@cosmicdrift/kumiko-bundled-features 0.339.0 → 0.341.0

package/dist/workflow-runner/db/queries/due-runs.js

@@ -1,4 +1,5 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { sql } from "@cosmicdrift/kumiko-framework/db";
+import { workflowRunPendingTable } from "../../tables.js";
 // Oldest first and capped, so a backlog after an outage drains over several
 // ticks instead of holding one tick's `concurrency: "skip"` slot for minutes.
 export const DUE_RUNS_BATCH_SIZE = 100;
@@ -6,7 +7,7 @@ export const DUE_RUNS_BATCH_SIZE = 100;
 // (ctx.tryAppendEvent on WORKFLOW_RESUMED) — a second dispatch for the same
 // row loses that race and no-ops. No row locks: in an autocommit statement
 // they would be released right after the SELECT and guard nothing.
-export async function selectDueWorkflowRunPending(db, tenantId) {
-    // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup
-    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now() ORDER BY wake_at ASC LIMIT ${DUE_RUNS_BATCH_SIZE}`, [tenantId]));
+// `now()` stays the DB clock so job-host clock skew cannot mark rows due early.
+export function selectDueWorkflowRunPending(db) {
+    return db.selectMany(workflowRunPendingTable, { wakeAt: { lt: sql `now()` } }, { orderBy: { col: "wakeAt", direction: "asc" }, limit: DUE_RUNS_BATCH_SIZE });
 }

package/dist/workflow-runner/feature.js

@@ -57,21 +57,19 @@ export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
             // skip: cron fired without a perTenant fan-out tenant — nothing scoped
             return;
         }
-        ctx.systemDb.assertTenantMatch(tenantId);
-        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.unsafeRaw("due-row pickup needs FOR UPDATE SKIP LOCKED raw SQL; the query filters by this job's tenantId"), // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
-        tenantId);
+        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
         for (const row of dueRows) {
             try {
                 await ctx.write("workflow-runner:write:resume-run", {
-                    runId: row.run_id,
-                    stepIndex: row.step_index,
+                    runId: row.runId,
+                    stepIndex: row.stepIndex,
                 });
             }
             catch (error) {
                 // skip: one row's dispatch failing (infra hiccup, not a business
                 // outcome — resume-run itself never throws for expected cases)
                 // must not stop the rest of this tenant's due rows from resuming.
-                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.run_id} stepIndex=${row.step_index} dispatch failed: ${String(error)}`);
+                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
             }
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.339.0",
+  "version": "0.341.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -465,6 +465,10 @@
       "types": "./dist/legal-pages/web/index.d.ts",
       "default": "./dist/legal-pages/web/index.js"
     },
+    "./waitlist": {
+      "types": "./dist/waitlist/index.d.ts",
+      "default": "./dist/waitlist/index.js"
+    },
     "./page-render": {
       "types": "./dist/page-render/index.d.ts",
       "default": "./dist/page-render/index.js"
@@ -499,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.339.0",
-    "@cosmicdrift/kumiko-framework": "0.339.0",
-    "@cosmicdrift/kumiko-headless": "0.339.0",
-    "@cosmicdrift/kumiko-renderer": "0.339.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.339.0",
-    "@cosmicdrift/kumiko-types": "0.339.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.341.0",
+    "@cosmicdrift/kumiko-framework": "0.341.0",
+    "@cosmicdrift/kumiko-headless": "0.341.0",
+    "@cosmicdrift/kumiko-renderer": "0.341.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.341.0",
+    "@cosmicdrift/kumiko-types": "0.341.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -975,6 +979,10 @@
         "types": "./dist/legal-pages/web/index.d.ts",
         "default": "./dist/legal-pages/web/index.js"
       },
+      "./waitlist": {
+        "types": "./dist/waitlist/index.d.ts",
+        "default": "./dist/waitlist/index.js"
+      },
       "./page-render": {
         "types": "./dist/page-render/index.d.ts",
         "default": "./dist/page-render/index.js"
@@ -1017,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.339.0",
-    "@cosmicdrift/kumiko-locale-es": "0.339.0",
+    "@cosmicdrift/kumiko-locale-de": "0.341.0",
+    "@cosmicdrift/kumiko-locale-es": "0.341.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "Invitations can carry a global role (SystemAdmin), granted only on accept",
+    "detail": "New system-only handler auth-email-password:write:system-invite-create and bootstrapTenants() for idempotent passwordless provisioning. Tenant admins cannot set global roles; a re-invite clears a pending one.",
+    "migration": "New column read_tenant_invitations.global_roles: run `kumiko schema generate` and apply the migration before deploying."
+  },
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "runBootstrap applies per-tenant config",
+    "detail": "BootstrapTenant.config sets tenant-scope config keys as system writes on every run; a value that already matches is not rewritten."
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "System invite refuses to reset an accepted invitation (invite_already_accepted)"
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "MFA required policy is writable by the system only",
+    "migration": "Tenant admins can no longer write auth-mfa:config:required (write access is now system-only). Set the app-wide default with createAuthMfaFeature({ requiredPolicy }) / the mfa options and per-tenant overrides with runBootstrap tenants[].config or a system write (createSystemUser). Code that wrote the key as TenantAdmin/Admin/SystemAdmin over HTTP must switch to one of these."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/billing-foundation/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "App layout around termination pages, trailing-slash redirects, receipt greeting",
+    "detail": "`createContractTerminationRoutes` accepts a `wrapLayout`, the same function `createLegalPagesFeature` takes. It wraps every termination page (form, review, result, 429, error); the security headers stay with the framework. The layout also receives `alternates`, a map from locale to the path of the same page, so it can render a language switch from plain links. `page-render` exports the shared type `PublicPageWrapLayout`; `LegalPagesWrapLayout` is now an alias of it. The page body sits in `<div data-kumiko-page=\"contract-termination\">` with `data-kumiko-*` hooks on the form, field groups, buttons and review table. The page CSP keeps `script-src 'none'`, so a layout must not rely on JavaScript.\nThe default `wrapInLayout` stylesheet gains base rules for input, select, textarea and button, so unstyled forms stay readable.\nThe termination pages and every legal page now answer the other trailing-slash form of their path (`/legal/kuendigen/`, `/legal/impressum/`) with a 301 to the configured path for GET and HEAD, query string kept. POST has no alias.\nThe termination receipt mail text changed: it now starts with a greeting line (\"Hallo,\" / \"Hello,\") and the English sentence starts capitalized (\"We confirm receipt ...\"). The receipt content still depends only on the declarant's input."
+  },
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "Payment and subscription projections use typed bun-db helpers",
+    "detail": "`payment-received` inserts through `insertOnConflictDoNothing`, subscription events upsert through `upsertOnConflict`. The raw `db/queries/payment-projection.ts` and `subscription-projection.ts` modules are gone.",
+    "migration": "keine"
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/channel-telegram/changes.json

@@ -0,0 +1,9 @@
+[
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "Telegram apiBaseUrl must match allowedHosts and use https",
+    "detail": "`ctx.secrets.set` now runs the same `valueSchema` check as `secrets:write:set` and throws the same validation error (`secrets.errors.invalidValue`, never carrying the value) before anything is encrypted or stored. `createSecretsContext` takes a required `registry` option that supplies the declared schemas; `runProdApp`, `runDevApp` and `setupTestStack` setups pass the booted registry.\n`createChannelTelegramFeature` takes `allowedHosts` (default `[\"api.telegram.org\"]`) and `requireHttps` (default `true`), like the other chat channels. Boot fails when the host of `apiBaseUrl` is not in `allowedHosts` or the URL is not https while `requireHttps` is on. Before, the host of `apiBaseUrl` was its own allowlist and https was only required when the URL already started with `https:`.",
+    "migration": "An app that sets a custom apiBaseUrl (self-hosted Bot API server, local test server) must also pass allowedHosts: [\"<host>\"], plus requireHttps: false for plain http. Without it the app fails at boot."
+  }
+]

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "Chat channels deliver in production boot, ctx.notify returns a NotifyResult",
+    "detail": "Chat channels (slack, discord, teams, telegram) now deliver in production boot. `runProdApp`, `runDevApp` and `runWorkerApp` pass the tenant secrets to the delivery service and hand queued channels to the `delivery.render`/`delivery.send` jobs of the calling context's job runner. `delivery.render` now receives `ctx.secrets` as well. Without a job runner, queued channels still deliver inline, now with secrets. `runBootstrap` is a one-shot process whose queue nobody drains after it exits, so it keeps delivering queued channels inline (the SystemAdmin invitation goes out before the process ends).\n`NotifyFn` returns a `NotifyResult` (`{ deliveries }` with channel, recipientId, status `queued | sent | failed | skipped`, error and `deliveryAttemptId` per delivery) instead of `void`. `NotifyOptions.immediate` delivers queued channels inline for one call and bypasses job retry, for \"send test message\" handlers. `NotifyFactory` takes an optional job dispatcher as third argument, and `DeliveryService.notify` an optional per-call dispatcher.\nConsumers: `NotifyFn` implementations in tests and mocks must now return a `NotifyResult`, e.g. `async () => ({ deliveries: [] })`. When running the API without a worker (`runSingleInstance: false`), a dedicated worker must process the delivery jobs.",
+    "migration": "NotifyFn implementations in tests and mocks must return a NotifyResult, e.g. async () => ({ deliveries: [] }). Queued channels now run through the delivery jobs in production; an API-only deployment (runSingleInstance: false) needs a worker that mounts delivery and the channel features."
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/files/changes.json

@@ -1 +1,13 @@
-[]
+[
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Uploads resolve a generic content type from the file content",
+    "detail": "POST /api/files now resolves application/octet-stream or a missing type from the bytes (PDF, XML, PNG, JPEG, GIF, WebP, ZIP) and falls back to the file extension. A concrete declared type is never overridden. The shared helper resolveContentType is exported from the files module."
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "Uploads without entityId no longer produce an empty storage key segment"
+  }
+]

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "Inbound mail projections use typed bun-db helpers",
+    "detail": "Mail-account and mail-thread events upsert through `upsertOnConflict` (`connectedAt` is only written on insert), inbound messages insert through `insertOnConflictDoNothing`. The raw `db/queries/inbound-projections.ts` module is gone.",
+    "migration": "keine"
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Localized mail branding, locale through delivery, logoPath",
+    "detail": "`ctx.notify` accepts `locale`, and the locale now travels through the delivery jobs (`delivery.render`, `delivery.send`) to `NotificationRenderer.render`, where `RendererInput.locale` is available. Jobs queued before this release have no locale and keep working. The email channel and `renderer-simple` pass it on; the auth mails and the consumer-protection mails set it to the language they already translate their content into. This lands in the same release as the `NotifyOptions` change from #3508.\n`MailBranding` for `renderer-simple` can now be localized: `footerText`, `footerLinks[].label` and `footerLinks[].url` take a plain string or a map of locale to string. The renderer picks the exact locale, then the language part (`de-AT` falls back to `de`), then the new optional `MailBranding.defaultLocale`, then the first entry. Every URL in a map must be an absolute http(s) URL, otherwise `createSimpleRenderer` throws at boot. Without a locale and with plain strings the HTML is unchanged.\n`MailBranding` also gets `logoPath` and `baseUrl`, so an app can point at a raster logo on its own origin (`logoPath: \"/logo.png\"`, `baseUrl` the same base as `auth.mail.baseUrl`). `logoPath` and `logoUrl` exclude each other, `logoPath` needs a valid `baseUrl`, must start with a single `/` and must stay on the base origin; violations throw at boot. Use PNG or JPEG, because mail clients block SVG."
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/secrets/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Chat channel secret values are validated on write",
+    "detail": "`r.secret` and `r.secretNamespace` accept a `valueSchema`. `secrets:write:set` checks the value against it after the key and role checks and answers a failure with a 400 validation error on field `value` (`secrets.errors.invalidValue`); the response never contains the value or the schema's issues. `secrets:write:delete` is unaffected.\nThe chat channels use it: Slack, Discord and Teams webhook secrets must be URLs that pass the channel's host allowlist (including the Discord `/api/webhooks/` path), and the Telegram bot token must have the `<bot id>:<secret>` shape. The allowlist comes from the same options as the channel, so `createChannelSlackFeature({ allowedHosts })` also governs what can be stored.\n`channel-slack`, `channel-discord`, `channel-teams` and `channel-telegram` now export their secret keys (`SLACK_SECRET_KEYS`, `DISCORD_SECRET_KEYS`, `TEAMS_SECRET_KEYS`, `TELEGRAM_SECRET_KEYS`), allowlist constants and `isTelegramChatId` / `isTelegramBotToken`. `delivery` exports `checkChatWebhookTarget`, `chatWebhookUrlSchema` and `resolveChatWebhookTarget`, so apps can validate an address or URL when a user creates a channel.\nExisting invalid secrets stay stored; only new writes are checked. Writes through `ctx.secrets.set` in feature code run through the same check."
+  },
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "ctx.secrets.set validates against the declared valueSchema",
+    "migration": "Code that calls createSecretsContext({ db, masterKeyProvider }) must also pass registry (the booted Registry). Programmatic ctx.secrets.set calls with a value that fails the key's valueSchema now throw a ValidationError instead of storing it."
+  },
   {
     "version": "0.337.0",
     "type": "breaking",

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Harden system role, invitations query, tenant teardown and addMember",
+    "detail": "The system role can no longer be minted into a session through a user's global roles. invitations.query returns an explicit field allowlist and exposes globalRoles only to a SystemAdmin. The tenant destruction sweep waits 60 seconds after the grace period ends so the teardown gate can settle. Behaviour change: tenant:write:addMember now adds members to a foreign tenant only from the framework system context; a SystemAdmin request user is limited to their own tenant and gets 403 otherwise."
+  },
   {
     "version": "0.336.1",
     "type": "fix",

package/src/user/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "The last-SystemAdmin check uses jsonb containment through selectMany",
+    "detail": "Removing the SystemAdmin role still refuses to drop the last active SystemAdmin; the count now comes from `selectMany` with a roles containment filter instead of raw SQL.",
+    "migration": "keine"
+  },
   {
     "version": "0.271.0",
     "type": "improvement",
@@ -8,7 +15,7 @@
   {
     "version": "0.218.1",
     "type": "improvement",
-    "title": "user.email searchable \u2014 reindex required after upgrade",
+    "title": "user.email searchable — reindex required after upgrade",
     "detail": "email gained searchable for roster lookup. buildSearchDocument only runs on write; existing rows need reindexEntity(\"user\") (or the reindex job) plus Meili configure for the new attribute.",
     "migration": "After deploying, run reindexEntity(\"user\") (or the existing reindex job) so pre-upgrade user rows appear in roster search."
   },
@@ -16,28 +23,28 @@
     "version": "0.218.0",
     "type": "fix",
     "title": "user-list: system-scope search; membership roles on tenants; emailVerified sort",
-    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant \u2192 Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only \u2014 TenantAdmin/Admin live on membership (Team \u2192 Members)."
+    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant → Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only — TenantAdmin/Admin live on membership (Team → Members)."
   },
   {
     "version": "0.217.0",
     "type": "improvement",
     "title": "user-list: roles multiSelect + tenants column; roles editable as SystemAdmin (fw#2384 follow-up)",
-    "detail": "user.roles is now createMultiSelectField (jsonb string[], options=[SystemAdmin]) so entityEdit shows a real multi-select instead of a raw JSON text box \u2014 SystemAdmins can promote another SystemAdmin from the UI. user-list columns gain roles + tenants; tenants is a derived field filled by the list handler from memberships (platform roster was unusable without tenant context). switch-tenant + auth-client parseRoles accept jsonb arrays (string-only deserialize dropped SystemAdmin on tenant switch). Soft-deleted users stay hidden by default.",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 migrates read_users.roles from text to jsonb USING roles::jsonb. Existing JSON array strings (`[]`, `[\"SystemAdmin\"]`) convert cleanly. Consumers that wrote roles as a JSON-encoded string via user:create/update should pass string[] instead (parseRoles still accepts both on read)."
+    "detail": "user.roles is now createMultiSelectField (jsonb string[], options=[SystemAdmin]) so entityEdit shows a real multi-select instead of a raw JSON text box — SystemAdmins can promote another SystemAdmin from the UI. user-list columns gain roles + tenants; tenants is a derived field filled by the list handler from memberships (platform roster was unusable without tenant context). switch-tenant + auth-client parseRoles accept jsonb arrays (string-only deserialize dropped SystemAdmin on tenant switch). Soft-deleted users stay hidden by default.",
+    "migration": "Run `kumiko-schema generate` and apply — migrates read_users.roles from text to jsonb USING roles::jsonb. Existing JSON array strings (`[]`, `[\"SystemAdmin\"]`) convert cleanly. Consumers that wrote roles as a JSON-encoded string via user:create/update should pass string[] instead (parseRoles still accepts both on read)."
   },
   {
     "version": "0.167.1",
     "type": "breaking",
     "title": "user.locale no longer defaults to \"de\" (fw#1637).",
     "detail": "The entity-level default contradicted tenant-settings' own \"en\" default and silently overrode any app or tenant locale configuration for every new user. locale now stays unset until the client or a resolution chain provides one. Consumers that already fall back with `user.locale ?? \"en\"` are unaffected in shape but now see null instead of \"de\".",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain \u2014 the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
+    "migration": "Run `kumiko-schema generate` and apply — the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain — the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
   },
   {
     "version": "0.167.1",
     "type": "improvement",
     "title": "user.timezone field, wired into ctx.tz (fw#1636).",
     "detail": "The user entity gains a `timezone` field (createTzField, no default). buildHandlerContext passes it to ctx.tz.user; the fallback chain stays tenant.timezone, then \"UTC\". Before this, ctx.tz.tenant and ctx.tz.user both hardcoded \"UTC\" while the plumbing already accepted per-request values.",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
+    "migration": "Run `kumiko-schema generate` and apply — the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
   },
   {
     "version": "0.165.3",

package/src/waitlist/changes.json

@@ -0,0 +1,17 @@
+[
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Waitlist submit is limited per email address"
+  },
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Add waitlist bundled feature: public signup intake with admin invite and reject, GDPR export and erasure"
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "Waitlist re-invite and reject no longer touch an invitee who already accepted"
+  }
+]

package/src/workflow-runner/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "The resume job reads due runs through the job's TenantDb",
+    "detail": "`selectDueWorkflowRunPending` takes a `TenantDb` and returns `{ runId, stepIndex }` rows, so the tenant filter comes from the TenantDb instead of a hand-written `WHERE tenant_id`.",
+    "migration": "keine"
+  },
   {
     "version": "0.339.0",
     "type": "breaking",

package/dist/billing-foundation/db/queries/payment-projection.d.ts

@@ -1,2 +0,0 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-export declare function insertPaymentProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>): Promise<void>;

package/dist/billing-foundation/db/queries/payment-projection.js

@@ -1,13 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-// INSERT-once, not UPSERT: unlike subscriptionsProjectionTable (one row per
-// tenant, state overwritten on every event), a payment row is an immutable
-// fact keyed by paymentRowId(tenantId, providerName, providerEventId) — ON
-// CONFLICT DO NOTHING makes a projection rebuild/replay idempotent without
-// ever mutating an existing row.
-export async function insertPaymentProjectionRow(tx, tableName, insertCols) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO NOTHING`;
-    // kumiko-lint-ignore raw-sql tableName + column keys are code-controlled, not user input: tableName is buildEntityTable()'s static table name and insertKeys come from applyPaymentReceived's hardcoded object-literal columns in projection.ts — only values flow through $1..$n
-    await asRawClient(tx).unsafe(sqlText, Object.values(insertCols));
-}

package/dist/billing-foundation/db/queries/subscription-projection.d.ts

@@ -1,2 +0,0 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-export declare function upsertSubscriptionProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>, setClauses: readonly string[], params: readonly unknown[]): Promise<void>;

package/dist/billing-foundation/db/queries/subscription-projection.js

@@ -1,7 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-export async function upsertSubscriptionProjectionRow(tx, tableName, insertCols, setClauses, params) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO UPDATE SET ${setClauses.join(", ")}`;
-    await asRawClient(tx).unsafe(sqlText, params);
-}

package/dist/inbound-mail-foundation/db/queries/inbound-projections.d.ts

@@ -1,7 +0,0 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-/** INSERT ... ON CONFLICT ("id") DO UPDATE SET <setClauses>. */
-export declare function upsertProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>, setClauses: readonly string[], params: readonly unknown[]): Promise<void>;
-/** INSERT ... ON CONFLICT ("id") DO NOTHING — für append-only-Rows
- *  (inbound-message: genau EIN received-event pro Stream, Replays
- *  no-op'en auf der PK). */
-export declare function insertIgnoreProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>): Promise<void>;

package/dist/inbound-mail-foundation/db/queries/inbound-projections.js

@@ -1,24 +0,0 @@
-// Raw-SQL-Helper für die inline projections — Muster
-// billing-foundation/db/queries/subscription-projection.ts.
-//
-// Warum raw statt drizzle-insert: die apply-fns laufen in der event-TX
-// mit einem DbRunner, und die ON-CONFLICT-Semantik (UPSERT vs.
-// DO NOTHING) ist der fachliche Kern — explizit hingeschrieben statt
-// hinter einem ORM-Builder versteckt.
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-/** INSERT ... ON CONFLICT ("id") DO UPDATE SET <setClauses>. */
-export async function upsertProjectionRow(tx, tableName, insertCols, setClauses, params) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO UPDATE SET ${setClauses.join(", ")}`;
-    await asRawClient(tx).unsafe(sqlText, params);
-}
-/** INSERT ... ON CONFLICT ("id") DO NOTHING — für append-only-Rows
- *  (inbound-message: genau EIN received-event pro Stream, Replays
- *  no-op'en auf der PK). */
-export async function insertIgnoreProjectionRow(tx, tableName, insertCols) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO NOTHING`;
-    await asRawClient(tx).unsafe(sqlText, Object.values(insertCols));
-}