@cosmicdrift/kumiko-bundled-features 0.165.2 → 0.165.3

package/src/data-retention/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.116.0",
+    "type": "improvement",
+    "title": "data-retention cleanup now implements the `anonymize` strategy (per-field anonymize funct…",
+    "detail": "data-retention cleanup now implements the `anonymize` strategy (per-field anonymize functions applied via the event-store executor, idempotent — a re-run appends zero events) and completes `blockDelete`: rows stay untouched during the keepFor legal hold, after expiry the anonymize functions run (row stays, person link goes). `RunRetentionCleanupResult.anonymizeDeferred` is replaced by `anonymized: number`; entities with an anonymize/blockDelete policy but no anonymize-annotated fields are reported in `skipped` with reason `missing_anonymize_fields`."
+  }
+]

package/src/delivery/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.120.0",
+    "type": "improvement",
+    "title": "PII on custom-event payloads (#799).",
+    "detail": "PII on custom-event payloads (#799). `r.defineEvent(name, schema, { piiFields: { recipientAddress: { subjectField: \"recipientId\" } } })` declares payload fields that are encrypted under the owning user's DEK (crypto-shredding). Enforcement lives in the low-level event-store `append()` — the single write funnel — so `ctx.appendEvent`, MSP-apply AND out-of-dispatcher writers (delivery attempt-log, jobs run-logger) are all covered; the stored event and the returned echo carry ciphertext, keeping inline projections and rebuilds identical. A null subject field (system cron runs, recipient-less attempts) stays plaintext — there is no user key to shred. Misconfigured `piiFields` (unknown field/subjectField) throw at feature-definition time. Bundled features annotated: `delivery:event:attempt`.`recipientAddress` (subject = recipientId) and `jobs` `run-started`.`payload` (subject = triggeredById); the pseudonymous fk ids stay plaintext. `delivery log.query` and `jobs list/details` decrypt for display — a forgotten subject shows `[[erased]]`. This makes the events-only aggregates from #797 Art.-17-capable: user-forget erases the DEK, historical delivery addresses and job payloads become unreadable without touching the append-only stream. New exports: `encryptPiiValueForSubject`, `configureEventPiiCatalog`/`configuredEventPiiCatalog`/`encryptEventPayloadPii` (framework/crypto)."
+  }
+]

package/src/document-ingest-foundation/changes.json

@@ -0,0 +1 @@
+[]

package/src/feature-toggles/changes.json

@@ -0,0 +1,26 @@
+[
+  {
+    "version": "0.165.0",
+    "type": "fix",
+    "title": "compose-tier-resolver: fixed requires-cascade",
+    "detail": "Tier resolver now correctly handles the requires-cascade and marks non-toggleable features properly."
+  },
+  {
+    "version": "0.163.0",
+    "type": "fix",
+    "title": "feature-toggles: register `store_global_feature_state` via `r.storeTable()` (exported as …",
+    "detail": "feature-toggles: register `store_global_feature_state` via `r.storeTable()` (exported as `globalFeatureStateTableMeta`). Previously the table was only a plain Drizzle export with no store-table meta, so `collectTableMetas(FEATURES)` never saw it — `kumiko schema generate` reported no changes for any app mounting `createFeatureTogglesFeature()`, and the table was missing in any DB that wasn't manually provisioned (e.g. via `unsafePushTables` in tests). `setupTestStack` now auto-provisions the table like every other `r.storeTable()` feature."
+  },
+  {
+    "version": "0.163.0",
+    "type": "fix",
+    "title": "feature-toggles: fix `composeTierResolverWithGlobalToggles` to actually grant tier-unawar…",
+    "detail": "feature-toggles: fix `composeTierResolverWithGlobalToggles` to actually grant tier-unaware toggleable features. The previous version only ever narrowed the tier resolver's own set — a toggleable feature that no tier's `features` list mentions at all (e.g. a pure operator kill-switch like a self-registration toggle, never differentiated by plan) could never appear, regardless of its declared default or an explicit `true` override, because narrowing can only remove names, never add ones the tier never granted. Now takes a third `registry` argument and unions in `computeEffectiveFeatures`' normal cascade for every feature name absent from `tierResolver(SYSTEM_TENANT_ID)` (the tier-managed set) — tier-managed toggleables keep the narrow-only semantics from before, tier-unaware ones are governed purely by their own default/override. - @cosmicdrift/kumiko-framework@0.163.0 - @cosmicdrift/kumiko-headless@0.163.0 - @cosmicdrift/kumiko-renderer@0.163.0 - @cosmicdrift/kumiko-dispatcher-live@0.163.0 - @cosmicdrift/kumiko-renderer-web@0.163.0"
+  },
+  {
+    "version": "0.162.0",
+    "type": "improvement",
+    "title": "feature-toggles: add `composeTierResolverWithGlobalToggles` to combine a tier-engine `ten…",
+    "detail": "feature-toggles: add `composeTierResolverWithGlobalToggles` to combine a tier-engine `tenantTierResolver` with a global `GlobalFeatureToggleRuntime` into a single `effectiveFeatures` resolver. Apps running both tier-engine (per-tenant feature cuts) and feature-toggles (global operator switches, e.g. a runtime kill-switch not tied to any tier) previously had no way to compose them — the framework only auto-wires one `tenantTierResolver` plugin. The global layer only narrows what the tier grants (an explicit `enabled:false` row removes a feature; no row or `true` leaves the tier's grant untouched) — it never falls back to a toggleable feature's own default, which would otherwise silently disable every tier-gated toggleable feature the moment feature-toggles gets composed in. Also adds `GlobalFeatureToggleRuntime.readOverride(name)` for the raw per-feature override, bypassing the requires() cascade."
+  }
+]

package/src/file-foundation/changes.json

@@ -0,0 +1 @@
+[]

package/src/file-provider-inmemory/changes.json

@@ -0,0 +1 @@
+[]

package/src/file-provider-s3/changes.json

@@ -0,0 +1 @@
+[]

package/src/file-provider-s3-env/changes.json

@@ -0,0 +1 @@
+[]

package/src/files/changes.json

@@ -0,0 +1 @@
+[]

package/src/files-provider-s3/changes.json

@@ -0,0 +1 @@
+[]

package/src/folders/changes.json

@@ -0,0 +1 @@
+[]

package/src/folders-user-data/changes.json

@@ -0,0 +1 @@
+[]

package/src/foundation-shared/changes.json

@@ -0,0 +1 @@
+[]

package/src/inbound-mail-foundation/__tests__/watch-supervisor.integration.test.ts

@@ -228,8 +228,10 @@ describe("watch-supervisor — error semantics", () => {
     const supervisor = createSupervisor();
     try {
       await supervisor.start();
-      await waitFor(() => {
+      await waitFor(async () => {
         expect(isWatching(accountId)).toBe(true);
+        const accounts = await selectMany(db, mailAccountsProjectionTable, { id: accountId });
+        expect(accounts[0]?.["watchState"]).toBe("watching");
       });
 
       emitWatchError(accountId, new InboundAuthError("token revoked"));

package/src/inbound-mail-foundation/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.150.0",
+    "type": "fix",
+    "title": "`@cosmicdrift/kumiko-framework/engine` bekommt `ctx.tryAppendEvent` — ein savepoint-scope…",
+    "detail": "`@cosmicdrift/kumiko-framework/engine` bekommt `ctx.tryAppendEvent` — ein savepoint-scoped Gegenstück zu `ctx.unsafeAppendEvent`, das `VersionConflictError` als `{ ok: false, conflict }` zurückgibt statt zu werfen, ohne die restliche Handler-Transaktion zu poisonen (Bun.SQL/ postgres.js brechen den gesamten `begin()` bei einem ungefangenen Statement- Fehler ab, SQLSTATE 25P02, selbst wenn der JS-Error gefangen wird — `tryAppendEvent` läuft dafür in einem echten `SAVEPOINT`). `@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation`: der `ingest-message`-Handler nutzt `ctx.tryAppendEvent` für den Message-Append — zwei parallele Ingest-Aufrufe für dieselbe `providerMessageId` (Watch-Push vs. Poll-Reconciliation-Überschneidung) liefern jetzt beide `{ duplicate: scheitert (#1038, Finding aus PR-Review #952). - @cosmicdrift/kumiko-framework@0.150.0 - @cosmicdrift/kumiko-headless@0.150.0 - @cosmicdrift/kumiko-renderer@0.150.0 - @cosmicdrift/kumiko-dispatcher-live@0.150.0 - @cosmicdrift/kumiko-renderer-web@0.150.0"
+  }
+]

package/src/inbound-mail-foundation/watch-supervisor.ts

@@ -407,7 +407,9 @@ export function createInboundMailSupervisor(
       }
       state.stop = stop;
       state.backoffMs = backoffInitialMs;
-      void markAccount(account, { watchState: "watching" }, "watch_supervisor");
+      // Await — fire-and-forget raced with a later auth_error mark under
+      // try-first waitFor (isWatching true before projection settled).
+      await markAccount(account, { watchState: "watching" }, "watch_supervisor");
     } catch (err) {
       const keepRunning = await handleSyncError(account, err);
       if (keepRunning) scheduleRestart(err);

package/src/inbound-provider-imap/changes.json

@@ -0,0 +1 @@
+[]

package/src/inbound-provider-inmemory/changes.json

@@ -0,0 +1 @@
+[]

package/src/jobs/__tests__/jobs-catalog.integration.test.ts

@@ -0,0 +1,159 @@
+// Catalog + trigger hardening for #1602 — manual-only surface.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { buildServer, type JwtHelper } from "@cosmicdrift/kumiko-framework/api";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createRegistry,
+  defineFeature,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { createJobRunner, type JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
+import {
+  createTestDb,
+  createTestRedis,
+  type TestDb,
+  type TestRedis,
+  TestUsers,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import type { Hono } from "hono";
+import { z } from "zod";
+import { JobErrors, JobHandlers, JobQueries } from "../constants";
+import { createJobsFeature } from "../feature";
+import { createJobRunLogger } from "../job-run-logger";
+import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
+
+let testDb: TestDb;
+let testRedis: TestRedis;
+let db: DbConnection;
+let app: Hono;
+let jwt: JwtHelper;
+let jobRunner: JobRunner;
+
+const systemAdmin = TestUsers.systemAdmin;
+const JWT_SECRET = "test-jwt-secret-for-jobs-catalog-32chars!!";
+
+const appFeature = defineFeature("catalog-app", (r) => {
+  r.job(
+    "manualEcho",
+    { trigger: { manual: true }, schema: z.object({ entity: z.string().min(1) }) },
+    async () => {},
+  );
+  r.job("cronOnly", { trigger: { cron: "0 * * * *" } }, async () => {});
+});
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  testRedis = await createTestRedis();
+  db = testDb.db;
+
+  const registry = createRegistry([appFeature, createJobsFeature()]);
+  await unsafePushTables(db, { jobRunsTable, jobRunLogsTable });
+  await createEventsTable(db);
+
+  const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
+  const logger = createJobRunLogger({ db, registry });
+  jobRunner = createJobRunner({
+    registry,
+    context: { db },
+    redisUrl,
+    consumerLane: "worker",
+    queueNamePrefix: `kumiko-jobs-catalog-test-${Date.now()}`,
+    ...logger,
+  });
+  const context = { db, registry, jobRunner };
+  const server = buildServer({ registry, context, jwtSecret: JWT_SECRET });
+  app = server.app;
+  jwt = server.jwt;
+
+  await jobRunner.start();
+});
+
+afterAll(async () => {
+  await jobRunner.stop();
+  await testDb.cleanup();
+  await testRedis.cleanup();
+});
+
+async function req(
+  method: string,
+  path: string,
+  user: SessionUser,
+  body?: unknown,
+): Promise<Response> {
+  const token = await jwt.sign(user);
+  const init: RequestInit = {
+    method,
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+  };
+  if (body) init.body = JSON.stringify(body);
+  return app.request(path, init);
+}
+
+async function write(user: SessionUser, type: string, payload: unknown) {
+  const res = await req("POST", "/api/write", user, { type, payload });
+  return res.json();
+}
+
+async function query(user: SessionUser, type: string, payload: unknown) {
+  const res = await req("POST", "/api/query", user, { type, payload });
+  const body = await res.json();
+  if (res.status !== 200) {
+    throw new Error(`query ${type} → ${res.status}: ${JSON.stringify(body)}`);
+  }
+  return body;
+}
+
+describe("jobs:query:catalog", () => {
+  test("lists only manual jobs including framework builtins", async () => {
+    const result = await query(systemAdmin, JobQueries.catalog, {});
+    type CatalogRow = {
+      readonly jobName: string;
+      readonly perTenant: boolean;
+      readonly payloadSchema: Record<string, unknown> | null;
+    };
+    const rows = (result.data as { rows: readonly CatalogRow[] }).rows;
+    const names = rows.map((r) => r.jobName);
+    expect(names).toContain("catalog-app:job:manual-echo");
+    expect(names).toContain("jobs:job:reindex-entity");
+    expect(names).toContain("jobs:job:projection-rebuild");
+    expect(names).not.toContain("catalog-app:job:cron-only");
+
+    const echo = rows.find((r) => r.jobName === "catalog-app:job:manual-echo");
+    expect(echo).toBeDefined();
+    expect(echo?.payloadSchema).not.toBeNull();
+
+    const reindex = rows.find((r) => r.jobName === "jobs:job:reindex-entity");
+    expect(reindex?.perTenant).toBe(true);
+  });
+});
+
+describe("jobs:write:trigger hardening", () => {
+  test("rejects cron-only jobs", async () => {
+    const result = await write(systemAdmin, JobHandlers.trigger, {
+      jobName: "catalog-app:job:cron-only",
+    });
+    expect(result.isSuccess).toBe(false);
+    expect(result.error?.code).toBe("unprocessable");
+    expect(result.error?.details).toMatchObject({ reason: JobErrors.notManual });
+  });
+
+  test("rejects invalid payload against job schema", async () => {
+    const result = await write(systemAdmin, JobHandlers.trigger, {
+      jobName: "catalog-app:job:manual-echo",
+      payload: {},
+    });
+    expect(result.isSuccess).toBe(false);
+    expect(result.error?.code).toBe("validation_error");
+  });
+
+  test("accepts valid schema payload", async () => {
+    const result = await write(systemAdmin, JobHandlers.trigger, {
+      jobName: "catalog-app:job:manual-echo",
+      payload: { entity: "credit" },
+    });
+    expect(result.isSuccess).toBe(true);
+  });
+});

package/src/jobs/__tests__/jobs-screens.boot.test.ts

@@ -30,6 +30,7 @@ describe("jobs screens + handler access alignment", () => {
     const roles = [...SYSTEM_ADMIN_ROLES];
     expect(rolesOf(jobs.queryHandlers["list"]?.access)).toEqual(roles);
     expect(rolesOf(jobs.queryHandlers["details"]?.access)).toEqual(roles);
+    expect(rolesOf(jobs.queryHandlers["catalog"]?.access)).toEqual(roles);
     expect(rolesOf(jobs.writeHandlers["trigger"]?.access)).toEqual(roles);
     expect(rolesOf(jobs.writeHandlers["retry"]?.access)).toEqual(roles);
   });

package/src/jobs/__tests__/jobs-security.integration.test.ts

@@ -45,10 +45,11 @@ afterAll(async () => {
 });
 
 describe("access matrix: jobs operator surface is SystemAdmin-only", () => {
-  test("list, detail, trigger, retry handlers share SystemAdmin", () => {
+  test("list, detail, catalog, trigger, retry handlers share SystemAdmin", () => {
     const roles = [...SYSTEM_ADMIN_ROLES];
     expect(rolesOf(stack.registry.getQueryHandler(JobQueries.list)?.access)).toEqual(roles);
     expect(rolesOf(stack.registry.getQueryHandler(JobQueries.details)?.access)).toEqual(roles);
+    expect(rolesOf(stack.registry.getQueryHandler(JobQueries.catalog)?.access)).toEqual(roles);
     expect(rolesOf(stack.registry.getWriteHandler(JobHandlers.trigger)?.access)).toEqual(roles);
     expect(rolesOf(stack.registry.getWriteHandler(JobHandlers.retry)?.access)).toEqual(roles);
   });
@@ -65,7 +66,7 @@ describe("access matrix: jobs operator surface is SystemAdmin-only", () => {
 });
 
 describe("non-SystemAdmin denied jobs HTTP surface", () => {
-  test("TenantAdmin 403 on list, detail, trigger", async () => {
+  test("TenantAdmin 403 on list, detail, catalog, trigger", async () => {
     for (const fn of [
       () => stack.http.query(JobQueries.list, {}, tenantAdmin),
       () =>
@@ -74,6 +75,7 @@ describe("non-SystemAdmin denied jobs HTTP surface", () => {
           { runId: "00000000-0000-4000-8000-000000000099" },
           tenantAdmin,
         ),
+      () => stack.http.query(JobQueries.catalog, {}, tenantAdmin),
       () =>
         stack.http.write(JobHandlers.trigger, { jobName: "jobs-sec-app:job:ping" }, tenantAdmin),
     ] as const) {

package/src/jobs/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.120.0",
+    "type": "improvement",
+    "title": "PII on custom-event payloads (#799).",
+    "detail": "PII on custom-event payloads (#799). `r.defineEvent(name, schema, { piiFields: { recipientAddress: { subjectField: \"recipientId\" } } })` declares payload fields that are encrypted under the owning user's DEK (crypto-shredding). Enforcement lives in the low-level event-store `append()` — the single write funnel — so `ctx.appendEvent`, MSP-apply AND out-of-dispatcher writers (delivery attempt-log, jobs run-logger) are all covered; the stored event and the returned echo carry ciphertext, keeping inline projections and rebuilds identical. A null subject field (system cron runs, recipient-less attempts) stays plaintext — there is no user key to shred. Misconfigured `piiFields` (unknown field/subjectField) throw at feature-definition time. Bundled features annotated: `delivery:event:attempt`.`recipientAddress` (subject = recipientId) and `jobs` `run-started`.`payload` (subject = triggeredById); the pseudonymous fk ids stay plaintext. `delivery log.query` and `jobs list/details` decrypt for display — a forgotten subject shows `[[erased]]`. This makes the events-only aggregates from #797 Art.-17-capable: user-forget erases the DEK, historical delivery addresses and job payloads become unreadable without touching the append-only stream. New exports: `encryptPiiValueForSubject`, `configureEventPiiCatalog`/`configuredEventPiiCatalog`/`encryptEventPayloadPii` (framework/crypto)."
+  }
+]

package/src/jobs/constants.ts

@@ -12,6 +12,7 @@ export const JobHandlers = {
 export const JobQueries = {
   list: "jobs:query:list",
   details: "jobs:query:details",
+  catalog: "jobs:query:catalog",
 } as const;
 
 // Error codes
@@ -19,6 +20,7 @@ export const JobErrors = {
   unknownJob: "unknown_job",
   notFound: "not_found",
   onlyFailedCanRetry: "only_failed_jobs_can_be_retried",
+  notManual: "job_not_manual",
 } as const;
 
 /** SystemAdmin job-runs list. Nav: `jobs:screen:job-runs`. */

package/src/jobs/feature.ts

@@ -11,6 +11,7 @@ import { JOB_RUN_DETAIL_SCREEN_ID, JOB_RUNS_SCREEN_ID } from "./constants";
 // payloads against these schemas before low-level append() — that's what
 // keeps out-of-dispatcher writes as type-safe as ctx.appendEvent.
 import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
+import { catalogQuery } from "./handlers/catalog.query";
 import { detailQuery } from "./handlers/detail.query";
 import { listQuery } from "./handlers/list.query";
 import {
@@ -32,7 +33,7 @@ import { jobRunLogsTable, jobRunLogsTableMeta, jobRunsTable } from "./job-run-ta
 export function createJobsFeature(): FeatureDefinition {
   return defineFeature("jobs", (r) => {
     r.describe(
-      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution appends `run-started`, `run-completed`, and `run-failed` events to the `jobRun` aggregate stream, which two inline projections materialize into `read_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list` and `jobs:query:details` for the operator UI.",
+      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution appends `run-started`, `run-completed`, and `run-failed` events to the `jobRun` aggregate stream, which two inline projections materialize into `read_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI.",
     );
     r.uiHints({
       displayLabel: "Jobs · Audit & Operator UI",
@@ -194,6 +195,7 @@ export function createJobsFeature(): FeatureDefinition {
     const queries = {
       list: r.queryHandler(listQuery),
       detail: r.queryHandler(detailQuery),
+      catalog: r.queryHandler(catalogQuery),
     };
 
     const systemAdminAccess = { roles: ["SystemAdmin"] as const };

package/src/jobs/handlers/catalog.query.ts

@@ -0,0 +1,43 @@
+import { defineQueryHandler, type JobDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+
+export type ManualJobCatalogEntry = {
+  readonly jobName: string;
+  readonly perTenant: boolean;
+  /** Compact JSON Schema (or null when the job accepts any/empty payload). */
+  readonly payloadSchema: Record<string, unknown> | null;
+};
+
+function isManualTrigger(trigger: JobDefinition["trigger"]): boolean {
+  return "manual" in trigger && trigger.manual === true;
+}
+
+function payloadSchemaJson(job: JobDefinition): Record<string, unknown> | null {
+  if (job.schema === undefined) return null;
+  try {
+    return z.toJSONSchema(job.schema) as Record<string, unknown>;
+  } catch {
+    // Non-JSON-Schema-able Zod types (transforms/effects) — UI still lists the job.
+    return null;
+  }
+}
+
+/** SystemAdmin catalog of jobs that may be started via `jobs:write:trigger`. */
+export const catalogQuery = defineQueryHandler({
+  name: "catalog",
+  schema: z.object({}),
+  access: { roles: ["SystemAdmin"] },
+  handler: async (_query, ctx): Promise<{ rows: readonly ManualJobCatalogEntry[] }> => {
+    const rows: ManualJobCatalogEntry[] = [];
+    for (const [jobName, job] of ctx.registry.getAllJobs()) {
+      if (!isManualTrigger(job.trigger)) continue;
+      rows.push({
+        jobName,
+        perTenant: job.perTenant === true,
+        payloadSchema: payloadSchemaJson(job),
+      });
+    }
+    rows.sort((a, b) => a.jobName.localeCompare(b.jobName));
+    return { rows };
+  },
+});

package/src/jobs/handlers/trigger.write.ts

@@ -1,8 +1,14 @@
 import type { DbRow } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  NotFoundError,
+  UnprocessableError,
+  validationErrorFromZod,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import { z } from "zod";
+import { JobErrors } from "../constants";
 
 export const triggerWrite = defineWriteHandler({
   name: "trigger",
@@ -25,7 +31,25 @@ export const triggerWrite = defineWriteHandler({
       );
     }
 
-    const payload = (event.payload.payload ?? {}) as DbRow;
+    if (!("manual" in jobDef.trigger) || jobDef.trigger.manual !== true) {
+      return writeFailure(
+        new UnprocessableError(JobErrors.notManual, {
+          i18nKey: "jobs.errors.notManual",
+          details: { jobName: event.payload.jobName },
+        }),
+      );
+    }
+
+    const rawPayload = event.payload.payload ?? {};
+    let payload: DbRow = rawPayload as DbRow;
+    if (jobDef.schema !== undefined) {
+      const parsed = jobDef.schema.safeParse(rawPayload);
+      if (!parsed.success) {
+        return writeFailure(validationErrorFromZod(parsed.error));
+      }
+      payload = parsed.data as DbRow;
+    }
+
     const bullJobId = await jobRunner.dispatch(event.payload.jobName, payload, {
       triggeredById: event.user.id,
       payload: JSON.stringify(payload),

package/src/jobs/i18n.ts

@@ -34,4 +34,37 @@ export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
   "jobs.detail.logs.empty": { de: "Keine Log-Zeilen.", en: "No log lines." },
   "jobs.detail.retry": { de: "Erneut ausführen", en: "Retry" },
   "jobs.detail.retrying": { de: "Wird erneut gestartet…", en: "Retrying…" },
+  "jobs.trigger.title": { de: "Job starten", en: "Run a job" },
+  "jobs.trigger.explainer": {
+    de: "Nur manuell startbare Jobs. Nach dem Start erscheint der Lauf in der Historie unten.",
+    en: "Only manually triggerable jobs. After starting, the run appears in the history below.",
+  },
+  "jobs.trigger.job": { de: "Job", en: "Job" },
+  "jobs.trigger.payload": { de: "Payload (JSON)", en: "Payload (JSON)" },
+  "jobs.trigger.payload.hint": { de: "Schema-Hinweis", en: "Schema hint" },
+  "jobs.trigger.payload.invalidJson": {
+    de: "Payload ist kein gültiges JSON-Objekt.",
+    en: "Payload is not a valid JSON object.",
+  },
+  "jobs.trigger.submit": { de: "Starten", en: "Run" },
+  "jobs.trigger.submitting": { de: "Wird gestartet…", en: "Starting…" },
+  "jobs.trigger.success": { de: "Job gestartet.", en: "Job started." },
+  "jobs.trigger.empty": {
+    de: "Keine manuell startbaren Jobs registriert.",
+    en: "No manually triggerable jobs are registered.",
+  },
+  "jobs.trigger.perTenant": {
+    de: "Läuft einmal pro aktivem Tenant.",
+    en: "Runs once per active tenant.",
+  },
+  "jobs.errors.unknownJob": { de: "Unbekannter Job.", en: "Unknown job." },
+  "jobs.errors.notManual": {
+    de: "Dieser Job ist nicht manuell startbar.",
+    en: "This job cannot be triggered manually.",
+  },
+  "jobs.errors.notFound": { de: "Nicht gefunden.", en: "Not found." },
+  "jobs.errors.onlyFailedCanRetry": {
+    de: "Nur fehlgeschlagene Läufe können erneut gestartet werden.",
+    en: "Only failed runs can be retried.",
+  },
 };