinition[];
 export declare function validateComposedFeatures(features: readonly FeatureDefinition[], bootOptions: ValidateBootOptions): void;
 export declare function assertMfaSwitchTenantGate(registry: Registry, processName: string): void;
 export declare function buildEffectiveFeaturesResolver(deps: {
@@ -27,14 +28,16 @@ export declare function applyStandardBootSeeds(deps: {
     readonly admin: SeedAdminOptions | undefined;
     readonly shortcutSeeds: readonly DbSeedFn[];
     readonly cipher: EnvelopeCipher | undefined;
+    readonly processName: string;
+    readonly databaseWait?: DatabaseWaitClock;
 }): Promise<void>;
 type SharedAuthFlowFields = Pick<RunProdAppAuthOptions, "passwordReset" | "emailVerification" | "accountUnlock" | "signup" | "invite">;
 type AuthFlowRoutes = Pick<AuthRoutesConfig, "passwordReset" | "emailVerification" | "accountUnlock" | "signup" | "invite">;
 export type SharedAuthRouteSource = SharedAuthFlowFields & Pick<RunProdAppAuthOptions, "loginErrorStatusMap" | "cookieDomain" | "retiredCookieDomains" | "allowedOrigins" | "unsafeSkipOriginCheck" | "postAuthLanding">;
 export type SharedAuthRoutes = AuthFlowRoutes & Pick<AuthRoutesConfig, "membershipQuery" | "loginHandler" | "loginErrorStatusMap" | "cookieDomain" | "retiredCookieDomains" | "allowedOrigins" | "unsafeSkipOriginCheck" | "postAuthLanding" | "mfaVerifyHandler" | "switchTenantMfaGateHandler" | "mfaPreauthEnableStartHandler" | "mfaPreauthConfirmHandler">;
 export declare function buildSharedAuthRoutes(effectiveAuth: SharedAuthRouteSource, hasMfa: boolean): SharedAuthRoutes;
-export declare function waitForKmsHealthy(kms: KmsAdapter, processName: string, deadline: number): Promise<void>;
-export declare function openDatabasePools(databaseUrl: string, envSource: Record<string, string | undefined>): {
+export declare function waitForKmsHealthy(kms: KmsAdapter, processName: string, deadline: number, clock?: DatabaseWaitClock): Promise<void>;
+export declare function openDatabasePools(databaseUrl: string, envSource: Record<string, string | undefined>, rowLevelSecurity: RowLevelSecurityMode): {
     readonly db: DbConnection;
     readonly closeDb: () => Promise<void>;
     readonly outsideTransactionDb: DbConnection;

package/dist/boot/shared-boot-steps.js

@@ -15,11 +15,12 @@ import { waitUntilDatabaseReachable } from "./wait-for-database.js";
 export function withEnvDefaults(envDefaults, envSource) {
     return Object.keys(envDefaults).length > 0 ? { ...envDefaults, ...envSource } : envSource;
 }
-export function composeAppFeatures(appFeatures, bootFeatures, effectiveAuth) {
+export function composeAppFeatures(appFeatures, bootFeatures, effectiveAuth, bundledLists) {
     const composeAuthOptions = buildComposeAuthOptions(effectiveAuth);
     return composeFeatures([...appFeatures, ...bootFeatures], {
         includeBundled: !!effectiveAuth,
         ...(composeAuthOptions && { authOptions: composeAuthOptions }),
+        ...(bundledLists && { bundledLists }),
     });
 }
 export function validateComposedFeatures(features, bootOptions) {
@@ -46,19 +47,25 @@ export async function buildEffectiveFeaturesResolver(deps) {
     return bound.resolver;
 }
 export async function applyStandardBootSeeds(deps) {
-    const { db, registry, admin, shortcutSeeds, cipher } = deps;
-    if (admin) {
-        await seedAdminGuarded(db, admin);
-    }
-    for (const seed of shortcutSeeds) {
-        await seed(db);
-    }
-    // The helper indirection is what config-seed-boot.integration.ts pins — keep it as a single call.
-    await applyBootSeeds({
-        registry,
-        db,
-        ...(cipher && { cipher }),
-    });
+    const { db, registry, admin, shortcutSeeds, cipher, processName, databaseWait } = deps;
+    // Seeds are idempotent, so a transient connection error re-runs the whole sequence; any other
+    // error stays fatal. Later boot steps build on the seeds, so this cannot continue in the background.
+    await waitUntilDatabaseReachable(async () => {
+        if (admin) {
+            // Operator-created account, not a self-registration: under emailVerificationMode "strict"
+            // an unverified seed admin could never log in. `admin.emailVerified` still overrides.
+            await seedAdminGuarded(db, { emailVerified: true, ...admin });
+        }
+        for (const seed of shortcutSeeds) {
+            await seed(db);
+        }
+        // The helper indirection is what config-seed-boot.integration.ts pins — keep it as a single call.
+        await applyBootSeeds({
+            registry,
+            db,
+            ...(cipher && { cipher }),
+        });
+    }, { ...databaseWait, processName, target: "database (boot seeds)" });
 }
 const MFA_ROUTE_HANDLERS = {
     mfaVerifyHandler: AuthMfaHandlers.verify,
@@ -129,8 +136,9 @@ export function buildSharedAuthRoutes(effectiveAuth, hasMfa) {
         ...buildAuthFlowRoutes(effectiveAuth),
     };
 }
-export async function waitForKmsHealthy(kms, processName, deadline) {
+export async function waitForKmsHealthy(kms, processName, deadline, clock) {
     const kmsHealth = await waitUntilDatabaseReachable(() => kms.health(), {
+        ...clock,
         processName,
         target: "KMS",
         deadline,
@@ -139,14 +147,16 @@ export async function waitForKmsHealthy(kms, processName, deadline) {
         throw new Error(`[${processName}] BOOT ABORTED — KMS health check failed (latency ${kmsHealth.latencyMs}ms)`);
     }
 }
-export function openDatabasePools(databaseUrl, envSource) {
+export function openDatabasePools(databaseUrl, envSource, rowLevelSecurity) {
     const { db, close: closeDb } = createDbConnection({
         url: databaseUrl,
+        rowLevelSecurity,
         ...dbConnectionOptionsFromEnv(envSource),
         ...serverTimeoutOptionsFromEnv(envSource),
     });
     const { db: outsideTransactionDb, close: closeOutsideTransactionDb } = createDbConnection({
         url: databaseUrl,
+        rowLevelSecurity,
         ...outsideTransactionPoolOptionsFromEnv(envSource),
         ...serverTimeoutOptionsFromEnv(envSource),
     });

package/dist/boot/stream-tenant-backfill-on-boot.d.ts

@@ -0,0 +1,27 @@
+import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { type DatabaseWaitClock } from "./wait-for-database.ts";
+export declare const STREAM_TENANT_BACKFILL_LOCK_KEY = 1937007206;
+/** Declares that the app has no search backend in any of its processes. */
+export type SearchBackendDeclaration = "none";
+export type StreamBackfillPart = "user" | "tenant";
+export declare function streamBackfillPendingId(part: StreamBackfillPart): string;
+export type StreamBackfillPartOutcome = "feature-missing" | "no-search-adapter" | "completed" | "failed";
+export type StreamTenantBackfillOutcome = {
+    readonly user: StreamBackfillPartOutcome;
+    readonly tenant: StreamBackfillPartOutcome;
+    readonly aggregatesMigrated: number;
+};
+type Log = ReturnType<typeof createFallbackLogger>;
+export declare function runStreamTenantBackfillOnBoot(opts: {
+    readonly db: DbConnection;
+    readonly registry: Registry;
+    readonly extraContext: object;
+    readonly processName: string;
+    /** `"none"`: the app has no search backend. Without it a process lacking a search adapter defers the work. */
+    readonly search?: SearchBackendDeclaration;
+    readonly databaseWait?: DatabaseWaitClock;
+    readonly log?: Log;
+}): Promise<StreamTenantBackfillOutcome>;
+export {};

package/dist/boot/stream-tenant-backfill-on-boot.js

@@ -0,0 +1,161 @@
+// Moves legacy tenant, tenant-membership and user streams onto the tenant their
+// aggregate type now addresses (SYSTEM_TENANT_ID or the membership's payload tenant), then
+// repairs the derived state (stale search docs, projection rows, index).
+//
+// There is no completion marker: every boot searches for legacy streams, so streams that
+// older pods write during a rolling deploy are fixed on the next boot. The search only reads
+// events of other tenants than the target (shared/stream-tenant-backfill.ts), which is cheap
+// when nothing is left. Once the scan finds work a part writes a "derived-pending" row (a clean boot writes nothing); while it exists,
+// rebuild and reindex run even if no stream moves, so a crash after the moves cannot leave
+// stale rows behind. Failures are logged and retried on the next boot.
+// A process that has no search adapter although the entity is searchable leaves the work to
+// one that has: moving streams without cleaning the old buckets would orphan search docs.
+// An app that declares `search: "none"` has no search backend in any process, so there are no
+// docs to orphan: the step moves and rebuilds, and the reindex stays out.
+import { backfillTenantStreamTenants } from "@cosmicdrift/kumiko-bundled-features/tenant";
+import { backfillUserStreamTenantsWithDerivedState } from "@cosmicdrift/kumiko-bundled-features/user";
+import { resolveBaseDbAndSearchAdapter } from "@cosmicdrift/kumiko-framework/api";
+import { deleteMany, fetchOne, insertOne, listEventTenantIds, withSessionAdvisoryLock, } from "@cosmicdrift/kumiko-framework/db";
+import { createEsOperationsTable, esOperationsTable } from "@cosmicdrift/kumiko-framework/es-ops";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { waitUntilDatabaseReachable } from "./wait-for-database.js";
+export const STREAM_TENANT_BACKFILL_LOCK_KEY = 0x73_74_62_66; // 'stbf'
+export function streamBackfillPendingId(part) {
+    return `stream-tenant-backfill:${part}:derived-pending`;
+}
+export async function runStreamTenantBackfillOnBoot(opts) {
+    const { db, registry, processName, search } = opts;
+    const log = opts.log ?? createFallbackLogger("stream-tenant-backfill");
+    const parts = ["user", "tenant"].filter((part) => registry.features.has(part));
+    const { searchAdapter } = resolveBaseDbAndSearchAdapter(opts.extraContext, registry);
+    if (search === "none" && searchAdapter) {
+        throw new Error(`${processName}: \`search: "none"\` declares an app without a search backend, but extraContext provides a searchAdapter. Remove one of the two.`);
+    }
+    if (parts.length === 0)
+        return outcomeOf(parts, {}, 0);
+    return waitUntilDatabaseReachable(() => runInSystemRowLevelSecurityScope("stream tenant backfill moves streams across tenants", async () => {
+        await createEsOperationsTable(db);
+        return withSessionAdvisoryLock(db, STREAM_TENANT_BACKFILL_LOCK_KEY, async () => {
+            const deps = {
+                db,
+                registry,
+                searchAdapter,
+                log,
+                search,
+                scanTenantIds: await listEventTenantIds(db),
+            };
+            const outcomes = {};
+            let migrated = 0;
+            for (const part of parts) {
+                const result = await runPart(part, deps);
+                outcomes[part] = result.outcome;
+                migrated += result.aggregatesMigrated;
+            }
+            return outcomeOf(parts, outcomes, migrated);
+        });
+    }), { ...opts.databaseWait, processName, target: "database (stream tenant backfill)" });
+}
+function outcomeOf(parts, outcomes, aggregatesMigrated) {
+    const of = (part) => parts.includes(part) ? (outcomes[part] ?? "completed") : "feature-missing";
+    return { user: of("user"), tenant: of("tenant"), aggregatesMigrated };
+}
+async function operationExists(db, id) {
+    return (await fetchOne(db, esOperationsTable, { id })) !== undefined;
+}
+// An app declaring `search: "none"` has no docs to orphan, so only apps that may have a backend defer.
+function isDeferredWithoutSearchAdapter(searchable, deps) {
+    return searchable && !deps.searchAdapter && deps.search !== "none";
+}
+async function runPart(part, deps) {
+    const { db, registry, log } = deps;
+    const entity = part === "user" ? "user" : "tenant";
+    const searchable = registry.getSearchableFields(entity).length > 0 ||
+        registry.getSearchPayloadExtensions(entity).length > 0;
+    const blockedWithoutAdapter = isDeferredWithoutSearchAdapter(searchable, deps);
+    const warnBlocked = () => log.warn(`stream tenant backfill (${part}) has work but "${entity}" is searchable and this process has no search adapter; a process with one runs it`);
+    const pendingId = streamBackfillPendingId(part);
+    const wasPending = await operationExists(db, pendingId);
+    if (wasPending && blockedWithoutAdapter) {
+        warnBlocked();
+        return { outcome: "no-search-adapter", aggregatesMigrated: 0 };
+    }
+    // A clean boot writes nothing: the pending row appears only once the scan found work.
+    let pendingExists = wasPending;
+    let skipped = false;
+    const onFirstCandidate = async () => {
+        if (skipped || blockedWithoutAdapter) {
+            if (!skipped)
+                warnBlocked();
+            skipped = true;
+            return "skip";
+        }
+        if (!pendingExists) {
+            await recordPending(db, pendingId);
+            pendingExists = true;
+        }
+        return "proceed";
+    };
+    // A throw (transient connection error) reaches waitUntilDatabaseReachable; the pending row stays for the retry.
+    const run = await runBackfill(part, deps, wasPending ? "always" : "if-moved", onFirstCandidate);
+    if (skipped)
+        return { outcome: "no-search-adapter", aggregatesMigrated: 0 };
+    for (const failure of run.failures) {
+        log.error(`stream tenant backfill (${part}) failed; it is retried on the next boot`, {
+            aggregateId: failure.aggregateId,
+            step: failure.step,
+            error: failure.error,
+        });
+    }
+    if (run.failures.length > 0) {
+        // Moves that keep failing (a broken aggregate) must not force rebuild and reindex on every
+        // boot: the pending row only guards the derived steps, which succeeded here.
+        if (pendingExists && !run.failures.some(isDerivedStateFailure)) {
+            await clearPending(db, pendingId);
+        }
+        return { outcome: "failed", aggregatesMigrated: run.aggregatesMigrated };
+    }
+    if (pendingExists)
+        await clearPending(db, pendingId);
+    if (run.aggregatesMigrated > 0) {
+        log.info(`stream tenant backfill (${part}) moved streams`, {
+            aggregatesMigrated: run.aggregatesMigrated,
+        });
+    }
+    return { outcome: "completed", aggregatesMigrated: run.aggregatesMigrated };
+}
+// Step names of rebuildAndReindex in bundled-features/shared/stream-tenant-derived-state.ts.
+function isDerivedStateFailure(failure) {
+    return failure.step === "rebuild" || failure.step === "reindex";
+}
+async function clearPending(db, pendingId) {
+    await deleteMany(db, esOperationsTable, { id: pendingId });
+}
+async function recordPending(db, id) {
+    await insertOne(db, esOperationsTable, {
+        id,
+        operationType: "stream-migration",
+        durationMs: 0,
+        appliedBy: "boot",
+    });
+}
+async function runBackfill(part, deps, derived, onFirstCandidate) {
+    const { db, registry, searchAdapter, scanTenantIds } = deps;
+    const common = {
+        db,
+        registry,
+        derived,
+        onFirstCandidate,
+        ...(searchAdapter && { searchAdapter }),
+        scanTenantIds,
+    };
+    if (part === "user") {
+        const result = await backfillUserStreamTenantsWithDerivedState(common);
+        return { failures: result.failures, aggregatesMigrated: result.streams.aggregatesMigrated };
+    }
+    const result = await backfillTenantStreamTenants(common);
+    return {
+        failures: result.failures,
+        aggregatesMigrated: result.tenants.aggregatesMigrated + result.memberships.aggregatesMigrated,
+    };
+}

package/dist/boot/wait-for-database.d.ts

@@ -12,5 +12,7 @@ export type WaitForDatabaseOptions = {
     readonly now?: () => number;
     readonly deadline?: number;
 };
+/** Injectable clock and sink; tests drive the backoff without real waiting. */
+export type DatabaseWaitClock = Pick<WaitForDatabaseOptions, "log" | "sleep" | "now">;
 export declare function waitForDatabase(db: DbConnection, options: WaitForDatabaseOptions): Promise<void>;
 export declare function waitUntilDatabaseReachable<T>(ping: () => Promise<T>, options: WaitForDatabaseOptions): Promise<T>;

package/dist/boot/wait-for-database.js

@@ -7,9 +7,10 @@ const TRANSIENT_CODES = new Set([
     "ETIMEDOUT",
     "ENOTFOUND",
     "EAI_AGAIN",
-    "CONNECTION_CLOSED",
-    "CONNECT_TIMEOUT",
-    "CONNECTION_DESTROYED",
+    "ERR_POSTGRES_CONNECTION_CLOSED",
+    "ERR_POSTGRES_CONNECTION_REFUSED",
+    "ERR_POSTGRES_CONNECTION_TIMEOUT",
+    "ERR_POSTGRES_CONNECTION_FAILED",
 ]);
 const CONNECTION_EXCEPTION_CLASS = "08";
 export function isTransientConnectionError(error) {

package/dist/boot/warn-row-level-security-off.d.ts

@@ -0,0 +1,3 @@
+import type { RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
+import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
+export declare function warnIfRowLevelSecurityOff(mode: RowLevelSecurityMode, log: Pick<Logger, "warn">): void;

package/dist/boot/warn-row-level-security-off.js

@@ -0,0 +1,6 @@
+export function warnIfRowLevelSecurityOff(mode, log) {
+    // skip: the default mode needs no warning
+    if (mode !== "off")
+        return;
+    log.warn("rowLevelSecurity is off: tenant isolation relies on the application layer only; Postgres row level security is not enforced");
+}

package/dist/boot/worker-boot-core.d.ts

@@ -25,8 +25,9 @@ export type BootedWorkerProcess = {
     readonly registry: Registry;
     readonly features: readonly FeatureDefinition[];
     readonly envSource: Record<string, string | undefined>;
+    readonly extraContext: Record<string, unknown>;
     readonly entrypoint: WorkerEntrypoint;
-    /** ctx.secrets as wired into the entrypoint (auto-wired when the secrets
+    /** ctx.services.secrets as wired into the entrypoint (auto-wired when the secrets
      *  feature is mounted and a master key exists, or from `extraContext`). */
     readonly secrets?: SecretsContext;
     /** Envelope cipher for `encrypted` config keys, when a master key is wired. */

package/dist/boot/worker-boot-core.js

@@ -5,9 +5,11 @@
 // share every step that decides ciphers, blind indexes and config encryption.
 import { loadJwtSecretOrKeyring } from "@cosmicdrift/kumiko-framework/api";
 import { configureBlindIndexKey, configurePiiSubjectKms, resolvePlatformKeks, } from "@cosmicdrift/kumiko-framework/crypto";
-import { configureEntityFieldEncryption, } from "@cosmicdrift/kumiko-framework/db";
+import { assertRowLevelSecurityBootState, configureEntityFieldEncryption, knownTablesOf, } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
 import { createWorkerEntrypoint, } from "@cosmicdrift/kumiko-framework/entrypoint";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { assertKumikoSchemaCurrent, SchemaDriftError, } from "@cosmicdrift/kumiko-framework/migrations";
 import { createEntityCache, createEventDedup, createIdempotencyGuard, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { createRedisCacheSyncBus, redisClientOptionsFromEnv, } from "@cosmicdrift/kumiko-framework/redis";
@@ -23,6 +25,7 @@ import { jobRunLoggerCallbacks } from "./job-run-logger.js";
 import { INSTANCE_ID_ENV } from "./record-app-started-on-boot.js";
 import { buildEffectiveFeaturesResolver, openDatabasePools, waitForKmsHealthy, } from "./shared-boot-steps.js";
 import { WAIT_FOR_DATABASE_DEADLINE_MS, waitForDatabase } from "./wait-for-database.js";
+import { warnIfRowLevelSecurityOff } from "./warn-row-level-security-off.js";
 import { assertWorkerMetricsOptions } from "./worker-metrics-server.js";
 function isSecretsContext(value) {
     if (typeof value !== "object" || value === null)
@@ -62,11 +65,13 @@ export async function bootWorkerProcess(options, envSource, profile) {
     const databaseUrl = requireEnv("DATABASE_URL", envSource, processName);
     const redisUrl = requireEnv("REDIS_URL", envSource, processName);
     const jwtSecretOrKeyring = loadJwtSecretOrKeyring(envSource);
+    const rowLevelSecurity = options.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE;
     // MUST be composed with the same `includeBundled` as the API process.
     const includeBundled = !!options.includeBundled || profile.authOptions !== undefined;
     const features = composeFeatures(options.features, {
         includeBundled,
         ...(profile.authOptions && { authOptions: profile.authOptions }),
+        ...(options.bundledLists && { bundledLists: options.bundledLists }),
     });
     const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
     validateBoot(features, {
@@ -92,18 +97,22 @@ export async function bootWorkerProcess(options, envSource, profile) {
         return { kind: "dry-run", envSource };
     }
     // Before the connections, so an abort leaks nothing.
-    const databaseWaitDeadline = Date.now() + WAIT_FOR_DATABASE_DEADLINE_MS;
+    const databaseWaitDeadline = (options.databaseWait?.now ?? Date.now)() + WAIT_FOR_DATABASE_DEADLINE_MS;
     if (options.kms) {
-        await waitForKmsHealthy(options.kms, processName, databaseWaitDeadline);
+        await waitForKmsHealthy(options.kms, processName, databaseWaitDeadline, options.databaseWait);
     }
-    const { db, closeDb, outsideTransactionDb, closeOutsideTransactionDb } = openDatabasePools(databaseUrl, envSource);
+    const { db, closeDb, outsideTransactionDb, closeOutsideTransactionDb } = openDatabasePools(databaseUrl, envSource, rowLevelSecurity);
     const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
     const cacheSync = createRedisCacheSyncBus({
         redisUrl,
         clientOptions: redisClientOptionsFromEnv(envSource),
     });
     try {
-        await waitForDatabase(db, { processName, deadline: databaseWaitDeadline });
+        await waitForDatabase(db, {
+            ...options.databaseWait,
+            processName,
+            deadline: databaseWaitDeadline,
+        });
     }
     catch (err) {
         await closeDb();
@@ -131,6 +140,16 @@ export async function bootWorkerProcess(options, envSource, profile) {
             throw err;
         }
     }
+    try {
+        await assertRowLevelSecurityBootState(db, rowLevelSecurity, knownTablesOf(features));
+    }
+    catch (err) {
+        await closeDb();
+        await closeOutsideTransactionDb();
+        redis.disconnect();
+        await cacheSync.close();
+        throw err;
+    }
     const idempotency = createIdempotencyGuard(redis, { ttlSeconds: 60 });
     const eventDedup = createEventDedup(redis, { ttlSeconds: 60 });
     const entityCache = createEntityCache(redis, { ttlSeconds: 60 });
@@ -144,6 +163,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
     configurePiiSubjectKms(options.kms);
     configureBlindIndexKey(options.blindIndexKey);
     const bootLogger = loggerFromExtraContext(resolvedExtraContext);
+    warnIfRowLevelSecurityOff(rowLevelSecurity, bootLogger ?? createFallbackLogger(processName));
     const autoExtraContext = buildBootExtraContext({
         db,
         features,
@@ -151,6 +171,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
         registry,
         hasAuth: includeBundled,
         redis,
+        ...(options.appOverrides && { appOverrides: options.appOverrides }),
         crypto: bootCrypto,
         ...(options.kms && { kms: options.kms }),
         ...(profile.deliverQueuedInline === true && { deliverQueuedInline: true }),
@@ -160,6 +181,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
     const jobLogger = jobRunLoggerCallbacks(registry, db);
     const entrypoint = createWorkerEntrypoint({
         registry,
+        rowLevelSecurity,
         context: { db, redis, entityCache, registry, ...extraContext },
         jwtSecret: jwtSecretOrKeyring,
         dispatcherOptions: {
@@ -191,6 +213,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
         registry,
         features,
         envSource,
+        extraContext,
         entrypoint,
         ...(isSecretsContext(extraContext["secrets"]) && { secrets: extraContext["secrets"] }),
         ...(bootCrypto.configCipher && { configCipher: bootCrypto.configCipher }),

package/dist/boot/worker-metrics-server.js

@@ -1,6 +1,7 @@
 // /metrics for HTTP-less worker pods: the worker entrypoint has no Hono app,
 // so scraping needs its own tiny server on a dedicated port.
 import { createMetricsApp, isPrometheusMeter, } from "@cosmicdrift/kumiko-framework/api";
+import { assertNoActiveRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/db";
 /** Fails the boot (also under KUMIKO_DRY_RUN_ENV=boot) on a metrics config
  *  that would otherwise only surface as a 503 on the first scrape. */
 export function assertWorkerMetricsOptions(metrics, observability, processName) {
@@ -16,6 +17,7 @@ export function assertWorkerMetricsOptions(metrics, observability, processName)
 }
 export function startWorkerMetricsServer(metrics, entrypoint) {
     const app = createMetricsApp(entrypoint.observability.meter, metrics);
+    assertNoActiveRowLevelSecurityScope("worker metrics server");
     const server = Bun.serve({ port: metrics.port, fetch: app.fetch });
     entrypoint.lifecycle.registerShutdownHook("metrics-server", async () => {
         await server.stop();

package/dist/boot-options/demo-mode.d.ts

@@ -1,4 +1,4 @@
-import type { ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
+import { type ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
 export type DemoAccountRole = "admin" | "sysadmin";
 /** A role alone, or a role with the label the banner shows next to the login. */
 export type DemoAccountEntry = DemoAccountRole | {
@@ -19,7 +19,7 @@ export type DemoModeNotice = {
     readonly accounts?: readonly DemoAccountEntry[];
 };
 /** Live-demo switch. `readOnly: true` answers every mutating request
- *  (POST/PUT/PATCH/DELETE) outside `/api/query` and the login/logout/MFA
+ *  (POST/PUT/PATCH/DELETE) and every WebSocket upgrade outside `/api/query` and the login/logout/MFA
  *  routes with 403 `demo_read_only`. `GET /demo-mode` (anonymous) returns
  *  `{ readOnly, notice }` for the client banner.
  *
@@ -32,7 +32,7 @@ export type DemoModeNotice = {
 export type DemoModeOption = {
     readonly readOnly: boolean;
     readonly notice?: DemoModeNotice;
-    /** Mutating paths that stay open besides the default allowlist. */
+    /** Mutating paths (and WebSocket route paths) that stay open besides the default allowlist. */
     readonly allowedWritePaths?: readonly string[];
 };
 export declare const DEMO_MODE_PATH = "/demo-mode";

package/dist/boot-options/demo-mode.js

@@ -1,3 +1,4 @@
+import { isWebSocketUpgradeRequest, } from "@cosmicdrift/kumiko-framework/api";
 export const DEMO_MODE_PATH = "/demo-mode";
 export const DEMO_READ_ONLY_ERROR_CODE = "demo_read_only";
 const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
@@ -52,7 +53,9 @@ export function withDemoReadOnlyFetch(fetchHandler, demoMode) {
         ...(demoMode.allowedWritePaths ?? []),
     ]);
     return async (req, arg) => {
-        if (MUTATING_METHODS.has(req.method) && !allowed.has(new URL(req.url).pathname)) {
+        // A socket carries writes after the upgrade (route `write` dep), outside this method gate.
+        const mutates = MUTATING_METHODS.has(req.method) || isWebSocketUpgradeRequest(req);
+        if (mutates && !allowed.has(new URL(req.url).pathname)) {
             return Response.json({
                 isSuccess: false,
                 error: {

package/dist/boot-options/resolve-boot-options.d.ts

@@ -24,6 +24,7 @@ export type BootOptionFields = {
     /** With `runSingleInstance: false`: the worker process mounts the same mail / fileStorage
      *  features (its own boot options or by hand), which silences the boot warning. */
     readonly workerMountsFeatures?: boolean;
+    readonly appOverrides?: object;
     readonly auth?: {
         readonly admin?: unknown;
         readonly mail?: {

package/dist/boot-options/resolve-boot-options.js

@@ -46,9 +46,9 @@ function wireFeatureToggles(options, mounted) {
 function warnAboutBootOptions(options) {
     const bootWarnings = stackBootWarnings(options).map((line) => `stacks in \`features\` expect boot options that are not set:\n${line}`);
     if (options.runSingleInstance === false &&
-        (options.mail || options.fileStorage || options.featureToggles) &&
+        (options.mail || options.fileStorage || options.featureToggles || options.appOverrides) &&
         options.workerMountsFeatures !== true) {
-        bootWarnings.push("runSingleInstance:false — delivery and file jobs run in runWorkerApp. Pass the same mail / fileStorage / featureToggles options there, or set workerMountsFeatures: true if it mounts those features itself.");
+        bootWarnings.push("runSingleInstance:false — delivery and file jobs run in runWorkerApp. Pass the same mail / fileStorage / featureToggles / appOverrides options there, or set workerMountsFeatures: true if it mounts those features itself.");
     }
     if (bootWarnings.length > 0) {
         // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early

package/dist/boot-options/seed-shortcuts.js

@@ -28,7 +28,9 @@ function membershipOf(tenant, roles) {
 }
 function seedAccount(admin) {
     return async (db) => {
-        await seedAdminGuarded(db, admin);
+        // Operator-created account, not a self-registration: under emailVerificationMode "strict"
+        // an unverified seed account could never log in. An explicit `emailVerified` still overrides.
+        await seedAdminGuarded(db, { emailVerified: true, ...admin });
     };
 }
 function buildDemoAdminSeed(value, demoTenant, envSource) {

package/dist/boot-options/stack-boot-requirements.d.ts

@@ -3,7 +3,7 @@ import type { RunProdAppOptions } from "../run-prod-app.ts";
 export type StackBootOptionFields = Pick<RunProdAppOptions, "features" | "kms" | "allowPlaintextPii" | BootOptionName>;
 /** Reads `bootRequires` from the raw feature list: dedupe may later drop the
  *  tagged copy of a feature two stacks share. `scope` limits the check to the
- *  options the calling boot function can set at all (runDevApp has no `signals`). */
+ *  options the calling boot function can set at all. */
 export declare function assertStackBootRequirements(options: StackBootOptionFields, scope?: readonly BootOptionName[]): void;
 /** Requirements a stack marked `severity: "warn"`: logged at boot, never fatal. */
 export declare function stackBootWarnings(options: StackBootOptionFields): string[];