@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.336.0

package/dist/document-ingest-foundation/feature.js

@@ -11,7 +11,7 @@ import { validateDocumentIngestProviderWiring } from "./boot-checks.js";
 import { documentExtractEntity } from "./entity.js";
 import { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
 import { forgetExtractOnFileRefDeletedHook, forgetExtractOnFileRefForgottenHook, forgetOrphanedDocumentExtractHook, } from "./forget-extract-with-file-ref.js";
-import { EXT_DOCUMENT_INGEST_PROVIDER, resolveDocumentIngestProviders } from "./providers.js";
+import { EXT_DOCUMENT_INGEST_PROVIDER, resolveDocumentIngestProviders, UNCLAIMED_PROVIDER_SENTINEL, } from "./providers.js";
 import { documentExtractTenantDestroyHook } from "./tenant-destroy-hook.js";
 const FEATURE_NAME = "document-ingest-foundation";
 const FILE_REF_CREATED = entityEventName("fileRef", "created");
@@ -123,10 +123,10 @@ export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) =
             {
                 fromVersion: 1,
                 toVersion: 2,
-                // "unknown" can never match a real where.provider filter — an
-                // upcast v1 row reads as unclaimed instead of silently misrouting to
-                // whichever provider happens to be mounted today.
-                transform: { default: { provider: "unknown" } },
+                // The sentinel can never match a real where.provider filter (providers
+                // may not register under it) — an upcast v1 row reads as unclaimed
+                // instead of silently misrouting to a currently mounted provider.
+                transform: { default: { provider: UNCLAIMED_PROVIDER_SENTINEL } },
             },
         ],
     });

package/dist/document-ingest-foundation/providers.d.ts

@@ -16,6 +16,7 @@ export type ResolvedDocumentIngestProvider = {
     readonly name: string;
     readonly maxFileBytes: number;
 };
+export declare const UNCLAIMED_PROVIDER_SENTINEL = "unknown";
 type ExtensionUsages = FeatureDefinition["extensionUsages"];
 export declare function resolveDocumentIngestProviders(usages: ExtensionUsages): ReadonlyMap<string, ResolvedDocumentIngestProvider>;
 export declare function listIngestibleMimeTypes(registry: Registry): readonly string[];

package/dist/document-ingest-foundation/providers.js

@@ -9,6 +9,9 @@ export const documentIngestProviderOptionsSchema = z.object({
     mimeTypes: z.array(z.string().min(1)).min(1),
     maxFileBytes: z.number().int().positive(),
 });
+// Stamped on upcast v1 documentIngest.requested events; a provider may not
+// claim it, or replayed v1 events would route to that provider.
+export const UNCLAIMED_PROVIDER_SENTINEL = "unknown";
 // Throws on an invalid options shape or two providers claiming the same
 // normalized mimeType — callers decide whether that's boot-fatal.
 export function resolveDocumentIngestProviders(usages) {
@@ -16,6 +19,9 @@ export function resolveDocumentIngestProviders(usages) {
     for (const usage of usages) {
         if (usage.extensionName !== EXT_DOCUMENT_INGEST_PROVIDER)
             continue;
+        if (usage.entityName === UNCLAIMED_PROVIDER_SENTINEL) {
+            throw new Error(`document-ingest-foundation: provider name "${UNCLAIMED_PROVIDER_SENTINEL}" is reserved for upcast legacy events.`);
+        }
         const parsed = documentIngestProviderOptionsSchema.safeParse(usage.options);
         if (!parsed.success) {
             throw new Error(`document-ingest-foundation: provider "${usage.entityName}" registered invalid options via ` +

package/dist/document-ingest-foundation/write-document-extract.d.ts

@@ -1,12 +1,12 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import type { DocumentExtractMeta, IngestPage } from "./entity.js";
+import { type DocumentExtractMeta, type IngestPage } from "./entity.js";
 export type DocumentExtractWriteResult = {
     readonly kind: "written";
     readonly documentExtractId: string;
 } | {
     readonly kind: "skipped";
-    readonly reason: "file_ref_deleted";
+    readonly reason: "file_ref_deleted" | "already_extracted";
 };
 export declare function writeDocumentExtractForLiveFileRef(input: {
     readonly tenantDb: TenantDb;

package/dist/document-ingest-foundation/write-document-extract.js

@@ -3,6 +3,7 @@
 // the one place that write must go through to stay race-safe against a
 // concurrent fileRef delete/forget — see forget-extract-with-file-ref.ts.
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { documentExtractsTable } from "./entity.js";
 import { documentExtractExecutor } from "./executor.js";
 import { isFileRefLive } from "./file-ref-liveness.js";
 import { writeIngestPages } from "./pages.js";
@@ -13,6 +14,15 @@ export async function writeDocumentExtractForLiveFileRef(input) {
     if (!(await isFileRefLive(input.tenantDb, input.fileRefId))) {
         return { kind: "skipped", reason: "file_ref_deleted" };
     }
+    // A redelivered documentIngest.requested, or the one a delete→restore race
+    // re-requests while the old extract is still standing, must not create a
+    // second extract for the same fileRef.
+    const existing = await input.tenantDb.selectMany(documentExtractsTable, {
+        fileRefId: input.fileRefId,
+    });
+    if (existing.length > 0) {
+        return { kind: "skipped", reason: "already_extracted" };
+    }
     const result = await documentExtractExecutor.create({
         fileRefId: input.fileRefId,
         storageKey: input.storageKey,

package/dist/feature-toggles/global-feature-state-table.js

@@ -1,4 +1,4 @@
-import { asEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
+import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
 import { boolean, declareGlobalTenancy, instant, integer, table as pgTable, sql, text, } from "@cosmicdrift/kumiko-framework/db";
 // Global feature-toggle override state. One row per feature that has ever
 // been explicitly flipped by an operator. Missing row = "no override,
@@ -26,9 +26,4 @@ export const globalFeatureStateTable = declareGlobalTenancy(pgTable("store_globa
 // the pgTable made queries type-check while the migration generator stayed
 // blind to it, failing in prod with "column ... does not exist" while every
 // mocked-stack test stayed green.
-const derivedMeta = asEntityTableMeta(globalFeatureStateTable);
-if (!derivedMeta) {
-    throw new Error("global-feature-state-table: asEntityTableMeta(globalFeatureStateTable) returned undefined " +
-        "— the pgTable definition no longer round-trips through the unmanaged-table meta builder.");
-}
-export const globalFeatureStateTableMeta = derivedMeta;
+export const globalFeatureStateTableMeta = requireEntityTableMeta(globalFeatureStateTable, "globalFeatureStateTable");

package/dist/feature-toggles/toggle-runtime.d.ts

@@ -9,6 +9,7 @@ export declare class GlobalFeatureToggleRuntime {
     private readonly registry;
     private readonly syncSignal?;
     private snapshot;
+    private appliedDuringLoad;
     constructor(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal | undefined);
     initialize(): Promise<void>;
     refresh(): Promise<void>;

package/dist/feature-toggles/toggle-runtime.js

@@ -17,6 +17,9 @@ export class GlobalFeatureToggleRuntime {
     registry;
     syncSignal;
     snapshot = new Map();
+    // Flips applied while a snapshot load is in flight. The load's SELECT may have
+    // started before the flip committed, so its rows can be older than these.
+    appliedDuringLoad;
     constructor(db, registry, syncSignal) {
         this.db = db;
         this.registry = registry;
@@ -30,8 +33,18 @@ export class GlobalFeatureToggleRuntime {
         });
     }
     async initialize() {
-        const rows = await selectMany(this.db, globalFeatureStateTable);
-        this.snapshot = new Map(rows.map((r) => [r.featureName, r.enabled]));
+        const pendingFlips = new Map();
+        this.appliedDuringLoad = pendingFlips;
+        try {
+            const rows = await selectMany(this.db, globalFeatureStateTable);
+            this.snapshot = new Map([
+                ...rows.map((r) => [r.featureName, r.enabled]),
+                ...pendingFlips,
+            ]);
+        }
+        finally {
+            this.appliedDuringLoad = undefined;
+        }
     }
     // Re-read the full snapshot. Called from the set-handler after a
     // successful write — cheap point-update would be an optimisation but
@@ -46,6 +59,7 @@ export class GlobalFeatureToggleRuntime {
     // lock. Kept alongside refresh() so both options are explicit.
     apply(featureName, enabled) {
         this.snapshot.set(featureName, enabled);
+        this.appliedDuringLoad?.set(featureName, enabled);
     }
     // Called by the toggle-cache-sync MSP handler (feature.ts) — the one
     // process whose shared cursor won a given toggle-set event. With a

package/dist/feature-toggles/toggle-sync-signal.d.ts

@@ -1,5 +1,6 @@
+import { type RedisClientOptions } from "@cosmicdrift/kumiko-framework/redis";
 import type { ToggleSyncSignal } from "./toggle-runtime.js";
 export type RedisToggleSyncSignal = ToggleSyncSignal & {
     close(): Promise<void>;
 };
-export declare function createRedisToggleSyncSignal(redisUrl: string): RedisToggleSyncSignal;
+export declare function createRedisToggleSyncSignal(redisUrl: string, clientOptions?: RedisClientOptions): RedisToggleSyncSignal;

package/dist/feature-toggles/toggle-sync-signal.js

@@ -1,4 +1,4 @@
-import { createRedisPubSubSignal } from "@cosmicdrift/kumiko-framework/redis";
+import { createRedisPubSubSignal, } from "@cosmicdrift/kumiko-framework/redis";
 // Single fixed channel — unlike the SSE broker there's no per-tenant/
 // per-user variance to multiplex, every toggle flip is global.
 const TOGGLE_SYNC_CHANNEL = "kumiko:feature-toggles:cache-sync";
@@ -15,11 +15,12 @@ function isTogglePayload(value) {
 // replicas > 1 is expected to set REDIS_URL, so app-boot code should build
 // this only when REDIS_URL is present and pass it into
 // createFeatureToggleRuntime.
-export function createRedisToggleSyncSignal(redisUrl) {
+export function createRedisToggleSyncSignal(redisUrl, clientOptions) {
     const signal = createRedisPubSubSignal({
         redisUrl,
         channelPattern: TOGGLE_SYNC_CHANNEL,
         label: "feature-toggles",
+        ...(clientOptions ? { clientOptions } : {}),
     });
     return {
         publish(featureName, enabled) {

package/dist/files-tenant-data/index.js

@@ -13,6 +13,7 @@
 import { defineFeature, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, } from "@cosmicdrift/kumiko-framework/engine";
 import { sweepOrphanedDerivativesJob, sweepOrphanedDerivativesPayloadSchema, } from "./handlers/sweep-orphaned-derivatives.job.js";
 import { fileRefStorageDestroyHook, fileRefTenantDestroyHook } from "./hooks.js";
+const SWEEP_ORPHANED_DERIVATIVES_ESCAPE_HATCH_REASON = "iterates every tenant and checks fileRef owners per tenant";
 export function createFilesTenantDataFeature() {
     return defineFeature("files-tenant-data", (r) => {
         r.describe("GDPR coverage for the `files` feature's `fileRef` entity: tenant-destroy row purge (EXT_TENANT_DATA) and full storage-prefix binary wipe (EXT_STORAGE_PROVIDER), plus a manual backfill/GC job that sweeps derivatives orphaned by a forget/tenant-destroy that ran before #2461 wired binary cleanup into those flows. Requires `tenant-lifecycle`, optionalRequires `files`.");
@@ -31,9 +32,9 @@ export function createFilesTenantDataFeature() {
             concurrency: "skip",
             schema: sweepOrphanedDerivativesPayloadSchema,
             escapeHatch: {
-                reason: "iterates every tenant and checks fileRef owners per tenant",
+                reason: SWEEP_ORPHANED_DERIVATIVES_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => sweepOrphanedDerivativesJob(payload, ctx, ctx.db.unsafeRaw("iterates every tenant and checks fileRef owners per tenant")),
+            handler: (payload, ctx) => sweepOrphanedDerivativesJob(payload, ctx, ctx.db.unsafeRaw(SWEEP_ORPHANED_DERIVATIVES_ESCAPE_HATCH_REASON)),
         });
     });
 }

package/dist/folders/handlers/clear-folder.write.js

@@ -1,5 +1,4 @@
-import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { joinRowParentIsVisible } from "../../shared/index.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { folderAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_FOLDER_ACCESS } from "../constants.js";
 import { folderAssignmentExecutor } from "../executor.js";
@@ -19,15 +18,9 @@ export function createClearFolderHandler(access = DEFAULT_FOLDER_ACCESS) {
         description: "Unfiles a host entity so it sits in no folder at all, reporting success when it was already unfiled; use it to take an entity out of its folder without touching the folder itself.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // entityType/entityId are client input: the caller must be able to see
-            // the host row through that entity's own read path (tenant scope plus its
-            // `access.read` ownership) before its assignment row may be written.
-            // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
-            // an invisible parent apart from a missing assignment or an unknown folder —
-            // every path answers with the same NotFoundError.
-            if (!(await joinRowParentIsVisible(ctx.registry, "folder-assignment", payload, event.user, ctx.db))) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "folder-assignment", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             const id = folderAssignmentAggregateId(event.user.tenantId, payload.entityType, payload.entityId);
             const existing = await folderAssignmentExecutor.detail({ id }, event.user, ctx.db);
             if (!existing) {

package/dist/folders/handlers/set-folder.write.js

@@ -1,5 +1,5 @@
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { joinRowParentIsVisible } from "../../shared/index.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { folderAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_FOLDER_ACCESS } from "../constants.js";
 import { folderAssignmentExecutor, folderExecutor } from "../executor.js";
@@ -35,15 +35,9 @@ export function createSetFolderHandler(access = DEFAULT_FOLDER_ACCESS) {
         description: "Files a host entity into one existing folder and moves it out of whatever folder it was in, since an entity belongs to at most one folder; use it for both the first filing and every later move.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // entityType/entityId are client input: the caller must be able to see
-            // the host row through that entity's own read path (tenant scope plus its
-            // `access.read` ownership) before its assignment row may be written.
-            // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
-            // an invisible parent apart from a missing assignment or an unknown folder —
-            // every path answers with the same NotFoundError.
-            if (!(await joinRowParentIsVisible(ctx.registry, "folder-assignment", payload, event.user, ctx.db))) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "folder-assignment", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             const id = folderAssignmentAggregateId(event.user.tenantId, payload.entityType, payload.entityId);
             const folder = await folderExecutor.detail({ id: payload.folderId }, event.user, ctx.db);
             if (!folder)

package/dist/form-draft/feature.js

@@ -12,6 +12,7 @@ import { discardDraftWrite } from "./handlers/discard.write.js";
 import { getDraftQuery } from "./handlers/get.query.js";
 import { listDraftsQuery } from "./handlers/list.query.js";
 import { saveDraftWrite } from "./handlers/save.write.js";
+const CLEANUP_ESCAPE_HATCH_REASON = "purges stale drafts of every tenant";
 function registerFormDraft(r) {
     r.describe("Per-user, per-tenant working copy of an in-progress form, saved BEFORE the real domain entity exists. Owns one event-sourced entity, `form-draft` (`read_form_drafts`), keyed by a caller-assigned draftKey (typically screenId + optional hostEntityId), unique per (tenant, owner, draftKey). `save` upserts the draft blob ({ values, stepIndex, savedAt } — savedAt stamped server-side), `discard` deletes it (called once the real submit succeeds), `get` resumes it, `list` finds a user's open drafts for a given screenId (draftKey prefix match) — the fallback when a client-generated draftId is lost. Ownership is enforced by a per-row owner filter in every handler, not by roles — a foreign user's save/discard/get/list for someone else's draftKey never sees or touches that row. Never holds anything that already lives in a domain stream; the consuming app is responsible for discarding once the domain write succeeds. A daily cron job hard-deletes drafts past a configurable retention window (`form-draft:config:retention-days`, SystemAdmin-writable, default 30 days).");
     r.uiHints({
@@ -36,8 +37,8 @@ function registerFormDraft(r) {
         name: "cleanup",
         trigger: { cron: "0 3 * * *" },
         concurrency: "skip",
-        escapeHatch: { reason: "purges stale drafts of every tenant" },
-        handler: (payload, ctx) => cleanupDraftsJob(payload, ctx, ctx.db.unsafeRaw("purges stale drafts of every tenant")),
+        escapeHatch: { reason: CLEANUP_ESCAPE_HATCH_REASON },
+        handler: (payload, ctx) => cleanupDraftsJob(payload, ctx, ctx.db.unsafeRaw(CLEANUP_ESCAPE_HATCH_REASON)),
     });
 }
 export const formDraftFeature = defineFeature(FORM_DRAFT_FEATURE_NAME, registerFormDraft);

package/dist/form-draft/handlers/discard.write.js

@@ -73,18 +73,17 @@ export const discardDraftWrite = defineWriteHandler({
             const keys = ownedRefs.map((ref) => ref.storageKey);
             const log = ctx.log;
             const schedule = ctx.scheduleAfterCommit;
+            const release = async () => {
+                await releaseDraftFileRefs(keys, async (key) => {
+                    await files.ref(key).delete();
+                }, log);
+            };
             if (schedule) {
-                schedule(async () => {
-                    await releaseDraftFileRefs(keys, async (key) => {
-                        await files.ref(key).delete();
-                    }, log);
-                });
+                schedule(release);
             }
             else {
                 // Unit/harness paths without a commit sink — best-effort inline.
-                await releaseDraftFileRefs(keys, async (key) => {
-                    await files.ref(key).delete();
-                }, log);
+                await release();
             }
         }
         return { isSuccess: true, data: { discarded: true } };

package/dist/form-draft/handlers/get.query.js

@@ -16,6 +16,12 @@ export const getDraftQuery = defineQueryHandler({
         if (!row)
             return { draft: null };
         const parsed = formDraftBlobSchema.safeParse(row.draft);
-        return { draft: parsed.success ? parsed.data : null };
+        if (!parsed.success) {
+            // Schema evolution or a corrupt jsonb row: surface it to operators
+            // instead of silently making the user's draft vanish.
+            ctx.log?.warn?.(`[form-draft:get] stored blob for draftKey=${query.payload.draftKey} failed schema, treating as absent: ${parsed.error.message}`);
+            return { draft: null };
+        }
+        return { draft: parsed.data };
     },
 });

package/dist/foundation-shared/host-allowlist.d.ts

@@ -0,0 +1,4 @@
+/** Parses a comma-separated operator host allowlist env var. Never throws —
+ *  an unset or empty value just means no bypass. */
+export declare function readHostAllowlistFromEnv(envVar: string, env?: Readonly<Record<string, string | undefined>>): readonly string[];
+export declare function isHostAllowlisted(host: string, allowlist: readonly string[]): boolean;

package/dist/foundation-shared/host-allowlist.js

@@ -0,0 +1,14 @@
+/** Parses a comma-separated operator host allowlist env var. Never throws —
+ *  an unset or empty value just means no bypass. */
+export function readHostAllowlistFromEnv(envVar, env = process.env) {
+    const raw = env[envVar];
+    if (!raw)
+        return [];
+    return raw
+        .split(",")
+        .map((host) => host.trim())
+        .filter((host) => host.length > 0);
+}
+export function isHostAllowlisted(host, allowlist) {
+    return allowlist.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
+}

package/dist/foundation-shared/index.d.ts

@@ -1,2 +1,3 @@
 export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers.js";
+export { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
 export { BlockedHostError, HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, type MailConnectTarget, type MailHostGuardOptions, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "./mail-host-policy.js";

package/dist/foundation-shared/index.js

@@ -1,4 +1,5 @@
 // Public API of foundation-shared — utilities consumed by the per-tenant
 // Foundation packages (ai-foundation, mail-foundation, file-foundation).
 export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers.js";
+export { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
 export { BlockedHostError, HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "./mail-host-policy.js";

package/dist/foundation-shared/mail-host-policy.d.ts

@@ -1,7 +1,5 @@
 import type { lookup } from "node:dns/promises";
 export declare const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
 export declare function readAllowedPrivateMailHostsFromEnv(env?: Readonly<Record<string, string | undefined>>): readonly string[];
 export type MailHostGuardOptions = {
     readonly allowedPrivateMailHosts?: readonly string[];

package/dist/foundation-shared/mail-host-policy.js

@@ -16,23 +16,13 @@
 // conflict check tripping when both features are mounted together.
 import { isIP } from "node:net";
 import { resolvePublicHostname } from "@cosmicdrift/kumiko-framework/http";
+import { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
 export const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
 export function readAllowedPrivateMailHostsFromEnv(env = process.env) {
-    const raw = env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
-    if (!raw)
-        return [];
-    return raw
-        .split(",")
-        .map((host) => host.trim())
-        .filter((host) => host.length > 0);
-}
-function isAllowedPrivateMailHost(host, allowed) {
-    return allowed.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
+    return readHostAllowlistFromEnv(MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, env);
 }
 export async function resolveMailConnectTarget(host, options = {}) {
-    if (isAllowedPrivateMailHost(host, options.allowedPrivateMailHosts ?? [])) {
+    if (isHostAllowlisted(host, options.allowedPrivateMailHosts ?? [])) {
         return { host };
     }
     const resolved = await resolvePublicHostname(host, options.lookupFn);

package/dist/inbound-mail-foundation/connect-routes.js

@@ -73,6 +73,12 @@ export function createInboundMailConnectRoutes(options) {
         verify: async (request) => verifyCallbackRequest(request, options.stateSecret),
         handler: async (c, verified, deps) => {
             const { code, state } = verified;
+            // Checked before exchangeCode/connectAccount: the code is single-use and
+            // an account created without a persistable refresh token is an orphan.
+            // `deps.secrets` is optional on SignatureExtraRouteDeps.
+            if (!deps.secrets) {
+                return errorJson(c, 500, "secrets_context_missing", `${INBOUND_MAIL_FOUNDATION_FEATURE}: no secrets context wired for the oauth callback route — the refresh token cannot be persisted`);
+            }
             const providerCtx = { registry: deps.registry, secrets: deps.secrets, config: undefined };
             let plugin;
             try {
@@ -123,11 +129,7 @@ export function createInboundMailConnectRoutes(options) {
             }
             // Refresh-token into the per-account secret slot (Slot = accountId).
             // Access tokens (~1h) are NEVER persisted — refresh-before-poll in the
-            // sync path. `deps.secrets` is optional on SignatureExtraRouteDeps —
-            // without it the token would be silently lost, so fail loud instead.
-            if (!deps.secrets) {
-                return errorJson(c, 500, "secrets_context_missing", `${INBOUND_MAIL_FOUNDATION_FEATURE}: no secrets context wired for the oauth callback route — the refresh token cannot be persisted`);
-            }
+            // sync path.
             await deps.secrets.set(state.tenantId, inboundCredentialSecretKey(accountId), tokens.refreshToken, {
                 redact: (plaintext) => `${plaintext.slice(0, 4)}…`,
                 hint: `OAuth refresh token for inbound mail account ${accountId}`,

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -121,7 +121,8 @@ export function createInboundMailSupervisor(deps) {
             return null; // korrupter Cursor = wie kein Cursor → Backfill, Dedup fängt Dubletten
         }
     }
-    async function saveCursor(accountId, cursor) {
+    async function saveCursor(account, cursor) {
+        const accountId = account.id;
         const now = Temporal.Now.instant().toString();
         const serialized = JSON.stringify(cursor);
         const existing = await fetchOne(deps.db, syncCursorTable, {
@@ -135,6 +136,8 @@ export function createInboundMailSupervisor(deps) {
         }
         await insertOne(deps.db, syncCursorTable, {
             id: crypto.randomUUID(),
+            // Direct-write store: no executor stamps the NOT NULL tenant_id for us.
+            tenantId: account.tenantId,
             accountId,
             scope: CURSOR_SCOPE,
             cursor: serialized,
@@ -227,7 +230,7 @@ export function createInboundMailSupervisor(deps) {
                     maxMessages: budget,
                 });
                 await ingestBatch(account, result.messages, JSON.stringify(result.nextCursor));
-                await saveCursor(account.id, result.nextCursor);
+                await saveCursor(account, result.nextCursor);
                 cursor = result.nextCursor;
                 budget -= result.messages.length;
                 if (!result.hasMore || budget <= 0)
@@ -267,51 +270,52 @@ export function createInboundMailSupervisor(deps) {
     // lifecycle — it keeps renewing across reconnect backoff, not just while
     // `plugin.watch()` is actually connected, so a flaky IMAP link doesn't
     // make this worker lose the account to a peer mid-backoff.
-    // kumiko-lint-ignore complexity-budget watch lease renew backoff/re-acquire loop
     function scheduleRenew(account, state, generation) {
         state.renewTimer = setTimeout(() => {
-            // kumiko-lint-ignore complexity-budget renew timer callback (renew/backoff/re-acquire)
-            void (async () => {
-                state.renewTimer = null;
-                // skip: supervisor stopped, generation superseded, or lease already lost — stale timer fire, nothing to renew.
-                if (!running || state.generation !== generation || !state.lockToken || !deps.lock)
-                    return;
-                let renewed;
-                try {
-                    renewed = await deps.lock.renew(account.id, state.lockToken, leaseTtlSeconds);
-                }
-                catch (err) {
-                    log(`inbound-mail: watch lease renew for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
-                    state.renewFailures += 1;
-                    // After failures spanning a full lease TTL, tear down — otherwise a
-                    // peer can acquire the expired key while we still hold an IDLE conn.
-                    if (state.renewFailures * renewIntervalMs >= leaseTtlSeconds * 1000) {
-                        log(`inbound-mail: watch lease renew for account ${account.id} failed across TTL — tearing down local watcher`);
-                        state.lockToken = null;
-                        await stopWatcher(account.id);
-                        // skip: local watcher torn down after renew failures spanning a full lease TTL.
-                        return;
-                    }
-                    if (running && state.generation === generation && state.lockToken) {
-                        scheduleRenew(account, state, generation);
-                    }
-                    // skip: renew already rescheduled above (or conditions no longer hold) — nothing left to do this tick.
-                    return;
-                }
-                state.renewFailures = 0;
-                if (!renewed) {
-                    log(`inbound-mail: watch lease for account ${account.id} lost — tearing down local watcher`);
-                    state.lockToken = null;
-                    await stopWatcher(account.id);
-                    // skip: watcher already torn down by stopWatcher() above — nothing left to do.
-                    return;
-                }
-                if (running && state.generation === generation && state.lockToken) {
-                    scheduleRenew(account, state, generation);
-                }
-            })();
+            void renewLeaseOnce(account, state, generation);
         }, renewIntervalMs);
     }
+    async function tearDownAfterRenewFailures(account, state, reason) {
+        log(`inbound-mail: watch lease ${reason} for account ${account.id} — tearing down local watcher`);
+        state.lockToken = null;
+        await stopWatcher(account.id);
+    }
+    async function renewLeaseOnce(account, state, generation) {
+        state.renewTimer = null;
+        // skip: supervisor stopped, generation superseded, or lease already lost — stale timer fire, nothing to renew.
+        if (!running || state.generation !== generation || !state.lockToken || !deps.lock)
+            return;
+        let renewed;
+        try {
+            renewed = await deps.lock.renew(account.id, state.lockToken, leaseTtlSeconds);
+        }
+        catch (err) {
+            log(`inbound-mail: watch lease renew for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+            state.renewFailures += 1;
+            // After failures spanning a full lease TTL, tear down — otherwise a
+            // peer can acquire the expired key while we still hold an IDLE conn.
+            if (state.renewFailures * renewIntervalMs >= leaseTtlSeconds * 1000) {
+                await tearDownAfterRenewFailures(account, state, "renew failed across TTL");
+                // skip: connection torn down, no reschedule
+                return;
+            }
+            rescheduleIfStillHeld(account, state, generation);
+            // skip: renew failed but TTL not yet exhausted, retry already scheduled
+            return;
+        }
+        state.renewFailures = 0;
+        if (!renewed) {
+            await tearDownAfterRenewFailures(account, state, "lost");
+            // skip: lease lost and torn down, nothing to reschedule
+            return;
+        }
+        rescheduleIfStillHeld(account, state, generation);
+    }
+    function rescheduleIfStillHeld(account, state, generation) {
+        if (running && state.generation === generation && state.lockToken) {
+            scheduleRenew(account, state, generation);
+        }
+    }
     // kumiko-lint-ignore complexity-budget yield-point stale-map check after acquire is intentional (#2460)
     async function acquireWatchLease(account, state) {
         if (!deps.lock || state.lockToken)

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -12,30 +12,37 @@
 // the run becomes retriable via the existing jobs:write:retry gate
 // (retry.write.ts only allows retry from "failed").
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { mapWithConcurrency } from "../../../shared/index.js";
 import { encryptFailureError } from "../../job-run-logger.js";
 import { jobRunsTable } from "../../job-run-table.js";
+const KMS_POOL_CONCURRENCY = 4;
 export const STALE_JOB_RUN_ERROR = "job run exceeded the stale-run timeout without a completion signal (likely a crashed worker process)";
 export async function markStaleJobRunsFailed(db, timeoutHours) {
     const cutoff = Temporal.Now.instant().subtract({ hours: timeoutHours });
     const now = Temporal.Now.instant();
     // Fetch the matched rows first: `error` carries the same per-triggering-
     // user subject annotation as job-run-logger.ts's onJobFailed path
-    // (personal: { of: "triggeredById" } on job-run-table.ts), and a batch
-    // updateMany can't encrypt per-row — different matched runs can belong to
-    // different users, each under their own DEK. One updateMany per row keeps
-    // this crash-recovery sweep's write on the same encrypted footing as the
-    // normal failure path instead of writing STALE_JOB_RUN_ERROR in the clear.
+    // (personal: { of: "triggeredById" } on job-run-table.ts), so it is encrypted
+    // under that subject's DEK. Runs are grouped by subject: one encrypt and one
+    // updateMany per subject instead of per run.
     const stale = await selectMany(db, jobRunsTable, {
         status: "running",
         startedAt: { lt: cutoff },
     });
+    const idsBySubject = new Map();
+    for (const run of stale) {
+        const ids = idsBySubject.get(run.triggeredById);
+        if (ids)
+            ids.push(run.id);
+        else
+            idsBySubject.set(run.triggeredById, [run.id]);
+    }
     // duration is deliberately left untouched: we don't know when the run
     // actually died, only that it crossed the timeout, so recording a
     // duration would misrepresent it as measured. detail-screen/list-screen
     // both already render a null duration as "—".
-    let runsMarkedFailed = 0;
-    for (const run of stale) {
-        const encryptedError = await encryptFailureError(STALE_JOB_RUN_ERROR, run.triggeredById);
+    const updatedPerSubject = await mapWithConcurrency([...idsBySubject], KMS_POOL_CONCURRENCY, async ([triggeredById, ids]) => {
+        const encryptedError = await encryptFailureError(STALE_JOB_RUN_ERROR, triggeredById);
         const updated = await updateMany(db, jobRunsTable, {
             status: "failed",
             error: encryptedError,
@@ -43,12 +50,12 @@ export async function markStaleJobRunsFailed(db, timeoutHours) {
             modifiedAt: now,
             modifiedById: "system",
         }, 
-        // Re-assert status: "running" here (not just id) — closes the race
-        // window between the selectMany above and this write, where the run
-        // could have completed/failed normally in between and must not be
-        // clobbered back to "failed" with the stale-timeout message.
-        { id: run.id, status: "running" });
-        runsMarkedFailed += updated.length;
-    }
+        // Re-assert status: "running" (not just id) — closes the race window
+        // between the selectMany above and this write, where a run could have
+        // completed/failed normally and must not be clobbered back to "failed".
+        { id: { in: ids }, status: "running" });
+        return updated.length;
+    });
+    const runsMarkedFailed = updatedPerSubject.reduce((sum, count) => sum + count, 0);
     return { runsMarkedFailed };
 }