@cosmicdrift/kumiko-bundled-features 0.338.0 → 0.340.0

package/dist/tenant-lifecycle/handlers/cancel-destruction.write.js

@@ -20,7 +20,9 @@ export const cancelDestructionWrite = defineWriteHandler({
     },
     handler: async (event, ctx) => {
         const tenantId = event.user.tenantId;
-        const row = await fetchOne(ctx.db.unsafeRaw(CANCEL_DESTRUCTION_TENANT_ROW_REASON), tenantTable, { id: tenantId });
+        const row = await fetchOne(ctx.db.unsafeRaw(), tenantTable, {
+            id: tenantId,
+        });
         if (!row) {
             return writeFailure(new UnprocessableError("tenant_not_found", { details: { tenantId } }));
         }

package/dist/tenant-lifecycle/handlers/request-destruction.write.js

@@ -24,7 +24,7 @@ export const requestDestructionWrite = defineWriteHandler({
     },
     handler: async (event, ctx) => {
         const tenantId = event.user.tenantId;
-        const runner = ctx.db.unsafeRaw(REQUEST_DESTRUCTION_TENANT_ROW_REASON);
+        const runner = ctx.db.unsafeRaw();
         const row = await fetchOne(runner, tenantTable, { id: tenantId });
         if (!row) {
             return writeFailure(new UnprocessableError("tenant_not_found", { details: { tenantId } }));

package/dist/tier-engine/feature.js

@@ -303,7 +303,7 @@ export function createTierEngineFeature(opts = {}) {
                 const rawDb = ctx.systemDb
                     ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
                     : ctx.db && "unsafeRaw" in ctx.db
-                        ? ctx.db.unsafeRaw(autoDefaultTierHookReason)
+                        ? ctx.db.unsafeRaw()
                         : undefined;
                 // skip: defensive — inTransaction phase always sets db, but AppContext's
                 // type makes it optional. Throwing would be overreach (lifecycle

package/dist/tier-engine/handlers/get-tenant-tier.query.js

@@ -20,7 +20,7 @@ export const getTenantTierQuery = defineQueryHandler({
     },
     handler: async (query, ctx) => {
         const tenantId = query.payload.tenantId; // @cast-boundary engine-bridge
-        const tdb = createTenantDb(ctx.db.unsafeRaw(GET_TENANT_TIER_REASON), tenantId, "system");
+        const tdb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
         const row = await fetchOne(tdb, tierAssignmentTable, { tenantId });
         return row ?? null;
     },

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -51,7 +51,7 @@ export function createSetTenantTierWrite(opts = {}) {
         },
         handler: async (event, ctx) => {
             const tenantId = event.payload.tenantId; // @cast-boundary engine-bridge
-            const rawDb = ctx.db.unsafeRaw(SET_TENANT_TIER_REASON);
+            const rawDb = ctx.db.unsafeRaw();
             const tdb = createTenantDb(rawDb, tenantId, "system");
             const systemUser = { ...event.user, tenantId };
             const tier = event.payload.tier;

package/dist/user/handlers/update-roles.js

@@ -1,4 +1,4 @@
-import { asEntityTableMeta, asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { acquireNamespacedAdvisoryLock, createEventStoreExecutor, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, findForbiddenRoleAssignment, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ConflictError, InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
@@ -10,9 +10,6 @@ const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user"
 // Serializes last-SystemAdmin demotion checks globally inside the write TX
 // (dispatcher batch wraps handlers in transaction — xact lock holds through update).
 const LAST_SYSTEM_ADMIN_LOCK_NAMESPACE = 0x7361646d; // 'sadm'
-function quoteIdent(name) {
-    return `"${name.replace(/"/g, '""')}"`;
-}
 function isActiveUserRow(row) {
     if (row.isDeleted === true)
         return false;
@@ -22,19 +19,11 @@ function isActiveSystemAdminRow(row) {
     return isActiveUserRow(row) && parseRoles(row.roles).includes("SystemAdmin");
 }
 async function countOtherActiveSystemAdmins(db, excludeUserId) {
-    const tableName = asEntityTableMeta(userTable)?.tableName;
-    if (!tableName) {
-        throw new InternalError({ message: "user read table meta missing" });
-    }
-    // kumiko-lint-ignore raw-sql jsonb @> prefilter for SystemAdmin roster under advisory lock
-    const rows = (await asRawClient(db).unsafe(`SELECT id, roles, status, is_deleted AS "isDeleted"
-     FROM ${quoteIdent(tableName)}
-     WHERE is_deleted = false
-       AND (status = $1 OR status IS NULL)
-       AND roles @> $2::jsonb`, 
-    // Pass a JS array — JSON.stringify + $n::jsonb double-encodes to a jsonb string
-    // (postgres.js), so `@>` never matches a roles array.
-    [USER_STATUS.Active, ["SystemAdmin"]]));
+    // `roles` is a jsonb multiSelect column: a scalar filter value means `@>` containment.
+    const rows = await selectMany(db, userTable, {
+        isDeleted: false,
+        roles: "SystemAdmin",
+    });
     return rows.filter((u) => u.id !== excludeUserId && isActiveSystemAdminRow(u)).length;
 }
 export async function applyUserRolesUpdate(event, ctx, db) {
@@ -68,7 +57,7 @@ export async function applyUserRolesUpdate(event, ctx, db) {
         // Lock before count+update so two concurrent demotions cannot both
         // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
         await acquireNamespacedAdvisoryLock(lockRunner, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
-        const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(ctx.systemDb.unsafeRaw("jsonb @> prefilter over the global users table to count remaining active SystemAdmins"), event.payload.id);
+        const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(ctx.systemDb.unsafeRaw("count remaining active SystemAdmins across the global users table"), event.payload.id);
         if (otherActiveSystemAdmins === 0) {
             return writeFailure(new ConflictError({
                 message: "cannot demote the last active SystemAdmin",

package/dist/user-data-rights/feature.js

@@ -411,7 +411,7 @@ export function createUserDataRightsFeature(opts = {}) {
                 // Discriminator wird via handlerName="user-data-rights:run-export-
                 // jobs" im Secret-Read-Audit erfasst.
                 const exportUserId = ctx._userId ?? SYSTEM_USER_ID;
-                const exportDb = ctx.db.unsafeRaw(RUN_EXPORT_JOBS_REASON); // @cast-boundary db-operator — jobs never run inside a DbTx
+                const exportDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
                 const exportRegistry = ctx.registry;
                 // JobContext carries ctx.meter (raw), not ctx.metrics — that bound
                 // handle only exists on HandlerContext (built per write/query call
@@ -496,7 +496,7 @@ export function createUserDataRightsFeature(opts = {}) {
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
                 const forgetUserId = ctx._userId ?? SYSTEM_USER_ID;
-                const forgetDb = ctx.db.unsafeRaw(RUN_FORGET_CLEANUP_REASON); // @cast-boundary db-operator — jobs never run inside a DbTx
+                const forgetDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
                 const forgetRegistry = ctx.registry;
                 const tenantModel = await resolveAppTenantModel({
                     registry: forgetRegistry,

package/dist/user-data-rights/handlers/cancel-deletion.write.js

@@ -45,7 +45,7 @@ export const cancelDeletionWrite = defineWriteHandler({
         if (!isWithinGracePeriod(row.gracePeriodEnd)) {
             return writeFailure(new UnprocessableError("grace_period_expired"));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), event.user.id, {
+        await updateUserLifecycle(ctx.db.unsafeRaw(), event.user.id, {
             status: USER_STATUS.Active,
             gracePeriodEnd: null,
             // #354/1: closes the replay-after-cancel window — a still-TTL-valid email

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -68,7 +68,7 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
                 secret: opts.deletionTokenSecret,
                 loadPendingRequestId: (userId) => readPendingDeletionRequestId(ctx, userId),
                 commitDeletion: async (userId, requestId) => {
-                    const res = await startDeletionGracePeriod(ctx, userId, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), { pendingDeletionRequestId: requestId });
+                    const res = await startDeletionGracePeriod(ctx, userId, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw(), { pendingDeletionRequestId: requestId });
                     if (!res.ok)
                         return false;
                     gracePeriodEndIso = res.gracePeriodEnd.toString();

package/dist/user-data-rights/handlers/download-by-job.query.js

@@ -61,7 +61,7 @@ export const downloadByJobQuery = defineQueryHandler({
         // Wert (603/2).
         const auditIp = requestContext.get()?.ip ?? null;
         const auditUa = requestContext.get()?.userAgent ?? null;
-        const runner = ctx.db.unsafeRaw(DOWNLOAD_BY_JOB_REASON);
+        const runner = ctx.db.unsafeRaw();
         // Step 1-2: job-lookup + cross-user-isolation
         const jobRow = await fetchOne(runner, exportJobsTable, { id: jobId });
         if (!jobRow || jobRow.userId !== userId) {

package/dist/user-data-rights/handlers/download-by-token.query.js

@@ -64,7 +64,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     handler: async (query, ctx) => {
         const T = getTemporal();
         const now = T.Now.instant();
-        const runner = ctx.db.unsafeRaw(DOWNLOAD_BY_TOKEN_REASON);
+        const runner = ctx.db.unsafeRaw();
         // Step 1: hash + lookup
         const hash = await hashDownloadToken(query.payload.token);
         const tokenRow = await fetchOne(runner, exportDownloadTokensTable, {

package/dist/user-data-rights/handlers/export-status.query.js

@@ -30,7 +30,7 @@ export const exportStatusQuery = defineQueryHandler({
         reason: EXPORT_STATUS_REASON,
     },
     handler: async (query, ctx) => {
-        const rows = await selectMany(ctx.db.unsafeRaw(EXPORT_STATUS_REASON), exportJobsTable, { userId: query.user.id }, { limit: 1, orderBy: { col: "requestedAt", direction: "desc" } });
+        const rows = await selectMany(ctx.db.unsafeRaw(), exportJobsTable, { userId: query.user.id }, { limit: 1, orderBy: { col: "requestedAt", direction: "desc" } });
         const latest = rows[0];
         if (!latest)
             return { hasJob: false };

package/dist/user-data-rights/handlers/lift-restriction.write.js

@@ -5,8 +5,6 @@ import { USER_STATUS, userTable } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.js";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
 const LIFT_RESTRICTION_ESCAPE_HATCH_REASON = "checks the target user's membership in the admin's tenant and appends the user lifecycle status change on the SYSTEM_TENANT_ID user stream, both via DbRunner helpers outside the admin's own tenant scope.";
-const CHECK_TARGET_MEMBERSHIP_REASON = "checks the target user's membership in the admin's tenant via the DbRunner helper";
-const APPEND_LIFECYCLE_EVENT_REASON = "appends the user lifecycle event on the SYSTEM_TENANT_ID user stream";
 // POST /api/user/lift-restriction (S2.U6) — DSGVO Art. 18 Reverse.
 //
 // Operator-only. A Restricted user's own session is unconditionally
@@ -38,7 +36,7 @@ export const liftRestrictionWrite = defineWriteHandler({
     },
     handler: async (event, ctx) => {
         const targetUserId = event.payload.userId;
-        const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(CHECK_TARGET_MEMBERSHIP_REASON), event.user, targetUserId);
+        const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(), event.user, targetUserId);
         if (outside)
             return outside;
         const userRow = await ctx.db.global(userTable).fetchOne({
@@ -55,7 +53,7 @@ export const liftRestrictionWrite = defineWriteHandler({
                 details: { currentStatus },
             }));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), targetUserId, {
+        await updateUserLifecycle(ctx.db.unsafeRaw(), targetUserId, {
             status: USER_STATUS.Active,
         });
         return {

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -53,7 +53,7 @@ export const myAuditLogQuery = defineQueryHandler({
         }
         if (p.before)
             where["id"] = { lt: BigInt(p.before) };
-        const rows = await selectMany(ctx.db.unsafeRaw(MY_AUDIT_LOG_REASON), eventsTable, where, {
+        const rows = await selectMany(ctx.db.unsafeRaw(), eventsTable, where, {
             orderBy: { col: "id", direction: "desc" },
             limit: p.limit,
         });

package/dist/user-data-rights/handlers/request-deletion-by-email.write.js

@@ -57,7 +57,7 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
             // user-Row landet und in die Token-HMAC-Purpose gefaltet wird. cancel
             // nullt sie → ein nach Cancel nachgespieltes Token verifiziert nicht mehr.
             const requestId = crypto.randomUUID();
-            await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), userRow["id"], {
+            await updateUserLifecycle(ctx.db.unsafeRaw(), userRow["id"], {
                 pendingDeletionRequestId: requestId,
             });
             const { token, expiresAt } = signDeletionToken(userRow["id"], requestId, DELETION_VERIFY_TTL_MINUTES, opts.deletionTokenSecret);

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -29,7 +29,7 @@ export function createRequestDeletionHandler(opts = {}) {
         description: "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
         agent: { risk: "high" },
         handler: async (event, ctx) => {
-            const res = await startDeletionGracePeriod(ctx, event.user.id, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"));
+            const res = await startDeletionGracePeriod(ctx, event.user.id, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw());
             if (!res.ok)
                 return writeFailure(res.error);
             const { gracePeriodEnd, userEmail, userLocale } = res;

package/dist/user-data-rights/handlers/request-export.write.js

@@ -58,7 +58,7 @@ export const requestExportWrite = defineWriteHandler({
         const userId = event.user.id;
         const T = getTemporal();
         const now = T.Now.instant();
-        const exportJobRunner = ctx.db.unsafeRaw(REQUEST_EXPORT_REASON);
+        const exportJobRunner = ctx.db.unsafeRaw();
         // Pre-Check: exportJobRunner bypasses the TenantDb-Filter — the
         // TenantDb-Wrapper would hide cross-tenant jobs.
         const existing = await findActiveJob(exportJobRunner, userId);

package/dist/user-data-rights/handlers/restrict-account.write.js

@@ -59,7 +59,7 @@ export const restrictAccountWrite = defineWriteHandler({
                     details: { reason: "admin_required_for_other_user" },
                 }));
             }
-            const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw("checks the target user's membership in the admin's tenant via the DbRunner helper"), event.user, targetUserId);
+            const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(), event.user, targetUserId);
             if (outside)
                 return outside;
         }
@@ -82,7 +82,7 @@ export const restrictAccountWrite = defineWriteHandler({
                 details: { currentStatus },
             }));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), targetUserId, { status: USER_STATUS.Restricted });
+        await updateUserLifecycle(ctx.db.unsafeRaw(), targetUserId, { status: USER_STATUS.Restricted });
         // Cross-Feature: alle live sessions revoken — sonst koennte der User
         // mit existierendem JWT bis zur Token-Expiry weiter schreiben.
         // ctx.writeAs(systemUser, ...) damit der privileged-Handler die

package/dist/user-data-rights/handlers/run-forget-cleanup.write.js

@@ -36,7 +36,7 @@ export function createRunForgetCleanupHandler(opts = {}) {
                 }));
             }
             const T = getTemporal();
-            const runner = ctx.db.unsafeRaw(RUN_FORGET_CLEANUP_REASON);
+            const runner = ctx.db.unsafeRaw();
             // Operator-triggered forget must also erase binaries, not just rows —
             // it flips users to Deleted, after which the cron never re-processes
             // them, so a row-only delete here would permanently leak the binaries.

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -18,7 +18,7 @@ import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
 // NICHT `event.user.tenantId` (das ist der aktive Tenant zur Lifecycle-Zeit und
 // kann abweichen).
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
-// `conn` is ctx.db.unsafeRaw(reason) (regular handlers) or the open tx
+// `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
 // (forget-cleanup sub-tx) — keeps the event append atomic with the write.
 //
 // Returns `{ applied: false }` instead of throwing only when `options.expect`

package/dist/workflow-runner/db/queries/due-runs.d.ts

@@ -1,8 +1,7 @@
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 export type DueRow = {
-    readonly run_id: string;
-    readonly step_index: number;
+    readonly runId: string;
+    readonly stepIndex: number;
 };
 export declare const DUE_RUNS_BATCH_SIZE = 100;
-export declare function selectDueWorkflowRunPending(db: DbConnection, tenantId: TenantId): Promise<readonly DueRow[]>;
+export declare function selectDueWorkflowRunPending(db: TenantDb): Promise<readonly DueRow[]>;

package/dist/workflow-runner/db/queries/due-runs.js

@@ -1,4 +1,5 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { sql } from "@cosmicdrift/kumiko-framework/db";
+import { workflowRunPendingTable } from "../../tables.js";
 // Oldest first and capped, so a backlog after an outage drains over several
 // ticks instead of holding one tick's `concurrency: "skip"` slot for minutes.
 export const DUE_RUNS_BATCH_SIZE = 100;
@@ -6,7 +7,7 @@ export const DUE_RUNS_BATCH_SIZE = 100;
 // (ctx.tryAppendEvent on WORKFLOW_RESUMED) — a second dispatch for the same
 // row loses that race and no-ops. No row locks: in an autocommit statement
 // they would be released right after the SELECT and guard nothing.
-export async function selectDueWorkflowRunPending(db, tenantId) {
-    // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup
-    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now() ORDER BY wake_at ASC LIMIT ${DUE_RUNS_BATCH_SIZE}`, [tenantId]));
+// `now()` stays the DB clock so job-host clock skew cannot mark rows due early.
+export function selectDueWorkflowRunPending(db) {
+    return db.selectMany(workflowRunPendingTable, { wakeAt: { lt: sql `now()` } }, { orderBy: { col: "wakeAt", direction: "asc" }, limit: DUE_RUNS_BATCH_SIZE });
 }

package/dist/workflow-runner/event-subscriber.js

@@ -20,7 +20,7 @@
 // This subscriber never resumes a run itself (D3, workflow-resume-loop.md):
 // the MultiStreamApplyContext it runs in has no callFeature/runStepList
 // access, only unsafeAppendEvent/loadAggregate. It writes triggerEventType
-// + triggerPayload + wakeAt=now() onto the matching pending row(s); the
+// + triggerEventRef + wakeAt=now() onto the matching pending row(s); the
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -66,7 +66,11 @@ const wakeupApply = async (event, tx) => {
             continue;
         await updateMany(tx, workflowRunPendingTable, {
             triggerEventType: event.type,
-            triggerPayload: event.payload,
+            triggerEventRef: {
+                eventId: event.id,
+                aggregateId: event.aggregateId,
+                version: event.version,
+            },
             wakeAt: getTemporal().Now.instant().toString(),
         }, { tenantId: row.tenantId, runId: row.runId, stepIndex: row.stepIndex });
     }

package/dist/workflow-runner/event-trigger.js

@@ -69,6 +69,11 @@ export function registerEventTrigger(r, workflow) {
                         runId,
                         workflow,
                         triggerEvent,
+                        triggerEventRef: {
+                            eventId: event.id,
+                            aggregateId: event.aggregateId,
+                            version: event.version,
+                        },
                         ...(idempotencyKey && { idempotencyKey }),
                         // @cast-boundary msp-to-handler-ctx — MultiStreamApplyContext only
                         // exposes unsafeAppendEvent/loadAggregate, a subset of

package/dist/workflow-runner/feature.js

@@ -57,21 +57,19 @@ export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
             // skip: cron fired without a perTenant fan-out tenant — nothing scoped
             return;
         }
-        ctx.systemDb.assertTenantMatch(tenantId);
-        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.unsafeRaw("due-row pickup needs FOR UPDATE SKIP LOCKED raw SQL; the query filters by this job's tenantId"), // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
-        tenantId);
+        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
         for (const row of dueRows) {
             try {
                 await ctx.write("workflow-runner:write:resume-run", {
-                    runId: row.run_id,
-                    stepIndex: row.step_index,
+                    runId: row.runId,
+                    stepIndex: row.stepIndex,
                 });
             }
             catch (error) {
                 // skip: one row's dispatch failing (infra hiccup, not a business
                 // outcome — resume-run itself never throws for expected cases)
                 // must not stop the rest of this tenant's due rows from resuming.
-                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.run_id} stepIndex=${row.step_index} dispatch failed: ${String(error)}`);
+                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
             }
         }
     });