create-flowdular 0.6.0 → 0.6.1

package/template/default/platform/src/server/lifecycle.ts

@@ -0,0 +1,325 @@
+import process from 'node:process';
+import { randomUUID } from 'node:crypto';
+import type { EventEmitter } from 'node:events';
+import { BroadcastChannel } from 'node:worker_threads';
+import type { Middleware } from '@octanejs/app-core';
+import { serverLogger, trackResponseBody } from '@flowdular/sdk/server';
+
+export const PLATFORM_LIFECYCLE_SYMBOL = Symbol.for(
+	'flowdular.platform.runtime-lifecycle',
+);
+export const PLATFORM_LIFECYCLE_ACTIVATE_EVENT =
+	'flowdular:platform-runtime-activate';
+export const PLATFORM_LIFECYCLE_RETIRE_EVENT =
+	'flowdular:platform-runtime-retire';
+const PLATFORM_LIFECYCLE_CHANNEL = 'flowdular.platform.runtime-lifecycle';
+
+type Dispose = () => void | Promise<void>;
+
+export interface PlatformRuntimeLifecycle {
+	readonly middleware: Middleware;
+	/** Runs as soon as retirement begins, before the requests in flight drain:
+	    for a producer that holds a request open until it is told to stop. */
+	addInterrupt(interrupt: Dispose): void;
+	addQuiesce(quiesce: Dispose): void;
+	add(dispose: Dispose): void;
+	retire(): Promise<void>;
+}
+
+type ProcessWithLifecycle = NodeJS.Process & {
+	[PLATFORM_LIFECYCLE_SYMBOL]?: PlatformRuntimeLifecycle;
+};
+
+/* An event stream never finishes on its own. Its protocol has the client
+	reconnect and resume from Last-Event-ID, which reaches the next generation,
+	so retirement ends it instead of waiting for it. Any other body drains. */
+function isEventStream(response: Response): boolean {
+	const type = response.headers.get('content-type')?.split(';', 1)[0];
+	return type?.trim().toLowerCase() === 'text/event-stream';
+}
+
+/* EventSource stops reconnecting for good on any answer but a 200 event
+	stream, and a production server keeps listening while it retires. A stream
+	request to a retired generation gets an empty stream that ends at once, so
+	the client keeps reconnecting until the next process answers. */
+function retiredResponse(request: Request | undefined): Response {
+	if (
+		request?.method === 'GET' &&
+		request.headers.get('accept')?.includes('text/event-stream')
+	) {
+		return new Response('retry: 1000\n\n', {
+			headers: {
+				'content-type': 'text/event-stream; charset=utf-8',
+				'cache-control': 'no-store',
+			},
+		});
+	}
+	return new Response(null, {
+		status: 503,
+		headers: { 'retry-after': '1' },
+	});
+}
+
+/* Vite evaluates octane.config.ts again when one of its SSR dependencies is
+	invalidated. A generation owns every resource created by that evaluation.
+	Retirement interrupts what would hold a request open, waits for requests
+	already using the old route closures, then disposes its resources in
+	reverse composition order. */
+export function createPlatformRuntimeLifecycle(): PlatformRuntimeLifecycle {
+	const disposers: Dispose[] = [];
+	const quiescers: Dispose[] = [];
+	const interrupts = new Set<Dispose>();
+	let interrupted: Promise<unknown[]> = Promise.resolve([]);
+	let activeRequests = 0;
+	let retired = false;
+	let finishing = false;
+	let disposal: Promise<void> | undefined;
+	let resolveDisposal: (() => void) | undefined;
+	let rejectDisposal: ((error: unknown) => void) | undefined;
+
+	const finish = () => {
+		if (!retired || activeRequests !== 0 || disposal === undefined || finishing)
+			return;
+		finishing = true;
+		const currentQuiescers = quiescers.splice(0).reverse();
+		const current = disposers.splice(0).reverse();
+		void (async () => {
+			const failures = await interrupted;
+			/* Every background producer stops before any module repository closes. */
+			for (const quiesce of currentQuiescers) {
+				try {
+					await quiesce();
+				} catch (error) {
+					failures.push(error);
+				}
+			}
+			for (const dispose of current) {
+				try {
+					await dispose();
+				} catch (error) {
+					failures.push(error);
+				}
+			}
+			if (failures.length > 0) {
+				/* A logger reads the message, not the errors array, so each cause
+				   is named there rather than left for a debugger. */
+				rejectDisposal?.(
+					new AggregateError(
+						failures,
+						'Platform runtime teardown did not release every resource: ' +
+							failures
+								.map((failure) =>
+									failure instanceof Error ? failure.message : String(failure),
+								)
+								.join('; '),
+					),
+				);
+			} else {
+				resolveDisposal?.();
+			}
+		})();
+	};
+
+	const interrupt = async (): Promise<unknown[]> => {
+		const failures: unknown[] = [];
+		await Promise.all(
+			[...interrupts].map(async (run) => {
+				try {
+					await run();
+				} catch (error) {
+					failures.push(error);
+				}
+			}),
+		);
+		return failures;
+	};
+
+	const lifecycle: PlatformRuntimeLifecycle = {
+		middleware: async (context, next) => {
+			if (retired) return retiredResponse(context.request);
+			activeRequests += 1;
+			let endStream: (() => void) | undefined;
+			const release = () => {
+				if (endStream) interrupts.delete(endStream);
+				activeRequests -= 1;
+				finish();
+			};
+			try {
+				const response = await next();
+				const signal = context.request?.signal;
+				if (!isEventStream(response)) {
+					return trackResponseBody(response, release, signal);
+				}
+				const end = new AbortController();
+				endStream = () => end.abort(new Error('The platform runtime retired.'));
+				if (retired) endStream();
+				else interrupts.add(endStream);
+				return trackResponseBody(
+					response,
+					release,
+					signal ? AbortSignal.any([signal, end.signal]) : end.signal,
+				);
+			} catch (error) {
+				release();
+				throw error;
+			}
+		},
+		addInterrupt(run) {
+			if (retired) {
+				void Promise.resolve()
+					.then(run)
+					.catch((error: unknown) => {
+						serverLogger().error('late platform interrupt failed', {
+							module: 'platform',
+							err: error,
+						});
+					});
+				return;
+			}
+			interrupts.add(run);
+		},
+		addQuiesce(quiesce) {
+			if (retired) {
+				void Promise.resolve()
+					.then(quiesce)
+					.catch((error: unknown) => {
+						serverLogger().error('late platform quiesce failed', {
+							module: 'platform',
+							err: error,
+						});
+					});
+				return;
+			}
+			quiescers.push(quiesce);
+		},
+		add(dispose) {
+			if (retired) {
+				void Promise.resolve()
+					.then(dispose)
+					.catch((error: unknown) => {
+						serverLogger().error('late platform teardown failed', {
+							module: 'platform',
+							err: error,
+						});
+					});
+				return;
+			}
+			disposers.push(dispose);
+		},
+		retire() {
+			if (!disposal) {
+				disposal = new Promise<void>((resolve, reject) => {
+					resolveDisposal = resolve;
+					rejectDisposal = reject;
+				});
+				retired = true;
+				interrupted = interrupt();
+				finish();
+			}
+			return disposal;
+		},
+	};
+	return lifecycle;
+}
+
+/* Activation happens only after the new configuration composed successfully.
+	A failed HMR evaluation therefore tears down only its partial generation and
+	leaves the previous, still-routable generation alive. */
+export function activatePlatformRuntimeLifecycle(
+	lifecycle: PlatformRuntimeLifecycle,
+): Promise<void> {
+	const owner = process as ProcessWithLifecycle;
+	const events = process as unknown as EventEmitter;
+	const generationId = `${process.pid}:${randomUUID()}`;
+	const channel = new BroadcastChannel(PLATFORM_LIFECYCLE_CHANNEL);
+	channel.unref();
+	const previous = owner[PLATFORM_LIFECYCLE_SYMBOL];
+	owner[PLATFORM_LIFECYCLE_SYMBOL] = lifecycle;
+	/* Octane loads its config once through the Vite config loader and again
+	   through the SSR module runner. Their process wrappers do not share custom
+	   properties, but both delegate EventEmitter operations to the real process.
+	   The event is therefore the cross-runner ownership handoff. */
+	const onActivation = (
+		next: PlatformRuntimeLifecycle,
+		report?: (retirement: Promise<void>) => void,
+	) => {
+		if (next === lifecycle) return;
+		const retirement = lifecycle.retire();
+		report?.(retirement);
+		void retirement.catch((error: unknown) => {
+			serverLogger().error('stale platform teardown failed', {
+				module: 'platform',
+				err: error,
+			});
+		});
+	};
+	const onRetire = (report: (retirement: Promise<void>) => void) => {
+		report(lifecycle.retire());
+	};
+	channel.onmessage = (event) => {
+		if (!event.data || typeof event.data !== 'object') return;
+		const message = event.data as { type?: unknown; generationId?: unknown };
+		if (
+			message.type !== 'retire-all' &&
+			(message.type !== 'activate' || message.generationId === generationId)
+		) {
+			return;
+		}
+		/* Closing a BroadcastChannel from inside its own callback can wait for the
+		   callback to return. Start retirement in the next microtask so channel
+		   teardown cannot deadlock the generation it is releasing. */
+		queueMicrotask(() => {
+			void lifecycle.retire().catch((error: unknown) => {
+				serverLogger().error('cross-runner platform teardown failed', {
+					module: 'platform',
+					err: error,
+				});
+			});
+		});
+	};
+	events.on(PLATFORM_LIFECYCLE_ACTIVATE_EVENT, onActivation);
+	events.on(PLATFORM_LIFECYCLE_RETIRE_EVENT, onRetire);
+	lifecycle.add(() => {
+		channel.close();
+		events.off(PLATFORM_LIFECYCLE_ACTIVATE_EVENT, onActivation);
+		events.off(PLATFORM_LIFECYCLE_RETIRE_EVENT, onRetire);
+		if (owner[PLATFORM_LIFECYCLE_SYMBOL] === lifecycle) {
+			delete owner[PLATFORM_LIFECYCLE_SYMBOL];
+		}
+	});
+	const retirements = new Set<Promise<void>>();
+	events.emit(
+		PLATFORM_LIFECYCLE_ACTIVATE_EVENT,
+		lifecycle,
+		(retirement: Promise<void>) => retirements.add(retirement),
+	);
+	channel.postMessage({ type: 'activate', generationId });
+	if (previous && previous !== lifecycle) {
+		const retirement = previous.retire();
+		retirements.add(retirement);
+		void retirement.catch((error: unknown) => {
+			serverLogger().error('stale platform teardown failed', {
+				module: 'platform',
+				err: error,
+			});
+		});
+	}
+	return Promise.all(retirements).then(() => undefined);
+}
+
+/* Preparation may inspect durable state but must not create write handles,
+	 workers or timers. Only a fully prepared generation may retire the one that
+	 is currently serving requests. */
+export async function prepareAndActivatePlatformRuntimeLifecycle(
+	lifecycle: PlatformRuntimeLifecycle,
+	preparations: readonly (() => void | Promise<void>)[],
+): Promise<void> {
+	for (const prepare of preparations) await prepare();
+	await activatePlatformRuntimeLifecycle(lifecycle);
+}
+
+export function activePlatformRuntimeLifecycle():
+	| PlatformRuntimeLifecycle
+	| undefined {
+	return (process as ProcessWithLifecycle)[PLATFORM_LIFECYCLE_SYMBOL];
+}

package/template/default/platform/src/server/setup/modules.ts

@@ -1,10 +1,11 @@
-import { readdirSync, readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
 import {
 	DATABASE_CAPABILITY_IDS,
 	DATABASE_DIALECT_IDS,
 	type ModuleDatabaseRequirements,
 } from '@flowdular/sdk/database';
+import { findModuleManifests } from '@flowdular/sdk/kernel/module-manifests';
 import projectManifest from '../../../../flowdular.json';
 
 /**
@@ -27,9 +28,10 @@ export const PLATFORM_MODULE_DATABASE_REQUIREMENTS = Object.freeze({
 export interface EnabledDatabaseModules {
 	readonly modules: readonly ModuleDatabaseRequirements[];
 	/**
-	 * True when the module manifests could not be read, so every enabled module
-	 * is treated as owning tenant-scoped tables. Over-approximating keeps the
-	 * check strict; the review screen says the list came from this fallback.
+	 * True when a module manifest could not be read, so the enabled module it
+	 * belongs to is treated as owning tenant-scoped tables. Over-approximating
+	 * keeps the check strict; the review screen says the list came from this
+	 * fallback.
 	 */
 	readonly approximated: boolean;
 }
@@ -75,9 +77,10 @@ function requirements(
 
 /**
  * The enabled modules that own database tables, in `flowdular.json` order.
- * A container image ships only `platform/dist`, so the enabled list falls back
- * to the manifest bundled at build time and, without the module manifests
- * beside it, every enabled module is assumed to own tenant-scoped tables.
+ * Manifests are found where the CLI finds them, @flowdular/sdk included. A
+ * container image ships only `platform/dist`, so the enabled list falls back
+ * to the manifest bundled at build time and an enabled module whose manifest
+ * is not beside it is assumed to own tenant-scoped tables.
  */
 export function enabledDatabaseModules(
 	workspaceRoot: string,
@@ -87,37 +90,30 @@ export function enabledDatabaseModules(
 		(projectManifest as ProjectManifest);
 	const enabled = stringList(project.modules?.enabled);
 	if (enabled.length === 0) return { modules: [], approximated: false };
-	const roots = stringList(project.modules?.roots);
+	let paths: readonly string[] = [];
+	try {
+		paths = findModuleManifests(workspaceRoot, project.modules?.roots);
+	} catch {
+		/* Unreadable roots leave every module to the strict fallback below. */
+	}
 	const manifests = new Map<string, ModuleManifest>();
-	for (const root of roots.length > 0 ? roots : ['modules']) {
-		const directory = resolve(workspaceRoot, root);
-		let entries: readonly string[];
-		try {
-			entries = readdirSync(directory);
-		} catch {
-			continue;
+	for (const path of paths) {
+		const manifest = readJson<ModuleManifest>(path);
+		if (typeof manifest?.id === 'string') {
+			manifests.set(manifest.id, manifest);
 		}
-		for (const entry of entries) {
-			const manifest = readJson<ModuleManifest>(
-				join(directory, entry, 'module.json'),
-			);
-			if (typeof manifest?.id === 'string') {
-				manifests.set(manifest.id, manifest);
-			}
-		}
-	}
-	if (manifests.size === 0) {
-		return {
-			modules: enabled.map((moduleId) => requirements(moduleId, true)),
-			approximated: true,
-		};
 	}
 	const modules: ModuleDatabaseRequirements[] = [];
+	let approximated = false;
 	for (const moduleId of enabled) {
 		const manifest = manifests.get(moduleId);
-		if (!manifest) continue;
+		if (!manifest) {
+			modules.push(requirements(moduleId, true));
+			approximated = true;
+			continue;
+		}
 		if (!stringList(manifest.capabilities).includes('database')) continue;
 		modules.push(requirements(moduleId, manifest.tenancy === 'required'));
 	}
-	return { modules, approximated: false };
+	return { modules, approximated };
 }

package/template/default/platform/src/server/setup/page.ts

@@ -304,6 +304,42 @@ ${steps(view.step, view.databasePreconfigured)}${alerts(view)}
 const WORKSPACE_SLUG_INPUT_PATTERN =
 	'(?!.*--)[a-z0-9][a-z0-9\\-]{1,46}[a-z0-9]';
 
+/* What the address field keeps of typed or pasted text. Accented letters fold
+   to their base letter: NFD splits the accent off and the drop below removes
+   it, and the map covers letters that do not decompose. A short value and a
+   trailing hyphen pass, because typing goes through both; the pattern and the
+   server refuse them on submit. Every step reads left to right, one character
+   at a time, so filtering the text up to the end of an edit tells what that
+   edit may insert. The page ships this source and tests evaluate it. */
+export const WORKSPACE_SLUG_TYPING_FILTER = String.raw`(function(){var fold={'ł':'l','Ł':'l','ø':'o','Ø':'o','đ':'d','Đ':'d','ð':'d','Ð':'d','þ':'th','Þ':'th','æ':'ae','Æ':'ae','œ':'oe','Œ':'oe','ß':'ss','ẞ':'ss','ı':'i'};
+return function(value){return value.normalize('NFD').replace(/[^\x00-\x7f]/g,function(c){return fold[c]||c;}).toLowerCase().replace(/\s/g,'-').replace(/[^a-z0-9-]/g,'').replace(/-{2,}/g,'-').replace(/^-/,'').slice(0,48);};})()`;
+
+/* An insertion at the selection that the page may cancel is filtered before
+   the browser applies it and replayed as an editing command, so undo, redo,
+   the caret and maxlength only ever see filtered text; assigning the value
+   instead corrupts Chrome's undo history. A failed replay lets the raw edit
+   through for the pattern to refuse. Deletions pass untouched: they add no
+   character, and rewriting them would erase separators mid-edit. Composed
+   text is filtered once committed, in every engine. */
+const WORKSPACE_SLUG_TYPING = `
+(function(filter){var input=document.getElementById('setup-workspaceSlug');if(!input)return;
+function kept(start,end,text){var value=input.value,head=value.slice(0,start);
+var next=filter(head+text).slice(filter(head).length);
+return next.slice(-1)==='-'&&value.charAt(end)==='-'?next.slice(0,-1):next;}
+function insert(text){return document.execCommand(text?'insertText':'delete',false,text);}
+input.addEventListener('beforeinput',function(event){
+if(!event.cancelable||event.isComposing||!/^insert(Text|FromPaste|FromDrop)$/.test(event.inputType))return;
+var text=event.data!=null?event.data:event.dataTransfer?event.dataTransfer.getData('text/plain'):'';
+var next=kept(input.selectionStart,input.selectionEnd,text);
+if(next!==text&&(!next||insert(next)))event.preventDefault();});
+input.addEventListener('compositionend',function(event){
+var text=event.data||'',end=input.selectionStart,start=end-text.length;
+if(!text||start<0||input.value.slice(start,end)!==text)return;
+var next=kept(start,end,text);
+if(next!==text){input.setSelectionRange(start,end);insert(next);}});
+})(${WORKSPACE_SLUG_TYPING_FILTER});
+`;
+
 function workspaceField(
 	view: SetupPageView,
 	name: string,
@@ -394,7 +430,7 @@ ${
 </ul></div>
 <div><p class="setup-label setup-sublabel">Enabled modules that own tables</p><ul class="setup-list">${modules || '<li><span class="setup-help">No enabled module owns database tables.</span></li>'}</ul>${
 		view.modulesApproximated
-			? '<p class="setup-note setup-note--gap">This build ships without the module manifests, so every enabled module is checked against the strictest requirements any of them can ask for.</p>'
+			? '<p class="setup-note setup-note--gap">This build ships without some module manifests, so each enabled module without one is checked against the strictest requirements any module can ask for.</p>'
 			: ''
 	}</div>
 <form class="setup-form" method="post" action="/setup">${csrf(view)}
@@ -430,6 +466,17 @@ function environmentSection(result: EnvironmentWriteResult): string {
 	}.</p>`;
 }
 
+function ungrantedNotice(modules: readonly string[]): string {
+	if (modules.length === 0) return '';
+	const commands = modules
+		.map(
+			(id) =>
+				`<br><code>pnpm flowdular auth sync-scopes --module ${escapeHtml(id)} --apply</code>`,
+		)
+		.join('');
+	return `<p class="setup-alert setup-alert--warning" role="alert">The owner was not granted the permissions of ${escapeHtml(modules.join(', '))}. Run ${modules.length === 1 ? 'this command' : 'these commands'} with this deployment's database settings (stop the app first if it uses the embedded database), then sign in:${commands}</p>`;
+}
+
 function doneStep(view: SetupPageView): string {
 	const seed = view.seed;
 	const owner = seed?.accounts[0];
@@ -445,7 +492,7 @@ function doneStep(view: SetupPageView): string {
 				: 'Restart this deployment to leave setup and open the sign-in screen.';
 	return `<header><span class="setup-kicker">Sign in</span><h2>Flowdular is ready</h2>
 <p class="setup-card__sub">The workspace ${escapeHtml(seed?.workspace.name ?? '')} is ready. ${nextStep}</p></header>
-${steps(view.step, view.databasePreconfigured)}${alerts(view)}
+${steps(view.step, view.databasePreconfigured)}${alerts(view)}${ungrantedNotice(seed?.ungrantedModules ?? [])}
 <div><p class="setup-label setup-sublabel">Sign in as the workspace owner</p><div class="setup-credentials"><div><b>Owner account</b><code>${escapeHtml(owner?.email ?? view.values.ownerEmail ?? '')}</code></div></div>
 <p class="setup-note setup-note--gap">After signing in, you can connect an AI model in Providers. This is optional and can be done later.</p></div>
 ${view.environment ? environmentSection(view.environment) : ''}
@@ -459,6 +506,10 @@ export function renderSetupPage(view: SetupPageView, nonce: string): string {
 		view.step === 'Sign in' && view.autoRestart && view.csrfToken
 			? `<script nonce="${nonce}">fetch('/setup',{method:'POST',credentials:'same-origin',headers:{'content-type':'application/x-www-form-urlencoded'},body:new URLSearchParams({step:'restart',setupCsrf:'${view.csrfToken}'}),keepalive:true}).catch(()=>{});</script>`
 			: '';
+	const slugScript =
+		view.step === 'Workspace'
+			? `<script nonce="${nonce}">${WORKSPACE_SLUG_TYPING}</script>`
+			: '';
 	const body =
 		view.step === 'Unlock'
 			? unlockStep(view)
@@ -492,6 +543,6 @@ function sync(){for(var i=0;i<f.length;i++){var s=document.querySelector('fields
 if(s)s.hidden=!f[i].checked;}}
 for(var i=0;i<f.length;i++)f[i].addEventListener('change',sync);sync();})();
 </script>
-${restartScript}
+${slugScript}${restartScript}
 </body></html>`;
 }

package/template/default/platform/src/server/setup/routes.ts

@@ -191,6 +191,7 @@ function page(
 				`style-src 'nonce-${nonce}'`,
 				`script-src 'nonce-${nonce}'`,
 				"img-src 'self' data:",
+				"connect-src 'self'",
 				"form-action 'self'",
 				"base-uri 'none'",
 				"frame-ancestors 'none'",

package/template/default/platform/src/server/setup/seed.ts

@@ -3,6 +3,7 @@ import {
 	authRuntimeOptionsFromEnvironment,
 	createAuthRuntime,
 } from '@flowdular/sdk/modules/auth/server';
+import { readModuleCatalog } from '@flowdular/sdk/modules/system/server';
 /* First-run provisioning uses the same audited auth service as the operator
    CLI. The operator chooses the first owner; no demo credentials are shipped. */
 
@@ -26,6 +27,8 @@ export interface FirstRunOwner {
 export interface FirstRunSeed {
 	readonly workspace: { readonly name: string; readonly slug: string };
 	readonly accounts: readonly SeededAccount[];
+	/** Enabled modules whose permissions setup could not grant to the owner. */
+	readonly ungrantedModules: readonly string[];
 }
 
 export class SetupSeedError extends Error {
@@ -38,10 +41,19 @@ export class SetupSeedError extends Error {
 	}
 }
 
+/* A driver message can carry a host or a connection string, so only a code
+   from a fixed alphabet is logged, such as a SQLSTATE or an errno name. */
+function stableCode(error: unknown): string {
+	const code = (error as { code?: unknown } | null)?.code;
+	if (typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code)) return code;
+	return error instanceof Error ? error.name : 'unknown';
+}
+
 /**
- * Migrates auth.core, then creates the chosen workspace and its owner. The
- * database must still have no workspace, so a stale session cannot re-provision
- * an existing installation.
+ * Migrates auth.core, then creates the chosen workspace and its owner, and
+ * grants that owner the permissions the enabled modules declare. The database
+ * must still have no workspace, so a stale session cannot re-provision an
+ * existing installation.
  */
 export async function seedFirstRun(
 	databases: DatabaseProvider,
@@ -49,6 +61,9 @@ export async function seedFirstRun(
 	workspaceRoot: string,
 	owner: FirstRunOwner,
 ): Promise<FirstRunSeed> {
+	const enabled = readModuleCatalog(workspaceRoot).filter(
+		(entry) => entry.enabled,
+	);
 	const runtime = createAuthRuntime({
 		...authRuntimeOptionsFromEnvironment(environment, workspaceRoot),
 		databases,
@@ -72,6 +87,37 @@ export async function seedFirstRun(
 			password: owner.ownerPassword,
 			operator: FIRST_RUN_OPERATOR,
 		});
+		/* An application's own modules declare permissions the owner defaults
+		   cannot carry, and the grant module enable runs found no workspace
+		   before this one. The workspace is committed and first run is over, so
+		   a failed grant is reported with its repair command rather than failing
+		   a setup that cannot run again. */
+		const held = new Set(provisioned.owner.scopes);
+		const pending = enabled.filter((entry) =>
+			entry.permissions.some((permission) => !held.has(permission.id)),
+		);
+		let scopes = provisioned.owner.scopes;
+		let ungrantedModules: readonly string[] = [];
+		if (pending.length > 0) {
+			try {
+				const grants = await service.grantModuleScopes(
+					pending.flatMap((entry) =>
+						entry.permissions.map((permission) => permission.id),
+					),
+				);
+				scopes = [
+					...scopes,
+					...(grants.find(
+						(grant) => grant.accountId === provisioned.owner.accountId,
+					)?.granted ?? []),
+				];
+			} catch (error) {
+				ungrantedModules = pending.map((entry) => entry.id);
+				console.warn(
+					`First-run setup could not grant the owner the permissions of ${ungrantedModules.join(', ')} (${stableCode(error)}).`,
+				);
+			}
+		}
 		return {
 			workspace: {
 				name: provisioned.workspace.name,
@@ -82,9 +128,10 @@ export async function seedFirstRun(
 					email: provisioned.owner.email,
 					displayName: provisioned.owner.displayName,
 					role: provisioned.owner.role,
-					scopes: provisioned.owner.scopes,
+					scopes,
 				},
 			],
+			ungrantedModules,
 		};
 	} finally {
 		await runtime.dispose();