@cosmicdrift/kumiko-server-runtime 0.388.0 → 0.390.0

package/dist/boot-options/stack-boot-requirements.js

@@ -29,18 +29,6 @@ const OPTION_CHECKS = {
         isSatisfied: (options) => options.featureToggles === true,
         hint: "set featureToggles: true",
     },
-    demoMode: {
-        isSatisfied: (options) => options.demoMode !== undefined,
-        hint: "set demoMode: { readOnly }",
-    },
-    seeds: {
-        isSatisfied: (options) => options.seeds !== undefined,
-        hint: "set seeds",
-    },
-    signals: {
-        isSatisfied: (options) => options.signals !== false,
-        hint: "drop signals: false",
-    },
     rateLimit: {
         isSatisfied: (options) => options.rateLimit !== false,
         hint: "drop rateLimit: false",
@@ -65,7 +53,7 @@ function unsatisfiedRequirements(options, severity, scope) {
 }
 /** Reads `bootRequires` from the raw feature list: dedupe may later drop the
  *  tagged copy of a feature two stacks share. `scope` limits the check to the
- *  options the calling boot function can set at all (runDevApp has no `signals`). */
+ *  options the calling boot function can set at all. */
 export function assertStackBootRequirements(options, scope) {
     const gaps = unsatisfiedRequirements(options, "error", scope);
     if (gaps.length > 0) {

package/dist/build-prod-bundle.js

@@ -63,6 +63,7 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { BUNDLED_ASSETS_DIST_DIR, readBundledAssetDeclarations, resolveBundledAssetSource, } from "./bundled-assets.js";
 import { CSP_HASHES_FILE, inlineScriptHashes } from "./csp-hashes.js";
 import { RENDERER_WEB_FONT_FILE_PATTERN, RENDERER_WEB_FONTS_DIST_DIR, resolveRendererWebFontsDir, } from "./renderer-web-fonts.js";
+import { resolveInstalledSync } from "./resolve-installed-package.js";
 import { canResolveTailwindStylesheet, resolveTailwindCli } from "./resolve-tailwind-cli.js";
 // Bun runtime check as a module-level constant: every build step (Tailwind via
 // Bun.spawn, client bundling via Bun.build, and stylesheet resolution via
@@ -454,18 +455,11 @@ function resolveStylesheetEntry(cwd, clientEntry, override) {
     // and production builds behave identically.
     if (!clientEntry)
         return undefined;
-    if (!hasBun)
-        return undefined;
-    try {
-        const resolved = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", cwd);
-        if (!canResolveTailwindStylesheet(resolved, { bun: Bun, cwd })) {
-            return undefined;
-        }
-        return { path: resolved, isRendererWebFallback: true };
-    }
-    catch {
+    const resolved = resolveInstalledSync("@cosmicdrift/kumiko-renderer/web/styles.css", cwd);
+    if (resolved === undefined || !canResolveTailwindStylesheet(resolved, { bun: Bun, cwd })) {
         return undefined;
     }
+    return { path: resolved, isRendererWebFallback: true };
 }
 // Build-time guard against unstyled production output: when the build falls
 // back to renderer-web/styles.css but the compiled CSS lacks the shell sentinel,
@@ -579,9 +573,15 @@ function isTailwindEngine(candidate) {
 // Both packages are the CLI's own dependencies, so they resolve from the CLI package directory
 // (same version the CLI would run), not from the app root.
 async function loadTailwindEngine(cliPath, bun) {
-    const cliDir = dirname(bun.resolveSync("@tailwindcss/cli/package.json", dirname(cliPath)));
-    const node = await import(__rewriteRelativeImportExtension(bun.resolveSync("@tailwindcss/node", cliDir)));
-    const oxide = await import(__rewriteRelativeImportExtension(bun.resolveSync("@tailwindcss/oxide", cliDir)));
+    const cliDir = resolve(cliPath, "..", "..");
+    const importFromCli = (packageName) => {
+        const entry = resolveInstalledSync(packageName, cliDir, bun);
+        if (entry !== undefined)
+            return import(__rewriteRelativeImportExtension(entry));
+        throw new Error(`[kumiko build] ${packageName} is not installed next to @tailwindcss/cli (${cliDir}).`);
+    };
+    const node = await importFromCli("@tailwindcss/node");
+    const oxide = await importFromCli("@tailwindcss/oxide");
     const engine = {
         compile: isRecord(node) ? node["compile"] : undefined,
         optimize: isRecord(node) ? node["optimize"] : undefined,

package/dist/bundled-lists-table.d.ts

@@ -0,0 +1,2 @@
+import { type BundledListsOptions, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export declare function applyBundledListsTable(features: readonly FeatureDefinition[], options: BundledListsOptions | undefined): FeatureDefinition[];

package/dist/bundled-lists-table.js

@@ -0,0 +1,56 @@
+import { normalizeListColumn, validateBundledListsOptions, } from "@cosmicdrift/kumiko-framework/engine";
+export function applyBundledListsTable(features, options) {
+    if (options === undefined)
+        return [...features];
+    validateBundledListsOptions(options);
+    return features.map((feature) => feature.adoptsBundledLists === true ? withListTableDefaults(feature, options) : feature);
+}
+function withListTableDefaults(feature, options) {
+    return {
+        ...feature,
+        screens: Object.fromEntries(Object.entries(feature.screens).map(([id, screen]) => [
+            id,
+            withScreenTableDefaults(screen, options),
+        ])),
+    };
+}
+function withScreenTableDefaults(screen, options) {
+    switch (screen.type) {
+        case "entityList":
+        case "projectionList": {
+            const table = { ...options.table, ...screen.table };
+            return { ...screen, table, columns: pinFirstColumn(screen.columns, table, options) };
+        }
+        case "projectionDetail":
+        case "entityEdit":
+            return {
+                ...screen,
+                layout: {
+                    ...screen.layout,
+                    sections: screen.layout.sections.map((section) => withSectionTableDefaults(section, options)),
+                },
+            };
+        default:
+            return screen;
+    }
+}
+function withSectionTableDefaults(section, options) {
+    if (section.kind !== "relatedList")
+        return section;
+    // export is only valid on entityList and projectionList
+    const { export: _export, ...defaultsWithoutExport } = options.table;
+    const table = { ...defaultsWithoutExport, ...section.table };
+    return { ...section, table, columns: pinFirstColumn(section.columns, table, options) };
+}
+function pinFirstColumn(columns, table, options) {
+    if (options.pinFirstColumn !== true || table.pinning !== true)
+        return columns;
+    const normalized = columns.map(normalizeListColumn);
+    if (normalized.some((column) => column.pinned !== undefined))
+        return columns;
+    // A hidden column only appears via the column picker; pinning it would surprise the user.
+    const firstVisible = normalized.findIndex((column) => column.hidden !== true);
+    if (firstVisible === -1)
+        return columns;
+    return columns.map((column, index) => index === firstVisible ? { ...normalizeListColumn(column), pinned: "left" } : column);
+}

package/dist/compose-auth-options.d.ts

@@ -0,0 +1,16 @@
+import type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOptions, EmailVerificationOptions, InviteOptions, PasswordResetOptions, SignupOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+/** Shape of any run{Prod,Dev}App auth block that can carry a
+ *  passwordReset/emailVerification config, once resolveAuthMail has resolved
+ *  the wrapper's optional hmacSecret into the feature API's required one —
+ *  a structural-typed lookup on the auth-only subset is enough. Lets
+ *  buildComposeAuthOptions be called with both RunProd- and
+ *  RunDev-AuthOptions without building the helper twice. */
+export type AuthOptionsCarrier = {
+    readonly passwordReset?: PasswordResetOptions;
+    readonly emailVerification?: EmailVerificationOptions;
+    readonly signup?: SignupOptions;
+    readonly invite?: InviteOptions;
+    readonly accountUnlock?: AccountUnlockOptions;
+    readonly accountLockout?: AccountLockoutOptions;
+};
+export declare function buildComposeAuthOptions(auth: AuthOptionsCarrier | undefined): AuthEmailPasswordOptions | undefined;

package/dist/compose-auth-options.js

@@ -0,0 +1,49 @@
+// The magic-link mail fields shared by all five flows. Conditional spreads omit
+// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
+// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
+// reset/verify layer hmacSecret (+ mode) on top.
+function pickMailFields(src) {
+    return {
+        appUrl: src.appUrl,
+        ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
+        ...(src.appName !== undefined && { appName: src.appName }),
+        ...(src.locale !== undefined && { locale: src.locale }),
+    };
+}
+export function buildComposeAuthOptions(auth) {
+    if (!auth)
+        return undefined;
+    const opts = {};
+    if (auth.passwordReset) {
+        opts.passwordReset = {
+            hmacSecret: auth.passwordReset.hmacSecret,
+            ...pickMailFields(auth.passwordReset),
+        };
+    }
+    if (auth.emailVerification) {
+        opts.emailVerification = {
+            hmacSecret: auth.emailVerification.hmacSecret,
+            ...pickMailFields(auth.emailVerification),
+            ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
+        };
+    }
+    if (auth.signup) {
+        opts.signup = pickMailFields(auth.signup);
+    }
+    if (auth.invite) {
+        opts.invite = pickMailFields(auth.invite);
+    }
+    if (auth.accountUnlock) {
+        opts.accountUnlock = {
+            hmacSecret: auth.accountUnlock.hmacSecret,
+            ...pickMailFields(auth.accountUnlock),
+        };
+    }
+    if (auth.accountLockout) {
+        opts.accountLockout = auth.accountLockout;
+    }
+    return hasAnyAuthFlow(opts) ? opts : undefined;
+}
+function hasAnyAuthFlow(opts) {
+    return Object.values(opts).some(Boolean);
+}

package/dist/compose-features.d.ts

@@ -1,5 +1,6 @@
-import { type AccountLockoutOptions, type AccountUnlockOptions, type AuthEmailPasswordOptions, type EmailVerificationOptions, type InviteOptions, type PasswordResetOptions, type SignupOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type AuthEmailPasswordOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { type BundledListsOptions, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export { type AuthOptionsCarrier, buildComposeAuthOptions } from "./compose-auth-options.ts";
 export type ComposeFeaturesOptions = {
     /** When true, prepends config + user + tenant + auth-email-password
      *  (+ auth-self-registration when authOptions.signup is set) before the
@@ -12,20 +13,7 @@ export type ComposeFeaturesOptions = {
      *  auth-routes.ts but no handler dispatches). Goes hand-in-hand with the
      *  passwordReset block in RunProdAppAuthOptions / RunDevAppAuthOptions. */
     readonly authOptions?: AuthEmailPasswordOptions;
+    /** One table block for every list screen and relatedList of the bundled features; screen-own keys win. */
+    readonly bundledLists?: BundledListsOptions;
 };
 export declare function composeFeatures(appFeatures: readonly FeatureDefinition[], options: ComposeFeaturesOptions): FeatureDefinition[];
-/** Shape of any run{Prod,Dev}App auth block that can carry a
- *  passwordReset/emailVerification config, once resolveAuthMail has resolved
- *  the wrapper's optional hmacSecret into the feature API's required one —
- *  a structural-typed lookup on the auth-only subset is enough. Lets
- *  buildComposeAuthOptions be called with both RunProd- and
- *  RunDev-AuthOptions without building the helper twice. */
-export type AuthOptionsCarrier = {
-    readonly passwordReset?: PasswordResetOptions;
-    readonly emailVerification?: EmailVerificationOptions;
-    readonly signup?: SignupOptions;
-    readonly invite?: InviteOptions;
-    readonly accountUnlock?: AccountUnlockOptions;
-    readonly accountLockout?: AccountLockoutOptions;
-};
-export declare function buildComposeAuthOptions(auth: AuthOptionsCarrier | undefined): AuthEmailPasswordOptions | undefined;

package/dist/compose-features.js

@@ -21,9 +21,14 @@ import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-featu
 import { collectAssignableAppRoles, createTenantFeature, } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { TENANT_LIFECYCLE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
 import { createUserFeature } from "@cosmicdrift/kumiko-bundled-features/user";
-import { dedupeFeatures } from "@cosmicdrift/kumiko-framework/engine";
+import { dedupeFeatures, } from "@cosmicdrift/kumiko-framework/engine";
 import { FILES_FEATURE } from "@cosmicdrift/kumiko-framework/files";
 import { createRendererMailHtmlFeature } from "@cosmicdrift/kumiko-renderer-mail-html";
+import { applyBundledListsTable } from "./bundled-lists-table.js";
+export { buildComposeAuthOptions } from "./compose-auth-options.js";
+// Output of a first composeFeatures pass comes back as app features when a caller composes twice (the app
+// config already composed, boot composes again); those copies are dropped silently, only app-supplied ones warn.
+const composedBundledInstances = new WeakSet();
 export function composeFeatures(appFeatures, options) {
     // ponytail: includeBundled:false skips the auth-mfa auto-wiring below —
     // an app composing its own foundation and mounting auth-mfa itself is
@@ -32,7 +37,7 @@ export function composeFeatures(appFeatures, options) {
     // bypasses MFA. Upgrade if this trips someone: warn here when appFeatures
     // contains AUTH_MFA_FEATURE but includeBundled is false.
     if (!options.includeBundled)
-        return dedupeFeatures(appFeatures);
+        return applyBundledListsTable(dedupeFeatures(appFeatures), options.bundledLists);
     // Bundled foundation goes first so its instances carry the runDevApp /
     // runProdApp `authOptions` (passwordReset wiring etc.). App-features that
     // ALSO declare one of these names — e.g. the create-kumiko-app picker
@@ -72,6 +77,8 @@ export function composeFeatures(appFeatures, options) {
         // "on unless an operator flips it off at runtime" contract.
         ...(authOptions?.signup !== undefined ? [createAuthSelfRegistrationToggleFeature()] : []),
     ];
+    for (const f of bundled)
+        composedBundledInstances.add(f);
     const bundledNames = new Set(bundled.map((f) => f.name));
     const filteredApp = [];
     for (const f of dedupedAppFeatures) {
@@ -81,6 +88,8 @@ export function composeFeatures(appFeatures, options) {
             // authOptions.signup and only get it from there.
             if (f.name === AUTH_SELF_REGISTRATION_FEATURE)
                 continue;
+            if (composedBundledInstances.has(f))
+                continue;
             // biome-ignore lint/suspicious/noConsole: boot-time UX warning
             console.warn(`[composeFeatures] "${f.name}" already auto-mounted via includeBundled — dropping the explicit copy from APP_FEATURES. Remove it from run-config.ts to silence this warning.`);
             continue;
@@ -92,12 +101,12 @@ export function composeFeatures(appFeatures, options) {
     const needsFilesTenantData = names.has(FILES_FEATURE) &&
         names.has(TENANT_LIFECYCLE_FEATURE) &&
         !names.has(FILES_TENANT_DATA_FEATURE);
-    return [
+    return applyBundledListsTable([
         ...bundled,
         ...missingAuthMailStack(names),
         ...filteredApp,
         ...(needsFilesTenantData ? [createFilesTenantDataFeature()] : []),
-    ];
+    ], options.bundledLists);
 }
 // auth-email-password declares its mails as stored templates, and the boot seed
 // fails without the template-resolver and a mail renderer. Mounting the missing
@@ -110,52 +119,3 @@ function missingAuthMailStack(mountedNames) {
         createRendererMailHtmlFeature(),
     ].filter((feature) => !mountedNames.has(feature.name));
 }
-// The magic-link mail fields shared by all five flows. Conditional spreads omit
-// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
-// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
-// reset/verify layer hmacSecret (+ mode) on top.
-function pickMailFields(src) {
-    return {
-        appUrl: src.appUrl,
-        ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
-        ...(src.appName !== undefined && { appName: src.appName }),
-        ...(src.locale !== undefined && { locale: src.locale }),
-    };
-}
-export function buildComposeAuthOptions(auth) {
-    if (!auth)
-        return undefined;
-    const opts = {};
-    if (auth.passwordReset) {
-        opts.passwordReset = {
-            hmacSecret: auth.passwordReset.hmacSecret,
-            ...pickMailFields(auth.passwordReset),
-        };
-    }
-    if (auth.emailVerification) {
-        opts.emailVerification = {
-            hmacSecret: auth.emailVerification.hmacSecret,
-            ...pickMailFields(auth.emailVerification),
-            ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
-        };
-    }
-    if (auth.signup) {
-        opts.signup = pickMailFields(auth.signup);
-    }
-    if (auth.invite) {
-        opts.invite = pickMailFields(auth.invite);
-    }
-    if (auth.accountUnlock) {
-        opts.accountUnlock = {
-            hmacSecret: auth.accountUnlock.hmacSecret,
-            ...pickMailFields(auth.accountUnlock),
-        };
-    }
-    if (auth.accountLockout) {
-        opts.accountLockout = auth.accountLockout;
-    }
-    return hasAnyAuthFlow(opts) ? opts : undefined;
-}
-function hasAnyAuthFlow(opts) {
-    return Object.values(opts).some(Boolean);
-}

package/dist/extra-routes-deps.d.ts

@@ -1,11 +1,13 @@
 import type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 export type { SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+export { makeFilesForTenant } from "./files-for-tenant.ts";
 /** Deps for the `wire` hook (runProdApp/createKumikoServer, after
  *  buildServer has mounted `extraRoutes`) and
  *  for `runWorkerApp.wireComponents`. Naming: `deps` not `ctx` because
@@ -18,11 +20,13 @@ export type SystemWireDeps = {
     /** Feature-registry — e.g. for plugin-lookups via
      *  `registry.getExtensionUsages("subscriptionProvider")`. */
     readonly registry: Registry;
+    /** File context of a tenant's storage; undefined when no file storage is mounted. Required so a consumer cannot lose attachment reading by omission. */
+    readonly filesForTenant: (tenantId: string) => FileContext | undefined;
     /** The boot's master key keyring; absent when no `KUMIKO_SECRETS_MASTER_KEY_V<n>` is set. */
     readonly masterKeyProvider?: MasterKeyProvider;
     /** Cipher for `encrypted: true` config keys, same instance and DEK cache as the handlers use. */
     readonly configEncryption?: EnvelopeCipher;
-    /** Same contract as `ctx.metricsFor`: unregistered metric names no-op. */
+    /** Same contract as `ctx.obs.metricsFor`: unregistered metric names no-op. */
     readonly metricsFor: (featureName: string) => MetricsHandle;
     /** Writes through the /api/*-command-dispatcher (same idempotency/job
      *  hooks) as an auto-constructed SystemAdmin of the target tenant,

package/dist/extra-routes-deps.js

@@ -2,3 +2,4 @@
 // truth lives in framework/api next to buildServer's own `extraRoutes`
 // mount so the two never drift on how the SystemAdmin identity is built.
 export { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+export { makeFilesForTenant } from "./files-for-tenant.js";

package/dist/files-for-tenant.d.ts

@@ -0,0 +1,3 @@
+import { type AppContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
+export declare function makeFilesForTenant(context: AppContext): (tenantId: string) => FileContext | undefined;

package/dist/files-for-tenant.js

@@ -0,0 +1,10 @@
+import { fileContextFromResolver } from "@cosmicdrift/kumiko-bundled-features/file-foundation";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+// Takes the AppContext buildServer returned: only that one carries `_fileProviderResolver`.
+// Without a resolver, `context.files` is bound to the system tenant and reaches no other one.
+export function makeFilesForTenant(context) {
+    const resolver = context._fileProviderResolver;
+    if (resolver)
+        return (tenantId) => fileContextFromResolver(resolver, tenantId);
+    return (tenantId) => (tenantId === SYSTEM_TENANT_ID ? context.files : undefined);
+}

package/dist/renderer-web-fonts.js

@@ -3,26 +3,20 @@
 // dir (dev) or hashed into dist/assets (prod), away from the source fonts.
 // data: URIs are out because apps run with `font-src 'self'`.
 import { dirname, join } from "node:path";
+import { resolveInstalledSync } from "./resolve-installed-package.js";
 export const RENDERER_WEB_FONTS_URL_PREFIX = "/assets/kumiko/fonts/";
 /** dist-relative folder the prod build copies the fonts into. */
 export const RENDERER_WEB_FONTS_DIST_DIR = "assets/kumiko/fonts";
 /** Allowlist for servable font file names; also rules out path segments. */
 export const RENDERER_WEB_FONT_FILE_PATTERN = /^[a-z0-9-]+\.woff2$/;
-const hasBun = typeof Bun !== "undefined";
 /** Directory of the woff2 files next to renderer-web's styles.css, or
  *  undefined when the package can't be resolved from any `searchFrom` dir
  *  (or outside Bun, which does the package-exports resolution). */
 export function resolveRendererWebFontsDir(searchFrom) {
-    if (!hasBun)
-        return undefined;
     for (const from of searchFrom) {
-        try {
-            const stylesheet = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", from);
+        const stylesheet = resolveInstalledSync("@cosmicdrift/kumiko-renderer/web/styles.css", from);
+        if (stylesheet !== undefined)
             return join(dirname(stylesheet), "fonts");
-        }
-        catch {
-            // try the next search root
-        }
     }
     return undefined;
 }

package/dist/resolve-installed-package.d.ts

@@ -0,0 +1,10 @@
+export type BunResolver = {
+    readonly resolveSync: (id: string, from: string) => string;
+};
+export declare function packageNameOf(specifier: string): string;
+/** Walks node_modules upwards like Node does; returns the real path so transitive deps
+ *  of an isolated-linker install are found as siblings. */
+export declare function findInstalledPackageDir(packageName: string, fromDir: string): string | undefined;
+/** Bun.resolveSync auto-installs from the registry (since 1.4.4) when no node_modules tree
+ *  exists, so only call it for packages that are already installed. */
+export declare function resolveInstalledSync(specifier: string, fromDir: string, bun?: BunResolver | undefined): string | undefined;

package/dist/resolve-installed-package.js

@@ -0,0 +1,32 @@
+import { existsSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+export function packageNameOf(specifier) {
+    const segments = specifier.split("/");
+    return specifier.startsWith("@") ? segments.slice(0, 2).join("/") : (segments[0] ?? specifier);
+}
+/** Walks node_modules upwards like Node does; returns the real path so transitive deps
+ *  of an isolated-linker install are found as siblings. */
+export function findInstalledPackageDir(packageName, fromDir) {
+    for (let dir = resolve(fromDir);; dir = resolve(dir, "..")) {
+        const packageDir = join(dir, "node_modules", packageName);
+        if (existsSync(join(packageDir, "package.json")))
+            return realpathSync(packageDir);
+        if (resolve(dir, "..") === dir)
+            return undefined;
+    }
+}
+const globalBun = typeof Bun !== "undefined" ? Bun : undefined;
+/** Bun.resolveSync auto-installs from the registry (since 1.4.4) when no node_modules tree
+ *  exists, so only call it for packages that are already installed. */
+export function resolveInstalledSync(specifier, fromDir, bun = globalBun) {
+    if (bun === undefined)
+        return undefined;
+    if (findInstalledPackageDir(packageNameOf(specifier), fromDir) === undefined)
+        return undefined;
+    try {
+        return bun.resolveSync(specifier, fromDir);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/resolve-tailwind-cli.d.ts

@@ -1,14 +1,9 @@
-type BunResolver = {
-    resolveSync: (id: string, from: string) => string;
-};
+import { type BunResolver } from "./resolve-installed-package.ts";
 export type ResolveTailwindCliDeps = {
     readonly bun?: BunResolver;
     readonly cwd: string;
 };
 export declare function resolveTailwindCli(deps: ResolveTailwindCliDeps): string | undefined;
-/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
- *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
- *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer/web` outside a hoisted node_modules tree. */
+/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry CSS file, so
+ *  tailwindcss must be installed above it (not just next to a Bun cache copy of renderer-web). */
 export declare function canResolveTailwindStylesheet(entryCss: string, deps: ResolveTailwindCliDeps): boolean;
-export {};

package/dist/resolve-tailwind-cli.js

@@ -1,34 +1,17 @@
 // Resolves the locally installed @tailwindcss/cli binary to its absolute path.
 // We avoid `bunx` because it still requests the registry manifest for a locally
 // installed package and fails with `FailedToOpenSocket` when offline.
-//
-// Kept separate from create-kumiko-server.ts so the Bun and resolution-failure
-// branches can be tested under Vitest/Node without booting the server.
-import { dirname, resolve } from "node:path";
+import { dirname, join } from "node:path";
+import { findInstalledPackageDir } from "./resolve-installed-package.js";
 export function resolveTailwindCli(deps) {
     if (deps.bun === undefined)
         return undefined;
-    try {
-        const pkgJsonPath = deps.bun.resolveSync("@tailwindcss/cli/package.json", deps.cwd);
-        // bin: { tailwindcss: "./dist/index.mjs" } → absoluter Pfad
-        return resolve(pkgJsonPath, "..", "dist", "index.mjs");
-    }
-    catch {
-        return undefined;
-    }
+    const cliDir = findInstalledPackageDir("@tailwindcss/cli", deps.cwd);
+    return cliDir === undefined ? undefined : join(cliDir, "dist", "index.mjs");
 }
-/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry
- *  CSS file. Skip renderer-web fallback (or fail build) when peer deps
- *  aren't resolvable from that directory — e.g. Bun cache copies of
- *  `@cosmicdrift/kumiko-renderer/web` outside a hoisted node_modules tree. */
+/** Tailwind v4 resolves `@import "tailwindcss"` relative to the entry CSS file, so
+ *  tailwindcss must be installed above it (not just next to a Bun cache copy of renderer-web). */
 export function canResolveTailwindStylesheet(entryCss, deps) {
-    if (deps.bun === undefined)
-        return false;
-    try {
-        deps.bun.resolveSync("tailwindcss", dirname(entryCss));
-        return true;
-    }
-    catch {
-        return false;
-    }
+    return (deps.bun !== undefined &&
+        findInstalledPackageDir("tailwindcss", dirname(entryCss)) !== undefined);
 }

package/dist/run-prod-app-boot-context.d.ts

@@ -16,6 +16,8 @@ export declare function addConfigAccessorFactory<T extends {
 export declare function loggerFromExtraContext(extraContext: Record<string, unknown>): Logger | undefined;
 /** Config key (`feature:config:name`) to value; wins over the key's env variable. */
 export type ConfigOverridesInput = Readonly<Record<string, string | number | boolean>>;
+/** Env bridge first, validated app overrides on top: the one merge every boot function shares. */
+export declare function buildConfigOverrides(registry: Registry, envSource: Record<string, string | undefined>, appOverrides: ConfigOverridesInput | undefined): import("@cosmicdrift/kumiko-bundled-features/config").AppConfigOverrides;
 type BootExtraContextOptions = {
     readonly db: DbConnection;
     readonly features: readonly FeatureDefinition[];

package/dist/run-prod-app-boot-context.js

@@ -23,13 +23,11 @@ import { resolveBootCrypto } from "./boot/boot-crypto.js";
 export function addConfigAccessorFactory(resolved, registry) {
     if (!resolved.configResolver)
         return resolved;
-    // Both keys, always overriding an app-supplied value: the factory must derive from the
-    // effective resolver; the underscore alias stays until the next major.
+    // Always overrides an app-supplied value: the factory must derive from the effective resolver.
     const configAccessorFactory = createConfigAccessorFactory(registry, resolved.configResolver);
     return {
         ...resolved,
         configAccessorFactory,
-        _configAccessorFactory: configAccessorFactory,
     };
 }
 // Framework-default providers for AppContext, using the same mechanism as
@@ -42,7 +40,7 @@ export function addConfigAccessorFactory(resolved, registry) {
 // boot/boot-crypto.ts (envHasMasterKek, resolveBootCrypto), shared with runDevApp.
 // A production misconfiguration (secrets mounted without a KEK) is caught by
 // secretsEnvSchema during boot; without the env-schema path, requireSecretsContext
-// throws with a wiring hint on the first ctx.secrets access. configResolver is only
+// throws with a wiring hint on the first ctx.services.secrets access. configResolver is only
 // wired in auth mode. Exported and pure for unit tests; the caller merges it with
 // app values (the app wins).
 // Prod/dev parity for ctx.notify: without this `_notifyFactory` is only wired
@@ -116,16 +114,20 @@ function bootCryptoContext(crypto) {
         ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
         // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
         // whenever a master key exists — NOT gated on the secrets feature,
-        // config encryption must work without mounting ctx.secrets.
+        // config encryption must work without mounting ctx.services.secrets.
         ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
     };
 }
-function createBootConfigResolver(registry, envSource, crypto, appOverrides) {
+/** Env bridge first, validated app overrides on top: the one merge every boot function shares. */
+export function buildConfigOverrides(registry, envSource, appOverrides) {
     const envOverrides = buildEnvConfigOverrides(registry, envSource);
+    return appOverrides
+        ? new Map([...envOverrides, ...validateAppOverrides(registry, appOverrides)])
+        : envOverrides;
+}
+function createBootConfigResolver(registry, envSource, crypto, appOverrides) {
     return createConfigResolver({
-        appOverrides: appOverrides
-            ? new Map([...envOverrides, ...validateAppOverrides(registry, appOverrides)])
-            : envOverrides,
+        appOverrides: buildConfigOverrides(registry, envSource, appOverrides),
         ...(crypto.configCipher && { cipher: crypto.configCipher }),
     });
 }

package/dist/run-prod-app-config.d.ts

@@ -1,4 +1,5 @@
 import { loadJwtSecretOrKeyring } from "@cosmicdrift/kumiko-framework/api";
+import type { RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import { type FeatureDefinition, type Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { resolveBootCrypto } from "./boot/boot-crypto.ts";
@@ -15,6 +16,7 @@ export type ProdBootConfig = {
     readonly envSource: Record<string, string | undefined>;
     readonly bootKms: BootOptionWiring["kms"];
     readonly databaseUrl: string;
+    readonly rowLevelSecurity: RowLevelSecurityMode;
     readonly redisUrl: string;
     readonly jwtSecret: string;
     readonly jwtSecretOrKeyring: ReturnType<typeof loadJwtSecretOrKeyring>;

package/dist/run-prod-app-config.js

@@ -2,6 +2,7 @@ import { EXT_SESSION_STORE } from "@cosmicdrift/kumiko-bundled-features/auth-fou
 import { SESSIONS_FEATURE } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { loadJwtSecretOrKeyring, TRUSTED_PROXY_HOPS_ENV } from "@cosmicdrift/kumiko-framework/api";
 import { createRegistry, } from "@cosmicdrift/kumiko-framework/engine";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { resolveBootCrypto } from "./boot/boot-crypto.js";
 import { composeAppFeatures, validateComposedFeatures, withEnvDefaults, } from "./boot/shared-boot-steps.js";
@@ -100,6 +101,7 @@ export async function resolveProdBootConfig(options, decryptedEnvSource, log, re
         envSource,
         bootKms,
         databaseUrl,
+        rowLevelSecurity: options.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE,
         redisUrl,
         jwtSecret,
         jwtSecretOrKeyring,
@@ -136,7 +138,7 @@ export function composeProdFeatures(options, config, log) {
     // auth-email-password via composeFeatures, using the same feature list as
     // runDevApp and the per-app schema generator. Build it before any connection
     // so boot mode can validate wiring without opening Postgres or Redis sockets.
-    const features = composeAppFeatures(options.features, bootOptionWiring.features, effectiveAuth);
+    const features = composeAppFeatures(options.features, bootOptionWiring.features, effectiveAuth, options.bundledLists);
     const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
     validateComposedFeatures(features, {
         env: envSource,