@cosmicdrift/kumiko-server-runtime 0.410.0 → 0.411.0

package/dist/boot/shared-boot-steps.d.ts

@@ -22,6 +22,7 @@ export declare function buildEffectiveFeaturesResolver(deps: {
     readonly registry: Registry;
     readonly cacheSync: CacheSyncBus;
 }): Promise<EffectiveFeaturesResolver | undefined>;
+export declare const BOOT_SEEDS_LOCK_KEY = 1651729764;
 export declare function applyStandardBootSeeds(deps: {
     readonly db: DbConnection;
     readonly registry: Registry;

package/dist/boot/shared-boot-steps.js

@@ -5,7 +5,7 @@ import { AuthErrors, AuthHandlers, AuthQueries, } from "@cosmicdrift/kumiko-bund
 import { seedAdminGuarded, } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import { AuthMfaHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
-import { createDbConnection, dbConnectionOptionsFromEnv, outsideTransactionPoolOptionsFromEnv, serverTimeoutOptionsFromEnv, } from "@cosmicdrift/kumiko-framework/db";
+import { createDbConnection, dbConnectionOptionsFromEnv, outsideTransactionPoolOptionsFromEnv, serverTimeoutOptionsFromEnv, withSessionAdvisoryLock, } from "@cosmicdrift/kumiko-framework/db";
 import { collectWriteHandlerQns, findTierResolverUsage, requireTierResolverPlugin, validateAppCustomScreenWriteQns, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { buildComposeAuthOptions, composeFeatures, } from "../compose-features.js";
@@ -46,12 +46,16 @@ export async function buildEffectiveFeaturesResolver(deps) {
     const bound = await featureToggles.bind({ db, registry, cacheSync, tierResolver });
     return bound.resolver;
 }
+export const BOOT_SEEDS_LOCK_KEY = 0x62_73_65_64; // 'bsed'
 export async function applyStandardBootSeeds(deps) {
     const { db, registry, admin, shortcutSeeds, cipher, processName, databaseWait } = deps;
     let adminUserId;
     // Seeds are idempotent, so a transient connection error re-runs the whole sequence; any other
     // error stays fatal. Later boot steps build on the seeds, so this cannot continue in the background.
-    await waitUntilDatabaseReachable(async () => {
+    await waitUntilDatabaseReachable(
+    // Serialised across instances: seedUser is check-then-insert, so two booting replicas could
+    // otherwise both insert the same admin.
+    () => withSessionAdvisoryLock(db, BOOT_SEEDS_LOCK_KEY, async () => {
         if (admin) {
             // Operator-created account, not a self-registration: under emailVerificationMode "strict"
             // an unverified seed admin could never log in. `admin.emailVerified` still overrides.
@@ -66,7 +70,7 @@ export async function applyStandardBootSeeds(deps) {
             db,
             ...(cipher && { cipher }),
         });
-    }, { ...databaseWait, processName, target: "database (boot seeds)" });
+    }), { ...databaseWait, processName, target: "database (boot seeds)" });
     return adminUserId === undefined ? {} : { adminUserId };
 }
 const MFA_ROUTE_HANDLERS = {

package/dist/boot-options/option-env-schema.js

@@ -1,7 +1,7 @@
 import { smtpEnvSchema } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { kmsEnvSchema } from "@cosmicdrift/kumiko-bundled-features/crypto-shredding/env";
 import { createS3EnvSchema, s3EnvSchema, } from "@cosmicdrift/kumiko-bundled-features/file-provider-s3";
-import { demoAdminEnvSchema } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
+import { bootstrapAdminEnvSchema, demoAdminEnvSchema, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { subscriptionStripeEnvSchema } from "@cosmicdrift/kumiko-bundled-features/subscription-stripe";
 import { readKumikoMeta } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
@@ -31,17 +31,16 @@ function pickShape(shape, keys) {
     }
     return picked;
 }
-function sysadminTenantNeedsEnvId(seeds) {
-    const { sysadminFromEnv } = seeds;
-    return (typeof sysadminFromEnv === "object" &&
-        sysadminFromEnv.tenant !== undefined &&
-        sysadminFromEnv.tenant.id === undefined);
+function accountTenantNeedsEnvId(account) {
+    return (typeof account === "object" && account.tenant !== undefined && account.tenant.id === undefined);
 }
 function seedEnvBlock(seeds) {
     const keys = [];
     const required = [];
     const demoTenantNeedsEnvId = seeds.demoTenant !== undefined && seeds.demoTenant.id === undefined;
-    if (demoTenantNeedsEnvId || sysadminTenantNeedsEnvId(seeds)) {
+    if (demoTenantNeedsEnvId ||
+        accountTenantNeedsEnvId(seeds.sysadminFromEnv) ||
+        accountTenantNeedsEnvId(seeds.bootstrapAdminFromEnv)) {
         keys.push("DEMO_TENANT_ID");
         required.push("DEMO_TENANT_ID");
     }
@@ -53,9 +52,14 @@ function seedEnvBlock(seeds) {
         keys.push("DEMO_SYSADMIN_EMAIL", "DEMO_SYSADMIN_PASSWORD");
         required.push("DEMO_SYSADMIN_EMAIL", "DEMO_SYSADMIN_PASSWORD");
     }
-    if (keys.length === 0)
+    const bootstrapShape = seeds.bootstrapAdminFromEnv ? bootstrapAdminEnvSchema.shape : {};
+    if (keys.length === 0 && !seeds.bootstrapAdminFromEnv)
         return undefined;
-    return { source: "runProdApp.seeds", shape: pickShape(demoAdminEnvSchema.shape, keys), required };
+    return {
+        source: "runProdApp.seeds",
+        shape: { ...pickShape(demoAdminEnvSchema.shape, keys), ...bootstrapShape },
+        required,
+    };
 }
 function fileStorageEnvBlocks(fileStorage) {
     const blocks = [];

package/dist/boot-options/resolve-boot-options.d.ts

@@ -27,6 +27,7 @@ export type BootOptionFields = {
     readonly appOverrides?: object;
     readonly auth?: {
         readonly admin?: unknown;
+        readonly passwordReset?: unknown;
         readonly mail?: {
             readonly from?: string;
         };

package/dist/boot-options/resolve-boot-options.js

@@ -1,6 +1,7 @@
 import { BILLING_FOUNDATION_FEATURE } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { DELIVERY_FEATURE } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { FEATURE_TOGGLES_FEATURE } from "@cosmicdrift/kumiko-bundled-features/feature-toggles";
+import { BOOTSTRAP_ADMIN_EMAIL_ENV } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { SUBSCRIPTION_PADDLE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/subscription-paddle";
 import { SUBSCRIPTION_STRIPE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/subscription-stripe";
 import { TIER_ENGINE_FEATURE } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
@@ -43,8 +44,20 @@ function wireFeatureToggles(options, mounted) {
     }
     return undefined;
 }
-function warnAboutBootOptions(options) {
+function bootstrapAdminCannotSetPassword(options, envSource) {
+    const { seeds } = options;
+    return (seeds !== undefined &&
+        !isSeedFnList(seeds) &&
+        Boolean(seeds.bootstrapAdminFromEnv) &&
+        Boolean(envSource[BOOTSTRAP_ADMIN_EMAIL_ENV]) &&
+        options.auth?.passwordReset === undefined &&
+        options.auth?.mail === undefined);
+}
+function warnAboutBootOptions(options, envSource) {
     const bootWarnings = stackBootWarnings(options).map((line) => `stacks in \`features\` expect boot options that are not set:\n${line}`);
+    if (bootstrapAdminCannotSetPassword(options, envSource)) {
+        bootWarnings.push(`${BOOTSTRAP_ADMIN_EMAIL_ENV} is set but neither auth.passwordReset nor auth.mail is configured: the bootstrap admin has no password and could never set one.`);
+    }
     if (options.runSingleInstance === false &&
         (options.mail || options.fileStorage || options.featureToggles || options.appOverrides) &&
         options.workerMountsFeatures !== true) {
@@ -101,7 +114,7 @@ export async function resolveBootOptionWiring(options, envSource) {
     if (demoMode) {
         extraRoutes.push(buildDemoModeRoute(demoMode, envSource));
     }
-    warnAboutBootOptions(options);
+    warnAboutBootOptions(options, envSource);
     const seeds = options.seeds ?? [];
     const shortcutSeeds = isSeedFnList(seeds)
         ? []

package/dist/boot-options/seed-shortcuts.d.ts

@@ -20,6 +20,10 @@ type SeededAccountOptions = {
  *  - `sysadminFromEnv`: `DEMO_SYSADMIN_EMAIL` / `DEMO_SYSADMIN_PASSWORD`, global
  *    role `SystemAdmin`, email verified, member of `tenant` (default
  *    `demoTenant`) with role `User` (default).
+ *  - `bootstrapAdminFromEnv`: `KUMIKO_BOOTSTRAP_ADMIN_EMAIL` (no seed while unset) becomes an
+ *    admin WITHOUT a password in `tenant` (default `demoTenant`) with `Admin` + `TenantAdmin`
+ *    and the global role `SystemAdmin`; it sets its password via password reset. One-shot:
+ *    skipped when the account already has a password or the tenant already has another member.
  *  - `run`: free seed functions, same contract as the array form.
  *
  *  @example
@@ -36,6 +40,10 @@ export type ProdSeedsConfig = {
     readonly sysadminFromEnv?: boolean | (SeededAccountOptions & {
         readonly tenant?: ProdSeedTenant;
     });
+    readonly bootstrapAdminFromEnv?: boolean | (SeededAccountOptions & {
+        readonly tenant?: ProdSeedTenant;
+        readonly globalRoles?: readonly string[];
+    });
     readonly run?: readonly ProdSeedFn[];
 };
 export type DbSeedFn = (db: DbConnection) => Promise<void>;

package/dist/boot-options/seed-shortcuts.js

@@ -1,4 +1,5 @@
-import { seedAdminGuarded, seedTenant, } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
+import { seedAdminGuarded, seedBootstrapAdmin, seedTenant, } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
+import { BOOTSTRAP_ADMIN_EMAIL_ENV } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { parseTenantId } from "@cosmicdrift/kumiko-types/identifiers";
 const DEFAULT_DEMO_ADMIN_ROLES = ["Admin", ROLES.TenantAdmin];
@@ -65,12 +66,36 @@ function buildSysadminSeed(value, demoTenant, envSource) {
         memberships: [membershipOf(tenant, options.roles ?? DEFAULT_SYSADMIN_TENANT_ROLES)],
     });
 }
+function buildBootstrapAdminSeed(value, demoTenant, envSource) {
+    const options = typeof value === "object" ? value : {};
+    const tenant = options.tenant
+        ? resolveTenant(options.tenant, envSource, "bootstrapAdminFromEnv.tenant")
+        : demoTenant;
+    if (!tenant) {
+        throw new Error("[runProdApp] seeds.bootstrapAdminFromEnv needs seeds.demoTenant or bootstrapAdminFromEnv.tenant for its membership.");
+    }
+    const email = envSource[BOOTSTRAP_ADMIN_EMAIL_ENV];
+    if (!email)
+        return undefined;
+    const admin = {
+        email,
+        displayName: options.displayName ?? "Admin",
+        globalRoles: options.globalRoles ?? [ROLES.SystemAdmin],
+        emailVerified: options.emailVerified ?? true,
+        memberships: [membershipOf(tenant, options.roles ?? DEFAULT_DEMO_ADMIN_ROLES)],
+    };
+    return async (db) => {
+        await seedBootstrapAdmin(db, admin);
+    };
+}
 /** Validates env and options at boot (before any connection) and returns the
  *  seeds to run once the database is up. */
 export function resolveSeedShortcuts(seeds, deps) {
-    const wantsAccounts = Boolean(seeds.demoAdminFromEnv) || Boolean(seeds.sysadminFromEnv);
+    const wantsAccounts = Boolean(seeds.demoAdminFromEnv) ||
+        Boolean(seeds.sysadminFromEnv) ||
+        Boolean(seeds.bootstrapAdminFromEnv);
     if ((wantsAccounts || seeds.demoTenant) && !deps.hasAuth) {
-        throw new Error("[runProdApp] seeds.demoTenant / demoAdminFromEnv / sysadminFromEnv need `auth` (user, tenant and auth-email-password features).");
+        throw new Error("[runProdApp] seeds.demoTenant / demoAdminFromEnv / sysadminFromEnv / bootstrapAdminFromEnv need `auth` (user, tenant and auth-email-password features).");
     }
     if (seeds.demoAdminFromEnv && deps.hasAuthAdmin) {
         throw new Error("[runProdApp] seeds.demoAdminFromEnv and auth.admin both seed the admin — keep one.");
@@ -90,5 +115,10 @@ export function resolveSeedShortcuts(seeds, deps) {
     if (seeds.sysadminFromEnv) {
         result.push(buildSysadminSeed(seeds.sysadminFromEnv, demoTenant, deps.envSource));
     }
+    if (seeds.bootstrapAdminFromEnv) {
+        const bootstrapSeed = buildBootstrapAdminSeed(seeds.bootstrapAdminFromEnv, demoTenant, deps.envSource);
+        if (bootstrapSeed)
+            result.push(bootstrapSeed);
+    }
     return result;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.410.0",
+  "version": "0.411.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -96,11 +96,11 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.410.0",
-    "@cosmicdrift/kumiko-framework": "0.410.0",
-    "@cosmicdrift/kumiko-renderer": "0.410.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.410.0",
-    "@cosmicdrift/kumiko-types": "0.410.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.411.0",
+    "@cosmicdrift/kumiko-framework": "0.411.0",
+    "@cosmicdrift/kumiko-renderer": "0.411.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.411.0",
+    "@cosmicdrift/kumiko-types": "0.411.0",
     "ioredis": "^5.11.1",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.6.7"
@@ -109,7 +109,7 @@
     "bun-types": "^1.4.4"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.410.0",
+    "@cosmicdrift/kumiko-testing": "0.411.0",
     "bun-types": "^1.4.4"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.411.0",
+    "type": "improvement",
+    "title": "seeds.bootstrapAdminFromEnv creates the app creator as admin",
+    "detail": "`runProdApp({ seeds: { bootstrapAdminFromEnv: true | { tenant, displayName, roles, globalRoles, emailVerified } } })` reads `KUMIKO_BOOTSTRAP_ADMIN_EMAIL` (optional, validated as an email in the env schema) and idempotently creates that account without a password, with the Admin and TenantAdmin roles in the tenant (`seeds.demoTenant` or the option's `tenant`), the SystemAdmin global role and a verified email. An empty variable seeds nothing. An existing account that already has a password (for example a self-registration with the same email) is left untouched: no verification, no membership, no role change; boot logs one warning without the email. It works next to `auth.admin`. Boot warns when the variable is set but neither `auth.passwordReset` nor `auth.mail` is configured, because the admin could never set a password."
+  },
+  {
+    "version": "0.411.0",
+    "type": "fix",
+    "title": "Boot seeds run under an advisory lock",
+    "detail": "`applyStandardBootSeeds` holds a session advisory lock (`BOOT_SEEDS_LOCK_KEY`) while it seeds, for `runProdApp` and `runDevApp` alike. Two pods starting at the same time no longer race on add-only seeds such as the demo admin. The lock takes one pooled connection while the seeds run."
+  },
   {
     "version": "0.409.0",
     "type": "improvement",