@cosmicdrift/kumiko-server-runtime 0.388.0 → 0.390.0

package/dist/run-prod-app-connections.d.ts

@@ -2,6 +2,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { createRedisCacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
 import { Redis } from "ioredis";
+import { type DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import type { RunProdAppOptions } from "./run-prod-app.ts";
 import type { ProdBootConfig, RegisterBootAbortCleanup } from "./run-prod-app-config.ts";
 export type ProdConnections = {
@@ -12,5 +13,5 @@ export type ProdConnections = {
     readonly redis: Redis;
     readonly cacheSync: ReturnType<typeof createRedisCacheSyncBus>;
 };
-export declare function connectProdDependencies(config: ProdBootConfig, log: Logger, registerAbortCleanup: RegisterBootAbortCleanup): Promise<ProdConnections>;
+export declare function connectProdDependencies(config: ProdBootConfig, log: Logger, registerAbortCleanup: RegisterBootAbortCleanup, databaseWait?: DatabaseWaitClock): Promise<ProdConnections>;
 export declare function assertProdSchemaCurrent(db: DbConnection, migrations: RunProdAppOptions["migrations"], log: Logger): Promise<void>;

package/dist/run-prod-app-connections.js

@@ -2,27 +2,31 @@ import { assertKumikoSchemaCurrent, SchemaDriftError, } from "@cosmicdrift/kumik
 import { createRedisCacheSyncBus, logRedisConnectionState, redisClientOptionsFromEnv, } from "@cosmicdrift/kumiko-framework/redis";
 import { Redis } from "ioredis";
 import { openDatabasePools, waitForKmsHealthy } from "./boot/shared-boot-steps.js";
-import { WAIT_FOR_DATABASE_DEADLINE_MS, waitForDatabase } from "./boot/wait-for-database.js";
+import { WAIT_FOR_DATABASE_DEADLINE_MS, waitForDatabase, } from "./boot/wait-for-database.js";
 // Postgres + Redis. The Redis client is shared by idempotency, event-dedup,
 // entity-cache, rate-limit; failing to construct here surfaces the misconfig
 // immediately. `new Redis(...)` connects eagerly, so this must stay AFTER the
 // boot-mode exit.
-export async function connectProdDependencies(config, log, registerAbortCleanup) {
-    const { bootKms, databaseUrl, redisUrl, envSource } = config;
+export async function connectProdDependencies(config, log, registerAbortCleanup, databaseWait) {
+    const { bootKms, databaseUrl, redisUrl, envSource, rowLevelSecurity } = config;
     // KMS health gate: an app configured for crypto-shredding must not boot
     // against an unreachable key store — a silent start would answer every
     // PII read with 503. Runs BEFORE connections so an abort leaks nothing.
-    const databaseWaitDeadline = Date.now() + WAIT_FOR_DATABASE_DEADLINE_MS;
+    const databaseWaitDeadline = (databaseWait?.now ?? Date.now)() + WAIT_FOR_DATABASE_DEADLINE_MS;
     if (bootKms.kms) {
-        await waitForKmsHealthy(bootKms.kms, "runProdApp", databaseWaitDeadline);
+        await waitForKmsHealthy(bootKms.kms, "runProdApp", databaseWaitDeadline, databaseWait);
     }
-    const pools = openDatabasePools(databaseUrl, envSource);
+    const pools = openDatabasePools(databaseUrl, envSource, rowLevelSecurity);
     const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
     registerAbortCleanup(pools.closeDb);
     registerAbortCleanup(pools.closeOutsideTransactionDb);
     registerAbortCleanup(() => redis.disconnect());
     logRedisConnectionState(redis, log);
-    await waitForDatabase(pools.db, { processName: "runProdApp", deadline: databaseWaitDeadline });
+    await waitForDatabase(pools.db, {
+        ...databaseWait,
+        processName: "runProdApp",
+        deadline: databaseWaitDeadline,
+    });
     // One bus per process: the tier resolver, the dispatcher and the file-provider
     // resolver all subscribe to it (invalidation across the API pods).
     const cacheSync = createRedisCacheSyncBus({

package/dist/run-prod-app-entrypoint.d.ts

@@ -10,5 +10,5 @@ export declare function buildProdEntrypointOptions(options: RunProdAppOptions, c
 export type ProdEntrypointOptions = ReturnType<typeof buildProdEntrypointOptions>;
 export declare function createProdEntrypoint(options: RunProdAppOptions, config: ProdBootConfig, composed: ProdComposedFeatures, connections: ProdConnections, entrypointOptions: ProdEntrypointOptions): ProdEntrypoint;
 export declare function registerProdShutdownHooks(entrypoint: ProdEntrypoint, cacheSync: ProdConnections["cacheSync"], ownedRedisSseBroker: ProdRequestContext["ownedRedisSseBroker"]): void;
-export declare function runProdWireHook(options: RunProdAppOptions, composed: ProdComposedFeatures, connections: ProdConnections, entrypoint: ProdEntrypoint): Promise<void>;
+export declare function runProdWireHook(options: RunProdAppOptions, config: ProdBootConfig, composed: ProdComposedFeatures, connections: ProdConnections, entrypoint: ProdEntrypoint): Promise<void>;
 export declare function startProdBackgroundWork(entrypoint: ProdEntrypoint, config: ProdBootConfig, composed: ProdComposedFeatures, connections: ProdConnections): Promise<void>;

package/dist/run-prod-app-entrypoint.js

@@ -1,9 +1,11 @@
 import { createAllInOneEntrypoint, createApiEntrypoint, } from "@cosmicdrift/kumiko-framework/entrypoint";
+import { appHookScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createMetricsForFactory } from "@cosmicdrift/kumiko-framework/observability";
 import { jobRunLoggerCallbacks } from "./boot/job-run-logger.js";
 import { startPiiEventBackfillOnBoot } from "./boot/pii-event-backfill-on-boot.js";
 import { recordAppStartedOnBoot } from "./boot/record-app-started-on-boot.js";
 import { makeDispatchSystemQuery, makeDispatchSystemWrite } from "./extra-routes-deps.js";
+import { makeFilesForTenant } from "./files-for-tenant.js";
 import { buildProdAuthRoutes } from "./run-prod-app-auth.js";
 function collectProdExtraRoutes(options, config, composed) {
     const bootExtraRoutes = config.bootOptionWiring.extraRoutes;
@@ -26,6 +28,7 @@ export function buildProdEntrypointOptions(options, config, composed, connection
             registry,
             ...requestContext.extraContext,
         },
+        rowLevelSecurity: config.rowLevelSecurity,
         sseBroker: requestContext.sseBroker,
         jwtSecret: config.jwtSecretOrKeyring,
         ...(jwtIssuer && { jwtIssuer }),
@@ -118,14 +121,15 @@ export function registerProdShutdownHooks(entrypoint, cacheSync, ownedRedisSseBr
 // runs. `wire` is the remaining escape-hatch for app-wired co-running
 // components that need the system-write dispatcher but don't declare a
 // route.
-export async function runProdWireHook(options, composed, connections, entrypoint) {
+export async function runProdWireHook(options, config, composed, connections, entrypoint) {
     const { wire } = options;
     if (wire) {
         const { bootCrypto } = composed;
         await wire({
-            db: connections.db,
+            db: appHookScopedRunner(connections.db, config.rowLevelSecurity),
             redis: connections.redis,
             registry: composed.registry,
+            filesForTenant: makeFilesForTenant(entrypoint.context),
             ...(bootCrypto.masterKeyProvider && { masterKeyProvider: bootCrypto.masterKeyProvider }),
             ...(bootCrypto.configCipher && { configEncryption: bootCrypto.configCipher }),
             metricsFor: createMetricsForFactory(entrypoint.observability.meter),

package/dist/run-prod-app-handle.js

@@ -1,3 +1,4 @@
+import { assertNoActiveRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/db";
 import { flushEscapeHatchAudits } from "@cosmicdrift/kumiko-framework/pipeline";
 import { installShutdownSignals } from "./boot-options/process-signals.js";
 import { buildBunServeOptions, resolveDerivedMaxRequestBodySize } from "./bun-serve-options.js";
@@ -45,7 +46,8 @@ export function createProdAppHandle(input) {
     const { options, config, composed, connections, entrypoint, log } = input;
     const { fetchHandler, cspScriptHashes } = input.fetch;
     // Upgrade rejections (401/403/426...) are ordinary responses and get the same headers as fetchHandler.
-    const securedUpgradeFetch = withSecurityHeaders(async (req, env) => stripNoRouteMatchHeader(await entrypoint.app.fetch(req, env)), options.securityHeaders, cspScriptHashes);
+    // Same read-only demo gate as fetchHandler: upgrade requests are GETs, but the socket then writes.
+    const securedUpgradeFetch = withSecurityHeaders(config.bootOptionWiring.wrapFetch(async (req, env) => stripNoRouteMatchHeader(await entrypoint.app.fetch(req, env))), options.securityHeaders, cspScriptHashes);
     const webSocketUpgradeFetch = async (req, env) => securedUpgradeFetch(req, env);
     let uninstallShutdownSignals;
     let uninstallFatalHandlers;
@@ -64,6 +66,7 @@ export function createProdAppHandle(input) {
                 throw new Error("[runProdApp] listen() requires Bun runtime (Bun.serve). " +
                     "Under Node/vitest pass `autoListen: false` and call the returned `fetch()` directly.");
             }
+            assertNoActiveRowLevelSecurityScope("prod app server");
             handle.server = Bun.serve(buildBunServeOptions(listenPort, fetchHandler, options.maxRequestBodySize ?? resolveDerivedMaxRequestBodySize(composed.registry), { upgradeFetch: webSocketUpgradeFetch }));
             // SIGTERM/SIGINT — graceful shutdown. Only registered when we
             // actually own a Bun-server, otherwise the test process picks up

package/dist/run-prod-app-request-context.js

@@ -2,6 +2,7 @@ import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-
 import { createDefaultSseBroker } from "@cosmicdrift/kumiko-framework/api";
 import { configureBlindIndexKey, configurePiiSubjectKms, } from "@cosmicdrift/kumiko-framework/crypto";
 import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { appHookScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createFallbackLogger, setProcessLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createEntityCache, createEventDedup, createIdempotencyGuard, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, } from "./run-prod-app-boot-context.js";
@@ -47,7 +48,13 @@ function buildProdExtraContext(options, config, composed, connections, deps) {
         ...(options.defaultLocale !== undefined && { defaultLocale: options.defaultLocale }),
     };
 }
-async function resolveProdAnonymousAccess(options, deps) {
+async function resolveProdAnonymousAccess(options, requestDeps, config) {
+    // extraContext services run inside requests and keep the ambient tenant scope; only this
+    // boot-time factory and the registry resolvers get the system scope.
+    const deps = {
+        ...requestDeps,
+        db: appHookScopedRunner(requestDeps.db, config.rowLevelSecurity),
+    };
     const baseAnonymousAccess = typeof options.anonymousAccess === "function"
         ? options.anonymousAccess(deps)
         : options.anonymousAccess;
@@ -90,7 +97,7 @@ export async function buildProdRequestContext(options, config, composed, connect
         ...(bootCrypto.configCipher && { configEncryption: bootCrypto.configCipher }),
     };
     const extraContext = buildProdExtraContext(options, config, composed, connections, deps);
-    const resolvedAnonymousAccess = await resolveProdAnonymousAccess(options, deps);
+    const resolvedAnonymousAccess = await resolveProdAnonymousAccess(options, deps, config);
     return {
         idempotency,
         eventDedup,

package/dist/run-prod-app-seeds.js

@@ -1,7 +1,9 @@
 import { withFileProviderResolver } from "@cosmicdrift/kumiko-framework/api";
 import { createEsOperationsTable, createSeedMigrationContext, runPendingSeedMigrations, } from "@cosmicdrift/kumiko-framework/es-ops";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createDispatcher, createUnlimitedRateLimitResolver, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { applyStandardBootSeeds } from "./boot/shared-boot-steps.js";
+import { runStreamTenantBackfillOnBoot } from "./boot/stream-tenant-backfill-on-boot.js";
 import { makeSeedCreateFileRef, withSeedErrorContext, } from "./seed-dispatcher.js";
 // Seeds are bootstrap writes, not tenant traffic: they always get the unlimited resolver,
 // even when the app has a real one, so a handler's rateLimit can neither fail nor drain them.
@@ -58,29 +60,42 @@ async function runSeedMigrations(run, seedsDir, seedDispatcher) {
 // preconditions. Config-seeds rely on a deterministic
 // aggregate-id so re-boot becomes a version_conflict skip.
 export async function runProdBootSeeds(run, entrypoint, dispatcherOptions) {
-    const { options, config, composed, connections } = run;
-    await applyStandardBootSeeds({
-        db: connections.db,
-        registry: composed.registry,
-        admin: composed.effectiveAuth?.admin,
-        shortcutSeeds: config.bootOptionWiring.shortcutSeeds,
-        cipher: composed.bootCrypto.configCipher,
+    return runInSystemRowLevelSecurityScope("boot seeds write rows for arbitrary tenants", async () => {
+        const { options, config, composed, connections } = run;
+        // First: custom seeds update tenants by version and would crash against unmigrated streams.
+        await runStreamTenantBackfillOnBoot({
+            db: connections.db,
+            registry: composed.registry,
+            extraContext: run.requestContext.extraContext,
+            processName: "runProdApp",
+            ...(options.search && { search: options.search }),
+            ...(options.databaseWait && { databaseWait: options.databaseWait }),
+        });
+        await applyStandardBootSeeds({
+            db: connections.db,
+            registry: composed.registry,
+            admin: composed.effectiveAuth?.admin,
+            shortcutSeeds: config.bootOptionWiring.shortcutSeeds,
+            cipher: composed.bootCrypto.configCipher,
+            processName: "runProdApp",
+            ...(options.databaseWait && { databaseWait: options.databaseWait }),
+        });
+        const hasSeeds = config.bootOptionWiring.customSeeds.length > 0 || options.seedsDir !== undefined;
+        const seedContext = hasSeeds ? buildSeedContext(run) : undefined;
+        const seedDispatcher = seedContext
+            ? withSeedErrorContext(createDispatcher(composed.registry, seedContext, {
+                ...dispatcherOptions,
+                lifecycle: entrypoint.lifecycleHooks,
+                ...(entrypoint.mode === "all-in-one" && { jobRunner: entrypoint.jobRunner }),
+            }))
+            : undefined;
+        if (seedDispatcher && seedContext) {
+            await runCustomSeeds(run, seedContext, seedDispatcher);
+        }
+        if (seedDispatcher &&
+            options.seedsDir !== undefined &&
+            config.envSource["KUMIKO_SKIP_ES_OPS"] !== "1") {
+            await runSeedMigrations(run, options.seedsDir, seedDispatcher);
+        }
     });
-    const hasSeeds = config.bootOptionWiring.customSeeds.length > 0 || options.seedsDir !== undefined;
-    const seedContext = hasSeeds ? buildSeedContext(run) : undefined;
-    const seedDispatcher = seedContext
-        ? withSeedErrorContext(createDispatcher(composed.registry, seedContext, {
-            ...dispatcherOptions,
-            lifecycle: entrypoint.lifecycleHooks,
-            ...(entrypoint.mode === "all-in-one" && { jobRunner: entrypoint.jobRunner }),
-        }))
-        : undefined;
-    if (seedDispatcher && seedContext) {
-        await runCustomSeeds(run, seedContext, seedDispatcher);
-    }
-    if (seedDispatcher &&
-        options.seedsDir !== undefined &&
-        config.envSource["KUMIKO_SKIP_ES_OPS"] !== "1") {
-        await runSeedMigrations(run, options.seedsDir, seedDispatcher);
-    }
 }

package/dist/run-prod-app-static-files.js

@@ -1,9 +1,10 @@
+import { existsSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { cachedResponse, computeStrongEtag, computeWeakEtag, createClientIpResolver, } from "@cosmicdrift/kumiko-framework/api";
 import { rankPreferredLocales } from "@cosmicdrift/kumiko-framework/i18n";
 import { resolveAndInjectPageHead } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import { errorCodeOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { ASSETS_DIR } from "./build-prod-bundle.js";
+import { ASSETS_DIR, collectBuildScriptHashes } from "./build-prod-bundle.js";
 import { BUNDLED_ASSETS_DIST_DIR } from "./bundled-assets.js";
 import { CSP_HASHES_FILE, parseCspHashes } from "./csp-hashes.js";
 import { buildRequestBoundSystemQuery, } from "./request-bound-system-query.js";
@@ -67,7 +68,14 @@ function usesDefaultCsp(securityHeaders) {
 export async function resolveHostDispatchScriptHashes(staticDir, securityHeaders, defaultCspHashes) {
     return usesDefaultCsp(securityHeaders) ? defaultCspHashes : readBuildScriptHashes(staticDir);
 }
+// Apps also write HTML into staticDir at boot (rendered landing pages), after kumiko build wrote
+// the file; staticDir is server-owned, so hashing what is on disk never trusts request data.
 export async function readBuildScriptHashes(staticDir) {
+    const fromFile = await readBuildHashesFile(staticDir);
+    const onDisk = existsSync(staticDir) ? collectBuildScriptHashes(staticDir).scriptSrc : [];
+    return [...new Set([...fromFile, ...onDisk])].sort();
+}
+async function readBuildHashesFile(staticDir) {
     const file = await readStaticFile(join(staticDir, CSP_HASHES_FILE));
     const result = file ? parseCspHashes(new TextDecoder().decode(file.bytes)) : undefined;
     if (result?.kind === "found")

package/dist/run-prod-app.d.ts

@@ -3,7 +3,8 @@ import type { AccountLockoutOptions, AccountUnlockOptions, AuthMailLocale, AuthP
 import type { SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import type { ExtraRouteDefinition, KumikoServeEnv, PostAuthLandingResolver, SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import type { FeatureDefinition, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import { type RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
+import type { BundledListsOptions, FeatureDefinition, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { AllInOneEntrypoint, ApiEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
@@ -12,6 +13,8 @@ import type { ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observ
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { PageHeadMeta, PageHeadResolver, PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import type { Redis } from "ioredis";
+import type { SearchBackendDeclaration } from "./boot/stream-tenant-backfill-on-boot.ts";
+import type { DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import type { BillingBootOption } from "./boot-options/billing-option.ts";
 import type { DemoModeOption } from "./boot-options/demo-mode.ts";
 import type { FileStorageBootOption } from "./boot-options/file-storage-option.ts";
@@ -29,7 +32,7 @@ export { parseRunMode } from "./boot/env-gate.ts";
 export { buildBunServeOptions } from "./bun-serve-options.ts";
 export { requireEnv } from "./require-env.ts";
 export { resolveUnsubscribeWiring, type UnsubscribeOption, } from "./resolve-unsubscribe-wiring.ts";
-export { addConfigAccessorFactory, buildBootExtraContext, type ConfigOverridesInput, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.ts";
+export { addConfigAccessorFactory, buildBootExtraContext, buildConfigOverrides, type ConfigOverridesInput, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.ts";
 export { staticCachePolicy } from "./run-prod-app-static-files.ts";
 /** Wrapper API for the password-reset flow.
  *
@@ -263,6 +266,15 @@ export type RunProdAppOptions = {
     readonly features: readonly FeatureDefinition[];
     /** Opt-in boot-validator warnings — see ValidateBootOptions. */
     readonly validateBootOptions?: ValidateBootOptions;
+    /** One table block for every list of the bundled features, see ComposeFeaturesOptions.bundledLists. */
+    readonly bundledLists?: BundledListsOptions;
+    /** Row level security mode of every connection; pass `appConfig.rowLevelSecurity`. Default "on". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+    /** `"none"`: the app has no search backend in any process (no `searchAdapter` in `extraContext`),
+     *  so no search docs can be orphaned and the stream-tenant backfill runs without a reindex. Unset:
+     *  a process without a search adapter defers the backfill of searchable entities to one that has
+     *  it. Combining `"none"` with a `searchAdapter` fails the boot. Must match the worker process. */
+    readonly search?: SearchBackendDeclaration;
     /** Listen-Port. Default 3000 (or $PORT). */
     readonly port?: number;
     /** Ceiling Bun.serve buffers a request body to before any app-level
@@ -339,16 +351,19 @@ export type RunProdAppOptions = {
     readonly defaultLocale?: string;
     readonly extraContext?: ExtraContextOption;
     /** MasterKeyProvider replacing the env KEK (`KUMIKO_SECRETS_MASTER_KEY_V<n>`)
-     *  for `ctx.secrets`, encrypted config keys and `encrypted: true` entity
+     *  for `ctx.services.secrets`, encrypted config keys and `encrypted: true` entity
      *  fields. Default: `createEnvMasterKeyProvider`. Use it for KMS backends
      *  (AWS/GCP/Azure); with it set, `KUMIKO_SECRETS_MASTER_KEY_V1` is not
      *  required in the env. */
     readonly masterKey?: MasterKeyProvider;
     /** Subject-key adapter for crypto-shredding (GDPR Art. 17). When set, it is
-     *  exposed to feature code as `ctx.kms`, and boot checks its health so the app
+     *  exposed to feature code as `ctx.services.kms`, and boot checks its health so the app
      *  cannot start against an unreachable KMS. Without an adapter,
      *  crypto-shredding remains disabled. */
     readonly kms?: KmsAdapter;
+    /** Replaces the real clock, sleep and log sink of the boot backoff for the database, KMS and
+     *  seed waits; tests use it to run the retry path without real waiting. */
+    readonly databaseWait?: DatabaseWaitClock;
     /** 32-byte base64 key for blind-index HMACs on `lookupable` fields
      *  (env: KUMIKO_BLIND_INDEX_KEY, `openssl rand -base64 32`). It is separate
      *  from PLATFORM_KEK and not part of the KmsAdapter contract. It is required

package/dist/run-prod-app.js

@@ -39,9 +39,11 @@
 //   same JWT_SECRET.
 //   PORT=3000
 //   KUMIKO_INSTANCE_ID=<stable per replica>
+import { assertRowLevelSecurityBootState, knownTablesOf, } from "@cosmicdrift/kumiko-framework/db";
 import { assertSeedModeNotInProduction } from "@cosmicdrift/kumiko-framework/event-store";
 import { runEnvGate } from "./boot/env-gate.js";
 import { buildEffectiveFeaturesResolver } from "./boot/shared-boot-steps.js";
+import { warnIfRowLevelSecurityOff } from "./boot/warn-row-level-security-off.js";
 import { installProcessLogger, uninstallProcessLogger } from "./process-logger.js";
 import { wireProdAuth } from "./run-prod-app-auth.js";
 import { composeProdFeatures, resolveProdBootConfig, runWithBootAbortCleanups, } from "./run-prod-app-config.js";
@@ -54,7 +56,7 @@ export { parseRunMode } from "./boot/env-gate.js";
 export { buildBunServeOptions } from "./bun-serve-options.js";
 export { requireEnv } from "./require-env.js";
 export { resolveUnsubscribeWiring, } from "./resolve-unsubscribe-wiring.js";
-export { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
+export { addConfigAccessorFactory, buildBootExtraContext, buildConfigOverrides, loggerFromExtraContext, resolveAuthMail, } from "./run-prod-app-boot-context.js";
 export { staticCachePolicy } from "./run-prod-app-static-files.js";
 // Returned from runProdApp when KUMIKO_DRY_RUN_ENV is set AND envSource
 // was passed (= test-mode). The handle is intentionally inert — listen()
@@ -119,7 +121,7 @@ async function bootProdApp(options, registerAbortCleanup) {
         }
         return makeDryRunHandle();
     }
-    const connections = await connectProdDependencies(config, log, registerAbortCleanup);
+    const connections = await connectProdDependencies(config, log, registerAbortCleanup, options.databaseWait);
     // Tier-composition auto-wire: if a feature carries a tenantTierResolver extension, the
     // resolver is built here, before the dispatcher exists. The app author only mounts
     // `createTierEngineFeature(opts)`; the framework does the wiring.
@@ -131,12 +133,14 @@ async function bootProdApp(options, registerAbortCleanup) {
         cacheSync: connections.cacheSync,
     });
     await assertProdSchemaCurrent(connections.db, options.migrations, log);
+    await assertRowLevelSecurityBootState(connections.db, config.rowLevelSecurity, knownTablesOf(features));
+    warnIfRowLevelSecurityOff(config.rowLevelSecurity, log);
     const requestContext = await buildProdRequestContext(options, config, composed, connections);
     const authWiring = await wireProdAuth(config, composed, connections);
     const entrypointOptions = buildProdEntrypointOptions(options, config, composed, connections, requestContext, authWiring, effectiveFeatures);
     const entrypoint = createProdEntrypoint(options, config, composed, connections, entrypointOptions);
     registerProdShutdownHooks(entrypoint, connections.cacheSync, requestContext.ownedRedisSseBroker);
-    await runProdWireHook(options, composed, connections, entrypoint);
+    await runProdWireHook(options, config, composed, connections, entrypoint);
     await runProdBootSeeds({ options, config, composed, connections, requestContext }, entrypoint, entrypointOptions.dispatcherOptions);
     await startProdBackgroundWork(entrypoint, config, composed, connections);
     const fetch = await buildProdFetchHandler(options, config, entrypoint);

package/dist/run-worker-app.d.ts

@@ -1,19 +1,22 @@
 import type { ServerOptions } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { FeatureDefinition, Registry, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import type { DbConnection, RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
+import type { BundledListsOptions, FeatureDefinition, Registry, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { WorkerEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
 import type { JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
 import { type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
 import type { MasterKeyProvider, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
+import { type SearchBackendDeclaration } from "./boot/stream-tenant-backfill-on-boot.ts";
+import type { DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import { type WorkerMetricsOptions, type WorkerMetricsServer } from "./boot/worker-metrics-server.ts";
 import type { BillingBootOption } from "./boot-options/billing-option.ts";
 import type { FileStorageBootOption } from "./boot-options/file-storage-option.ts";
 import type { KmsMode } from "./boot-options/kms-mode.ts";
 import type { MailBootOption } from "./boot-options/mail-option.ts";
 import { type SystemWireDeps } from "./extra-routes-deps.ts";
+import type { ConfigOverridesInput } from "./run-prod-app-boot-context.ts";
 export type WorkerContextOption = Record<string, unknown> | ((deps: WorkerDeps) => Record<string, unknown>);
 export type WorkerDeps = {
     readonly db: DbConnection;
@@ -27,18 +30,27 @@ export type WorkerDeps = {
  *  `lifecycle` for `registerShutdownHook`. */
 export type WorkerWireDeps = SystemWireDeps & {
     readonly lifecycle: WorkerEntrypoint["lifecycle"];
-    /** The worker's ctx.secrets — what `createInboundMailSupervisor` needs as
+    /** The worker's ctx.services.secrets — what `createInboundMailSupervisor` needs as
      *  `providerCtx.secrets` (the IMAP provider reads credentials through it,
      *  with `auditUserId` set to a system identity for the audit trail). Undefined
      *  when the secrets feature is not mounted or no master key is available. */
     readonly secrets?: SecretsContext;
 };
 export type RunWorkerAppOptions = {
+    /** Row level security mode of every connection; pass appConfig.rowLevelSecurity. Default "on". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+    /** `"none"`: the app has no search backend in any process (no `searchAdapter` in `extraContext`),
+     *  so no search docs can be orphaned and the stream-tenant backfill runs without a reindex. Unset:
+     *  a process without a search adapter defers the backfill of searchable entities to one that has
+     *  it. Combining `"none"` with a `searchAdapter` fails the boot. Must match the API process. */
+    readonly search?: SearchBackendDeclaration;
     /** App-specific features — same array as in the API/all-in-one process,
      *  so the registry + schema stay identical across processes. */
     readonly features: readonly FeatureDefinition[];
     /** Opt-in boot-validator warnings — see ValidateBootOptions. */
     readonly validateBootOptions?: ValidateBootOptions;
+    /** One table block for every list of the bundled features, see ComposeFeaturesOptions.bundledLists. Must match the API process. */
+    readonly bundledLists?: BundledListsOptions;
     /** Mount the auto-mixed config/user/tenant/auth-email-password features —
      *  MUST match the API process's `includeBundled` value, otherwise API
      *  and worker run with a diverging registry topology. Also controls
@@ -54,7 +66,7 @@ export type RunWorkerAppOptions = {
      *  RunProdAppOptions["extraContext"], without sseBroker (the worker
      *  has none — see entrypoint/index.ts's documented SSE limitation). */
     readonly extraContext?: WorkerContextOption;
-    /** MasterKeyProvider replacing the env KEK for ctx.secrets, encrypted
+    /** MasterKeyProvider replacing the env KEK for ctx.services.secrets, encrypted
      *  config keys and `encrypted: true` entity fields; with it set,
      *  `KUMIKO_SECRETS_MASTER_KEY_V1` is not required (see
      *  RunProdAppOptions["masterKey"]). */
@@ -62,6 +74,12 @@ export type RunWorkerAppOptions = {
     /** Subject-key adapter for crypto-shredding — boot checks health()
      *  before any connection (see RunProdAppOptions["kms"]). */
     readonly kms?: KmsAdapter;
+    /** App-level config values, same semantics and merge as RunProdAppOptions["appOverrides"];
+     *  the worker renders the mail layouts and must resolve the same branding as the API. */
+    readonly appOverrides?: ConfigOverridesInput;
+    /** Replaces the real clock, sleep and log sink of the boot backoff for the database and
+     *  KMS waits; tests use it to run the retry path without real waiting. */
+    readonly databaseWait?: DatabaseWaitClock;
     /** Blind-index key for lookupable fields (see
      *  RunProdAppOptions["blindIndexKey"]). */
     readonly blindIndexKey?: string;

package/dist/run-worker-app.js

@@ -15,18 +15,21 @@
 // Container/Coolify sets the same env vars as runProdApp:
 //   DATABASE_URL, REDIS_URL, JWT_SECRET — PORT is not needed.
 import { assertSeedModeNotInProduction } from "@cosmicdrift/kumiko-framework/event-store";
+import { appHookScopedRunner, DEFAULT_ROW_LEVEL_SECURITY_MODE, } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { scrubLogText } from "@cosmicdrift/kumiko-framework/logging";
 import { createMetricsForFactory, } from "@cosmicdrift/kumiko-framework/observability";
 import { logRedisConnectionState } from "@cosmicdrift/kumiko-framework/redis";
 import { runEnvGate } from "./boot/env-gate.js";
 import { startPiiEventBackfillOnBoot } from "./boot/pii-event-backfill-on-boot.js";
 import { recordAppStartedOnBoot } from "./boot/record-app-started-on-boot.js";
+import { runStreamTenantBackfillOnBoot, } from "./boot/stream-tenant-backfill-on-boot.js";
 import { bootWorkerProcess, resolveWorkerEnvSource, } from "./boot/worker-boot-core.js";
 import { startWorkerMetricsServer, } from "./boot/worker-metrics-server.js";
 import { resolveBootOptionWiring } from "./boot-options/resolve-boot-options.js";
 import { assertStackBootRequirements } from "./boot-options/stack-boot-requirements.js";
 import { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "./extra-routes-deps.js";
 import { installFatalErrorHandlers } from "./fatal-error-handlers.js";
+import { makeFilesForTenant } from "./files-for-tenant.js";
 import { installProcessLogger, uninstallProcessLogger } from "./process-logger.js";
 function makeBootModeHandle() {
     return {
@@ -48,6 +51,22 @@ async function resolveGatedEnvSource(options) {
 function assertWorkerStackRequirements(options) {
     assertStackBootRequirements({ features: options.features, ...(options.featureToggles && { featureToggles: true }) }, ["featureToggles"]);
 }
+function wireHookDb(db, options) {
+    return appHookScopedRunner(db, options.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE);
+}
+// Runs before the metrics port opens and before start() consumes jobs: a worker must not process
+// events of a feature whose streams still sit on the wrong tenant.
+async function backfillThenStartMetrics(boot, options) {
+    await runStreamTenantBackfillOnBoot({
+        db: boot.db,
+        registry: boot.registry,
+        extraContext: boot.extraContext,
+        processName: "runWorkerApp",
+        ...(options.search && { search: options.search }),
+        ...(options.databaseWait && { databaseWait: options.databaseWait }),
+    });
+    return options.metrics ? startWorkerMetricsServer(options.metrics, boot.entrypoint) : undefined;
+}
 export async function runWorkerApp(options) {
     assertSeedModeNotInProduction();
     const resolvedEnvSource = await resolveGatedEnvSource(options);
@@ -91,9 +110,7 @@ export async function runWorkerApp(options) {
     // hook, so a failing start() does not leak the listener.
     let metricsServer;
     try {
-        metricsServer = options.metrics
-            ? startWorkerMetricsServer(options.metrics, entrypoint)
-            : undefined;
+        metricsServer = await backfillThenStartMetrics(boot, options);
         await entrypoint.start();
     }
     catch (error) {
@@ -124,9 +141,10 @@ export async function runWorkerApp(options) {
     });
     if (options.wireComponents) {
         await options.wireComponents({
-            db,
+            db: wireHookDb(db, options),
             redis,
             registry,
+            filesForTenant: makeFilesForTenant(entrypoint.context),
             metricsFor: createMetricsForFactory(entrypoint.observability.meter),
             dispatchSystemWrite: makeDispatchSystemWrite(entrypoint.dispatcher),
             dispatchSystemQuery: makeDispatchSystemQuery(entrypoint.dispatcher),

package/dist/seed-dispatcher.js

@@ -7,7 +7,9 @@ export function makeSeedCreateFileRef(deps) {
     const fileResolver = context._fileProviderResolver;
     return (tenantId, input) => createFileRefFromBytes({
         db: createTenantDb({ db, tenantId }),
-        files: fileResolver ? createTenantFileContext(fileResolver, tenantId) : context.files,
+        services: {
+            files: fileResolver ? createTenantFileContext(fileResolver, tenantId) : context.files,
+        },
         registry,
         user: createSystemUser(tenantId),
     }, input);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.388.0",
+  "version": "0.390.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -70,6 +70,10 @@
       "types": "./dist/renderer-web-fonts.d.ts",
       "default": "./dist/renderer-web-fonts.js"
     },
+    "./resolve-installed-package": {
+      "types": "./dist/resolve-installed-package.d.ts",
+      "default": "./dist/resolve-installed-package.js"
+    },
     "./resolve-tailwind-cli": {
       "types": "./dist/resolve-tailwind-cli.d.ts",
       "default": "./dist/resolve-tailwind-cli.js"
@@ -92,18 +96,21 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.388.0",
-    "@cosmicdrift/kumiko-framework": "0.388.0",
-    "@cosmicdrift/kumiko-renderer": "0.388.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
-    "@cosmicdrift/kumiko-types": "0.388.0",
-    "bun-types": "^1.3.13",
+    "@cosmicdrift/kumiko-bundled-features": "0.390.0",
+    "@cosmicdrift/kumiko-framework": "0.390.0",
+    "@cosmicdrift/kumiko-renderer": "0.390.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.390.0",
+    "@cosmicdrift/kumiko-types": "0.390.0",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
   },
+  "peerDependencies": {
+    "bun-types": "^1.4.4"
+  },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.388.0"
+    "@cosmicdrift/kumiko-testing": "0.390.0",
+    "bun-types": "^1.4.4"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -161,6 +168,10 @@
         "types": "./dist/renderer-web-fonts.d.ts",
         "default": "./dist/renderer-web-fonts.js"
       },
+      "./resolve-installed-package": {
+        "types": "./dist/resolve-installed-package.d.ts",
+        "default": "./dist/resolve-installed-package.js"
+      },
       "./resolve-tailwind-cli": {
         "types": "./dist/resolve-tailwind-cli.d.ts",
         "default": "./dist/resolve-tailwind-cli.js"